1 /*
2 * QEMU RISC-V Native Debug Support
3 *
4 * Copyright (c) 2022 Wind River Systems, Inc.
5 *
6 * Author:
7 * Bin Meng <bin.meng@windriver.com>
8 *
9 * This provides the native debug support via the Trigger Module, as defined
10 * in the RISC-V Debug Specification:
11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms and conditions of the GNU General Public License,
15 * version 2 or later, as published by the Free Software Foundation.
16 *
17 * This program is distributed in the hope it will be useful, but WITHOUT
18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
20 * more details.
21 *
22 * You should have received a copy of the GNU General Public License along with
23 * this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "qemu/osdep.h"
27 #include "qemu/log.h"
28 #include "qapi/error.h"
29 #include "cpu.h"
30 #include "trace.h"
31 #include "exec/exec-all.h"
32 #include "exec/helper-proto.h"
33 #include "sysemu/cpu-timers.h"
34
35 /*
36 * The following M-mode trigger CSRs are implemented:
37 *
38 * - tselect
39 * - tdata1
40 * - tdata2
41 * - tdata3
42 * - tinfo
43 *
44 * The following triggers are initialized by default:
45 *
46 * Index | Type | tdata mapping | Description
47 * ------+------+------------------------+------------
48 * 0 | 2 | tdata1, tdata2 | Address / Data Match
49 * 1 | 2 | tdata1, tdata2 | Address / Data Match
50 */
51
52 /* tdata availability of a trigger */
53 typedef bool tdata_avail[TDATA_NUM];
54
55 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = {
56 [TRIGGER_TYPE_NO_EXIST] = { false, false, false },
57 [TRIGGER_TYPE_AD_MATCH] = { true, true, true },
58 [TRIGGER_TYPE_INST_CNT] = { true, false, true },
59 [TRIGGER_TYPE_INT] = { true, true, true },
60 [TRIGGER_TYPE_EXCP] = { true, true, true },
61 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true },
62 [TRIGGER_TYPE_EXT_SRC] = { true, false, false },
63 [TRIGGER_TYPE_UNAVAIL] = { true, true, true }
64 };
65
66 /* only breakpoint size 1/2/4/8 supported */
67 static int access_size[SIZE_NUM] = {
68 [SIZE_ANY] = 0,
69 [SIZE_1B] = 1,
70 [SIZE_2B] = 2,
71 [SIZE_4B] = 4,
72 [SIZE_6B] = -1,
73 [SIZE_8B] = 8,
74 [6 ... 15] = -1,
75 };
76
extract_trigger_type(CPURISCVState * env,target_ulong tdata1)77 static inline target_ulong extract_trigger_type(CPURISCVState *env,
78 target_ulong tdata1)
79 {
80 switch (riscv_cpu_mxl(env)) {
81 case MXL_RV32:
82 return extract32(tdata1, 28, 4);
83 case MXL_RV64:
84 case MXL_RV128:
85 return extract64(tdata1, 60, 4);
86 default:
87 g_assert_not_reached();
88 }
89 }
90
get_trigger_type(CPURISCVState * env,target_ulong trigger_index)91 static inline target_ulong get_trigger_type(CPURISCVState *env,
92 target_ulong trigger_index)
93 {
94 return extract_trigger_type(env, env->tdata1[trigger_index]);
95 }
96
get_trigger_action(CPURISCVState * env,target_ulong trigger_index)97 static trigger_action_t get_trigger_action(CPURISCVState *env,
98 target_ulong trigger_index)
99 {
100 target_ulong tdata1 = env->tdata1[trigger_index];
101 int trigger_type = get_trigger_type(env, trigger_index);
102 trigger_action_t action = DBG_ACTION_NONE;
103
104 switch (trigger_type) {
105 case TRIGGER_TYPE_AD_MATCH:
106 action = (tdata1 & TYPE2_ACTION) >> 12;
107 break;
108 case TRIGGER_TYPE_AD_MATCH6:
109 action = (tdata1 & TYPE6_ACTION) >> 12;
110 break;
111 case TRIGGER_TYPE_INST_CNT:
112 case TRIGGER_TYPE_INT:
113 case TRIGGER_TYPE_EXCP:
114 case TRIGGER_TYPE_EXT_SRC:
115 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
116 trigger_type);
117 break;
118 case TRIGGER_TYPE_NO_EXIST:
119 case TRIGGER_TYPE_UNAVAIL:
120 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
121 trigger_type);
122 break;
123 default:
124 g_assert_not_reached();
125 }
126
127 return action;
128 }
129
build_tdata1(CPURISCVState * env,trigger_type_t type,bool dmode,target_ulong data)130 static inline target_ulong build_tdata1(CPURISCVState *env,
131 trigger_type_t type,
132 bool dmode, target_ulong data)
133 {
134 target_ulong tdata1;
135
136 switch (riscv_cpu_mxl(env)) {
137 case MXL_RV32:
138 tdata1 = RV32_TYPE(type) |
139 (dmode ? RV32_DMODE : 0) |
140 (data & RV32_DATA_MASK);
141 break;
142 case MXL_RV64:
143 case MXL_RV128:
144 tdata1 = RV64_TYPE(type) |
145 (dmode ? RV64_DMODE : 0) |
146 (data & RV64_DATA_MASK);
147 break;
148 default:
149 g_assert_not_reached();
150 }
151
152 return tdata1;
153 }
154
tdata_available(CPURISCVState * env,int tdata_index)155 bool tdata_available(CPURISCVState *env, int tdata_index)
156 {
157 int trigger_type = get_trigger_type(env, env->trigger_cur);
158
159 if (unlikely(tdata_index >= TDATA_NUM)) {
160 return false;
161 }
162
163 return tdata_mapping[trigger_type][tdata_index];
164 }
165
tselect_csr_read(CPURISCVState * env)166 target_ulong tselect_csr_read(CPURISCVState *env)
167 {
168 return env->trigger_cur;
169 }
170
tselect_csr_write(CPURISCVState * env,target_ulong val)171 void tselect_csr_write(CPURISCVState *env, target_ulong val)
172 {
173 if (val < RV_MAX_TRIGGERS) {
174 env->trigger_cur = val;
175 }
176 }
177
tdata1_validate(CPURISCVState * env,target_ulong val,trigger_type_t t)178 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
179 trigger_type_t t)
180 {
181 uint32_t type, dmode;
182 target_ulong tdata1;
183
184 switch (riscv_cpu_mxl(env)) {
185 case MXL_RV32:
186 type = extract32(val, 28, 4);
187 dmode = extract32(val, 27, 1);
188 tdata1 = RV32_TYPE(t);
189 break;
190 case MXL_RV64:
191 case MXL_RV128:
192 type = extract64(val, 60, 4);
193 dmode = extract64(val, 59, 1);
194 tdata1 = RV64_TYPE(t);
195 break;
196 default:
197 g_assert_not_reached();
198 }
199
200 if (type != t) {
201 qemu_log_mask(LOG_GUEST_ERROR,
202 "ignoring type write to tdata1 register\n");
203 }
204
205 if (dmode != 0) {
206 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n");
207 }
208
209 return tdata1;
210 }
211
warn_always_zero_bit(target_ulong val,target_ulong mask,const char * msg)212 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
213 const char *msg)
214 {
215 if (val & mask) {
216 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg);
217 }
218 }
219
textra_validate(CPURISCVState * env,target_ulong tdata3)220 static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
221 {
222 target_ulong mhvalue, mhselect;
223 target_ulong mhselect_new;
224 target_ulong textra;
225 const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 };
226
227 switch (riscv_cpu_mxl(env)) {
228 case MXL_RV32:
229 mhvalue = get_field(tdata3, TEXTRA32_MHVALUE);
230 mhselect = get_field(tdata3, TEXTRA32_MHSELECT);
231 /* Validate unimplemented (always zero) bits */
232 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK,
233 "sbytemask");
234 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE,
235 "svalue");
236 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT,
237 "sselect");
238 break;
239 case MXL_RV64:
240 case MXL_RV128:
241 mhvalue = get_field(tdata3, TEXTRA64_MHVALUE);
242 mhselect = get_field(tdata3, TEXTRA64_MHSELECT);
243 /* Validate unimplemented (always zero) bits */
244 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK,
245 "sbytemask");
246 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE,
247 "svalue");
248 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT,
249 "sselect");
250 break;
251 default:
252 g_assert_not_reached();
253 }
254
255 /* Validate mhselect. */
256 mhselect_new = mhselect_no_rvh[mhselect];
257 if (mhselect != mhselect_new) {
258 qemu_log_mask(LOG_UNIMP, "mhselect only supports 0 or 4 for now\n");
259 }
260
261 /* Write legal values into textra */
262 textra = 0;
263 switch (riscv_cpu_mxl(env)) {
264 case MXL_RV32:
265 textra = set_field(textra, TEXTRA32_MHVALUE, mhvalue);
266 textra = set_field(textra, TEXTRA32_MHSELECT, mhselect_new);
267 break;
268 case MXL_RV64:
269 case MXL_RV128:
270 textra = set_field(textra, TEXTRA64_MHVALUE, mhvalue);
271 textra = set_field(textra, TEXTRA64_MHSELECT, mhselect_new);
272 break;
273 default:
274 g_assert_not_reached();
275 }
276
277 return textra;
278 }
279
do_trigger_action(CPURISCVState * env,target_ulong trigger_index)280 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
281 {
282 trigger_action_t action = get_trigger_action(env, trigger_index);
283
284 switch (action) {
285 case DBG_ACTION_NONE:
286 break;
287 case DBG_ACTION_BP:
288 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
289 break;
290 case DBG_ACTION_DBG_MODE:
291 case DBG_ACTION_TRACE0:
292 case DBG_ACTION_TRACE1:
293 case DBG_ACTION_TRACE2:
294 case DBG_ACTION_TRACE3:
295 case DBG_ACTION_EXT_DBG0:
296 case DBG_ACTION_EXT_DBG1:
297 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action);
298 break;
299 default:
300 g_assert_not_reached();
301 }
302 }
303
304 /*
305 * Check the privilege level of specific trigger matches CPU's current privilege
306 * level.
307 */
trigger_priv_match(CPURISCVState * env,trigger_type_t type,int trigger_index)308 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type,
309 int trigger_index)
310 {
311 target_ulong ctrl = env->tdata1[trigger_index];
312
313 switch (type) {
314 case TRIGGER_TYPE_AD_MATCH:
315 /* type 2 trigger cannot be fired in VU/VS mode */
316 if (env->virt_enabled) {
317 return false;
318 }
319 /* check U/S/M bit against current privilege level */
320 if ((ctrl >> 3) & BIT(env->priv)) {
321 return true;
322 }
323 break;
324 case TRIGGER_TYPE_AD_MATCH6:
325 if (env->virt_enabled) {
326 /* check VU/VS bit against current privilege level */
327 if ((ctrl >> 23) & BIT(env->priv)) {
328 return true;
329 }
330 } else {
331 /* check U/S/M bit against current privilege level */
332 if ((ctrl >> 3) & BIT(env->priv)) {
333 return true;
334 }
335 }
336 break;
337 case TRIGGER_TYPE_INST_CNT:
338 if (env->virt_enabled) {
339 /* check VU/VS bit against current privilege level */
340 if ((ctrl >> 25) & BIT(env->priv)) {
341 return true;
342 }
343 } else {
344 /* check U/S/M bit against current privilege level */
345 if ((ctrl >> 6) & BIT(env->priv)) {
346 return true;
347 }
348 }
349 break;
350 case TRIGGER_TYPE_INT:
351 case TRIGGER_TYPE_EXCP:
352 case TRIGGER_TYPE_EXT_SRC:
353 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", type);
354 break;
355 case TRIGGER_TYPE_NO_EXIST:
356 case TRIGGER_TYPE_UNAVAIL:
357 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exist\n",
358 type);
359 break;
360 default:
361 g_assert_not_reached();
362 }
363
364 return false;
365 }
366
trigger_textra_match(CPURISCVState * env,trigger_type_t type,int trigger_index)367 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type,
368 int trigger_index)
369 {
370 target_ulong textra = env->tdata3[trigger_index];
371 target_ulong mhvalue, mhselect;
372
373 if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) {
374 /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */
375 return true;
376 }
377
378 switch (riscv_cpu_mxl(env)) {
379 case MXL_RV32:
380 mhvalue = get_field(textra, TEXTRA32_MHVALUE);
381 mhselect = get_field(textra, TEXTRA32_MHSELECT);
382 break;
383 case MXL_RV64:
384 case MXL_RV128:
385 mhvalue = get_field(textra, TEXTRA64_MHVALUE);
386 mhselect = get_field(textra, TEXTRA64_MHSELECT);
387 break;
388 default:
389 g_assert_not_reached();
390 }
391
392 /* Check mhvalue and mhselect. */
393 switch (mhselect) {
394 case MHSELECT_IGNORE:
395 break;
396 case MHSELECT_MCONTEXT:
397 /* Match if the low bits of mcontext/hcontext equal mhvalue. */
398 if (mhvalue != env->mcontext) {
399 return false;
400 }
401 break;
402 default:
403 break;
404 }
405
406 return true;
407 }
408
409 /* Common matching conditions for all types of the triggers. */
trigger_common_match(CPURISCVState * env,trigger_type_t type,int trigger_index)410 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type,
411 int trigger_index)
412 {
413 return trigger_priv_match(env, type, trigger_index) &&
414 trigger_textra_match(env, type, trigger_index);
415 }
416
417 /* type 2 trigger */
418
type2_breakpoint_size(CPURISCVState * env,target_ulong ctrl)419 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
420 {
421 uint32_t sizelo, sizehi = 0;
422
423 if (riscv_cpu_mxl(env) == MXL_RV64) {
424 sizehi = extract32(ctrl, 21, 2);
425 }
426 sizelo = extract32(ctrl, 16, 2);
427 return (sizehi << 2) | sizelo;
428 }
429
type2_breakpoint_enabled(target_ulong ctrl)430 static inline bool type2_breakpoint_enabled(target_ulong ctrl)
431 {
432 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M));
433 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
434
435 return mode && rwx;
436 }
437
type2_mcontrol_validate(CPURISCVState * env,target_ulong ctrl)438 static target_ulong type2_mcontrol_validate(CPURISCVState *env,
439 target_ulong ctrl)
440 {
441 target_ulong val;
442 uint32_t size;
443
444 /* validate the generic part first */
445 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH);
446
447 /* validate unimplemented (always zero) bits */
448 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match");
449 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain");
450 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action");
451 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing");
452 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select");
453 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit");
454
455 /* validate size encoding */
456 size = type2_breakpoint_size(env, ctrl);
457 if (access_size[size] == -1) {
458 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
459 "SIZE_ANY\n", size);
460 } else {
461 val |= (ctrl & TYPE2_SIZELO);
462 if (riscv_cpu_mxl(env) == MXL_RV64) {
463 val |= (ctrl & TYPE2_SIZEHI);
464 }
465 }
466
467 /* keep the mode and attribute bits */
468 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M |
469 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
470
471 return val;
472 }
473
type2_breakpoint_insert(CPURISCVState * env,target_ulong index)474 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
475 {
476 target_ulong ctrl = env->tdata1[index];
477 target_ulong addr = env->tdata2[index];
478 bool enabled = type2_breakpoint_enabled(ctrl);
479 CPUState *cs = env_cpu(env);
480 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
481 uint32_t size, def_size;
482
483 if (!enabled) {
484 return;
485 }
486
487 if (ctrl & TYPE2_EXEC) {
488 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
489 }
490
491 if (ctrl & TYPE2_LOAD) {
492 flags |= BP_MEM_READ;
493 }
494 if (ctrl & TYPE2_STORE) {
495 flags |= BP_MEM_WRITE;
496 }
497
498 if (flags & BP_MEM_ACCESS) {
499 size = type2_breakpoint_size(env, ctrl);
500 if (size != 0) {
501 cpu_watchpoint_insert(cs, addr, size, flags,
502 &env->cpu_watchpoint[index]);
503 } else {
504 def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4;
505
506 cpu_watchpoint_insert(cs, addr, def_size, flags,
507 &env->cpu_watchpoint[index]);
508 }
509 }
510 }
511
type2_breakpoint_remove(CPURISCVState * env,target_ulong index)512 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
513 {
514 CPUState *cs = env_cpu(env);
515
516 if (env->cpu_breakpoint[index]) {
517 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
518 env->cpu_breakpoint[index] = NULL;
519 }
520
521 if (env->cpu_watchpoint[index]) {
522 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
523 env->cpu_watchpoint[index] = NULL;
524 }
525 }
526
type2_reg_write(CPURISCVState * env,target_ulong index,int tdata_index,target_ulong val)527 static void type2_reg_write(CPURISCVState *env, target_ulong index,
528 int tdata_index, target_ulong val)
529 {
530 target_ulong new_val;
531
532 switch (tdata_index) {
533 case TDATA1:
534 new_val = type2_mcontrol_validate(env, val);
535 if (new_val != env->tdata1[index]) {
536 env->tdata1[index] = new_val;
537 type2_breakpoint_remove(env, index);
538 type2_breakpoint_insert(env, index);
539 }
540 break;
541 case TDATA2:
542 if (val != env->tdata2[index]) {
543 env->tdata2[index] = val;
544 type2_breakpoint_remove(env, index);
545 type2_breakpoint_insert(env, index);
546 }
547 break;
548 case TDATA3:
549 env->tdata3[index] = textra_validate(env, val);
550 break;
551 default:
552 g_assert_not_reached();
553 }
554
555 return;
556 }
557
558 /* type 6 trigger */
559
type6_breakpoint_enabled(target_ulong ctrl)560 static inline bool type6_breakpoint_enabled(target_ulong ctrl)
561 {
562 bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
563 bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
564
565 return mode && rwx;
566 }
567
type6_mcontrol6_validate(CPURISCVState * env,target_ulong ctrl)568 static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
569 target_ulong ctrl)
570 {
571 target_ulong val;
572 uint32_t size;
573
574 /* validate the generic part first */
575 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6);
576
577 /* validate unimplemented (always zero) bits */
578 warn_always_zero_bit(ctrl, TYPE6_MATCH, "match");
579 warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain");
580 warn_always_zero_bit(ctrl, TYPE6_ACTION, "action");
581 warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing");
582 warn_always_zero_bit(ctrl, TYPE6_SELECT, "select");
583 warn_always_zero_bit(ctrl, TYPE6_HIT, "hit");
584
585 /* validate size encoding */
586 size = extract32(ctrl, 16, 4);
587 if (access_size[size] == -1) {
588 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
589 "SIZE_ANY\n", size);
590 } else {
591 val |= (ctrl & TYPE6_SIZE);
592 }
593
594 /* keep the mode and attribute bits */
595 val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M |
596 TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
597
598 return val;
599 }
600
type6_breakpoint_insert(CPURISCVState * env,target_ulong index)601 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
602 {
603 target_ulong ctrl = env->tdata1[index];
604 target_ulong addr = env->tdata2[index];
605 bool enabled = type6_breakpoint_enabled(ctrl);
606 CPUState *cs = env_cpu(env);
607 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
608 uint32_t size;
609
610 if (!enabled) {
611 return;
612 }
613
614 if (ctrl & TYPE6_EXEC) {
615 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
616 }
617
618 if (ctrl & TYPE6_LOAD) {
619 flags |= BP_MEM_READ;
620 }
621
622 if (ctrl & TYPE6_STORE) {
623 flags |= BP_MEM_WRITE;
624 }
625
626 if (flags & BP_MEM_ACCESS) {
627 size = extract32(ctrl, 16, 4);
628 if (size != 0) {
629 cpu_watchpoint_insert(cs, addr, size, flags,
630 &env->cpu_watchpoint[index]);
631 } else {
632 cpu_watchpoint_insert(cs, addr, 8, flags,
633 &env->cpu_watchpoint[index]);
634 }
635 }
636 }
637
type6_breakpoint_remove(CPURISCVState * env,target_ulong index)638 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
639 {
640 type2_breakpoint_remove(env, index);
641 }
642
type6_reg_write(CPURISCVState * env,target_ulong index,int tdata_index,target_ulong val)643 static void type6_reg_write(CPURISCVState *env, target_ulong index,
644 int tdata_index, target_ulong val)
645 {
646 target_ulong new_val;
647
648 switch (tdata_index) {
649 case TDATA1:
650 new_val = type6_mcontrol6_validate(env, val);
651 if (new_val != env->tdata1[index]) {
652 env->tdata1[index] = new_val;
653 type6_breakpoint_remove(env, index);
654 type6_breakpoint_insert(env, index);
655 }
656 break;
657 case TDATA2:
658 if (val != env->tdata2[index]) {
659 env->tdata2[index] = val;
660 type6_breakpoint_remove(env, index);
661 type6_breakpoint_insert(env, index);
662 }
663 break;
664 case TDATA3:
665 env->tdata3[index] = textra_validate(env, val);
666 break;
667 default:
668 g_assert_not_reached();
669 }
670
671 return;
672 }
673
674 /* icount trigger type */
675 static inline int
itrigger_get_count(CPURISCVState * env,int index)676 itrigger_get_count(CPURISCVState *env, int index)
677 {
678 return get_field(env->tdata1[index], ITRIGGER_COUNT);
679 }
680
681 static inline void
itrigger_set_count(CPURISCVState * env,int index,int value)682 itrigger_set_count(CPURISCVState *env, int index, int value)
683 {
684 env->tdata1[index] = set_field(env->tdata1[index],
685 ITRIGGER_COUNT, value);
686 }
687
check_itrigger_priv(CPURISCVState * env,int index)688 static bool check_itrigger_priv(CPURISCVState *env, int index)
689 {
690 target_ulong tdata1 = env->tdata1[index];
691 if (env->virt_enabled) {
692 /* check VU/VS bit against current privilege level */
693 return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
694 (get_field(tdata1, ITRIGGER_VU) == env->priv);
695 } else {
696 /* check U/S/M bit against current privilege level */
697 return (get_field(tdata1, ITRIGGER_M) == env->priv) ||
698 (get_field(tdata1, ITRIGGER_S) == env->priv) ||
699 (get_field(tdata1, ITRIGGER_U) == env->priv);
700 }
701 }
702
riscv_itrigger_enabled(CPURISCVState * env)703 bool riscv_itrigger_enabled(CPURISCVState *env)
704 {
705 int count;
706 for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
707 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
708 continue;
709 }
710 if (check_itrigger_priv(env, i)) {
711 continue;
712 }
713 count = itrigger_get_count(env, i);
714 if (!count) {
715 continue;
716 }
717 return true;
718 }
719
720 return false;
721 }
722
helper_itrigger_match(CPURISCVState * env)723 void helper_itrigger_match(CPURISCVState *env)
724 {
725 int count;
726 for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
727 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
728 continue;
729 }
730 if (!trigger_common_match(env, TRIGGER_TYPE_INST_CNT, i)) {
731 continue;
732 }
733 count = itrigger_get_count(env, i);
734 if (!count) {
735 continue;
736 }
737 itrigger_set_count(env, i, count--);
738 if (!count) {
739 env->itrigger_enabled = riscv_itrigger_enabled(env);
740 do_trigger_action(env, i);
741 }
742 }
743 }
744
riscv_itrigger_update_count(CPURISCVState * env)745 static void riscv_itrigger_update_count(CPURISCVState *env)
746 {
747 int count, executed;
748 /*
749 * Record last icount, so that we can evaluate the executed instructions
750 * since last privilege mode change or timer expire.
751 */
752 int64_t last_icount = env->last_icount, current_icount;
753 current_icount = env->last_icount = icount_get_raw();
754
755 for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
756 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
757 continue;
758 }
759 count = itrigger_get_count(env, i);
760 if (!count) {
761 continue;
762 }
763 /*
764 * Only when privilege is changed or itrigger timer expires,
765 * the count field in itrigger tdata1 register is updated.
766 * And the count field in itrigger only contains remaining value.
767 */
768 if (check_itrigger_priv(env, i)) {
769 /*
770 * If itrigger enabled in this privilege mode, the number of
771 * executed instructions since last privilege change
772 * should be reduced from current itrigger count.
773 */
774 executed = current_icount - last_icount;
775 itrigger_set_count(env, i, count - executed);
776 if (count == executed) {
777 do_trigger_action(env, i);
778 }
779 } else {
780 /*
781 * If itrigger is not enabled in this privilege mode,
782 * the number of executed instructions will be discard and
783 * the count field in itrigger will not change.
784 */
785 timer_mod(env->itrigger_timer[i],
786 current_icount + count);
787 }
788 }
789 }
790
riscv_itrigger_timer_cb(void * opaque)791 static void riscv_itrigger_timer_cb(void *opaque)
792 {
793 riscv_itrigger_update_count((CPURISCVState *)opaque);
794 }
795
riscv_itrigger_update_priv(CPURISCVState * env)796 void riscv_itrigger_update_priv(CPURISCVState *env)
797 {
798 riscv_itrigger_update_count(env);
799 }
800
itrigger_validate(CPURISCVState * env,target_ulong ctrl)801 static target_ulong itrigger_validate(CPURISCVState *env,
802 target_ulong ctrl)
803 {
804 target_ulong val;
805
806 /* validate the generic part first */
807 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT);
808
809 /* validate unimplemented (always zero) bits */
810 warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action");
811 warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit");
812 warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending");
813
814 /* keep the mode and attribute bits */
815 val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S |
816 ITRIGGER_M | ITRIGGER_COUNT);
817
818 return val;
819 }
820
itrigger_reg_write(CPURISCVState * env,target_ulong index,int tdata_index,target_ulong val)821 static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
822 int tdata_index, target_ulong val)
823 {
824 target_ulong new_val;
825
826 switch (tdata_index) {
827 case TDATA1:
828 /* set timer for icount */
829 new_val = itrigger_validate(env, val);
830 if (new_val != env->tdata1[index]) {
831 env->tdata1[index] = new_val;
832 if (icount_enabled()) {
833 env->last_icount = icount_get_raw();
834 /* set the count to timer */
835 timer_mod(env->itrigger_timer[index],
836 env->last_icount + itrigger_get_count(env, index));
837 } else {
838 env->itrigger_enabled = riscv_itrigger_enabled(env);
839 }
840 }
841 break;
842 case TDATA2:
843 qemu_log_mask(LOG_UNIMP,
844 "tdata2 is not supported for icount trigger\n");
845 break;
846 case TDATA3:
847 env->tdata3[index] = textra_validate(env, val);
848 break;
849 default:
850 g_assert_not_reached();
851 }
852
853 return;
854 }
855
itrigger_get_adjust_count(CPURISCVState * env)856 static int itrigger_get_adjust_count(CPURISCVState *env)
857 {
858 int count = itrigger_get_count(env, env->trigger_cur), executed;
859 if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) {
860 executed = icount_get_raw() - env->last_icount;
861 count += executed;
862 }
863 return count;
864 }
865
tdata_csr_read(CPURISCVState * env,int tdata_index)866 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
867 {
868 int trigger_type;
869 switch (tdata_index) {
870 case TDATA1:
871 trigger_type = extract_trigger_type(env,
872 env->tdata1[env->trigger_cur]);
873 if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) {
874 return deposit64(env->tdata1[env->trigger_cur], 10, 14,
875 itrigger_get_adjust_count(env));
876 }
877 return env->tdata1[env->trigger_cur];
878 case TDATA2:
879 return env->tdata2[env->trigger_cur];
880 case TDATA3:
881 return env->tdata3[env->trigger_cur];
882 default:
883 g_assert_not_reached();
884 }
885 }
886
tdata_csr_write(CPURISCVState * env,int tdata_index,target_ulong val)887 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
888 {
889 int trigger_type;
890
891 if (tdata_index == TDATA1) {
892 trigger_type = extract_trigger_type(env, val);
893 } else {
894 trigger_type = get_trigger_type(env, env->trigger_cur);
895 }
896
897 switch (trigger_type) {
898 case TRIGGER_TYPE_AD_MATCH:
899 type2_reg_write(env, env->trigger_cur, tdata_index, val);
900 break;
901 case TRIGGER_TYPE_AD_MATCH6:
902 type6_reg_write(env, env->trigger_cur, tdata_index, val);
903 break;
904 case TRIGGER_TYPE_INST_CNT:
905 itrigger_reg_write(env, env->trigger_cur, tdata_index, val);
906 break;
907 case TRIGGER_TYPE_INT:
908 case TRIGGER_TYPE_EXCP:
909 case TRIGGER_TYPE_EXT_SRC:
910 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
911 trigger_type);
912 break;
913 case TRIGGER_TYPE_NO_EXIST:
914 case TRIGGER_TYPE_UNAVAIL:
915 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
916 trigger_type);
917 break;
918 default:
919 g_assert_not_reached();
920 }
921 }
922
tinfo_csr_read(CPURISCVState * env)923 target_ulong tinfo_csr_read(CPURISCVState *env)
924 {
925 /* assume all triggers support the same types of triggers */
926 return BIT(TRIGGER_TYPE_AD_MATCH) |
927 BIT(TRIGGER_TYPE_AD_MATCH6);
928 }
929
riscv_cpu_debug_excp_handler(CPUState * cs)930 void riscv_cpu_debug_excp_handler(CPUState *cs)
931 {
932 RISCVCPU *cpu = RISCV_CPU(cs);
933 CPURISCVState *env = &cpu->env;
934
935 if (cs->watchpoint_hit) {
936 if (cs->watchpoint_hit->flags & BP_CPU) {
937 do_trigger_action(env, DBG_ACTION_BP);
938 }
939 } else {
940 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) {
941 do_trigger_action(env, DBG_ACTION_BP);
942 }
943 }
944 }
945
riscv_cpu_debug_check_breakpoint(CPUState * cs)946 bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
947 {
948 RISCVCPU *cpu = RISCV_CPU(cs);
949 CPURISCVState *env = &cpu->env;
950 CPUBreakpoint *bp;
951 target_ulong ctrl;
952 target_ulong pc;
953 int trigger_type;
954 int i;
955
956 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
957 for (i = 0; i < RV_MAX_TRIGGERS; i++) {
958 trigger_type = get_trigger_type(env, i);
959
960 if (!trigger_common_match(env, trigger_type, i)) {
961 continue;
962 }
963
964 switch (trigger_type) {
965 case TRIGGER_TYPE_AD_MATCH:
966 ctrl = env->tdata1[i];
967 pc = env->tdata2[i];
968
969 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
970 env->badaddr = pc;
971 return true;
972 }
973 break;
974 case TRIGGER_TYPE_AD_MATCH6:
975 ctrl = env->tdata1[i];
976 pc = env->tdata2[i];
977
978 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
979 env->badaddr = pc;
980 return true;
981 }
982 break;
983 default:
984 /* other trigger types are not supported or irrelevant */
985 break;
986 }
987 }
988 }
989
990 return false;
991 }
992
riscv_cpu_debug_check_watchpoint(CPUState * cs,CPUWatchpoint * wp)993 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
994 {
995 RISCVCPU *cpu = RISCV_CPU(cs);
996 CPURISCVState *env = &cpu->env;
997 target_ulong ctrl;
998 target_ulong addr;
999 int trigger_type;
1000 int flags;
1001 int i;
1002
1003 for (i = 0; i < RV_MAX_TRIGGERS; i++) {
1004 trigger_type = get_trigger_type(env, i);
1005
1006 if (!trigger_common_match(env, trigger_type, i)) {
1007 continue;
1008 }
1009
1010 switch (trigger_type) {
1011 case TRIGGER_TYPE_AD_MATCH:
1012 ctrl = env->tdata1[i];
1013 addr = env->tdata2[i];
1014 flags = 0;
1015
1016 if (ctrl & TYPE2_LOAD) {
1017 flags |= BP_MEM_READ;
1018 }
1019 if (ctrl & TYPE2_STORE) {
1020 flags |= BP_MEM_WRITE;
1021 }
1022
1023 if ((wp->flags & flags) && (wp->vaddr == addr)) {
1024 return true;
1025 }
1026 break;
1027 case TRIGGER_TYPE_AD_MATCH6:
1028 ctrl = env->tdata1[i];
1029 addr = env->tdata2[i];
1030 flags = 0;
1031
1032 if (ctrl & TYPE6_LOAD) {
1033 flags |= BP_MEM_READ;
1034 }
1035 if (ctrl & TYPE6_STORE) {
1036 flags |= BP_MEM_WRITE;
1037 }
1038
1039 if ((wp->flags & flags) && (wp->vaddr == addr)) {
1040 return true;
1041 }
1042 break;
1043 default:
1044 /* other trigger types are not supported */
1045 break;
1046 }
1047 }
1048
1049 return false;
1050 }
1051
riscv_trigger_realize(CPURISCVState * env)1052 void riscv_trigger_realize(CPURISCVState *env)
1053 {
1054 int i;
1055
1056 for (i = 0; i < RV_MAX_TRIGGERS; i++) {
1057 env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
1058 riscv_itrigger_timer_cb, env);
1059 }
1060 }
1061
riscv_trigger_reset_hold(CPURISCVState * env)1062 void riscv_trigger_reset_hold(CPURISCVState *env)
1063 {
1064 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
1065 int i;
1066
1067 /* init to type 2 triggers */
1068 for (i = 0; i < RV_MAX_TRIGGERS; i++) {
1069 /*
1070 * type = TRIGGER_TYPE_AD_MATCH
1071 * dmode = 0 (both debug and M-mode can write tdata)
1072 * maskmax = 0 (unimplemented, always 0)
1073 * sizehi = 0 (match against any size, RV64 only)
1074 * hit = 0 (unimplemented, always 0)
1075 * select = 0 (always 0, perform match on address)
1076 * timing = 0 (always 0, trigger before instruction)
1077 * sizelo = 0 (match against any size)
1078 * action = 0 (always 0, raise a breakpoint exception)
1079 * chain = 0 (unimplemented, always 0)
1080 * match = 0 (always 0, when any compare value equals tdata2)
1081 */
1082 env->tdata1[i] = tdata1;
1083 env->tdata2[i] = 0;
1084 env->tdata3[i] = 0;
1085 env->cpu_breakpoint[i] = NULL;
1086 env->cpu_watchpoint[i] = NULL;
1087 timer_del(env->itrigger_timer[i]);
1088 }
1089
1090 env->mcontext = 0;
1091 }
1092