master
c 1,117 lines 32.3 KB
Raw
1 /*
2 * QEMU RISC-V Native Debug Support
3 *
4 * Copyright (c) 2022 Wind River Systems, Inc.
5 *
6 * Author:
7 * Bin Meng <bin.meng@windriver.com>
8 *
9 * This provides the native debug support via the Trigger Module, as defined
10 * in the RISC-V Debug Specification:
11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms and conditions of the GNU General Public License,
15 * version 2 or later, as published by the Free Software Foundation.
16 *
17 * This program is distributed in the hope it will be useful, but WITHOUT
18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
20 * more details.
21 *
22 * You should have received a copy of the GNU General Public License along with
23 * this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "qemu/osdep.h"
27 #include "qemu/log.h"
28 #include "qapi/error.h"
29 #include "qemu/error-report.h"
30 #include "cpu.h"
31 #include "target/riscv/tcg/debug.h"
32 #include "trace.h"
33 #include "exec/helper-proto.h"
34 #include "exec/watchpoint.h"
35 #include "system/cpu-timers.h"
36 #include "exec/icount.h"
37
38 /*
39 * The following M-mode trigger CSRs are implemented:
40 *
41 * - tselect
42 * - tdata1
43 * - tdata2
44 * - tdata3
45 * - tinfo
46 *
47 * The following triggers are initialized by default:
48 *
49 * Index | Type | tdata mapping | Description
50 * ------+------+------------------------+------------
51 * 0 | 2 | tdata1, tdata2 | Address / Data Match
52 * 1 | 2 | tdata1, tdata2 | Address / Data Match
53 */
54
55 /* tdata availability of a trigger */
56 typedef bool tdata_avail[TDATA_NUM];
57
58 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = {
59 [TRIGGER_TYPE_NO_EXIST] = { false, false, false },
60 [TRIGGER_TYPE_AD_MATCH] = { true, true, true },
61 [TRIGGER_TYPE_INST_CNT] = { true, false, true },
62 [TRIGGER_TYPE_INT] = { true, true, true },
63 [TRIGGER_TYPE_EXCP] = { true, true, true },
64 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true },
65 [TRIGGER_TYPE_EXT_SRC] = { true, false, false },
66 [TRIGGER_TYPE_UNAVAIL] = { true, true, true }
67 };
68
69 /* only breakpoint size 1/2/4/8 supported */
70 static int access_size[SIZE_NUM] = {
71 [SIZE_ANY] = 0,
72 [SIZE_1B] = 1,
73 [SIZE_2B] = 2,
74 [SIZE_4B] = 4,
75 [SIZE_6B] = -1,
76 [SIZE_8B] = 8,
77 [6 ... 15] = -1,
78 };
79
80 static inline target_ulong extract_trigger_type(CPURISCVState *env,
81 target_ulong tdata1)
82 {
83 switch (riscv_cpu_mxl(env)) {
84 case MXL_RV32:
85 return extract32(tdata1, 28, 4);
86 case MXL_RV64:
87 case MXL_RV128:
88 return extract64(tdata1, 60, 4);
89 default:
90 g_assert_not_reached();
91 }
92 }
93
94 static inline target_ulong get_trigger_type(CPURISCVState *env,
95 target_ulong trigger_index)
96 {
97 return extract_trigger_type(env, env->tdata1[trigger_index]);
98 }
99
100 static trigger_action_t get_trigger_action(CPURISCVState *env,
101 target_ulong trigger_index)
102 {
103 target_ulong tdata1 = env->tdata1[trigger_index];
104 int trigger_type = get_trigger_type(env, trigger_index);
105 trigger_action_t action = DBG_ACTION_NONE;
106
107 switch (trigger_type) {
108 case TRIGGER_TYPE_AD_MATCH:
109 action = (tdata1 & TYPE2_ACTION) >> 12;
110 break;
111 case TRIGGER_TYPE_AD_MATCH6:
112 action = (tdata1 & TYPE6_ACTION) >> 12;
113 break;
114 case TRIGGER_TYPE_INST_CNT:
115 case TRIGGER_TYPE_INT:
116 case TRIGGER_TYPE_EXCP:
117 case TRIGGER_TYPE_EXT_SRC:
118 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
119 trigger_type);
120 break;
121 case TRIGGER_TYPE_NO_EXIST:
122 case TRIGGER_TYPE_UNAVAIL:
123 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
124 trigger_type);
125 break;
126 default:
127 g_assert_not_reached();
128 }
129
130 return action;
131 }
132
133 static inline target_ulong build_tdata1(CPURISCVState *env,
134 trigger_type_t type,
135 bool dmode, target_ulong data)
136 {
137 target_ulong tdata1;
138
139 switch (riscv_cpu_mxl(env)) {
140 case MXL_RV32:
141 tdata1 = RV32_TYPE(type) |
142 (dmode ? RV32_DMODE : 0) |
143 (data & RV32_DATA_MASK);
144 break;
145 case MXL_RV64:
146 case MXL_RV128:
147 tdata1 = RV64_TYPE(type) |
148 (dmode ? RV64_DMODE : 0) |
149 (data & RV64_DATA_MASK);
150 break;
151 default:
152 g_assert_not_reached();
153 }
154
155 return tdata1;
156 }
157
158 bool tdata_available(CPURISCVState *env, int tdata_index)
159 {
160 int trigger_type = get_trigger_type(env, env->trigger_cur);
161
162 if (unlikely(tdata_index >= TDATA_NUM)) {
163 return false;
164 }
165
166 return tdata_mapping[trigger_type][tdata_index];
167 }
168
169 target_ulong tselect_csr_read(CPURISCVState *env)
170 {
171 return env->trigger_cur;
172 }
173
174 void tselect_csr_write(CPURISCVState *env, target_ulong val)
175 {
176 if (val < env->num_triggers) {
177 env->trigger_cur = val;
178 }
179 }
180
181 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
182 trigger_type_t t)
183 {
184 uint32_t type, dmode;
185 target_ulong tdata1;
186
187 switch (riscv_cpu_mxl(env)) {
188 case MXL_RV32:
189 type = extract32(val, 28, 4);
190 dmode = extract32(val, 27, 1);
191 tdata1 = RV32_TYPE(t);
192 break;
193 case MXL_RV64:
194 case MXL_RV128:
195 type = extract64(val, 60, 4);
196 dmode = extract64(val, 59, 1);
197 tdata1 = RV64_TYPE(t);
198 break;
199 default:
200 g_assert_not_reached();
201 }
202
203 if (type != t) {
204 qemu_log_mask(LOG_GUEST_ERROR,
205 "ignoring type write to tdata1 register\n");
206 }
207
208 if (dmode != 0) {
209 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n");
210 }
211
212 return tdata1;
213 }
214
215 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
216 const char *msg)
217 {
218 if (val & mask) {
219 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg);
220 }
221 }
222
223 static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
224 {
225 target_ulong mhvalue, mhselect;
226 target_ulong mhselect_new;
227 target_ulong textra;
228 const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 };
229
230 switch (riscv_cpu_mxl(env)) {
231 case MXL_RV32:
232 mhvalue = get_field(tdata3, TEXTRA32_MHVALUE);
233 mhselect = get_field(tdata3, TEXTRA32_MHSELECT);
234 /* Validate unimplemented (always zero) bits */
235 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK,
236 "sbytemask");
237 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE,
238 "svalue");
239 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT,
240 "sselect");
241 break;
242 case MXL_RV64:
243 case MXL_RV128:
244 mhvalue = get_field(tdata3, TEXTRA64_MHVALUE);
245 mhselect = get_field(tdata3, TEXTRA64_MHSELECT);
246 /* Validate unimplemented (always zero) bits */
247 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK,
248 "sbytemask");
249 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE,
250 "svalue");
251 warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT,
252 "sselect");
253 break;
254 default:
255 g_assert_not_reached();
256 }
257
258 /* Validate mhselect. */
259 mhselect_new = mhselect_no_rvh[mhselect];
260 if (mhselect != mhselect_new) {
261 qemu_log_mask(LOG_UNIMP, "mhselect only supports 0 or 4 for now\n");
262 }
263
264 /* Write legal values into textra */
265 textra = 0;
266 switch (riscv_cpu_mxl(env)) {
267 case MXL_RV32:
268 textra = set_field(textra, TEXTRA32_MHVALUE, mhvalue);
269 textra = set_field(textra, TEXTRA32_MHSELECT, mhselect_new);
270 break;
271 case MXL_RV64:
272 case MXL_RV128:
273 textra = set_field(textra, TEXTRA64_MHVALUE, mhvalue);
274 textra = set_field(textra, TEXTRA64_MHSELECT, mhselect_new);
275 break;
276 default:
277 g_assert_not_reached();
278 }
279
280 return textra;
281 }
282
283 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
284 {
285 trigger_action_t action = get_trigger_action(env, trigger_index);
286
287 switch (action) {
288 case DBG_ACTION_NONE:
289 break;
290 case DBG_ACTION_BP:
291 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
292 break;
293 case DBG_ACTION_DBG_MODE:
294 case DBG_ACTION_TRACE0:
295 case DBG_ACTION_TRACE1:
296 case DBG_ACTION_TRACE2:
297 case DBG_ACTION_TRACE3:
298 case DBG_ACTION_EXT_DBG0:
299 case DBG_ACTION_EXT_DBG1:
300 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action);
301 break;
302 default:
303 g_assert_not_reached();
304 }
305 }
306
307 /*
308 * Check the privilege level of specific trigger matches CPU's current privilege
309 * level.
310 */
311 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type,
312 int trigger_index)
313 {
314 target_ulong ctrl = env->tdata1[trigger_index];
315
316 switch (type) {
317 case TRIGGER_TYPE_AD_MATCH:
318 /* type 2 trigger cannot be fired in VU/VS mode */
319 if (env->virt_enabled) {
320 return false;
321 }
322 /* check U/S/M bit against current privilege level */
323 if ((ctrl >> 3) & BIT(env->priv)) {
324 return true;
325 }
326 break;
327 case TRIGGER_TYPE_AD_MATCH6:
328 if (env->virt_enabled) {
329 /* check VU/VS bit against current privilege level */
330 if ((ctrl >> 23) & BIT(env->priv)) {
331 return true;
332 }
333 } else {
334 /* check U/S/M bit against current privilege level */
335 if ((ctrl >> 3) & BIT(env->priv)) {
336 return true;
337 }
338 }
339 break;
340 case TRIGGER_TYPE_INST_CNT:
341 if (env->virt_enabled) {
342 /* check VU/VS bit against current privilege level */
343 if ((ctrl >> 25) & BIT(env->priv)) {
344 return true;
345 }
346 } else {
347 /* check U/S/M bit against current privilege level */
348 if ((ctrl >> 6) & BIT(env->priv)) {
349 return true;
350 }
351 }
352 break;
353 case TRIGGER_TYPE_INT:
354 case TRIGGER_TYPE_EXCP:
355 case TRIGGER_TYPE_EXT_SRC:
356 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", type);
357 break;
358 case TRIGGER_TYPE_NO_EXIST:
359 case TRIGGER_TYPE_UNAVAIL:
360 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exist\n",
361 type);
362 break;
363 default:
364 g_assert_not_reached();
365 }
366
367 return false;
368 }
369
370 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type,
371 int trigger_index)
372 {
373 target_ulong textra = env->tdata3[trigger_index];
374 target_ulong mhvalue, mhselect;
375
376 if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) {
377 /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */
378 return true;
379 }
380
381 switch (riscv_cpu_mxl(env)) {
382 case MXL_RV32:
383 mhvalue = get_field(textra, TEXTRA32_MHVALUE);
384 mhselect = get_field(textra, TEXTRA32_MHSELECT);
385 break;
386 case MXL_RV64:
387 case MXL_RV128:
388 mhvalue = get_field(textra, TEXTRA64_MHVALUE);
389 mhselect = get_field(textra, TEXTRA64_MHSELECT);
390 break;
391 default:
392 g_assert_not_reached();
393 }
394
395 /* Check mhvalue and mhselect. */
396 switch (mhselect) {
397 case MHSELECT_IGNORE:
398 break;
399 case MHSELECT_MCONTEXT:
400 /* Match if the low bits of mcontext/hcontext equal mhvalue. */
401 if (mhvalue != env->mcontext) {
402 return false;
403 }
404 break;
405 default:
406 break;
407 }
408
409 return true;
410 }
411
412 /* Common matching conditions for all types of the triggers. */
413 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type,
414 int trigger_index)
415 {
416 return trigger_priv_match(env, type, trigger_index) &&
417 trigger_textra_match(env, type, trigger_index);
418 }
419
420 /* type 2 trigger */
421
422 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
423 {
424 uint32_t sizelo, sizehi = 0;
425
426 if (riscv_cpu_mxl(env) == MXL_RV64) {
427 sizehi = extract32(ctrl, 21, 2);
428 }
429 sizelo = extract32(ctrl, 16, 2);
430 return (sizehi << 2) | sizelo;
431 }
432
433 static inline bool type2_breakpoint_enabled(target_ulong ctrl)
434 {
435 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M));
436 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
437
438 return mode && rwx;
439 }
440
441 static target_ulong type2_mcontrol_validate(CPURISCVState *env,
442 target_ulong ctrl)
443 {
444 target_ulong val;
445 uint32_t size;
446
447 /* validate the generic part first */
448 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH);
449
450 /* validate unimplemented (always zero) bits */
451 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match");
452 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain");
453 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action");
454 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing");
455 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select");
456 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit");
457
458 /* validate size encoding */
459 size = type2_breakpoint_size(env, ctrl);
460 if (access_size[size] == -1) {
461 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
462 "SIZE_ANY\n", size);
463 } else {
464 val |= (ctrl & TYPE2_SIZELO);
465 if (riscv_cpu_mxl(env) == MXL_RV64) {
466 val |= (ctrl & TYPE2_SIZEHI);
467 }
468 }
469
470 /* keep the mode and attribute bits */
471 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M |
472 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
473
474 return val;
475 }
476
477 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
478 {
479 target_ulong ctrl = env->tdata1[index];
480 target_ulong addr = env->tdata2[index];
481 bool enabled = type2_breakpoint_enabled(ctrl);
482 CPUState *cs = env_cpu(env);
483 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
484 uint32_t size, def_size;
485
486 if (!enabled) {
487 return;
488 }
489
490 if (ctrl & TYPE2_EXEC) {
491 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
492 }
493
494 if (ctrl & TYPE2_LOAD) {
495 flags |= BP_MEM_READ;
496 }
497 if (ctrl & TYPE2_STORE) {
498 flags |= BP_MEM_WRITE;
499 }
500
501 if (flags & BP_MEM_ACCESS) {
502 size = type2_breakpoint_size(env, ctrl);
503 if (size != 0) {
504 cpu_watchpoint_insert(cs, addr, size, flags,
505 &env->cpu_watchpoint[index]);
506 } else {
507 def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4;
508
509 cpu_watchpoint_insert(cs, addr, def_size, flags,
510 &env->cpu_watchpoint[index]);
511 }
512 }
513 }
514
515 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
516 {
517 CPUState *cs = env_cpu(env);
518
519 if (env->cpu_breakpoint[index]) {
520 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
521 env->cpu_breakpoint[index] = NULL;
522 }
523
524 if (env->cpu_watchpoint[index]) {
525 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
526 env->cpu_watchpoint[index] = NULL;
527 }
528 }
529
530 static void type2_reg_write(CPURISCVState *env, target_ulong index,
531 int tdata_index, target_ulong val)
532 {
533 target_ulong new_val;
534
535 switch (tdata_index) {
536 case TDATA1:
537 new_val = type2_mcontrol_validate(env, val);
538 if (new_val != env->tdata1[index]) {
539 env->tdata1[index] = new_val;
540 type2_breakpoint_remove(env, index);
541 type2_breakpoint_insert(env, index);
542 }
543 break;
544 case TDATA2:
545 if (val != env->tdata2[index]) {
546 env->tdata2[index] = val;
547 type2_breakpoint_remove(env, index);
548 type2_breakpoint_insert(env, index);
549 }
550 break;
551 case TDATA3:
552 env->tdata3[index] = textra_validate(env, val);
553 break;
554 default:
555 g_assert_not_reached();
556 }
557 }
558
559 /* type 6 trigger */
560
561 static inline bool type6_breakpoint_enabled(target_ulong ctrl)
562 {
563 bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
564 bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
565
566 return mode && rwx;
567 }
568
569 static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
570 target_ulong ctrl)
571 {
572 target_ulong val;
573 uint32_t size;
574
575 /* validate the generic part first */
576 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6);
577
578 /* validate unimplemented (always zero) bits */
579 warn_always_zero_bit(ctrl, TYPE6_MATCH, "match");
580 warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain");
581 warn_always_zero_bit(ctrl, TYPE6_ACTION, "action");
582 warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing");
583 warn_always_zero_bit(ctrl, TYPE6_SELECT, "select");
584 warn_always_zero_bit(ctrl, TYPE6_HIT, "hit");
585
586 /* validate size encoding */
587 size = extract32(ctrl, 16, 4);
588 if (access_size[size] == -1) {
589 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
590 "SIZE_ANY\n", size);
591 } else {
592 val |= (ctrl & TYPE6_SIZE);
593 }
594
595 /* keep the mode and attribute bits */
596 val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M |
597 TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
598
599 return val;
600 }
601
602 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
603 {
604 target_ulong ctrl = env->tdata1[index];
605 target_ulong addr = env->tdata2[index];
606 bool enabled = type6_breakpoint_enabled(ctrl);
607 CPUState *cs = env_cpu(env);
608 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
609 uint32_t size;
610
611 if (!enabled) {
612 return;
613 }
614
615 if (ctrl & TYPE6_EXEC) {
616 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
617 }
618
619 if (ctrl & TYPE6_LOAD) {
620 flags |= BP_MEM_READ;
621 }
622
623 if (ctrl & TYPE6_STORE) {
624 flags |= BP_MEM_WRITE;
625 }
626
627 if (flags & BP_MEM_ACCESS) {
628 size = extract32(ctrl, 16, 4);
629 if (size != 0) {
630 cpu_watchpoint_insert(cs, addr, size, flags,
631 &env->cpu_watchpoint[index]);
632 } else {
633 cpu_watchpoint_insert(cs, addr, 8, flags,
634 &env->cpu_watchpoint[index]);
635 }
636 }
637 }
638
639 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
640 {
641 type2_breakpoint_remove(env, index);
642 }
643
644 static void type6_reg_write(CPURISCVState *env, target_ulong index,
645 int tdata_index, target_ulong val)
646 {
647 target_ulong new_val;
648
649 switch (tdata_index) {
650 case TDATA1:
651 new_val = type6_mcontrol6_validate(env, val);
652 if (new_val != env->tdata1[index]) {
653 env->tdata1[index] = new_val;
654 type6_breakpoint_remove(env, index);
655 type6_breakpoint_insert(env, index);
656 }
657 break;
658 case TDATA2:
659 if (val != env->tdata2[index]) {
660 env->tdata2[index] = val;
661 type6_breakpoint_remove(env, index);
662 type6_breakpoint_insert(env, index);
663 }
664 break;
665 case TDATA3:
666 env->tdata3[index] = textra_validate(env, val);
667 break;
668 default:
669 g_assert_not_reached();
670 }
671 }
672
673 /* icount trigger type */
674 static inline int
675 itrigger_get_count(CPURISCVState *env, int index)
676 {
677 return get_field(env->tdata1[index], ITRIGGER_COUNT);
678 }
679
680 static inline void
681 itrigger_set_count(CPURISCVState *env, int index, int value)
682 {
683 env->tdata1[index] = set_field(env->tdata1[index],
684 ITRIGGER_COUNT, value);
685 }
686
687 static bool check_itrigger_priv(CPURISCVState *env, int index)
688 {
689 target_ulong tdata1 = env->tdata1[index];
690 if (env->virt_enabled) {
691 /* check VU/VS bit against current privilege level */
692 return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
693 (get_field(tdata1, ITRIGGER_VU) == env->priv);
694 } else {
695 /* check U/S/M bit against current privilege level */
696 return (get_field(tdata1, ITRIGGER_M) == env->priv) ||
697 (get_field(tdata1, ITRIGGER_S) == env->priv) ||
698 (get_field(tdata1, ITRIGGER_U) == env->priv);
699 }
700 }
701
702 bool riscv_itrigger_enabled(CPURISCVState *env)
703 {
704 int count;
705 for (int i = 0; i < env->num_triggers; i++) {
706 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
707 continue;
708 }
709 if (check_itrigger_priv(env, i)) {
710 continue;
711 }
712 count = itrigger_get_count(env, i);
713 if (!count) {
714 continue;
715 }
716 return true;
717 }
718
719 return false;
720 }
721
722 void helper_itrigger_match(CPURISCVState *env)
723 {
724 int count;
725 for (int i = 0; i < env->num_triggers; i++) {
726 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
727 continue;
728 }
729 if (!trigger_common_match(env, TRIGGER_TYPE_INST_CNT, i)) {
730 continue;
731 }
732 count = itrigger_get_count(env, i);
733 if (!count) {
734 continue;
735 }
736 itrigger_set_count(env, i, count--);
737 if (!count) {
738 env->itrigger_enabled = riscv_itrigger_enabled(env);
739 do_trigger_action(env, i);
740 }
741 }
742 }
743
744 static void riscv_itrigger_update_count(CPURISCVState *env)
745 {
746 int count, executed;
747 /*
748 * Record last icount, so that we can evaluate the executed instructions
749 * since last privilege mode change or timer expire.
750 */
751 int64_t last_icount = env->last_icount, current_icount;
752 current_icount = env->last_icount = icount_get_raw();
753
754 for (int i = 0; i < env->num_triggers; i++) {
755 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
756 continue;
757 }
758 count = itrigger_get_count(env, i);
759 if (!count) {
760 continue;
761 }
762 /*
763 * Only when privilege is changed or itrigger timer expires,
764 * the count field in itrigger tdata1 register is updated.
765 * And the count field in itrigger only contains remaining value.
766 */
767 if (check_itrigger_priv(env, i)) {
768 /*
769 * If itrigger enabled in this privilege mode, the number of
770 * executed instructions since last privilege change
771 * should be reduced from current itrigger count.
772 */
773 executed = current_icount - last_icount;
774 itrigger_set_count(env, i, count - executed);
775 if (count == executed) {
776 do_trigger_action(env, i);
777 }
778 } else {
779 /*
780 * If itrigger is not enabled in this privilege mode,
781 * the number of executed instructions will be discard and
782 * the count field in itrigger will not change.
783 */
784 timer_mod(env->itrigger_timer[i],
785 current_icount + count);
786 }
787 }
788 }
789
790 static void riscv_itrigger_timer_cb(void *opaque)
791 {
792 riscv_itrigger_update_count((CPURISCVState *)opaque);
793 }
794
795 void riscv_itrigger_update_priv(CPURISCVState *env)
796 {
797 riscv_itrigger_update_count(env);
798 }
799
800 static target_ulong itrigger_validate(CPURISCVState *env,
801 target_ulong ctrl)
802 {
803 target_ulong val;
804
805 /* validate the generic part first */
806 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT);
807
808 /* validate unimplemented (always zero) bits */
809 warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action");
810 warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit");
811 warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending");
812
813 /* keep the mode and attribute bits */
814 val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S |
815 ITRIGGER_M | ITRIGGER_COUNT);
816
817 return val;
818 }
819
820 static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
821 int tdata_index, target_ulong val)
822 {
823 target_ulong new_val;
824
825 switch (tdata_index) {
826 case TDATA1:
827 /* set timer for icount */
828 new_val = itrigger_validate(env, val);
829 if (new_val != env->tdata1[index]) {
830 env->tdata1[index] = new_val;
831 if (icount_enabled()) {
832 env->last_icount = icount_get_raw();
833 /* set the count to timer */
834 timer_mod(env->itrigger_timer[index],
835 env->last_icount + itrigger_get_count(env, index));
836 } else {
837 env->itrigger_enabled = riscv_itrigger_enabled(env);
838 }
839 }
840 break;
841 case TDATA2:
842 qemu_log_mask(LOG_UNIMP,
843 "tdata2 is not supported for icount trigger\n");
844 break;
845 case TDATA3:
846 env->tdata3[index] = textra_validate(env, val);
847 break;
848 default:
849 g_assert_not_reached();
850 }
851 }
852
853 static int itrigger_get_adjust_count(CPURISCVState *env)
854 {
855 int count = itrigger_get_count(env, env->trigger_cur), executed;
856 if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) {
857 executed = icount_get_raw() - env->last_icount;
858 count += executed;
859 }
860 return count;
861 }
862
863 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
864 {
865 int trigger_type;
866 switch (tdata_index) {
867 case TDATA1:
868 trigger_type = extract_trigger_type(env,
869 env->tdata1[env->trigger_cur]);
870 if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) {
871 return deposit64(env->tdata1[env->trigger_cur], 10, 14,
872 itrigger_get_adjust_count(env));
873 }
874 return env->tdata1[env->trigger_cur];
875 case TDATA2:
876 return env->tdata2[env->trigger_cur];
877 case TDATA3:
878 return env->tdata3[env->trigger_cur];
879 default:
880 g_assert_not_reached();
881 }
882 }
883
884 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
885 {
886 int trigger_type;
887
888 if (tdata_index == TDATA1) {
889 trigger_type = extract_trigger_type(env, val);
890 } else {
891 trigger_type = get_trigger_type(env, env->trigger_cur);
892 }
893
894 switch (trigger_type) {
895 case TRIGGER_TYPE_AD_MATCH:
896 type2_reg_write(env, env->trigger_cur, tdata_index, val);
897 break;
898 case TRIGGER_TYPE_AD_MATCH6:
899 type6_reg_write(env, env->trigger_cur, tdata_index, val);
900 break;
901 case TRIGGER_TYPE_INST_CNT:
902 itrigger_reg_write(env, env->trigger_cur, tdata_index, val);
903 break;
904 case TRIGGER_TYPE_INT:
905 case TRIGGER_TYPE_EXCP:
906 case TRIGGER_TYPE_EXT_SRC:
907 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
908 trigger_type);
909 break;
910 case TRIGGER_TYPE_NO_EXIST:
911 case TRIGGER_TYPE_UNAVAIL:
912 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
913 trigger_type);
914 break;
915 default:
916 g_assert_not_reached();
917 }
918 }
919
920 target_ulong tinfo_csr_read(CPURISCVState *env)
921 {
922 /* assume all triggers support the same types of triggers */
923 return BIT(TRIGGER_TYPE_AD_MATCH) |
924 BIT(TRIGGER_TYPE_AD_MATCH6);
925 }
926
927 void riscv_cpu_debug_excp_handler(CPUState *cs)
928 {
929 RISCVCPU *cpu = RISCV_CPU(cs);
930 CPURISCVState *env = &cpu->env;
931
932 if (cs->watchpoint_hit) {
933 if (cs->watchpoint_hit->flags & BP_CPU) {
934 do_trigger_action(env, DBG_ACTION_BP);
935 }
936 } else {
937 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) {
938 do_trigger_action(env, DBG_ACTION_BP);
939 }
940 }
941 }
942
943 bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
944 {
945 RISCVCPU *cpu = RISCV_CPU(cs);
946 CPURISCVState *env = &cpu->env;
947 CPUBreakpoint *bp;
948 target_ulong ctrl;
949 target_ulong pc;
950 int trigger_type;
951 int i;
952
953 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
954 for (i = 0; i < env->num_triggers; i++) {
955 trigger_type = get_trigger_type(env, i);
956
957 if (!trigger_common_match(env, trigger_type, i)) {
958 continue;
959 }
960
961 switch (trigger_type) {
962 case TRIGGER_TYPE_AD_MATCH:
963 ctrl = env->tdata1[i];
964 pc = env->tdata2[i];
965
966 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
967 env->badaddr = pc;
968 return true;
969 }
970 break;
971 case TRIGGER_TYPE_AD_MATCH6:
972 ctrl = env->tdata1[i];
973 pc = env->tdata2[i];
974
975 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
976 env->badaddr = pc;
977 return true;
978 }
979 break;
980 default:
981 /* other trigger types are not supported or irrelevant */
982 break;
983 }
984 }
985 }
986
987 return false;
988 }
989
990 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
991 {
992 RISCVCPU *cpu = RISCV_CPU(cs);
993 CPURISCVState *env = &cpu->env;
994 target_ulong ctrl;
995 target_ulong addr;
996 int trigger_type;
997 int flags;
998 int i;
999
1000 for (i = 0; i < env->num_triggers; i++) {
1001 trigger_type = get_trigger_type(env, i);
1002
1003 if (!trigger_common_match(env, trigger_type, i)) {
1004 continue;
1005 }
1006
1007 switch (trigger_type) {
1008 case TRIGGER_TYPE_AD_MATCH:
1009 ctrl = env->tdata1[i];
1010 addr = env->tdata2[i];
1011 flags = 0;
1012
1013 if (ctrl & TYPE2_LOAD) {
1014 flags |= BP_MEM_READ;
1015 }
1016 if (ctrl & TYPE2_STORE) {
1017 flags |= BP_MEM_WRITE;
1018 }
1019
1020 if ((wp->flags & flags) && (wp->vaddr == addr)) {
1021 return true;
1022 }
1023 break;
1024 case TRIGGER_TYPE_AD_MATCH6:
1025 ctrl = env->tdata1[i];
1026 addr = env->tdata2[i];
1027 flags = 0;
1028
1029 if (ctrl & TYPE6_LOAD) {
1030 flags |= BP_MEM_READ;
1031 }
1032 if (ctrl & TYPE6_STORE) {
1033 flags |= BP_MEM_WRITE;
1034 }
1035
1036 if ((wp->flags & flags) && (wp->vaddr == addr)) {
1037 return true;
1038 }
1039 break;
1040 default:
1041 /* other trigger types are not supported */
1042 break;
1043 }
1044 }
1045
1046 return false;
1047 }
1048
1049 void riscv_trigger_realize(CPURISCVState *env)
1050 {
1051 int i;
1052
1053 if (env->num_triggers > RV_MAX_TRIGGERS) {
1054 error_report(
1055 "Invalid configuration: 'num-triggers' must be less than %u",
1056 RV_MAX_TRIGGERS);
1057 exit(1);
1058 }
1059
1060 env->tdata1 = g_new0(uint64_t, env->num_triggers);
1061 env->tdata2 = g_new0(uint64_t, env->num_triggers);
1062 env->tdata3 = g_new0(uint64_t, env->num_triggers);
1063 env->cpu_breakpoint = g_new0(struct CPUBreakpoint *, env->num_triggers);
1064 env->cpu_watchpoint = g_new0(struct CPUWatchpoint *, env->num_triggers);
1065 env->itrigger_timer = g_new0(QEMUTimer *, env->num_triggers);
1066
1067 for (i = 0; i < env->num_triggers; i++) {
1068 env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
1069 riscv_itrigger_timer_cb, env);
1070 }
1071 }
1072
1073 void riscv_trigger_unrealize(CPURISCVState *env)
1074 {
1075 g_free(env->tdata1);
1076 g_free(env->tdata2);
1077 g_free(env->tdata3);
1078
1079 g_free(env->cpu_breakpoint);
1080 g_free(env->cpu_watchpoint);
1081
1082 for (int i = 0; i < env->num_triggers; i++) {
1083 timer_free(env->itrigger_timer[i]);
1084 }
1085 g_free(env->itrigger_timer);
1086 }
1087
1088 void riscv_trigger_reset_hold(CPURISCVState *env)
1089 {
1090 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
1091 int i;
1092
1093 /* init to type 2 triggers */
1094 for (i = 0; i < env->num_triggers; i++) {
1095 /*
1096 * type = TRIGGER_TYPE_AD_MATCH
1097 * dmode = 0 (both debug and M-mode can write tdata)
1098 * maskmax = 0 (unimplemented, always 0)
1099 * sizehi = 0 (match against any size, RV64 only)
1100 * hit = 0 (unimplemented, always 0)
1101 * select = 0 (always 0, perform match on address)
1102 * timing = 0 (always 0, trigger before instruction)
1103 * sizelo = 0 (match against any size)
1104 * action = 0 (always 0, raise a breakpoint exception)
1105 * chain = 0 (unimplemented, always 0)
1106 * match = 0 (always 0, when any compare value equals tdata2)
1107 */
1108 env->tdata1[i] = tdata1;
1109 env->tdata2[i] = 0;
1110 env->tdata3[i] = 0;
1111 env->cpu_breakpoint[i] = NULL;
1112 env->cpu_watchpoint[i] = NULL;
1113 timer_del(env->itrigger_timer[i]);
1114 }
1115
1116 env->mcontext = 0;
1117 }