From nobody Sun Apr 12 06:09:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linaro.org ARC-Seal: i=1; a=rsa-sha256; t=1771497403; cv=none; d=zohomail.com; s=zohoarc; b=nbKFDglDSldhB5DiwqUNTTy3HsWGqOrb+1fO8Z7lkL4AdywCuzQosJmWq4EP07trbeVkn+fj2sflkPq7ZfwdpfD3QS6K1LbCGZjfR7hb9Ls2z88Ps7+x+Fq+SIWNVNRw5ksIxuYOQ+0LelmEf9izDHLEGBltyt0qwXgQ1fO5r9g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1771497403; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=mfCDIFdRUVutujvkRIe+imF240VJMOiVp5FL3KJ7/zY=; b=cP583rPMVDOohSr18ELRkcaZxkgC1aYNulPK6S8fjmwfw57u9lZIlVRJhMUlDnjE7OIWAvvEPyfXc5ID7HOfUquWAxlCl86mkZXlAfHSE17oAKVAv2B8qE00f4rKYa7jXE8AGqoJpW9/H0WzzLerr/s5t0aQJoAWI60CDKvkt8c= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1771497403904182.9559156508741; Thu, 19 Feb 2026 02:36:43 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vt1Mj-0007Kt-3V; Thu, 19 Feb 2026 05:34:37 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vt1Mg-0007IQ-2r for qemu-devel@nongnu.org; Thu, 19 Feb 2026 05:34:34 -0500 Received: from mail-wm1-x32f.google.com ([2a00:1450:4864:20::32f]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1vt1MY-00066e-5J for qemu-devel@nongnu.org; Thu, 19 Feb 2026 05:34:31 -0500 Received: by mail-wm1-x32f.google.com with SMTP id 5b1f17b1804b1-4838c15e3cbso6565535e9.3 for ; Thu, 19 Feb 2026 02:34:25 -0800 (PST) Received: from lanath.. (wildly.archaic.org.uk. [81.2.115.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4834d5ebd34sm697630795e9.7.2026.02.19.02.34.23 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Feb 2026 02:34:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1771497265; x=1772102065; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=mfCDIFdRUVutujvkRIe+imF240VJMOiVp5FL3KJ7/zY=; b=BQjQjrI4OSfNR56Dg4Uc9yzTxPwwIMzsPCLqackCJGTo6ghZZhhBbbDC807Gs7aI9j 3woIk3UnesIh9aRKgkCKu3WqapS6RjvhmsQU9PDSO8ql+rd75gREQowRu6VKnp1DiNp2 Yzzk5Q76IX3unD/YHH4AKR/LpfVWURjxm5hD/7heXRbaYOHh6YuHEuNOn4aKvZc1UIoJ R8B5kxACBsZGlzuz19rkoirnS2pg3H2nyQ392ufI69A4r19n77TPbRCl37j9qmbsNAKb Mtof98Vo8OOh1y2JHoL/bFf0L9wBz80LYP9WRj5lfLA0mJinWmBH1fyVXuGJqNTvo01Q d/vw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771497265; x=1772102065; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=mfCDIFdRUVutujvkRIe+imF240VJMOiVp5FL3KJ7/zY=; b=DmbkqSVRXeltc6gi1+103+8CrP/jvKzjqAGWXAO4Dd4bLU2+iHzhL7fkCOZo4hWnjX 5VEDbuJyuIWIwgGDPbsjC61WTju/FtC17+p0XlQ51lJr/YmRB1k/nu4f97AAoIugTqI3 uIY5kdcxjO+xnkdNetV8SzG+JaCL93/2Juak63niJnCA1nZw3ivTNJjH6qU5+8DqNztQ 66QQnYd863gN4yLT3eV3vBAAe0YJ+GK/F73eHyGsy6MPZj6W4f7DUMKvLdVkaGxXvrmJ tGnnJz/5MajeTc1R+lvEKFx79to3WtYdKszc3KcC4pjeCo8bRWrQVAYYKQDlk32R4fYZ gAiQ== X-Gm-Message-State: AOJu0Yw3A7c8ZL+obTGlndyBgcNXsq28wpNvguAa9c4Tt+jogusxjr84 yvGwy5Ng3guMIIM8jpGX0cTNoOFszFxdfXsMHGW/6N23c+YtnG8a9FQpqUg9V5K4Z/stnCnTfc3 YRH2Q X-Gm-Gg: AZuq6aK5atIrbqhAaTpdDKLPKnDEhkNILOA62SaoiVoajeKVKuOfOmktW7ySaVSRXHi PTYbkaFJkrbWODHie9Xn7ejqz7cT4NIQgmVQEVl8iO2sIum5aY1x9pDk+ZBHJfDSlHAIrqs+GUb BnPRc4P4fZWivJT776S+UYF5obfoSUq15yjj3ztHQQYphwQ1FkbfFuGowKZFO4rltAVFXbPDOEN JAUaqfdHII806w5xlwrRtW2LFJHxXnwcpnioujsu8VwXiOH1b6CUY5lo0b0AFhBt1i4w4jEljYd 0dTFLZOW4qaB2MqiVfDH334iynPq9aLAt/eDFfXDgle4BYOh1WauCNPlyY3HHvO2J9XG6xCgUW4 UikMyARKEc9a2TOKbEDisrfCXR4Y4nKCX0PEnijs4wg5xg8baho13coGoV1BPBFukRTgeP7IDSU dhmxYDPXRQ0cmXo6ysyvw3cXE850rSy+q+NJNjmj4NyvxS/dChs2IO5xDO3ODiQ/BfRsz1XIbDE RYKcls1g/AmyW+kj+PxsrtBYJ/+tJs= X-Received: by 2002:a05:600c:620d:b0:480:3bba:1cac with SMTP id 5b1f17b1804b1-48371043046mr306802735e9.6.1771497264194; Thu, 19 Feb 2026 02:34:24 -0800 (PST) From: Peter Maydell To: qemu-devel@nongnu.org Subject: [PULL 19/32] target/arm: Move TCG-specific code out of debug_helper.c Date: Thu, 19 Feb 2026 10:33:52 +0000 Message-ID: <20260219103405.3793357-20-peter.maydell@linaro.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260219103405.3793357-1-peter.maydell@linaro.org> References: <20260219103405.3793357-1-peter.maydell@linaro.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::32f; envelope-from=peter.maydell@linaro.org; helo=mail-wm1-x32f.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linaro.org) X-ZM-MESSAGEID: 1771497406126154100 Content-Type: text/plain; charset="utf-8" The target/arm/debug_helper.c file has some code which we need for non-TCG accelerators, but quite a lot which is guarded by a CONFIG_TCG ifdef. Move all this TCG-only code out to a new file target/arm/tcg/debug.c. In particular all the code requiring access to the TCG helper function prototypes is in the moved code, so we can drop the use of tcg/helper.h from debug_helper.c. Signed-off-by: Peter Maydell Reviewed-by: Pierrick Bouvier Reviewed-by: Richard Henderson Signed-off-by: Pierrick Bouvier Message-id: 20260219040150.2098396-2-pierrick.bouvier@linaro.org Signed-off-by: Peter Maydell --- target/arm/debug_helper.c | 769 --------------------- target/arm/{debug_helper.c =3D> tcg/debug.c} | 544 +-------------- target/arm/tcg/meson.build | 2 + 3 files changed, 4 insertions(+), 1311 deletions(-) copy target/arm/{debug_helper.c =3D> tcg/debug.c} (53%) diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c index 579516e154..352c8e5c8e 100644 --- a/target/arm/debug_helper.c +++ b/target/arm/debug_helper.c @@ -14,775 +14,6 @@ #include "exec/watchpoint.h" #include "system/tcg.h" =20 -#define HELPER_H "tcg/helper.h" -#include "exec/helper-proto.h.inc" - -#ifdef CONFIG_TCG -/* Return the Exception Level targeted by debug exceptions. */ -static int arm_debug_target_el(CPUARMState *env) -{ - bool secure =3D arm_is_secure(env); - bool route_to_el2 =3D false; - - if (arm_feature(env, ARM_FEATURE_M)) { - return 1; - } - - if (arm_is_el2_enabled(env)) { - route_to_el2 =3D env->cp15.hcr_el2 & HCR_TGE || - env->cp15.mdcr_el2 & MDCR_TDE; - } - - if (route_to_el2) { - return 2; - } else if (arm_feature(env, ARM_FEATURE_EL3) && - !arm_el_is_aa64(env, 3) && secure) { - return 3; - } else { - return 1; - } -} - -/* - * Raise an exception to the debug target el. - * Modify syndrome to indicate when origin and target EL are the same. - */ -G_NORETURN static void -raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome) -{ - int debug_el =3D arm_debug_target_el(env); - int cur_el =3D arm_current_el(env); - - /* - * If singlestep is targeting a lower EL than the current one, then - * DisasContext.ss_active must be false and we can never get here. - * Similarly for watchpoint and breakpoint matches. - */ - assert(debug_el >=3D cur_el); - syndrome |=3D (debug_el =3D=3D cur_el) << ARM_EL_EC_SHIFT; - raise_exception(env, excp, syndrome, debug_el); -} - -/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */ -static bool aa64_generate_debug_exceptions(CPUARMState *env) -{ - int cur_el =3D arm_current_el(env); - int debug_el; - - if (cur_el =3D=3D 3) { - return false; - } - - /* MDCR_EL3.SDD disables debug events from Secure state */ - if (arm_is_secure_below_el3(env) - && extract32(env->cp15.mdcr_el3, 16, 1)) { - return false; - } - - /* - * Same EL to same EL debug exceptions need MDSCR_KDE enabled - * while not masking the (D)ebug bit in DAIF. - */ - debug_el =3D arm_debug_target_el(env); - - if (cur_el =3D=3D debug_el) { - return extract32(env->cp15.mdscr_el1, 13, 1) - && !(env->daif & PSTATE_D); - } - - /* Otherwise the debug target needs to be a higher EL */ - return debug_el > cur_el; -} - -static bool aa32_generate_debug_exceptions(CPUARMState *env) -{ - int el =3D arm_current_el(env); - - if (el =3D=3D 0 && arm_el_is_aa64(env, 1)) { - return aa64_generate_debug_exceptions(env); - } - - if (arm_is_secure(env)) { - int spd; - - if (el =3D=3D 0 && (env->cp15.sder & 1)) { - /* - * SDER.SUIDEN means debug exceptions from Secure EL0 - * are always enabled. Otherwise they are controlled by - * SDCR.SPD like those from other Secure ELs. - */ - return true; - } - - spd =3D extract32(env->cp15.mdcr_el3, 14, 2); - switch (spd) { - case 1: - /* SPD =3D=3D 0b01 is reserved, but behaves as 0b00. */ - case 0: - /* - * For 0b00 we return true if external secure invasive debug - * is enabled. On real hardware this is controlled by external - * signals to the core. QEMU always permits debug, and behaves - * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high. - */ - return true; - case 2: - return false; - case 3: - return true; - } - } - - return el !=3D 2; -} - -/* - * Return true if debugging exceptions are currently enabled. - * This corresponds to what in ARM ARM pseudocode would be - * if UsingAArch32() then - * return AArch32.GenerateDebugExceptions() - * else - * return AArch64.GenerateDebugExceptions() - * We choose to push the if() down into this function for clarity, - * since the pseudocode has it at all callsites except for the one in - * CheckSoftwareStep(), where it is elided because both branches would - * always return the same value. - */ -bool arm_generate_debug_exceptions(CPUARMState *env) -{ - if ((env->cp15.oslsr_el1 & 1) || (env->cp15.osdlr_el1 & 1)) { - return false; - } - if (is_a64(env)) { - return aa64_generate_debug_exceptions(env); - } else { - return aa32_generate_debug_exceptions(env); - } -} - -/* - * Is single-stepping active? (Note that the "is EL_D AArch64?" check - * implicitly means this always returns false in pre-v8 CPUs.) - */ -bool arm_singlestep_active(CPUARMState *env) -{ - return extract32(env->cp15.mdscr_el1, 0, 1) - && arm_el_is_aa64(env, arm_debug_target_el(env)) - && arm_generate_debug_exceptions(env); -} - -/* Return true if the linked breakpoint entry lbn passes its checks */ -static bool linked_bp_matches(ARMCPU *cpu, int lbn) -{ - CPUARMState *env =3D &cpu->env; - uint64_t bcr =3D env->cp15.dbgbcr[lbn]; - int brps =3D arm_num_brps(cpu); - int ctx_cmps =3D arm_num_ctx_cmps(cpu); - int bt; - uint32_t contextidr; - uint64_t hcr_el2; - - /* - * Links to unimplemented or non-context aware breakpoints are - * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or - * as if linked to an UNKNOWN context-aware breakpoint (in which - * case DBGWCR_EL1.LBN must indicate that breakpoint). - * We choose the former. - */ - if (lbn >=3D brps || lbn < (brps - ctx_cmps)) { - return false; - } - - bcr =3D env->cp15.dbgbcr[lbn]; - - if (extract64(bcr, 0, 1) =3D=3D 0) { - /* Linked breakpoint disabled : generate no events */ - return false; - } - - bt =3D extract64(bcr, 20, 4); - hcr_el2 =3D arm_hcr_el2_eff(env); - - switch (bt) { - case 3: /* linked context ID match */ - switch (arm_current_el(env)) { - default: - /* Context matches never fire in AArch64 EL3 */ - return false; - case 2: - if (!(hcr_el2 & HCR_E2H)) { - /* Context matches never fire in EL2 without E2H enabled. = */ - return false; - } - contextidr =3D env->cp15.contextidr_el[2]; - break; - case 1: - contextidr =3D env->cp15.contextidr_el[1]; - break; - case 0: - if ((hcr_el2 & (HCR_E2H | HCR_TGE)) =3D=3D (HCR_E2H | HCR_TGE)= ) { - contextidr =3D env->cp15.contextidr_el[2]; - } else { - contextidr =3D env->cp15.contextidr_el[1]; - } - break; - } - break; - - case 7: /* linked contextidr_el1 match */ - contextidr =3D env->cp15.contextidr_el[1]; - break; - case 13: /* linked contextidr_el2 match */ - contextidr =3D env->cp15.contextidr_el[2]; - break; - - case 9: /* linked VMID match (reserved if no EL2) */ - case 11: /* linked context ID and VMID match (reserved if no EL2) */ - case 15: /* linked full context ID match */ - default: - /* - * Links to Unlinked context breakpoints must generate no - * events; we choose to do the same for reserved values too. - */ - return false; - } - - /* - * We match the whole register even if this is AArch32 using the - * short descriptor format (in which case it holds both PROCID and ASI= D), - * since we don't implement the optional v7 context ID masking. - */ - return contextidr =3D=3D (uint32_t)env->cp15.dbgbvr[lbn]; -} - -static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp) -{ - CPUARMState *env =3D &cpu->env; - uint64_t cr; - int pac, hmc, ssc, wt, lbn; - /* - * Note that for watchpoints the check is against the CPU security - * state, not the S/NS attribute on the offending data access. - */ - bool is_secure =3D arm_is_secure(env); - int access_el =3D arm_current_el(env); - - if (is_wp) { - CPUWatchpoint *wp =3D env->cpu_watchpoint[n]; - - if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) { - return false; - } - cr =3D env->cp15.dbgwcr[n]; - if (wp->hitattrs.user) { - /* - * The LDRT/STRT/LDT/STT "unprivileged access" instructions sh= ould - * match watchpoints as if they were accesses done at EL0, eve= n if - * the CPU is at EL1 or higher. - */ - access_el =3D 0; - } - } else { - uint64_t pc =3D is_a64(env) ? env->pc : env->regs[15]; - - if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc !=3D pc)= { - return false; - } - cr =3D env->cp15.dbgbcr[n]; - } - /* - * The WATCHPOINT_HIT flag guarantees us that the watchpoint is - * enabled and that the address and access type match; for breakpoints - * we know the address matched; check the remaining fields, including - * linked breakpoints. We rely on WCR and BCR having the same layout - * for the LBN, SSC, HMC, PAC/PMC and is-linked fields. - * Note that some combinations of {PAC, HMC, SSC} are reserved and - * must act either like some valid combination or as if the watchpoint - * were disabled. We choose the former, and use this together with - * the fact that EL3 must always be Secure and EL2 must always be - * Non-Secure to simplify the code slightly compared to the full - * table in the ARM ARM. - */ - pac =3D FIELD_EX64(cr, DBGWCR, PAC); - hmc =3D FIELD_EX64(cr, DBGWCR, HMC); - ssc =3D FIELD_EX64(cr, DBGWCR, SSC); - - switch (ssc) { - case 0: - break; - case 1: - case 3: - if (is_secure) { - return false; - } - break; - case 2: - if (!is_secure) { - return false; - } - break; - } - - switch (access_el) { - case 3: - case 2: - if (!hmc) { - return false; - } - break; - case 1: - if (extract32(pac, 0, 1) =3D=3D 0) { - return false; - } - break; - case 0: - if (extract32(pac, 1, 1) =3D=3D 0) { - return false; - } - break; - default: - g_assert_not_reached(); - } - - wt =3D FIELD_EX64(cr, DBGWCR, WT); - lbn =3D FIELD_EX64(cr, DBGWCR, LBN); - - if (wt && !linked_bp_matches(cpu, lbn)) { - return false; - } - - return true; -} - -static bool check_watchpoints(ARMCPU *cpu) -{ - CPUARMState *env =3D &cpu->env; - int n; - - /* - * If watchpoints are disabled globally or we can't take debug - * exceptions here then watchpoint firings are ignored. - */ - if (extract32(env->cp15.mdscr_el1, 15, 1) =3D=3D 0 - || !arm_generate_debug_exceptions(env)) { - return false; - } - - for (n =3D 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) { - if (bp_wp_matches(cpu, n, true)) { - return true; - } - } - return false; -} - -bool arm_debug_check_breakpoint(CPUState *cs) -{ - ARMCPU *cpu =3D ARM_CPU(cs); - CPUARMState *env =3D &cpu->env; - vaddr pc; - int n; - - /* - * If breakpoints are disabled globally or we can't take debug - * exceptions here then breakpoint firings are ignored. - */ - if (extract32(env->cp15.mdscr_el1, 15, 1) =3D=3D 0 - || !arm_generate_debug_exceptions(env)) { - return false; - } - - /* - * Single-step exceptions have priority over breakpoint exceptions. - * If single-step state is active-pending, suppress the bp. - */ - if (arm_singlestep_active(env) && !(env->pstate & PSTATE_SS)) { - return false; - } - - /* - * PC alignment faults have priority over breakpoint exceptions. - */ - pc =3D is_a64(env) ? env->pc : env->regs[15]; - if ((is_a64(env) || !env->thumb) && (pc & 3) !=3D 0) { - return false; - } - - /* - * Instruction aborts have priority over breakpoint exceptions. - * TODO: We would need to look up the page for PC and verify that - * it is present and executable. - */ - - for (n =3D 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) { - if (bp_wp_matches(cpu, n, false)) { - return true; - } - } - return false; -} - -bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) -{ - /* - * Called by core code when a CPU watchpoint fires; need to check if t= his - * is also an architectural watchpoint match. - */ - ARMCPU *cpu =3D ARM_CPU(cs); - - return check_watchpoints(cpu); -} - -/* - * Return the FSR value for a debug exception (watchpoint, hardware - * breakpoint or BKPT insn) targeting the specified exception level. - */ -static uint32_t arm_debug_exception_fsr(CPUARMState *env) -{ - ARMMMUFaultInfo fi =3D { .type =3D ARMFault_Debug }; - int target_el =3D arm_debug_target_el(env); - bool using_lpae; - - if (arm_feature(env, ARM_FEATURE_M)) { - using_lpae =3D false; - } else if (target_el =3D=3D 2 || arm_el_is_aa64(env, target_el)) { - using_lpae =3D true; - } else if (arm_feature(env, ARM_FEATURE_PMSA) && - arm_feature(env, ARM_FEATURE_V8)) { - using_lpae =3D true; - } else if (arm_feature(env, ARM_FEATURE_LPAE) && - (env->cp15.tcr_el[target_el] & TTBCR_EAE)) { - using_lpae =3D true; - } else { - using_lpae =3D false; - } - - if (using_lpae) { - return arm_fi_to_lfsc(&fi); - } else { - return arm_fi_to_sfsc(&fi); - } -} - -void arm_debug_excp_handler(CPUState *cs) -{ - /* - * Called by core code when a watchpoint or breakpoint fires; - * need to check which one and raise the appropriate exception. - */ - ARMCPU *cpu =3D ARM_CPU(cs); - CPUARMState *env =3D &cpu->env; - CPUWatchpoint *wp_hit =3D cs->watchpoint_hit; - - if (wp_hit) { - if (wp_hit->flags & BP_CPU) { - bool wnr =3D (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) !=3D 0; - - cs->watchpoint_hit =3D NULL; - - env->exception.fsr =3D arm_debug_exception_fsr(env); - env->exception.vaddress =3D wp_hit->hitaddr; - raise_exception_debug(env, EXCP_DATA_ABORT, - syn_watchpoint(0, 0, wnr)); - } - } else { - uint64_t pc =3D is_a64(env) ? env->pc : env->regs[15]; - - /* - * (1) GDB breakpoints should be handled first. - * (2) Do not raise a CPU exception if no CPU breakpoint has fired, - * since singlestep is also done by generating a debug internal - * exception. - */ - if (cpu_breakpoint_test(cs, pc, BP_GDB) - || !cpu_breakpoint_test(cs, pc, BP_CPU)) { - return; - } - - env->exception.fsr =3D arm_debug_exception_fsr(env); - /* - * FAR is UNKNOWN: clear vaddress to avoid potentially exposing - * values to the guest that it shouldn't be able to see at its - * exception/security level. - */ - env->exception.vaddress =3D 0; - raise_exception_debug(env, EXCP_PREFETCH_ABORT, syn_breakpoint(0)); - } -} - -/* - * Raise an EXCP_BKPT with the specified syndrome register value, - * targeting the correct exception level for debug exceptions. - */ -void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome) -{ - int debug_el =3D arm_debug_target_el(env); - int cur_el =3D arm_current_el(env); - - /* FSR will only be used if the debug target EL is AArch32. */ - env->exception.fsr =3D arm_debug_exception_fsr(env); - /* - * FAR is UNKNOWN: clear vaddress to avoid potentially exposing - * values to the guest that it shouldn't be able to see at its - * exception/security level. - */ - env->exception.vaddress =3D 0; - /* - * Other kinds of architectural debug exception are ignored if - * they target an exception level below the current one (in QEMU - * this is checked by arm_generate_debug_exceptions()). Breakpoint - * instructions are special because they always generate an exception - * to somewhere: if they can't go to the configured debug exception - * level they are taken to the current exception level. - */ - if (debug_el < cur_el) { - debug_el =3D cur_el; - } - raise_exception(env, EXCP_BKPT, syndrome, debug_el); -} - -void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome) -{ - raise_exception_debug(env, EXCP_UDEF, syndrome); -} - -void hw_watchpoint_update(ARMCPU *cpu, int n) -{ - CPUARMState *env =3D &cpu->env; - vaddr len =3D 0; - vaddr wvr =3D env->cp15.dbgwvr[n]; - uint64_t wcr =3D env->cp15.dbgwcr[n]; - int mask; - int flags =3D BP_CPU | BP_STOP_BEFORE_ACCESS; - - if (env->cpu_watchpoint[n]) { - cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); - env->cpu_watchpoint[n] =3D NULL; - } - - if (!FIELD_EX64(wcr, DBGWCR, E)) { - /* E bit clear : watchpoint disabled */ - return; - } - - switch (FIELD_EX64(wcr, DBGWCR, LSC)) { - case 0: - /* LSC 00 is reserved and must behave as if the wp is disabled */ - return; - case 1: - flags |=3D BP_MEM_READ; - break; - case 2: - flags |=3D BP_MEM_WRITE; - break; - case 3: - flags |=3D BP_MEM_ACCESS; - break; - } - - /* - * Attempts to use both MASK and BAS fields simultaneously are - * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, - * thus generating a watchpoint for every byte in the masked region. - */ - mask =3D FIELD_EX64(wcr, DBGWCR, MASK); - if (mask =3D=3D 1 || mask =3D=3D 2) { - /* - * Reserved values of MASK; we must act as if the mask value was - * some non-reserved value, or as if the watchpoint were disabled. - * We choose the latter. - */ - return; - } else if (mask) { - /* Watchpoint covers an aligned area up to 2GB in size */ - len =3D 1ULL << mask; - /* - * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTAB= LE - * whether the watchpoint fires when the unmasked bits match; we o= pt - * to generate the exceptions. - */ - wvr &=3D ~(len - 1); - } else { - /* Watchpoint covers bytes defined by the byte address select bits= */ - int bas =3D FIELD_EX64(wcr, DBGWCR, BAS); - int basstart; - - if (extract64(wvr, 2, 1)) { - /* - * Deprecated case of an only 4-aligned address. BAS[7:4] are - * ignored, and BAS[3:0] define which bytes to watch. - */ - bas &=3D 0xf; - } - - if (bas =3D=3D 0) { - /* This must act as if the watchpoint is disabled */ - return; - } - - /* - * The BAS bits are supposed to be programmed to indicate a contig= uous - * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE wheth= er - * we fire for each byte in the word/doubleword addressed by the W= VR. - * We choose to ignore any non-zero bits after the first range of = 1s. - */ - basstart =3D ctz32(bas); - len =3D cto32(bas >> basstart); - wvr +=3D basstart; - } - - cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, - &env->cpu_watchpoint[n]); -} - -void hw_watchpoint_update_all(ARMCPU *cpu) -{ - int i; - CPUARMState *env =3D &cpu->env; - - /* - * Completely clear out existing QEMU watchpoints and our array, to - * avoid possible stale entries following migration load. - */ - cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); - memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); - - for (i =3D 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { - hw_watchpoint_update(cpu, i); - } -} - -void hw_breakpoint_update(ARMCPU *cpu, int n) -{ - CPUARMState *env =3D &cpu->env; - uint64_t bvr =3D env->cp15.dbgbvr[n]; - uint64_t bcr =3D env->cp15.dbgbcr[n]; - vaddr addr; - int bt; - int flags =3D BP_CPU; - - if (env->cpu_breakpoint[n]) { - cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); - env->cpu_breakpoint[n] =3D NULL; - } - - if (!extract64(bcr, 0, 1)) { - /* E bit clear : watchpoint disabled */ - return; - } - - bt =3D extract64(bcr, 20, 4); - - switch (bt) { - case 4: /* unlinked address mismatch (reserved if AArch64) */ - case 5: /* linked address mismatch (reserved if AArch64) */ - qemu_log_mask(LOG_UNIMP, - "arm: address mismatch breakpoint types not implemen= ted\n"); - return; - case 0: /* unlinked address match */ - case 1: /* linked address match */ - { - /* - * Bits [1:0] are RES0. - * - * It is IMPLEMENTATION DEFINED whether bits [63:49] - * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit - * of the VA field ([48] or [52] for FEAT_LVA), or whether the - * value is read as written. It is CONSTRAINED UNPREDICTABLE - * whether the RESS bits are ignored when comparing an address. - * Therefore we are allowed to compare the entire register, which - * lets us avoid considering whether FEAT_LVA is actually enabled. - * - * The BAS field is used to allow setting breakpoints on 16-bit - * wide instructions; it is CONSTRAINED UNPREDICTABLE whether - * a bp will fire if the addresses covered by the bp and the addre= sses - * covered by the insn overlap but the insn doesn't start at the - * start of the bp address range. We choose to require the insn and - * the bp to have the same address. The constraints on writing to - * BAS enforced in dbgbcr_write mean we have only four cases: - * 0b0000 =3D> no breakpoint - * 0b0011 =3D> breakpoint on addr - * 0b1100 =3D> breakpoint on addr + 2 - * 0b1111 =3D> breakpoint on addr - * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). - */ - int bas =3D extract64(bcr, 5, 4); - addr =3D bvr & ~3ULL; - if (bas =3D=3D 0) { - return; - } - if (bas =3D=3D 0xc) { - addr +=3D 2; - } - break; - } - case 2: /* unlinked context ID match */ - case 8: /* unlinked VMID match (reserved if no EL2) */ - case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ - qemu_log_mask(LOG_UNIMP, - "arm: unlinked context breakpoint types not implemen= ted\n"); - return; - case 9: /* linked VMID match (reserved if no EL2) */ - case 11: /* linked context ID and VMID match (reserved if no EL2) */ - case 3: /* linked context ID match */ - default: - /* - * We must generate no events for Linked context matches (unless - * they are linked to by some other bp/wp, which is handled in - * updates for the linking bp/wp). We choose to also generate no e= vents - * for reserved values. - */ - return; - } - - cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); -} - -void hw_breakpoint_update_all(ARMCPU *cpu) -{ - int i; - CPUARMState *env =3D &cpu->env; - - /* - * Completely clear out existing QEMU breakpoints and our array, to - * avoid possible stale entries following migration load. - */ - cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); - memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); - - for (i =3D 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { - hw_breakpoint_update(cpu, i); - } -} - -#if !defined(CONFIG_USER_ONLY) - -vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len) -{ - ARMCPU *cpu =3D ARM_CPU(cs); - CPUARMState *env =3D &cpu->env; - - /* - * In BE32 system mode, target memory is stored byteswapped (on a - * little-endian host system), and by the time we reach here (via an - * opcode helper) the addresses of subword accesses have been adjusted - * to account for that, which means that watchpoints will not match. - * Undo the adjustment here. - */ - if (arm_sctlr_b(env)) { - if (len =3D=3D 1) { - addr ^=3D 3; - } else if (len =3D=3D 2) { - addr ^=3D 2; - } - } - - return addr; -} - -#endif /* !CONFIG_USER_ONLY */ -#endif /* CONFIG_TCG */ - /* * Check for traps to "powerdown debug" registers, which are controlled * by MDCR.TDOSA diff --git a/target/arm/debug_helper.c b/target/arm/tcg/debug.c similarity index 53% copy from target/arm/debug_helper.c copy to target/arm/tcg/debug.c index 579516e154..7dfb291a9b 100644 --- a/target/arm/debug_helper.c +++ b/target/arm/tcg/debug.c @@ -1,5 +1,5 @@ /* - * ARM debug helpers. + * ARM debug helpers used by TCG * * This code is licensed under the GNU GPL v2 or later. * @@ -17,7 +17,6 @@ #define HELPER_H "tcg/helper.h" #include "exec/helper-proto.h.inc" =20 -#ifdef CONFIG_TCG /* Return the Exception Level targeted by debug exceptions. */ static int arm_debug_target_el(CPUARMState *env) { @@ -47,7 +46,7 @@ static int arm_debug_target_el(CPUARMState *env) * Raise an exception to the debug target el. * Modify syndrome to indicate when origin and target EL are the same. */ -G_NORETURN static void +static G_NORETURN void raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome) { int debug_el =3D arm_debug_target_el(env); @@ -781,542 +780,3 @@ vaddr arm_adjust_watchpoint_address(CPUState *cs, vad= dr addr, int len) } =20 #endif /* !CONFIG_USER_ONLY */ -#endif /* CONFIG_TCG */ - -/* - * Check for traps to "powerdown debug" registers, which are controlled - * by MDCR.TDOSA - */ -static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *r= i, - bool isread) -{ - int el =3D arm_current_el(env); - uint64_t mdcr_el2 =3D arm_mdcr_el2_eff(env); - bool mdcr_el2_tdosa =3D (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TD= E) || - (arm_hcr_el2_eff(env) & HCR_TGE); - - if (el < 2 && mdcr_el2_tdosa) { - return CP_ACCESS_TRAP_EL2; - } - if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { - return CP_ACCESS_TRAP_EL3; - } - return CP_ACCESS_OK; -} - -/* - * Check for traps to "debug ROM" registers, which are controlled - * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. - */ -static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, - bool isread) -{ - int el =3D arm_current_el(env); - uint64_t mdcr_el2 =3D arm_mdcr_el2_eff(env); - bool mdcr_el2_tdra =3D (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE)= || - (arm_hcr_el2_eff(env) & HCR_TGE); - - if (el < 2 && mdcr_el2_tdra) { - return CP_ACCESS_TRAP_EL2; - } - if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { - return CP_ACCESS_TRAP_EL3; - } - return CP_ACCESS_OK; -} - -/* - * Check for traps to general debug registers, which are controlled - * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. - */ -static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, - bool isread) -{ - int el =3D arm_current_el(env); - uint64_t mdcr_el2 =3D arm_mdcr_el2_eff(env); - bool mdcr_el2_tda =3D (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) || - (arm_hcr_el2_eff(env) & HCR_TGE); - - if (el < 2 && mdcr_el2_tda) { - return CP_ACCESS_TRAP_EL2; - } - if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { - return CP_ACCESS_TRAP_EL3; - } - return CP_ACCESS_OK; -} - -static CPAccessResult access_dbgvcr32(CPUARMState *env, const ARMCPRegInfo= *ri, - bool isread) -{ - /* MCDR_EL3.TDMA doesn't apply for FEAT_NV traps */ - if (arm_current_el(env) =3D=3D 2 && (env->cp15.mdcr_el3 & MDCR_TDA)) { - return CP_ACCESS_TRAP_EL3; - } - return CP_ACCESS_OK; -} - -/* - * Check for traps to Debug Comms Channel registers. If FEAT_FGT - * is implemented then these are controlled by MDCR_EL2.TDCC for - * EL2 and MDCR_EL3.TDCC for EL3. They are also controlled by - * the general debug access trap bits MDCR_EL2.TDA and MDCR_EL3.TDA. - * For EL0, they are also controlled by MDSCR_EL1.TDCC. - */ -static CPAccessResult access_tdcc(CPUARMState *env, const ARMCPRegInfo *ri, - bool isread) -{ - int el =3D arm_current_el(env); - uint64_t mdcr_el2 =3D arm_mdcr_el2_eff(env); - bool mdscr_el1_tdcc =3D extract32(env->cp15.mdscr_el1, 12, 1); - bool mdcr_el2_tda =3D (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) || - (arm_hcr_el2_eff(env) & HCR_TGE); - bool mdcr_el2_tdcc =3D cpu_isar_feature(aa64_fgt, env_archcpu(env)) && - (mdcr_el2 & MDCR_TDCC); - bool mdcr_el3_tdcc =3D cpu_isar_feature(aa64_fgt, env_archcpu(env)) && - (env->cp15.mdcr_el3 & MDCR_TDCC); - - if (el < 1 && mdscr_el1_tdcc) { - return CP_ACCESS_TRAP_EL1; - } - if (el < 2 && (mdcr_el2_tda || mdcr_el2_tdcc)) { - return CP_ACCESS_TRAP_EL2; - } - if (!arm_is_el3_or_mon(env) && - ((env->cp15.mdcr_el3 & MDCR_TDA) || mdcr_el3_tdcc)) { - return CP_ACCESS_TRAP_EL3; - } - return CP_ACCESS_OK; -} - -static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri, - uint64_t value) -{ - /* - * Writes to OSLAR_EL1 may update the OS lock status, which can be - * read via a bit in OSLSR_EL1. - */ - int oslock; - - if (ri->state =3D=3D ARM_CP_STATE_AA32) { - oslock =3D (value =3D=3D 0xC5ACCE55); - } else { - oslock =3D value & 1; - } - - env->cp15.oslsr_el1 =3D deposit32(env->cp15.oslsr_el1, 1, 1, oslock); -} - -static void osdlr_write(CPUARMState *env, const ARMCPRegInfo *ri, - uint64_t value) -{ - ARMCPU *cpu =3D env_archcpu(env); - /* - * Only defined bit is bit 0 (DLK); if Feat_DoubleLock is not - * implemented this is RAZ/WI. - */ - if(arm_feature(env, ARM_FEATURE_AARCH64) - ? cpu_isar_feature(aa64_doublelock, cpu) - : cpu_isar_feature(aa32_doublelock, cpu)) { - env->cp15.osdlr_el1 =3D value & 1; - } -} - -static void dbgclaimset_write(CPUARMState *env, const ARMCPRegInfo *ri, - uint64_t value) -{ - env->cp15.dbgclaim |=3D (value & 0xFF); -} - -static uint64_t dbgclaimset_read(CPUARMState *env, const ARMCPRegInfo *ri) -{ - /* CLAIM bits are RAO */ - return 0xFF; -} - -static void dbgclaimclr_write(CPUARMState *env, const ARMCPRegInfo *ri, - uint64_t value) -{ - env->cp15.dbgclaim &=3D ~(value & 0xFF); -} - -static CPAccessResult access_bogus(CPUARMState *env, const ARMCPRegInfo *r= i, - bool isread) -{ - /* Always UNDEF, as if this cpreg didn't exist */ - return CP_ACCESS_UNDEFINED; -} - -static const ARMCPRegInfo debug_cp_reginfo[] =3D { - /* - * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped - * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1; - * unlike DBGDRAR it is never accessible from EL0. - * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AAr= ch64 - * accessor. - */ - { .name =3D "DBGDRAR", .cp =3D 14, .crn =3D 1, .crm =3D 0, .opc1 =3D 0= , .opc2 =3D 0, - .access =3D PL0_R, .accessfn =3D access_tdra, - .type =3D ARM_CP_CONST | ARM_CP_NO_GDB, .resetvalue =3D 0 }, - { .name =3D "MDRAR_EL1", .state =3D ARM_CP_STATE_AA64, - .opc0 =3D 2, .opc1 =3D 0, .crn =3D 1, .crm =3D 0, .opc2 =3D 0, - .access =3D PL1_R, .accessfn =3D access_tdra, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - { .name =3D "DBGDSAR", .cp =3D 14, .crn =3D 2, .crm =3D 0, .opc1 =3D 0= , .opc2 =3D 0, - .access =3D PL0_R, .accessfn =3D access_tdra, - .type =3D ARM_CP_CONST | ARM_CP_NO_GDB, .resetvalue =3D 0 }, - /* Monitor debug system control register; the 32-bit alias is DBGDSCRe= xt. */ - { .name =3D "MDSCR_EL1", .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 0, .crm =3D 2, .opc2 = =3D 2, - .access =3D PL1_RW, .accessfn =3D access_tda, - .fgt =3D FGT_MDSCR_EL1, - .nv2_redirect_offset =3D 0x158, - .fieldoffset =3D offsetof(CPUARMState, cp15.mdscr_el1), - .resetvalue =3D 0 }, - /* - * MDCCSR_EL0[30:29] map to EDSCR[30:29]. Simply RAZ as the external - * Debug Communication Channel is not implemented. - */ - { .name =3D "MDCCSR_EL0", .state =3D ARM_CP_STATE_AA64, - .opc0 =3D 2, .opc1 =3D 3, .crn =3D 0, .crm =3D 1, .opc2 =3D 0, - .access =3D PL0_R, .accessfn =3D access_tdcc, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - /* - * These registers belong to the Debug Communications Channel, - * which is not implemented. However we implement RAZ/WI behaviour - * with trapping to prevent spurious SIGILLs if the guest OS does - * access them as the support cannot be probed for. - */ - { .name =3D "OSDTRRX_EL1", .state =3D ARM_CP_STATE_BOTH, .cp =3D 14, - .opc0 =3D 2, .opc1 =3D 0, .crn =3D 0, .crm =3D 0, .opc2 =3D 2, - .access =3D PL1_RW, .accessfn =3D access_tdcc, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - { .name =3D "OSDTRTX_EL1", .state =3D ARM_CP_STATE_BOTH, .cp =3D 14, - .opc0 =3D 2, .opc1 =3D 0, .crn =3D 0, .crm =3D 3, .opc2 =3D 2, - .access =3D PL1_RW, .accessfn =3D access_tdcc, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - /* Architecturally DBGDTRTX is named DBGDTRRX when used for reads */ - { .name =3D "DBGDTRTX_EL0", .state =3D ARM_CP_STATE_AA64, - .opc0 =3D 2, .opc1 =3D 3, .crn =3D 0, .crm =3D 5, .opc2 =3D 0, - .access =3D PL0_RW, .accessfn =3D access_tdcc, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - { .name =3D "DBGDTRTX", .state =3D ARM_CP_STATE_AA32, .cp =3D 14, - .opc1 =3D 0, .crn =3D 0, .crm =3D 5, .opc2 =3D 0, - .access =3D PL0_RW, .accessfn =3D access_tdcc, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - /* This is AArch64-only and is a combination of DBGDTRTX and DBGDTRRX = */ - { .name =3D "DBGDTR_EL0", .state =3D ARM_CP_STATE_AA64, - .opc0 =3D 2, .opc1 =3D 3, .crn =3D 0, .crm =3D 4, .opc2 =3D 0, - .access =3D PL0_RW, .accessfn =3D access_tdcc, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - /* - * This is not a real AArch32 register. We used to incorrectly expose - * this due to a QEMU bug; to avoid breaking migration compatibility we - * need to continue to provide it so that we don't fail the inbound - * migration when it tells us about a sysreg that we don't have. - * We set an always-fails .accessfn, which means that the guest doesn't - * actually see this register (it will always UNDEF, identically to if - * there were no cpreg definition for it other than that we won't print - * a LOG_UNIMP message about it), and we set the ARM_CP_NO_GDB flag so= the - * gdbstub won't see it either. - * (We can't just set .access =3D 0, because add_cpreg_to_hashtable() - * helpfully ignores cpregs which aren't accessible to the highest - * implemented EL.) - * - * TODO: implement a system for being able to describe "this register - * can be ignored if it appears in the inbound stream"; then we can - * remove this temporary hack. - */ - { .name =3D "BOGUS_DBGDTR_EL0", .state =3D ARM_CP_STATE_AA32, - .cp =3D 14, .opc1 =3D 3, .crn =3D 0, .crm =3D 5, .opc2 =3D 0, - .access =3D PL0_RW, .accessfn =3D access_bogus, - .type =3D ARM_CP_CONST | ARM_CP_NO_GDB, .resetvalue =3D 0 }, - /* - * OSECCR_EL1 provides a mechanism for an operating system - * to access the contents of EDECCR. EDECCR is not implemented though, - * as is the rest of external device mechanism. - */ - { .name =3D "OSECCR_EL1", .state =3D ARM_CP_STATE_BOTH, .cp =3D 14, - .opc0 =3D 2, .opc1 =3D 0, .crn =3D 0, .crm =3D 6, .opc2 =3D 2, - .access =3D PL1_RW, .accessfn =3D access_tda, - .fgt =3D FGT_OSECCR_EL1, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - /* - * DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2]. Map all bits as - * it is unlikely a guest will care. - * We don't implement the configurable EL0 access. - */ - { .name =3D "DBGDSCRint", .state =3D ARM_CP_STATE_AA32, - .cp =3D 14, .opc1 =3D 0, .crn =3D 0, .crm =3D 1, .opc2 =3D 0, - .type =3D ARM_CP_ALIAS, - .access =3D PL1_R, .accessfn =3D access_tda, - .fieldoffset =3D offsetof(CPUARMState, cp15.mdscr_el1), }, - { .name =3D "OSLAR_EL1", .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 1, .crm =3D 0, .opc2 = =3D 4, - .access =3D PL1_W, .type =3D ARM_CP_NO_RAW, - .accessfn =3D access_tdosa, - .fgt =3D FGT_OSLAR_EL1, - .writefn =3D oslar_write }, - { .name =3D "OSLSR_EL1", .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 1, .crm =3D 1, .opc2 = =3D 4, - .access =3D PL1_R, .resetvalue =3D 10, - .accessfn =3D access_tdosa, - .fgt =3D FGT_OSLSR_EL1, - .fieldoffset =3D offsetof(CPUARMState, cp15.oslsr_el1) }, - /* Dummy OSDLR_EL1: 32-bit Linux will read this */ - { .name =3D "OSDLR_EL1", .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 1, .crm =3D 3, .opc2 = =3D 4, - .access =3D PL1_RW, .accessfn =3D access_tdosa, - .fgt =3D FGT_OSDLR_EL1, - .writefn =3D osdlr_write, - .fieldoffset =3D offsetof(CPUARMState, cp15.osdlr_el1) }, - /* - * Dummy DBGVCR: Linux wants to clear this on startup, but we don't - * implement vector catch debug events yet. - */ - { .name =3D "DBGVCR", - .cp =3D 14, .opc1 =3D 0, .crn =3D 0, .crm =3D 7, .opc2 =3D 0, - .access =3D PL1_RW, .accessfn =3D access_tda, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - /* - * Dummy MDCCINT_EL1, since we don't implement the Debug Communications - * Channel but Linux may try to access this register. The 32-bit - * alias is DBGDCCINT. - */ - { .name =3D "MDCCINT_EL1", .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 0, .crm =3D 2, .opc2 = =3D 0, - .access =3D PL1_RW, .accessfn =3D access_tdcc, - .type =3D ARM_CP_CONST, .resetvalue =3D 0 }, - /* - * Dummy DBGCLAIM registers. - * "The architecture does not define any functionality for the CLAIM t= ag bits.", - * so we only keep the raw bits - */ - { .name =3D "DBGCLAIMSET_EL1", .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 7, .crm =3D 8, .opc2 = =3D 6, - .type =3D ARM_CP_ALIAS, - .access =3D PL1_RW, .accessfn =3D access_tda, - .fgt =3D FGT_DBGCLAIM, - .writefn =3D dbgclaimset_write, .readfn =3D dbgclaimset_read }, - { .name =3D "DBGCLAIMCLR_EL1", .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 7, .crm =3D 9, .opc2 = =3D 6, - .access =3D PL1_RW, .accessfn =3D access_tda, - .fgt =3D FGT_DBGCLAIM, - .writefn =3D dbgclaimclr_write, .raw_writefn =3D raw_write, - .fieldoffset =3D offsetof(CPUARMState, cp15.dbgclaim) }, -}; - -/* These are present only when EL1 supports AArch32 */ -static const ARMCPRegInfo debug_aa32_el1_reginfo[] =3D { - /* - * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor - * to save and restore a 32-bit guest's DBGVCR) - */ - { .name =3D "DBGVCR32_EL2", .state =3D ARM_CP_STATE_AA64, - .opc0 =3D 2, .opc1 =3D 4, .crn =3D 0, .crm =3D 7, .opc2 =3D 0, - .access =3D PL2_RW, .accessfn =3D access_dbgvcr32, - .type =3D ARM_CP_CONST | ARM_CP_EL3_NO_EL2_KEEP, - .resetvalue =3D 0 }, -}; - -static const ARMCPRegInfo debug_lpae_cp_reginfo[] =3D { - /* 64 bit access versions of the (dummy) debug registers */ - { .name =3D "DBGDRAR", .cp =3D 14, .crm =3D 1, .opc1 =3D 0, - .access =3D PL0_R, .type =3D ARM_CP_CONST | ARM_CP_64BIT | ARM_CP_NO= _GDB, - .resetvalue =3D 0 }, - { .name =3D "DBGDSAR", .cp =3D 14, .crm =3D 2, .opc1 =3D 0, - .access =3D PL0_R, .type =3D ARM_CP_CONST | ARM_CP_64BIT | ARM_CP_NO= _GDB, - .resetvalue =3D 0 }, -}; - -static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri, - uint64_t value) -{ - ARMCPU *cpu =3D env_archcpu(env); - int i =3D ri->crm; - - /* - * Bits [1:0] are RES0. - * - * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA) - * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if - * they contain the value written. It is CONSTRAINED UNPREDICTABLE - * whether the RESS bits are ignored when comparing an address. - * - * Therefore we are allowed to compare the entire register, which lets - * us avoid considering whether or not FEAT_LVA is actually enabled. - */ - value &=3D ~3ULL; - - raw_write(env, ri, value); - if (tcg_enabled()) { - hw_watchpoint_update(cpu, i); - } -} - -static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri, - uint64_t value) -{ - ARMCPU *cpu =3D env_archcpu(env); - int i =3D ri->crm; - - raw_write(env, ri, value); - if (tcg_enabled()) { - hw_watchpoint_update(cpu, i); - } -} - -static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri, - uint64_t value) -{ - ARMCPU *cpu =3D env_archcpu(env); - int i =3D ri->crm; - - raw_write(env, ri, value); - if (tcg_enabled()) { - hw_breakpoint_update(cpu, i); - } -} - -static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, - uint64_t value) -{ - ARMCPU *cpu =3D env_archcpu(env); - int i =3D ri->crm; - - /* - * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only - * copy of BAS[0]. - */ - value =3D deposit64(value, 6, 1, extract64(value, 5, 1)); - value =3D deposit64(value, 8, 1, extract64(value, 7, 1)); - - raw_write(env, ri, value); - if (tcg_enabled()) { - hw_breakpoint_update(cpu, i); - } -} - -void define_debug_regs(ARMCPU *cpu) -{ - /* - * Define v7 and v8 architectural debug registers. - * These are just dummy implementations for now. - */ - int i; - int wrps, brps, ctx_cmps; - - /* - * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot - * use AArch32. Given that bit 15 is RES1, if the value is 0 then - * the register must not exist for this cpu. - */ - if (cpu->isar.dbgdidr !=3D 0) { - ARMCPRegInfo dbgdidr =3D { - .name =3D "DBGDIDR", .cp =3D 14, .crn =3D 0, .crm =3D 0, - .opc1 =3D 0, .opc2 =3D 0, - .access =3D PL0_R, .accessfn =3D access_tda, - .type =3D ARM_CP_CONST, .resetvalue =3D cpu->isar.dbgdidr, - }; - define_one_arm_cp_reg(cpu, &dbgdidr); - } - - /* - * DBGDEVID is present in the v7 debug architecture if - * DBGDIDR.DEVID_imp is 1 (bit 15); from v7.1 and on it is - * mandatory (and bit 15 is RES1). DBGDEVID1 and DBGDEVID2 exist - * from v7.1 of the debug architecture. Because no fields have yet - * been defined in DBGDEVID2 (and quite possibly none will ever - * be) we don't define an ARMISARegisters field for it. - * These registers exist only if EL1 can use AArch32, but that - * happens naturally because they are only PL1 accessible anyway. - */ - if (extract32(cpu->isar.dbgdidr, 15, 1)) { - ARMCPRegInfo dbgdevid =3D { - .name =3D "DBGDEVID", - .cp =3D 14, .opc1 =3D 0, .crn =3D 7, .opc2 =3D 2, .crn =3D 7, - .access =3D PL1_R, .accessfn =3D access_tda, - .type =3D ARM_CP_CONST, .resetvalue =3D cpu->isar.dbgdevid, - }; - define_one_arm_cp_reg(cpu, &dbgdevid); - } - if (cpu_isar_feature(aa32_debugv7p1, cpu)) { - ARMCPRegInfo dbgdevid12[] =3D { - { - .name =3D "DBGDEVID1", - .cp =3D 14, .opc1 =3D 0, .crn =3D 7, .opc2 =3D 1, .crn =3D= 7, - .access =3D PL1_R, .accessfn =3D access_tda, - .type =3D ARM_CP_CONST, .resetvalue =3D cpu->isar.dbgdevid= 1, - }, { - .name =3D "DBGDEVID2", - .cp =3D 14, .opc1 =3D 0, .crn =3D 7, .opc2 =3D 0, .crn =3D= 7, - .access =3D PL1_R, .accessfn =3D access_tda, - .type =3D ARM_CP_CONST, .resetvalue =3D 0, - }, - }; - define_arm_cp_regs(cpu, dbgdevid12); - } - - brps =3D arm_num_brps(cpu); - wrps =3D arm_num_wrps(cpu); - ctx_cmps =3D arm_num_ctx_cmps(cpu); - - assert(ctx_cmps <=3D brps); - - define_arm_cp_regs(cpu, debug_cp_reginfo); - if (cpu_isar_feature(aa64_aa32_el1, cpu)) { - define_arm_cp_regs(cpu, debug_aa32_el1_reginfo); - } - - if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) { - define_arm_cp_regs(cpu, debug_lpae_cp_reginfo); - } - - for (i =3D 0; i < brps; i++) { - char *dbgbvr_el1_name =3D g_strdup_printf("DBGBVR%d_EL1", i); - char *dbgbcr_el1_name =3D g_strdup_printf("DBGBCR%d_EL1", i); - ARMCPRegInfo dbgregs[] =3D { - { .name =3D dbgbvr_el1_name, .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 0, .crm =3D i= , .opc2 =3D 4, - .access =3D PL1_RW, .accessfn =3D access_tda, - .fgt =3D FGT_DBGBVRN_EL1, - .fieldoffset =3D offsetof(CPUARMState, cp15.dbgbvr[i]), - .writefn =3D dbgbvr_write, .raw_writefn =3D raw_write - }, - { .name =3D dbgbcr_el1_name, .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 0, .crm =3D i= , .opc2 =3D 5, - .access =3D PL1_RW, .accessfn =3D access_tda, - .fgt =3D FGT_DBGBCRN_EL1, - .fieldoffset =3D offsetof(CPUARMState, cp15.dbgbcr[i]), - .writefn =3D dbgbcr_write, .raw_writefn =3D raw_write - }, - }; - define_arm_cp_regs(cpu, dbgregs); - g_free(dbgbvr_el1_name); - g_free(dbgbcr_el1_name); - } - - for (i =3D 0; i < wrps; i++) { - char *dbgwvr_el1_name =3D g_strdup_printf("DBGWVR%d_EL1", i); - char *dbgwcr_el1_name =3D g_strdup_printf("DBGWCR%d_EL1", i); - ARMCPRegInfo dbgregs[] =3D { - { .name =3D dbgwvr_el1_name, .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 0, .crm =3D i= , .opc2 =3D 6, - .access =3D PL1_RW, .accessfn =3D access_tda, - .fgt =3D FGT_DBGWVRN_EL1, - .fieldoffset =3D offsetof(CPUARMState, cp15.dbgwvr[i]), - .writefn =3D dbgwvr_write, .raw_writefn =3D raw_write - }, - { .name =3D dbgwcr_el1_name, .state =3D ARM_CP_STATE_BOTH, - .cp =3D 14, .opc0 =3D 2, .opc1 =3D 0, .crn =3D 0, .crm =3D i= , .opc2 =3D 7, - .access =3D PL1_RW, .accessfn =3D access_tda, - .fgt =3D FGT_DBGWCRN_EL1, - .fieldoffset =3D offsetof(CPUARMState, cp15.dbgwcr[i]), - .writefn =3D dbgwcr_write, .raw_writefn =3D raw_write - }, - }; - define_arm_cp_regs(cpu, dbgregs); - g_free(dbgwvr_el1_name); - g_free(dbgwcr_el1_name); - } -} diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build index 1b115656c4..6e9aed3e5d 100644 --- a/target/arm/tcg/meson.build +++ b/target/arm/tcg/meson.build @@ -65,6 +65,7 @@ arm_common_ss.add(files( =20 arm_common_system_ss.add(files( 'cpregs-at.c', + 'debug.c', 'hflags.c', 'neon_helper.c', 'tlb_helper.c', @@ -72,6 +73,7 @@ arm_common_system_ss.add(files( 'vfp_helper.c', )) arm_user_ss.add(files( + 'debug.c', 'hflags.c', 'neon_helper.c', 'tlb_helper.c', --=20 2.43.0