1 /* 2 * QEMU RISC-V Native Debug Support 3 * 4 * Copyright (c) 2022 Wind River Systems, Inc. 5 * 6 * Author: 7 * Bin Meng <bin.meng@windriver.com> 8 * 9 * This provides the native debug support via the Trigger Module, as defined 10 * in the RISC-V Debug Specification: 11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf 12 * 13 * This program is free software; you can redistribute it and/or modify it 14 * under the terms and conditions of the GNU General Public License, 15 * version 2 or later, as published by the Free Software Foundation. 16 * 17 * This program is distributed in the hope it will be useful, but WITHOUT 18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 20 * more details. 21 * 22 * You should have received a copy of the GNU General Public License along with 23 * this program. If not, see <http://www.gnu.org/licenses/>. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 #include "trace.h" 31 #include "exec/exec-all.h" 32 #include "exec/helper-proto.h" 33 #include "exec/watchpoint.h" 34 #include "system/cpu-timers.h" 35 #include "exec/icount.h" 36 37 /* 38 * The following M-mode trigger CSRs are implemented: 39 * 40 * - tselect 41 * - tdata1 42 * - tdata2 43 * - tdata3 44 * - tinfo 45 * 46 * The following triggers are initialized by default: 47 * 48 * Index | Type | tdata mapping | Description 49 * ------+------+------------------------+------------ 50 * 0 | 2 | tdata1, tdata2 | Address / Data Match 51 * 1 | 2 | tdata1, tdata2 | Address / Data Match 52 */ 53 54 /* tdata availability of a trigger */ 55 typedef bool tdata_avail[TDATA_NUM]; 56 57 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = { 58 [TRIGGER_TYPE_NO_EXIST] = { false, false, false }, 59 [TRIGGER_TYPE_AD_MATCH] = { true, true, true }, 60 [TRIGGER_TYPE_INST_CNT] = { true, false, true }, 61 [TRIGGER_TYPE_INT] = { true, true, true }, 62 [TRIGGER_TYPE_EXCP] = { true, true, true }, 63 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true }, 64 [TRIGGER_TYPE_EXT_SRC] = { true, false, false }, 65 [TRIGGER_TYPE_UNAVAIL] = { true, true, true } 66 }; 67 68 /* only breakpoint size 1/2/4/8 supported */ 69 static int access_size[SIZE_NUM] = { 70 [SIZE_ANY] = 0, 71 [SIZE_1B] = 1, 72 [SIZE_2B] = 2, 73 [SIZE_4B] = 4, 74 [SIZE_6B] = -1, 75 [SIZE_8B] = 8, 76 [6 ... 15] = -1, 77 }; 78 79 static inline target_ulong extract_trigger_type(CPURISCVState *env, 80 target_ulong tdata1) 81 { 82 switch (riscv_cpu_mxl(env)) { 83 case MXL_RV32: 84 return extract32(tdata1, 28, 4); 85 case MXL_RV64: 86 case MXL_RV128: 87 return extract64(tdata1, 60, 4); 88 default: 89 g_assert_not_reached(); 90 } 91 } 92 93 static inline target_ulong get_trigger_type(CPURISCVState *env, 94 target_ulong trigger_index) 95 { 96 return extract_trigger_type(env, env->tdata1[trigger_index]); 97 } 98 99 static trigger_action_t get_trigger_action(CPURISCVState *env, 100 target_ulong trigger_index) 101 { 102 target_ulong tdata1 = env->tdata1[trigger_index]; 103 int trigger_type = get_trigger_type(env, trigger_index); 104 trigger_action_t action = DBG_ACTION_NONE; 105 106 switch (trigger_type) { 107 case TRIGGER_TYPE_AD_MATCH: 108 action = (tdata1 & TYPE2_ACTION) >> 12; 109 break; 110 case TRIGGER_TYPE_AD_MATCH6: 111 action = (tdata1 & TYPE6_ACTION) >> 12; 112 break; 113 case TRIGGER_TYPE_INST_CNT: 114 case TRIGGER_TYPE_INT: 115 case TRIGGER_TYPE_EXCP: 116 case TRIGGER_TYPE_EXT_SRC: 117 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 118 trigger_type); 119 break; 120 case TRIGGER_TYPE_NO_EXIST: 121 case TRIGGER_TYPE_UNAVAIL: 122 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 123 trigger_type); 124 break; 125 default: 126 g_assert_not_reached(); 127 } 128 129 return action; 130 } 131 132 static inline target_ulong build_tdata1(CPURISCVState *env, 133 trigger_type_t type, 134 bool dmode, target_ulong data) 135 { 136 target_ulong tdata1; 137 138 switch (riscv_cpu_mxl(env)) { 139 case MXL_RV32: 140 tdata1 = RV32_TYPE(type) | 141 (dmode ? RV32_DMODE : 0) | 142 (data & RV32_DATA_MASK); 143 break; 144 case MXL_RV64: 145 case MXL_RV128: 146 tdata1 = RV64_TYPE(type) | 147 (dmode ? RV64_DMODE : 0) | 148 (data & RV64_DATA_MASK); 149 break; 150 default: 151 g_assert_not_reached(); 152 } 153 154 return tdata1; 155 } 156 157 bool tdata_available(CPURISCVState *env, int tdata_index) 158 { 159 int trigger_type = get_trigger_type(env, env->trigger_cur); 160 161 if (unlikely(tdata_index >= TDATA_NUM)) { 162 return false; 163 } 164 165 return tdata_mapping[trigger_type][tdata_index]; 166 } 167 168 target_ulong tselect_csr_read(CPURISCVState *env) 169 { 170 return env->trigger_cur; 171 } 172 173 void tselect_csr_write(CPURISCVState *env, target_ulong val) 174 { 175 if (val < RV_MAX_TRIGGERS) { 176 env->trigger_cur = val; 177 } 178 } 179 180 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val, 181 trigger_type_t t) 182 { 183 uint32_t type, dmode; 184 target_ulong tdata1; 185 186 switch (riscv_cpu_mxl(env)) { 187 case MXL_RV32: 188 type = extract32(val, 28, 4); 189 dmode = extract32(val, 27, 1); 190 tdata1 = RV32_TYPE(t); 191 break; 192 case MXL_RV64: 193 case MXL_RV128: 194 type = extract64(val, 60, 4); 195 dmode = extract64(val, 59, 1); 196 tdata1 = RV64_TYPE(t); 197 break; 198 default: 199 g_assert_not_reached(); 200 } 201 202 if (type != t) { 203 qemu_log_mask(LOG_GUEST_ERROR, 204 "ignoring type write to tdata1 register\n"); 205 } 206 207 if (dmode != 0) { 208 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n"); 209 } 210 211 return tdata1; 212 } 213 214 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask, 215 const char *msg) 216 { 217 if (val & mask) { 218 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg); 219 } 220 } 221 222 static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3) 223 { 224 target_ulong mhvalue, mhselect; 225 target_ulong mhselect_new; 226 target_ulong textra; 227 const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 }; 228 229 switch (riscv_cpu_mxl(env)) { 230 case MXL_RV32: 231 mhvalue = get_field(tdata3, TEXTRA32_MHVALUE); 232 mhselect = get_field(tdata3, TEXTRA32_MHSELECT); 233 /* Validate unimplemented (always zero) bits */ 234 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK, 235 "sbytemask"); 236 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE, 237 "svalue"); 238 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT, 239 "sselect"); 240 break; 241 case MXL_RV64: 242 case MXL_RV128: 243 mhvalue = get_field(tdata3, TEXTRA64_MHVALUE); 244 mhselect = get_field(tdata3, TEXTRA64_MHSELECT); 245 /* Validate unimplemented (always zero) bits */ 246 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK, 247 "sbytemask"); 248 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE, 249 "svalue"); 250 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT, 251 "sselect"); 252 break; 253 default: 254 g_assert_not_reached(); 255 } 256 257 /* Validate mhselect. */ 258 mhselect_new = mhselect_no_rvh[mhselect]; 259 if (mhselect != mhselect_new) { 260 qemu_log_mask(LOG_UNIMP, "mhselect only supports 0 or 4 for now\n"); 261 } 262 263 /* Write legal values into textra */ 264 textra = 0; 265 switch (riscv_cpu_mxl(env)) { 266 case MXL_RV32: 267 textra = set_field(textra, TEXTRA32_MHVALUE, mhvalue); 268 textra = set_field(textra, TEXTRA32_MHSELECT, mhselect_new); 269 break; 270 case MXL_RV64: 271 case MXL_RV128: 272 textra = set_field(textra, TEXTRA64_MHVALUE, mhvalue); 273 textra = set_field(textra, TEXTRA64_MHSELECT, mhselect_new); 274 break; 275 default: 276 g_assert_not_reached(); 277 } 278 279 return textra; 280 } 281 282 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index) 283 { 284 trigger_action_t action = get_trigger_action(env, trigger_index); 285 286 switch (action) { 287 case DBG_ACTION_NONE: 288 break; 289 case DBG_ACTION_BP: 290 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0); 291 break; 292 case DBG_ACTION_DBG_MODE: 293 case DBG_ACTION_TRACE0: 294 case DBG_ACTION_TRACE1: 295 case DBG_ACTION_TRACE2: 296 case DBG_ACTION_TRACE3: 297 case DBG_ACTION_EXT_DBG0: 298 case DBG_ACTION_EXT_DBG1: 299 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action); 300 break; 301 default: 302 g_assert_not_reached(); 303 } 304 } 305 306 /* 307 * Check the privilege level of specific trigger matches CPU's current privilege 308 * level. 309 */ 310 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type, 311 int trigger_index) 312 { 313 target_ulong ctrl = env->tdata1[trigger_index]; 314 315 switch (type) { 316 case TRIGGER_TYPE_AD_MATCH: 317 /* type 2 trigger cannot be fired in VU/VS mode */ 318 if (env->virt_enabled) { 319 return false; 320 } 321 /* check U/S/M bit against current privilege level */ 322 if ((ctrl >> 3) & BIT(env->priv)) { 323 return true; 324 } 325 break; 326 case TRIGGER_TYPE_AD_MATCH6: 327 if (env->virt_enabled) { 328 /* check VU/VS bit against current privilege level */ 329 if ((ctrl >> 23) & BIT(env->priv)) { 330 return true; 331 } 332 } else { 333 /* check U/S/M bit against current privilege level */ 334 if ((ctrl >> 3) & BIT(env->priv)) { 335 return true; 336 } 337 } 338 break; 339 case TRIGGER_TYPE_INST_CNT: 340 if (env->virt_enabled) { 341 /* check VU/VS bit against current privilege level */ 342 if ((ctrl >> 25) & BIT(env->priv)) { 343 return true; 344 } 345 } else { 346 /* check U/S/M bit against current privilege level */ 347 if ((ctrl >> 6) & BIT(env->priv)) { 348 return true; 349 } 350 } 351 break; 352 case TRIGGER_TYPE_INT: 353 case TRIGGER_TYPE_EXCP: 354 case TRIGGER_TYPE_EXT_SRC: 355 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", type); 356 break; 357 case TRIGGER_TYPE_NO_EXIST: 358 case TRIGGER_TYPE_UNAVAIL: 359 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exist\n", 360 type); 361 break; 362 default: 363 g_assert_not_reached(); 364 } 365 366 return false; 367 } 368 369 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type, 370 int trigger_index) 371 { 372 target_ulong textra = env->tdata3[trigger_index]; 373 target_ulong mhvalue, mhselect; 374 375 if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) { 376 /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */ 377 return true; 378 } 379 380 switch (riscv_cpu_mxl(env)) { 381 case MXL_RV32: 382 mhvalue = get_field(textra, TEXTRA32_MHVALUE); 383 mhselect = get_field(textra, TEXTRA32_MHSELECT); 384 break; 385 case MXL_RV64: 386 case MXL_RV128: 387 mhvalue = get_field(textra, TEXTRA64_MHVALUE); 388 mhselect = get_field(textra, TEXTRA64_MHSELECT); 389 break; 390 default: 391 g_assert_not_reached(); 392 } 393 394 /* Check mhvalue and mhselect. */ 395 switch (mhselect) { 396 case MHSELECT_IGNORE: 397 break; 398 case MHSELECT_MCONTEXT: 399 /* Match if the low bits of mcontext/hcontext equal mhvalue. */ 400 if (mhvalue != env->mcontext) { 401 return false; 402 } 403 break; 404 default: 405 break; 406 } 407 408 return true; 409 } 410 411 /* Common matching conditions for all types of the triggers. */ 412 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type, 413 int trigger_index) 414 { 415 return trigger_priv_match(env, type, trigger_index) && 416 trigger_textra_match(env, type, trigger_index); 417 } 418 419 /* type 2 trigger */ 420 421 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl) 422 { 423 uint32_t sizelo, sizehi = 0; 424 425 if (riscv_cpu_mxl(env) == MXL_RV64) { 426 sizehi = extract32(ctrl, 21, 2); 427 } 428 sizelo = extract32(ctrl, 16, 2); 429 return (sizehi << 2) | sizelo; 430 } 431 432 static inline bool type2_breakpoint_enabled(target_ulong ctrl) 433 { 434 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M)); 435 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 436 437 return mode && rwx; 438 } 439 440 static target_ulong type2_mcontrol_validate(CPURISCVState *env, 441 target_ulong ctrl) 442 { 443 target_ulong val; 444 uint32_t size; 445 446 /* validate the generic part first */ 447 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH); 448 449 /* validate unimplemented (always zero) bits */ 450 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match"); 451 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain"); 452 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action"); 453 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing"); 454 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select"); 455 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit"); 456 457 /* validate size encoding */ 458 size = type2_breakpoint_size(env, ctrl); 459 if (access_size[size] == -1) { 460 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 461 "SIZE_ANY\n", size); 462 } else { 463 val |= (ctrl & TYPE2_SIZELO); 464 if (riscv_cpu_mxl(env) == MXL_RV64) { 465 val |= (ctrl & TYPE2_SIZEHI); 466 } 467 } 468 469 /* keep the mode and attribute bits */ 470 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M | 471 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 472 473 return val; 474 } 475 476 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index) 477 { 478 target_ulong ctrl = env->tdata1[index]; 479 target_ulong addr = env->tdata2[index]; 480 bool enabled = type2_breakpoint_enabled(ctrl); 481 CPUState *cs = env_cpu(env); 482 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 483 uint32_t size, def_size; 484 485 if (!enabled) { 486 return; 487 } 488 489 if (ctrl & TYPE2_EXEC) { 490 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 491 } 492 493 if (ctrl & TYPE2_LOAD) { 494 flags |= BP_MEM_READ; 495 } 496 if (ctrl & TYPE2_STORE) { 497 flags |= BP_MEM_WRITE; 498 } 499 500 if (flags & BP_MEM_ACCESS) { 501 size = type2_breakpoint_size(env, ctrl); 502 if (size != 0) { 503 cpu_watchpoint_insert(cs, addr, size, flags, 504 &env->cpu_watchpoint[index]); 505 } else { 506 def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4; 507 508 cpu_watchpoint_insert(cs, addr, def_size, flags, 509 &env->cpu_watchpoint[index]); 510 } 511 } 512 } 513 514 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index) 515 { 516 CPUState *cs = env_cpu(env); 517 518 if (env->cpu_breakpoint[index]) { 519 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]); 520 env->cpu_breakpoint[index] = NULL; 521 } 522 523 if (env->cpu_watchpoint[index]) { 524 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]); 525 env->cpu_watchpoint[index] = NULL; 526 } 527 } 528 529 static void type2_reg_write(CPURISCVState *env, target_ulong index, 530 int tdata_index, target_ulong val) 531 { 532 target_ulong new_val; 533 534 switch (tdata_index) { 535 case TDATA1: 536 new_val = type2_mcontrol_validate(env, val); 537 if (new_val != env->tdata1[index]) { 538 env->tdata1[index] = new_val; 539 type2_breakpoint_remove(env, index); 540 type2_breakpoint_insert(env, index); 541 } 542 break; 543 case TDATA2: 544 if (val != env->tdata2[index]) { 545 env->tdata2[index] = val; 546 type2_breakpoint_remove(env, index); 547 type2_breakpoint_insert(env, index); 548 } 549 break; 550 case TDATA3: 551 env->tdata3[index] = textra_validate(env, val); 552 break; 553 default: 554 g_assert_not_reached(); 555 } 556 557 return; 558 } 559 560 /* type 6 trigger */ 561 562 static inline bool type6_breakpoint_enabled(target_ulong ctrl) 563 { 564 bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M)); 565 bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 566 567 return mode && rwx; 568 } 569 570 static target_ulong type6_mcontrol6_validate(CPURISCVState *env, 571 target_ulong ctrl) 572 { 573 target_ulong val; 574 uint32_t size; 575 576 /* validate the generic part first */ 577 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6); 578 579 /* validate unimplemented (always zero) bits */ 580 warn_always_zero_bit(ctrl, TYPE6_MATCH, "match"); 581 warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain"); 582 warn_always_zero_bit(ctrl, TYPE6_ACTION, "action"); 583 warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing"); 584 warn_always_zero_bit(ctrl, TYPE6_SELECT, "select"); 585 warn_always_zero_bit(ctrl, TYPE6_HIT, "hit"); 586 587 /* validate size encoding */ 588 size = extract32(ctrl, 16, 4); 589 if (access_size[size] == -1) { 590 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using " 591 "SIZE_ANY\n", size); 592 } else { 593 val |= (ctrl & TYPE6_SIZE); 594 } 595 596 /* keep the mode and attribute bits */ 597 val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M | 598 TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 599 600 return val; 601 } 602 603 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index) 604 { 605 target_ulong ctrl = env->tdata1[index]; 606 target_ulong addr = env->tdata2[index]; 607 bool enabled = type6_breakpoint_enabled(ctrl); 608 CPUState *cs = env_cpu(env); 609 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 610 uint32_t size; 611 612 if (!enabled) { 613 return; 614 } 615 616 if (ctrl & TYPE6_EXEC) { 617 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 618 } 619 620 if (ctrl & TYPE6_LOAD) { 621 flags |= BP_MEM_READ; 622 } 623 624 if (ctrl & TYPE6_STORE) { 625 flags |= BP_MEM_WRITE; 626 } 627 628 if (flags & BP_MEM_ACCESS) { 629 size = extract32(ctrl, 16, 4); 630 if (size != 0) { 631 cpu_watchpoint_insert(cs, addr, size, flags, 632 &env->cpu_watchpoint[index]); 633 } else { 634 cpu_watchpoint_insert(cs, addr, 8, flags, 635 &env->cpu_watchpoint[index]); 636 } 637 } 638 } 639 640 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index) 641 { 642 type2_breakpoint_remove(env, index); 643 } 644 645 static void type6_reg_write(CPURISCVState *env, target_ulong index, 646 int tdata_index, target_ulong val) 647 { 648 target_ulong new_val; 649 650 switch (tdata_index) { 651 case TDATA1: 652 new_val = type6_mcontrol6_validate(env, val); 653 if (new_val != env->tdata1[index]) { 654 env->tdata1[index] = new_val; 655 type6_breakpoint_remove(env, index); 656 type6_breakpoint_insert(env, index); 657 } 658 break; 659 case TDATA2: 660 if (val != env->tdata2[index]) { 661 env->tdata2[index] = val; 662 type6_breakpoint_remove(env, index); 663 type6_breakpoint_insert(env, index); 664 } 665 break; 666 case TDATA3: 667 env->tdata3[index] = textra_validate(env, val); 668 break; 669 default: 670 g_assert_not_reached(); 671 } 672 673 return; 674 } 675 676 /* icount trigger type */ 677 static inline int 678 itrigger_get_count(CPURISCVState *env, int index) 679 { 680 return get_field(env->tdata1[index], ITRIGGER_COUNT); 681 } 682 683 static inline void 684 itrigger_set_count(CPURISCVState *env, int index, int value) 685 { 686 env->tdata1[index] = set_field(env->tdata1[index], 687 ITRIGGER_COUNT, value); 688 } 689 690 static bool check_itrigger_priv(CPURISCVState *env, int index) 691 { 692 target_ulong tdata1 = env->tdata1[index]; 693 if (env->virt_enabled) { 694 /* check VU/VS bit against current privilege level */ 695 return (get_field(tdata1, ITRIGGER_VS) == env->priv) || 696 (get_field(tdata1, ITRIGGER_VU) == env->priv); 697 } else { 698 /* check U/S/M bit against current privilege level */ 699 return (get_field(tdata1, ITRIGGER_M) == env->priv) || 700 (get_field(tdata1, ITRIGGER_S) == env->priv) || 701 (get_field(tdata1, ITRIGGER_U) == env->priv); 702 } 703 } 704 705 bool riscv_itrigger_enabled(CPURISCVState *env) 706 { 707 int count; 708 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 709 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 710 continue; 711 } 712 if (check_itrigger_priv(env, i)) { 713 continue; 714 } 715 count = itrigger_get_count(env, i); 716 if (!count) { 717 continue; 718 } 719 return true; 720 } 721 722 return false; 723 } 724 725 void helper_itrigger_match(CPURISCVState *env) 726 { 727 int count; 728 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 729 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 730 continue; 731 } 732 if (!trigger_common_match(env, TRIGGER_TYPE_INST_CNT, i)) { 733 continue; 734 } 735 count = itrigger_get_count(env, i); 736 if (!count) { 737 continue; 738 } 739 itrigger_set_count(env, i, count--); 740 if (!count) { 741 env->itrigger_enabled = riscv_itrigger_enabled(env); 742 do_trigger_action(env, i); 743 } 744 } 745 } 746 747 static void riscv_itrigger_update_count(CPURISCVState *env) 748 { 749 int count, executed; 750 /* 751 * Record last icount, so that we can evaluate the executed instructions 752 * since last privilege mode change or timer expire. 753 */ 754 int64_t last_icount = env->last_icount, current_icount; 755 current_icount = env->last_icount = icount_get_raw(); 756 757 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 758 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 759 continue; 760 } 761 count = itrigger_get_count(env, i); 762 if (!count) { 763 continue; 764 } 765 /* 766 * Only when privilege is changed or itrigger timer expires, 767 * the count field in itrigger tdata1 register is updated. 768 * And the count field in itrigger only contains remaining value. 769 */ 770 if (check_itrigger_priv(env, i)) { 771 /* 772 * If itrigger enabled in this privilege mode, the number of 773 * executed instructions since last privilege change 774 * should be reduced from current itrigger count. 775 */ 776 executed = current_icount - last_icount; 777 itrigger_set_count(env, i, count - executed); 778 if (count == executed) { 779 do_trigger_action(env, i); 780 } 781 } else { 782 /* 783 * If itrigger is not enabled in this privilege mode, 784 * the number of executed instructions will be discard and 785 * the count field in itrigger will not change. 786 */ 787 timer_mod(env->itrigger_timer[i], 788 current_icount + count); 789 } 790 } 791 } 792 793 static void riscv_itrigger_timer_cb(void *opaque) 794 { 795 riscv_itrigger_update_count((CPURISCVState *)opaque); 796 } 797 798 void riscv_itrigger_update_priv(CPURISCVState *env) 799 { 800 riscv_itrigger_update_count(env); 801 } 802 803 static target_ulong itrigger_validate(CPURISCVState *env, 804 target_ulong ctrl) 805 { 806 target_ulong val; 807 808 /* validate the generic part first */ 809 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT); 810 811 /* validate unimplemented (always zero) bits */ 812 warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action"); 813 warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit"); 814 warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending"); 815 816 /* keep the mode and attribute bits */ 817 val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S | 818 ITRIGGER_M | ITRIGGER_COUNT); 819 820 return val; 821 } 822 823 static void itrigger_reg_write(CPURISCVState *env, target_ulong index, 824 int tdata_index, target_ulong val) 825 { 826 target_ulong new_val; 827 828 switch (tdata_index) { 829 case TDATA1: 830 /* set timer for icount */ 831 new_val = itrigger_validate(env, val); 832 if (new_val != env->tdata1[index]) { 833 env->tdata1[index] = new_val; 834 if (icount_enabled()) { 835 env->last_icount = icount_get_raw(); 836 /* set the count to timer */ 837 timer_mod(env->itrigger_timer[index], 838 env->last_icount + itrigger_get_count(env, index)); 839 } else { 840 env->itrigger_enabled = riscv_itrigger_enabled(env); 841 } 842 } 843 break; 844 case TDATA2: 845 qemu_log_mask(LOG_UNIMP, 846 "tdata2 is not supported for icount trigger\n"); 847 break; 848 case TDATA3: 849 env->tdata3[index] = textra_validate(env, val); 850 break; 851 default: 852 g_assert_not_reached(); 853 } 854 855 return; 856 } 857 858 static int itrigger_get_adjust_count(CPURISCVState *env) 859 { 860 int count = itrigger_get_count(env, env->trigger_cur), executed; 861 if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) { 862 executed = icount_get_raw() - env->last_icount; 863 count += executed; 864 } 865 return count; 866 } 867 868 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index) 869 { 870 int trigger_type; 871 switch (tdata_index) { 872 case TDATA1: 873 trigger_type = extract_trigger_type(env, 874 env->tdata1[env->trigger_cur]); 875 if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) { 876 return deposit64(env->tdata1[env->trigger_cur], 10, 14, 877 itrigger_get_adjust_count(env)); 878 } 879 return env->tdata1[env->trigger_cur]; 880 case TDATA2: 881 return env->tdata2[env->trigger_cur]; 882 case TDATA3: 883 return env->tdata3[env->trigger_cur]; 884 default: 885 g_assert_not_reached(); 886 } 887 } 888 889 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val) 890 { 891 int trigger_type; 892 893 if (tdata_index == TDATA1) { 894 trigger_type = extract_trigger_type(env, val); 895 } else { 896 trigger_type = get_trigger_type(env, env->trigger_cur); 897 } 898 899 switch (trigger_type) { 900 case TRIGGER_TYPE_AD_MATCH: 901 type2_reg_write(env, env->trigger_cur, tdata_index, val); 902 break; 903 case TRIGGER_TYPE_AD_MATCH6: 904 type6_reg_write(env, env->trigger_cur, tdata_index, val); 905 break; 906 case TRIGGER_TYPE_INST_CNT: 907 itrigger_reg_write(env, env->trigger_cur, tdata_index, val); 908 break; 909 case TRIGGER_TYPE_INT: 910 case TRIGGER_TYPE_EXCP: 911 case TRIGGER_TYPE_EXT_SRC: 912 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 913 trigger_type); 914 break; 915 case TRIGGER_TYPE_NO_EXIST: 916 case TRIGGER_TYPE_UNAVAIL: 917 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 918 trigger_type); 919 break; 920 default: 921 g_assert_not_reached(); 922 } 923 } 924 925 target_ulong tinfo_csr_read(CPURISCVState *env) 926 { 927 /* assume all triggers support the same types of triggers */ 928 return BIT(TRIGGER_TYPE_AD_MATCH) | 929 BIT(TRIGGER_TYPE_AD_MATCH6); 930 } 931 932 void riscv_cpu_debug_excp_handler(CPUState *cs) 933 { 934 RISCVCPU *cpu = RISCV_CPU(cs); 935 CPURISCVState *env = &cpu->env; 936 937 if (cs->watchpoint_hit) { 938 if (cs->watchpoint_hit->flags & BP_CPU) { 939 do_trigger_action(env, DBG_ACTION_BP); 940 } 941 } else { 942 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) { 943 do_trigger_action(env, DBG_ACTION_BP); 944 } 945 } 946 } 947 948 bool riscv_cpu_debug_check_breakpoint(CPUState *cs) 949 { 950 RISCVCPU *cpu = RISCV_CPU(cs); 951 CPURISCVState *env = &cpu->env; 952 CPUBreakpoint *bp; 953 target_ulong ctrl; 954 target_ulong pc; 955 int trigger_type; 956 int i; 957 958 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) { 959 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 960 trigger_type = get_trigger_type(env, i); 961 962 if (!trigger_common_match(env, trigger_type, i)) { 963 continue; 964 } 965 966 switch (trigger_type) { 967 case TRIGGER_TYPE_AD_MATCH: 968 ctrl = env->tdata1[i]; 969 pc = env->tdata2[i]; 970 971 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) { 972 env->badaddr = pc; 973 return true; 974 } 975 break; 976 case TRIGGER_TYPE_AD_MATCH6: 977 ctrl = env->tdata1[i]; 978 pc = env->tdata2[i]; 979 980 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) { 981 env->badaddr = pc; 982 return true; 983 } 984 break; 985 default: 986 /* other trigger types are not supported or irrelevant */ 987 break; 988 } 989 } 990 } 991 992 return false; 993 } 994 995 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) 996 { 997 RISCVCPU *cpu = RISCV_CPU(cs); 998 CPURISCVState *env = &cpu->env; 999 target_ulong ctrl; 1000 target_ulong addr; 1001 int trigger_type; 1002 int flags; 1003 int i; 1004 1005 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1006 trigger_type = get_trigger_type(env, i); 1007 1008 if (!trigger_common_match(env, trigger_type, i)) { 1009 continue; 1010 } 1011 1012 switch (trigger_type) { 1013 case TRIGGER_TYPE_AD_MATCH: 1014 ctrl = env->tdata1[i]; 1015 addr = env->tdata2[i]; 1016 flags = 0; 1017 1018 if (ctrl & TYPE2_LOAD) { 1019 flags |= BP_MEM_READ; 1020 } 1021 if (ctrl & TYPE2_STORE) { 1022 flags |= BP_MEM_WRITE; 1023 } 1024 1025 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1026 return true; 1027 } 1028 break; 1029 case TRIGGER_TYPE_AD_MATCH6: 1030 ctrl = env->tdata1[i]; 1031 addr = env->tdata2[i]; 1032 flags = 0; 1033 1034 if (ctrl & TYPE6_LOAD) { 1035 flags |= BP_MEM_READ; 1036 } 1037 if (ctrl & TYPE6_STORE) { 1038 flags |= BP_MEM_WRITE; 1039 } 1040 1041 if ((wp->flags & flags) && (wp->vaddr == addr)) { 1042 return true; 1043 } 1044 break; 1045 default: 1046 /* other trigger types are not supported */ 1047 break; 1048 } 1049 } 1050 1051 return false; 1052 } 1053 1054 void riscv_trigger_realize(CPURISCVState *env) 1055 { 1056 int i; 1057 1058 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1059 env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL, 1060 riscv_itrigger_timer_cb, env); 1061 } 1062 } 1063 1064 void riscv_trigger_reset_hold(CPURISCVState *env) 1065 { 1066 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0); 1067 int i; 1068 1069 /* init to type 2 triggers */ 1070 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 1071 /* 1072 * type = TRIGGER_TYPE_AD_MATCH 1073 * dmode = 0 (both debug and M-mode can write tdata) 1074 * maskmax = 0 (unimplemented, always 0) 1075 * sizehi = 0 (match against any size, RV64 only) 1076 * hit = 0 (unimplemented, always 0) 1077 * select = 0 (always 0, perform match on address) 1078 * timing = 0 (always 0, trigger before instruction) 1079 * sizelo = 0 (match against any size) 1080 * action = 0 (always 0, raise a breakpoint exception) 1081 * chain = 0 (unimplemented, always 0) 1082 * match = 0 (always 0, when any compare value equals tdata2) 1083 */ 1084 env->tdata1[i] = tdata1; 1085 env->tdata2[i] = 0; 1086 env->tdata3[i] = 0; 1087 env->cpu_breakpoint[i] = NULL; 1088 env->cpu_watchpoint[i] = NULL; 1089 timer_del(env->itrigger_timer[i]); 1090 } 1091 1092 env->mcontext = 0; 1093 } 1094