1 /* 2 * QEMU RISC-V Native Debug Support 3 * 4 * Copyright (c) 2022 Wind River Systems, Inc. 5 * 6 * Author: 7 * Bin Meng <bin.meng@windriver.com> 8 * 9 * This provides the native debug support via the Trigger Module, as defined 10 * in the RISC-V Debug Specification: 11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf 12 * 13 * This program is free software; you can redistribute it and/or modify it 14 * under the terms and conditions of the GNU General Public License, 15 * version 2 or later, as published by the Free Software Foundation. 16 * 17 * This program is distributed in the hope it will be useful, but WITHOUT 18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 20 * more details. 21 * 22 * You should have received a copy of the GNU General Public License along with 23 * this program. If not, see <http://www.gnu.org/licenses/>. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 #include "trace.h" 31 #include "exec/helper-proto.h" 32 #include "exec/watchpoint.h" 33 #include "system/cpu-timers.h" 34 #include "exec/icount.h" 35 36 /* 37 * The following M-mode trigger CSRs are implemented: 38 * 39 * - tselect 40 * - tdata1 41 * - tdata2 42 * - tdata3 43 * - tinfo 44 * 45 * The following triggers are initialized by default: 46 * 47 * Index | Type | tdata mapping | Description 48 * ------+------+------------------------+------------ 49 * 0 | 2 | tdata1, tdata2 | Address / Data Match 50 * 1 | 2 | tdata1, tdata2 | Address / Data Match 51 */ 52 53 /* tdata availability of a trigger */ 54 typedef bool tdata_avail[TDATA_NUM]; 55 56 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = { 57 [TRIGGER_TYPE_NO_EXIST] = { false, false, false }, 58 [TRIGGER_TYPE_AD_MATCH] = { true, true, true }, 59 [TRIGGER_TYPE_INST_CNT] = { true, false, true }, 60 [TRIGGER_TYPE_INT] = { true, true, true }, 61 [TRIGGER_TYPE_EXCP] = { true, true, true }, 62 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true }, 63 [TRIGGER_TYPE_EXT_SRC] = { true, false, false }, 64 [TRIGGER_TYPE_UNAVAIL] = { true, true, true } 65 }; 66 67 /* only breakpoint size 1/2/4/8 supported */ 68 static int access_size[SIZE_NUM] = { 69 [SIZE_ANY] = 0, 70 [SIZE_1B] = 1, 71 [SIZE_2B] = 2, 72 [SIZE_4B] = 4, 73 [SIZE_6B] = -1, 74 [SIZE_8B] = 8, 75 [6 ... 15] = -1, 76 }; 77 78 static inline target_ulong extract_trigger_type(CPURISCVState *env, 79 target_ulong tdata1) 80 { 81 switch (riscv_cpu_mxl(env)) { 82 case MXL_RV32: 83 return extract32(tdata1, 28, 4); 84 case MXL_RV64: 85 case MXL_RV128: 86 return extract64(tdata1, 60, 4); 87 default: 88 g_assert_not_reached(); 89 } 90 } 91 92 static inline target_ulong get_trigger_type(CPURISCVState *env, 93 target_ulong trigger_index) 94 { 95 return extract_trigger_type(env, env->tdata1[trigger_index]); 96 } 97 98 static trigger_action_t get_trigger_action(CPURISCVState *env, 99 target_ulong trigger_index) 100 { 101 target_ulong tdata1 = env->tdata1[trigger_index]; 102 int trigger_type = get_trigger_type(env, trigger_index); 103 trigger_action_t action = DBG_ACTION_NONE; 104 105 switch (trigger_type) { 106 case TRIGGER_TYPE_AD_MATCH: 107 action = (tdata1 & TYPE2_ACTION) >> 12; 108 break; 109 case TRIGGER_TYPE_AD_MATCH6: 110 action = (tdata1 & TYPE6_ACTION) >> 12; 111 break; 112 case TRIGGER_TYPE_INST_CNT: 113 case TRIGGER_TYPE_INT: 114 case TRIGGER_TYPE_EXCP: 115 case TRIGGER_TYPE_EXT_SRC: 116 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 117 trigger_type); 118 break; 119 case TRIGGER_TYPE_NO_EXIST: 120 case TRIGGER_TYPE_UNAVAIL: 121 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 122 trigger_type); 123 break; 124 default: 125 g_assert_not_reached(); 126 } 127 128 return action; 129 } 130 131 static inline target_ulong build_tdata1(CPURISCVState *env, 132 trigger_type_t type, 133 bool dmode, target_ulong data) 134 { 135 target_ulong tdata1; 136 137 switch (riscv_cpu_mxl(env)) { 138 case MXL_RV32: 139 tdata1 = RV32_TYPE(type) | 140 (dmode ? RV32_DMODE : 0) | 141 (data & RV32_DATA_MASK); 142 break; 143 case MXL_RV64: 144 case MXL_RV128: 145 tdata1 = RV64_TYPE(type) | 146 (dmode ? RV64_DMODE : 0) | 147 (data & RV64_DATA_MASK); 148 break; 149 default: 150 g_assert_not_reached(); 151 } 152 153 return tdata1; 154 } 155 156 bool tdata_available(CPURISCVState *env, int tdata_index) 157 { 158 int trigger_type = get_trigger_type(env, env->trigger_cur); 159 160 if (unlikely(tdata_index >= TDATA_NUM)) { 161 return false; 162 } 163 164 return tdata_mapping[trigger_type][tdata_index]; 165 } 166 167 target_ulong tselect_csr_read(CPURISCVState *env) 168 { 169 return env->trigger_cur; 170 } 171 172 void tselect_csr_write(CPURISCVState *env, target_ulong val) 173 { 174 if (val < RV_MAX_TRIGGERS) { 175 env->trigger_cur = val; 176 } 177 } 178 179 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val, 180 trigger_type_t t) 181 { 182 uint32_t type, dmode; 183 target_ulong tdata1; 184 185 switch (riscv_cpu_mxl(env)) { 186 case MXL_RV32: 187 type = extract32(val, 28, 4); 188 dmode = extract32(val, 27, 1); 189 tdata1 = RV32_TYPE(t); 190 break; 191 case MXL_RV64: 192 case MXL_RV128: 193 type = extract64(val, 60, 4); 194 dmode = extract64(val, 59, 1); 195 tdata1 = RV64_TYPE(t); 196 break; 197 default: 198 g_assert_not_reached(); 199 } 200 201 if (type != t) { 202 qemu_log_mask(LOG_GUEST_ERROR, 203 "ignoring type write to tdata1 register\n"); 204 } 205 206 if (dmode != 0) { 207 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n"); 208 } 209 210 return tdata1; 211 } 212 213 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask, 214 const char *msg) 215 { 216 if (val & mask) { 217 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg); 218 } 219 } 220 221 static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3) 222 { 223 target_ulong mhvalue, mhselect; 224 target_ulong mhselect_new; 225 target_ulong textra; 226 const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 }; 227 228 switch (riscv_cpu_mxl(env)) { 229 case MXL_RV32: 230 mhvalue = get_field(tdata3, TEXTRA32_MHVALUE); 231 mhselect = get_field(tdata3, TEXTRA32_MHSELECT); 232 /* Validate unimplemented (always zero) bits */ 233 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK, 234 "sbytemask"); 235 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE, 236 "svalue"); 237 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT, 238 "sselect"); 239 break; 240 case MXL_RV64: 241 case MXL_RV128: 242 mhvalue = get_field(tdata3, TEXTRA64_MHVALUE); 243 mhselect = get_field(tdata3, TEXTRA64_MHSELECT); 244 /* Validate unimplemented (always zero) bits */ 245 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK, 246 "sbytemask"); 247 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE, 248 "svalue"); 249 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT, 250 "sselect"); 251 break; 252 default: 253 g_assert_not_reached(); 254 } 255 256 /* Validate mhselect. */ 257 mhselect_new = mhselect_no_rvh[mhselect]; 258 if (mhselect != mhselect_new) { 259 qemu_log_mask(LOG_UNIMP, "mhselect only supports 0 or 4 for now\n"); 260 } 261 262 /* Write legal values into textra */ 263 textra = 0; 264 switch (riscv_cpu_mxl(env)) { 265 case MXL_RV32: 266 textra = set_field(textra, TEXTRA32_MHVALUE, mhvalue); 267 textra = set_field(textra, TEXTRA32_MHSELECT, mhselect_new); 268 break; 269 case MXL_RV64: 270 case MXL_RV128: 271 textra = set_field(textra, TEXTRA64_MHVALUE, mhvalue); 272 textra = set_field(textra, TEXTRA64_MHSELECT, mhselect_new); 273 break; 274 default: 275 g_assert_not_reached(); 276 } 277 278 return textra; 279 } 280 281 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index) 282 { 283 trigger_action_t action = get_trigger_action(env, trigger_index); 284 285 switch (action) { 286 case DBG_ACTION_NONE: 287 break; 288 case DBG_ACTION_BP: 289 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0); 290 break; 291 case DBG_ACTION_DBG_MODE: 292 case DBG_ACTION_TRACE0: 293 case DBG_ACTION_TRACE1: 294 case DBG_ACTION_TRACE2: 295 case DBG_ACTION_TRACE3: 296 case DBG_ACTION_EXT_DBG0: 297 case DBG_ACTION_EXT_DBG1: 298 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action); 299 break; 300 default: 301 g_assert_not_reached(); 302 } 303 } 304 305 /* 306 * Check the privilege level of specific trigger matches CPU's current privilege 307 * level. 308 */ 309 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type, 310 int trigger_index) 311 { 312 target_ulong ctrl = env->tdata1[trigger_index]; 313 314 switch (type) { 315 case TRIGGER_TYPE_AD_MATCH: 316 /* type 2 trigger cannot be fired in VU/VS mode */ 317 if (env->virt_enabled) { 318 return false; 319 } 320 /* check U/S/M bit against current privilege level */ 321 if ((ctrl >> 3) & BIT(env->priv)) { 322 return true; 323 } 324 break; 325 case TRIGGER_TYPE_AD_MATCH6: 326 if (env->virt_enabled) { 327 /* check VU/VS bit against current privilege level */ 328 if ((ctrl >> 23) & BIT(env->priv)) { 329 return true; 330 } 331 } else { 332 /* check U/S/M bit against current privilege level */ 333 if ((ctrl >> 3) & BIT(env->priv)) { 334 return true; 335 } 336 } 337 break; 338 case TRIGGER_TYPE_INST_CNT: 339 if (env->virt_enabled) { 340 /* check VU/VS bit against current privilege level */ 341 if ((ctrl >> 25) & BIT(env->priv)) { 342 return true; 343 } 344 } else { 345 /* check U/S/M bit against current privilege level */ 346 if ((ctrl >> 6) & BIT(env->priv)) { 347 return true; 348 } 349 } 350 break; 351 case TRIGGER_TYPE_INT: 352 case TRIGGER_TYPE_EXCP: 353 case TRIGGER_TYPE_EXT_SRC: 354 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", type); 355 break; 356 case TRIGGER_TYPE_NO_EXIST: 357 case TRIGGER_TYPE_UNAVAIL: 358 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exist\n", 359 type); 360 break; 361 default: 362 g_assert_not_reached(); 363 } 364 365 return false; 366 } 367 368 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type, 369 int trigger_index) 370 { 371 target_ulong textra = env->tdata3[trigger_index]; 372 target_ulong mhvalue, mhselect; 373 374 if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) { 375 /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */ 376 return true; 377 } 378 379 switch (riscv_cpu_mxl(env)) { 380 case MXL_RV32: 381 mhvalue = get_field(textra, TEXTRA32_MHVALUE); 382 mhselect = get_field(textra, TEXTRA32_MHSELECT); 383 break; 384 case MXL_RV64: 385 case MXL_RV128: 386 mhvalue = get_field(textra, TEXTRA64_MHVALUE); 387 mhselect = get_field(textra, TEXTRA64_MHSELECT); 388 break; 389 default: 390 g_assert_not_reached(); 391 } 392 393 /* Check mhvalue and mhselect. */ 394 switch (mhselect) { 395 case MHSELECT_IGNORE: 396 break; 397 case MHSELECT_MCONTEXT: 398 /* Match if the low bits of mcontext/hcontext equal mhvalue. */ 399 if (mhvalue != env->mcontext) { 400 return false; 401 } 402 break; 403 default: 404 break; 405 } 406 407 return true; 408 } 409 410 /* Common matching conditions for all types of the triggers. */ 411 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type, 412 int trigger_index) 413 { 414 return trigger_priv_match(env, type, trigger_index) && 415 trigger_textra_match(env, type, trigger_index); 416 } 417 418 /* type 2 trigger */ 419 420 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl) 421 { 422 uint32_t sizelo, sizehi = 0; 423 424 if (riscv_cpu_mxl(env) == MXL_RV64) { 425 sizehi = extract32(ctrl, 21, 2); 426 } 427 sizelo = extract32(ctrl, 16, 2); 428 return (sizehi << 2) | sizelo; 429 } 430 431 static inline bool type2_breakpoint_enabled(target_ulong ctrl) 432 { 433 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M)); 434 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 435 436 return mode && rwx; 437 } 438 439 static target_ulong type2_mcontrol_validate(CPURISCVState *env, 440 target_ulong ctrl) 441 { 442 target_ulong val; 443 uint32_t size; 444 445 /* validate the generic part first */ 446 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH); 447 448 /* validate unimplemented (always zero) bits */ 449 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match"); 450 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain"); 451 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action"); 452 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing"); 453 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select"); 454 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit"); 455 456 /* validate size encoding */ 457 size = type2_breakpoint_size(env, ctrl); 458 if (access_size[size] == -1) { 459 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 460 "SIZE_ANY\n", size); 461 } else { 462 val |= (ctrl & TYPE2_SIZELO); 463 if (riscv_cpu_mxl(env) == MXL_RV64) { 464 val |= (ctrl & TYPE2_SIZEHI); 465 } 466 } 467 468 /* keep the mode and attribute bits */ 469 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M | 470 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 471 472 return val; 473 } 474 475 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index) 476 { 477 target_ulong ctrl = env->tdata1[index]; 478 target_ulong addr = env->tdata2[index]; 479 bool enabled = type2_breakpoint_enabled(ctrl); 480 CPUState *cs = env_cpu(env); 481 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 482 uint32_t size, def_size; 483 484 if (!enabled) { 485 return; 486 } 487 488 if (ctrl & TYPE2_EXEC) { 489 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 490 } 491 492 if (ctrl & TYPE2_LOAD) { 493 flags |= BP_MEM_READ; 494 } 495 if (ctrl & TYPE2_STORE) { 496 flags |= BP_MEM_WRITE; 497 } 498 499 if (flags & BP_MEM_ACCESS) { 500 size = type2_breakpoint_size(env, ctrl); 501 if (size != 0) { 502 cpu_watchpoint_insert(cs, addr, size, flags, 503 &env->cpu_watchpoint[index]); 504 } else { 505 def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4; 506 507 cpu_watchpoint_insert(cs, addr, def_size, flags, 508 &env->cpu_watchpoint[index]); 509 } 510 } 511 } 512 513 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index) 514 { 515 CPUState *cs = env_cpu(env); 516 517 if (env->cpu_breakpoint[index]) { 518 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]); 519 env->cpu_breakpoint[index] = NULL; 520 } 521 522 if (env->cpu_watchpoint[index]) { 523 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]); 524 env->cpu_watchpoint[index] = NULL; 525 } 526 } 527 528 static void type2_reg_write(CPURISCVState *env, target_ulong index, 529 int tdata_index, target_ulong val) 530 { 531 target_ulong new_val; 532 533 switch (tdata_index) { 534 case TDATA1: 535 new_val = type2_mcontrol_validate(env, val); 536 if (new_val != env->tdata1[index]) { 537 env->tdata1[index] = new_val; 538 type2_breakpoint_remove(env, index); 539 type2_breakpoint_insert(env, index); 540 } 541 break; 542 case TDATA2: 543 if (val != env->tdata2[index]) { 544 env->tdata2[index] = val; 545 type2_breakpoint_remove(env, index); 546 type2_breakpoint_insert(env, index); 547 } 548 break; 549 case TDATA3: 550 env->tdata3[index] = textra_validate(env, val); 551 break; 552 default: 553 g_assert_not_reached(); 554 } 555 } 556 557 /* type 6 trigger */ 558 559 static inline bool type6_breakpoint_enabled(target_ulong ctrl) 560 { 561 bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M)); 562 bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 563 564 return mode && rwx; 565 } 566 567 static target_ulong type6_mcontrol6_validate(CPURISCVState *env, 568 target_ulong ctrl) 569 { 570 target_ulong val; 571 uint32_t size; 572 573 /* validate the generic part first */ 574 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6); 575 576 /* validate unimplemented (always zero) bits */ 577 warn_always_zero_bit(ctrl, TYPE6_MATCH, "match"); 578 warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain"); 579 warn_always_zero_bit(ctrl, TYPE6_ACTION, "action"); 580 warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing"); 581 warn_always_zero_bit(ctrl, TYPE6_SELECT, "select"); 582 warn_always_zero_bit(ctrl, TYPE6_HIT, "hit"); 583 584 /* validate size encoding */ 585 size = extract32(ctrl, 16, 4); 586 if (access_size[size] == -1) { 587 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 588 "SIZE_ANY\n", size); 589 } else { 590 val |= (ctrl & TYPE6_SIZE); 591 } 592 593 /* keep the mode and attribute bits */ 594 val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M | 595 TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 596 597 return val; 598 } 599 600 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index) 601 { 602 target_ulong ctrl = env->tdata1[index]; 603 target_ulong addr = env->tdata2[index]; 604 bool enabled = type6_breakpoint_enabled(ctrl); 605 CPUState *cs = env_cpu(env); 606 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 607 uint32_t size; 608 609 if (!enabled) { 610 return; 611 } 612 613 if (ctrl & TYPE6_EXEC) { 614 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 615 } 616 617 if (ctrl & TYPE6_LOAD) { 618 flags |= BP_MEM_READ; 619 } 620 621 if (ctrl & TYPE6_STORE) { 622 flags |= BP_MEM_WRITE; 623 } 624 625 if (flags & BP_MEM_ACCESS) { 626 size = extract32(ctrl, 16, 4); 627 if (size != 0) { 628 cpu_watchpoint_insert(cs, addr, size, flags, 629 &env->cpu_watchpoint[index]); 630 } else { 631 cpu_watchpoint_insert(cs, addr, 8, flags, 632 &env->cpu_watchpoint[index]); 633 } 634 } 635 } 636 637 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index) 638 { 639 type2_breakpoint_remove(env, index); 640 } 641 642 static void type6_reg_write(CPURISCVState *env, target_ulong index, 643 int tdata_index, target_ulong val) 644 { 645 target_ulong new_val; 646 647 switch (tdata_index) { 648 case TDATA1: 649 new_val = type6_mcontrol6_validate(env, val); 650 if (new_val != env->tdata1[index]) { 651 env->tdata1[index] = new_val; 652 type6_breakpoint_remove(env, index); 653 type6_breakpoint_insert(env, index); 654 } 655 break; 656 case TDATA2: 657 if (val != env->tdata2[index]) { 658 env->tdata2[index] = val; 659 type6_breakpoint_remove(env, index); 660 type6_breakpoint_insert(env, index); 661 } 662 break; 663 case TDATA3: 664 env->tdata3[index] = textra_validate(env, val); 665 break; 666 default: 667 g_assert_not_reached(); 668 } 669 } 670 671 /* icount trigger type */ 672 static inline int 673 itrigger_get_count(CPURISCVState *env, int index) 674 { 675 return get_field(env->tdata1[index], ITRIGGER_COUNT); 676 } 677 678 static inline void 679 itrigger_set_count(CPURISCVState *env, int index, int value) 680 { 681 env->tdata1[index] = set_field(env->tdata1[index], 682 ITRIGGER_COUNT, value); 683 } 684 685 static bool check_itrigger_priv(CPURISCVState *env, int index) 686 { 687 target_ulong tdata1 = env->tdata1[index]; 688 if (env->virt_enabled) { 689 /* check VU/VS bit against current privilege level */ 690 return (get_field(tdata1, ITRIGGER_VS) == env->priv) || 691 (get_field(tdata1, ITRIGGER_VU) == env->priv); 692 } else { 693 /* check U/S/M bit against current privilege level */ 694 return (get_field(tdata1, ITRIGGER_M) == env->priv) || 695 (get_field(tdata1, ITRIGGER_S) == env->priv) || 696 (get_field(tdata1, ITRIGGER_U) == env->priv); 697 } 698 } 699 700 bool riscv_itrigger_enabled(CPURISCVState *env) 701 { 702 int count; 703 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 704 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 705 continue; 706 } 707 if (check_itrigger_priv(env, i)) { 708 continue; 709 } 710 count = itrigger_get_count(env, i); 711 if (!count) { 712 continue; 713 } 714 return true; 715 } 716 717 return false; 718 } 719 720 void helper_itrigger_match(CPURISCVState *env) 721 { 722 int count; 723 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 724 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 725 continue; 726 } 727 if (!trigger_common_match(env, TRIGGER_TYPE_INST_CNT, i)) { 728 continue; 729 } 730 count = itrigger_get_count(env, i); 731 if (!count) { 732 continue; 733 } 734 itrigger_set_count(env, i, count--); 735 if (!count) { 736 env->itrigger_enabled = riscv_itrigger_enabled(env); 737 do_trigger_action(env, i); 738 } 739 } 740 } 741 742 static void riscv_itrigger_update_count(CPURISCVState *env) 743 { 744 int count, executed; 745 /* 746 * Record last icount, so that we can evaluate the executed instructions 747 * since last privilege mode change or timer expire. 748 */ 749 int64_t last_icount = env->last_icount, current_icount; 750 current_icount = env->last_icount = icount_get_raw(); 751 752 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 753 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 754 continue; 755 } 756 count = itrigger_get_count(env, i); 757 if (!count) { 758 continue; 759 } 760 /* 761 * Only when privilege is changed or itrigger timer expires, 762 * the count field in itrigger tdata1 register is updated. 763 * And the count field in itrigger only contains remaining value. 764 */ 765 if (check_itrigger_priv(env, i)) { 766 /* 767 * If itrigger enabled in this privilege mode, the number of 768 * executed instructions since last privilege change 769 * should be reduced from current itrigger count. 770 */ 771 executed = current_icount - last_icount; 772 itrigger_set_count(env, i, count - executed); 773 if (count == executed) { 774 do_trigger_action(env, i); 775 } 776 } else { 777 /* 778 * If itrigger is not enabled in this privilege mode, 779 * the number of executed instructions will be discard and 780 * the count field in itrigger will not change. 781 */ 782 timer_mod(env->itrigger_timer[i], 783 current_icount + count); 784 } 785 } 786 } 787 788 static void riscv_itrigger_timer_cb(void *opaque) 789 { 790 riscv_itrigger_update_count((CPURISCVState *)opaque); 791 } 792 793 void riscv_itrigger_update_priv(CPURISCVState *env) 794 { 795 riscv_itrigger_update_count(env); 796 } 797 798 static target_ulong itrigger_validate(CPURISCVState *env, 799 target_ulong ctrl) 800 { 801 target_ulong val; 802 803 /* validate the generic part first */ 804 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT); 805 806 /* validate unimplemented (always zero) bits */ 807 warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action"); 808 warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit"); 809 warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending"); 810 811 /* keep the mode and attribute bits */ 812 val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S | 813 ITRIGGER_M | ITRIGGER_COUNT); 814 815 return val; 816 } 817 818 static void itrigger_reg_write(CPURISCVState *env, target_ulong index, 819 int tdata_index, target_ulong val) 820 { 821 target_ulong new_val; 822 823 switch (tdata_index) { 824 case TDATA1: 825 /* set timer for icount */ 826 new_val = itrigger_validate(env, val); 827 if (new_val != env->tdata1[index]) { 828 env->tdata1[index] = new_val; 829 if (icount_enabled()) { 830 env->last_icount = icount_get_raw(); 831 /* set the count to timer */ 832 timer_mod(env->itrigger_timer[index], 833 env->last_icount + itrigger_get_count(env, index)); 834 } else { 835 env->itrigger_enabled = riscv_itrigger_enabled(env); 836 } 837 } 838 break; 839 case TDATA2: 840 qemu_log_mask(LOG_UNIMP, 841 "tdata2 is not supported for icount trigger\n"); 842 break; 843 case TDATA3: 844 env->tdata3[index] = textra_validate(env, val); 845 break; 846 default: 847 g_assert_not_reached(); 848 } 849 } 850 851 static int itrigger_get_adjust_count(CPURISCVState *env) 852 { 853 int count = itrigger_get_count(env, env->trigger_cur), executed; 854 if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) { 855 executed = icount_get_raw() - env->last_icount; 856 count += executed; 857 } 858 return count; 859 } 860 861 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index) 862 { 863 int trigger_type; 864 switch (tdata_index) { 865 case TDATA1: 866 trigger_type = extract_trigger_type(env, 867 env->tdata1[env->trigger_cur]); 868 if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) { 869 return deposit64(env->tdata1[env->trigger_cur], 10, 14, 870 itrigger_get_adjust_count(env)); 871 } 872 return env->tdata1[env->trigger_cur]; 873 case TDATA2: 874 return env->tdata2[env->trigger_cur]; 875 case TDATA3: 876 return env->tdata3[env->trigger_cur]; 877 default: 878 g_assert_not_reached(); 879 } 880 } 881 882 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val) 883 { 884 int trigger_type; 885 886 if (tdata_index == TDATA1) { 887 trigger_type = extract_trigger_type(env, val); 888 } else { 889 trigger_type = get_trigger_type(env, env->trigger_cur); 890 } 891 892 switch (trigger_type) { 893 case TRIGGER_TYPE_AD_MATCH: 894 type2_reg_write(env, env->trigger_cur, tdata_index, val); 895 break; 896 case TRIGGER_TYPE_AD_MATCH6: 897 type6_reg_write(env, env->trigger_cur, tdata_index, val); 898 break; 899 case TRIGGER_TYPE_INST_CNT: 900 itrigger_reg_write(env, env->trigger_cur, tdata_index, val); 901 break; 902 case TRIGGER_TYPE_INT: 903 case TRIGGER_TYPE_EXCP: 904 case TRIGGER_TYPE_EXT_SRC: 905 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 906 trigger_type); 907 break; 908 case TRIGGER_TYPE_NO_EXIST: 909 case TRIGGER_TYPE_UNAVAIL: 910 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 911 trigger_type); 912 break; 913 default: 914 g_assert_not_reached(); 915 } 916 } 917 918 target_ulong tinfo_csr_read(CPURISCVState *env) 919 { 920 /* assume all triggers support the same types of triggers */ 921 return BIT(TRIGGER_TYPE_AD_MATCH) | 922 BIT(TRIGGER_TYPE_AD_MATCH6); 923 } 924 925 void riscv_cpu_debug_excp_handler(CPUState *cs) 926 { 927 RISCVCPU *cpu = RISCV_CPU(cs); 928 CPURISCVState *env = &cpu->env; 929 930 if (cs->watchpoint_hit) { 931 if (cs->watchpoint_hit->flags & BP_CPU) { 932 do_trigger_action(env, DBG_ACTION_BP); 933 } 934 } else { 935 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) { 936 do_trigger_action(env, DBG_ACTION_BP); 937 } 938 } 939 } 940 941 bool riscv_cpu_debug_check_breakpoint(CPUState *cs) 942 { 943 RISCVCPU *cpu = RISCV_CPU(cs); 944 CPURISCVState *env = &cpu->env; 945 CPUBreakpoint *bp; 946 target_ulong ctrl; 947 target_ulong pc; 948 int trigger_type; 949 int i; 950 951 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) { 952 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 953 trigger_type = get_trigger_type(env, i); 954 955 if (!trigger_common_match(env, trigger_type, i)) { 956 continue; 957 } 958 959 switch (trigger_type) { 960 case TRIGGER_TYPE_AD_MATCH: 961 ctrl = env->tdata1[i]; 962 pc = env->tdata2[i]; 963 964 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) { 965 env->badaddr = pc; 966 return true; 967 } 968 break; 969 case TRIGGER_TYPE_AD_MATCH6: 970 ctrl = env->tdata1[i]; 971 pc = env->tdata2[i]; 972 973 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) { 974 env->badaddr = pc; 975 return true; 976 } 977 break; 978 default: 979 /* other trigger types are not supported or irrelevant */ 980 break; 981 } 982 } 983 } 984 985 return false; 986 } 987 988 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) 989 { 990 RISCVCPU *cpu = RISCV_CPU(cs); 991 CPURISCVState *env = &cpu->env; 992 target_ulong ctrl; 993 target_ulong addr; 994 int trigger_type; 995 int flags; 996 int i; 997 998 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 999 trigger_type = get_trigger_type(env, i); 1000 1001 if (!trigger_common_match(env, trigger_type, i)) { 1002 continue; 1003 } 1004 1005 switch (trigger_type) { 1006 case TRIGGER_TYPE_AD_MATCH: 1007 ctrl = env->tdata1[i]; 1008 addr = env->tdata2[i]; 1009 flags = 0; 1010 1011 if (ctrl & TYPE2_LOAD) { 1012 flags |= BP_MEM_READ; 1013 } 1014 if (ctrl & TYPE2_STORE) { 1015 flags |= BP_MEM_WRITE; 1016 } 1017 1018 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1019 return true; 1020 } 1021 break; 1022 case TRIGGER_TYPE_AD_MATCH6: 1023 ctrl = env->tdata1[i]; 1024 addr = env->tdata2[i]; 1025 flags = 0; 1026 1027 if (ctrl & TYPE6_LOAD) { 1028 flags |= BP_MEM_READ; 1029 } 1030 if (ctrl & TYPE6_STORE) { 1031 flags |= BP_MEM_WRITE; 1032 } 1033 1034 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1035 return true; 1036 } 1037 break; 1038 default: 1039 /* other trigger types are not supported */ 1040 break; 1041 } 1042 } 1043 1044 return false; 1045 } 1046 1047 void riscv_trigger_realize(CPURISCVState *env) 1048 { 1049 int i; 1050 1051 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1052 env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL, 1053 riscv_itrigger_timer_cb, env); 1054 } 1055 } 1056 1057 void riscv_trigger_reset_hold(CPURISCVState *env) 1058 { 1059 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0); 1060 int i; 1061 1062 /* init to type 2 triggers */ 1063 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1064 /* 1065 * type = TRIGGER_TYPE_AD_MATCH 1066 * dmode = 0 (both debug and M-mode can write tdata) 1067 * maskmax = 0 (unimplemented, always 0) 1068 * sizehi = 0 (match against any size, RV64 only) 1069 * hit = 0 (unimplemented, always 0) 1070 * select = 0 (always 0, perform match on address) 1071 * timing = 0 (always 0, trigger before instruction) 1072 * sizelo = 0 (match against any size) 1073 * action = 0 (always 0, raise a breakpoint exception) 1074 * chain = 0 (unimplemented, always 0) 1075 * match = 0 (always 0, when any compare value equals tdata2) 1076 */ 1077 env->tdata1[i] = tdata1; 1078 env->tdata2[i] = 0; 1079 env->tdata3[i] = 0; 1080 env->cpu_breakpoint[i] = NULL; 1081 env->cpu_watchpoint[i] = NULL; 1082 timer_del(env->itrigger_timer[i]); 1083 } 1084 1085 env->mcontext = 0; 1086 } 1087