xref: /qemu/target/i386/tcg/system/bpt_helper.c (revision 42fa9665e598c268a7ccfab5b92636618d9574ec) 
1 /*
2  *  i386 breakpoint helpers - system code
3  *
4  *  Copyright (c) 2003 Fabrice Bellard
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "cpu.h"
22 #include "exec/exec-all.h"
23 #include "exec/helper-proto.h"
24 #include "exec/watchpoint.h"
25 #include "tcg/helper-tcg.h"
26 
27 
28 static inline bool hw_local_breakpoint_enabled(unsigned long dr7, int index)
29 {
30     return (dr7 >> (index * 2)) & 1;
31 }
32 
33 static inline bool hw_global_breakpoint_enabled(unsigned long dr7, int index)
34 {
35     return (dr7 >> (index * 2)) & 2;
36 
37 }
38 static inline bool hw_breakpoint_enabled(unsigned long dr7, int index)
39 {
40     return hw_global_breakpoint_enabled(dr7, index) ||
41            hw_local_breakpoint_enabled(dr7, index);
42 }
43 
44 static inline int hw_breakpoint_type(unsigned long dr7, int index)
45 {
46     return (dr7 >> (DR7_TYPE_SHIFT + (index * 4))) & 3;
47 }
48 
49 static inline int hw_breakpoint_len(unsigned long dr7, int index)
50 {
51     int len = ((dr7 >> (DR7_LEN_SHIFT + (index * 4))) & 3);
52     return (len == 2) ? 8 : len + 1;
53 }
54 
55 static int hw_breakpoint_insert(CPUX86State *env, int index)
56 {
57     CPUState *cs = env_cpu(env);
58     target_ulong dr7 = env->dr[7];
59     target_ulong drN = env->dr[index];
60     int err = 0;
61 
62     switch (hw_breakpoint_type(dr7, index)) {
63     case DR7_TYPE_BP_INST:
64         if (hw_breakpoint_enabled(dr7, index)) {
65             err = cpu_breakpoint_insert(cs, drN, BP_CPU,
66                                         &env->cpu_breakpoint[index]);
67         }
68         break;
69 
70     case DR7_TYPE_IO_RW:
71         /* Notice when we should enable calls to bpt_io.  */
72         return hw_breakpoint_enabled(env->dr[7], index)
73                ? HF_IOBPT_MASK : 0;
74 
75     case DR7_TYPE_DATA_WR:
76         if (hw_breakpoint_enabled(dr7, index)) {
77             err = cpu_watchpoint_insert(cs, drN,
78                                         hw_breakpoint_len(dr7, index),
79                                         BP_CPU | BP_MEM_WRITE,
80                                         &env->cpu_watchpoint[index]);
81         }
82         break;
83 
84     case DR7_TYPE_DATA_RW:
85         if (hw_breakpoint_enabled(dr7, index)) {
86             err = cpu_watchpoint_insert(cs, drN,
87                                         hw_breakpoint_len(dr7, index),
88                                         BP_CPU | BP_MEM_ACCESS,
89                                         &env->cpu_watchpoint[index]);
90         }
91         break;
92     }
93     if (err) {
94         env->cpu_breakpoint[index] = NULL;
95     }
96     return 0;
97 }
98 
99 static void hw_breakpoint_remove(CPUX86State *env, int index)
100 {
101     CPUState *cs = env_cpu(env);
102 
103     switch (hw_breakpoint_type(env->dr[7], index)) {
104     case DR7_TYPE_BP_INST:
105         if (env->cpu_breakpoint[index]) {
106             cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
107             env->cpu_breakpoint[index] = NULL;
108         }
109         break;
110 
111     case DR7_TYPE_DATA_WR:
112     case DR7_TYPE_DATA_RW:
113         if (env->cpu_watchpoint[index]) {
114             cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
115             env->cpu_watchpoint[index] = NULL;
116         }
117         break;
118 
119     case DR7_TYPE_IO_RW:
120         /* HF_IOBPT_MASK cleared elsewhere.  */
121         break;
122     }
123 }
124 
125 void cpu_x86_update_dr7(CPUX86State *env, uint32_t new_dr7)
126 {
127     target_ulong old_dr7 = env->dr[7];
128     int iobpt = 0;
129     int i;
130 
131     new_dr7 |= DR7_FIXED_1;
132 
133     /* If nothing is changing except the global/local enable bits,
134        then we can make the change more efficient.  */
135     if (((old_dr7 ^ new_dr7) & ~0xff) == 0) {
136         /* Fold the global and local enable bits together into the
137            global fields, then xor to show which registers have
138            changed collective enable state.  */
139         int mod = ((old_dr7 | old_dr7 * 2) ^ (new_dr7 | new_dr7 * 2)) & 0xff;
140 
141         for (i = 0; i < DR7_MAX_BP; i++) {
142             if ((mod & (2 << i * 2)) && !hw_breakpoint_enabled(new_dr7, i)) {
143                 hw_breakpoint_remove(env, i);
144             }
145         }
146         env->dr[7] = new_dr7;
147         for (i = 0; i < DR7_MAX_BP; i++) {
148             if (mod & (2 << i * 2) && hw_breakpoint_enabled(new_dr7, i)) {
149                 iobpt |= hw_breakpoint_insert(env, i);
150             } else if (hw_breakpoint_type(new_dr7, i) == DR7_TYPE_IO_RW
151                        && hw_breakpoint_enabled(new_dr7, i)) {
152                 iobpt |= HF_IOBPT_MASK;
153             }
154         }
155     } else {
156         for (i = 0; i < DR7_MAX_BP; i++) {
157             hw_breakpoint_remove(env, i);
158         }
159         env->dr[7] = new_dr7;
160         for (i = 0; i < DR7_MAX_BP; i++) {
161             iobpt |= hw_breakpoint_insert(env, i);
162         }
163     }
164 
165     env->hflags = (env->hflags & ~HF_IOBPT_MASK) | iobpt;
166 }
167 
168 bool check_hw_breakpoints(CPUX86State *env, bool force_dr6_update)
169 {
170     target_ulong dr6;
171     int reg;
172     bool hit_enabled = false;
173 
174     dr6 = env->dr[6] & ~0xf;
175     for (reg = 0; reg < DR7_MAX_BP; reg++) {
176         bool bp_match = false;
177         bool wp_match = false;
178 
179         switch (hw_breakpoint_type(env->dr[7], reg)) {
180         case DR7_TYPE_BP_INST:
181             if (env->dr[reg] == env->eip) {
182                 bp_match = true;
183             }
184             break;
185         case DR7_TYPE_DATA_WR:
186         case DR7_TYPE_DATA_RW:
187             if (env->cpu_watchpoint[reg] &&
188                 env->cpu_watchpoint[reg]->flags & BP_WATCHPOINT_HIT) {
189                 wp_match = true;
190             }
191             break;
192         case DR7_TYPE_IO_RW:
193             break;
194         }
195         if (bp_match || wp_match) {
196             dr6 |= 1 << reg;
197             if (hw_breakpoint_enabled(env->dr[7], reg)) {
198                 hit_enabled = true;
199             }
200         }
201     }
202 
203     if (hit_enabled || force_dr6_update) {
204         env->dr[6] = dr6;
205     }
206 
207     return hit_enabled;
208 }
209 
210 void breakpoint_handler(CPUState *cs)
211 {
212     X86CPU *cpu = X86_CPU(cs);
213     CPUX86State *env = &cpu->env;
214 
215     if (cs->watchpoint_hit) {
216         if (cs->watchpoint_hit->flags & BP_CPU) {
217             cs->watchpoint_hit = NULL;
218             if (check_hw_breakpoints(env, false)) {
219                 /*
220                  * FIXME: #DB should be delayed by one instruction if
221                  * INHIBIT_IRQ is set (STI cannot trigger a watchpoint).
222                  * The delayed #DB should also fuse with one generated
223                  * by ICEBP (aka INT1).
224                  */
225                 raise_exception(env, EXCP01_DB);
226             } else {
227                 cpu_loop_exit_noexc(cs);
228             }
229         }
230     } else {
231         if (cpu_breakpoint_test(cs, env->eip, BP_CPU)) {
232             check_hw_breakpoints(env, true);
233             raise_exception(env, EXCP01_DB);
234         }
235     }
236 }
237 
238 target_ulong helper_get_dr(CPUX86State *env, int reg)
239 {
240     if (reg >= 4 && reg < 6) {
241         if (env->cr[4] & CR4_DE_MASK) {
242             raise_exception_ra(env, EXCP06_ILLOP, GETPC());
243         } else {
244             reg += 2;
245         }
246     }
247 
248     if (env->dr[7] & DR7_GD) {
249         env->dr[7] &= ~DR7_GD;
250         env->dr[6] |= DR6_BD;
251         raise_exception_ra(env, EXCP01_DB, GETPC());
252     }
253 
254     return env->dr[reg];
255 }
256 
257 void helper_set_dr(CPUX86State *env, int reg, target_ulong t0)
258 {
259     if (reg >= 4 && reg < 6) {
260         if (env->cr[4] & CR4_DE_MASK) {
261             raise_exception_ra(env, EXCP06_ILLOP, GETPC());
262         } else {
263             reg += 2;
264         }
265     }
266 
267     if (env->dr[7] & DR7_GD) {
268         env->dr[7] &= ~DR7_GD;
269         env->dr[6] |= DR6_BD;
270         raise_exception_ra(env, EXCP01_DB, GETPC());
271     }
272 
273     if (reg < 4) {
274         if (hw_breakpoint_enabled(env->dr[7], reg)
275             && hw_breakpoint_type(env->dr[7], reg) != DR7_TYPE_IO_RW) {
276             hw_breakpoint_remove(env, reg);
277             env->dr[reg] = t0;
278             hw_breakpoint_insert(env, reg);
279         } else {
280             env->dr[reg] = t0;
281         }
282     } else {
283         if (t0 & DR_RESERVED_MASK) {
284             raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC());
285         }
286         if (reg == 6) {
287             env->dr[6] = t0 | DR6_FIXED_1;
288         } else {
289             cpu_x86_update_dr7(env, t0);
290         }
291     }
292 }
293 
294 /* Check if Port I/O is trapped by a breakpoint.  */
295 void helper_bpt_io(CPUX86State *env, uint32_t port,
296                    uint32_t size, target_ulong next_eip)
297 {
298     target_ulong dr7 = env->dr[7];
299     int i, hit = 0;
300 
301     for (i = 0; i < DR7_MAX_BP; ++i) {
302         if (hw_breakpoint_type(dr7, i) == DR7_TYPE_IO_RW
303             && hw_breakpoint_enabled(dr7, i)) {
304             int bpt_len = hw_breakpoint_len(dr7, i);
305             if (port + size - 1 >= env->dr[i]
306                 && port <= env->dr[i] + bpt_len - 1) {
307                 hit |= 1 << i;
308             }
309         }
310     }
311 
312     if (hit) {
313         env->dr[6] = (env->dr[6] & ~0xf) | hit;
314         env->eip = next_eip;
315         raise_exception(env, EXCP01_DB);
316     }
317 }
318