target/arm/debug_helper.c

   1 /*
   2  * ARM debug helpers.
   3  *
   4  * This code is licensed under the GNU GPL v2 or later.
   5  *
   6  * SPDX-License-Identifier: GPL-2.0-or-later
   7  */
   8 #include "qemu/osdep.h"
   9 #include "qemu/log.h"
  10 #include "cpu.h"
  11 #include "internals.h"
  12 #include "cpregs.h"
  13 #include "exec/exec-all.h"
  14 #include "exec/helper-proto.h"
  15
  16
  17 /* Return the Exception Level targeted by debug exceptions. */
  18 static int arm_debug_target_el(CPUARMState *env)
  19 {
  20     bool secure = arm_is_secure(env);
  21     bool route_to_el2 = false;
  22
  23     if (arm_is_el2_enabled(env)) {
  24         route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
  25                        env->cp15.mdcr_el2 & MDCR_TDE;
  26     }
  27
  28     if (route_to_el2) {
  29         return 2;
  30     } else if (arm_feature(env, ARM_FEATURE_EL3) &&
  31                !arm_el_is_aa64(env, 3) && secure) {
  32         return 3;
  33     } else {
  34         return 1;
  35     }
  36 }
  37
  38 /*
  39  * Raise an exception to the debug target el.
  40  * Modify syndrome to indicate when origin and target EL are the same.
  41  */
  42 G_NORETURN static void
  43 raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome)
  44 {
  45     int debug_el = arm_debug_target_el(env);
  46     int cur_el = arm_current_el(env);
  47
  48     /*
  49      * If singlestep is targeting a lower EL than the current one, then
  50      * DisasContext.ss_active must be false and we can never get here.
  51      * Similarly for watchpoint and breakpoint matches.
  52      */
  53     assert(debug_el >= cur_el);
  54     syndrome |= (debug_el == cur_el) << ARM_EL_EC_SHIFT;
  55     raise_exception(env, excp, syndrome, debug_el);
  56 }
  57
  58 /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
  59 static bool aa64_generate_debug_exceptions(CPUARMState *env)
  60 {
  61     int cur_el = arm_current_el(env);
  62     int debug_el;
  63
  64     if (cur_el == 3) {
  65         return false;
  66     }
  67
  68     /* MDCR_EL3.SDD disables debug events from Secure state */
  69     if (arm_is_secure_below_el3(env)
  70         && extract32(env->cp15.mdcr_el3, 16, 1)) {
  71         return false;
  72     }
  73
  74     /*
  75      * Same EL to same EL debug exceptions need MDSCR_KDE enabled
  76      * while not masking the (D)ebug bit in DAIF.
  77      */
  78     debug_el = arm_debug_target_el(env);
  79
  80     if (cur_el == debug_el) {
  81         return extract32(env->cp15.mdscr_el1, 13, 1)
  82             && !(env->daif & PSTATE_D);
  83     }
  84
  85     /* Otherwise the debug target needs to be a higher EL */
  86     return debug_el > cur_el;
  87 }
  88
  89 static bool aa32_generate_debug_exceptions(CPUARMState *env)
  90 {
  91     int el = arm_current_el(env);
  92
  93     if (el == 0 && arm_el_is_aa64(env, 1)) {
  94         return aa64_generate_debug_exceptions(env);
  95     }
  96
  97     if (arm_is_secure(env)) {
  98         int spd;
  99
 100         if (el == 0 && (env->cp15.sder & 1)) {
 101             /*
 102              * SDER.SUIDEN means debug exceptions from Secure EL0
 103              * are always enabled. Otherwise they are controlled by
 104              * SDCR.SPD like those from other Secure ELs.
 105              */
 106             return true;
 107         }
 108
 109         spd = extract32(env->cp15.mdcr_el3, 14, 2);
 110         switch (spd) {
 111         case 1:
 112             /* SPD == 0b01 is reserved, but behaves as 0b00. */
 113         case 0:
 114             /*
 115              * For 0b00 we return true if external secure invasive debug
 116              * is enabled. On real hardware this is controlled by external
 117              * signals to the core. QEMU always permits debug, and behaves
 118              * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
 119              */
 120             return true;
 121         case 2:
 122             return false;
 123         case 3:
 124             return true;
 125         }
 126     }
 127
 128     return el != 2;
 129 }
 130
 131 /*
 132  * Return true if debugging exceptions are currently enabled.
 133  * This corresponds to what in ARM ARM pseudocode would be
 134  *    if UsingAArch32() then
 135  *        return AArch32.GenerateDebugExceptions()
 136  *    else
 137  *        return AArch64.GenerateDebugExceptions()
 138  * We choose to push the if() down into this function for clarity,
 139  * since the pseudocode has it at all callsites except for the one in
 140  * CheckSoftwareStep(), where it is elided because both branches would
 141  * always return the same value.
 142  */
 143 bool arm_generate_debug_exceptions(CPUARMState *env)
 144 {
 145     if ((env->cp15.oslsr_el1 & 1) || (env->cp15.osdlr_el1 & 1)) {
 146         return false;
 147     }
 148     if (is_a64(env)) {
 149         return aa64_generate_debug_exceptions(env);
 150     } else {
 151         return aa32_generate_debug_exceptions(env);
 152     }
 153 }
 154
 155 /*
 156  * Is single-stepping active? (Note that the "is EL_D AArch64?" check
 157  * implicitly means this always returns false in pre-v8 CPUs.)
 158  */
 159 bool arm_singlestep_active(CPUARMState *env)
 160 {
 161     return extract32(env->cp15.mdscr_el1, 0, 1)
 162         && arm_el_is_aa64(env, arm_debug_target_el(env))
 163         && arm_generate_debug_exceptions(env);
 164 }
 165
 166 /* Return true if the linked breakpoint entry lbn passes its checks */
 167 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
 168 {
 169     CPUARMState *env = &cpu->env;
 170     uint64_t bcr = env->cp15.dbgbcr[lbn];
 171     int brps = arm_num_brps(cpu);
 172     int ctx_cmps = arm_num_ctx_cmps(cpu);
 173     int bt;
 174     uint32_t contextidr;
 175     uint64_t hcr_el2;
 176
 177     /*
 178      * Links to unimplemented or non-context aware breakpoints are
 179      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
 180      * as if linked to an UNKNOWN context-aware breakpoint (in which
 181      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
 182      * We choose the former.
 183      */
 184     if (lbn >= brps || lbn < (brps - ctx_cmps)) {
 185         return false;
 186     }
 187
 188     bcr = env->cp15.dbgbcr[lbn];
 189
 190     if (extract64(bcr, 0, 1) == 0) {
 191         /* Linked breakpoint disabled : generate no events */
 192         return false;
 193     }
 194
 195     bt = extract64(bcr, 20, 4);
 196     hcr_el2 = arm_hcr_el2_eff(env);
 197
 198     switch (bt) {
 199     case 3: /* linked context ID match */
 200         switch (arm_current_el(env)) {
 201         default:
 202             /* Context matches never fire in AArch64 EL3 */
 203             return false;
 204         case 2:
 205             if (!(hcr_el2 & HCR_E2H)) {
 206                 /* Context matches never fire in EL2 without E2H enabled. */
 207                 return false;
 208             }
 209             contextidr = env->cp15.contextidr_el[2];
 210             break;
 211         case 1:
 212             contextidr = env->cp15.contextidr_el[1];
 213             break;
 214         case 0:
 215             if ((hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
 216                 contextidr = env->cp15.contextidr_el[2];
 217             } else {
 218                 contextidr = env->cp15.contextidr_el[1];
 219             }
 220             break;
 221         }
 222         break;
 223
 224     case 7:  /* linked contextidr_el1 match */
 225         contextidr = env->cp15.contextidr_el[1];
 226         break;
 227     case 13: /* linked contextidr_el2 match */
 228         contextidr = env->cp15.contextidr_el[2];
 229         break;
 230
 231     case 9: /* linked VMID match (reserved if no EL2) */
 232     case 11: /* linked context ID and VMID match (reserved if no EL2) */
 233     case 15: /* linked full context ID match */
 234     default:
 235         /*
 236          * Links to Unlinked context breakpoints must generate no
 237          * events; we choose to do the same for reserved values too.
 238          */
 239         return false;
 240     }
 241
 242     /*
 243      * We match the whole register even if this is AArch32 using the
 244      * short descriptor format (in which case it holds both PROCID and ASID),
 245      * since we don't implement the optional v7 context ID masking.
 246      */
 247     return contextidr == (uint32_t)env->cp15.dbgbvr[lbn];
 248 }
 249
 250 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
 251 {
 252     CPUARMState *env = &cpu->env;
 253     uint64_t cr;
 254     int pac, hmc, ssc, wt, lbn;
 255     /*
 256      * Note that for watchpoints the check is against the CPU security
 257      * state, not the S/NS attribute on the offending data access.
 258      */
 259     bool is_secure = arm_is_secure(env);
 260     int access_el = arm_current_el(env);
 261
 262     if (is_wp) {
 263         CPUWatchpoint *wp = env->cpu_watchpoint[n];
 264
 265         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
 266             return false;
 267         }
 268         cr = env->cp15.dbgwcr[n];
 269         if (wp->hitattrs.user) {
 270             /*
 271              * The LDRT/STRT/LDT/STT "unprivileged access" instructions should
 272              * match watchpoints as if they were accesses done at EL0, even if
 273              * the CPU is at EL1 or higher.
 274              */
 275             access_el = 0;
 276         }
 277     } else {
 278         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 279
 280         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
 281             return false;
 282         }
 283         cr = env->cp15.dbgbcr[n];
 284     }
 285     /*
 286      * The WATCHPOINT_HIT flag guarantees us that the watchpoint is
 287      * enabled and that the address and access type match; for breakpoints
 288      * we know the address matched; check the remaining fields, including
 289      * linked breakpoints. We rely on WCR and BCR having the same layout
 290      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
 291      * Note that some combinations of {PAC, HMC, SSC} are reserved and
 292      * must act either like some valid combination or as if the watchpoint
 293      * were disabled. We choose the former, and use this together with
 294      * the fact that EL3 must always be Secure and EL2 must always be
 295      * Non-Secure to simplify the code slightly compared to the full
 296      * table in the ARM ARM.
 297      */
 298     pac = FIELD_EX64(cr, DBGWCR, PAC);
 299     hmc = FIELD_EX64(cr, DBGWCR, HMC);
 300     ssc = FIELD_EX64(cr, DBGWCR, SSC);
 301
 302     switch (ssc) {
 303     case 0:
 304         break;
 305     case 1:
 306     case 3:
 307         if (is_secure) {
 308             return false;
 309         }
 310         break;
 311     case 2:
 312         if (!is_secure) {
 313             return false;
 314         }
 315         break;
 316     }
 317
 318     switch (access_el) {
 319     case 3:
 320     case 2:
 321         if (!hmc) {
 322             return false;
 323         }
 324         break;
 325     case 1:
 326         if (extract32(pac, 0, 1) == 0) {
 327             return false;
 328         }
 329         break;
 330     case 0:
 331         if (extract32(pac, 1, 1) == 0) {
 332             return false;
 333         }
 334         break;
 335     default:
 336         g_assert_not_reached();
 337     }
 338
 339     wt = FIELD_EX64(cr, DBGWCR, WT);
 340     lbn = FIELD_EX64(cr, DBGWCR, LBN);
 341
 342     if (wt && !linked_bp_matches(cpu, lbn)) {
 343         return false;
 344     }
 345
 346     return true;
 347 }
 348
 349 static bool check_watchpoints(ARMCPU *cpu)
 350 {
 351     CPUARMState *env = &cpu->env;
 352     int n;
 353
 354     /*
 355      * If watchpoints are disabled globally or we can't take debug
 356      * exceptions here then watchpoint firings are ignored.
 357      */
 358     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 359         || !arm_generate_debug_exceptions(env)) {
 360         return false;
 361     }
 362
 363     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
 364         if (bp_wp_matches(cpu, n, true)) {
 365             return true;
 366         }
 367     }
 368     return false;
 369 }
 370
 371 bool arm_debug_check_breakpoint(CPUState *cs)
 372 {
 373     ARMCPU *cpu = ARM_CPU(cs);
 374     CPUARMState *env = &cpu->env;
 375     target_ulong pc;
 376     int n;
 377
 378     /*
 379      * If breakpoints are disabled globally or we can't take debug
 380      * exceptions here then breakpoint firings are ignored.
 381      */
 382     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 383         || !arm_generate_debug_exceptions(env)) {
 384         return false;
 385     }
 386
 387     /*
 388      * Single-step exceptions have priority over breakpoint exceptions.
 389      * If single-step state is active-pending, suppress the bp.
 390      */
 391     if (arm_singlestep_active(env) && !(env->pstate & PSTATE_SS)) {
 392         return false;
 393     }
 394
 395     /*
 396      * PC alignment faults have priority over breakpoint exceptions.
 397      */
 398     pc = is_a64(env) ? env->pc : env->regs[15];
 399     if ((is_a64(env) || !env->thumb) && (pc & 3) != 0) {
 400         return false;
 401     }
 402
 403     /*
 404      * Instruction aborts have priority over breakpoint exceptions.
 405      * TODO: We would need to look up the page for PC and verify that
 406      * it is present and executable.
 407      */
 408
 409     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
 410         if (bp_wp_matches(cpu, n, false)) {
 411             return true;
 412         }
 413     }
 414     return false;
 415 }
 416
 417 bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 418 {
 419     /*
 420      * Called by core code when a CPU watchpoint fires; need to check if this
 421      * is also an architectural watchpoint match.
 422      */
 423     ARMCPU *cpu = ARM_CPU(cs);
 424
 425     return check_watchpoints(cpu);
 426 }
 427
 428 /*
 429  * Return the FSR value for a debug exception (watchpoint, hardware
 430  * breakpoint or BKPT insn) targeting the specified exception level.
 431  */
 432 static uint32_t arm_debug_exception_fsr(CPUARMState *env)
 433 {
 434     ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
 435     int target_el = arm_debug_target_el(env);
 436     bool using_lpae = false;
 437
 438     if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
 439         using_lpae = true;
 440     } else if (arm_feature(env, ARM_FEATURE_PMSA) &&
 441                arm_feature(env, ARM_FEATURE_V8)) {
 442         using_lpae = true;
 443     } else {
 444         if (arm_feature(env, ARM_FEATURE_LPAE) &&
 445             (env->cp15.tcr_el[target_el] & TTBCR_EAE)) {
 446             using_lpae = true;
 447         }
 448     }
 449
 450     if (using_lpae) {
 451         return arm_fi_to_lfsc(&fi);
 452     } else {
 453         return arm_fi_to_sfsc(&fi);
 454     }
 455 }
 456
 457 void arm_debug_excp_handler(CPUState *cs)
 458 {
 459     /*
 460      * Called by core code when a watchpoint or breakpoint fires;
 461      * need to check which one and raise the appropriate exception.
 462      */
 463     ARMCPU *cpu = ARM_CPU(cs);
 464     CPUARMState *env = &cpu->env;
 465     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
 466
 467     if (wp_hit) {
 468         if (wp_hit->flags & BP_CPU) {
 469             bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 470
 471             cs->watchpoint_hit = NULL;
 472
 473             env->exception.fsr = arm_debug_exception_fsr(env);
 474             env->exception.vaddress = wp_hit->hitaddr;
 475             raise_exception_debug(env, EXCP_DATA_ABORT,
 476                                   syn_watchpoint(0, 0, wnr));
 477         }
 478     } else {
 479         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 480
 481         /*
 482          * (1) GDB breakpoints should be handled first.
 483          * (2) Do not raise a CPU exception if no CPU breakpoint has fired,
 484          * since singlestep is also done by generating a debug internal
 485          * exception.
 486          */
 487         if (cpu_breakpoint_test(cs, pc, BP_GDB)
 488             || !cpu_breakpoint_test(cs, pc, BP_CPU)) {
 489             return;
 490         }
 491
 492         env->exception.fsr = arm_debug_exception_fsr(env);
 493         /*
 494          * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
 495          * values to the guest that it shouldn't be able to see at its
 496          * exception/security level.
 497          */
 498         env->exception.vaddress = 0;
 499         raise_exception_debug(env, EXCP_PREFETCH_ABORT, syn_breakpoint(0));
 500     }
 501 }
 502
 503 /*
 504  * Raise an EXCP_BKPT with the specified syndrome register value,
 505  * targeting the correct exception level for debug exceptions.
 506  */
 507 void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
 508 {
 509     int debug_el = arm_debug_target_el(env);
 510     int cur_el = arm_current_el(env);
 511
 512     /* FSR will only be used if the debug target EL is AArch32. */
 513     env->exception.fsr = arm_debug_exception_fsr(env);
 514     /*
 515      * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
 516      * values to the guest that it shouldn't be able to see at its
 517      * exception/security level.
 518      */
 519     env->exception.vaddress = 0;
 520     /*
 521      * Other kinds of architectural debug exception are ignored if
 522      * they target an exception level below the current one (in QEMU
 523      * this is checked by arm_generate_debug_exceptions()). Breakpoint
 524      * instructions are special because they always generate an exception
 525      * to somewhere: if they can't go to the configured debug exception
 526      * level they are taken to the current exception level.
 527      */
 528     if (debug_el < cur_el) {
 529         debug_el = cur_el;
 530     }
 531     raise_exception(env, EXCP_BKPT, syndrome, debug_el);
 532 }
 533
 534 void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
 535 {
 536     raise_exception_debug(env, EXCP_UDEF, syndrome);
 537 }
 538
 539 /*
 540  * Check for traps to "powerdown debug" registers, which are controlled
 541  * by MDCR.TDOSA
 542  */
 543 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
 544                                    bool isread)
 545 {
 546     int el = arm_current_el(env);
 547     uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 548     bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
 549         (arm_hcr_el2_eff(env) & HCR_TGE);
 550
 551     if (el < 2 && mdcr_el2_tdosa) {
 552         return CP_ACCESS_TRAP_EL2;
 553     }
 554     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
 555         return CP_ACCESS_TRAP_EL3;
 556     }
 557     return CP_ACCESS_OK;
 558 }
 559
 560 /*
 561  * Check for traps to "debug ROM" registers, which are controlled
 562  * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
 563  */
 564 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
 565                                   bool isread)
 566 {
 567     int el = arm_current_el(env);
 568     uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 569     bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
 570         (arm_hcr_el2_eff(env) & HCR_TGE);
 571
 572     if (el < 2 && mdcr_el2_tdra) {
 573         return CP_ACCESS_TRAP_EL2;
 574     }
 575     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
 576         return CP_ACCESS_TRAP_EL3;
 577     }
 578     return CP_ACCESS_OK;
 579 }
 580
 581 /*
 582  * Check for traps to general debug registers, which are controlled
 583  * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
 584  */
 585 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
 586                                   bool isread)
 587 {
 588     int el = arm_current_el(env);
 589     uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 590     bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
 591         (arm_hcr_el2_eff(env) & HCR_TGE);
 592
 593     if (el < 2 && mdcr_el2_tda) {
 594         return CP_ACCESS_TRAP_EL2;
 595     }
 596     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
 597         return CP_ACCESS_TRAP_EL3;
 598     }
 599     return CP_ACCESS_OK;
 600 }
 601
 602 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
 603                         uint64_t value)
 604 {
 605     /*
 606      * Writes to OSLAR_EL1 may update the OS lock status, which can be
 607      * read via a bit in OSLSR_EL1.
 608      */
 609     int oslock;
 610
 611     if (ri->state == ARM_CP_STATE_AA32) {
 612         oslock = (value == 0xC5ACCE55);
 613     } else {
 614         oslock = value & 1;
 615     }
 616
 617     env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
 618 }
 619
 620 static void osdlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 621                         uint64_t value)
 622 {
 623     ARMCPU *cpu = env_archcpu(env);
 624     /*
 625      * Only defined bit is bit 0 (DLK); if Feat_DoubleLock is not
 626      * implemented this is RAZ/WI.
 627      */
 628     if(arm_feature(env, ARM_FEATURE_AARCH64)
 629        ? cpu_isar_feature(aa64_doublelock, cpu)
 630        : cpu_isar_feature(aa32_doublelock, cpu)) {
 631         env->cp15.osdlr_el1 = value & 1;
 632     }
 633 }
 634
 635 static void dbgclaimset_write(CPUARMState *env, const ARMCPRegInfo *ri,
 636                               uint64_t value)
 637 {
 638     env->cp15.dbgclaim |= (value & 0xFF);
 639 }
 640
 641 static uint64_t dbgclaimset_read(CPUARMState *env, const ARMCPRegInfo *ri)
 642 {
 643     /* CLAIM bits are RAO */
 644     return 0xFF;
 645 }
 646
 647 static void dbgclaimclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 648                               uint64_t value)
 649 {
 650     env->cp15.dbgclaim &= ~(value & 0xFF);
 651 }
 652
 653 static const ARMCPRegInfo debug_cp_reginfo[] = {
 654     /*
 655      * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
 656      * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
 657      * unlike DBGDRAR it is never accessible from EL0.
 658      * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
 659      * accessor.
 660      */
 661     { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
 662       .access = PL0_R, .accessfn = access_tdra,
 663       .type = ARM_CP_CONST, .resetvalue = 0 },
 664     { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
 665       .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
 666       .access = PL1_R, .accessfn = access_tdra,
 667       .type = ARM_CP_CONST, .resetvalue = 0 },
 668     { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
 669       .access = PL0_R, .accessfn = access_tdra,
 670       .type = ARM_CP_CONST, .resetvalue = 0 },
 671     /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
 672     { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
 673       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
 674       .access = PL1_RW, .accessfn = access_tda,
 675       .fgt = FGT_MDSCR_EL1,
 676       .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
 677       .resetvalue = 0 },
 678     /*
 679      * MDCCSR_EL0[30:29] map to EDSCR[30:29].  Simply RAZ as the external
 680      * Debug Communication Channel is not implemented.
 681      */
 682     { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_AA64,
 683       .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 1, .opc2 = 0,
 684       .access = PL0_R, .accessfn = access_tda,
 685       .type = ARM_CP_CONST, .resetvalue = 0 },
 686     /*
 687      * OSDTRRX_EL1/OSDTRTX_EL1 are used for save and restore of DBGDTRRX_EL0.
 688      * It is a component of the Debug Communications Channel, which is not implemented.
 689      */
 690     { .name = "OSDTRRX_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14,
 691       .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 2,
 692       .access = PL1_RW, .accessfn = access_tda,
 693       .type = ARM_CP_CONST, .resetvalue = 0 },
 694     { .name = "OSDTRTX_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14,
 695       .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
 696       .access = PL1_RW, .accessfn = access_tda,
 697       .type = ARM_CP_CONST, .resetvalue = 0 },
 698     /*
 699      * OSECCR_EL1 provides a mechanism for an operating system
 700      * to access the contents of EDECCR. EDECCR is not implemented though,
 701      * as is the rest of external device mechanism.
 702      */
 703     { .name = "OSECCR_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14,
 704       .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
 705       .access = PL1_RW, .accessfn = access_tda,
 706       .fgt = FGT_OSECCR_EL1,
 707       .type = ARM_CP_CONST, .resetvalue = 0 },
 708     /*
 709      * DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2].  Map all bits as
 710      * it is unlikely a guest will care.
 711      * We don't implement the configurable EL0 access.
 712      */
 713     { .name = "DBGDSCRint", .state = ARM_CP_STATE_AA32,
 714       .cp = 14, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
 715       .type = ARM_CP_ALIAS,
 716       .access = PL1_R, .accessfn = access_tda,
 717       .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
 718     { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
 719       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
 720       .access = PL1_W, .type = ARM_CP_NO_RAW,
 721       .accessfn = access_tdosa,
 722       .fgt = FGT_OSLAR_EL1,
 723       .writefn = oslar_write },
 724     { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
 725       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
 726       .access = PL1_R, .resetvalue = 10,
 727       .accessfn = access_tdosa,
 728       .fgt = FGT_OSLSR_EL1,
 729       .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
 730     /* Dummy OSDLR_EL1: 32-bit Linux will read this */
 731     { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
 732       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
 733       .access = PL1_RW, .accessfn = access_tdosa,
 734       .fgt = FGT_OSDLR_EL1,
 735       .writefn = osdlr_write,
 736       .fieldoffset = offsetof(CPUARMState, cp15.osdlr_el1) },
 737     /*
 738      * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
 739      * implement vector catch debug events yet.
 740      */
 741     { .name = "DBGVCR",
 742       .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
 743       .access = PL1_RW, .accessfn = access_tda,
 744       .type = ARM_CP_NOP },
 745     /*
 746      * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
 747      * to save and restore a 32-bit guest's DBGVCR)
 748      */
 749     { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
 750       .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
 751       .access = PL2_RW, .accessfn = access_tda,
 752       .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
 753     /*
 754      * Dummy MDCCINT_EL1, since we don't implement the Debug Communications
 755      * Channel but Linux may try to access this register. The 32-bit
 756      * alias is DBGDCCINT.
 757      */
 758     { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
 759       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
 760       .access = PL1_RW, .accessfn = access_tda,
 761       .type = ARM_CP_NOP },
 762     /*
 763      * Dummy DBGCLAIM registers.
 764      * "The architecture does not define any functionality for the CLAIM tag bits.",
 765      * so we only keep the raw bits
 766      */
 767     { .name = "DBGCLAIMSET_EL1", .state = ARM_CP_STATE_BOTH,
 768       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 6,
 769       .type = ARM_CP_ALIAS,
 770       .access = PL1_RW, .accessfn = access_tda,
 771       .fgt = FGT_DBGCLAIM,
 772       .writefn = dbgclaimset_write, .readfn = dbgclaimset_read },
 773     { .name = "DBGCLAIMCLR_EL1", .state = ARM_CP_STATE_BOTH,
 774       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 6,
 775       .access = PL1_RW, .accessfn = access_tda,
 776       .fgt = FGT_DBGCLAIM,
 777       .writefn = dbgclaimclr_write, .raw_writefn = raw_write,
 778       .fieldoffset = offsetof(CPUARMState, cp15.dbgclaim) },
 779 };
 780
 781 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
 782     /* 64 bit access versions of the (dummy) debug registers */
 783     { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
 784       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 785     { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
 786       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 787 };
 788
 789 void hw_watchpoint_update(ARMCPU *cpu, int n)
 790 {
 791     CPUARMState *env = &cpu->env;
 792     vaddr len = 0;
 793     vaddr wvr = env->cp15.dbgwvr[n];
 794     uint64_t wcr = env->cp15.dbgwcr[n];
 795     int mask;
 796     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 797
 798     if (env->cpu_watchpoint[n]) {
 799         cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
 800         env->cpu_watchpoint[n] = NULL;
 801     }
 802
 803     if (!FIELD_EX64(wcr, DBGWCR, E)) {
 804         /* E bit clear : watchpoint disabled */
 805         return;
 806     }
 807
 808     switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
 809     case 0:
 810         /* LSC 00 is reserved and must behave as if the wp is disabled */
 811         return;
 812     case 1:
 813         flags |= BP_MEM_READ;
 814         break;
 815     case 2:
 816         flags |= BP_MEM_WRITE;
 817         break;
 818     case 3:
 819         flags |= BP_MEM_ACCESS;
 820         break;
 821     }
 822
 823     /*
 824      * Attempts to use both MASK and BAS fields simultaneously are
 825      * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
 826      * thus generating a watchpoint for every byte in the masked region.
 827      */
 828     mask = FIELD_EX64(wcr, DBGWCR, MASK);
 829     if (mask == 1 || mask == 2) {
 830         /*
 831          * Reserved values of MASK; we must act as if the mask value was
 832          * some non-reserved value, or as if the watchpoint were disabled.
 833          * We choose the latter.
 834          */
 835         return;
 836     } else if (mask) {
 837         /* Watchpoint covers an aligned area up to 2GB in size */
 838         len = 1ULL << mask;
 839         /*
 840          * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
 841          * whether the watchpoint fires when the unmasked bits match; we opt
 842          * to generate the exceptions.
 843          */
 844         wvr &= ~(len - 1);
 845     } else {
 846         /* Watchpoint covers bytes defined by the byte address select bits */
 847         int bas = FIELD_EX64(wcr, DBGWCR, BAS);
 848         int basstart;
 849
 850         if (extract64(wvr, 2, 1)) {
 851             /*
 852              * Deprecated case of an only 4-aligned address. BAS[7:4] are
 853              * ignored, and BAS[3:0] define which bytes to watch.
 854              */
 855             bas &= 0xf;
 856         }
 857
 858         if (bas == 0) {
 859             /* This must act as if the watchpoint is disabled */
 860             return;
 861         }
 862
 863         /*
 864          * The BAS bits are supposed to be programmed to indicate a contiguous
 865          * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
 866          * we fire for each byte in the word/doubleword addressed by the WVR.
 867          * We choose to ignore any non-zero bits after the first range of 1s.
 868          */
 869         basstart = ctz32(bas);
 870         len = cto32(bas >> basstart);
 871         wvr += basstart;
 872     }
 873
 874     cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
 875                           &env->cpu_watchpoint[n]);
 876 }
 877
 878 void hw_watchpoint_update_all(ARMCPU *cpu)
 879 {
 880     int i;
 881     CPUARMState *env = &cpu->env;
 882
 883     /*
 884      * Completely clear out existing QEMU watchpoints and our array, to
 885      * avoid possible stale entries following migration load.
 886      */
 887     cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
 888     memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
 889
 890     for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
 891         hw_watchpoint_update(cpu, i);
 892     }
 893 }
 894
 895 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 896                          uint64_t value)
 897 {
 898     ARMCPU *cpu = env_archcpu(env);
 899     int i = ri->crm;
 900
 901     /*
 902      * Bits [1:0] are RES0.
 903      *
 904      * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
 905      * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
 906      * they contain the value written.  It is CONSTRAINED UNPREDICTABLE
 907      * whether the RESS bits are ignored when comparing an address.
 908      *
 909      * Therefore we are allowed to compare the entire register, which lets
 910      * us avoid considering whether or not FEAT_LVA is actually enabled.
 911      */
 912     value &= ~3ULL;
 913
 914     raw_write(env, ri, value);
 915     hw_watchpoint_update(cpu, i);
 916 }
 917
 918 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 919                          uint64_t value)
 920 {
 921     ARMCPU *cpu = env_archcpu(env);
 922     int i = ri->crm;
 923
 924     raw_write(env, ri, value);
 925     hw_watchpoint_update(cpu, i);
 926 }
 927
 928 void hw_breakpoint_update(ARMCPU *cpu, int n)
 929 {
 930     CPUARMState *env = &cpu->env;
 931     uint64_t bvr = env->cp15.dbgbvr[n];
 932     uint64_t bcr = env->cp15.dbgbcr[n];
 933     vaddr addr;
 934     int bt;
 935     int flags = BP_CPU;
 936
 937     if (env->cpu_breakpoint[n]) {
 938         cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
 939         env->cpu_breakpoint[n] = NULL;
 940     }
 941
 942     if (!extract64(bcr, 0, 1)) {
 943         /* E bit clear : watchpoint disabled */
 944         return;
 945     }
 946
 947     bt = extract64(bcr, 20, 4);
 948
 949     switch (bt) {
 950     case 4: /* unlinked address mismatch (reserved if AArch64) */
 951     case 5: /* linked address mismatch (reserved if AArch64) */
 952         qemu_log_mask(LOG_UNIMP,
 953                       "arm: address mismatch breakpoint types not implemented\n");
 954         return;
 955     case 0: /* unlinked address match */
 956     case 1: /* linked address match */
 957     {
 958         /*
 959          * Bits [1:0] are RES0.
 960          *
 961          * It is IMPLEMENTATION DEFINED whether bits [63:49]
 962          * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
 963          * of the VA field ([48] or [52] for FEAT_LVA), or whether the
 964          * value is read as written.  It is CONSTRAINED UNPREDICTABLE
 965          * whether the RESS bits are ignored when comparing an address.
 966          * Therefore we are allowed to compare the entire register, which
 967          * lets us avoid considering whether FEAT_LVA is actually enabled.
 968          *
 969          * The BAS field is used to allow setting breakpoints on 16-bit
 970          * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
 971          * a bp will fire if the addresses covered by the bp and the addresses
 972          * covered by the insn overlap but the insn doesn't start at the
 973          * start of the bp address range. We choose to require the insn and
 974          * the bp to have the same address. The constraints on writing to
 975          * BAS enforced in dbgbcr_write mean we have only four cases:
 976          *  0b0000  => no breakpoint
 977          *  0b0011  => breakpoint on addr
 978          *  0b1100  => breakpoint on addr + 2
 979          *  0b1111  => breakpoint on addr
 980          * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
 981          */
 982         int bas = extract64(bcr, 5, 4);
 983         addr = bvr & ~3ULL;
 984         if (bas == 0) {
 985             return;
 986         }
 987         if (bas == 0xc) {
 988             addr += 2;
 989         }
 990         break;
 991     }
 992     case 2: /* unlinked context ID match */
 993     case 8: /* unlinked VMID match (reserved if no EL2) */
 994     case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
 995         qemu_log_mask(LOG_UNIMP,
 996                       "arm: unlinked context breakpoint types not implemented\n");
 997         return;
 998     case 9: /* linked VMID match (reserved if no EL2) */
 999     case 11: /* linked context ID and VMID match (reserved if no EL2) */
1000     case 3: /* linked context ID match */
1001     default:
1002         /*
1003          * We must generate no events for Linked context matches (unless
1004          * they are linked to by some other bp/wp, which is handled in
1005          * updates for the linking bp/wp). We choose to also generate no events
1006          * for reserved values.
1007          */
1008         return;
1009     }
1010
1011     cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
1012 }
1013
1014 void hw_breakpoint_update_all(ARMCPU *cpu)
1015 {
1016     int i;
1017     CPUARMState *env = &cpu->env;
1018
1019     /*
1020      * Completely clear out existing QEMU breakpoints and our array, to
1021      * avoid possible stale entries following migration load.
1022      */
1023     cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
1024     memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
1025
1026     for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
1027         hw_breakpoint_update(cpu, i);
1028     }
1029 }
1030
1031 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1032                          uint64_t value)
1033 {
1034     ARMCPU *cpu = env_archcpu(env);
1035     int i = ri->crm;
1036
1037     raw_write(env, ri, value);
1038     hw_breakpoint_update(cpu, i);
1039 }
1040
1041 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1042                          uint64_t value)
1043 {
1044     ARMCPU *cpu = env_archcpu(env);
1045     int i = ri->crm;
1046
1047     /*
1048      * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
1049      * copy of BAS[0].
1050      */
1051     value = deposit64(value, 6, 1, extract64(value, 5, 1));
1052     value = deposit64(value, 8, 1, extract64(value, 7, 1));
1053
1054     raw_write(env, ri, value);
1055     hw_breakpoint_update(cpu, i);
1056 }
1057
1058 void define_debug_regs(ARMCPU *cpu)
1059 {
1060     /*
1061      * Define v7 and v8 architectural debug registers.
1062      * These are just dummy implementations for now.
1063      */
1064     int i;
1065     int wrps, brps, ctx_cmps;
1066
1067     /*
1068      * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
1069      * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
1070      * the register must not exist for this cpu.
1071      */
1072     if (cpu->isar.dbgdidr != 0) {
1073         ARMCPRegInfo dbgdidr = {
1074             .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
1075             .opc1 = 0, .opc2 = 0,
1076             .access = PL0_R, .accessfn = access_tda,
1077             .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
1078         };
1079         define_one_arm_cp_reg(cpu, &dbgdidr);
1080     }
1081
1082     /*
1083      * DBGDEVID is present in the v7 debug architecture if
1084      * DBGDIDR.DEVID_imp is 1 (bit 15); from v7.1 and on it is
1085      * mandatory (and bit 15 is RES1). DBGDEVID1 and DBGDEVID2 exist
1086      * from v7.1 of the debug architecture. Because no fields have yet
1087      * been defined in DBGDEVID2 (and quite possibly none will ever
1088      * be) we don't define an ARMISARegisters field for it.
1089      * These registers exist only if EL1 can use AArch32, but that
1090      * happens naturally because they are only PL1 accessible anyway.
1091      */
1092     if (extract32(cpu->isar.dbgdidr, 15, 1)) {
1093         ARMCPRegInfo dbgdevid = {
1094             .name = "DBGDEVID",
1095             .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 2, .crn = 7,
1096             .access = PL1_R, .accessfn = access_tda,
1097             .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid,
1098         };
1099         define_one_arm_cp_reg(cpu, &dbgdevid);
1100     }
1101     if (cpu_isar_feature(aa32_debugv7p1, cpu)) {
1102         ARMCPRegInfo dbgdevid12[] = {
1103             {
1104                 .name = "DBGDEVID1",
1105                 .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 1, .crn = 7,
1106                 .access = PL1_R, .accessfn = access_tda,
1107                 .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid1,
1108             }, {
1109                 .name = "DBGDEVID2",
1110                 .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 0, .crn = 7,
1111                 .access = PL1_R, .accessfn = access_tda,
1112                 .type = ARM_CP_CONST, .resetvalue = 0,
1113             },
1114         };
1115         define_arm_cp_regs(cpu, dbgdevid12);
1116     }
1117
1118     brps = arm_num_brps(cpu);
1119     wrps = arm_num_wrps(cpu);
1120     ctx_cmps = arm_num_ctx_cmps(cpu);
1121
1122     assert(ctx_cmps <= brps);
1123
1124     define_arm_cp_regs(cpu, debug_cp_reginfo);
1125
1126     if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
1127         define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
1128     }
1129
1130     for (i = 0; i < brps; i++) {
1131         char *dbgbvr_el1_name = g_strdup_printf("DBGBVR%d_EL1", i);
1132         char *dbgbcr_el1_name = g_strdup_printf("DBGBCR%d_EL1", i);
1133         ARMCPRegInfo dbgregs[] = {
1134             { .name = dbgbvr_el1_name, .state = ARM_CP_STATE_BOTH,
1135               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
1136               .access = PL1_RW, .accessfn = access_tda,
1137               .fgt = FGT_DBGBVRN_EL1,
1138               .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
1139               .writefn = dbgbvr_write, .raw_writefn = raw_write
1140             },
1141             { .name = dbgbcr_el1_name, .state = ARM_CP_STATE_BOTH,
1142               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
1143               .access = PL1_RW, .accessfn = access_tda,
1144               .fgt = FGT_DBGBCRN_EL1,
1145               .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
1146               .writefn = dbgbcr_write, .raw_writefn = raw_write
1147             },
1148         };
1149         define_arm_cp_regs(cpu, dbgregs);
1150         g_free(dbgbvr_el1_name);
1151         g_free(dbgbcr_el1_name);
1152     }
1153
1154     for (i = 0; i < wrps; i++) {
1155         char *dbgwvr_el1_name = g_strdup_printf("DBGWVR%d_EL1", i);
1156         char *dbgwcr_el1_name = g_strdup_printf("DBGWCR%d_EL1", i);
1157         ARMCPRegInfo dbgregs[] = {
1158             { .name = dbgwvr_el1_name, .state = ARM_CP_STATE_BOTH,
1159               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
1160               .access = PL1_RW, .accessfn = access_tda,
1161               .fgt = FGT_DBGWVRN_EL1,
1162               .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
1163               .writefn = dbgwvr_write, .raw_writefn = raw_write
1164             },
1165             { .name = dbgwcr_el1_name, .state = ARM_CP_STATE_BOTH,
1166               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
1167               .access = PL1_RW, .accessfn = access_tda,
1168               .fgt = FGT_DBGWCRN_EL1,
1169               .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
1170               .writefn = dbgwcr_write, .raw_writefn = raw_write
1171             },
1172         };
1173         define_arm_cp_regs(cpu, dbgregs);
1174         g_free(dbgwvr_el1_name);
1175         g_free(dbgwcr_el1_name);
1176     }
1177 }
1178
1179 #if !defined(CONFIG_USER_ONLY)
1180
1181 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
1182 {
1183     ARMCPU *cpu = ARM_CPU(cs);
1184     CPUARMState *env = &cpu->env;
1185
1186     /*
1187      * In BE32 system mode, target memory is stored byteswapped (on a
1188      * little-endian host system), and by the time we reach here (via an
1189      * opcode helper) the addresses of subword accesses have been adjusted
1190      * to account for that, which means that watchpoints will not match.
1191      * Undo the adjustment here.
1192      */
1193     if (arm_sctlr_b(env)) {
1194         if (len == 1) {
1195             addr ^= 3;
1196         } else if (len == 2) {
1197             addr ^= 2;
1198         }
1199     }
1200
1201     return addr;
1202 }
1203
1204 #endif