Assertion failure when force-reading a dirty register

[en-sc]

Steps to reproduce:

1. Run Spike:

> spike --rbb-port=7777 ~/openocd/boot_spike64.elf

2. Run OpenOCD:

> cat spike.cfg
adapter driver remote_bitbang
remote_bitbang port 7777
remote_bitbang host 127.0.0.1

set _CHIPNAME riscv
jtag newtap $_CHIPNAME cpu -irlen 5

set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME riscv -chain-position $_TARGETNAME -rtos hwthread
> openocd \
  -f spike.cfg \
  -c init \
  -c halt \
  -c 'reg a0 0' \
  -c 'reg a0 force' \
  -c shutdown
Open On-Chip Debugger 0.12.0+dev-02029-geb01c632a (2025-11-05-14:51)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
Warn : DEPRECATED: auto-selecting transport "jtag". Use 'transport select jtag' to suppress this message.
Info : [riscv.cpu] Hardware thread awareness created
Info : Initializing remote_bitbang driver
Info : Connecting to 127.0.0.1:7777
Info : remote_bitbang driver initialized
Info : Note: The adapter "remote_bitbang" doesn't support configurable speed
Info : JTAG tap: riscv.cpu tap/device found: 0xdeadbeef (mfg: 0x777 (Fabric of Truth Inc), part: 0xeadb, ver: 0xd)
Info : [riscv.cpu] datacount=2 progbufsize=2
Info : [riscv.cpu] Examined RISC-V core
Info : [riscv.cpu]  XLEN=64, misa=0x800000000014112d
[riscv.cpu] Target successfully examined.
Info : [riscv.cpu] Examination succeed
Info : [riscv.cpu] starting gdb server on 3333
Info : Listening on port 3333 for gdb connections
riscv.cpu halted due to undefined.
a0 (/64): 0x0000000000000000
openocd: ocd_sources/src/target/riscv/riscv_reg_impl.h:30: riscv_reg_impl_is_initialized: Assertion `reg->valid || !reg->dirty' failed.
Aborted                    (core dumped) build/Release/src/openocd -f spike.cfg -c init -c halt -c 'reg a0 0' -c 'reg a0 force' -c shutdown

[en-sc]

A bit more info on the issue:

OpenOCD implements a register cache to reduce the communication with the target.
For each register, two status bits are maintained -- valid and dirty.

riscv-openocd/src/target/register.h

Lines 123 to 126 in eb01c63

	/* The stored value needs to be written to the target. */
	bool dirty;
	/* When true, value is valid. */
	bool valid;

valid allows to cache read operations -- if a register value from the cache is valid, it can be used and there is no need to fetch it from the target.

dirty allows to cache writes -- instead of writing to the target, we can set the dirty bit, marking that the current value of the register is actually in the cache and deferring the write. If a register is written twice -- the first write will be forgotten and only the second write will be performed on the target (e.g. on resume).

The register entry starts of in an "invalid" state -- dirty == valid == false.
If a register is read and a read is cached, the register becomes "valid": dirty == false, valid == true.
If a register is written, and the read is cached, the entry becomes "dirty": dirty == true, valid == true.
See this comment (unmerged):

riscv-openocd/src/target/riscv/riscv-013_reg.c

Lines 70 to 80 in 85654c1

	/**
	* Note: There are only 3 reachable states for an item in the register cache:
	* |: state :|: "reg->valid" :|: "reg->dirty" :|
	* | "invalid" | false | false |
	* | "valid" | true | false |
	* | "dirty" | true | true |
	*
	* The state "reg->valid == dirty && reg->valid == false" should be unreacheable.
	* To achieve this, "reg->valid" and "reg->dirty" are not assigned directly
	* outside of "mark_<state>()" functions.
	*/

Now consider the state dirty == true, valid == false -- is does not make sense -- the current value should be used to update the value on the target at a later time (indicated by dirty), but this value is invalid and should not be used at all (indicated by valid).

Two operations are allowed on a register from the cache: get (read) and set (write).

riscv-openocd/src/target/register.h

Lines 151 to 154 in eb01c63

	struct reg_arch_type {
	int (*get)(struct reg *reg);
	int (*set)(struct reg *reg, uint8_t *buf);
	};

However, the Tcl interface allows an additional operation: force read. Such operation should bypass the cache and always read from the target. The issue is -- there are no such operations on the register cache entry level. So there is a hack in place reg->valid is explicitly set to false:

riscv-openocd/src/target/target.c

Lines 3113 to 3125 in eb01c63

	/* display a register */
	if ((CMD_ARGC == 1) || ((CMD_ARGC == 2) && !((CMD_ARGV[1][0] >= '0')
	&& (CMD_ARGV[1][0] <= '9')))) {
	if ((CMD_ARGC == 2) && (strcmp(CMD_ARGV[1], "force") == 0))
	reg->valid = false;
	if (!reg->valid) {
	int retval = reg->type->get(reg);
	if (retval != ERROR_OK) {
	LOG_ERROR("Could not read register '%s'", reg->name);
	return retval;
	}
	}

The bug occurs in the following scenario:

1. Register write is cached, the register is marked as dirty.
2. Register is force-read, the valid bit is reset and when performing the read reg->valid || !reg->dirty check fails.

The proper fix for this issue is to drop the hack on force-read. One option is to introduce a third register method -- flush, that transfers the dirty value from the cache to the target. See https://review.openocd.org/c/openocd/+/8070

This bug was introduced because I was aware of https://review.openocd.org/c/openocd/+/8070 when developing the re-design of the stuff around register access, and I was expecting it to be merged first. However, https://review.openocd.org/c/openocd/+/8070 never got merged so the bug was introduced.