qemu/target/riscv/debug.c
<<
>>
Prefs
   1/*
   2 * QEMU RISC-V Native Debug Support
   3 *
   4 * Copyright (c) 2022 Wind River Systems, Inc.
   5 *
   6 * Author:
   7 *   Bin Meng <bin.meng@windriver.com>
   8 *
   9 * This provides the native debug support via the Trigger Module, as defined
  10 * in the RISC-V Debug Specification:
  11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf
  12 *
  13 * This program is free software; you can redistribute it and/or modify it
  14 * under the terms and conditions of the GNU General Public License,
  15 * version 2 or later, as published by the Free Software Foundation.
  16 *
  17 * This program is distributed in the hope it will be useful, but WITHOUT
  18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  19 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  20 * more details.
  21 *
  22 * You should have received a copy of the GNU General Public License along with
  23 * this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26#include "qemu/osdep.h"
  27#include "qemu/log.h"
  28#include "qapi/error.h"
  29#include "cpu.h"
  30#include "trace.h"
  31#include "exec/exec-all.h"
  32#include "exec/helper-proto.h"
  33#include "sysemu/cpu-timers.h"
  34
  35/*
  36 * The following M-mode trigger CSRs are implemented:
  37 *
  38 * - tselect
  39 * - tdata1
  40 * - tdata2
  41 * - tdata3
  42 * - tinfo
  43 *
  44 * The following triggers are initialized by default:
  45 *
  46 * Index | Type |          tdata mapping | Description
  47 * ------+------+------------------------+------------
  48 *     0 |    2 |         tdata1, tdata2 | Address / Data Match
  49 *     1 |    2 |         tdata1, tdata2 | Address / Data Match
  50 */
  51
  52/* tdata availability of a trigger */
  53typedef bool tdata_avail[TDATA_NUM];
  54
  55static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = {
  56    [TRIGGER_TYPE_NO_EXIST] = { false, false, false },
  57    [TRIGGER_TYPE_AD_MATCH] = { true, true, true },
  58    [TRIGGER_TYPE_INST_CNT] = { true, false, true },
  59    [TRIGGER_TYPE_INT] = { true, true, true },
  60    [TRIGGER_TYPE_EXCP] = { true, true, true },
  61    [TRIGGER_TYPE_AD_MATCH6] = { true, true, true },
  62    [TRIGGER_TYPE_EXT_SRC] = { true, false, false },
  63    [TRIGGER_TYPE_UNAVAIL] = { true, true, true }
  64};
  65
  66/* only breakpoint size 1/2/4/8 supported */
  67static int access_size[SIZE_NUM] = {
  68    [SIZE_ANY] = 0,
  69    [SIZE_1B]  = 1,
  70    [SIZE_2B]  = 2,
  71    [SIZE_4B]  = 4,
  72    [SIZE_6B]  = -1,
  73    [SIZE_8B]  = 8,
  74    [6 ... 15] = -1,
  75};
  76
  77static inline target_ulong extract_trigger_type(CPURISCVState *env,
  78                                                target_ulong tdata1)
  79{
  80    switch (riscv_cpu_mxl(env)) {
  81    case MXL_RV32:
  82        return extract32(tdata1, 28, 4);
  83    case MXL_RV64:
  84    case MXL_RV128:
  85        return extract64(tdata1, 60, 4);
  86    default:
  87        g_assert_not_reached();
  88    }
  89}
  90
  91static inline target_ulong get_trigger_type(CPURISCVState *env,
  92                                            target_ulong trigger_index)
  93{
  94    return extract_trigger_type(env, env->tdata1[trigger_index]);
  95}
  96
  97static trigger_action_t get_trigger_action(CPURISCVState *env,
  98                                           target_ulong trigger_index)
  99{
 100    target_ulong tdata1 = env->tdata1[trigger_index];
 101    int trigger_type = get_trigger_type(env, trigger_index);
 102    trigger_action_t action = DBG_ACTION_NONE;
 103
 104    switch (trigger_type) {
 105    case TRIGGER_TYPE_AD_MATCH:
 106        action = (tdata1 & TYPE2_ACTION) >> 12;
 107        break;
 108    case TRIGGER_TYPE_AD_MATCH6:
 109        action = (tdata1 & TYPE6_ACTION) >> 12;
 110        break;
 111    case TRIGGER_TYPE_INST_CNT:
 112    case TRIGGER_TYPE_INT:
 113    case TRIGGER_TYPE_EXCP:
 114    case TRIGGER_TYPE_EXT_SRC:
 115        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
 116                      trigger_type);
 117        break;
 118    case TRIGGER_TYPE_NO_EXIST:
 119    case TRIGGER_TYPE_UNAVAIL:
 120        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
 121                      trigger_type);
 122        break;
 123    default:
 124        g_assert_not_reached();
 125    }
 126
 127    return action;
 128}
 129
 130static inline target_ulong build_tdata1(CPURISCVState *env,
 131                                        trigger_type_t type,
 132                                        bool dmode, target_ulong data)
 133{
 134    target_ulong tdata1;
 135
 136    switch (riscv_cpu_mxl(env)) {
 137    case MXL_RV32:
 138        tdata1 = RV32_TYPE(type) |
 139                 (dmode ? RV32_DMODE : 0) |
 140                 (data & RV32_DATA_MASK);
 141        break;
 142    case MXL_RV64:
 143    case MXL_RV128:
 144        tdata1 = RV64_TYPE(type) |
 145                 (dmode ? RV64_DMODE : 0) |
 146                 (data & RV64_DATA_MASK);
 147        break;
 148    default:
 149        g_assert_not_reached();
 150    }
 151
 152    return tdata1;
 153}
 154
 155bool tdata_available(CPURISCVState *env, int tdata_index)
 156{
 157    int trigger_type = get_trigger_type(env, env->trigger_cur);
 158
 159    if (unlikely(tdata_index >= TDATA_NUM)) {
 160        return false;
 161    }
 162
 163    return tdata_mapping[trigger_type][tdata_index];
 164}
 165
 166target_ulong tselect_csr_read(CPURISCVState *env)
 167{
 168    return env->trigger_cur;
 169}
 170
 171void tselect_csr_write(CPURISCVState *env, target_ulong val)
 172{
 173    if (val < RV_MAX_TRIGGERS) {
 174        env->trigger_cur = val;
 175    }
 176}
 177
 178static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
 179                                    trigger_type_t t)
 180{
 181    uint32_t type, dmode;
 182    target_ulong tdata1;
 183
 184    switch (riscv_cpu_mxl(env)) {
 185    case MXL_RV32:
 186        type = extract32(val, 28, 4);
 187        dmode = extract32(val, 27, 1);
 188        tdata1 = RV32_TYPE(t);
 189        break;
 190    case MXL_RV64:
 191    case MXL_RV128:
 192        type = extract64(val, 60, 4);
 193        dmode = extract64(val, 59, 1);
 194        tdata1 = RV64_TYPE(t);
 195        break;
 196    default:
 197        g_assert_not_reached();
 198    }
 199
 200    if (type != t) {
 201        qemu_log_mask(LOG_GUEST_ERROR,
 202                      "ignoring type write to tdata1 register\n");
 203    }
 204
 205    if (dmode != 0) {
 206        qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n");
 207    }
 208
 209    return tdata1;
 210}
 211
 212static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
 213                                        const char *msg)
 214{
 215    if (val & mask) {
 216        qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg);
 217    }
 218}
 219
 220static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
 221{
 222    trigger_action_t action = get_trigger_action(env, trigger_index);
 223
 224    switch (action) {
 225    case DBG_ACTION_NONE:
 226        break;
 227    case DBG_ACTION_BP:
 228        riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
 229        break;
 230    case DBG_ACTION_DBG_MODE:
 231    case DBG_ACTION_TRACE0:
 232    case DBG_ACTION_TRACE1:
 233    case DBG_ACTION_TRACE2:
 234    case DBG_ACTION_TRACE3:
 235    case DBG_ACTION_EXT_DBG0:
 236    case DBG_ACTION_EXT_DBG1:
 237        qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action);
 238        break;
 239    default:
 240        g_assert_not_reached();
 241    }
 242}
 243
 244/* type 2 trigger */
 245
 246static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
 247{
 248    uint32_t sizelo, sizehi = 0;
 249
 250    if (riscv_cpu_mxl(env) == MXL_RV64) {
 251        sizehi = extract32(ctrl, 21, 2);
 252    }
 253    sizelo = extract32(ctrl, 16, 2);
 254    return (sizehi << 2) | sizelo;
 255}
 256
 257static inline bool type2_breakpoint_enabled(target_ulong ctrl)
 258{
 259    bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M));
 260    bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
 261
 262    return mode && rwx;
 263}
 264
 265static target_ulong type2_mcontrol_validate(CPURISCVState *env,
 266                                            target_ulong ctrl)
 267{
 268    target_ulong val;
 269    uint32_t size;
 270
 271    /* validate the generic part first */
 272    val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH);
 273
 274    /* validate unimplemented (always zero) bits */
 275    warn_always_zero_bit(ctrl, TYPE2_MATCH, "match");
 276    warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain");
 277    warn_always_zero_bit(ctrl, TYPE2_ACTION, "action");
 278    warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing");
 279    warn_always_zero_bit(ctrl, TYPE2_SELECT, "select");
 280    warn_always_zero_bit(ctrl, TYPE2_HIT, "hit");
 281
 282    /* validate size encoding */
 283    size = type2_breakpoint_size(env, ctrl);
 284    if (access_size[size] == -1) {
 285        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
 286                      size);
 287    } else {
 288        val |= (ctrl & TYPE2_SIZELO);
 289        if (riscv_cpu_mxl(env) == MXL_RV64) {
 290            val |= (ctrl & TYPE2_SIZEHI);
 291        }
 292    }
 293
 294    /* keep the mode and attribute bits */
 295    val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M |
 296                    TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
 297
 298    return val;
 299}
 300
 301static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
 302{
 303    target_ulong ctrl = env->tdata1[index];
 304    target_ulong addr = env->tdata2[index];
 305    bool enabled = type2_breakpoint_enabled(ctrl);
 306    CPUState *cs = env_cpu(env);
 307    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 308    uint32_t size;
 309
 310    if (!enabled) {
 311        return;
 312    }
 313
 314    if (ctrl & TYPE2_EXEC) {
 315        cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
 316    }
 317
 318    if (ctrl & TYPE2_LOAD) {
 319        flags |= BP_MEM_READ;
 320    }
 321    if (ctrl & TYPE2_STORE) {
 322        flags |= BP_MEM_WRITE;
 323    }
 324
 325    if (flags & BP_MEM_ACCESS) {
 326        size = type2_breakpoint_size(env, ctrl);
 327        if (size != 0) {
 328            cpu_watchpoint_insert(cs, addr, size, flags,
 329                                  &env->cpu_watchpoint[index]);
 330        } else {
 331            cpu_watchpoint_insert(cs, addr, 8, flags,
 332                                  &env->cpu_watchpoint[index]);
 333        }
 334    }
 335}
 336
 337static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
 338{
 339    CPUState *cs = env_cpu(env);
 340
 341    if (env->cpu_breakpoint[index]) {
 342        cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
 343        env->cpu_breakpoint[index] = NULL;
 344    }
 345
 346    if (env->cpu_watchpoint[index]) {
 347        cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
 348        env->cpu_watchpoint[index] = NULL;
 349    }
 350}
 351
 352static void type2_reg_write(CPURISCVState *env, target_ulong index,
 353                            int tdata_index, target_ulong val)
 354{
 355    target_ulong new_val;
 356
 357    switch (tdata_index) {
 358    case TDATA1:
 359        new_val = type2_mcontrol_validate(env, val);
 360        if (new_val != env->tdata1[index]) {
 361            env->tdata1[index] = new_val;
 362            type2_breakpoint_remove(env, index);
 363            type2_breakpoint_insert(env, index);
 364        }
 365        break;
 366    case TDATA2:
 367        if (val != env->tdata2[index]) {
 368            env->tdata2[index] = val;
 369            type2_breakpoint_remove(env, index);
 370            type2_breakpoint_insert(env, index);
 371        }
 372        break;
 373    case TDATA3:
 374        qemu_log_mask(LOG_UNIMP,
 375                      "tdata3 is not supported for type 2 trigger\n");
 376        break;
 377    default:
 378        g_assert_not_reached();
 379    }
 380
 381    return;
 382}
 383
 384/* type 6 trigger */
 385
 386static inline bool type6_breakpoint_enabled(target_ulong ctrl)
 387{
 388    bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
 389    bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
 390
 391    return mode && rwx;
 392}
 393
 394static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
 395                                             target_ulong ctrl)
 396{
 397    target_ulong val;
 398    uint32_t size;
 399
 400    /* validate the generic part first */
 401    val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6);
 402
 403    /* validate unimplemented (always zero) bits */
 404    warn_always_zero_bit(ctrl, TYPE6_MATCH, "match");
 405    warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain");
 406    warn_always_zero_bit(ctrl, TYPE6_ACTION, "action");
 407    warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing");
 408    warn_always_zero_bit(ctrl, TYPE6_SELECT, "select");
 409    warn_always_zero_bit(ctrl, TYPE6_HIT, "hit");
 410
 411    /* validate size encoding */
 412    size = extract32(ctrl, 16, 4);
 413    if (access_size[size] == -1) {
 414        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
 415                      size);
 416    } else {
 417        val |= (ctrl & TYPE6_SIZE);
 418    }
 419
 420    /* keep the mode and attribute bits */
 421    val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M |
 422                    TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
 423
 424    return val;
 425}
 426
 427static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
 428{
 429    target_ulong ctrl = env->tdata1[index];
 430    target_ulong addr = env->tdata2[index];
 431    bool enabled = type6_breakpoint_enabled(ctrl);
 432    CPUState *cs = env_cpu(env);
 433    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 434    uint32_t size;
 435
 436    if (!enabled) {
 437        return;
 438    }
 439
 440    if (ctrl & TYPE6_EXEC) {
 441        cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
 442    }
 443
 444    if (ctrl & TYPE6_LOAD) {
 445        flags |= BP_MEM_READ;
 446    }
 447
 448    if (ctrl & TYPE6_STORE) {
 449        flags |= BP_MEM_WRITE;
 450    }
 451
 452    if (flags & BP_MEM_ACCESS) {
 453        size = extract32(ctrl, 16, 4);
 454        if (size != 0) {
 455            cpu_watchpoint_insert(cs, addr, size, flags,
 456                                  &env->cpu_watchpoint[index]);
 457        } else {
 458            cpu_watchpoint_insert(cs, addr, 8, flags,
 459                                  &env->cpu_watchpoint[index]);
 460        }
 461    }
 462}
 463
 464static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
 465{
 466    type2_breakpoint_remove(env, index);
 467}
 468
 469static void type6_reg_write(CPURISCVState *env, target_ulong index,
 470                            int tdata_index, target_ulong val)
 471{
 472    target_ulong new_val;
 473
 474    switch (tdata_index) {
 475    case TDATA1:
 476        new_val = type6_mcontrol6_validate(env, val);
 477        if (new_val != env->tdata1[index]) {
 478            env->tdata1[index] = new_val;
 479            type6_breakpoint_remove(env, index);
 480            type6_breakpoint_insert(env, index);
 481        }
 482        break;
 483    case TDATA2:
 484        if (val != env->tdata2[index]) {
 485            env->tdata2[index] = val;
 486            type6_breakpoint_remove(env, index);
 487            type6_breakpoint_insert(env, index);
 488        }
 489        break;
 490    case TDATA3:
 491        qemu_log_mask(LOG_UNIMP,
 492                      "tdata3 is not supported for type 6 trigger\n");
 493        break;
 494    default:
 495        g_assert_not_reached();
 496    }
 497
 498    return;
 499}
 500
 501/* icount trigger type */
 502static inline int
 503itrigger_get_count(CPURISCVState *env, int index)
 504{
 505    return get_field(env->tdata1[index], ITRIGGER_COUNT);
 506}
 507
 508static inline void
 509itrigger_set_count(CPURISCVState *env, int index, int value)
 510{
 511    env->tdata1[index] = set_field(env->tdata1[index],
 512                                   ITRIGGER_COUNT, value);
 513}
 514
 515static bool check_itrigger_priv(CPURISCVState *env, int index)
 516{
 517    target_ulong tdata1 = env->tdata1[index];
 518    if (riscv_cpu_virt_enabled(env)) {
 519        /* check VU/VS bit against current privilege level */
 520        return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
 521               (get_field(tdata1, ITRIGGER_VU) == env->priv);
 522    } else {
 523        /* check U/S/M bit against current privilege level */
 524        return (get_field(tdata1, ITRIGGER_M) == env->priv) ||
 525               (get_field(tdata1, ITRIGGER_S) == env->priv) ||
 526               (get_field(tdata1, ITRIGGER_U) == env->priv);
 527    }
 528}
 529
 530bool riscv_itrigger_enabled(CPURISCVState *env)
 531{
 532    int count;
 533    for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
 534        if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
 535            continue;
 536        }
 537        if (check_itrigger_priv(env, i)) {
 538            continue;
 539        }
 540        count = itrigger_get_count(env, i);
 541        if (!count) {
 542            continue;
 543        }
 544        return true;
 545    }
 546
 547    return false;
 548}
 549
 550void helper_itrigger_match(CPURISCVState *env)
 551{
 552    int count;
 553    for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
 554        if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
 555            continue;
 556        }
 557        if (check_itrigger_priv(env, i)) {
 558            continue;
 559        }
 560        count = itrigger_get_count(env, i);
 561        if (!count) {
 562            continue;
 563        }
 564        itrigger_set_count(env, i, count--);
 565        if (!count) {
 566            env->itrigger_enabled = riscv_itrigger_enabled(env);
 567            do_trigger_action(env, i);
 568        }
 569    }
 570}
 571
 572static void riscv_itrigger_update_count(CPURISCVState *env)
 573{
 574    int count, executed;
 575    /*
 576     * Record last icount, so that we can evaluate the executed instructions
 577     * since last priviledge mode change or timer expire.
 578     */
 579    int64_t last_icount = env->last_icount, current_icount;
 580    current_icount = env->last_icount = icount_get_raw();
 581
 582    for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
 583        if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
 584            continue;
 585        }
 586        count = itrigger_get_count(env, i);
 587        if (!count) {
 588            continue;
 589        }
 590        /*
 591         * Only when priviledge is changed or itrigger timer expires,
 592         * the count field in itrigger tdata1 register is updated.
 593         * And the count field in itrigger only contains remaining value.
 594         */
 595        if (check_itrigger_priv(env, i)) {
 596            /*
 597             * If itrigger enabled in this priviledge mode, the number of
 598             * executed instructions since last priviledge change
 599             * should be reduced from current itrigger count.
 600             */
 601            executed = current_icount - last_icount;
 602            itrigger_set_count(env, i, count - executed);
 603            if (count == executed) {
 604                do_trigger_action(env, i);
 605            }
 606        } else {
 607            /*
 608             * If itrigger is not enabled in this priviledge mode,
 609             * the number of executed instructions will be discard and
 610             * the count field in itrigger will not change.
 611             */
 612            timer_mod(env->itrigger_timer[i],
 613                      current_icount + count);
 614        }
 615    }
 616}
 617
 618static void riscv_itrigger_timer_cb(void *opaque)
 619{
 620    riscv_itrigger_update_count((CPURISCVState *)opaque);
 621}
 622
 623void riscv_itrigger_update_priv(CPURISCVState *env)
 624{
 625    riscv_itrigger_update_count(env);
 626}
 627
 628static target_ulong itrigger_validate(CPURISCVState *env,
 629                                      target_ulong ctrl)
 630{
 631    target_ulong val;
 632
 633    /* validate the generic part first */
 634    val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT);
 635
 636    /* validate unimplemented (always zero) bits */
 637    warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action");
 638    warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit");
 639    warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending");
 640
 641    /* keep the mode and attribute bits */
 642    val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S |
 643                   ITRIGGER_M | ITRIGGER_COUNT);
 644
 645    return val;
 646}
 647
 648static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
 649                               int tdata_index, target_ulong val)
 650{
 651    target_ulong new_val;
 652
 653    switch (tdata_index) {
 654    case TDATA1:
 655        /* set timer for icount */
 656        new_val = itrigger_validate(env, val);
 657        if (new_val != env->tdata1[index]) {
 658            env->tdata1[index] = new_val;
 659            if (icount_enabled()) {
 660                env->last_icount = icount_get_raw();
 661                /* set the count to timer */
 662                timer_mod(env->itrigger_timer[index],
 663                          env->last_icount + itrigger_get_count(env, index));
 664            } else {
 665                env->itrigger_enabled = riscv_itrigger_enabled(env);
 666            }
 667        }
 668        break;
 669    case TDATA2:
 670        qemu_log_mask(LOG_UNIMP,
 671                      "tdata2 is not supported for icount trigger\n");
 672        break;
 673    case TDATA3:
 674        qemu_log_mask(LOG_UNIMP,
 675                      "tdata3 is not supported for icount trigger\n");
 676        break;
 677    default:
 678        g_assert_not_reached();
 679    }
 680
 681    return;
 682}
 683
 684static int itrigger_get_adjust_count(CPURISCVState *env)
 685{
 686    int count = itrigger_get_count(env, env->trigger_cur), executed;
 687    if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) {
 688        executed = icount_get_raw() - env->last_icount;
 689        count += executed;
 690    }
 691    return count;
 692}
 693
 694target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
 695{
 696    int trigger_type;
 697    switch (tdata_index) {
 698    case TDATA1:
 699        trigger_type = extract_trigger_type(env, env->tdata1[env->trigger_cur]);
 700        if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) {
 701            return deposit64(env->tdata1[env->trigger_cur], 10, 14,
 702                             itrigger_get_adjust_count(env));
 703        }
 704        return env->tdata1[env->trigger_cur];
 705    case TDATA2:
 706        return env->tdata2[env->trigger_cur];
 707    case TDATA3:
 708        return env->tdata3[env->trigger_cur];
 709    default:
 710        g_assert_not_reached();
 711    }
 712}
 713
 714void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
 715{
 716    int trigger_type;
 717
 718    if (tdata_index == TDATA1) {
 719        trigger_type = extract_trigger_type(env, val);
 720    } else {
 721        trigger_type = get_trigger_type(env, env->trigger_cur);
 722    }
 723
 724    switch (trigger_type) {
 725    case TRIGGER_TYPE_AD_MATCH:
 726        type2_reg_write(env, env->trigger_cur, tdata_index, val);
 727        break;
 728    case TRIGGER_TYPE_AD_MATCH6:
 729        type6_reg_write(env, env->trigger_cur, tdata_index, val);
 730        break;
 731    case TRIGGER_TYPE_INST_CNT:
 732        itrigger_reg_write(env, env->trigger_cur, tdata_index, val);
 733        break;
 734    case TRIGGER_TYPE_INT:
 735    case TRIGGER_TYPE_EXCP:
 736    case TRIGGER_TYPE_EXT_SRC:
 737        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
 738                      trigger_type);
 739        break;
 740    case TRIGGER_TYPE_NO_EXIST:
 741    case TRIGGER_TYPE_UNAVAIL:
 742        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
 743                      trigger_type);
 744        break;
 745    default:
 746        g_assert_not_reached();
 747    }
 748}
 749
 750target_ulong tinfo_csr_read(CPURISCVState *env)
 751{
 752    /* assume all triggers support the same types of triggers */
 753    return BIT(TRIGGER_TYPE_AD_MATCH) |
 754           BIT(TRIGGER_TYPE_AD_MATCH6);
 755}
 756
 757void riscv_cpu_debug_excp_handler(CPUState *cs)
 758{
 759    RISCVCPU *cpu = RISCV_CPU(cs);
 760    CPURISCVState *env = &cpu->env;
 761
 762    if (cs->watchpoint_hit) {
 763        if (cs->watchpoint_hit->flags & BP_CPU) {
 764            do_trigger_action(env, DBG_ACTION_BP);
 765        }
 766    } else {
 767        if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) {
 768            do_trigger_action(env, DBG_ACTION_BP);
 769        }
 770    }
 771}
 772
 773bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
 774{
 775    RISCVCPU *cpu = RISCV_CPU(cs);
 776    CPURISCVState *env = &cpu->env;
 777    CPUBreakpoint *bp;
 778    target_ulong ctrl;
 779    target_ulong pc;
 780    int trigger_type;
 781    int i;
 782
 783    QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
 784        for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 785            trigger_type = get_trigger_type(env, i);
 786
 787            switch (trigger_type) {
 788            case TRIGGER_TYPE_AD_MATCH:
 789                /* type 2 trigger cannot be fired in VU/VS mode */
 790                if (riscv_cpu_virt_enabled(env)) {
 791                    return false;
 792                }
 793
 794                ctrl = env->tdata1[i];
 795                pc = env->tdata2[i];
 796
 797                if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
 798                    /* check U/S/M bit against current privilege level */
 799                    if ((ctrl >> 3) & BIT(env->priv)) {
 800                        return true;
 801                    }
 802                }
 803                break;
 804            case TRIGGER_TYPE_AD_MATCH6:
 805                ctrl = env->tdata1[i];
 806                pc = env->tdata2[i];
 807
 808                if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
 809                    if (riscv_cpu_virt_enabled(env)) {
 810                        /* check VU/VS bit against current privilege level */
 811                        if ((ctrl >> 23) & BIT(env->priv)) {
 812                            return true;
 813                        }
 814                    } else {
 815                        /* check U/S/M bit against current privilege level */
 816                        if ((ctrl >> 3) & BIT(env->priv)) {
 817                            return true;
 818                        }
 819                    }
 820                }
 821                break;
 822            default:
 823                /* other trigger types are not supported or irrelevant */
 824                break;
 825            }
 826        }
 827    }
 828
 829    return false;
 830}
 831
 832bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 833{
 834    RISCVCPU *cpu = RISCV_CPU(cs);
 835    CPURISCVState *env = &cpu->env;
 836    target_ulong ctrl;
 837    target_ulong addr;
 838    int trigger_type;
 839    int flags;
 840    int i;
 841
 842    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 843        trigger_type = get_trigger_type(env, i);
 844
 845        switch (trigger_type) {
 846        case TRIGGER_TYPE_AD_MATCH:
 847            /* type 2 trigger cannot be fired in VU/VS mode */
 848            if (riscv_cpu_virt_enabled(env)) {
 849                return false;
 850            }
 851
 852            ctrl = env->tdata1[i];
 853            addr = env->tdata2[i];
 854            flags = 0;
 855
 856            if (ctrl & TYPE2_LOAD) {
 857                flags |= BP_MEM_READ;
 858            }
 859            if (ctrl & TYPE2_STORE) {
 860                flags |= BP_MEM_WRITE;
 861            }
 862
 863            if ((wp->flags & flags) && (wp->vaddr == addr)) {
 864                /* check U/S/M bit against current privilege level */
 865                if ((ctrl >> 3) & BIT(env->priv)) {
 866                    return true;
 867                }
 868            }
 869            break;
 870        case TRIGGER_TYPE_AD_MATCH6:
 871            ctrl = env->tdata1[i];
 872            addr = env->tdata2[i];
 873            flags = 0;
 874
 875            if (ctrl & TYPE6_LOAD) {
 876                flags |= BP_MEM_READ;
 877            }
 878            if (ctrl & TYPE6_STORE) {
 879                flags |= BP_MEM_WRITE;
 880            }
 881
 882            if ((wp->flags & flags) && (wp->vaddr == addr)) {
 883                if (riscv_cpu_virt_enabled(env)) {
 884                    /* check VU/VS bit against current privilege level */
 885                    if ((ctrl >> 23) & BIT(env->priv)) {
 886                        return true;
 887                    }
 888                } else {
 889                    /* check U/S/M bit against current privilege level */
 890                    if ((ctrl >> 3) & BIT(env->priv)) {
 891                        return true;
 892                    }
 893                }
 894            }
 895            break;
 896        default:
 897            /* other trigger types are not supported */
 898            break;
 899        }
 900    }
 901
 902    return false;
 903}
 904
 905void riscv_trigger_init(CPURISCVState *env)
 906{
 907    target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
 908    int i;
 909
 910    /* init to type 2 triggers */
 911    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 912        /*
 913         * type = TRIGGER_TYPE_AD_MATCH
 914         * dmode = 0 (both debug and M-mode can write tdata)
 915         * maskmax = 0 (unimplemented, always 0)
 916         * sizehi = 0 (match against any size, RV64 only)
 917         * hit = 0 (unimplemented, always 0)
 918         * select = 0 (always 0, perform match on address)
 919         * timing = 0 (always 0, trigger before instruction)
 920         * sizelo = 0 (match against any size)
 921         * action = 0 (always 0, raise a breakpoint exception)
 922         * chain = 0 (unimplemented, always 0)
 923         * match = 0 (always 0, when any compare value equals tdata2)
 924         */
 925        env->tdata1[i] = tdata1;
 926        env->tdata2[i] = 0;
 927        env->tdata3[i] = 0;
 928        env->cpu_breakpoint[i] = NULL;
 929        env->cpu_watchpoint[i] = NULL;
 930        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 931                                              riscv_itrigger_timer_cb, env);
 932    }
 933}
 934