qemu

debug_helper.c (36871B)

---

 /*
  * ARM debug helpers.
  *
  * This code is licensed under the GNU GPL v2 or later.
  *
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
 #include "internals.h"
 #include "cpregs.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 
 
 /* Return the Exception Level targeted by debug exceptions. */
 static int arm_debug_target_el(CPUARMState *env)
 {
     bool secure = arm_is_secure(env);
     bool route_to_el2 = false;
 
     if (arm_is_el2_enabled(env)) {
         route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
                        env->cp15.mdcr_el2 & MDCR_TDE;
     }
 
     if (route_to_el2) {
         return 2;
     } else if (arm_feature(env, ARM_FEATURE_EL3) &&
                !arm_el_is_aa64(env, 3) && secure) {
         return 3;
     } else {
         return 1;
     }
 }
 
 /*
  * Raise an exception to the debug target el.
  * Modify syndrome to indicate when origin and target EL are the same.
  */
 G_NORETURN static void
 raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome)
 {
     int debug_el = arm_debug_target_el(env);
     int cur_el = arm_current_el(env);
 
     /*
      * If singlestep is targeting a lower EL than the current one, then
      * DisasContext.ss_active must be false and we can never get here.
      * Similarly for watchpoint and breakpoint matches.
      */
     assert(debug_el >= cur_el);
     syndrome |= (debug_el == cur_el) << ARM_EL_EC_SHIFT;
     raise_exception(env, excp, syndrome, debug_el);
 }
 
 /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
 static bool aa64_generate_debug_exceptions(CPUARMState *env)
 {
     int cur_el = arm_current_el(env);
     int debug_el;
 
     if (cur_el == 3) {
         return false;
     }
 
     /* MDCR_EL3.SDD disables debug events from Secure state */
     if (arm_is_secure_below_el3(env)
         && extract32(env->cp15.mdcr_el3, 16, 1)) {
         return false;
     }
 
     /*
      * Same EL to same EL debug exceptions need MDSCR_KDE enabled
      * while not masking the (D)ebug bit in DAIF.
      */
     debug_el = arm_debug_target_el(env);
 
     if (cur_el == debug_el) {
         return extract32(env->cp15.mdscr_el1, 13, 1)
             && !(env->daif & PSTATE_D);
     }
 
     /* Otherwise the debug target needs to be a higher EL */
     return debug_el > cur_el;
 }
 
 static bool aa32_generate_debug_exceptions(CPUARMState *env)
 {
     int el = arm_current_el(env);
 
     if (el == 0 && arm_el_is_aa64(env, 1)) {
         return aa64_generate_debug_exceptions(env);
     }
 
     if (arm_is_secure(env)) {
         int spd;
 
         if (el == 0 && (env->cp15.sder & 1)) {
             /*
              * SDER.SUIDEN means debug exceptions from Secure EL0
              * are always enabled. Otherwise they are controlled by
              * SDCR.SPD like those from other Secure ELs.
              */
             return true;
         }
 
         spd = extract32(env->cp15.mdcr_el3, 14, 2);
         switch (spd) {
         case 1:
             /* SPD == 0b01 is reserved, but behaves as 0b00. */
         case 0:
             /*
              * For 0b00 we return true if external secure invasive debug
              * is enabled. On real hardware this is controlled by external
              * signals to the core. QEMU always permits debug, and behaves
              * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
              */
             return true;
         case 2:
             return false;
         case 3:
             return true;
         }
     }
 
     return el != 2;
 }
 
 /*
  * Return true if debugging exceptions are currently enabled.
  * This corresponds to what in ARM ARM pseudocode would be
  *    if UsingAArch32() then
  *        return AArch32.GenerateDebugExceptions()
  *    else
  *        return AArch64.GenerateDebugExceptions()
  * We choose to push the if() down into this function for clarity,
  * since the pseudocode has it at all callsites except for the one in
  * CheckSoftwareStep(), where it is elided because both branches would
  * always return the same value.
  */
 bool arm_generate_debug_exceptions(CPUARMState *env)
 {
     if ((env->cp15.oslsr_el1 & 1) || (env->cp15.osdlr_el1 & 1)) {
         return false;
     }
     if (is_a64(env)) {
         return aa64_generate_debug_exceptions(env);
     } else {
         return aa32_generate_debug_exceptions(env);
     }
 }
 
 /*
  * Is single-stepping active? (Note that the "is EL_D AArch64?" check
  * implicitly means this always returns false in pre-v8 CPUs.)
  */
 bool arm_singlestep_active(CPUARMState *env)
 {
     return extract32(env->cp15.mdscr_el1, 0, 1)
         && arm_el_is_aa64(env, arm_debug_target_el(env))
         && arm_generate_debug_exceptions(env);
 }
 
 /* Return true if the linked breakpoint entry lbn passes its checks */
 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
 {
     CPUARMState *env = &cpu->env;
     uint64_t bcr = env->cp15.dbgbcr[lbn];
     int brps = arm_num_brps(cpu);
     int ctx_cmps = arm_num_ctx_cmps(cpu);
     int bt;
     uint32_t contextidr;
     uint64_t hcr_el2;
 
     /*
      * Links to unimplemented or non-context aware breakpoints are
      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
      * as if linked to an UNKNOWN context-aware breakpoint (in which
      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
      * We choose the former.
      */
     if (lbn >= brps || lbn < (brps - ctx_cmps)) {
         return false;
     }
 
     bcr = env->cp15.dbgbcr[lbn];
 
     if (extract64(bcr, 0, 1) == 0) {
         /* Linked breakpoint disabled : generate no events */
         return false;
     }
 
     bt = extract64(bcr, 20, 4);
     hcr_el2 = arm_hcr_el2_eff(env);
 
     switch (bt) {
     case 3: /* linked context ID match */
         switch (arm_current_el(env)) {
         default:
             /* Context matches never fire in AArch64 EL3 */
             return false;
         case 2:
             if (!(hcr_el2 & HCR_E2H)) {
                 /* Context matches never fire in EL2 without E2H enabled. */
                 return false;
             }
             contextidr = env->cp15.contextidr_el[2];
             break;
         case 1:
             contextidr = env->cp15.contextidr_el[1];
             break;
         case 0:
             if ((hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
                 contextidr = env->cp15.contextidr_el[2];
             } else {
                 contextidr = env->cp15.contextidr_el[1];
             }
             break;
         }
         break;
 
     case 7:  /* linked contextidr_el1 match */
         contextidr = env->cp15.contextidr_el[1];
         break;
     case 13: /* linked contextidr_el2 match */
         contextidr = env->cp15.contextidr_el[2];
         break;
 
     case 9: /* linked VMID match (reserved if no EL2) */
     case 11: /* linked context ID and VMID match (reserved if no EL2) */
     case 15: /* linked full context ID match */
     default:
         /*
          * Links to Unlinked context breakpoints must generate no
          * events; we choose to do the same for reserved values too.
          */
         return false;
     }
 
     /*
      * We match the whole register even if this is AArch32 using the
      * short descriptor format (in which case it holds both PROCID and ASID),
      * since we don't implement the optional v7 context ID masking.
      */
     return contextidr == (uint32_t)env->cp15.dbgbvr[lbn];
 }
 
 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
 {
     CPUARMState *env = &cpu->env;
     uint64_t cr;
     int pac, hmc, ssc, wt, lbn;
     /*
      * Note that for watchpoints the check is against the CPU security
      * state, not the S/NS attribute on the offending data access.
      */
     bool is_secure = arm_is_secure(env);
     int access_el = arm_current_el(env);
 
     if (is_wp) {
         CPUWatchpoint *wp = env->cpu_watchpoint[n];
 
         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
             return false;
         }
         cr = env->cp15.dbgwcr[n];
         if (wp->hitattrs.user) {
             /*
              * The LDRT/STRT/LDT/STT "unprivileged access" instructions should
              * match watchpoints as if they were accesses done at EL0, even if
              * the CPU is at EL1 or higher.
              */
             access_el = 0;
         }
     } else {
         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 
         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
             return false;
         }
         cr = env->cp15.dbgbcr[n];
     }
     /*
      * The WATCHPOINT_HIT flag guarantees us that the watchpoint is
      * enabled and that the address and access type match; for breakpoints
      * we know the address matched; check the remaining fields, including
      * linked breakpoints. We rely on WCR and BCR having the same layout
      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
      * Note that some combinations of {PAC, HMC, SSC} are reserved and
      * must act either like some valid combination or as if the watchpoint
      * were disabled. We choose the former, and use this together with
      * the fact that EL3 must always be Secure and EL2 must always be
      * Non-Secure to simplify the code slightly compared to the full
      * table in the ARM ARM.
      */
     pac = FIELD_EX64(cr, DBGWCR, PAC);
     hmc = FIELD_EX64(cr, DBGWCR, HMC);
     ssc = FIELD_EX64(cr, DBGWCR, SSC);
 
     switch (ssc) {
     case 0:
         break;
     case 1:
     case 3:
         if (is_secure) {
             return false;
         }
         break;
     case 2:
         if (!is_secure) {
             return false;
         }
         break;
     }
 
     switch (access_el) {
     case 3:
     case 2:
         if (!hmc) {
             return false;
         }
         break;
     case 1:
         if (extract32(pac, 0, 1) == 0) {
             return false;
         }
         break;
     case 0:
         if (extract32(pac, 1, 1) == 0) {
             return false;
         }
         break;
     default:
         g_assert_not_reached();
     }
 
     wt = FIELD_EX64(cr, DBGWCR, WT);
     lbn = FIELD_EX64(cr, DBGWCR, LBN);
 
     if (wt && !linked_bp_matches(cpu, lbn)) {
         return false;
     }
 
     return true;
 }
 
 static bool check_watchpoints(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
     int n;
 
     /*
      * If watchpoints are disabled globally or we can't take debug
      * exceptions here then watchpoint firings are ignored.
      */
     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
         || !arm_generate_debug_exceptions(env)) {
         return false;
     }
 
     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
         if (bp_wp_matches(cpu, n, true)) {
             return true;
         }
     }
     return false;
 }
 
 bool arm_debug_check_breakpoint(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     target_ulong pc;
     int n;
 
     /*
      * If breakpoints are disabled globally or we can't take debug
      * exceptions here then breakpoint firings are ignored.
      */
     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
         || !arm_generate_debug_exceptions(env)) {
         return false;
     }
 
     /*
      * Single-step exceptions have priority over breakpoint exceptions.
      * If single-step state is active-pending, suppress the bp.
      */
     if (arm_singlestep_active(env) && !(env->pstate & PSTATE_SS)) {
         return false;
     }
 
     /*
      * PC alignment faults have priority over breakpoint exceptions.
      */
     pc = is_a64(env) ? env->pc : env->regs[15];
     if ((is_a64(env) || !env->thumb) && (pc & 3) != 0) {
         return false;
     }
 
     /*
      * Instruction aborts have priority over breakpoint exceptions.
      * TODO: We would need to look up the page for PC and verify that
      * it is present and executable.
      */
 
     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
         if (bp_wp_matches(cpu, n, false)) {
             return true;
         }
     }
     return false;
 }
 
 bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 {
     /*
      * Called by core code when a CPU watchpoint fires; need to check if this
      * is also an architectural watchpoint match.
      */
     ARMCPU *cpu = ARM_CPU(cs);
 
     return check_watchpoints(cpu);
 }
 
 /*
  * Return the FSR value for a debug exception (watchpoint, hardware
  * breakpoint or BKPT insn) targeting the specified exception level.
  */
 static uint32_t arm_debug_exception_fsr(CPUARMState *env)
 {
     ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
     int target_el = arm_debug_target_el(env);
     bool using_lpae = false;
 
     if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
         using_lpae = true;
     } else {
         if (arm_feature(env, ARM_FEATURE_LPAE) &&
             (env->cp15.tcr_el[target_el] & TTBCR_EAE)) {
             using_lpae = true;
         }
     }
 
     if (using_lpae) {
         return arm_fi_to_lfsc(&fi);
     } else {
         return arm_fi_to_sfsc(&fi);
     }
 }
 
 void arm_debug_excp_handler(CPUState *cs)
 {
     /*
      * Called by core code when a watchpoint or breakpoint fires;
      * need to check which one and raise the appropriate exception.
      */
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
 
     if (wp_hit) {
         if (wp_hit->flags & BP_CPU) {
             bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 
             cs->watchpoint_hit = NULL;
 
             env->exception.fsr = arm_debug_exception_fsr(env);
             env->exception.vaddress = wp_hit->hitaddr;
             raise_exception_debug(env, EXCP_DATA_ABORT,
                                   syn_watchpoint(0, 0, wnr));
         }
     } else {
         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 
         /*
          * (1) GDB breakpoints should be handled first.
          * (2) Do not raise a CPU exception if no CPU breakpoint has fired,
          * since singlestep is also done by generating a debug internal
          * exception.
          */
         if (cpu_breakpoint_test(cs, pc, BP_GDB)
             || !cpu_breakpoint_test(cs, pc, BP_CPU)) {
             return;
         }
 
         env->exception.fsr = arm_debug_exception_fsr(env);
         /*
          * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
          * values to the guest that it shouldn't be able to see at its
          * exception/security level.
          */
         env->exception.vaddress = 0;
         raise_exception_debug(env, EXCP_PREFETCH_ABORT, syn_breakpoint(0));
     }
 }
 
 /*
  * Raise an EXCP_BKPT with the specified syndrome register value,
  * targeting the correct exception level for debug exceptions.
  */
 void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
 {
     int debug_el = arm_debug_target_el(env);
     int cur_el = arm_current_el(env);
 
     /* FSR will only be used if the debug target EL is AArch32. */
     env->exception.fsr = arm_debug_exception_fsr(env);
     /*
      * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
      * values to the guest that it shouldn't be able to see at its
      * exception/security level.
      */
     env->exception.vaddress = 0;
     /*
      * Other kinds of architectural debug exception are ignored if
      * they target an exception level below the current one (in QEMU
      * this is checked by arm_generate_debug_exceptions()). Breakpoint
      * instructions are special because they always generate an exception
      * to somewhere: if they can't go to the configured debug exception
      * level they are taken to the current exception level.
      */
     if (debug_el < cur_el) {
         debug_el = cur_el;
     }
     raise_exception(env, EXCP_BKPT, syndrome, debug_el);
 }
 
 void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
 {
     raise_exception_debug(env, EXCP_UDEF, syndrome);
 }
 
 /*
  * Check for traps to "powerdown debug" registers, which are controlled
  * by MDCR.TDOSA
  */
 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
                                    bool isread)
 {
     int el = arm_current_el(env);
     uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
     bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
         (arm_hcr_el2_eff(env) & HCR_TGE);
 
     if (el < 2 && mdcr_el2_tdosa) {
         return CP_ACCESS_TRAP_EL2;
     }
     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
         return CP_ACCESS_TRAP_EL3;
     }
     return CP_ACCESS_OK;
 }
 
 /*
  * Check for traps to "debug ROM" registers, which are controlled
  * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
  */
 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
                                   bool isread)
 {
     int el = arm_current_el(env);
     uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
     bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
         (arm_hcr_el2_eff(env) & HCR_TGE);
 
     if (el < 2 && mdcr_el2_tdra) {
         return CP_ACCESS_TRAP_EL2;
     }
     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
         return CP_ACCESS_TRAP_EL3;
     }
     return CP_ACCESS_OK;
 }
 
 /*
  * Check for traps to general debug registers, which are controlled
  * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
  */
 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
                                   bool isread)
 {
     int el = arm_current_el(env);
     uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
     bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
         (arm_hcr_el2_eff(env) & HCR_TGE);
 
     if (el < 2 && mdcr_el2_tda) {
         return CP_ACCESS_TRAP_EL2;
     }
     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
         return CP_ACCESS_TRAP_EL3;
     }
     return CP_ACCESS_OK;
 }
 
 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
     /*
      * Writes to OSLAR_EL1 may update the OS lock status, which can be
      * read via a bit in OSLSR_EL1.
      */
     int oslock;
 
     if (ri->state == ARM_CP_STATE_AA32) {
         oslock = (value == 0xC5ACCE55);
     } else {
         oslock = value & 1;
     }
 
     env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
 }
 
 static void osdlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
     ARMCPU *cpu = env_archcpu(env);
     /*
      * Only defined bit is bit 0 (DLK); if Feat_DoubleLock is not
      * implemented this is RAZ/WI.
      */
     if(arm_feature(env, ARM_FEATURE_AARCH64)
        ? cpu_isar_feature(aa64_doublelock, cpu)
        : cpu_isar_feature(aa32_doublelock, cpu)) {
         env->cp15.osdlr_el1 = value & 1;
     }
 }
 
 static const ARMCPRegInfo debug_cp_reginfo[] = {
     /*
      * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
      * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
      * unlike DBGDRAR it is never accessible from EL0.
      * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
      * accessor.
      */
     { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
       .access = PL0_R, .accessfn = access_tdra,
       .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
       .access = PL1_R, .accessfn = access_tdra,
       .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
       .access = PL0_R, .accessfn = access_tdra,
       .type = ARM_CP_CONST, .resetvalue = 0 },
     /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
     { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tda,
       .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
       .resetvalue = 0 },
     /*
      * MDCCSR_EL0[30:29] map to EDSCR[30:29].  Simply RAZ as the external
      * Debug Communication Channel is not implemented.
      */
     { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 1, .opc2 = 0,
       .access = PL0_R, .accessfn = access_tda,
       .type = ARM_CP_CONST, .resetvalue = 0 },
     /*
      * DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2].  Map all bits as
      * it is unlikely a guest will care.
      * We don't implement the configurable EL0 access.
      */
     { .name = "DBGDSCRint", .state = ARM_CP_STATE_AA32,
       .cp = 14, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
       .type = ARM_CP_ALIAS,
       .access = PL1_R, .accessfn = access_tda,
       .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
     { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
       .access = PL1_W, .type = ARM_CP_NO_RAW,
       .accessfn = access_tdosa,
       .writefn = oslar_write },
     { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
       .access = PL1_R, .resetvalue = 10,
       .accessfn = access_tdosa,
       .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
     /* Dummy OSDLR_EL1: 32-bit Linux will read this */
     { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
       .access = PL1_RW, .accessfn = access_tdosa,
       .writefn = osdlr_write,
       .fieldoffset = offsetof(CPUARMState, cp15.osdlr_el1) },
     /*
      * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
      * implement vector catch debug events yet.
      */
     { .name = "DBGVCR",
       .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_tda,
       .type = ARM_CP_NOP },
     /*
      * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
      * to save and restore a 32-bit guest's DBGVCR)
      */
     { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
       .access = PL2_RW, .accessfn = access_tda,
       .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
     /*
      * Dummy MDCCINT_EL1, since we don't implement the Debug Communications
      * Channel but Linux may try to access this register. The 32-bit
      * alias is DBGDCCINT.
      */
     { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_tda,
       .type = ARM_CP_NOP },
 };
 
 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
     /* 64 bit access versions of the (dummy) debug registers */
     { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
     { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 };
 
 void hw_watchpoint_update(ARMCPU *cpu, int n)
 {
     CPUARMState *env = &cpu->env;
     vaddr len = 0;
     vaddr wvr = env->cp15.dbgwvr[n];
     uint64_t wcr = env->cp15.dbgwcr[n];
     int mask;
     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 
     if (env->cpu_watchpoint[n]) {
         cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
         env->cpu_watchpoint[n] = NULL;
     }
 
     if (!FIELD_EX64(wcr, DBGWCR, E)) {
         /* E bit clear : watchpoint disabled */
         return;
     }
 
     switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
     case 0:
         /* LSC 00 is reserved and must behave as if the wp is disabled */
         return;
     case 1:
         flags |= BP_MEM_READ;
         break;
     case 2:
         flags |= BP_MEM_WRITE;
         break;
     case 3:
         flags |= BP_MEM_ACCESS;
         break;
     }
 
     /*
      * Attempts to use both MASK and BAS fields simultaneously are
      * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
      * thus generating a watchpoint for every byte in the masked region.
      */
     mask = FIELD_EX64(wcr, DBGWCR, MASK);
     if (mask == 1 || mask == 2) {
         /*
          * Reserved values of MASK; we must act as if the mask value was
          * some non-reserved value, or as if the watchpoint were disabled.
          * We choose the latter.
          */
         return;
     } else if (mask) {
         /* Watchpoint covers an aligned area up to 2GB in size */
         len = 1ULL << mask;
         /*
          * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
          * whether the watchpoint fires when the unmasked bits match; we opt
          * to generate the exceptions.
          */
         wvr &= ~(len - 1);
     } else {
         /* Watchpoint covers bytes defined by the byte address select bits */
         int bas = FIELD_EX64(wcr, DBGWCR, BAS);
         int basstart;
 
         if (extract64(wvr, 2, 1)) {
             /*
              * Deprecated case of an only 4-aligned address. BAS[7:4] are
              * ignored, and BAS[3:0] define which bytes to watch.
              */
             bas &= 0xf;
         }
 
         if (bas == 0) {
             /* This must act as if the watchpoint is disabled */
             return;
         }
 
         /*
          * The BAS bits are supposed to be programmed to indicate a contiguous
          * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
          * we fire for each byte in the word/doubleword addressed by the WVR.
          * We choose to ignore any non-zero bits after the first range of 1s.
          */
         basstart = ctz32(bas);
         len = cto32(bas >> basstart);
         wvr += basstart;
     }
 
     cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
                           &env->cpu_watchpoint[n]);
 }
 
 void hw_watchpoint_update_all(ARMCPU *cpu)
 {
     int i;
     CPUARMState *env = &cpu->env;
 
     /*
      * Completely clear out existing QEMU watchpoints and our array, to
      * avoid possible stale entries following migration load.
      */
     cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
     memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
 
     for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
         hw_watchpoint_update(cpu, i);
     }
 }
 
 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                          uint64_t value)
 {
     ARMCPU *cpu = env_archcpu(env);
     int i = ri->crm;
 
     /*
      * Bits [1:0] are RES0.
      *
      * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
      * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
      * they contain the value written.  It is CONSTRAINED UNPREDICTABLE
      * whether the RESS bits are ignored when comparing an address.
      *
      * Therefore we are allowed to compare the entire register, which lets
      * us avoid considering whether or not FEAT_LVA is actually enabled.
      */
     value &= ~3ULL;
 
     raw_write(env, ri, value);
     hw_watchpoint_update(cpu, i);
 }
 
 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                          uint64_t value)
 {
     ARMCPU *cpu = env_archcpu(env);
     int i = ri->crm;
 
     raw_write(env, ri, value);
     hw_watchpoint_update(cpu, i);
 }
 
 void hw_breakpoint_update(ARMCPU *cpu, int n)
 {
     CPUARMState *env = &cpu->env;
     uint64_t bvr = env->cp15.dbgbvr[n];
     uint64_t bcr = env->cp15.dbgbcr[n];
     vaddr addr;
     int bt;
     int flags = BP_CPU;
 
     if (env->cpu_breakpoint[n]) {
         cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
         env->cpu_breakpoint[n] = NULL;
     }
 
     if (!extract64(bcr, 0, 1)) {
         /* E bit clear : watchpoint disabled */
         return;
     }
 
     bt = extract64(bcr, 20, 4);
 
     switch (bt) {
     case 4: /* unlinked address mismatch (reserved if AArch64) */
     case 5: /* linked address mismatch (reserved if AArch64) */
         qemu_log_mask(LOG_UNIMP,
                       "arm: address mismatch breakpoint types not implemented\n");
         return;
     case 0: /* unlinked address match */
     case 1: /* linked address match */
     {
         /*
          * Bits [1:0] are RES0.
          *
          * It is IMPLEMENTATION DEFINED whether bits [63:49]
          * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
          * of the VA field ([48] or [52] for FEAT_LVA), or whether the
          * value is read as written.  It is CONSTRAINED UNPREDICTABLE
          * whether the RESS bits are ignored when comparing an address.
          * Therefore we are allowed to compare the entire register, which
          * lets us avoid considering whether FEAT_LVA is actually enabled.
          *
          * The BAS field is used to allow setting breakpoints on 16-bit
          * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
          * a bp will fire if the addresses covered by the bp and the addresses
          * covered by the insn overlap but the insn doesn't start at the
          * start of the bp address range. We choose to require the insn and
          * the bp to have the same address. The constraints on writing to
          * BAS enforced in dbgbcr_write mean we have only four cases:
          *  0b0000  => no breakpoint
          *  0b0011  => breakpoint on addr
          *  0b1100  => breakpoint on addr + 2
          *  0b1111  => breakpoint on addr
          * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
          */
         int bas = extract64(bcr, 5, 4);
         addr = bvr & ~3ULL;
         if (bas == 0) {
             return;
         }
         if (bas == 0xc) {
             addr += 2;
         }
         break;
     }
     case 2: /* unlinked context ID match */
     case 8: /* unlinked VMID match (reserved if no EL2) */
     case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
         qemu_log_mask(LOG_UNIMP,
                       "arm: unlinked context breakpoint types not implemented\n");
         return;
     case 9: /* linked VMID match (reserved if no EL2) */
     case 11: /* linked context ID and VMID match (reserved if no EL2) */
     case 3: /* linked context ID match */
     default:
         /*
          * We must generate no events for Linked context matches (unless
          * they are linked to by some other bp/wp, which is handled in
          * updates for the linking bp/wp). We choose to also generate no events
          * for reserved values.
          */
         return;
     }
 
     cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
 }
 
 void hw_breakpoint_update_all(ARMCPU *cpu)
 {
     int i;
     CPUARMState *env = &cpu->env;
 
     /*
      * Completely clear out existing QEMU breakpoints and our array, to
      * avoid possible stale entries following migration load.
      */
     cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
     memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
 
     for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
         hw_breakpoint_update(cpu, i);
     }
 }
 
 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                          uint64_t value)
 {
     ARMCPU *cpu = env_archcpu(env);
     int i = ri->crm;
 
     raw_write(env, ri, value);
     hw_breakpoint_update(cpu, i);
 }
 
 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                          uint64_t value)
 {
     ARMCPU *cpu = env_archcpu(env);
     int i = ri->crm;
 
     /*
      * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
      * copy of BAS[0].
      */
     value = deposit64(value, 6, 1, extract64(value, 5, 1));
     value = deposit64(value, 8, 1, extract64(value, 7, 1));
 
     raw_write(env, ri, value);
     hw_breakpoint_update(cpu, i);
 }
 
 void define_debug_regs(ARMCPU *cpu)
 {
     /*
      * Define v7 and v8 architectural debug registers.
      * These are just dummy implementations for now.
      */
     int i;
     int wrps, brps, ctx_cmps;
 
     /*
      * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
      * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
      * the register must not exist for this cpu.
      */
     if (cpu->isar.dbgdidr != 0) {
         ARMCPRegInfo dbgdidr = {
             .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
             .opc1 = 0, .opc2 = 0,
             .access = PL0_R, .accessfn = access_tda,
             .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
         };
         define_one_arm_cp_reg(cpu, &dbgdidr);
     }
 
     /*
      * DBGDEVID is present in the v7 debug architecture if
      * DBGDIDR.DEVID_imp is 1 (bit 15); from v7.1 and on it is
      * mandatory (and bit 15 is RES1). DBGDEVID1 and DBGDEVID2 exist
      * from v7.1 of the debug architecture. Because no fields have yet
      * been defined in DBGDEVID2 (and quite possibly none will ever
      * be) we don't define an ARMISARegisters field for it.
      * These registers exist only if EL1 can use AArch32, but that
      * happens naturally because they are only PL1 accessible anyway.
      */
     if (extract32(cpu->isar.dbgdidr, 15, 1)) {
         ARMCPRegInfo dbgdevid = {
             .name = "DBGDEVID",
             .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 2, .crn = 7,
             .access = PL1_R, .accessfn = access_tda,
             .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid,
         };
         define_one_arm_cp_reg(cpu, &dbgdevid);
     }
     if (cpu_isar_feature(aa32_debugv7p1, cpu)) {
         ARMCPRegInfo dbgdevid12[] = {
             {
                 .name = "DBGDEVID1",
                 .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 1, .crn = 7,
                 .access = PL1_R, .accessfn = access_tda,
                 .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid1,
             }, {
                 .name = "DBGDEVID2",
                 .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 0, .crn = 7,
                 .access = PL1_R, .accessfn = access_tda,
                 .type = ARM_CP_CONST, .resetvalue = 0,
             },
         };
         define_arm_cp_regs(cpu, dbgdevid12);
     }
 
     brps = arm_num_brps(cpu);
     wrps = arm_num_wrps(cpu);
     ctx_cmps = arm_num_ctx_cmps(cpu);
 
     assert(ctx_cmps <= brps);
 
     define_arm_cp_regs(cpu, debug_cp_reginfo);
 
     if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
         define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
     }
 
     for (i = 0; i < brps; i++) {
         char *dbgbvr_el1_name = g_strdup_printf("DBGBVR%d_EL1", i);
         char *dbgbcr_el1_name = g_strdup_printf("DBGBCR%d_EL1", i);
         ARMCPRegInfo dbgregs[] = {
             { .name = dbgbvr_el1_name, .state = ARM_CP_STATE_BOTH,
               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
               .access = PL1_RW, .accessfn = access_tda,
               .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
               .writefn = dbgbvr_write, .raw_writefn = raw_write
             },
             { .name = dbgbcr_el1_name, .state = ARM_CP_STATE_BOTH,
               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
               .access = PL1_RW, .accessfn = access_tda,
               .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
               .writefn = dbgbcr_write, .raw_writefn = raw_write
             },
         };
         define_arm_cp_regs(cpu, dbgregs);
         g_free(dbgbvr_el1_name);
         g_free(dbgbcr_el1_name);
     }
 
     for (i = 0; i < wrps; i++) {
         char *dbgwvr_el1_name = g_strdup_printf("DBGWVR%d_EL1", i);
         char *dbgwcr_el1_name = g_strdup_printf("DBGWCR%d_EL1", i);
         ARMCPRegInfo dbgregs[] = {
             { .name = dbgwvr_el1_name, .state = ARM_CP_STATE_BOTH,
               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
               .access = PL1_RW, .accessfn = access_tda,
               .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
               .writefn = dbgwvr_write, .raw_writefn = raw_write
             },
             { .name = dbgwcr_el1_name, .state = ARM_CP_STATE_BOTH,
               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
               .access = PL1_RW, .accessfn = access_tda,
               .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
               .writefn = dbgwcr_write, .raw_writefn = raw_write
             },
         };
         define_arm_cp_regs(cpu, dbgregs);
         g_free(dbgwvr_el1_name);
         g_free(dbgwcr_el1_name);
     }
 }
 
 #if !defined(CONFIG_USER_ONLY)
 
 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
 
     /*
      * In BE32 system mode, target memory is stored byteswapped (on a
      * little-endian host system), and by the time we reach here (via an
      * opcode helper) the addresses of subword accesses have been adjusted
      * to account for that, which means that watchpoints will not match.
      * Undo the adjustment here.
      */
     if (arm_sctlr_b(env)) {
         if (len == 1) {
             addr ^= 3;
         } else if (len == 2) {
             addr ^= 2;
         }
     }
 
     return addr;
 }
 
 #endif