1 /* 2 * QEMU RISC-V Native Debug Support 3 * 4 * Copyright (c) 2022 Wind River Systems, Inc. 5 * 6 * Author: 7 * Bin Meng <bin.meng@windriver.com> 8 * 9 * This provides the native debug support via the Trigger Module, as defined 10 * in the RISC-V Debug Specification: 11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf 12 * 13 * This program is free software; you can redistribute it and/or modify it 14 * under the terms and conditions of the GNU General Public License, 15 * version 2 or later, as published by the Free Software Foundation. 16 * 17 * This program is distributed in the hope it will be useful, but WITHOUT 18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 20 * more details. 21 * 22 * You should have received a copy of the GNU General Public License along with 23 * this program. If not, see <http://www.gnu.org/licenses/>. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 #include "trace.h" 31 #include "exec/exec-all.h" 32 #include "exec/helper-proto.h" 33 #include "exec/watchpoint.h" 34 #include "system/cpu-timers.h" 35 #include "exec/icount.h" 36 37 /* 38 * The following M-mode trigger CSRs are implemented: 39 * 40 * - tselect 41 * - tdata1 42 * - tdata2 43 * - tdata3 44 * - tinfo 45 * 46 * The following triggers are initialized by default: 47 * 48 * Index | Type | tdata mapping | Description 49 * ------+------+------------------------+------------ 50 * 0 | 2 | tdata1, tdata2 | Address / Data Match 51 * 1 | 2 | tdata1, tdata2 | Address / Data Match 52 */ 53 54 /* tdata availability of a trigger */ 55 typedef bool tdata_avail[TDATA_NUM]; 56 57 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = { 58 [TRIGGER_TYPE_NO_EXIST] = { false, false, false }, 59 [TRIGGER_TYPE_AD_MATCH] = { true, true, true }, 60 [TRIGGER_TYPE_INST_CNT] = { true, false, true }, 61 [TRIGGER_TYPE_INT] = { true, true, true }, 62 [TRIGGER_TYPE_EXCP] = { true, true, true }, 63 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true }, 64 [TRIGGER_TYPE_EXT_SRC] = { true, false, false }, 65 [TRIGGER_TYPE_UNAVAIL] = { true, true, true } 66 }; 67 68 /* only breakpoint size 1/2/4/8 supported */ 69 static int access_size[SIZE_NUM] = { 70 [SIZE_ANY] = 0, 71 [SIZE_1B] = 1, 72 [SIZE_2B] = 2, 73 [SIZE_4B] = 4, 74 [SIZE_6B] = -1, 75 [SIZE_8B] = 8, 76 [6 ... 15] = -1, 77 }; 78 79 static inline target_ulong extract_trigger_type(CPURISCVState *env, 80 target_ulong tdata1) 81 { 82 switch (riscv_cpu_mxl(env)) { 83 case MXL_RV32: 84 return extract32(tdata1, 28, 4); 85 case MXL_RV64: 86 case MXL_RV128: 87 return extract64(tdata1, 60, 4); 88 default: 89 g_assert_not_reached(); 90 } 91 } 92 93 static inline target_ulong get_trigger_type(CPURISCVState *env, 94 target_ulong trigger_index) 95 { 96 return extract_trigger_type(env, env->tdata1[trigger_index]); 97 } 98 99 static trigger_action_t get_trigger_action(CPURISCVState *env, 100 target_ulong trigger_index) 101 { 102 target_ulong tdata1 = env->tdata1[trigger_index]; 103 int trigger_type = get_trigger_type(env, trigger_index); 104 trigger_action_t action = DBG_ACTION_NONE; 105 106 switch (trigger_type) { 107 case TRIGGER_TYPE_AD_MATCH: 108 action = (tdata1 & TYPE2_ACTION) >> 12; 109 break; 110 case TRIGGER_TYPE_AD_MATCH6: 111 action = (tdata1 & TYPE6_ACTION) >> 12; 112 break; 113 case TRIGGER_TYPE_INST_CNT: 114 case TRIGGER_TYPE_INT: 115 case TRIGGER_TYPE_EXCP: 116 case TRIGGER_TYPE_EXT_SRC: 117 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 118 trigger_type); 119 break; 120 case TRIGGER_TYPE_NO_EXIST: 121 case TRIGGER_TYPE_UNAVAIL: 122 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 123 trigger_type); 124 break; 125 default: 126 g_assert_not_reached(); 127 } 128 129 return action; 130 } 131 132 static inline target_ulong build_tdata1(CPURISCVState *env, 133 trigger_type_t type, 134 bool dmode, target_ulong data) 135 { 136 target_ulong tdata1; 137 138 switch (riscv_cpu_mxl(env)) { 139 case MXL_RV32: 140 tdata1 = RV32_TYPE(type) | 141 (dmode ? RV32_DMODE : 0) | 142 (data & RV32_DATA_MASK); 143 break; 144 case MXL_RV64: 145 case MXL_RV128: 146 tdata1 = RV64_TYPE(type) | 147 (dmode ? RV64_DMODE : 0) | 148 (data & RV64_DATA_MASK); 149 break; 150 default: 151 g_assert_not_reached(); 152 } 153 154 return tdata1; 155 } 156 157 bool tdata_available(CPURISCVState *env, int tdata_index) 158 { 159 int trigger_type = get_trigger_type(env, env->trigger_cur); 160 161 if (unlikely(tdata_index >= TDATA_NUM)) { 162 return false; 163 } 164 165 return tdata_mapping[trigger_type][tdata_index]; 166 } 167 168 target_ulong tselect_csr_read(CPURISCVState *env) 169 { 170 return env->trigger_cur; 171 } 172 173 void tselect_csr_write(CPURISCVState *env, target_ulong val) 174 { 175 if (val < RV_MAX_TRIGGERS) { 176 env->trigger_cur = val; 177 } 178 } 179 180 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val, 181 trigger_type_t t) 182 { 183 uint32_t type, dmode; 184 target_ulong tdata1; 185 186 switch (riscv_cpu_mxl(env)) { 187 case MXL_RV32: 188 type = extract32(val, 28, 4); 189 dmode = extract32(val, 27, 1); 190 tdata1 = RV32_TYPE(t); 191 break; 192 case MXL_RV64: 193 case MXL_RV128: 194 type = extract64(val, 60, 4); 195 dmode = extract64(val, 59, 1); 196 tdata1 = RV64_TYPE(t); 197 break; 198 default: 199 g_assert_not_reached(); 200 } 201 202 if (type != t) { 203 qemu_log_mask(LOG_GUEST_ERROR, 204 "ignoring type write to tdata1 register\n"); 205 } 206 207 if (dmode != 0) { 208 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n"); 209 } 210 211 return tdata1; 212 } 213 214 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask, 215 const char *msg) 216 { 217 if (val & mask) { 218 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg); 219 } 220 } 221 222 static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3) 223 { 224 target_ulong mhvalue, mhselect; 225 target_ulong mhselect_new; 226 target_ulong textra; 227 const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 }; 228 229 switch (riscv_cpu_mxl(env)) { 230 case MXL_RV32: 231 mhvalue = get_field(tdata3, TEXTRA32_MHVALUE); 232 mhselect = get_field(tdata3, TEXTRA32_MHSELECT); 233 /* Validate unimplemented (always zero) bits */ 234 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK, 235 "sbytemask"); 236 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE, 237 "svalue"); 238 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT, 239 "sselect"); 240 break; 241 case MXL_RV64: 242 case MXL_RV128: 243 mhvalue = get_field(tdata3, TEXTRA64_MHVALUE); 244 mhselect = get_field(tdata3, TEXTRA64_MHSELECT); 245 /* Validate unimplemented (always zero) bits */ 246 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK, 247 "sbytemask"); 248 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE, 249 "svalue"); 250 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT, 251 "sselect"); 252 break; 253 default: 254 g_assert_not_reached(); 255 } 256 257 /* Validate mhselect. */ 258 mhselect_new = mhselect_no_rvh[mhselect]; 259 if (mhselect != mhselect_new) { 260 qemu_log_mask(LOG_UNIMP, "mhselect only supports 0 or 4 for now\n"); 261 } 262 263 /* Write legal values into textra */ 264 textra = 0; 265 switch (riscv_cpu_mxl(env)) { 266 case MXL_RV32: 267 textra = set_field(textra, TEXTRA32_MHVALUE, mhvalue); 268 textra = set_field(textra, TEXTRA32_MHSELECT, mhselect_new); 269 break; 270 case MXL_RV64: 271 case MXL_RV128: 272 textra = set_field(textra, TEXTRA64_MHVALUE, mhvalue); 273 textra = set_field(textra, TEXTRA64_MHSELECT, mhselect_new); 274 break; 275 default: 276 g_assert_not_reached(); 277 } 278 279 return textra; 280 } 281 282 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index) 283 { 284 trigger_action_t action = get_trigger_action(env, trigger_index); 285 286 switch (action) { 287 case DBG_ACTION_NONE: 288 break; 289 case DBG_ACTION_BP: 290 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0); 291 break; 292 case DBG_ACTION_DBG_MODE: 293 case DBG_ACTION_TRACE0: 294 case DBG_ACTION_TRACE1: 295 case DBG_ACTION_TRACE2: 296 case DBG_ACTION_TRACE3: 297 case DBG_ACTION_EXT_DBG0: 298 case DBG_ACTION_EXT_DBG1: 299 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action); 300 break; 301 default: 302 g_assert_not_reached(); 303 } 304 } 305 306 /* 307 * Check the privilege level of specific trigger matches CPU's current privilege 308 * level. 309 */ 310 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type, 311 int trigger_index) 312 { 313 target_ulong ctrl = env->tdata1[trigger_index]; 314 315 switch (type) { 316 case TRIGGER_TYPE_AD_MATCH: 317 /* type 2 trigger cannot be fired in VU/VS mode */ 318 if (env->virt_enabled) { 319 return false; 320 } 321 /* check U/S/M bit against current privilege level */ 322 if ((ctrl >> 3) & BIT(env->priv)) { 323 return true; 324 } 325 break; 326 case TRIGGER_TYPE_AD_MATCH6: 327 if (env->virt_enabled) { 328 /* check VU/VS bit against current privilege level */ 329 if ((ctrl >> 23) & BIT(env->priv)) { 330 return true; 331 } 332 } else { 333 /* check U/S/M bit against current privilege level */ 334 if ((ctrl >> 3) & BIT(env->priv)) { 335 return true; 336 } 337 } 338 break; 339 case TRIGGER_TYPE_INST_CNT: 340 if (env->virt_enabled) { 341 /* check VU/VS bit against current privilege level */ 342 if ((ctrl >> 25) & BIT(env->priv)) { 343 return true; 344 } 345 } else { 346 /* check U/S/M bit against current privilege level */ 347 if ((ctrl >> 6) & BIT(env->priv)) { 348 return true; 349 } 350 } 351 break; 352 case TRIGGER_TYPE_INT: 353 case TRIGGER_TYPE_EXCP: 354 case TRIGGER_TYPE_EXT_SRC: 355 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", type); 356 break; 357 case TRIGGER_TYPE_NO_EXIST: 358 case TRIGGER_TYPE_UNAVAIL: 359 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exist\n", 360 type); 361 break; 362 default: 363 g_assert_not_reached(); 364 } 365 366 return false; 367 } 368 369 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type, 370 int trigger_index) 371 { 372 target_ulong textra = env->tdata3[trigger_index]; 373 target_ulong mhvalue, mhselect; 374 375 if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) { 376 /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */ 377 return true; 378 } 379 380 switch (riscv_cpu_mxl(env)) { 381 case MXL_RV32: 382 mhvalue = get_field(textra, TEXTRA32_MHVALUE); 383 mhselect = get_field(textra, TEXTRA32_MHSELECT); 384 break; 385 case MXL_RV64: 386 case MXL_RV128: 387 mhvalue = get_field(textra, TEXTRA64_MHVALUE); 388 mhselect = get_field(textra, TEXTRA64_MHSELECT); 389 break; 390 default: 391 g_assert_not_reached(); 392 } 393 394 /* Check mhvalue and mhselect. */ 395 switch (mhselect) { 396 case MHSELECT_IGNORE: 397 break; 398 case MHSELECT_MCONTEXT: 399 /* Match if the low bits of mcontext/hcontext equal mhvalue. */ 400 if (mhvalue != env->mcontext) { 401 return false; 402 } 403 break; 404 default: 405 break; 406 } 407 408 return true; 409 } 410 411 /* Common matching conditions for all types of the triggers. */ 412 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type, 413 int trigger_index) 414 { 415 return trigger_priv_match(env, type, trigger_index) && 416 trigger_textra_match(env, type, trigger_index); 417 } 418 419 /* type 2 trigger */ 420 421 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl) 422 { 423 uint32_t sizelo, sizehi = 0; 424 425 if (riscv_cpu_mxl(env) == MXL_RV64) { 426 sizehi = extract32(ctrl, 21, 2); 427 } 428 sizelo = extract32(ctrl, 16, 2); 429 return (sizehi << 2) | sizelo; 430 } 431 432 static inline bool type2_breakpoint_enabled(target_ulong ctrl) 433 { 434 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M)); 435 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 436 437 return mode && rwx; 438 } 439 440 static target_ulong type2_mcontrol_validate(CPURISCVState *env, 441 target_ulong ctrl) 442 { 443 target_ulong val; 444 uint32_t size; 445 446 /* validate the generic part first */ 447 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH); 448 449 /* validate unimplemented (always zero) bits */ 450 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match"); 451 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain"); 452 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action"); 453 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing"); 454 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select"); 455 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit"); 456 457 /* validate size encoding */ 458 size = type2_breakpoint_size(env, ctrl); 459 if (access_size[size] == -1) { 460 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 461 "SIZE_ANY\n", size); 462 } else { 463 val |= (ctrl & TYPE2_SIZELO); 464 if (riscv_cpu_mxl(env) == MXL_RV64) { 465 val |= (ctrl & TYPE2_SIZEHI); 466 } 467 } 468 469 /* keep the mode and attribute bits */ 470 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M | 471 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 472 473 return val; 474 } 475 476 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index) 477 { 478 target_ulong ctrl = env->tdata1[index]; 479 target_ulong addr = env->tdata2[index]; 480 bool enabled = type2_breakpoint_enabled(ctrl); 481 CPUState *cs = env_cpu(env); 482 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 483 uint32_t size, def_size; 484 485 if (!enabled) { 486 return; 487 } 488 489 if (ctrl & TYPE2_EXEC) { 490 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 491 } 492 493 if (ctrl & TYPE2_LOAD) { 494 flags |= BP_MEM_READ; 495 } 496 if (ctrl & TYPE2_STORE) { 497 flags |= BP_MEM_WRITE; 498 } 499 500 if (flags & BP_MEM_ACCESS) { 501 size = type2_breakpoint_size(env, ctrl); 502 if (size != 0) { 503 cpu_watchpoint_insert(cs, addr, size, flags, 504 &env->cpu_watchpoint[index]); 505 } else { 506 def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4; 507 508 cpu_watchpoint_insert(cs, addr, def_size, flags, 509 &env->cpu_watchpoint[index]); 510 } 511 } 512 } 513 514 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index) 515 { 516 CPUState *cs = env_cpu(env); 517 518 if (env->cpu_breakpoint[index]) { 519 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]); 520 env->cpu_breakpoint[index] = NULL; 521 } 522 523 if (env->cpu_watchpoint[index]) { 524 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]); 525 env->cpu_watchpoint[index] = NULL; 526 } 527 } 528 529 static void type2_reg_write(CPURISCVState *env, target_ulong index, 530 int tdata_index, target_ulong val) 531 { 532 target_ulong new_val; 533 534 switch (tdata_index) { 535 case TDATA1: 536 new_val = type2_mcontrol_validate(env, val); 537 if (new_val != env->tdata1[index]) { 538 env->tdata1[index] = new_val; 539 type2_breakpoint_remove(env, index); 540 type2_breakpoint_insert(env, index); 541 } 542 break; 543 case TDATA2: 544 if (val != env->tdata2[index]) { 545 env->tdata2[index] = val; 546 type2_breakpoint_remove(env, index); 547 type2_breakpoint_insert(env, index); 548 } 549 break; 550 case TDATA3: 551 env->tdata3[index] = textra_validate(env, val); 552 break; 553 default: 554 g_assert_not_reached(); 555 } 556 } 557 558 /* type 6 trigger */ 559 560 static inline bool type6_breakpoint_enabled(target_ulong ctrl) 561 { 562 bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M)); 563 bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 564 565 return mode && rwx; 566 } 567 568 static target_ulong type6_mcontrol6_validate(CPURISCVState *env, 569 target_ulong ctrl) 570 { 571 target_ulong val; 572 uint32_t size; 573 574 /* validate the generic part first */ 575 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6); 576 577 /* validate unimplemented (always zero) bits */ 578 warn_always_zero_bit(ctrl, TYPE6_MATCH, "match"); 579 warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain"); 580 warn_always_zero_bit(ctrl, TYPE6_ACTION, "action"); 581 warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing"); 582 warn_always_zero_bit(ctrl, TYPE6_SELECT, "select"); 583 warn_always_zero_bit(ctrl, TYPE6_HIT, "hit"); 584 585 /* validate size encoding */ 586 size = extract32(ctrl, 16, 4); 587 if (access_size[size] == -1) { 588 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 589 "SIZE_ANY\n", size); 590 } else { 591 val |= (ctrl & TYPE6_SIZE); 592 } 593 594 /* keep the mode and attribute bits */ 595 val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M | 596 TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 597 598 return val; 599 } 600 601 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index) 602 { 603 target_ulong ctrl = env->tdata1[index]; 604 target_ulong addr = env->tdata2[index]; 605 bool enabled = type6_breakpoint_enabled(ctrl); 606 CPUState *cs = env_cpu(env); 607 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 608 uint32_t size; 609 610 if (!enabled) { 611 return; 612 } 613 614 if (ctrl & TYPE6_EXEC) { 615 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 616 } 617 618 if (ctrl & TYPE6_LOAD) { 619 flags |= BP_MEM_READ; 620 } 621 622 if (ctrl & TYPE6_STORE) { 623 flags |= BP_MEM_WRITE; 624 } 625 626 if (flags & BP_MEM_ACCESS) { 627 size = extract32(ctrl, 16, 4); 628 if (size != 0) { 629 cpu_watchpoint_insert(cs, addr, size, flags, 630 &env->cpu_watchpoint[index]); 631 } else { 632 cpu_watchpoint_insert(cs, addr, 8, flags, 633 &env->cpu_watchpoint[index]); 634 } 635 } 636 } 637 638 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index) 639 { 640 type2_breakpoint_remove(env, index); 641 } 642 643 static void type6_reg_write(CPURISCVState *env, target_ulong index, 644 int tdata_index, target_ulong val) 645 { 646 target_ulong new_val; 647 648 switch (tdata_index) { 649 case TDATA1: 650 new_val = type6_mcontrol6_validate(env, val); 651 if (new_val != env->tdata1[index]) { 652 env->tdata1[index] = new_val; 653 type6_breakpoint_remove(env, index); 654 type6_breakpoint_insert(env, index); 655 } 656 break; 657 case TDATA2: 658 if (val != env->tdata2[index]) { 659 env->tdata2[index] = val; 660 type6_breakpoint_remove(env, index); 661 type6_breakpoint_insert(env, index); 662 } 663 break; 664 case TDATA3: 665 env->tdata3[index] = textra_validate(env, val); 666 break; 667 default: 668 g_assert_not_reached(); 669 } 670 } 671 672 /* icount trigger type */ 673 static inline int 674 itrigger_get_count(CPURISCVState *env, int index) 675 { 676 return get_field(env->tdata1[index], ITRIGGER_COUNT); 677 } 678 679 static inline void 680 itrigger_set_count(CPURISCVState *env, int index, int value) 681 { 682 env->tdata1[index] = set_field(env->tdata1[index], 683 ITRIGGER_COUNT, value); 684 } 685 686 static bool check_itrigger_priv(CPURISCVState *env, int index) 687 { 688 target_ulong tdata1 = env->tdata1[index]; 689 if (env->virt_enabled) { 690 /* check VU/VS bit against current privilege level */ 691 return (get_field(tdata1, ITRIGGER_VS) == env->priv) || 692 (get_field(tdata1, ITRIGGER_VU) == env->priv); 693 } else { 694 /* check U/S/M bit against current privilege level */ 695 return (get_field(tdata1, ITRIGGER_M) == env->priv) || 696 (get_field(tdata1, ITRIGGER_S) == env->priv) || 697 (get_field(tdata1, ITRIGGER_U) == env->priv); 698 } 699 } 700 701 bool riscv_itrigger_enabled(CPURISCVState *env) 702 { 703 int count; 704 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 705 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 706 continue; 707 } 708 if (check_itrigger_priv(env, i)) { 709 continue; 710 } 711 count = itrigger_get_count(env, i); 712 if (!count) { 713 continue; 714 } 715 return true; 716 } 717 718 return false; 719 } 720 721 void helper_itrigger_match(CPURISCVState *env) 722 { 723 int count; 724 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 725 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 726 continue; 727 } 728 if (!trigger_common_match(env, TRIGGER_TYPE_INST_CNT, i)) { 729 continue; 730 } 731 count = itrigger_get_count(env, i); 732 if (!count) { 733 continue; 734 } 735 itrigger_set_count(env, i, count--); 736 if (!count) { 737 env->itrigger_enabled = riscv_itrigger_enabled(env); 738 do_trigger_action(env, i); 739 } 740 } 741 } 742 743 static void riscv_itrigger_update_count(CPURISCVState *env) 744 { 745 int count, executed; 746 /* 747 * Record last icount, so that we can evaluate the executed instructions 748 * since last privilege mode change or timer expire. 749 */ 750 int64_t last_icount = env->last_icount, current_icount; 751 current_icount = env->last_icount = icount_get_raw(); 752 753 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 754 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 755 continue; 756 } 757 count = itrigger_get_count(env, i); 758 if (!count) { 759 continue; 760 } 761 /* 762 * Only when privilege is changed or itrigger timer expires, 763 * the count field in itrigger tdata1 register is updated. 764 * And the count field in itrigger only contains remaining value. 765 */ 766 if (check_itrigger_priv(env, i)) { 767 /* 768 * If itrigger enabled in this privilege mode, the number of 769 * executed instructions since last privilege change 770 * should be reduced from current itrigger count. 771 */ 772 executed = current_icount - last_icount; 773 itrigger_set_count(env, i, count - executed); 774 if (count == executed) { 775 do_trigger_action(env, i); 776 } 777 } else { 778 /* 779 * If itrigger is not enabled in this privilege mode, 780 * the number of executed instructions will be discard and 781 * the count field in itrigger will not change. 782 */ 783 timer_mod(env->itrigger_timer[i], 784 current_icount + count); 785 } 786 } 787 } 788 789 static void riscv_itrigger_timer_cb(void *opaque) 790 { 791 riscv_itrigger_update_count((CPURISCVState *)opaque); 792 } 793 794 void riscv_itrigger_update_priv(CPURISCVState *env) 795 { 796 riscv_itrigger_update_count(env); 797 } 798 799 static target_ulong itrigger_validate(CPURISCVState *env, 800 target_ulong ctrl) 801 { 802 target_ulong val; 803 804 /* validate the generic part first */ 805 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT); 806 807 /* validate unimplemented (always zero) bits */ 808 warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action"); 809 warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit"); 810 warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending"); 811 812 /* keep the mode and attribute bits */ 813 val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S | 814 ITRIGGER_M | ITRIGGER_COUNT); 815 816 return val; 817 } 818 819 static void itrigger_reg_write(CPURISCVState *env, target_ulong index, 820 int tdata_index, target_ulong val) 821 { 822 target_ulong new_val; 823 824 switch (tdata_index) { 825 case TDATA1: 826 /* set timer for icount */ 827 new_val = itrigger_validate(env, val); 828 if (new_val != env->tdata1[index]) { 829 env->tdata1[index] = new_val; 830 if (icount_enabled()) { 831 env->last_icount = icount_get_raw(); 832 /* set the count to timer */ 833 timer_mod(env->itrigger_timer[index], 834 env->last_icount + itrigger_get_count(env, index)); 835 } else { 836 env->itrigger_enabled = riscv_itrigger_enabled(env); 837 } 838 } 839 break; 840 case TDATA2: 841 qemu_log_mask(LOG_UNIMP, 842 "tdata2 is not supported for icount trigger\n"); 843 break; 844 case TDATA3: 845 env->tdata3[index] = textra_validate(env, val); 846 break; 847 default: 848 g_assert_not_reached(); 849 } 850 } 851 852 static int itrigger_get_adjust_count(CPURISCVState *env) 853 { 854 int count = itrigger_get_count(env, env->trigger_cur), executed; 855 if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) { 856 executed = icount_get_raw() - env->last_icount; 857 count += executed; 858 } 859 return count; 860 } 861 862 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index) 863 { 864 int trigger_type; 865 switch (tdata_index) { 866 case TDATA1: 867 trigger_type = extract_trigger_type(env, 868 env->tdata1[env->trigger_cur]); 869 if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) { 870 return deposit64(env->tdata1[env->trigger_cur], 10, 14, 871 itrigger_get_adjust_count(env)); 872 } 873 return env->tdata1[env->trigger_cur]; 874 case TDATA2: 875 return env->tdata2[env->trigger_cur]; 876 case TDATA3: 877 return env->tdata3[env->trigger_cur]; 878 default: 879 g_assert_not_reached(); 880 } 881 } 882 883 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val) 884 { 885 int trigger_type; 886 887 if (tdata_index == TDATA1) { 888 trigger_type = extract_trigger_type(env, val); 889 } else { 890 trigger_type = get_trigger_type(env, env->trigger_cur); 891 } 892 893 switch (trigger_type) { 894 case TRIGGER_TYPE_AD_MATCH: 895 type2_reg_write(env, env->trigger_cur, tdata_index, val); 896 break; 897 case TRIGGER_TYPE_AD_MATCH6: 898 type6_reg_write(env, env->trigger_cur, tdata_index, val); 899 break; 900 case TRIGGER_TYPE_INST_CNT: 901 itrigger_reg_write(env, env->trigger_cur, tdata_index, val); 902 break; 903 case TRIGGER_TYPE_INT: 904 case TRIGGER_TYPE_EXCP: 905 case TRIGGER_TYPE_EXT_SRC: 906 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 907 trigger_type); 908 break; 909 case TRIGGER_TYPE_NO_EXIST: 910 case TRIGGER_TYPE_UNAVAIL: 911 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 912 trigger_type); 913 break; 914 default: 915 g_assert_not_reached(); 916 } 917 } 918 919 target_ulong tinfo_csr_read(CPURISCVState *env) 920 { 921 /* assume all triggers support the same types of triggers */ 922 return BIT(TRIGGER_TYPE_AD_MATCH) | 923 BIT(TRIGGER_TYPE_AD_MATCH6); 924 } 925 926 void riscv_cpu_debug_excp_handler(CPUState *cs) 927 { 928 RISCVCPU *cpu = RISCV_CPU(cs); 929 CPURISCVState *env = &cpu->env; 930 931 if (cs->watchpoint_hit) { 932 if (cs->watchpoint_hit->flags & BP_CPU) { 933 do_trigger_action(env, DBG_ACTION_BP); 934 } 935 } else { 936 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) { 937 do_trigger_action(env, DBG_ACTION_BP); 938 } 939 } 940 } 941 942 bool riscv_cpu_debug_check_breakpoint(CPUState *cs) 943 { 944 RISCVCPU *cpu = RISCV_CPU(cs); 945 CPURISCVState *env = &cpu->env; 946 CPUBreakpoint *bp; 947 target_ulong ctrl; 948 target_ulong pc; 949 int trigger_type; 950 int i; 951 952 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) { 953 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 954 trigger_type = get_trigger_type(env, i); 955 956 if (!trigger_common_match(env, trigger_type, i)) { 957 continue; 958 } 959 960 switch (trigger_type) { 961 case TRIGGER_TYPE_AD_MATCH: 962 ctrl = env->tdata1[i]; 963 pc = env->tdata2[i]; 964 965 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) { 966 env->badaddr = pc; 967 return true; 968 } 969 break; 970 case TRIGGER_TYPE_AD_MATCH6: 971 ctrl = env->tdata1[i]; 972 pc = env->tdata2[i]; 973 974 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) { 975 env->badaddr = pc; 976 return true; 977 } 978 break; 979 default: 980 /* other trigger types are not supported or irrelevant */ 981 break; 982 } 983 } 984 } 985 986 return false; 987 } 988 989 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) 990 { 991 RISCVCPU *cpu = RISCV_CPU(cs); 992 CPURISCVState *env = &cpu->env; 993 target_ulong ctrl; 994 target_ulong addr; 995 int trigger_type; 996 int flags; 997 int i; 998 999 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1000 trigger_type = get_trigger_type(env, i); 1001 1002 if (!trigger_common_match(env, trigger_type, i)) { 1003 continue; 1004 } 1005 1006 switch (trigger_type) { 1007 case TRIGGER_TYPE_AD_MATCH: 1008 ctrl = env->tdata1[i]; 1009 addr = env->tdata2[i]; 1010 flags = 0; 1011 1012 if (ctrl & TYPE2_LOAD) { 1013 flags |= BP_MEM_READ; 1014 } 1015 if (ctrl & TYPE2_STORE) { 1016 flags |= BP_MEM_WRITE; 1017 } 1018 1019 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1020 return true; 1021 } 1022 break; 1023 case TRIGGER_TYPE_AD_MATCH6: 1024 ctrl = env->tdata1[i]; 1025 addr = env->tdata2[i]; 1026 flags = 0; 1027 1028 if (ctrl & TYPE6_LOAD) { 1029 flags |= BP_MEM_READ; 1030 } 1031 if (ctrl & TYPE6_STORE) { 1032 flags |= BP_MEM_WRITE; 1033 } 1034 1035 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1036 return true; 1037 } 1038 break; 1039 default: 1040 /* other trigger types are not supported */ 1041 break; 1042 } 1043 } 1044 1045 return false; 1046 } 1047 1048 void riscv_trigger_realize(CPURISCVState *env) 1049 { 1050 int i; 1051 1052 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1053 env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL, 1054 riscv_itrigger_timer_cb, env); 1055 } 1056 } 1057 1058 void riscv_trigger_reset_hold(CPURISCVState *env) 1059 { 1060 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0); 1061 int i; 1062 1063 /* init to type 2 triggers */ 1064 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1065 /* 1066 * type = TRIGGER_TYPE_AD_MATCH 1067 * dmode = 0 (both debug and M-mode can write tdata) 1068 * maskmax = 0 (unimplemented, always 0) 1069 * sizehi = 0 (match against any size, RV64 only) 1070 * hit = 0 (unimplemented, always 0) 1071 * select = 0 (always 0, perform match on address) 1072 * timing = 0 (always 0, trigger before instruction) 1073 * sizelo = 0 (match against any size) 1074 * action = 0 (always 0, raise a breakpoint exception) 1075 * chain = 0 (unimplemented, always 0) 1076 * match = 0 (always 0, when any compare value equals tdata2) 1077 */ 1078 env->tdata1[i] = tdata1; 1079 env->tdata2[i] = 0; 1080 env->tdata3[i] = 0; 1081 env->cpu_breakpoint[i] = NULL; 1082 env->cpu_watchpoint[i] = NULL; 1083 timer_del(env->itrigger_timer[i]); 1084 } 1085 1086 env->mcontext = 0; 1087 } 1088