1 /* 2 * QEMU RISC-V Native Debug Support 3 * 4 * Copyright (c) 2022 Wind River Systems, Inc. 5 * 6 * Author: 7 * Bin Meng <bin.meng@windriver.com> 8 * 9 * This provides the native debug support via the Trigger Module, as defined 10 * in the RISC-V Debug Specification: 11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf 12 * 13 * This program is free software; you can redistribute it and/or modify it 14 * under the terms and conditions of the GNU General Public License, 15 * version 2 or later, as published by the Free Software Foundation. 16 * 17 * This program is distributed in the hope it will be useful, but WITHOUT 18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 20 * more details. 21 * 22 * You should have received a copy of the GNU General Public License along with 23 * this program. If not, see <http://www.gnu.org/licenses/>. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 #include "trace.h" 31 #include "exec/exec-all.h" 32 33 /* 34 * The following M-mode trigger CSRs are implemented: 35 * 36 * - tselect 37 * - tdata1 38 * - tdata2 39 * - tdata3 40 * - tinfo 41 * 42 * The following triggers are implemented: 43 * 44 * Index | Type | tdata mapping | Description 45 * ------+------+------------------------+------------ 46 * 0 | 2 | tdata1, tdata2 | Address / Data Match 47 * 1 | 2 | tdata1, tdata2 | Address / Data Match 48 */ 49 50 /* tdata availability of a trigger */ 51 typedef bool tdata_avail[TDATA_NUM]; 52 53 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = { 54 [TRIGGER_TYPE_NO_EXIST] = { false, false, false }, 55 [TRIGGER_TYPE_AD_MATCH] = { true, true, true }, 56 [TRIGGER_TYPE_INST_CNT] = { true, false, true }, 57 [TRIGGER_TYPE_INT] = { true, true, true }, 58 [TRIGGER_TYPE_EXCP] = { true, true, true }, 59 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true }, 60 [TRIGGER_TYPE_EXT_SRC] = { true, false, false }, 61 [TRIGGER_TYPE_UNAVAIL] = { true, true, true } 62 }; 63 64 /* only breakpoint size 1/2/4/8 supported */ 65 static int access_size[SIZE_NUM] = { 66 [SIZE_ANY] = 0, 67 [SIZE_1B] = 1, 68 [SIZE_2B] = 2, 69 [SIZE_4B] = 4, 70 [SIZE_6B] = -1, 71 [SIZE_8B] = 8, 72 [6 ... 15] = -1, 73 }; 74 75 static inline target_ulong extract_trigger_type(CPURISCVState *env, 76 target_ulong tdata1) 77 { 78 switch (riscv_cpu_mxl(env)) { 79 case MXL_RV32: 80 return extract32(tdata1, 28, 4); 81 case MXL_RV64: 82 case MXL_RV128: 83 return extract64(tdata1, 60, 4); 84 default: 85 g_assert_not_reached(); 86 } 87 } 88 89 static inline target_ulong get_trigger_type(CPURISCVState *env, 90 target_ulong trigger_index) 91 { 92 return extract_trigger_type(env, env->tdata1[trigger_index]); 93 } 94 95 static trigger_action_t get_trigger_action(CPURISCVState *env, 96 target_ulong trigger_index) 97 { 98 target_ulong tdata1 = env->tdata1[trigger_index]; 99 int trigger_type = get_trigger_type(env, trigger_index); 100 trigger_action_t action = DBG_ACTION_NONE; 101 102 switch (trigger_type) { 103 case TRIGGER_TYPE_AD_MATCH: 104 action = (tdata1 & TYPE2_ACTION) >> 12; 105 break; 106 case TRIGGER_TYPE_INST_CNT: 107 case TRIGGER_TYPE_INT: 108 case TRIGGER_TYPE_EXCP: 109 case TRIGGER_TYPE_AD_MATCH6: 110 case TRIGGER_TYPE_EXT_SRC: 111 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 112 trigger_type); 113 break; 114 case TRIGGER_TYPE_NO_EXIST: 115 case TRIGGER_TYPE_UNAVAIL: 116 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 117 trigger_type); 118 break; 119 default: 120 g_assert_not_reached(); 121 } 122 123 return action; 124 } 125 126 static inline target_ulong build_tdata1(CPURISCVState *env, 127 trigger_type_t type, 128 bool dmode, target_ulong data) 129 { 130 target_ulong tdata1; 131 132 switch (riscv_cpu_mxl(env)) { 133 case MXL_RV32: 134 tdata1 = RV32_TYPE(type) | 135 (dmode ? RV32_DMODE : 0) | 136 (data & RV32_DATA_MASK); 137 break; 138 case MXL_RV64: 139 case MXL_RV128: 140 tdata1 = RV64_TYPE(type) | 141 (dmode ? RV64_DMODE : 0) | 142 (data & RV64_DATA_MASK); 143 break; 144 default: 145 g_assert_not_reached(); 146 } 147 148 return tdata1; 149 } 150 151 bool tdata_available(CPURISCVState *env, int tdata_index) 152 { 153 int trigger_type = get_trigger_type(env, env->trigger_cur); 154 155 if (unlikely(tdata_index >= TDATA_NUM)) { 156 return false; 157 } 158 159 return tdata_mapping[trigger_type][tdata_index]; 160 } 161 162 target_ulong tselect_csr_read(CPURISCVState *env) 163 { 164 return env->trigger_cur; 165 } 166 167 void tselect_csr_write(CPURISCVState *env, target_ulong val) 168 { 169 if (val < RV_MAX_TRIGGERS) { 170 env->trigger_cur = val; 171 } 172 } 173 174 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val, 175 trigger_type_t t) 176 { 177 uint32_t type, dmode; 178 target_ulong tdata1; 179 180 switch (riscv_cpu_mxl(env)) { 181 case MXL_RV32: 182 type = extract32(val, 28, 4); 183 dmode = extract32(val, 27, 1); 184 tdata1 = RV32_TYPE(t); 185 break; 186 case MXL_RV64: 187 case MXL_RV128: 188 type = extract64(val, 60, 4); 189 dmode = extract64(val, 59, 1); 190 tdata1 = RV64_TYPE(t); 191 break; 192 default: 193 g_assert_not_reached(); 194 } 195 196 if (type != t) { 197 qemu_log_mask(LOG_GUEST_ERROR, 198 "ignoring type write to tdata1 register\n"); 199 } 200 201 if (dmode != 0) { 202 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n"); 203 } 204 205 return tdata1; 206 } 207 208 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask, 209 const char *msg) 210 { 211 if (val & mask) { 212 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg); 213 } 214 } 215 216 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index) 217 { 218 trigger_action_t action = get_trigger_action(env, trigger_index); 219 220 switch (action) { 221 case DBG_ACTION_NONE: 222 break; 223 case DBG_ACTION_BP: 224 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0); 225 break; 226 case DBG_ACTION_DBG_MODE: 227 case DBG_ACTION_TRACE0: 228 case DBG_ACTION_TRACE1: 229 case DBG_ACTION_TRACE2: 230 case DBG_ACTION_TRACE3: 231 case DBG_ACTION_EXT_DBG0: 232 case DBG_ACTION_EXT_DBG1: 233 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action); 234 break; 235 default: 236 g_assert_not_reached(); 237 } 238 } 239 240 /* type 2 trigger */ 241 242 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl) 243 { 244 uint32_t size, sizelo, sizehi = 0; 245 246 if (riscv_cpu_mxl(env) == MXL_RV64) { 247 sizehi = extract32(ctrl, 21, 2); 248 } 249 sizelo = extract32(ctrl, 16, 2); 250 size = (sizehi << 2) | sizelo; 251 252 return size; 253 } 254 255 static inline bool type2_breakpoint_enabled(target_ulong ctrl) 256 { 257 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M)); 258 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 259 260 return mode && rwx; 261 } 262 263 static target_ulong type2_mcontrol_validate(CPURISCVState *env, 264 target_ulong ctrl) 265 { 266 target_ulong val; 267 uint32_t size; 268 269 /* validate the generic part first */ 270 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH); 271 272 /* validate unimplemented (always zero) bits */ 273 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match"); 274 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain"); 275 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action"); 276 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing"); 277 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select"); 278 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit"); 279 280 /* validate size encoding */ 281 size = type2_breakpoint_size(env, ctrl); 282 if (access_size[size] == -1) { 283 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n", 284 size); 285 } else { 286 val |= (ctrl & TYPE2_SIZELO); 287 if (riscv_cpu_mxl(env) == MXL_RV64) { 288 val |= (ctrl & TYPE2_SIZEHI); 289 } 290 } 291 292 /* keep the mode and attribute bits */ 293 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M | 294 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 295 296 return val; 297 } 298 299 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index) 300 { 301 target_ulong ctrl = env->tdata1[index]; 302 target_ulong addr = env->tdata2[index]; 303 bool enabled = type2_breakpoint_enabled(ctrl); 304 CPUState *cs = env_cpu(env); 305 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 306 uint32_t size; 307 308 if (!enabled) { 309 return; 310 } 311 312 if (ctrl & TYPE2_EXEC) { 313 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 314 } 315 316 if (ctrl & TYPE2_LOAD) { 317 flags |= BP_MEM_READ; 318 } 319 if (ctrl & TYPE2_STORE) { 320 flags |= BP_MEM_WRITE; 321 } 322 323 if (flags & BP_MEM_ACCESS) { 324 size = type2_breakpoint_size(env, ctrl); 325 if (size != 0) { 326 cpu_watchpoint_insert(cs, addr, size, flags, 327 &env->cpu_watchpoint[index]); 328 } else { 329 cpu_watchpoint_insert(cs, addr, 8, flags, 330 &env->cpu_watchpoint[index]); 331 } 332 } 333 } 334 335 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index) 336 { 337 CPUState *cs = env_cpu(env); 338 339 if (env->cpu_breakpoint[index]) { 340 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]); 341 env->cpu_breakpoint[index] = NULL; 342 } 343 344 if (env->cpu_watchpoint[index]) { 345 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]); 346 env->cpu_watchpoint[index] = NULL; 347 } 348 } 349 350 static void type2_reg_write(CPURISCVState *env, target_ulong index, 351 int tdata_index, target_ulong val) 352 { 353 target_ulong new_val; 354 355 switch (tdata_index) { 356 case TDATA1: 357 new_val = type2_mcontrol_validate(env, val); 358 if (new_val != env->tdata1[index]) { 359 env->tdata1[index] = new_val; 360 type2_breakpoint_remove(env, index); 361 type2_breakpoint_insert(env, index); 362 } 363 break; 364 case TDATA2: 365 if (val != env->tdata2[index]) { 366 env->tdata2[index] = val; 367 type2_breakpoint_remove(env, index); 368 type2_breakpoint_insert(env, index); 369 } 370 break; 371 case TDATA3: 372 qemu_log_mask(LOG_UNIMP, 373 "tdata3 is not supported for type 2 trigger\n"); 374 break; 375 default: 376 g_assert_not_reached(); 377 } 378 379 return; 380 } 381 382 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index) 383 { 384 switch (tdata_index) { 385 case TDATA1: 386 return env->tdata1[env->trigger_cur]; 387 case TDATA2: 388 return env->tdata2[env->trigger_cur]; 389 case TDATA3: 390 return env->tdata3[env->trigger_cur]; 391 default: 392 g_assert_not_reached(); 393 } 394 } 395 396 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val) 397 { 398 int trigger_type; 399 400 if (tdata_index == TDATA1) { 401 trigger_type = extract_trigger_type(env, val); 402 } else { 403 trigger_type = get_trigger_type(env, env->trigger_cur); 404 } 405 406 switch (trigger_type) { 407 case TRIGGER_TYPE_AD_MATCH: 408 type2_reg_write(env, env->trigger_cur, tdata_index, val); 409 break; 410 case TRIGGER_TYPE_INST_CNT: 411 case TRIGGER_TYPE_INT: 412 case TRIGGER_TYPE_EXCP: 413 case TRIGGER_TYPE_AD_MATCH6: 414 case TRIGGER_TYPE_EXT_SRC: 415 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 416 trigger_type); 417 break; 418 case TRIGGER_TYPE_NO_EXIST: 419 case TRIGGER_TYPE_UNAVAIL: 420 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 421 trigger_type); 422 break; 423 default: 424 g_assert_not_reached(); 425 } 426 } 427 428 target_ulong tinfo_csr_read(CPURISCVState *env) 429 { 430 /* assume all triggers support the same types of triggers */ 431 return BIT(TRIGGER_TYPE_AD_MATCH); 432 } 433 434 void riscv_cpu_debug_excp_handler(CPUState *cs) 435 { 436 RISCVCPU *cpu = RISCV_CPU(cs); 437 CPURISCVState *env = &cpu->env; 438 439 if (cs->watchpoint_hit) { 440 if (cs->watchpoint_hit->flags & BP_CPU) { 441 cs->watchpoint_hit = NULL; 442 do_trigger_action(env, DBG_ACTION_BP); 443 } 444 } else { 445 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) { 446 do_trigger_action(env, DBG_ACTION_BP); 447 } 448 } 449 } 450 451 bool riscv_cpu_debug_check_breakpoint(CPUState *cs) 452 { 453 RISCVCPU *cpu = RISCV_CPU(cs); 454 CPURISCVState *env = &cpu->env; 455 CPUBreakpoint *bp; 456 target_ulong ctrl; 457 target_ulong pc; 458 int trigger_type; 459 int i; 460 461 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) { 462 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 463 trigger_type = get_trigger_type(env, i); 464 465 switch (trigger_type) { 466 case TRIGGER_TYPE_AD_MATCH: 467 ctrl = env->tdata1[i]; 468 pc = env->tdata2[i]; 469 470 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) { 471 /* check U/S/M bit against current privilege level */ 472 if ((ctrl >> 3) & BIT(env->priv)) { 473 return true; 474 } 475 } 476 break; 477 default: 478 /* other trigger types are not supported or irrelevant */ 479 break; 480 } 481 } 482 } 483 484 return false; 485 } 486 487 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) 488 { 489 RISCVCPU *cpu = RISCV_CPU(cs); 490 CPURISCVState *env = &cpu->env; 491 target_ulong ctrl; 492 target_ulong addr; 493 int trigger_type; 494 int flags; 495 int i; 496 497 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 498 trigger_type = get_trigger_type(env, i); 499 500 switch (trigger_type) { 501 case TRIGGER_TYPE_AD_MATCH: 502 ctrl = env->tdata1[i]; 503 addr = env->tdata2[i]; 504 flags = 0; 505 506 if (ctrl & TYPE2_LOAD) { 507 flags |= BP_MEM_READ; 508 } 509 if (ctrl & TYPE2_STORE) { 510 flags |= BP_MEM_WRITE; 511 } 512 513 if ((wp->flags & flags) && (wp->vaddr == addr)) { 514 /* check U/S/M bit against current privilege level */ 515 if ((ctrl >> 3) & BIT(env->priv)) { 516 return true; 517 } 518 } 519 break; 520 default: 521 /* other trigger types are not supported */ 522 break; 523 } 524 } 525 526 return false; 527 } 528 529 void riscv_trigger_init(CPURISCVState *env) 530 { 531 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0); 532 int i; 533 534 /* init to type 2 triggers */ 535 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 536 /* 537 * type = TRIGGER_TYPE_AD_MATCH 538 * dmode = 0 (both debug and M-mode can write tdata) 539 * maskmax = 0 (unimplemented, always 0) 540 * sizehi = 0 (match against any size, RV64 only) 541 * hit = 0 (unimplemented, always 0) 542 * select = 0 (always 0, perform match on address) 543 * timing = 0 (always 0, trigger before instruction) 544 * sizelo = 0 (match against any size) 545 * action = 0 (always 0, raise a breakpoint exception) 546 * chain = 0 (unimplemented, always 0) 547 * match = 0 (always 0, when any compare value equals tdata2) 548 */ 549 env->tdata1[i] = tdata1; 550 env->tdata2[i] = 0; 551 env->tdata3[i] = 0; 552 env->cpu_breakpoint[i] = NULL; 553 env->cpu_watchpoint[i] = NULL; 554 } 555 } 556