1 /* 2 * QEMU RISC-V Native Debug Support 3 * 4 * Copyright (c) 2022 Wind River Systems, Inc. 5 * 6 * Author: 7 * Bin Meng <bin.meng@windriver.com> 8 * 9 * This provides the native debug support via the Trigger Module, as defined 10 * in the RISC-V Debug Specification: 11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf 12 * 13 * This program is free software; you can redistribute it and/or modify it 14 * under the terms and conditions of the GNU General Public License, 15 * version 2 or later, as published by the Free Software Foundation. 16 * 17 * This program is distributed in the hope it will be useful, but WITHOUT 18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 20 * more details. 21 * 22 * You should have received a copy of the GNU General Public License along with 23 * this program. If not, see <http://www.gnu.org/licenses/>. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 #include "trace.h" 31 #include "exec/exec-all.h" 32 #include "exec/helper-proto.h" 33 #include "system/cpu-timers.h" 34 35 /* 36 * The following M-mode trigger CSRs are implemented: 37 * 38 * - tselect 39 * - tdata1 40 * - tdata2 41 * - tdata3 42 * - tinfo 43 * 44 * The following triggers are initialized by default: 45 * 46 * Index | Type | tdata mapping | Description 47 * ------+------+------------------------+------------ 48 * 0 | 2 | tdata1, tdata2 | Address / Data Match 49 * 1 | 2 | tdata1, tdata2 | Address / Data Match 50 */ 51 52 /* tdata availability of a trigger */ 53 typedef bool tdata_avail[TDATA_NUM]; 54 55 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = { 56 [TRIGGER_TYPE_NO_EXIST] = { false, false, false }, 57 [TRIGGER_TYPE_AD_MATCH] = { true, true, true }, 58 [TRIGGER_TYPE_INST_CNT] = { true, false, true }, 59 [TRIGGER_TYPE_INT] = { true, true, true }, 60 [TRIGGER_TYPE_EXCP] = { true, true, true }, 61 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true }, 62 [TRIGGER_TYPE_EXT_SRC] = { true, false, false }, 63 [TRIGGER_TYPE_UNAVAIL] = { true, true, true } 64 }; 65 66 /* only breakpoint size 1/2/4/8 supported */ 67 static int access_size[SIZE_NUM] = { 68 [SIZE_ANY] = 0, 69 [SIZE_1B] = 1, 70 [SIZE_2B] = 2, 71 [SIZE_4B] = 4, 72 [SIZE_6B] = -1, 73 [SIZE_8B] = 8, 74 [6 ... 15] = -1, 75 }; 76 77 static inline target_ulong extract_trigger_type(CPURISCVState *env, 78 target_ulong tdata1) 79 { 80 switch (riscv_cpu_mxl(env)) { 81 case MXL_RV32: 82 return extract32(tdata1, 28, 4); 83 case MXL_RV64: 84 case MXL_RV128: 85 return extract64(tdata1, 60, 4); 86 default: 87 g_assert_not_reached(); 88 } 89 } 90 91 static inline target_ulong get_trigger_type(CPURISCVState *env, 92 target_ulong trigger_index) 93 { 94 return extract_trigger_type(env, env->tdata1[trigger_index]); 95 } 96 97 static trigger_action_t get_trigger_action(CPURISCVState *env, 98 target_ulong trigger_index) 99 { 100 target_ulong tdata1 = env->tdata1[trigger_index]; 101 int trigger_type = get_trigger_type(env, trigger_index); 102 trigger_action_t action = DBG_ACTION_NONE; 103 104 switch (trigger_type) { 105 case TRIGGER_TYPE_AD_MATCH: 106 action = (tdata1 & TYPE2_ACTION) >> 12; 107 break; 108 case TRIGGER_TYPE_AD_MATCH6: 109 action = (tdata1 & TYPE6_ACTION) >> 12; 110 break; 111 case TRIGGER_TYPE_INST_CNT: 112 case TRIGGER_TYPE_INT: 113 case TRIGGER_TYPE_EXCP: 114 case TRIGGER_TYPE_EXT_SRC: 115 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 116 trigger_type); 117 break; 118 case TRIGGER_TYPE_NO_EXIST: 119 case TRIGGER_TYPE_UNAVAIL: 120 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 121 trigger_type); 122 break; 123 default: 124 g_assert_not_reached(); 125 } 126 127 return action; 128 } 129 130 static inline target_ulong build_tdata1(CPURISCVState *env, 131 trigger_type_t type, 132 bool dmode, target_ulong data) 133 { 134 target_ulong tdata1; 135 136 switch (riscv_cpu_mxl(env)) { 137 case MXL_RV32: 138 tdata1 = RV32_TYPE(type) | 139 (dmode ? RV32_DMODE : 0) | 140 (data & RV32_DATA_MASK); 141 break; 142 case MXL_RV64: 143 case MXL_RV128: 144 tdata1 = RV64_TYPE(type) | 145 (dmode ? RV64_DMODE : 0) | 146 (data & RV64_DATA_MASK); 147 break; 148 default: 149 g_assert_not_reached(); 150 } 151 152 return tdata1; 153 } 154 155 bool tdata_available(CPURISCVState *env, int tdata_index) 156 { 157 int trigger_type = get_trigger_type(env, env->trigger_cur); 158 159 if (unlikely(tdata_index >= TDATA_NUM)) { 160 return false; 161 } 162 163 return tdata_mapping[trigger_type][tdata_index]; 164 } 165 166 target_ulong tselect_csr_read(CPURISCVState *env) 167 { 168 return env->trigger_cur; 169 } 170 171 void tselect_csr_write(CPURISCVState *env, target_ulong val) 172 { 173 if (val < RV_MAX_TRIGGERS) { 174 env->trigger_cur = val; 175 } 176 } 177 178 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val, 179 trigger_type_t t) 180 { 181 uint32_t type, dmode; 182 target_ulong tdata1; 183 184 switch (riscv_cpu_mxl(env)) { 185 case MXL_RV32: 186 type = extract32(val, 28, 4); 187 dmode = extract32(val, 27, 1); 188 tdata1 = RV32_TYPE(t); 189 break; 190 case MXL_RV64: 191 case MXL_RV128: 192 type = extract64(val, 60, 4); 193 dmode = extract64(val, 59, 1); 194 tdata1 = RV64_TYPE(t); 195 break; 196 default: 197 g_assert_not_reached(); 198 } 199 200 if (type != t) { 201 qemu_log_mask(LOG_GUEST_ERROR, 202 "ignoring type write to tdata1 register\n"); 203 } 204 205 if (dmode != 0) { 206 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n"); 207 } 208 209 return tdata1; 210 } 211 212 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask, 213 const char *msg) 214 { 215 if (val & mask) { 216 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg); 217 } 218 } 219 220 static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3) 221 { 222 target_ulong mhvalue, mhselect; 223 target_ulong mhselect_new; 224 target_ulong textra; 225 const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 }; 226 227 switch (riscv_cpu_mxl(env)) { 228 case MXL_RV32: 229 mhvalue = get_field(tdata3, TEXTRA32_MHVALUE); 230 mhselect = get_field(tdata3, TEXTRA32_MHSELECT); 231 /* Validate unimplemented (always zero) bits */ 232 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK, 233 "sbytemask"); 234 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE, 235 "svalue"); 236 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT, 237 "sselect"); 238 break; 239 case MXL_RV64: 240 case MXL_RV128: 241 mhvalue = get_field(tdata3, TEXTRA64_MHVALUE); 242 mhselect = get_field(tdata3, TEXTRA64_MHSELECT); 243 /* Validate unimplemented (always zero) bits */ 244 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK, 245 "sbytemask"); 246 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE, 247 "svalue"); 248 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT, 249 "sselect"); 250 break; 251 default: 252 g_assert_not_reached(); 253 } 254 255 /* Validate mhselect. */ 256 mhselect_new = mhselect_no_rvh[mhselect]; 257 if (mhselect != mhselect_new) { 258 qemu_log_mask(LOG_UNIMP, "mhselect only supports 0 or 4 for now\n"); 259 } 260 261 /* Write legal values into textra */ 262 textra = 0; 263 switch (riscv_cpu_mxl(env)) { 264 case MXL_RV32: 265 textra = set_field(textra, TEXTRA32_MHVALUE, mhvalue); 266 textra = set_field(textra, TEXTRA32_MHSELECT, mhselect_new); 267 break; 268 case MXL_RV64: 269 case MXL_RV128: 270 textra = set_field(textra, TEXTRA64_MHVALUE, mhvalue); 271 textra = set_field(textra, TEXTRA64_MHSELECT, mhselect_new); 272 break; 273 default: 274 g_assert_not_reached(); 275 } 276 277 return textra; 278 } 279 280 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index) 281 { 282 trigger_action_t action = get_trigger_action(env, trigger_index); 283 284 switch (action) { 285 case DBG_ACTION_NONE: 286 break; 287 case DBG_ACTION_BP: 288 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0); 289 break; 290 case DBG_ACTION_DBG_MODE: 291 case DBG_ACTION_TRACE0: 292 case DBG_ACTION_TRACE1: 293 case DBG_ACTION_TRACE2: 294 case DBG_ACTION_TRACE3: 295 case DBG_ACTION_EXT_DBG0: 296 case DBG_ACTION_EXT_DBG1: 297 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action); 298 break; 299 default: 300 g_assert_not_reached(); 301 } 302 } 303 304 /* 305 * Check the privilege level of specific trigger matches CPU's current privilege 306 * level. 307 */ 308 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type, 309 int trigger_index) 310 { 311 target_ulong ctrl = env->tdata1[trigger_index]; 312 313 switch (type) { 314 case TRIGGER_TYPE_AD_MATCH: 315 /* type 2 trigger cannot be fired in VU/VS mode */ 316 if (env->virt_enabled) { 317 return false; 318 } 319 /* check U/S/M bit against current privilege level */ 320 if ((ctrl >> 3) & BIT(env->priv)) { 321 return true; 322 } 323 break; 324 case TRIGGER_TYPE_AD_MATCH6: 325 if (env->virt_enabled) { 326 /* check VU/VS bit against current privilege level */ 327 if ((ctrl >> 23) & BIT(env->priv)) { 328 return true; 329 } 330 } else { 331 /* check U/S/M bit against current privilege level */ 332 if ((ctrl >> 3) & BIT(env->priv)) { 333 return true; 334 } 335 } 336 break; 337 case TRIGGER_TYPE_INST_CNT: 338 if (env->virt_enabled) { 339 /* check VU/VS bit against current privilege level */ 340 if ((ctrl >> 25) & BIT(env->priv)) { 341 return true; 342 } 343 } else { 344 /* check U/S/M bit against current privilege level */ 345 if ((ctrl >> 6) & BIT(env->priv)) { 346 return true; 347 } 348 } 349 break; 350 case TRIGGER_TYPE_INT: 351 case TRIGGER_TYPE_EXCP: 352 case TRIGGER_TYPE_EXT_SRC: 353 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", type); 354 break; 355 case TRIGGER_TYPE_NO_EXIST: 356 case TRIGGER_TYPE_UNAVAIL: 357 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exist\n", 358 type); 359 break; 360 default: 361 g_assert_not_reached(); 362 } 363 364 return false; 365 } 366 367 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type, 368 int trigger_index) 369 { 370 target_ulong textra = env->tdata3[trigger_index]; 371 target_ulong mhvalue, mhselect; 372 373 if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) { 374 /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */ 375 return true; 376 } 377 378 switch (riscv_cpu_mxl(env)) { 379 case MXL_RV32: 380 mhvalue = get_field(textra, TEXTRA32_MHVALUE); 381 mhselect = get_field(textra, TEXTRA32_MHSELECT); 382 break; 383 case MXL_RV64: 384 case MXL_RV128: 385 mhvalue = get_field(textra, TEXTRA64_MHVALUE); 386 mhselect = get_field(textra, TEXTRA64_MHSELECT); 387 break; 388 default: 389 g_assert_not_reached(); 390 } 391 392 /* Check mhvalue and mhselect. */ 393 switch (mhselect) { 394 case MHSELECT_IGNORE: 395 break; 396 case MHSELECT_MCONTEXT: 397 /* Match if the low bits of mcontext/hcontext equal mhvalue. */ 398 if (mhvalue != env->mcontext) { 399 return false; 400 } 401 break; 402 default: 403 break; 404 } 405 406 return true; 407 } 408 409 /* Common matching conditions for all types of the triggers. */ 410 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type, 411 int trigger_index) 412 { 413 return trigger_priv_match(env, type, trigger_index) && 414 trigger_textra_match(env, type, trigger_index); 415 } 416 417 /* type 2 trigger */ 418 419 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl) 420 { 421 uint32_t sizelo, sizehi = 0; 422 423 if (riscv_cpu_mxl(env) == MXL_RV64) { 424 sizehi = extract32(ctrl, 21, 2); 425 } 426 sizelo = extract32(ctrl, 16, 2); 427 return (sizehi << 2) | sizelo; 428 } 429 430 static inline bool type2_breakpoint_enabled(target_ulong ctrl) 431 { 432 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M)); 433 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 434 435 return mode && rwx; 436 } 437 438 static target_ulong type2_mcontrol_validate(CPURISCVState *env, 439 target_ulong ctrl) 440 { 441 target_ulong val; 442 uint32_t size; 443 444 /* validate the generic part first */ 445 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH); 446 447 /* validate unimplemented (always zero) bits */ 448 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match"); 449 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain"); 450 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action"); 451 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing"); 452 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select"); 453 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit"); 454 455 /* validate size encoding */ 456 size = type2_breakpoint_size(env, ctrl); 457 if (access_size[size] == -1) { 458 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 459 "SIZE_ANY\n", size); 460 } else { 461 val |= (ctrl & TYPE2_SIZELO); 462 if (riscv_cpu_mxl(env) == MXL_RV64) { 463 val |= (ctrl & TYPE2_SIZEHI); 464 } 465 } 466 467 /* keep the mode and attribute bits */ 468 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M | 469 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 470 471 return val; 472 } 473 474 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index) 475 { 476 target_ulong ctrl = env->tdata1[index]; 477 target_ulong addr = env->tdata2[index]; 478 bool enabled = type2_breakpoint_enabled(ctrl); 479 CPUState *cs = env_cpu(env); 480 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 481 uint32_t size, def_size; 482 483 if (!enabled) { 484 return; 485 } 486 487 if (ctrl & TYPE2_EXEC) { 488 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 489 } 490 491 if (ctrl & TYPE2_LOAD) { 492 flags |= BP_MEM_READ; 493 } 494 if (ctrl & TYPE2_STORE) { 495 flags |= BP_MEM_WRITE; 496 } 497 498 if (flags & BP_MEM_ACCESS) { 499 size = type2_breakpoint_size(env, ctrl); 500 if (size != 0) { 501 cpu_watchpoint_insert(cs, addr, size, flags, 502 &env->cpu_watchpoint[index]); 503 } else { 504 def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4; 505 506 cpu_watchpoint_insert(cs, addr, def_size, flags, 507 &env->cpu_watchpoint[index]); 508 } 509 } 510 } 511 512 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index) 513 { 514 CPUState *cs = env_cpu(env); 515 516 if (env->cpu_breakpoint[index]) { 517 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]); 518 env->cpu_breakpoint[index] = NULL; 519 } 520 521 if (env->cpu_watchpoint[index]) { 522 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]); 523 env->cpu_watchpoint[index] = NULL; 524 } 525 } 526 527 static void type2_reg_write(CPURISCVState *env, target_ulong index, 528 int tdata_index, target_ulong val) 529 { 530 target_ulong new_val; 531 532 switch (tdata_index) { 533 case TDATA1: 534 new_val = type2_mcontrol_validate(env, val); 535 if (new_val != env->tdata1[index]) { 536 env->tdata1[index] = new_val; 537 type2_breakpoint_remove(env, index); 538 type2_breakpoint_insert(env, index); 539 } 540 break; 541 case TDATA2: 542 if (val != env->tdata2[index]) { 543 env->tdata2[index] = val; 544 type2_breakpoint_remove(env, index); 545 type2_breakpoint_insert(env, index); 546 } 547 break; 548 case TDATA3: 549 env->tdata3[index] = textra_validate(env, val); 550 break; 551 default: 552 g_assert_not_reached(); 553 } 554 555 return; 556 } 557 558 /* type 6 trigger */ 559 560 static inline bool type6_breakpoint_enabled(target_ulong ctrl) 561 { 562 bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M)); 563 bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 564 565 return mode && rwx; 566 } 567 568 static target_ulong type6_mcontrol6_validate(CPURISCVState *env, 569 target_ulong ctrl) 570 { 571 target_ulong val; 572 uint32_t size; 573 574 /* validate the generic part first */ 575 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6); 576 577 /* validate unimplemented (always zero) bits */ 578 warn_always_zero_bit(ctrl, TYPE6_MATCH, "match"); 579 warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain"); 580 warn_always_zero_bit(ctrl, TYPE6_ACTION, "action"); 581 warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing"); 582 warn_always_zero_bit(ctrl, TYPE6_SELECT, "select"); 583 warn_always_zero_bit(ctrl, TYPE6_HIT, "hit"); 584 585 /* validate size encoding */ 586 size = extract32(ctrl, 16, 4); 587 if (access_size[size] == -1) { 588 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 589 "SIZE_ANY\n", size); 590 } else { 591 val |= (ctrl & TYPE6_SIZE); 592 } 593 594 /* keep the mode and attribute bits */ 595 val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M | 596 TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 597 598 return val; 599 } 600 601 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index) 602 { 603 target_ulong ctrl = env->tdata1[index]; 604 target_ulong addr = env->tdata2[index]; 605 bool enabled = type6_breakpoint_enabled(ctrl); 606 CPUState *cs = env_cpu(env); 607 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 608 uint32_t size; 609 610 if (!enabled) { 611 return; 612 } 613 614 if (ctrl & TYPE6_EXEC) { 615 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 616 } 617 618 if (ctrl & TYPE6_LOAD) { 619 flags |= BP_MEM_READ; 620 } 621 622 if (ctrl & TYPE6_STORE) { 623 flags |= BP_MEM_WRITE; 624 } 625 626 if (flags & BP_MEM_ACCESS) { 627 size = extract32(ctrl, 16, 4); 628 if (size != 0) { 629 cpu_watchpoint_insert(cs, addr, size, flags, 630 &env->cpu_watchpoint[index]); 631 } else { 632 cpu_watchpoint_insert(cs, addr, 8, flags, 633 &env->cpu_watchpoint[index]); 634 } 635 } 636 } 637 638 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index) 639 { 640 type2_breakpoint_remove(env, index); 641 } 642 643 static void type6_reg_write(CPURISCVState *env, target_ulong index, 644 int tdata_index, target_ulong val) 645 { 646 target_ulong new_val; 647 648 switch (tdata_index) { 649 case TDATA1: 650 new_val = type6_mcontrol6_validate(env, val); 651 if (new_val != env->tdata1[index]) { 652 env->tdata1[index] = new_val; 653 type6_breakpoint_remove(env, index); 654 type6_breakpoint_insert(env, index); 655 } 656 break; 657 case TDATA2: 658 if (val != env->tdata2[index]) { 659 env->tdata2[index] = val; 660 type6_breakpoint_remove(env, index); 661 type6_breakpoint_insert(env, index); 662 } 663 break; 664 case TDATA3: 665 env->tdata3[index] = textra_validate(env, val); 666 break; 667 default: 668 g_assert_not_reached(); 669 } 670 671 return; 672 } 673 674 /* icount trigger type */ 675 static inline int 676 itrigger_get_count(CPURISCVState *env, int index) 677 { 678 return get_field(env->tdata1[index], ITRIGGER_COUNT); 679 } 680 681 static inline void 682 itrigger_set_count(CPURISCVState *env, int index, int value) 683 { 684 env->tdata1[index] = set_field(env->tdata1[index], 685 ITRIGGER_COUNT, value); 686 } 687 688 static bool check_itrigger_priv(CPURISCVState *env, int index) 689 { 690 target_ulong tdata1 = env->tdata1[index]; 691 if (env->virt_enabled) { 692 /* check VU/VS bit against current privilege level */ 693 return (get_field(tdata1, ITRIGGER_VS) == env->priv) || 694 (get_field(tdata1, ITRIGGER_VU) == env->priv); 695 } else { 696 /* check U/S/M bit against current privilege level */ 697 return (get_field(tdata1, ITRIGGER_M) == env->priv) || 698 (get_field(tdata1, ITRIGGER_S) == env->priv) || 699 (get_field(tdata1, ITRIGGER_U) == env->priv); 700 } 701 } 702 703 bool riscv_itrigger_enabled(CPURISCVState *env) 704 { 705 int count; 706 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 707 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 708 continue; 709 } 710 if (check_itrigger_priv(env, i)) { 711 continue; 712 } 713 count = itrigger_get_count(env, i); 714 if (!count) { 715 continue; 716 } 717 return true; 718 } 719 720 return false; 721 } 722 723 void helper_itrigger_match(CPURISCVState *env) 724 { 725 int count; 726 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 727 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 728 continue; 729 } 730 if (!trigger_common_match(env, TRIGGER_TYPE_INST_CNT, i)) { 731 continue; 732 } 733 count = itrigger_get_count(env, i); 734 if (!count) { 735 continue; 736 } 737 itrigger_set_count(env, i, count--); 738 if (!count) { 739 env->itrigger_enabled = riscv_itrigger_enabled(env); 740 do_trigger_action(env, i); 741 } 742 } 743 } 744 745 static void riscv_itrigger_update_count(CPURISCVState *env) 746 { 747 int count, executed; 748 /* 749 * Record last icount, so that we can evaluate the executed instructions 750 * since last privilege mode change or timer expire. 751 */ 752 int64_t last_icount = env->last_icount, current_icount; 753 current_icount = env->last_icount = icount_get_raw(); 754 755 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 756 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 757 continue; 758 } 759 count = itrigger_get_count(env, i); 760 if (!count) { 761 continue; 762 } 763 /* 764 * Only when privilege is changed or itrigger timer expires, 765 * the count field in itrigger tdata1 register is updated. 766 * And the count field in itrigger only contains remaining value. 767 */ 768 if (check_itrigger_priv(env, i)) { 769 /* 770 * If itrigger enabled in this privilege mode, the number of 771 * executed instructions since last privilege change 772 * should be reduced from current itrigger count. 773 */ 774 executed = current_icount - last_icount; 775 itrigger_set_count(env, i, count - executed); 776 if (count == executed) { 777 do_trigger_action(env, i); 778 } 779 } else { 780 /* 781 * If itrigger is not enabled in this privilege mode, 782 * the number of executed instructions will be discard and 783 * the count field in itrigger will not change. 784 */ 785 timer_mod(env->itrigger_timer[i], 786 current_icount + count); 787 } 788 } 789 } 790 791 static void riscv_itrigger_timer_cb(void *opaque) 792 { 793 riscv_itrigger_update_count((CPURISCVState *)opaque); 794 } 795 796 void riscv_itrigger_update_priv(CPURISCVState *env) 797 { 798 riscv_itrigger_update_count(env); 799 } 800 801 static target_ulong itrigger_validate(CPURISCVState *env, 802 target_ulong ctrl) 803 { 804 target_ulong val; 805 806 /* validate the generic part first */ 807 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT); 808 809 /* validate unimplemented (always zero) bits */ 810 warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action"); 811 warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit"); 812 warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending"); 813 814 /* keep the mode and attribute bits */ 815 val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S | 816 ITRIGGER_M | ITRIGGER_COUNT); 817 818 return val; 819 } 820 821 static void itrigger_reg_write(CPURISCVState *env, target_ulong index, 822 int tdata_index, target_ulong val) 823 { 824 target_ulong new_val; 825 826 switch (tdata_index) { 827 case TDATA1: 828 /* set timer for icount */ 829 new_val = itrigger_validate(env, val); 830 if (new_val != env->tdata1[index]) { 831 env->tdata1[index] = new_val; 832 if (icount_enabled()) { 833 env->last_icount = icount_get_raw(); 834 /* set the count to timer */ 835 timer_mod(env->itrigger_timer[index], 836 env->last_icount + itrigger_get_count(env, index)); 837 } else { 838 env->itrigger_enabled = riscv_itrigger_enabled(env); 839 } 840 } 841 break; 842 case TDATA2: 843 qemu_log_mask(LOG_UNIMP, 844 "tdata2 is not supported for icount trigger\n"); 845 break; 846 case TDATA3: 847 env->tdata3[index] = textra_validate(env, val); 848 break; 849 default: 850 g_assert_not_reached(); 851 } 852 853 return; 854 } 855 856 static int itrigger_get_adjust_count(CPURISCVState *env) 857 { 858 int count = itrigger_get_count(env, env->trigger_cur), executed; 859 if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) { 860 executed = icount_get_raw() - env->last_icount; 861 count += executed; 862 } 863 return count; 864 } 865 866 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index) 867 { 868 int trigger_type; 869 switch (tdata_index) { 870 case TDATA1: 871 trigger_type = extract_trigger_type(env, 872 env->tdata1[env->trigger_cur]); 873 if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) { 874 return deposit64(env->tdata1[env->trigger_cur], 10, 14, 875 itrigger_get_adjust_count(env)); 876 } 877 return env->tdata1[env->trigger_cur]; 878 case TDATA2: 879 return env->tdata2[env->trigger_cur]; 880 case TDATA3: 881 return env->tdata3[env->trigger_cur]; 882 default: 883 g_assert_not_reached(); 884 } 885 } 886 887 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val) 888 { 889 int trigger_type; 890 891 if (tdata_index == TDATA1) { 892 trigger_type = extract_trigger_type(env, val); 893 } else { 894 trigger_type = get_trigger_type(env, env->trigger_cur); 895 } 896 897 switch (trigger_type) { 898 case TRIGGER_TYPE_AD_MATCH: 899 type2_reg_write(env, env->trigger_cur, tdata_index, val); 900 break; 901 case TRIGGER_TYPE_AD_MATCH6: 902 type6_reg_write(env, env->trigger_cur, tdata_index, val); 903 break; 904 case TRIGGER_TYPE_INST_CNT: 905 itrigger_reg_write(env, env->trigger_cur, tdata_index, val); 906 break; 907 case TRIGGER_TYPE_INT: 908 case TRIGGER_TYPE_EXCP: 909 case TRIGGER_TYPE_EXT_SRC: 910 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 911 trigger_type); 912 break; 913 case TRIGGER_TYPE_NO_EXIST: 914 case TRIGGER_TYPE_UNAVAIL: 915 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 916 trigger_type); 917 break; 918 default: 919 g_assert_not_reached(); 920 } 921 } 922 923 target_ulong tinfo_csr_read(CPURISCVState *env) 924 { 925 /* assume all triggers support the same types of triggers */ 926 return BIT(TRIGGER_TYPE_AD_MATCH) | 927 BIT(TRIGGER_TYPE_AD_MATCH6); 928 } 929 930 void riscv_cpu_debug_excp_handler(CPUState *cs) 931 { 932 RISCVCPU *cpu = RISCV_CPU(cs); 933 CPURISCVState *env = &cpu->env; 934 935 if (cs->watchpoint_hit) { 936 if (cs->watchpoint_hit->flags & BP_CPU) { 937 do_trigger_action(env, DBG_ACTION_BP); 938 } 939 } else { 940 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) { 941 do_trigger_action(env, DBG_ACTION_BP); 942 } 943 } 944 } 945 946 bool riscv_cpu_debug_check_breakpoint(CPUState *cs) 947 { 948 RISCVCPU *cpu = RISCV_CPU(cs); 949 CPURISCVState *env = &cpu->env; 950 CPUBreakpoint *bp; 951 target_ulong ctrl; 952 target_ulong pc; 953 int trigger_type; 954 int i; 955 956 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) { 957 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 958 trigger_type = get_trigger_type(env, i); 959 960 if (!trigger_common_match(env, trigger_type, i)) { 961 continue; 962 } 963 964 switch (trigger_type) { 965 case TRIGGER_TYPE_AD_MATCH: 966 ctrl = env->tdata1[i]; 967 pc = env->tdata2[i]; 968 969 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) { 970 env->badaddr = pc; 971 return true; 972 } 973 break; 974 case TRIGGER_TYPE_AD_MATCH6: 975 ctrl = env->tdata1[i]; 976 pc = env->tdata2[i]; 977 978 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) { 979 env->badaddr = pc; 980 return true; 981 } 982 break; 983 default: 984 /* other trigger types are not supported or irrelevant */ 985 break; 986 } 987 } 988 } 989 990 return false; 991 } 992 993 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) 994 { 995 RISCVCPU *cpu = RISCV_CPU(cs); 996 CPURISCVState *env = &cpu->env; 997 target_ulong ctrl; 998 target_ulong addr; 999 int trigger_type; 1000 int flags; 1001 int i; 1002 1003 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1004 trigger_type = get_trigger_type(env, i); 1005 1006 if (!trigger_common_match(env, trigger_type, i)) { 1007 continue; 1008 } 1009 1010 switch (trigger_type) { 1011 case TRIGGER_TYPE_AD_MATCH: 1012 ctrl = env->tdata1[i]; 1013 addr = env->tdata2[i]; 1014 flags = 0; 1015 1016 if (ctrl & TYPE2_LOAD) { 1017 flags |= BP_MEM_READ; 1018 } 1019 if (ctrl & TYPE2_STORE) { 1020 flags |= BP_MEM_WRITE; 1021 } 1022 1023 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1024 return true; 1025 } 1026 break; 1027 case TRIGGER_TYPE_AD_MATCH6: 1028 ctrl = env->tdata1[i]; 1029 addr = env->tdata2[i]; 1030 flags = 0; 1031 1032 if (ctrl & TYPE6_LOAD) { 1033 flags |= BP_MEM_READ; 1034 } 1035 if (ctrl & TYPE6_STORE) { 1036 flags |= BP_MEM_WRITE; 1037 } 1038 1039 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1040 return true; 1041 } 1042 break; 1043 default: 1044 /* other trigger types are not supported */ 1045 break; 1046 } 1047 } 1048 1049 return false; 1050 } 1051 1052 void riscv_trigger_realize(CPURISCVState *env) 1053 { 1054 int i; 1055 1056 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1057 env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL, 1058 riscv_itrigger_timer_cb, env); 1059 } 1060 } 1061 1062 void riscv_trigger_reset_hold(CPURISCVState *env) 1063 { 1064 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0); 1065 int i; 1066 1067 /* init to type 2 triggers */ 1068 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1069 /* 1070 * type = TRIGGER_TYPE_AD_MATCH 1071 * dmode = 0 (both debug and M-mode can write tdata) 1072 * maskmax = 0 (unimplemented, always 0) 1073 * sizehi = 0 (match against any size, RV64 only) 1074 * hit = 0 (unimplemented, always 0) 1075 * select = 0 (always 0, perform match on address) 1076 * timing = 0 (always 0, trigger before instruction) 1077 * sizelo = 0 (match against any size) 1078 * action = 0 (always 0, raise a breakpoint exception) 1079 * chain = 0 (unimplemented, always 0) 1080 * match = 0 (always 0, when any compare value equals tdata2) 1081 */ 1082 env->tdata1[i] = tdata1; 1083 env->tdata2[i] = 0; 1084 env->tdata3[i] = 0; 1085 env->cpu_breakpoint[i] = NULL; 1086 env->cpu_watchpoint[i] = NULL; 1087 timer_del(env->itrigger_timer[i]); 1088 } 1089 1090 env->mcontext = 0; 1091 } 1092