system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-07-21 10:24:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

target-arm queue:

Browse source 
* hw/arm/virt: dt: add rng-seed property
  * Fix MTE check in sve_ldnfff1_r
  * Record tagged bit for user-only in sve_probe_page
  * Correctly implement OS Lock and OS DoubleLock
  * Implement DBGDEVID, DBGDEVID1, DBGDEVID2 registers
  * Fix qemu-system-arm handling of LPAE block descriptors for highmem
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmLG0O8ZHHBldGVyLm1h
 eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3h1MEACnTd+jfssa/MdtQPP8N+cp
 cvrdrW+V9iho1vLPGG3d6yni6T8IMdulA5OvSkiNz2IaspY3z3u/t01PCpqEF0tA
 nl3HxA65ddehzG8QHpORiP2DIJfuYUcMaruK2zMcC//0EXBOVI215hkR7oNyC0r9
 PrYb+tiDVL1t3xzXWNKMoolZwUjS6M6dloxEu2b/d0tOBvtBLI0E7y9taANHCnmZ
 8r7ih0WRELo1rzveZVOXqnZGLUjFzbCurHCmshN6xr2V6iilBaLoaGHovZ2c489Z
 Fz/Ui1tyvDUoajr/Ck57GYo0BwDf9dKYkl5RkchdeY+cA88CgJAVK5pT0Rrybpf0
 lMgSAalIFcnIr2kjdnWRUqL02t+HgnOnsBTSUpgiwMNKwjfMN5NDi9294GuMCu2h
 7UyuAkQvfTwoQyFzJYzuapcnB6i5BvQjq6GxSmogzuR6kNSFptNOGimMhqCO4kN0
 fixOHOOE/aj7QoXq33V9u3ESY1IleDMX6+Zff2RLmVQYZpQKW6LpCfuwgnZrZEN3
 4hPiL+00bY9pWlXvvEHdu0/XYx8kPXtmdzgzpm80edCLUMFOVMDQMQE1Zy/qzC7S
 8ryfC2EvSQuigD1+s6I9WxCnHVv5Byz+DXgRCjRsitDPVu2kFcEgAibzz9K1WVUW
 qwQP4WGUzFD/LNUwO/Vryw==
 =TzwD
 -----END PGP SIGNATURE-----

Merge tag 'pull-target-arm-20220707' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
 * hw/arm/virt: dt: add rng-seed property
 * Fix MTE check in sve_ldnfff1_r
 * Record tagged bit for user-only in sve_probe_page
 * Correctly implement OS Lock and OS DoubleLock
 * Implement DBGDEVID, DBGDEVID1, DBGDEVID2 registers
 * Fix qemu-system-arm handling of LPAE block descriptors for highmem

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmLG0O8ZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3h1MEACnTd+jfssa/MdtQPP8N+cp
# cvrdrW+V9iho1vLPGG3d6yni6T8IMdulA5OvSkiNz2IaspY3z3u/t01PCpqEF0tA
# nl3HxA65ddehzG8QHpORiP2DIJfuYUcMaruK2zMcC//0EXBOVI215hkR7oNyC0r9
# PrYb+tiDVL1t3xzXWNKMoolZwUjS6M6dloxEu2b/d0tOBvtBLI0E7y9taANHCnmZ
# 8r7ih0WRELo1rzveZVOXqnZGLUjFzbCurHCmshN6xr2V6iilBaLoaGHovZ2c489Z
# Fz/Ui1tyvDUoajr/Ck57GYo0BwDf9dKYkl5RkchdeY+cA88CgJAVK5pT0Rrybpf0
# lMgSAalIFcnIr2kjdnWRUqL02t+HgnOnsBTSUpgiwMNKwjfMN5NDi9294GuMCu2h
# 7UyuAkQvfTwoQyFzJYzuapcnB6i5BvQjq6GxSmogzuR6kNSFptNOGimMhqCO4kN0
# fixOHOOE/aj7QoXq33V9u3ESY1IleDMX6+Zff2RLmVQYZpQKW6LpCfuwgnZrZEN3
# 4hPiL+00bY9pWlXvvEHdu0/XYx8kPXtmdzgzpm80edCLUMFOVMDQMQE1Zy/qzC7S
# 8ryfC2EvSQuigD1+s6I9WxCnHVv5Byz+DXgRCjRsitDPVu2kFcEgAibzz9K1WVUW
# qwQP4WGUzFD/LNUwO/Vryw==
# =TzwD
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 07 Jul 2022 05:56:23 PM +0530
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [full]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full]

* tag 'pull-target-arm-20220707' of https://git.linaro.org/people/pmaydell/qemu-arm:
  target/arm: Fix qemu-system-arm handling of LPAE block descriptors for highmem
  target/arm: Correctly implement Feat_DoubleLock
  target/arm: Implement AArch32 DBGDEVID, DBGDEVID1, DBGDEVID2
  target/arm: Suppress debug exceptions when OS Lock set
  target/arm: Move define_debug_regs() to debug_helper.c
  target/arm: Fix code style issues in debug helper functions
  target/arm: Record tagged bit for user-only in sve_probe_page
  target/arm: Fix MTE check in sve_ldnfff1_r
  hw/arm/virt: dt: add rng-seed property

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This commit is contained in:
Richard Henderson 2022-07-08 06:17:11 +05:30
parent 212267df2b c2360eaa02
commit 63b38f6c85
13 changed files with 684 additions and 538 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
docs/about/deprecated.rst
View file

@ -225,6 +225,14 @@ Use the more generic event ``DEVICE_UNPLUG_GUEST_ERROR`` instead.
System emulator machines
------------------------
Arm ``virt`` machine ``dtb-kaslr-seed`` property
''''''''''''''''''''''''''''''''''''''''''''''''
The ``dtb-kaslr-seed`` property on the ``virt`` board has been
deprecated; use the new name ``dtb-randomness`` instead. The new name
better reflects the way this property affects all random data within
the device tree blob, not just the ``kaslr-seed`` node.
PPC 405 ``taihu`` machine (since 7.0)
'''''''''''''''''''''''''''''''''''''

17
docs/system/arm/virt.rst
View file

@ -126,13 +126,18 @@ ras
Set ``on``/``off`` to enable/disable reporting host memory errors to a guest
using ACPI and guest external abort exceptions. The default is off.
dtb-randomness
Set ``on``/``off`` to pass random seeds via the guest DTB
rng-seed and kaslr-seed nodes (in both "/chosen" and
"/secure-chosen") to use for features like the random number
generator and address space randomisation. The default is
``on``. You will want to disable it if your trusted boot chain
will verify the DTB it is passed, since this option causes the
DTB to be non-deterministic. It would be the responsibility of
the firmware to come up with a seed and pass it on if it wants to.
dtb-kaslr-seed
Set ``on``/``off`` to pass a random seed via the guest dtb
kaslr-seed node (in both "/chosen" and /secure-chosen) to use
for features like address space randomisation. The default is
``on``. You will want to disable it if your trusted boot chain will
verify the DTB it is passed. It would be the responsibility of the
firmware to come up with a seed and pass it on if it wants to.
A deprecated synonym for dtb-randomness.
Linux guest kernel configuration
""""""""""""""""""""""""""""""""

44
hw/arm/virt.c
View file

@ -221,14 +221,18 @@ static bool cpu_type_valid(const char *cpu)
return false;
}
static void create_kaslr_seed(MachineState *ms, const char *node)
static void create_randomness(MachineState *ms, const char *node)
{
uint64_t seed;
struct {
uint64_t kaslr;
uint8_t rng[32];
} seed;
if (qemu_guest_getrandom(&seed, sizeof(seed), NULL)) {
return;
}
qemu_fdt_setprop_u64(ms->fdt, node, "kaslr-seed", seed);
qemu_fdt_setprop_u64(ms->fdt, node, "kaslr-seed", seed.kaslr);
qemu_fdt_setprop(ms->fdt, node, "rng-seed", seed.rng, sizeof(seed.rng));
}
static void create_fdt(VirtMachineState *vms)
@ -251,14 +255,14 @@ static void create_fdt(VirtMachineState *vms)
/* /chosen must exist for load_dtb to fill in necessary properties later */
qemu_fdt_add_subnode(fdt, "/chosen");
if (vms->dtb_kaslr_seed) {
create_kaslr_seed(ms, "/chosen");
if (vms->dtb_randomness) {
create_randomness(ms, "/chosen");
}
if (vms->secure) {
qemu_fdt_add_subnode(fdt, "/secure-chosen");
if (vms->dtb_kaslr_seed) {
create_kaslr_seed(ms, "/secure-chosen");
if (vms->dtb_randomness) {
create_randomness(ms, "/secure-chosen");
}
}
@ -2340,18 +2344,18 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
vms->its = value;
}
static bool virt_get_dtb_kaslr_seed(Object *obj, Error **errp)
static bool virt_get_dtb_randomness(Object *obj, Error **errp)
{
VirtMachineState *vms = VIRT_MACHINE(obj);
return vms->dtb_kaslr_seed;
return vms->dtb_randomness;
}
static void virt_set_dtb_kaslr_seed(Object *obj, bool value, Error **errp)
static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
{
VirtMachineState *vms = VIRT_MACHINE(obj);
vms->dtb_kaslr_seed = value;
vms->dtb_randomness = value;
}
static char *virt_get_oem_id(Object *obj, Error **errp)
@ -2980,12 +2984,18 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
"Set on/off to enable/disable "
"ITS instantiation");
object_class_property_add_bool(oc, "dtb-randomness",
virt_get_dtb_randomness,
virt_set_dtb_randomness);
object_class_property_set_description(oc, "dtb-randomness",
"Set off to disable passing random or "
"non-deterministic dtb nodes to guest");
object_class_property_add_bool(oc, "dtb-kaslr-seed",
virt_get_dtb_kaslr_seed,
virt_set_dtb_kaslr_seed);
virt_get_dtb_randomness,
virt_set_dtb_randomness);
object_class_property_set_description(oc, "dtb-kaslr-seed",
"Set off to disable passing of kaslr-seed "
"dtb node to guest");
"Deprecated synonym of dtb-randomness");
object_class_property_add_str(oc, "x-oem-id",
virt_get_oem_id,
@ -3053,8 +3063,8 @@ static void virt_instance_init(Object *obj)
/* MTE is disabled by default. */
vms->mte = false;
/* Supply a kaslr-seed by default */
vms->dtb_kaslr_seed = true;
/* Supply kaslr-seed and rng-seed by default */
vms->dtb_randomness = true;
vms->irqmap = a15irqmap;

2
include/hw/arm/virt.h
View file

@ -152,7 +152,7 @@ struct VirtMachineState {
bool virt;
bool ras;
bool mte;
bool dtb_kaslr_seed;
bool dtb_randomness;
OnOffAuto acpi;
VirtGICType gic_version;
VirtIOMMUType iommu;

3
target/arm/cpregs.h
View file

@ -442,6 +442,9 @@ void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
/* CPReadFn that can be used for read-as-zero behaviour */
uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
/* CPWriteFn that just writes the value to ri->fieldoffset */
void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value);
/*
* CPResetFn that does nothing, for use if no reset is required even
* if fieldoffset is non zero.

27
target/arm/cpu.h
View file

@ -500,6 +500,7 @@ typedef struct CPUArchState {
uint64_t dbgwcr[16]; /* watchpoint control registers */
uint64_t mdscr_el1;
uint64_t oslsr_el1; /* OS Lock Status */
uint64_t osdlr_el1; /* OS DoubleLock status */
uint64_t mdcr_el2;
uint64_t mdcr_el3;
/* Stores the architectural value of the counter *the last time it was
@ -988,6 +989,8 @@ struct ArchCPU {
uint32_t mvfr2;
uint32_t id_dfr0;
uint32_t dbgdidr;
uint32_t dbgdevid;
uint32_t dbgdevid1;
uint64_t id_aa64isar0;
uint64_t id_aa64isar1;
uint64_t id_aa64pfr0;
@ -2251,6 +2254,15 @@ FIELD(DBGDIDR, CTX_CMPS, 20, 4)
FIELD(DBGDIDR, BRPS, 24, 4)
FIELD(DBGDIDR, WRPS, 28, 4)
FIELD(DBGDEVID, PCSAMPLE, 0, 4)
FIELD(DBGDEVID, WPADDRMASK, 4, 4)
FIELD(DBGDEVID, BPADDRMASK, 8, 4)
FIELD(DBGDEVID, VECTORCATCH, 12, 4)
FIELD(DBGDEVID, VIRTEXTNS, 16, 4)
FIELD(DBGDEVID, DOUBLELOCK, 20, 4)
FIELD(DBGDEVID, AUXREGS, 24, 4)
FIELD(DBGDEVID, CIDMASK, 28, 4)
FIELD(MVFR0, SIMDREG, 0, 4)
FIELD(MVFR0, FPSP, 4, 4)
FIELD(MVFR0, FPDP, 8, 4)
@ -3719,11 +3731,21 @@ static inline bool isar_feature_aa32_ssbs(const ARMISARegisters *id)
return FIELD_EX32(id->id_pfr2, ID_PFR2, SSBS) != 0;
}
static inline bool isar_feature_aa32_debugv7p1(const ARMISARegisters *id)
{
return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 5;
}
static inline bool isar_feature_aa32_debugv8p2(const ARMISARegisters *id)
{
return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 8;
}
static inline bool isar_feature_aa32_doublelock(const ARMISARegisters *id)
{
return FIELD_EX32(id->dbgdevid, DBGDEVID, DOUBLELOCK) > 0;
}
/*
* 64-bit feature tests via id registers.
*/
@ -4148,6 +4170,11 @@ static inline bool isar_feature_aa64_sme_fa64(const ARMISARegisters *id)
return FIELD_EX64(id->id_aa64smfr0, ID_AA64SMFR0, FA64);
}
static inline bool isar_feature_aa64_doublelock(const ARMISARegisters *id)
{
return FIELD_SEX64(id->id_aa64dfr0, ID_AA64DFR0, DOUBLELOCK) >= 0;
}
/*
* Feature tests for "does this exist in either 32-bit or 64-bit?"
*/

6
target/arm/cpu64.c
View file

@ -79,6 +79,8 @@ static void aarch64_a57_initfn(Object *obj)
cpu->isar.id_aa64isar0 = 0x00011120;
cpu->isar.id_aa64mmfr0 = 0x00001124;
cpu->isar.dbgdidr = 0x3516d000;
cpu->isar.dbgdevid = 0x01110f13;
cpu->isar.dbgdevid1 = 0x2;
cpu->isar.reset_pmcr_el0 = 0x41013000;
cpu->clidr = 0x0a200023;
cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
@ -134,6 +136,8 @@ static void aarch64_a53_initfn(Object *obj)
cpu->isar.id_aa64isar0 = 0x00011120;
cpu->isar.id_aa64mmfr0 = 0x00001122; /* 40 bit physical addr */
cpu->isar.dbgdidr = 0x3516d000;
cpu->isar.dbgdevid = 0x00110f13;
cpu->isar.dbgdevid1 = 0x1;
cpu->isar.reset_pmcr_el0 = 0x41033000;
cpu->clidr = 0x0a200023;
cpu->ccsidr[0] = 0x700fe01a; /* 32KB L1 dcache */
@ -187,6 +191,8 @@ static void aarch64_a72_initfn(Object *obj)
cpu->isar.id_aa64isar0 = 0x00011120;
cpu->isar.id_aa64mmfr0 = 0x00001124;
cpu->isar.dbgdidr = 0x3516d000;
cpu->isar.dbgdevid = 0x01110f13;
cpu->isar.dbgdevid1 = 0x2;
cpu->isar.reset_pmcr_el0 = 0x41023000;
cpu->clidr = 0x0a200023;
cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */

6
target/arm/cpu_tcg.c
View file

@ -563,6 +563,8 @@ static void cortex_a7_initfn(Object *obj)
cpu->isar.id_isar3 = 0x11112131;
cpu->isar.id_isar4 = 0x10011142;
cpu->isar.dbgdidr = 0x3515f005;
cpu->isar.dbgdevid = 0x01110f13;
cpu->isar.dbgdevid1 = 0x1;
cpu->clidr = 0x0a200023;
cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
@ -606,6 +608,8 @@ static void cortex_a15_initfn(Object *obj)
cpu->isar.id_isar3 = 0x11112131;
cpu->isar.id_isar4 = 0x10011142;
cpu->isar.dbgdidr = 0x3515f021;
cpu->isar.dbgdevid = 0x01110f13;
cpu->isar.dbgdevid1 = 0x0;
cpu->clidr = 0x0a200023;
cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
@ -1098,6 +1102,8 @@ static void arm_max_initfn(Object *obj)
cpu->isar.id_isar5 = 0x00011121;
cpu->isar.id_isar6 = 0;
cpu->isar.dbgdidr = 0x3516d000;
cpu->isar.dbgdevid = 0x00110f13;
cpu->isar.dbgdevid1 = 0x2;
cpu->isar.reset_pmcr_el0 = 0x41013000;
cpu->clidr = 0x0a200023;
cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */

580
target/arm/debug_helper.c
View file

@ -6,8 +6,10 @@
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "qemu/osdep.h"
#include "qemu/log.h"
#include "cpu.h"
#include "internals.h"
#include "cpregs.h"
#include "exec/exec-all.h"
#include "exec/helper-proto.h"
@ -140,6 +142,9 @@ static bool aa32_generate_debug_exceptions(CPUARMState *env)
*/
bool arm_generate_debug_exceptions(CPUARMState *env)
{
if ((env->cp15.oslsr_el1 & 1) || (env->cp15.osdlr_el1 & 1)) {
return false;
}
if (is_a64(env)) {
return aa64_generate_debug_exceptions(env);
} else {
@ -528,6 +533,581 @@ void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
raise_exception_debug(env, EXCP_UDEF, syndrome);
}
/*
* Check for traps to "powerdown debug" registers, which are controlled
* by MDCR.TDOSA
*/
static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
bool isread)
{
int el = arm_current_el(env);
uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
(arm_hcr_el2_eff(env) & HCR_TGE);
if (el < 2 && mdcr_el2_tdosa) {
return CP_ACCESS_TRAP_EL2;
}
if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
return CP_ACCESS_TRAP_EL3;
}
return CP_ACCESS_OK;
}
/*
* Check for traps to "debug ROM" registers, which are controlled
* by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
*/
static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
bool isread)
{
int el = arm_current_el(env);
uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
(arm_hcr_el2_eff(env) & HCR_TGE);
if (el < 2 && mdcr_el2_tdra) {
return CP_ACCESS_TRAP_EL2;
}
if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
return CP_ACCESS_TRAP_EL3;
}
return CP_ACCESS_OK;
}
/*
* Check for traps to general debug registers, which are controlled
* by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
*/
static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
bool isread)
{
int el = arm_current_el(env);
uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
(arm_hcr_el2_eff(env) & HCR_TGE);
if (el < 2 && mdcr_el2_tda) {
return CP_ACCESS_TRAP_EL2;
}
if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
return CP_ACCESS_TRAP_EL3;
}
return CP_ACCESS_OK;
}
static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
/*
* Writes to OSLAR_EL1 may update the OS lock status, which can be
* read via a bit in OSLSR_EL1.
*/
int oslock;
if (ri->state == ARM_CP_STATE_AA32) {
oslock = (value == 0xC5ACCE55);
} else {
oslock = value & 1;
}
env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
}
static void osdlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
ARMCPU *cpu = env_archcpu(env);
/*
* Only defined bit is bit 0 (DLK); if Feat_DoubleLock is not
* implemented this is RAZ/WI.
*/
if(arm_feature(env, ARM_FEATURE_AARCH64)
? cpu_isar_feature(aa64_doublelock, cpu)
: cpu_isar_feature(aa32_doublelock, cpu)) {
env->cp15.osdlr_el1 = value & 1;
}
}
static const ARMCPRegInfo debug_cp_reginfo[] = {
/*
* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
* debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
* unlike DBGDRAR it is never accessible from EL0.
* DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
* accessor.
*/
{ .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
.access = PL0_R, .accessfn = access_tdra,
.type = ARM_CP_CONST, .resetvalue = 0 },
{ .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
.opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
.access = PL1_R, .accessfn = access_tdra,
.type = ARM_CP_CONST, .resetvalue = 0 },
{ .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
.access = PL0_R, .accessfn = access_tdra,
.type = ARM_CP_CONST, .resetvalue = 0 },
/* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
{ .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
.resetvalue = 0 },
/*
* MDCCSR_EL0[30:29] map to EDSCR[30:29]. Simply RAZ as the external
* Debug Communication Channel is not implemented.
*/
{ .name = "MDCCSR_EL0", .state = ARM_CP_STATE_AA64,
.opc0 = 2, .opc1 = 3, .crn = 0, .crm = 1, .opc2 = 0,
.access = PL0_R, .accessfn = access_tda,
.type = ARM_CP_CONST, .resetvalue = 0 },
/*
* DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2]. Map all bits as
* it is unlikely a guest will care.
* We don't implement the configurable EL0 access.
*/
{ .name = "DBGDSCRint", .state = ARM_CP_STATE_AA32,
.cp = 14, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
.type = ARM_CP_ALIAS,
.access = PL1_R, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
{ .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
.access = PL1_W, .type = ARM_CP_NO_RAW,
.accessfn = access_tdosa,
.writefn = oslar_write },
{ .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
.access = PL1_R, .resetvalue = 10,
.accessfn = access_tdosa,
.fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
/* Dummy OSDLR_EL1: 32-bit Linux will read this */
{ .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
.access = PL1_RW, .accessfn = access_tdosa,
.writefn = osdlr_write,
.fieldoffset = offsetof(CPUARMState, cp15.osdlr_el1) },
/*
* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
* implement vector catch debug events yet.
*/
{ .name = "DBGVCR",
.cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
.access = PL1_RW, .accessfn = access_tda,
.type = ARM_CP_NOP },
/*
* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
* to save and restore a 32-bit guest's DBGVCR)
*/
{ .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
.opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
.access = PL2_RW, .accessfn = access_tda,
.type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
/*
* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
* Channel but Linux may try to access this register. The 32-bit
* alias is DBGDCCINT.
*/
{ .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
.access = PL1_RW, .accessfn = access_tda,
.type = ARM_CP_NOP },
};
static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
/* 64 bit access versions of the (dummy) debug registers */
{ .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
.access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
{ .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
.access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
};
void hw_watchpoint_update(ARMCPU *cpu, int n)
{
CPUARMState *env = &cpu->env;
vaddr len = 0;
vaddr wvr = env->cp15.dbgwvr[n];
uint64_t wcr = env->cp15.dbgwcr[n];
int mask;
int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
if (env->cpu_watchpoint[n]) {
cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
env->cpu_watchpoint[n] = NULL;
}
if (!FIELD_EX64(wcr, DBGWCR, E)) {
/* E bit clear : watchpoint disabled */
return;
}
switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
case 0:
/* LSC 00 is reserved and must behave as if the wp is disabled */
return;
case 1:
flags |= BP_MEM_READ;
break;
case 2:
flags |= BP_MEM_WRITE;
break;
case 3:
flags |= BP_MEM_ACCESS;
break;
}
/*
* Attempts to use both MASK and BAS fields simultaneously are
* CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
* thus generating a watchpoint for every byte in the masked region.
*/
mask = FIELD_EX64(wcr, DBGWCR, MASK);
if (mask == 1 || mask == 2) {
/*
* Reserved values of MASK; we must act as if the mask value was
* some non-reserved value, or as if the watchpoint were disabled.
* We choose the latter.
*/
return;
} else if (mask) {
/* Watchpoint covers an aligned area up to 2GB in size */
len = 1ULL << mask;
/*
* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
* whether the watchpoint fires when the unmasked bits match; we opt
* to generate the exceptions.
*/
wvr &= ~(len - 1);
} else {
/* Watchpoint covers bytes defined by the byte address select bits */
int bas = FIELD_EX64(wcr, DBGWCR, BAS);
int basstart;
if (extract64(wvr, 2, 1)) {
/*
* Deprecated case of an only 4-aligned address. BAS[7:4] are
* ignored, and BAS[3:0] define which bytes to watch.
*/
bas &= 0xf;
}
if (bas == 0) {
/* This must act as if the watchpoint is disabled */
return;
}
/*
* The BAS bits are supposed to be programmed to indicate a contiguous
* range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
* we fire for each byte in the word/doubleword addressed by the WVR.
* We choose to ignore any non-zero bits after the first range of 1s.
*/
basstart = ctz32(bas);
len = cto32(bas >> basstart);
wvr += basstart;
}
cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
&env->cpu_watchpoint[n]);
}
void hw_watchpoint_update_all(ARMCPU *cpu)
{
int i;
CPUARMState *env = &cpu->env;
/*
* Completely clear out existing QEMU watchpoints and our array, to
* avoid possible stale entries following migration load.
*/
cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
hw_watchpoint_update(cpu, i);
}
}
static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
ARMCPU *cpu = env_archcpu(env);
int i = ri->crm;
/*
* Bits [1:0] are RES0.
*
* It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
* are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
* they contain the value written. It is CONSTRAINED UNPREDICTABLE
* whether the RESS bits are ignored when comparing an address.
*
* Therefore we are allowed to compare the entire register, which lets
* us avoid considering whether or not FEAT_LVA is actually enabled.
*/
value &= ~3ULL;
raw_write(env, ri, value);
hw_watchpoint_update(cpu, i);
}
static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
ARMCPU *cpu = env_archcpu(env);
int i = ri->crm;
raw_write(env, ri, value);
hw_watchpoint_update(cpu, i);
}
void hw_breakpoint_update(ARMCPU *cpu, int n)
{
CPUARMState *env = &cpu->env;
uint64_t bvr = env->cp15.dbgbvr[n];
uint64_t bcr = env->cp15.dbgbcr[n];
vaddr addr;
int bt;
int flags = BP_CPU;
if (env->cpu_breakpoint[n]) {
cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
env->cpu_breakpoint[n] = NULL;
}
if (!extract64(bcr, 0, 1)) {
/* E bit clear : watchpoint disabled */
return;
}
bt = extract64(bcr, 20, 4);
switch (bt) {
case 4: /* unlinked address mismatch (reserved if AArch64) */
case 5: /* linked address mismatch (reserved if AArch64) */
qemu_log_mask(LOG_UNIMP,
"arm: address mismatch breakpoint types not implemented\n");
return;
case 0: /* unlinked address match */
case 1: /* linked address match */
{
/*
* Bits [1:0] are RES0.
*
* It is IMPLEMENTATION DEFINED whether bits [63:49]
* ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
* of the VA field ([48] or [52] for FEAT_LVA), or whether the
* value is read as written. It is CONSTRAINED UNPREDICTABLE
* whether the RESS bits are ignored when comparing an address.
* Therefore we are allowed to compare the entire register, which
* lets us avoid considering whether FEAT_LVA is actually enabled.
*
* The BAS field is used to allow setting breakpoints on 16-bit
* wide instructions; it is CONSTRAINED UNPREDICTABLE whether
* a bp will fire if the addresses covered by the bp and the addresses
* covered by the insn overlap but the insn doesn't start at the
* start of the bp address range. We choose to require the insn and
* the bp to have the same address. The constraints on writing to
* BAS enforced in dbgbcr_write mean we have only four cases:
* 0b0000 => no breakpoint
* 0b0011 => breakpoint on addr
* 0b1100 => breakpoint on addr + 2
* 0b1111 => breakpoint on addr
* See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
*/
int bas = extract64(bcr, 5, 4);
addr = bvr & ~3ULL;
if (bas == 0) {
return;
}
if (bas == 0xc) {
addr += 2;
}
break;
}
case 2: /* unlinked context ID match */
case 8: /* unlinked VMID match (reserved if no EL2) */
case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
qemu_log_mask(LOG_UNIMP,
"arm: unlinked context breakpoint types not implemented\n");
return;
case 9: /* linked VMID match (reserved if no EL2) */
case 11: /* linked context ID and VMID match (reserved if no EL2) */
case 3: /* linked context ID match */
default:
/*
* We must generate no events for Linked context matches (unless
* they are linked to by some other bp/wp, which is handled in
* updates for the linking bp/wp). We choose to also generate no events
* for reserved values.
*/
return;
}
cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
}
void hw_breakpoint_update_all(ARMCPU *cpu)
{
int i;
CPUARMState *env = &cpu->env;
/*
* Completely clear out existing QEMU breakpoints and our array, to
* avoid possible stale entries following migration load.
*/
cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
hw_breakpoint_update(cpu, i);
}
}
static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
ARMCPU *cpu = env_archcpu(env);
int i = ri->crm;
raw_write(env, ri, value);
hw_breakpoint_update(cpu, i);
}
static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
ARMCPU *cpu = env_archcpu(env);
int i = ri->crm;
/*
* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
* copy of BAS[0].
*/
value = deposit64(value, 6, 1, extract64(value, 5, 1));
value = deposit64(value, 8, 1, extract64(value, 7, 1));
raw_write(env, ri, value);
hw_breakpoint_update(cpu, i);
}
void define_debug_regs(ARMCPU *cpu)
{
/*
* Define v7 and v8 architectural debug registers.
* These are just dummy implementations for now.
*/
int i;
int wrps, brps, ctx_cmps;
/*
* The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
* use AArch32. Given that bit 15 is RES1, if the value is 0 then
* the register must not exist for this cpu.
*/
if (cpu->isar.dbgdidr != 0) {
ARMCPRegInfo dbgdidr = {
.name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
.opc1 = 0, .opc2 = 0,
.access = PL0_R, .accessfn = access_tda,
.type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
};
define_one_arm_cp_reg(cpu, &dbgdidr);
}
/*
* DBGDEVID is present in the v7 debug architecture if
* DBGDIDR.DEVID_imp is 1 (bit 15); from v7.1 and on it is
* mandatory (and bit 15 is RES1). DBGDEVID1 and DBGDEVID2 exist
* from v7.1 of the debug architecture. Because no fields have yet
* been defined in DBGDEVID2 (and quite possibly none will ever
* be) we don't define an ARMISARegisters field for it.
* These registers exist only if EL1 can use AArch32, but that
* happens naturally because they are only PL1 accessible anyway.
*/
if (extract32(cpu->isar.dbgdidr, 15, 1)) {
ARMCPRegInfo dbgdevid = {
.name = "DBGDEVID",
.cp = 14, .opc1 = 0, .crn = 7, .opc2 = 2, .crn = 7,
.access = PL1_R, .accessfn = access_tda,
.type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid,
};
define_one_arm_cp_reg(cpu, &dbgdevid);
}
if (cpu_isar_feature(aa32_debugv7p1, cpu)) {
ARMCPRegInfo dbgdevid12[] = {
{
.name = "DBGDEVID1",
.cp = 14, .opc1 = 0, .crn = 7, .opc2 = 1, .crn = 7,
.access = PL1_R, .accessfn = access_tda,
.type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid1,
}, {
.name = "DBGDEVID2",
.cp = 14, .opc1 = 0, .crn = 7, .opc2 = 0, .crn = 7,
.access = PL1_R, .accessfn = access_tda,
.type = ARM_CP_CONST, .resetvalue = 0,
},
};
define_arm_cp_regs(cpu, dbgdevid12);
}
brps = arm_num_brps(cpu);
wrps = arm_num_wrps(cpu);
ctx_cmps = arm_num_ctx_cmps(cpu);
assert(ctx_cmps <= brps);
define_arm_cp_regs(cpu, debug_cp_reginfo);
if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
}
for (i = 0; i < brps; i++) {
char *dbgbvr_el1_name = g_strdup_printf("DBGBVR%d_EL1", i);
char *dbgbcr_el1_name = g_strdup_printf("DBGBCR%d_EL1", i);
ARMCPRegInfo dbgregs[] = {
{ .name = dbgbvr_el1_name, .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
.writefn = dbgbvr_write, .raw_writefn = raw_write
},
{ .name = dbgbcr_el1_name, .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
.writefn = dbgbcr_write, .raw_writefn = raw_write
},
};
define_arm_cp_regs(cpu, dbgregs);
g_free(dbgbvr_el1_name);
g_free(dbgbcr_el1_name);
}
for (i = 0; i < wrps; i++) {
char *dbgwvr_el1_name = g_strdup_printf("DBGWVR%d_EL1", i);
char *dbgwcr_el1_name = g_strdup_printf("DBGWCR%d_EL1", i);
ARMCPRegInfo dbgregs[] = {
{ .name = dbgwvr_el1_name, .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
.writefn = dbgwvr_write, .raw_writefn = raw_write
},
{ .name = dbgwcr_el1_name, .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
.writefn = dbgwcr_write, .raw_writefn = raw_write
},
};
define_arm_cp_regs(cpu, dbgregs);
g_free(dbgwvr_el1_name);
g_free(dbgwcr_el1_name);
}
}
#if !defined(CONFIG_USER_ONLY)
vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)

513
target/arm/helper.c
View file

@ -51,8 +51,7 @@ static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
}
}
static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
{
assert(ri->fieldoffset);
if (cpreg_field_is_64bit(ri)) {
@ -302,71 +301,6 @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
return CP_ACCESS_TRAP_UNCATEGORIZED;
}
static uint64_t arm_mdcr_el2_eff(CPUARMState *env)
{
return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
}
/* Check for traps to "powerdown debug" registers, which are controlled
* by MDCR.TDOSA
*/
static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
bool isread)
{
int el = arm_current_el(env);
uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
(arm_hcr_el2_eff(env) & HCR_TGE);
if (el < 2 && mdcr_el2_tdosa) {
return CP_ACCESS_TRAP_EL2;
}
if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
return CP_ACCESS_TRAP_EL3;
}
return CP_ACCESS_OK;
}
/* Check for traps to "debug ROM" registers, which are controlled
* by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
*/
static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
bool isread)
{
int el = arm_current_el(env);
uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
(arm_hcr_el2_eff(env) & HCR_TGE);
if (el < 2 && mdcr_el2_tdra) {
return CP_ACCESS_TRAP_EL2;
}
if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
return CP_ACCESS_TRAP_EL3;
}
return CP_ACCESS_OK;
}
/* Check for traps to general debug registers, which are controlled
* by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
*/
static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
bool isread)
{
int el = arm_current_el(env);
uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
(arm_hcr_el2_eff(env) & HCR_TGE);
if (el < 2 && mdcr_el2_tda) {
return CP_ACCESS_TRAP_EL2;
}
if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
return CP_ACCESS_TRAP_EL3;
}
return CP_ACCESS_OK;
}
/* Check for traps to performance monitor registers, which are controlled
* by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
*/
@ -5979,111 +5913,6 @@ static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
return CP_ACCESS_OK;
}
static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
/* Writes to OSLAR_EL1 may update the OS lock status, which can be
* read via a bit in OSLSR_EL1.
*/
int oslock;
if (ri->state == ARM_CP_STATE_AA32) {
oslock = (value == 0xC5ACCE55);
} else {
oslock = value & 1;
}
env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
}
static const ARMCPRegInfo debug_cp_reginfo[] = {
/* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
* debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
* unlike DBGDRAR it is never accessible from EL0.
* DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
* accessor.
*/
{ .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
.access = PL0_R, .accessfn = access_tdra,
.type = ARM_CP_CONST, .resetvalue = 0 },
{ .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
.opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
.access = PL1_R, .accessfn = access_tdra,
.type = ARM_CP_CONST, .resetvalue = 0 },
{ .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
.access = PL0_R, .accessfn = access_tdra,
.type = ARM_CP_CONST, .resetvalue = 0 },
/* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
{ .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
.resetvalue = 0 },
/*
* MDCCSR_EL0[30:29] map to EDSCR[30:29]. Simply RAZ as the external
* Debug Communication Channel is not implemented.
*/
{ .name = "MDCCSR_EL0", .state = ARM_CP_STATE_AA64,
.opc0 = 2, .opc1 = 3, .crn = 0, .crm = 1, .opc2 = 0,
.access = PL0_R, .accessfn = access_tda,
.type = ARM_CP_CONST, .resetvalue = 0 },
/*
* DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2]. Map all bits as
* it is unlikely a guest will care.
* We don't implement the configurable EL0 access.
*/
{ .name = "DBGDSCRint", .state = ARM_CP_STATE_AA32,
.cp = 14, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
.type = ARM_CP_ALIAS,
.access = PL1_R, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
{ .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
.access = PL1_W, .type = ARM_CP_NO_RAW,
.accessfn = access_tdosa,
.writefn = oslar_write },
{ .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
.access = PL1_R, .resetvalue = 10,
.accessfn = access_tdosa,
.fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
/* Dummy OSDLR_EL1: 32-bit Linux will read this */
{ .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
.access = PL1_RW, .accessfn = access_tdosa,
.type = ARM_CP_NOP },
/* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
* implement vector catch debug events yet.
*/
{ .name = "DBGVCR",
.cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
.access = PL1_RW, .accessfn = access_tda,
.type = ARM_CP_NOP },
/* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
* to save and restore a 32-bit guest's DBGVCR)
*/
{ .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
.opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
.access = PL2_RW, .accessfn = access_tda,
.type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
/* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
* Channel but Linux may try to access this register. The 32-bit
* alias is DBGDCCINT.
*/
{ .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
.access = PL1_RW, .accessfn = access_tda,
.type = ARM_CP_NOP },
};
static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
/* 64 bit access versions of the (dummy) debug registers */
{ .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
.access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
{ .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
.access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
};
/*
* Check for traps to RAS registers, which are controlled
* by HCR_EL2.TERR and SCR_EL3.TERR.
@ -6462,346 +6291,6 @@ static const ARMCPRegInfo sme_reginfo[] = {
};
#endif /* TARGET_AARCH64 */
void hw_watchpoint_update(ARMCPU *cpu, int n)
{
CPUARMState *env = &cpu->env;
vaddr len = 0;
vaddr wvr = env->cp15.dbgwvr[n];
uint64_t wcr = env->cp15.dbgwcr[n];
int mask;
int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
if (env->cpu_watchpoint[n]) {
cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
env->cpu_watchpoint[n] = NULL;
}
if (!FIELD_EX64(wcr, DBGWCR, E)) {
/* E bit clear : watchpoint disabled */
return;
}
switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
case 0:
/* LSC 00 is reserved and must behave as if the wp is disabled */
return;
case 1:
flags |= BP_MEM_READ;
break;
case 2:
flags |= BP_MEM_WRITE;
break;
case 3:
flags |= BP_MEM_ACCESS;
break;
}
/* Attempts to use both MASK and BAS fields simultaneously are
* CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
* thus generating a watchpoint for every byte in the masked region.
*/
mask = FIELD_EX64(wcr, DBGWCR, MASK);
if (mask == 1 || mask == 2) {
/* Reserved values of MASK; we must act as if the mask value was
* some non-reserved value, or as if the watchpoint were disabled.
* We choose the latter.
*/
return;
} else if (mask) {
/* Watchpoint covers an aligned area up to 2GB in size */
len = 1ULL << mask;
/* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
* whether the watchpoint fires when the unmasked bits match; we opt
* to generate the exceptions.
*/
wvr &= ~(len - 1);
} else {
/* Watchpoint covers bytes defined by the byte address select bits */
int bas = FIELD_EX64(wcr, DBGWCR, BAS);
int basstart;
if (extract64(wvr, 2, 1)) {
/* Deprecated case of an only 4-aligned address. BAS[7:4] are
* ignored, and BAS[3:0] define which bytes to watch.
*/
bas &= 0xf;
}
if (bas == 0) {
/* This must act as if the watchpoint is disabled */
return;
}
/* The BAS bits are supposed to be programmed to indicate a contiguous
* range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
* we fire for each byte in the word/doubleword addressed by the WVR.
* We choose to ignore any non-zero bits after the first range of 1s.
*/
basstart = ctz32(bas);
len = cto32(bas >> basstart);
wvr += basstart;
}
cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
&env->cpu_watchpoint[n]);
}
void hw_watchpoint_update_all(ARMCPU *cpu)
{
int i;
CPUARMState *env = &cpu->env;
/* Completely clear out existing QEMU watchpoints and our array, to
* avoid possible stale entries following migration load.
*/
cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
hw_watchpoint_update(cpu, i);
}
}
static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
ARMCPU *cpu = env_archcpu(env);
int i = ri->crm;
/*
* Bits [1:0] are RES0.
*
* It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
* are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
* they contain the value written. It is CONSTRAINED UNPREDICTABLE
* whether the RESS bits are ignored when comparing an address.
*
* Therefore we are allowed to compare the entire register, which lets
* us avoid considering whether or not FEAT_LVA is actually enabled.
*/
value &= ~3ULL;
raw_write(env, ri, value);
hw_watchpoint_update(cpu, i);
}
static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
ARMCPU *cpu = env_archcpu(env);
int i = ri->crm;
raw_write(env, ri, value);
hw_watchpoint_update(cpu, i);
}
void hw_breakpoint_update(ARMCPU *cpu, int n)
{
CPUARMState *env = &cpu->env;
uint64_t bvr = env->cp15.dbgbvr[n];
uint64_t bcr = env->cp15.dbgbcr[n];
vaddr addr;
int bt;
int flags = BP_CPU;
if (env->cpu_breakpoint[n]) {
cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
env->cpu_breakpoint[n] = NULL;
}
if (!extract64(bcr, 0, 1)) {
/* E bit clear : watchpoint disabled */
return;
}
bt = extract64(bcr, 20, 4);
switch (bt) {
case 4: /* unlinked address mismatch (reserved if AArch64) */
case 5: /* linked address mismatch (reserved if AArch64) */
qemu_log_mask(LOG_UNIMP,
"arm: address mismatch breakpoint types not implemented\n");
return;
case 0: /* unlinked address match */
case 1: /* linked address match */
{
/*
* Bits [1:0] are RES0.
*
* It is IMPLEMENTATION DEFINED whether bits [63:49]
* ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
* of the VA field ([48] or [52] for FEAT_LVA), or whether the
* value is read as written. It is CONSTRAINED UNPREDICTABLE
* whether the RESS bits are ignored when comparing an address.
* Therefore we are allowed to compare the entire register, which
* lets us avoid considering whether FEAT_LVA is actually enabled.
*
* The BAS field is used to allow setting breakpoints on 16-bit
* wide instructions; it is CONSTRAINED UNPREDICTABLE whether
* a bp will fire if the addresses covered by the bp and the addresses
* covered by the insn overlap but the insn doesn't start at the
* start of the bp address range. We choose to require the insn and
* the bp to have the same address. The constraints on writing to
* BAS enforced in dbgbcr_write mean we have only four cases:
* 0b0000 => no breakpoint
* 0b0011 => breakpoint on addr
* 0b1100 => breakpoint on addr + 2
* 0b1111 => breakpoint on addr
* See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
*/
int bas = extract64(bcr, 5, 4);
addr = bvr & ~3ULL;
if (bas == 0) {
return;
}
if (bas == 0xc) {
addr += 2;
}
break;
}
case 2: /* unlinked context ID match */
case 8: /* unlinked VMID match (reserved if no EL2) */
case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
qemu_log_mask(LOG_UNIMP,
"arm: unlinked context breakpoint types not implemented\n");
return;
case 9: /* linked VMID match (reserved if no EL2) */
case 11: /* linked context ID and VMID match (reserved if no EL2) */
case 3: /* linked context ID match */
default:
/* We must generate no events for Linked context matches (unless
* they are linked to by some other bp/wp, which is handled in
* updates for the linking bp/wp). We choose to also generate no events
* for reserved values.
*/
return;
}
cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
}
void hw_breakpoint_update_all(ARMCPU *cpu)
{
int i;
CPUARMState *env = &cpu->env;
/* Completely clear out existing QEMU breakpoints and our array, to
* avoid possible stale entries following migration load.
*/
cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
hw_breakpoint_update(cpu, i);
}
}
static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
ARMCPU *cpu = env_archcpu(env);
int i = ri->crm;
raw_write(env, ri, value);
hw_breakpoint_update(cpu, i);
}
static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
{
ARMCPU *cpu = env_archcpu(env);
int i = ri->crm;
/* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
* copy of BAS[0].
*/
value = deposit64(value, 6, 1, extract64(value, 5, 1));
value = deposit64(value, 8, 1, extract64(value, 7, 1));
raw_write(env, ri, value);
hw_breakpoint_update(cpu, i);
}
static void define_debug_regs(ARMCPU *cpu)
{
/* Define v7 and v8 architectural debug registers.
* These are just dummy implementations for now.
*/
int i;
int wrps, brps, ctx_cmps;
/*
* The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
* use AArch32. Given that bit 15 is RES1, if the value is 0 then
* the register must not exist for this cpu.
*/
if (cpu->isar.dbgdidr != 0) {
ARMCPRegInfo dbgdidr = {
.name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
.opc1 = 0, .opc2 = 0,
.access = PL0_R, .accessfn = access_tda,
.type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
};
define_one_arm_cp_reg(cpu, &dbgdidr);
}
brps = arm_num_brps(cpu);
wrps = arm_num_wrps(cpu);
ctx_cmps = arm_num_ctx_cmps(cpu);
assert(ctx_cmps <= brps);
define_arm_cp_regs(cpu, debug_cp_reginfo);
if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
}
for (i = 0; i < brps; i++) {
char *dbgbvr_el1_name = g_strdup_printf("DBGBVR%d_EL1", i);
char *dbgbcr_el1_name = g_strdup_printf("DBGBCR%d_EL1", i);
ARMCPRegInfo dbgregs[] = {
{ .name = dbgbvr_el1_name, .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
.writefn = dbgbvr_write, .raw_writefn = raw_write
},
{ .name = dbgbcr_el1_name, .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
.writefn = dbgbcr_write, .raw_writefn = raw_write
},
};
define_arm_cp_regs(cpu, dbgregs);
g_free(dbgbvr_el1_name);
g_free(dbgbcr_el1_name);
}
for (i = 0; i < wrps; i++) {
char *dbgwvr_el1_name = g_strdup_printf("DBGWVR%d_EL1", i);
char *dbgwcr_el1_name = g_strdup_printf("DBGWCR%d_EL1", i);
ARMCPRegInfo dbgregs[] = {
{ .name = dbgwvr_el1_name, .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
.writefn = dbgwvr_write, .raw_writefn = raw_write
},
{ .name = dbgwcr_el1_name, .state = ARM_CP_STATE_BOTH,
.cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
.access = PL1_RW, .accessfn = access_tda,
.fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
.writefn = dbgwcr_write, .raw_writefn = raw_write
},
};
define_arm_cp_regs(cpu, dbgregs);
g_free(dbgwvr_el1_name);
g_free(dbgwcr_el1_name);
}
}
static void define_pmu_regs(ARMCPU *cpu)
{
/*

9
target/arm/internals.h
View file

@ -1307,6 +1307,15 @@ int exception_target_el(CPUARMState *env);
bool arm_singlestep_active(CPUARMState *env);
bool arm_generate_debug_exceptions(CPUARMState *env);
/* Add the cpreg definitions for debug related system registers */
void define_debug_regs(ARMCPU *cpu);
/* Effective value of MDCR_EL2 */
static inline uint64_t arm_mdcr_el2_eff(CPUARMState *env)
{
return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
}
/* Powers of 2 for sve_vq_map et al. */
#define SVE_VQ_POW2_MAP \
((1 << (1 - 1)) | (1 << (2 - 1)) | \

2
target/arm/ptw.c
View file

@ -1257,7 +1257,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
* clear the lower bits here before ORing in the low vaddr bits.
*/
page_size = (1ULL << ((stride * (4 - level)) + 3));
descaddr &= ~(page_size - 1);
descaddr &= ~(hwaddr)(page_size - 1);
descaddr |= (address & (page_size - 1));
/* Extract attributes from the descriptor */
attrs = extract64(descriptor, 2, 10)

5
target/arm/sve_helper.c
View file

@ -5337,6 +5337,9 @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env,
#ifdef CONFIG_USER_ONLY
memset(&info->attrs, 0, sizeof(info->attrs));
/* Require both MAP_ANON and PROT_MTE -- see allocation_tag_mem. */
arm_tlb_mte_tagged(&info->attrs) =
(flags & PAGE_ANON) && (flags & PAGE_MTE);
#else
/*
* Find the iotlbentry for addr and return the transaction attributes.
@ -5986,7 +5989,7 @@ void sve_ldnfff1_r(CPUARMState *env, void *vg, const target_ulong addr,
* Disable MTE checking if the Tagged bit is not set. Since TBI must
* be set within MTEDESC for MTE, !mtedesc => !mte_active.
*/
if (arm_tlb_mte_tagged(&info.page[0].attrs)) {
if (!arm_tlb_mte_tagged(&info.page[0].attrs)) {
mtedesc = 0;
}