1 /*
2 * QEMU RISC-V Native Debug Support
3 *
4 * Copyright (c) 2022 Wind River Systems, Inc.
5 *
6 * Author:
7 * Bin Meng <bin.meng@windriver.com>
8 *
9 * This provides the native debug support via the Trigger Module, as defined
10 * in the RISC-V Debug Specification:
11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms and conditions of the GNU General Public License,
15 * version 2 or later, as published by the Free Software Foundation.
16 *
17 * This program is distributed in the hope it will be useful, but WITHOUT
18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
20 * more details.
21 *
22 * You should have received a copy of the GNU General Public License along with
23 * this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "qemu/osdep.h"
27 #include "qemu/log.h"
28 #include "qapi/error.h"
29 #include "cpu.h"
30 #include "trace.h"
31 #include "exec/helper-proto.h"
32 #include "exec/watchpoint.h"
33 #include "system/cpu-timers.h"
34 #include "exec/icount.h"
35
36 /*
37 * The following M-mode trigger CSRs are implemented:
38 *
39 * - tselect
40 * - tdata1
41 * - tdata2
42 * - tdata3
43 * - tinfo
44 *
45 * The following triggers are initialized by default:
46 *
47 * Index | Type | tdata mapping | Description
48 * ------+------+------------------------+------------
49 * 0 | 2 | tdata1, tdata2 | Address / Data Match
50 * 1 | 2 | tdata1, tdata2 | Address / Data Match
51 */
52
53 /* tdata availability of a trigger */
54 typedef bool tdata_avail[TDATA_NUM];
55
56 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = {
57 [TRIGGER_TYPE_NO_EXIST] = { false, false, false },
58 [TRIGGER_TYPE_AD_MATCH] = { true, true, true },
59 [TRIGGER_TYPE_INST_CNT] = { true, false, true },
60 [TRIGGER_TYPE_INT] = { true, true, true },
61 [TRIGGER_TYPE_EXCP] = { true, true, true },
62 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true },
63 [TRIGGER_TYPE_EXT_SRC] = { true, false, false },
64 [TRIGGER_TYPE_UNAVAIL] = { true, true, true }
65 };
66
67 /* only breakpoint size 1/2/4/8 supported */
68 static int access_size[SIZE_NUM] = {
69 [SIZE_ANY] = 0,
70 [SIZE_1B] = 1,
71 [SIZE_2B] = 2,
72 [SIZE_4B] = 4,
73 [SIZE_6B] = -1,
74 [SIZE_8B] = 8,
75 [6 ... 15] = -1,
76 };
77
extract_trigger_type(CPURISCVState * env,target_ulong tdata1)78 static inline target_ulong extract_trigger_type(CPURISCVState *env,
79 target_ulong tdata1)
80 {
81 switch (riscv_cpu_mxl(env)) {
82 case MXL_RV32:
83 return extract32(tdata1, 28, 4);
84 case MXL_RV64:
85 case MXL_RV128:
86 return extract64(tdata1, 60, 4);
87 default:
88 g_assert_not_reached();
89 }
90 }
91
get_trigger_type(CPURISCVState * env,target_ulong trigger_index)92 static inline target_ulong get_trigger_type(CPURISCVState *env,
93 target_ulong trigger_index)
94 {
95 return extract_trigger_type(env, env->tdata1[trigger_index]);
96 }
97
get_trigger_action(CPURISCVState * env,target_ulong trigger_index)98 static trigger_action_t get_trigger_action(CPURISCVState *env,
99 target_ulong trigger_index)
100 {
101 target_ulong tdata1 = env->tdata1[trigger_index];
102 int trigger_type = get_trigger_type(env, trigger_index);
103 trigger_action_t action = DBG_ACTION_NONE;
104
105 switch (trigger_type) {
106 case TRIGGER_TYPE_AD_MATCH:
107 action = (tdata1 & TYPE2_ACTION) >> 12;
108 break;
109 case TRIGGER_TYPE_AD_MATCH6:
110 action = (tdata1 & TYPE6_ACTION) >> 12;
111 break;
112 case TRIGGER_TYPE_INST_CNT:
113 case TRIGGER_TYPE_INT:
114 case TRIGGER_TYPE_EXCP:
115 case TRIGGER_TYPE_EXT_SRC:
116 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
117 trigger_type);
118 break;
119 case TRIGGER_TYPE_NO_EXIST:
120 case TRIGGER_TYPE_UNAVAIL:
121 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
122 trigger_type);
123 break;
124 default:
125 g_assert_not_reached();
126 }
127
128 return action;
129 }
130
build_tdata1(CPURISCVState * env,trigger_type_t type,bool dmode,target_ulong data)131 static inline target_ulong build_tdata1(CPURISCVState *env,
132 trigger_type_t type,
133 bool dmode, target_ulong data)
134 {
135 target_ulong tdata1;
136
137 switch (riscv_cpu_mxl(env)) {
138 case MXL_RV32:
139 tdata1 = RV32_TYPE(type) |
140 (dmode ? RV32_DMODE : 0) |
141 (data & RV32_DATA_MASK);
142 break;
143 case MXL_RV64:
144 case MXL_RV128:
145 tdata1 = RV64_TYPE(type) |
146 (dmode ? RV64_DMODE : 0) |
147 (data & RV64_DATA_MASK);
148 break;
149 default:
150 g_assert_not_reached();
151 }
152
153 return tdata1;
154 }
155
tdata_available(CPURISCVState * env,int tdata_index)156 bool tdata_available(CPURISCVState *env, int tdata_index)
157 {
158 int trigger_type = get_trigger_type(env, env->trigger_cur);
159
160 if (unlikely(tdata_index >= TDATA_NUM)) {
161 return false;
162 }
163
164 return tdata_mapping[trigger_type][tdata_index];
165 }
166
tselect_csr_read(CPURISCVState * env)167 target_ulong tselect_csr_read(CPURISCVState *env)
168 {
169 return env->trigger_cur;
170 }
171
tselect_csr_write(CPURISCVState * env,target_ulong val)172 void tselect_csr_write(CPURISCVState *env, target_ulong val)
173 {
174 if (val < RV_MAX_TRIGGERS) {
175 env->trigger_cur = val;
176 }
177 }
178
tdata1_validate(CPURISCVState * env,target_ulong val,trigger_type_t t)179 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
180 trigger_type_t t)
181 {
182 uint32_t type, dmode;
183 target_ulong tdata1;
184
185 switch (riscv_cpu_mxl(env)) {
186 case MXL_RV32:
187 type = extract32(val, 28, 4);
188 dmode = extract32(val, 27, 1);
189 tdata1 = RV32_TYPE(t);
190 break;
191 case MXL_RV64:
192 case MXL_RV128:
193 type = extract64(val, 60, 4);
194 dmode = extract64(val, 59, 1);
195 tdata1 = RV64_TYPE(t);
196 break;
197 default:
198 g_assert_not_reached();
199 }
200
201 if (type != t) {
202 qemu_log_mask(LOG_GUEST_ERROR,
203 "ignoring type write to tdata1 register\n");
204 }
205
206 if (dmode != 0) {
207 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n");
208 }
209
210 return tdata1;
211 }
212
warn_always_zero_bit(target_ulong val,target_ulong mask,const char * msg)213 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
214 const char *msg)
215 {
216 if (val & mask) {
217 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg);
218 }
219 }
220
textra_validate(CPURISCVState * env,target_ulong tdata3)221 static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
222 {
223 target_ulong mhvalue, mhselect;
224 target_ulong mhselect_new;
225 target_ulong textra;
226 const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 };
227
228 switch (riscv_cpu_mxl(env)) {
229 case MXL_RV32:
230 mhvalue = get_field(tdata3, TEXTRA32_MHVALUE);
231 mhselect = get_field(tdata3, TEXTRA32_MHSELECT);
232 /* Validate unimplemented (always zero) bits */
233 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK,
234 "sbytemask");
235 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE,
236 "svalue");
237 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT,
238 "sselect");
239 break;
240 case MXL_RV64:
241 case MXL_RV128:
242 mhvalue = get_field(tdata3, TEXTRA64_MHVALUE);
243 mhselect = get_field(tdata3, TEXTRA64_MHSELECT);
244 /* Validate unimplemented (always zero) bits */
245 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK,
246 "sbytemask");
247 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE,
248 "svalue");
249 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT,
250 "sselect");
251 break;
252 default:
253 g_assert_not_reached();
254 }
255
256 /* Validate mhselect. */
257 mhselect_new = mhselect_no_rvh[mhselect];
258 if (mhselect != mhselect_new) {
259 qemu_log_mask(LOG_UNIMP, "mhselect only supports 0 or 4 for now\n");
260 }
261
262 /* Write legal values into textra */
263 textra = 0;
264 switch (riscv_cpu_mxl(env)) {
265 case MXL_RV32:
266 textra = set_field(textra, TEXTRA32_MHVALUE, mhvalue);
267 textra = set_field(textra, TEXTRA32_MHSELECT, mhselect_new);
268 break;
269 case MXL_RV64:
270 case MXL_RV128:
271 textra = set_field(textra, TEXTRA64_MHVALUE, mhvalue);
272 textra = set_field(textra, TEXTRA64_MHSELECT, mhselect_new);
273 break;
274 default:
275 g_assert_not_reached();
276 }
277
278 return textra;
279 }
280
do_trigger_action(CPURISCVState * env,target_ulong trigger_index)281 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
282 {
283 trigger_action_t action = get_trigger_action(env, trigger_index);
284
285 switch (action) {
286 case DBG_ACTION_NONE:
287 break;
288 case DBG_ACTION_BP:
289 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
290 break;
291 case DBG_ACTION_DBG_MODE:
292 case DBG_ACTION_TRACE0:
293 case DBG_ACTION_TRACE1:
294 case DBG_ACTION_TRACE2:
295 case DBG_ACTION_TRACE3:
296 case DBG_ACTION_EXT_DBG0:
297 case DBG_ACTION_EXT_DBG1:
298 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action);
299 break;
300 default:
301 g_assert_not_reached();
302 }
303 }
304
305 /*
306 * Check the privilege level of specific trigger matches CPU's current privilege
307 * level.
308 */
trigger_priv_match(CPURISCVState * env,trigger_type_t type,int trigger_index)309 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type,
310 int trigger_index)
311 {
312 target_ulong ctrl = env->tdata1[trigger_index];
313
314 switch (type) {
315 case TRIGGER_TYPE_AD_MATCH:
316 /* type 2 trigger cannot be fired in VU/VS mode */
317 if (env->virt_enabled) {
318 return false;
319 }
320 /* check U/S/M bit against current privilege level */
321 if ((ctrl >> 3) & BIT(env->priv)) {
322 return true;
323 }
324 break;
325 case TRIGGER_TYPE_AD_MATCH6:
326 if (env->virt_enabled) {
327 /* check VU/VS bit against current privilege level */
328 if ((ctrl >> 23) & BIT(env->priv)) {
329 return true;
330 }
331 } else {
332 /* check U/S/M bit against current privilege level */
333 if ((ctrl >> 3) & BIT(env->priv)) {
334 return true;
335 }
336 }
337 break;
338 case TRIGGER_TYPE_INST_CNT:
339 if (env->virt_enabled) {
340 /* check VU/VS bit against current privilege level */
341 if ((ctrl >> 25) & BIT(env->priv)) {
342 return true;
343 }
344 } else {
345 /* check U/S/M bit against current privilege level */
346 if ((ctrl >> 6) & BIT(env->priv)) {
347 return true;
348 }
349 }
350 break;
351 case TRIGGER_TYPE_INT:
352 case TRIGGER_TYPE_EXCP:
353 case TRIGGER_TYPE_EXT_SRC:
354 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", type);
355 break;
356 case TRIGGER_TYPE_NO_EXIST:
357 case TRIGGER_TYPE_UNAVAIL:
358 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exist\n",
359 type);
360 break;
361 default:
362 g_assert_not_reached();
363 }
364
365 return false;
366 }
367
trigger_textra_match(CPURISCVState * env,trigger_type_t type,int trigger_index)368 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type,
369 int trigger_index)
370 {
371 target_ulong textra = env->tdata3[trigger_index];
372 target_ulong mhvalue, mhselect;
373
374 if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) {
375 /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */
376 return true;
377 }
378
379 switch (riscv_cpu_mxl(env)) {
380 case MXL_RV32:
381 mhvalue = get_field(textra, TEXTRA32_MHVALUE);
382 mhselect = get_field(textra, TEXTRA32_MHSELECT);
383 break;
384 case MXL_RV64:
385 case MXL_RV128:
386 mhvalue = get_field(textra, TEXTRA64_MHVALUE);
387 mhselect = get_field(textra, TEXTRA64_MHSELECT);
388 break;
389 default:
390 g_assert_not_reached();
391 }
392
393 /* Check mhvalue and mhselect. */
394 switch (mhselect) {
395 case MHSELECT_IGNORE:
396 break;
397 case MHSELECT_MCONTEXT:
398 /* Match if the low bits of mcontext/hcontext equal mhvalue. */
399 if (mhvalue != env->mcontext) {
400 return false;
401 }
402 break;
403 default:
404 break;
405 }
406
407 return true;
408 }
409
410 /* Common matching conditions for all types of the triggers. */
trigger_common_match(CPURISCVState * env,trigger_type_t type,int trigger_index)411 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type,
412 int trigger_index)
413 {
414 return trigger_priv_match(env, type, trigger_index) &&
415 trigger_textra_match(env, type, trigger_index);
416 }
417
418 /* type 2 trigger */
419
type2_breakpoint_size(CPURISCVState * env,target_ulong ctrl)420 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
421 {
422 uint32_t sizelo, sizehi = 0;
423
424 if (riscv_cpu_mxl(env) == MXL_RV64) {
425 sizehi = extract32(ctrl, 21, 2);
426 }
427 sizelo = extract32(ctrl, 16, 2);
428 return (sizehi << 2) | sizelo;
429 }
430
type2_breakpoint_enabled(target_ulong ctrl)431 static inline bool type2_breakpoint_enabled(target_ulong ctrl)
432 {
433 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M));
434 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
435
436 return mode && rwx;
437 }
438
type2_mcontrol_validate(CPURISCVState * env,target_ulong ctrl)439 static target_ulong type2_mcontrol_validate(CPURISCVState *env,
440 target_ulong ctrl)
441 {
442 target_ulong val;
443 uint32_t size;
444
445 /* validate the generic part first */
446 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH);
447
448 /* validate unimplemented (always zero) bits */
449 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match");
450 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain");
451 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action");
452 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing");
453 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select");
454 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit");
455
456 /* validate size encoding */
457 size = type2_breakpoint_size(env, ctrl);
458 if (access_size[size] == -1) {
459 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
460 "SIZE_ANY\n", size);
461 } else {
462 val |= (ctrl & TYPE2_SIZELO);
463 if (riscv_cpu_mxl(env) == MXL_RV64) {
464 val |= (ctrl & TYPE2_SIZEHI);
465 }
466 }
467
468 /* keep the mode and attribute bits */
469 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M |
470 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
471
472 return val;
473 }
474
type2_breakpoint_insert(CPURISCVState * env,target_ulong index)475 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
476 {
477 target_ulong ctrl = env->tdata1[index];
478 target_ulong addr = env->tdata2[index];
479 bool enabled = type2_breakpoint_enabled(ctrl);
480 CPUState *cs = env_cpu(env);
481 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
482 uint32_t size, def_size;
483
484 if (!enabled) {
485 return;
486 }
487
488 if (ctrl & TYPE2_EXEC) {
489 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
490 }
491
492 if (ctrl & TYPE2_LOAD) {
493 flags |= BP_MEM_READ;
494 }
495 if (ctrl & TYPE2_STORE) {
496 flags |= BP_MEM_WRITE;
497 }
498
499 if (flags & BP_MEM_ACCESS) {
500 size = type2_breakpoint_size(env, ctrl);
501 if (size != 0) {
502 cpu_watchpoint_insert(cs, addr, size, flags,
503 &env->cpu_watchpoint[index]);
504 } else {
505 def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4;
506
507 cpu_watchpoint_insert(cs, addr, def_size, flags,
508 &env->cpu_watchpoint[index]);
509 }
510 }
511 }
512
type2_breakpoint_remove(CPURISCVState * env,target_ulong index)513 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
514 {
515 CPUState *cs = env_cpu(env);
516
517 if (env->cpu_breakpoint[index]) {
518 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
519 env->cpu_breakpoint[index] = NULL;
520 }
521
522 if (env->cpu_watchpoint[index]) {
523 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
524 env->cpu_watchpoint[index] = NULL;
525 }
526 }
527
type2_reg_write(CPURISCVState * env,target_ulong index,int tdata_index,target_ulong val)528 static void type2_reg_write(CPURISCVState *env, target_ulong index,
529 int tdata_index, target_ulong val)
530 {
531 target_ulong new_val;
532
533 switch (tdata_index) {
534 case TDATA1:
535 new_val = type2_mcontrol_validate(env, val);
536 if (new_val != env->tdata1[index]) {
537 env->tdata1[index] = new_val;
538 type2_breakpoint_remove(env, index);
539 type2_breakpoint_insert(env, index);
540 }
541 break;
542 case TDATA2:
543 if (val != env->tdata2[index]) {
544 env->tdata2[index] = val;
545 type2_breakpoint_remove(env, index);
546 type2_breakpoint_insert(env, index);
547 }
548 break;
549 case TDATA3:
550 env->tdata3[index] = textra_validate(env, val);
551 break;
552 default:
553 g_assert_not_reached();
554 }
555 }
556
557 /* type 6 trigger */
558
type6_breakpoint_enabled(target_ulong ctrl)559 static inline bool type6_breakpoint_enabled(target_ulong ctrl)
560 {
561 bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
562 bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
563
564 return mode && rwx;
565 }
566
type6_mcontrol6_validate(CPURISCVState * env,target_ulong ctrl)567 static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
568 target_ulong ctrl)
569 {
570 target_ulong val;
571 uint32_t size;
572
573 /* validate the generic part first */
574 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6);
575
576 /* validate unimplemented (always zero) bits */
577 warn_always_zero_bit(ctrl, TYPE6_MATCH, "match");
578 warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain");
579 warn_always_zero_bit(ctrl, TYPE6_ACTION, "action");
580 warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing");
581 warn_always_zero_bit(ctrl, TYPE6_SELECT, "select");
582 warn_always_zero_bit(ctrl, TYPE6_HIT, "hit");
583
584 /* validate size encoding */
585 size = extract32(ctrl, 16, 4);
586 if (access_size[size] == -1) {
587 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
588 "SIZE_ANY\n", size);
589 } else {
590 val |= (ctrl & TYPE6_SIZE);
591 }
592
593 /* keep the mode and attribute bits */
594 val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M |
595 TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
596
597 return val;
598 }
599
type6_breakpoint_insert(CPURISCVState * env,target_ulong index)600 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
601 {
602 target_ulong ctrl = env->tdata1[index];
603 target_ulong addr = env->tdata2[index];
604 bool enabled = type6_breakpoint_enabled(ctrl);
605 CPUState *cs = env_cpu(env);
606 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
607 uint32_t size;
608
609 if (!enabled) {
610 return;
611 }
612
613 if (ctrl & TYPE6_EXEC) {
614 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
615 }
616
617 if (ctrl & TYPE6_LOAD) {
618 flags |= BP_MEM_READ;
619 }
620
621 if (ctrl & TYPE6_STORE) {
622 flags |= BP_MEM_WRITE;
623 }
624
625 if (flags & BP_MEM_ACCESS) {
626 size = extract32(ctrl, 16, 4);
627 if (size != 0) {
628 cpu_watchpoint_insert(cs, addr, size, flags,
629 &env->cpu_watchpoint[index]);
630 } else {
631 cpu_watchpoint_insert(cs, addr, 8, flags,
632 &env->cpu_watchpoint[index]);
633 }
634 }
635 }
636
type6_breakpoint_remove(CPURISCVState * env,target_ulong index)637 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
638 {
639 type2_breakpoint_remove(env, index);
640 }
641
type6_reg_write(CPURISCVState * env,target_ulong index,int tdata_index,target_ulong val)642 static void type6_reg_write(CPURISCVState *env, target_ulong index,
643 int tdata_index, target_ulong val)
644 {
645 target_ulong new_val;
646
647 switch (tdata_index) {
648 case TDATA1:
649 new_val = type6_mcontrol6_validate(env, val);
650 if (new_val != env->tdata1[index]) {
651 env->tdata1[index] = new_val;
652 type6_breakpoint_remove(env, index);
653 type6_breakpoint_insert(env, index);
654 }
655 break;
656 case TDATA2:
657 if (val != env->tdata2[index]) {
658 env->tdata2[index] = val;
659 type6_breakpoint_remove(env, index);
660 type6_breakpoint_insert(env, index);
661 }
662 break;
663 case TDATA3:
664 env->tdata3[index] = textra_validate(env, val);
665 break;
666 default:
667 g_assert_not_reached();
668 }
669 }
670
671 /* icount trigger type */
672 static inline int
itrigger_get_count(CPURISCVState * env,int index)673 itrigger_get_count(CPURISCVState *env, int index)
674 {
675 return get_field(env->tdata1[index], ITRIGGER_COUNT);
676 }
677
678 static inline void
itrigger_set_count(CPURISCVState * env,int index,int value)679 itrigger_set_count(CPURISCVState *env, int index, int value)
680 {
681 env->tdata1[index] = set_field(env->tdata1[index],
682 ITRIGGER_COUNT, value);
683 }
684
check_itrigger_priv(CPURISCVState * env,int index)685 static bool check_itrigger_priv(CPURISCVState *env, int index)
686 {
687 target_ulong tdata1 = env->tdata1[index];
688 if (env->virt_enabled) {
689 /* check VU/VS bit against current privilege level */
690 return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
691 (get_field(tdata1, ITRIGGER_VU) == env->priv);
692 } else {
693 /* check U/S/M bit against current privilege level */
694 return (get_field(tdata1, ITRIGGER_M) == env->priv) ||
695 (get_field(tdata1, ITRIGGER_S) == env->priv) ||
696 (get_field(tdata1, ITRIGGER_U) == env->priv);
697 }
698 }
699
riscv_itrigger_enabled(CPURISCVState * env)700 bool riscv_itrigger_enabled(CPURISCVState *env)
701 {
702 int count;
703 for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
704 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
705 continue;
706 }
707 if (check_itrigger_priv(env, i)) {
708 continue;
709 }
710 count = itrigger_get_count(env, i);
711 if (!count) {
712 continue;
713 }
714 return true;
715 }
716
717 return false;
718 }
719
helper_itrigger_match(CPURISCVState * env)720 void helper_itrigger_match(CPURISCVState *env)
721 {
722 int count;
723 for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
724 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
725 continue;
726 }
727 if (!trigger_common_match(env, TRIGGER_TYPE_INST_CNT, i)) {
728 continue;
729 }
730 count = itrigger_get_count(env, i);
731 if (!count) {
732 continue;
733 }
734 itrigger_set_count(env, i, count--);
735 if (!count) {
736 env->itrigger_enabled = riscv_itrigger_enabled(env);
737 do_trigger_action(env, i);
738 }
739 }
740 }
741
riscv_itrigger_update_count(CPURISCVState * env)742 static void riscv_itrigger_update_count(CPURISCVState *env)
743 {
744 int count, executed;
745 /*
746 * Record last icount, so that we can evaluate the executed instructions
747 * since last privilege mode change or timer expire.
748 */
749 int64_t last_icount = env->last_icount, current_icount;
750 current_icount = env->last_icount = icount_get_raw();
751
752 for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
753 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
754 continue;
755 }
756 count = itrigger_get_count(env, i);
757 if (!count) {
758 continue;
759 }
760 /*
761 * Only when privilege is changed or itrigger timer expires,
762 * the count field in itrigger tdata1 register is updated.
763 * And the count field in itrigger only contains remaining value.
764 */
765 if (check_itrigger_priv(env, i)) {
766 /*
767 * If itrigger enabled in this privilege mode, the number of
768 * executed instructions since last privilege change
769 * should be reduced from current itrigger count.
770 */
771 executed = current_icount - last_icount;
772 itrigger_set_count(env, i, count - executed);
773 if (count == executed) {
774 do_trigger_action(env, i);
775 }
776 } else {
777 /*
778 * If itrigger is not enabled in this privilege mode,
779 * the number of executed instructions will be discard and
780 * the count field in itrigger will not change.
781 */
782 timer_mod(env->itrigger_timer[i],
783 current_icount + count);
784 }
785 }
786 }
787
riscv_itrigger_timer_cb(void * opaque)788 static void riscv_itrigger_timer_cb(void *opaque)
789 {
790 riscv_itrigger_update_count((CPURISCVState *)opaque);
791 }
792
riscv_itrigger_update_priv(CPURISCVState * env)793 void riscv_itrigger_update_priv(CPURISCVState *env)
794 {
795 riscv_itrigger_update_count(env);
796 }
797
itrigger_validate(CPURISCVState * env,target_ulong ctrl)798 static target_ulong itrigger_validate(CPURISCVState *env,
799 target_ulong ctrl)
800 {
801 target_ulong val;
802
803 /* validate the generic part first */
804 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT);
805
806 /* validate unimplemented (always zero) bits */
807 warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action");
808 warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit");
809 warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending");
810
811 /* keep the mode and attribute bits */
812 val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S |
813 ITRIGGER_M | ITRIGGER_COUNT);
814
815 return val;
816 }
817
itrigger_reg_write(CPURISCVState * env,target_ulong index,int tdata_index,target_ulong val)818 static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
819 int tdata_index, target_ulong val)
820 {
821 target_ulong new_val;
822
823 switch (tdata_index) {
824 case TDATA1:
825 /* set timer for icount */
826 new_val = itrigger_validate(env, val);
827 if (new_val != env->tdata1[index]) {
828 env->tdata1[index] = new_val;
829 if (icount_enabled()) {
830 env->last_icount = icount_get_raw();
831 /* set the count to timer */
832 timer_mod(env->itrigger_timer[index],
833 env->last_icount + itrigger_get_count(env, index));
834 } else {
835 env->itrigger_enabled = riscv_itrigger_enabled(env);
836 }
837 }
838 break;
839 case TDATA2:
840 qemu_log_mask(LOG_UNIMP,
841 "tdata2 is not supported for icount trigger\n");
842 break;
843 case TDATA3:
844 env->tdata3[index] = textra_validate(env, val);
845 break;
846 default:
847 g_assert_not_reached();
848 }
849 }
850
itrigger_get_adjust_count(CPURISCVState * env)851 static int itrigger_get_adjust_count(CPURISCVState *env)
852 {
853 int count = itrigger_get_count(env, env->trigger_cur), executed;
854 if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) {
855 executed = icount_get_raw() - env->last_icount;
856 count += executed;
857 }
858 return count;
859 }
860
tdata_csr_read(CPURISCVState * env,int tdata_index)861 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
862 {
863 int trigger_type;
864 switch (tdata_index) {
865 case TDATA1:
866 trigger_type = extract_trigger_type(env,
867 env->tdata1[env->trigger_cur]);
868 if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) {
869 return deposit64(env->tdata1[env->trigger_cur], 10, 14,
870 itrigger_get_adjust_count(env));
871 }
872 return env->tdata1[env->trigger_cur];
873 case TDATA2:
874 return env->tdata2[env->trigger_cur];
875 case TDATA3:
876 return env->tdata3[env->trigger_cur];
877 default:
878 g_assert_not_reached();
879 }
880 }
881
tdata_csr_write(CPURISCVState * env,int tdata_index,target_ulong val)882 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
883 {
884 int trigger_type;
885
886 if (tdata_index == TDATA1) {
887 trigger_type = extract_trigger_type(env, val);
888 } else {
889 trigger_type = get_trigger_type(env, env->trigger_cur);
890 }
891
892 switch (trigger_type) {
893 case TRIGGER_TYPE_AD_MATCH:
894 type2_reg_write(env, env->trigger_cur, tdata_index, val);
895 break;
896 case TRIGGER_TYPE_AD_MATCH6:
897 type6_reg_write(env, env->trigger_cur, tdata_index, val);
898 break;
899 case TRIGGER_TYPE_INST_CNT:
900 itrigger_reg_write(env, env->trigger_cur, tdata_index, val);
901 break;
902 case TRIGGER_TYPE_INT:
903 case TRIGGER_TYPE_EXCP:
904 case TRIGGER_TYPE_EXT_SRC:
905 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
906 trigger_type);
907 break;
908 case TRIGGER_TYPE_NO_EXIST:
909 case TRIGGER_TYPE_UNAVAIL:
910 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
911 trigger_type);
912 break;
913 default:
914 g_assert_not_reached();
915 }
916 }
917
tinfo_csr_read(CPURISCVState * env)918 target_ulong tinfo_csr_read(CPURISCVState *env)
919 {
920 /* assume all triggers support the same types of triggers */
921 return BIT(TRIGGER_TYPE_AD_MATCH) |
922 BIT(TRIGGER_TYPE_AD_MATCH6);
923 }
924
riscv_cpu_debug_excp_handler(CPUState * cs)925 void riscv_cpu_debug_excp_handler(CPUState *cs)
926 {
927 RISCVCPU *cpu = RISCV_CPU(cs);
928 CPURISCVState *env = &cpu->env;
929
930 if (cs->watchpoint_hit) {
931 if (cs->watchpoint_hit->flags & BP_CPU) {
932 do_trigger_action(env, DBG_ACTION_BP);
933 }
934 } else {
935 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) {
936 do_trigger_action(env, DBG_ACTION_BP);
937 }
938 }
939 }
940
riscv_cpu_debug_check_breakpoint(CPUState * cs)941 bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
942 {
943 RISCVCPU *cpu = RISCV_CPU(cs);
944 CPURISCVState *env = &cpu->env;
945 CPUBreakpoint *bp;
946 target_ulong ctrl;
947 target_ulong pc;
948 int trigger_type;
949 int i;
950
951 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
952 for (i = 0; i < RV_MAX_TRIGGERS; i++) {
953 trigger_type = get_trigger_type(env, i);
954
955 if (!trigger_common_match(env, trigger_type, i)) {
956 continue;
957 }
958
959 switch (trigger_type) {
960 case TRIGGER_TYPE_AD_MATCH:
961 ctrl = env->tdata1[i];
962 pc = env->tdata2[i];
963
964 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
965 env->badaddr = pc;
966 return true;
967 }
968 break;
969 case TRIGGER_TYPE_AD_MATCH6:
970 ctrl = env->tdata1[i];
971 pc = env->tdata2[i];
972
973 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
974 env->badaddr = pc;
975 return true;
976 }
977 break;
978 default:
979 /* other trigger types are not supported or irrelevant */
980 break;
981 }
982 }
983 }
984
985 return false;
986 }
987
riscv_cpu_debug_check_watchpoint(CPUState * cs,CPUWatchpoint * wp)988 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
989 {
990 RISCVCPU *cpu = RISCV_CPU(cs);
991 CPURISCVState *env = &cpu->env;
992 target_ulong ctrl;
993 target_ulong addr;
994 int trigger_type;
995 int flags;
996 int i;
997
998 for (i = 0; i < RV_MAX_TRIGGERS; i++) {
999 trigger_type = get_trigger_type(env, i);
1000
1001 if (!trigger_common_match(env, trigger_type, i)) {
1002 continue;
1003 }
1004
1005 switch (trigger_type) {
1006 case TRIGGER_TYPE_AD_MATCH:
1007 ctrl = env->tdata1[i];
1008 addr = env->tdata2[i];
1009 flags = 0;
1010
1011 if (ctrl & TYPE2_LOAD) {
1012 flags |= BP_MEM_READ;
1013 }
1014 if (ctrl & TYPE2_STORE) {
1015 flags |= BP_MEM_WRITE;
1016 }
1017
1018 if ((wp->flags & flags) && (wp->vaddr == addr)) {
1019 return true;
1020 }
1021 break;
1022 case TRIGGER_TYPE_AD_MATCH6:
1023 ctrl = env->tdata1[i];
1024 addr = env->tdata2[i];
1025 flags = 0;
1026
1027 if (ctrl & TYPE6_LOAD) {
1028 flags |= BP_MEM_READ;
1029 }
1030 if (ctrl & TYPE6_STORE) {
1031 flags |= BP_MEM_WRITE;
1032 }
1033
1034 if ((wp->flags & flags) && (wp->vaddr == addr)) {
1035 return true;
1036 }
1037 break;
1038 default:
1039 /* other trigger types are not supported */
1040 break;
1041 }
1042 }
1043
1044 return false;
1045 }
1046
riscv_trigger_realize(CPURISCVState * env)1047 void riscv_trigger_realize(CPURISCVState *env)
1048 {
1049 int i;
1050
1051 for (i = 0; i < RV_MAX_TRIGGERS; i++) {
1052 env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
1053 riscv_itrigger_timer_cb, env);
1054 }
1055 }
1056
riscv_trigger_reset_hold(CPURISCVState * env)1057 void riscv_trigger_reset_hold(CPURISCVState *env)
1058 {
1059 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
1060 int i;
1061
1062 /* init to type 2 triggers */
1063 for (i = 0; i < RV_MAX_TRIGGERS; i++) {
1064 /*
1065 * type = TRIGGER_TYPE_AD_MATCH
1066 * dmode = 0 (both debug and M-mode can write tdata)
1067 * maskmax = 0 (unimplemented, always 0)
1068 * sizehi = 0 (match against any size, RV64 only)
1069 * hit = 0 (unimplemented, always 0)
1070 * select = 0 (always 0, perform match on address)
1071 * timing = 0 (always 0, trigger before instruction)
1072 * sizelo = 0 (match against any size)
1073 * action = 0 (always 0, raise a breakpoint exception)
1074 * chain = 0 (unimplemented, always 0)
1075 * match = 0 (always 0, when any compare value equals tdata2)
1076 */
1077 env->tdata1[i] = tdata1;
1078 env->tdata2[i] = 0;
1079 env->tdata3[i] = 0;
1080 env->cpu_breakpoint[i] = NULL;
1081 env->cpu_watchpoint[i] = NULL;
1082 timer_del(env->itrigger_timer[i]);
1083 }
1084
1085 env->mcontext = 0;
1086 }
1087