1 /* 2 * QEMU RISC-V Native Debug Support 3 * 4 * Copyright (c) 2022 Wind River Systems, Inc. 5 * 6 * Author: 7 * Bin Meng <bin.meng@windriver.com> 8 * 9 * This provides the native debug support via the Trigger Module, as defined 10 * in the RISC-V Debug Specification: 11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf 12 * 13 * This program is free software; you can redistribute it and/or modify it 14 * under the terms and conditions of the GNU General Public License, 15 * version 2 or later, as published by the Free Software Foundation. 16 * 17 * This program is distributed in the hope it will be useful, but WITHOUT 18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 20 * more details. 21 * 22 * You should have received a copy of the GNU General Public License along with 23 * this program. If not, see <http://www.gnu.org/licenses/>. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 #include "trace.h" 31 #include "exec/exec-all.h" 32 #include "exec/helper-proto.h" 33 #include "exec/watchpoint.h" 34 #include "system/cpu-timers.h" 35 36 /* 37 * The following M-mode trigger CSRs are implemented: 38 * 39 * - tselect 40 * - tdata1 41 * - tdata2 42 * - tdata3 43 * - tinfo 44 * 45 * The following triggers are initialized by default: 46 * 47 * Index | Type | tdata mapping | Description 48 * ------+------+------------------------+------------ 49 * 0 | 2 | tdata1, tdata2 | Address / Data Match 50 * 1 | 2 | tdata1, tdata2 | Address / Data Match 51 */ 52 53 /* tdata availability of a trigger */ 54 typedef bool tdata_avail[TDATA_NUM]; 55 56 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = { 57 [TRIGGER_TYPE_NO_EXIST] = { false, false, false }, 58 [TRIGGER_TYPE_AD_MATCH] = { true, true, true }, 59 [TRIGGER_TYPE_INST_CNT] = { true, false, true }, 60 [TRIGGER_TYPE_INT] = { true, true, true }, 61 [TRIGGER_TYPE_EXCP] = { true, true, true }, 62 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true }, 63 [TRIGGER_TYPE_EXT_SRC] = { true, false, false }, 64 [TRIGGER_TYPE_UNAVAIL] = { true, true, true } 65 }; 66 67 /* only breakpoint size 1/2/4/8 supported */ 68 static int access_size[SIZE_NUM] = { 69 [SIZE_ANY] = 0, 70 [SIZE_1B] = 1, 71 [SIZE_2B] = 2, 72 [SIZE_4B] = 4, 73 [SIZE_6B] = -1, 74 [SIZE_8B] = 8, 75 [6 ... 15] = -1, 76 }; 77 78 static inline target_ulong extract_trigger_type(CPURISCVState *env, 79 target_ulong tdata1) 80 { 81 switch (riscv_cpu_mxl(env)) { 82 case MXL_RV32: 83 return extract32(tdata1, 28, 4); 84 case MXL_RV64: 85 case MXL_RV128: 86 return extract64(tdata1, 60, 4); 87 default: 88 g_assert_not_reached(); 89 } 90 } 91 92 static inline target_ulong get_trigger_type(CPURISCVState *env, 93 target_ulong trigger_index) 94 { 95 return extract_trigger_type(env, env->tdata1[trigger_index]); 96 } 97 98 static trigger_action_t get_trigger_action(CPURISCVState *env, 99 target_ulong trigger_index) 100 { 101 target_ulong tdata1 = env->tdata1[trigger_index]; 102 int trigger_type = get_trigger_type(env, trigger_index); 103 trigger_action_t action = DBG_ACTION_NONE; 104 105 switch (trigger_type) { 106 case TRIGGER_TYPE_AD_MATCH: 107 action = (tdata1 & TYPE2_ACTION) >> 12; 108 break; 109 case TRIGGER_TYPE_AD_MATCH6: 110 action = (tdata1 & TYPE6_ACTION) >> 12; 111 break; 112 case TRIGGER_TYPE_INST_CNT: 113 case TRIGGER_TYPE_INT: 114 case TRIGGER_TYPE_EXCP: 115 case TRIGGER_TYPE_EXT_SRC: 116 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 117 trigger_type); 118 break; 119 case TRIGGER_TYPE_NO_EXIST: 120 case TRIGGER_TYPE_UNAVAIL: 121 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 122 trigger_type); 123 break; 124 default: 125 g_assert_not_reached(); 126 } 127 128 return action; 129 } 130 131 static inline target_ulong build_tdata1(CPURISCVState *env, 132 trigger_type_t type, 133 bool dmode, target_ulong data) 134 { 135 target_ulong tdata1; 136 137 switch (riscv_cpu_mxl(env)) { 138 case MXL_RV32: 139 tdata1 = RV32_TYPE(type) | 140 (dmode ? RV32_DMODE : 0) | 141 (data & RV32_DATA_MASK); 142 break; 143 case MXL_RV64: 144 case MXL_RV128: 145 tdata1 = RV64_TYPE(type) | 146 (dmode ? RV64_DMODE : 0) | 147 (data & RV64_DATA_MASK); 148 break; 149 default: 150 g_assert_not_reached(); 151 } 152 153 return tdata1; 154 } 155 156 bool tdata_available(CPURISCVState *env, int tdata_index) 157 { 158 int trigger_type = get_trigger_type(env, env->trigger_cur); 159 160 if (unlikely(tdata_index >= TDATA_NUM)) { 161 return false; 162 } 163 164 return tdata_mapping[trigger_type][tdata_index]; 165 } 166 167 target_ulong tselect_csr_read(CPURISCVState *env) 168 { 169 return env->trigger_cur; 170 } 171 172 void tselect_csr_write(CPURISCVState *env, target_ulong val) 173 { 174 if (val < RV_MAX_TRIGGERS) { 175 env->trigger_cur = val; 176 } 177 } 178 179 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val, 180 trigger_type_t t) 181 { 182 uint32_t type, dmode; 183 target_ulong tdata1; 184 185 switch (riscv_cpu_mxl(env)) { 186 case MXL_RV32: 187 type = extract32(val, 28, 4); 188 dmode = extract32(val, 27, 1); 189 tdata1 = RV32_TYPE(t); 190 break; 191 case MXL_RV64: 192 case MXL_RV128: 193 type = extract64(val, 60, 4); 194 dmode = extract64(val, 59, 1); 195 tdata1 = RV64_TYPE(t); 196 break; 197 default: 198 g_assert_not_reached(); 199 } 200 201 if (type != t) { 202 qemu_log_mask(LOG_GUEST_ERROR, 203 "ignoring type write to tdata1 register\n"); 204 } 205 206 if (dmode != 0) { 207 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n"); 208 } 209 210 return tdata1; 211 } 212 213 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask, 214 const char *msg) 215 { 216 if (val & mask) { 217 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg); 218 } 219 } 220 221 static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3) 222 { 223 target_ulong mhvalue, mhselect; 224 target_ulong mhselect_new; 225 target_ulong textra; 226 const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 }; 227 228 switch (riscv_cpu_mxl(env)) { 229 case MXL_RV32: 230 mhvalue = get_field(tdata3, TEXTRA32_MHVALUE); 231 mhselect = get_field(tdata3, TEXTRA32_MHSELECT); 232 /* Validate unimplemented (always zero) bits */ 233 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK, 234 "sbytemask"); 235 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE, 236 "svalue"); 237 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT, 238 "sselect"); 239 break; 240 case MXL_RV64: 241 case MXL_RV128: 242 mhvalue = get_field(tdata3, TEXTRA64_MHVALUE); 243 mhselect = get_field(tdata3, TEXTRA64_MHSELECT); 244 /* Validate unimplemented (always zero) bits */ 245 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK, 246 "sbytemask"); 247 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE, 248 "svalue"); 249 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT, 250 "sselect"); 251 break; 252 default: 253 g_assert_not_reached(); 254 } 255 256 /* Validate mhselect. */ 257 mhselect_new = mhselect_no_rvh[mhselect]; 258 if (mhselect != mhselect_new) { 259 qemu_log_mask(LOG_UNIMP, "mhselect only supports 0 or 4 for now\n"); 260 } 261 262 /* Write legal values into textra */ 263 textra = 0; 264 switch (riscv_cpu_mxl(env)) { 265 case MXL_RV32: 266 textra = set_field(textra, TEXTRA32_MHVALUE, mhvalue); 267 textra = set_field(textra, TEXTRA32_MHSELECT, mhselect_new); 268 break; 269 case MXL_RV64: 270 case MXL_RV128: 271 textra = set_field(textra, TEXTRA64_MHVALUE, mhvalue); 272 textra = set_field(textra, TEXTRA64_MHSELECT, mhselect_new); 273 break; 274 default: 275 g_assert_not_reached(); 276 } 277 278 return textra; 279 } 280 281 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index) 282 { 283 trigger_action_t action = get_trigger_action(env, trigger_index); 284 285 switch (action) { 286 case DBG_ACTION_NONE: 287 break; 288 case DBG_ACTION_BP: 289 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0); 290 break; 291 case DBG_ACTION_DBG_MODE: 292 case DBG_ACTION_TRACE0: 293 case DBG_ACTION_TRACE1: 294 case DBG_ACTION_TRACE2: 295 case DBG_ACTION_TRACE3: 296 case DBG_ACTION_EXT_DBG0: 297 case DBG_ACTION_EXT_DBG1: 298 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action); 299 break; 300 default: 301 g_assert_not_reached(); 302 } 303 } 304 305 /* 306 * Check the privilege level of specific trigger matches CPU's current privilege 307 * level. 308 */ 309 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type, 310 int trigger_index) 311 { 312 target_ulong ctrl = env->tdata1[trigger_index]; 313 314 switch (type) { 315 case TRIGGER_TYPE_AD_MATCH: 316 /* type 2 trigger cannot be fired in VU/VS mode */ 317 if (env->virt_enabled) { 318 return false; 319 } 320 /* check U/S/M bit against current privilege level */ 321 if ((ctrl >> 3) & BIT(env->priv)) { 322 return true; 323 } 324 break; 325 case TRIGGER_TYPE_AD_MATCH6: 326 if (env->virt_enabled) { 327 /* check VU/VS bit against current privilege level */ 328 if ((ctrl >> 23) & BIT(env->priv)) { 329 return true; 330 } 331 } else { 332 /* check U/S/M bit against current privilege level */ 333 if ((ctrl >> 3) & BIT(env->priv)) { 334 return true; 335 } 336 } 337 break; 338 case TRIGGER_TYPE_INST_CNT: 339 if (env->virt_enabled) { 340 /* check VU/VS bit against current privilege level */ 341 if ((ctrl >> 25) & BIT(env->priv)) { 342 return true; 343 } 344 } else { 345 /* check U/S/M bit against current privilege level */ 346 if ((ctrl >> 6) & BIT(env->priv)) { 347 return true; 348 } 349 } 350 break; 351 case TRIGGER_TYPE_INT: 352 case TRIGGER_TYPE_EXCP: 353 case TRIGGER_TYPE_EXT_SRC: 354 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", type); 355 break; 356 case TRIGGER_TYPE_NO_EXIST: 357 case TRIGGER_TYPE_UNAVAIL: 358 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exist\n", 359 type); 360 break; 361 default: 362 g_assert_not_reached(); 363 } 364 365 return false; 366 } 367 368 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type, 369 int trigger_index) 370 { 371 target_ulong textra = env->tdata3[trigger_index]; 372 target_ulong mhvalue, mhselect; 373 374 if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) { 375 /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */ 376 return true; 377 } 378 379 switch (riscv_cpu_mxl(env)) { 380 case MXL_RV32: 381 mhvalue = get_field(textra, TEXTRA32_MHVALUE); 382 mhselect = get_field(textra, TEXTRA32_MHSELECT); 383 break; 384 case MXL_RV64: 385 case MXL_RV128: 386 mhvalue = get_field(textra, TEXTRA64_MHVALUE); 387 mhselect = get_field(textra, TEXTRA64_MHSELECT); 388 break; 389 default: 390 g_assert_not_reached(); 391 } 392 393 /* Check mhvalue and mhselect. */ 394 switch (mhselect) { 395 case MHSELECT_IGNORE: 396 break; 397 case MHSELECT_MCONTEXT: 398 /* Match if the low bits of mcontext/hcontext equal mhvalue. */ 399 if (mhvalue != env->mcontext) { 400 return false; 401 } 402 break; 403 default: 404 break; 405 } 406 407 return true; 408 } 409 410 /* Common matching conditions for all types of the triggers. */ 411 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type, 412 int trigger_index) 413 { 414 return trigger_priv_match(env, type, trigger_index) && 415 trigger_textra_match(env, type, trigger_index); 416 } 417 418 /* type 2 trigger */ 419 420 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl) 421 { 422 uint32_t sizelo, sizehi = 0; 423 424 if (riscv_cpu_mxl(env) == MXL_RV64) { 425 sizehi = extract32(ctrl, 21, 2); 426 } 427 sizelo = extract32(ctrl, 16, 2); 428 return (sizehi << 2) | sizelo; 429 } 430 431 static inline bool type2_breakpoint_enabled(target_ulong ctrl) 432 { 433 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M)); 434 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 435 436 return mode && rwx; 437 } 438 439 static target_ulong type2_mcontrol_validate(CPURISCVState *env, 440 target_ulong ctrl) 441 { 442 target_ulong val; 443 uint32_t size; 444 445 /* validate the generic part first */ 446 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH); 447 448 /* validate unimplemented (always zero) bits */ 449 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match"); 450 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain"); 451 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action"); 452 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing"); 453 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select"); 454 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit"); 455 456 /* validate size encoding */ 457 size = type2_breakpoint_size(env, ctrl); 458 if (access_size[size] == -1) { 459 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 460 "SIZE_ANY\n", size); 461 } else { 462 val |= (ctrl & TYPE2_SIZELO); 463 if (riscv_cpu_mxl(env) == MXL_RV64) { 464 val |= (ctrl & TYPE2_SIZEHI); 465 } 466 } 467 468 /* keep the mode and attribute bits */ 469 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M | 470 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 471 472 return val; 473 } 474 475 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index) 476 { 477 target_ulong ctrl = env->tdata1[index]; 478 target_ulong addr = env->tdata2[index]; 479 bool enabled = type2_breakpoint_enabled(ctrl); 480 CPUState *cs = env_cpu(env); 481 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 482 uint32_t size, def_size; 483 484 if (!enabled) { 485 return; 486 } 487 488 if (ctrl & TYPE2_EXEC) { 489 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 490 } 491 492 if (ctrl & TYPE2_LOAD) { 493 flags |= BP_MEM_READ; 494 } 495 if (ctrl & TYPE2_STORE) { 496 flags |= BP_MEM_WRITE; 497 } 498 499 if (flags & BP_MEM_ACCESS) { 500 size = type2_breakpoint_size(env, ctrl); 501 if (size != 0) { 502 cpu_watchpoint_insert(cs, addr, size, flags, 503 &env->cpu_watchpoint[index]); 504 } else { 505 def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4; 506 507 cpu_watchpoint_insert(cs, addr, def_size, flags, 508 &env->cpu_watchpoint[index]); 509 } 510 } 511 } 512 513 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index) 514 { 515 CPUState *cs = env_cpu(env); 516 517 if (env->cpu_breakpoint[index]) { 518 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]); 519 env->cpu_breakpoint[index] = NULL; 520 } 521 522 if (env->cpu_watchpoint[index]) { 523 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]); 524 env->cpu_watchpoint[index] = NULL; 525 } 526 } 527 528 static void type2_reg_write(CPURISCVState *env, target_ulong index, 529 int tdata_index, target_ulong val) 530 { 531 target_ulong new_val; 532 533 switch (tdata_index) { 534 case TDATA1: 535 new_val = type2_mcontrol_validate(env, val); 536 if (new_val != env->tdata1[index]) { 537 env->tdata1[index] = new_val; 538 type2_breakpoint_remove(env, index); 539 type2_breakpoint_insert(env, index); 540 } 541 break; 542 case TDATA2: 543 if (val != env->tdata2[index]) { 544 env->tdata2[index] = val; 545 type2_breakpoint_remove(env, index); 546 type2_breakpoint_insert(env, index); 547 } 548 break; 549 case TDATA3: 550 env->tdata3[index] = textra_validate(env, val); 551 break; 552 default: 553 g_assert_not_reached(); 554 } 555 556 return; 557 } 558 559 /* type 6 trigger */ 560 561 static inline bool type6_breakpoint_enabled(target_ulong ctrl) 562 { 563 bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M)); 564 bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 565 566 return mode && rwx; 567 } 568 569 static target_ulong type6_mcontrol6_validate(CPURISCVState *env, 570 target_ulong ctrl) 571 { 572 target_ulong val; 573 uint32_t size; 574 575 /* validate the generic part first */ 576 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6); 577 578 /* validate unimplemented (always zero) bits */ 579 warn_always_zero_bit(ctrl, TYPE6_MATCH, "match"); 580 warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain"); 581 warn_always_zero_bit(ctrl, TYPE6_ACTION, "action"); 582 warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing"); 583 warn_always_zero_bit(ctrl, TYPE6_SELECT, "select"); 584 warn_always_zero_bit(ctrl, TYPE6_HIT, "hit"); 585 586 /* validate size encoding */ 587 size = extract32(ctrl, 16, 4); 588 if (access_size[size] == -1) { 589 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 590 "SIZE_ANY\n", size); 591 } else { 592 val |= (ctrl & TYPE6_SIZE); 593 } 594 595 /* keep the mode and attribute bits */ 596 val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M | 597 TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 598 599 return val; 600 } 601 602 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index) 603 { 604 target_ulong ctrl = env->tdata1[index]; 605 target_ulong addr = env->tdata2[index]; 606 bool enabled = type6_breakpoint_enabled(ctrl); 607 CPUState *cs = env_cpu(env); 608 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 609 uint32_t size; 610 611 if (!enabled) { 612 return; 613 } 614 615 if (ctrl & TYPE6_EXEC) { 616 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 617 } 618 619 if (ctrl & TYPE6_LOAD) { 620 flags |= BP_MEM_READ; 621 } 622 623 if (ctrl & TYPE6_STORE) { 624 flags |= BP_MEM_WRITE; 625 } 626 627 if (flags & BP_MEM_ACCESS) { 628 size = extract32(ctrl, 16, 4); 629 if (size != 0) { 630 cpu_watchpoint_insert(cs, addr, size, flags, 631 &env->cpu_watchpoint[index]); 632 } else { 633 cpu_watchpoint_insert(cs, addr, 8, flags, 634 &env->cpu_watchpoint[index]); 635 } 636 } 637 } 638 639 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index) 640 { 641 type2_breakpoint_remove(env, index); 642 } 643 644 static void type6_reg_write(CPURISCVState *env, target_ulong index, 645 int tdata_index, target_ulong val) 646 { 647 target_ulong new_val; 648 649 switch (tdata_index) { 650 case TDATA1: 651 new_val = type6_mcontrol6_validate(env, val); 652 if (new_val != env->tdata1[index]) { 653 env->tdata1[index] = new_val; 654 type6_breakpoint_remove(env, index); 655 type6_breakpoint_insert(env, index); 656 } 657 break; 658 case TDATA2: 659 if (val != env->tdata2[index]) { 660 env->tdata2[index] = val; 661 type6_breakpoint_remove(env, index); 662 type6_breakpoint_insert(env, index); 663 } 664 break; 665 case TDATA3: 666 env->tdata3[index] = textra_validate(env, val); 667 break; 668 default: 669 g_assert_not_reached(); 670 } 671 672 return; 673 } 674 675 /* icount trigger type */ 676 static inline int 677 itrigger_get_count(CPURISCVState *env, int index) 678 { 679 return get_field(env->tdata1[index], ITRIGGER_COUNT); 680 } 681 682 static inline void 683 itrigger_set_count(CPURISCVState *env, int index, int value) 684 { 685 env->tdata1[index] = set_field(env->tdata1[index], 686 ITRIGGER_COUNT, value); 687 } 688 689 static bool check_itrigger_priv(CPURISCVState *env, int index) 690 { 691 target_ulong tdata1 = env->tdata1[index]; 692 if (env->virt_enabled) { 693 /* check VU/VS bit against current privilege level */ 694 return (get_field(tdata1, ITRIGGER_VS) == env->priv) || 695 (get_field(tdata1, ITRIGGER_VU) == env->priv); 696 } else { 697 /* check U/S/M bit against current privilege level */ 698 return (get_field(tdata1, ITRIGGER_M) == env->priv) || 699 (get_field(tdata1, ITRIGGER_S) == env->priv) || 700 (get_field(tdata1, ITRIGGER_U) == env->priv); 701 } 702 } 703 704 bool riscv_itrigger_enabled(CPURISCVState *env) 705 { 706 int count; 707 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 708 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 709 continue; 710 } 711 if (check_itrigger_priv(env, i)) { 712 continue; 713 } 714 count = itrigger_get_count(env, i); 715 if (!count) { 716 continue; 717 } 718 return true; 719 } 720 721 return false; 722 } 723 724 void helper_itrigger_match(CPURISCVState *env) 725 { 726 int count; 727 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 728 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 729 continue; 730 } 731 if (!trigger_common_match(env, TRIGGER_TYPE_INST_CNT, i)) { 732 continue; 733 } 734 count = itrigger_get_count(env, i); 735 if (!count) { 736 continue; 737 } 738 itrigger_set_count(env, i, count--); 739 if (!count) { 740 env->itrigger_enabled = riscv_itrigger_enabled(env); 741 do_trigger_action(env, i); 742 } 743 } 744 } 745 746 static void riscv_itrigger_update_count(CPURISCVState *env) 747 { 748 int count, executed; 749 /* 750 * Record last icount, so that we can evaluate the executed instructions 751 * since last privilege mode change or timer expire. 752 */ 753 int64_t last_icount = env->last_icount, current_icount; 754 current_icount = env->last_icount = icount_get_raw(); 755 756 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 757 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 758 continue; 759 } 760 count = itrigger_get_count(env, i); 761 if (!count) { 762 continue; 763 } 764 /* 765 * Only when privilege is changed or itrigger timer expires, 766 * the count field in itrigger tdata1 register is updated. 767 * And the count field in itrigger only contains remaining value. 768 */ 769 if (check_itrigger_priv(env, i)) { 770 /* 771 * If itrigger enabled in this privilege mode, the number of 772 * executed instructions since last privilege change 773 * should be reduced from current itrigger count. 774 */ 775 executed = current_icount - last_icount; 776 itrigger_set_count(env, i, count - executed); 777 if (count == executed) { 778 do_trigger_action(env, i); 779 } 780 } else { 781 /* 782 * If itrigger is not enabled in this privilege mode, 783 * the number of executed instructions will be discard and 784 * the count field in itrigger will not change. 785 */ 786 timer_mod(env->itrigger_timer[i], 787 current_icount + count); 788 } 789 } 790 } 791 792 static void riscv_itrigger_timer_cb(void *opaque) 793 { 794 riscv_itrigger_update_count((CPURISCVState *)opaque); 795 } 796 797 void riscv_itrigger_update_priv(CPURISCVState *env) 798 { 799 riscv_itrigger_update_count(env); 800 } 801 802 static target_ulong itrigger_validate(CPURISCVState *env, 803 target_ulong ctrl) 804 { 805 target_ulong val; 806 807 /* validate the generic part first */ 808 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT); 809 810 /* validate unimplemented (always zero) bits */ 811 warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action"); 812 warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit"); 813 warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending"); 814 815 /* keep the mode and attribute bits */ 816 val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S | 817 ITRIGGER_M | ITRIGGER_COUNT); 818 819 return val; 820 } 821 822 static void itrigger_reg_write(CPURISCVState *env, target_ulong index, 823 int tdata_index, target_ulong val) 824 { 825 target_ulong new_val; 826 827 switch (tdata_index) { 828 case TDATA1: 829 /* set timer for icount */ 830 new_val = itrigger_validate(env, val); 831 if (new_val != env->tdata1[index]) { 832 env->tdata1[index] = new_val; 833 if (icount_enabled()) { 834 env->last_icount = icount_get_raw(); 835 /* set the count to timer */ 836 timer_mod(env->itrigger_timer[index], 837 env->last_icount + itrigger_get_count(env, index)); 838 } else { 839 env->itrigger_enabled = riscv_itrigger_enabled(env); 840 } 841 } 842 break; 843 case TDATA2: 844 qemu_log_mask(LOG_UNIMP, 845 "tdata2 is not supported for icount trigger\n"); 846 break; 847 case TDATA3: 848 env->tdata3[index] = textra_validate(env, val); 849 break; 850 default: 851 g_assert_not_reached(); 852 } 853 854 return; 855 } 856 857 static int itrigger_get_adjust_count(CPURISCVState *env) 858 { 859 int count = itrigger_get_count(env, env->trigger_cur), executed; 860 if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) { 861 executed = icount_get_raw() - env->last_icount; 862 count += executed; 863 } 864 return count; 865 } 866 867 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index) 868 { 869 int trigger_type; 870 switch (tdata_index) { 871 case TDATA1: 872 trigger_type = extract_trigger_type(env, 873 env->tdata1[env->trigger_cur]); 874 if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) { 875 return deposit64(env->tdata1[env->trigger_cur], 10, 14, 876 itrigger_get_adjust_count(env)); 877 } 878 return env->tdata1[env->trigger_cur]; 879 case TDATA2: 880 return env->tdata2[env->trigger_cur]; 881 case TDATA3: 882 return env->tdata3[env->trigger_cur]; 883 default: 884 g_assert_not_reached(); 885 } 886 } 887 888 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val) 889 { 890 int trigger_type; 891 892 if (tdata_index == TDATA1) { 893 trigger_type = extract_trigger_type(env, val); 894 } else { 895 trigger_type = get_trigger_type(env, env->trigger_cur); 896 } 897 898 switch (trigger_type) { 899 case TRIGGER_TYPE_AD_MATCH: 900 type2_reg_write(env, env->trigger_cur, tdata_index, val); 901 break; 902 case TRIGGER_TYPE_AD_MATCH6: 903 type6_reg_write(env, env->trigger_cur, tdata_index, val); 904 break; 905 case TRIGGER_TYPE_INST_CNT: 906 itrigger_reg_write(env, env->trigger_cur, tdata_index, val); 907 break; 908 case TRIGGER_TYPE_INT: 909 case TRIGGER_TYPE_EXCP: 910 case TRIGGER_TYPE_EXT_SRC: 911 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 912 trigger_type); 913 break; 914 case TRIGGER_TYPE_NO_EXIST: 915 case TRIGGER_TYPE_UNAVAIL: 916 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 917 trigger_type); 918 break; 919 default: 920 g_assert_not_reached(); 921 } 922 } 923 924 target_ulong tinfo_csr_read(CPURISCVState *env) 925 { 926 /* assume all triggers support the same types of triggers */ 927 return BIT(TRIGGER_TYPE_AD_MATCH) | 928 BIT(TRIGGER_TYPE_AD_MATCH6); 929 } 930 931 void riscv_cpu_debug_excp_handler(CPUState *cs) 932 { 933 RISCVCPU *cpu = RISCV_CPU(cs); 934 CPURISCVState *env = &cpu->env; 935 936 if (cs->watchpoint_hit) { 937 if (cs->watchpoint_hit->flags & BP_CPU) { 938 do_trigger_action(env, DBG_ACTION_BP); 939 } 940 } else { 941 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) { 942 do_trigger_action(env, DBG_ACTION_BP); 943 } 944 } 945 } 946 947 bool riscv_cpu_debug_check_breakpoint(CPUState *cs) 948 { 949 RISCVCPU *cpu = RISCV_CPU(cs); 950 CPURISCVState *env = &cpu->env; 951 CPUBreakpoint *bp; 952 target_ulong ctrl; 953 target_ulong pc; 954 int trigger_type; 955 int i; 956 957 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) { 958 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 959 trigger_type = get_trigger_type(env, i); 960 961 if (!trigger_common_match(env, trigger_type, i)) { 962 continue; 963 } 964 965 switch (trigger_type) { 966 case TRIGGER_TYPE_AD_MATCH: 967 ctrl = env->tdata1[i]; 968 pc = env->tdata2[i]; 969 970 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) { 971 env->badaddr = pc; 972 return true; 973 } 974 break; 975 case TRIGGER_TYPE_AD_MATCH6: 976 ctrl = env->tdata1[i]; 977 pc = env->tdata2[i]; 978 979 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) { 980 env->badaddr = pc; 981 return true; 982 } 983 break; 984 default: 985 /* other trigger types are not supported or irrelevant */ 986 break; 987 } 988 } 989 } 990 991 return false; 992 } 993 994 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) 995 { 996 RISCVCPU *cpu = RISCV_CPU(cs); 997 CPURISCVState *env = &cpu->env; 998 target_ulong ctrl; 999 target_ulong addr; 1000 int trigger_type; 1001 int flags; 1002 int i; 1003 1004 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1005 trigger_type = get_trigger_type(env, i); 1006 1007 if (!trigger_common_match(env, trigger_type, i)) { 1008 continue; 1009 } 1010 1011 switch (trigger_type) { 1012 case TRIGGER_TYPE_AD_MATCH: 1013 ctrl = env->tdata1[i]; 1014 addr = env->tdata2[i]; 1015 flags = 0; 1016 1017 if (ctrl & TYPE2_LOAD) { 1018 flags |= BP_MEM_READ; 1019 } 1020 if (ctrl & TYPE2_STORE) { 1021 flags |= BP_MEM_WRITE; 1022 } 1023 1024 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1025 return true; 1026 } 1027 break; 1028 case TRIGGER_TYPE_AD_MATCH6: 1029 ctrl = env->tdata1[i]; 1030 addr = env->tdata2[i]; 1031 flags = 0; 1032 1033 if (ctrl & TYPE6_LOAD) { 1034 flags |= BP_MEM_READ; 1035 } 1036 if (ctrl & TYPE6_STORE) { 1037 flags |= BP_MEM_WRITE; 1038 } 1039 1040 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1041 return true; 1042 } 1043 break; 1044 default: 1045 /* other trigger types are not supported */ 1046 break; 1047 } 1048 } 1049 1050 return false; 1051 } 1052 1053 void riscv_trigger_realize(CPURISCVState *env) 1054 { 1055 int i; 1056 1057 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1058 env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL, 1059 riscv_itrigger_timer_cb, env); 1060 } 1061 } 1062 1063 void riscv_trigger_reset_hold(CPURISCVState *env) 1064 { 1065 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0); 1066 int i; 1067 1068 /* init to type 2 triggers */ 1069 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1070 /* 1071 * type = TRIGGER_TYPE_AD_MATCH 1072 * dmode = 0 (both debug and M-mode can write tdata) 1073 * maskmax = 0 (unimplemented, always 0) 1074 * sizehi = 0 (match against any size, RV64 only) 1075 * hit = 0 (unimplemented, always 0) 1076 * select = 0 (always 0, perform match on address) 1077 * timing = 0 (always 0, trigger before instruction) 1078 * sizelo = 0 (match against any size) 1079 * action = 0 (always 0, raise a breakpoint exception) 1080 * chain = 0 (unimplemented, always 0) 1081 * match = 0 (always 0, when any compare value equals tdata2) 1082 */ 1083 env->tdata1[i] = tdata1; 1084 env->tdata2[i] = 0; 1085 env->tdata3[i] = 0; 1086 env->cpu_breakpoint[i] = NULL; 1087 env->cpu_watchpoint[i] = NULL; 1088 timer_del(env->itrigger_timer[i]); 1089 } 1090 1091 env->mcontext = 0; 1092 } 1093