target/riscv/debug.c

   1 /*
   2  * QEMU RISC-V Native Debug Support
   3  *
   4  * Copyright (c) 2022 Wind River Systems, Inc.
   5  *
   6  * Author:
   7  *   Bin Meng <bin.meng@windriver.com>
   8  *
   9  * This provides the native debug support via the Trigger Module, as defined
  10  * in the RISC-V Debug Specification:
  11  * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms and conditions of the GNU General Public License,
  15  * version 2 or later, as published by the Free Software Foundation.
  16  *
  17  * This program is distributed in the hope it will be useful, but WITHOUT
  18  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  19  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  20  * more details.
  21  *
  22  * You should have received a copy of the GNU General Public License along with
  23  * this program.  If not, see <http://www.gnu.org/licenses/>.
  24  */
  25
  26 #include "qemu/osdep.h"
  27 #include "qemu/log.h"
  28 #include "qapi/error.h"
  29 #include "cpu.h"
  30 #include "trace.h"
  31 #include "exec/exec-all.h"
  32 #include "exec/helper-proto.h"
  33 #include "sysemu/cpu-timers.h"
  34
  35 /*
  36  * The following M-mode trigger CSRs are implemented:
  37  *
  38  * - tselect
  39  * - tdata1
  40  * - tdata2
  41  * - tdata3
  42  * - tinfo
  43  *
  44  * The following triggers are initialized by default:
  45  *
  46  * Index | Type |          tdata mapping | Description
  47  * ------+------+------------------------+------------
  48  *     0 |    2 |         tdata1, tdata2 | Address / Data Match
  49  *     1 |    2 |         tdata1, tdata2 | Address / Data Match
  50  */
  51
  52 /* tdata availability of a trigger */
  53 typedef bool tdata_avail[TDATA_NUM];
  54
  55 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = {
  56     [TRIGGER_TYPE_NO_EXIST] = { false, false, false },
  57     [TRIGGER_TYPE_AD_MATCH] = { true, true, true },
  58     [TRIGGER_TYPE_INST_CNT] = { true, false, true },
  59     [TRIGGER_TYPE_INT] = { true, true, true },
  60     [TRIGGER_TYPE_EXCP] = { true, true, true },
  61     [TRIGGER_TYPE_AD_MATCH6] = { true, true, true },
  62     [TRIGGER_TYPE_EXT_SRC] = { true, false, false },
  63     [TRIGGER_TYPE_UNAVAIL] = { true, true, true }
  64 };
  65
  66 /* only breakpoint size 1/2/4/8 supported */
  67 static int access_size[SIZE_NUM] = {
  68     [SIZE_ANY] = 0,
  69     [SIZE_1B]  = 1,
  70     [SIZE_2B]  = 2,
  71     [SIZE_4B]  = 4,
  72     [SIZE_6B]  = -1,
  73     [SIZE_8B]  = 8,
  74     [6 ... 15] = -1,
  75 };
  76
  77 static inline target_ulong extract_trigger_type(CPURISCVState *env,
  78                                                 target_ulong tdata1)
  79 {
  80     switch (riscv_cpu_mxl(env)) {
  81     case MXL_RV32:
  82         return extract32(tdata1, 28, 4);
  83     case MXL_RV64:
  84     case MXL_RV128:
  85         return extract64(tdata1, 60, 4);
  86     default:
  87         g_assert_not_reached();
  88     }
  89 }
  90
  91 static inline target_ulong get_trigger_type(CPURISCVState *env,
  92                                             target_ulong trigger_index)
  93 {
  94     return extract_trigger_type(env, env->tdata1[trigger_index]);
  95 }
  96
  97 static trigger_action_t get_trigger_action(CPURISCVState *env,
  98                                            target_ulong trigger_index)
  99 {
 100     target_ulong tdata1 = env->tdata1[trigger_index];
 101     int trigger_type = get_trigger_type(env, trigger_index);
 102     trigger_action_t action = DBG_ACTION_NONE;
 103
 104     switch (trigger_type) {
 105     case TRIGGER_TYPE_AD_MATCH:
 106         action = (tdata1 & TYPE2_ACTION) >> 12;
 107         break;
 108     case TRIGGER_TYPE_AD_MATCH6:
 109         action = (tdata1 & TYPE6_ACTION) >> 12;
 110         break;
 111     case TRIGGER_TYPE_INST_CNT:
 112     case TRIGGER_TYPE_INT:
 113     case TRIGGER_TYPE_EXCP:
 114     case TRIGGER_TYPE_EXT_SRC:
 115         qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
 116                       trigger_type);
 117         break;
 118     case TRIGGER_TYPE_NO_EXIST:
 119     case TRIGGER_TYPE_UNAVAIL:
 120         qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
 121                       trigger_type);
 122         break;
 123     default:
 124         g_assert_not_reached();
 125     }
 126
 127     return action;
 128 }
 129
 130 static inline target_ulong build_tdata1(CPURISCVState *env,
 131                                         trigger_type_t type,
 132                                         bool dmode, target_ulong data)
 133 {
 134     target_ulong tdata1;
 135
 136     switch (riscv_cpu_mxl(env)) {
 137     case MXL_RV32:
 138         tdata1 = RV32_TYPE(type) |
 139                  (dmode ? RV32_DMODE : 0) |
 140                  (data & RV32_DATA_MASK);
 141         break;
 142     case MXL_RV64:
 143     case MXL_RV128:
 144         tdata1 = RV64_TYPE(type) |
 145                  (dmode ? RV64_DMODE : 0) |
 146                  (data & RV64_DATA_MASK);
 147         break;
 148     default:
 149         g_assert_not_reached();
 150     }
 151
 152     return tdata1;
 153 }
 154
 155 bool tdata_available(CPURISCVState *env, int tdata_index)
 156 {
 157     int trigger_type = get_trigger_type(env, env->trigger_cur);
 158
 159     if (unlikely(tdata_index >= TDATA_NUM)) {
 160         return false;
 161     }
 162
 163     return tdata_mapping[trigger_type][tdata_index];
 164 }
 165
 166 target_ulong tselect_csr_read(CPURISCVState *env)
 167 {
 168     return env->trigger_cur;
 169 }
 170
 171 void tselect_csr_write(CPURISCVState *env, target_ulong val)
 172 {
 173     if (val < RV_MAX_TRIGGERS) {
 174         env->trigger_cur = val;
 175     }
 176 }
 177
 178 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
 179                                     trigger_type_t t)
 180 {
 181     uint32_t type, dmode;
 182     target_ulong tdata1;
 183
 184     switch (riscv_cpu_mxl(env)) {
 185     case MXL_RV32:
 186         type = extract32(val, 28, 4);
 187         dmode = extract32(val, 27, 1);
 188         tdata1 = RV32_TYPE(t);
 189         break;
 190     case MXL_RV64:
 191     case MXL_RV128:
 192         type = extract64(val, 60, 4);
 193         dmode = extract64(val, 59, 1);
 194         tdata1 = RV64_TYPE(t);
 195         break;
 196     default:
 197         g_assert_not_reached();
 198     }
 199
 200     if (type != t) {
 201         qemu_log_mask(LOG_GUEST_ERROR,
 202                       "ignoring type write to tdata1 register\n");
 203     }
 204
 205     if (dmode != 0) {
 206         qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n");
 207     }
 208
 209     return tdata1;
 210 }
 211
 212 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
 213                                         const char *msg)
 214 {
 215     if (val & mask) {
 216         qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg);
 217     }
 218 }
 219
 220 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
 221 {
 222     trigger_action_t action = get_trigger_action(env, trigger_index);
 223
 224     switch (action) {
 225     case DBG_ACTION_NONE:
 226         break;
 227     case DBG_ACTION_BP:
 228         riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
 229         break;
 230     case DBG_ACTION_DBG_MODE:
 231     case DBG_ACTION_TRACE0:
 232     case DBG_ACTION_TRACE1:
 233     case DBG_ACTION_TRACE2:
 234     case DBG_ACTION_TRACE3:
 235     case DBG_ACTION_EXT_DBG0:
 236     case DBG_ACTION_EXT_DBG1:
 237         qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action);
 238         break;
 239     default:
 240         g_assert_not_reached();
 241     }
 242 }
 243
 244 /* type 2 trigger */
 245
 246 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
 247 {
 248     uint32_t sizelo, sizehi = 0;
 249
 250     if (riscv_cpu_mxl(env) == MXL_RV64) {
 251         sizehi = extract32(ctrl, 21, 2);
 252     }
 253     sizelo = extract32(ctrl, 16, 2);
 254     return (sizehi << 2) | sizelo;
 255 }
 256
 257 static inline bool type2_breakpoint_enabled(target_ulong ctrl)
 258 {
 259     bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M));
 260     bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
 261
 262     return mode && rwx;
 263 }
 264
 265 static target_ulong type2_mcontrol_validate(CPURISCVState *env,
 266                                             target_ulong ctrl)
 267 {
 268     target_ulong val;
 269     uint32_t size;
 270
 271     /* validate the generic part first */
 272     val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH);
 273
 274     /* validate unimplemented (always zero) bits */
 275     warn_always_zero_bit(ctrl, TYPE2_MATCH, "match");
 276     warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain");
 277     warn_always_zero_bit(ctrl, TYPE2_ACTION, "action");
 278     warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing");
 279     warn_always_zero_bit(ctrl, TYPE2_SELECT, "select");
 280     warn_always_zero_bit(ctrl, TYPE2_HIT, "hit");
 281
 282     /* validate size encoding */
 283     size = type2_breakpoint_size(env, ctrl);
 284     if (access_size[size] == -1) {
 285         qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
 286                                  "SIZE_ANY\n", size);
 287     } else {
 288         val |= (ctrl & TYPE2_SIZELO);
 289         if (riscv_cpu_mxl(env) == MXL_RV64) {
 290             val |= (ctrl & TYPE2_SIZEHI);
 291         }
 292     }
 293
 294     /* keep the mode and attribute bits */
 295     val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M |
 296                     TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
 297
 298     return val;
 299 }
 300
 301 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
 302 {
 303     target_ulong ctrl = env->tdata1[index];
 304     target_ulong addr = env->tdata2[index];
 305     bool enabled = type2_breakpoint_enabled(ctrl);
 306     CPUState *cs = env_cpu(env);
 307     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 308     uint32_t size;
 309
 310     if (!enabled) {
 311         return;
 312     }
 313
 314     if (ctrl & TYPE2_EXEC) {
 315         cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
 316     }
 317
 318     if (ctrl & TYPE2_LOAD) {
 319         flags |= BP_MEM_READ;
 320     }
 321     if (ctrl & TYPE2_STORE) {
 322         flags |= BP_MEM_WRITE;
 323     }
 324
 325     if (flags & BP_MEM_ACCESS) {
 326         size = type2_breakpoint_size(env, ctrl);
 327         if (size != 0) {
 328             cpu_watchpoint_insert(cs, addr, size, flags,
 329                                   &env->cpu_watchpoint[index]);
 330         } else {
 331             cpu_watchpoint_insert(cs, addr, 8, flags,
 332                                   &env->cpu_watchpoint[index]);
 333         }
 334     }
 335 }
 336
 337 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
 338 {
 339     CPUState *cs = env_cpu(env);
 340
 341     if (env->cpu_breakpoint[index]) {
 342         cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
 343         env->cpu_breakpoint[index] = NULL;
 344     }
 345
 346     if (env->cpu_watchpoint[index]) {
 347         cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
 348         env->cpu_watchpoint[index] = NULL;
 349     }
 350 }
 351
 352 static void type2_reg_write(CPURISCVState *env, target_ulong index,
 353                             int tdata_index, target_ulong val)
 354 {
 355     target_ulong new_val;
 356
 357     switch (tdata_index) {
 358     case TDATA1:
 359         new_val = type2_mcontrol_validate(env, val);
 360         if (new_val != env->tdata1[index]) {
 361             env->tdata1[index] = new_val;
 362             type2_breakpoint_remove(env, index);
 363             type2_breakpoint_insert(env, index);
 364         }
 365         break;
 366     case TDATA2:
 367         if (val != env->tdata2[index]) {
 368             env->tdata2[index] = val;
 369             type2_breakpoint_remove(env, index);
 370             type2_breakpoint_insert(env, index);
 371         }
 372         break;
 373     case TDATA3:
 374         qemu_log_mask(LOG_UNIMP,
 375                       "tdata3 is not supported for type 2 trigger\n");
 376         break;
 377     default:
 378         g_assert_not_reached();
 379     }
 380
 381     return;
 382 }
 383
 384 /* type 6 trigger */
 385
 386 static inline bool type6_breakpoint_enabled(target_ulong ctrl)
 387 {
 388     bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
 389     bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
 390
 391     return mode && rwx;
 392 }
 393
 394 static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
 395                                              target_ulong ctrl)
 396 {
 397     target_ulong val;
 398     uint32_t size;
 399
 400     /* validate the generic part first */
 401     val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6);
 402
 403     /* validate unimplemented (always zero) bits */
 404     warn_always_zero_bit(ctrl, TYPE6_MATCH, "match");
 405     warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain");
 406     warn_always_zero_bit(ctrl, TYPE6_ACTION, "action");
 407     warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing");
 408     warn_always_zero_bit(ctrl, TYPE6_SELECT, "select");
 409     warn_always_zero_bit(ctrl, TYPE6_HIT, "hit");
 410
 411     /* validate size encoding */
 412     size = extract32(ctrl, 16, 4);
 413     if (access_size[size] == -1) {
 414         qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using "
 415                                  "SIZE_ANY\n", size);
 416     } else {
 417         val |= (ctrl & TYPE6_SIZE);
 418     }
 419
 420     /* keep the mode and attribute bits */
 421     val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M |
 422                     TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
 423
 424     return val;
 425 }
 426
 427 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
 428 {
 429     target_ulong ctrl = env->tdata1[index];
 430     target_ulong addr = env->tdata2[index];
 431     bool enabled = type6_breakpoint_enabled(ctrl);
 432     CPUState *cs = env_cpu(env);
 433     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 434     uint32_t size;
 435
 436     if (!enabled) {
 437         return;
 438     }
 439
 440     if (ctrl & TYPE6_EXEC) {
 441         cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
 442     }
 443
 444     if (ctrl & TYPE6_LOAD) {
 445         flags |= BP_MEM_READ;
 446     }
 447
 448     if (ctrl & TYPE6_STORE) {
 449         flags |= BP_MEM_WRITE;
 450     }
 451
 452     if (flags & BP_MEM_ACCESS) {
 453         size = extract32(ctrl, 16, 4);
 454         if (size != 0) {
 455             cpu_watchpoint_insert(cs, addr, size, flags,
 456                                   &env->cpu_watchpoint[index]);
 457         } else {
 458             cpu_watchpoint_insert(cs, addr, 8, flags,
 459                                   &env->cpu_watchpoint[index]);
 460         }
 461     }
 462 }
 463
 464 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
 465 {
 466     type2_breakpoint_remove(env, index);
 467 }
 468
 469 static void type6_reg_write(CPURISCVState *env, target_ulong index,
 470                             int tdata_index, target_ulong val)
 471 {
 472     target_ulong new_val;
 473
 474     switch (tdata_index) {
 475     case TDATA1:
 476         new_val = type6_mcontrol6_validate(env, val);
 477         if (new_val != env->tdata1[index]) {
 478             env->tdata1[index] = new_val;
 479             type6_breakpoint_remove(env, index);
 480             type6_breakpoint_insert(env, index);
 481         }
 482         break;
 483     case TDATA2:
 484         if (val != env->tdata2[index]) {
 485             env->tdata2[index] = val;
 486             type6_breakpoint_remove(env, index);
 487             type6_breakpoint_insert(env, index);
 488         }
 489         break;
 490     case TDATA3:
 491         qemu_log_mask(LOG_UNIMP,
 492                       "tdata3 is not supported for type 6 trigger\n");
 493         break;
 494     default:
 495         g_assert_not_reached();
 496     }
 497
 498     return;
 499 }
 500
 501 /* icount trigger type */
 502 static inline int
 503 itrigger_get_count(CPURISCVState *env, int index)
 504 {
 505     return get_field(env->tdata1[index], ITRIGGER_COUNT);
 506 }
 507
 508 static inline void
 509 itrigger_set_count(CPURISCVState *env, int index, int value)
 510 {
 511     env->tdata1[index] = set_field(env->tdata1[index],
 512                                    ITRIGGER_COUNT, value);
 513 }
 514
 515 static bool check_itrigger_priv(CPURISCVState *env, int index)
 516 {
 517     target_ulong tdata1 = env->tdata1[index];
 518     if (env->virt_enabled) {
 519         /* check VU/VS bit against current privilege level */
 520         return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
 521                (get_field(tdata1, ITRIGGER_VU) == env->priv);
 522     } else {
 523         /* check U/S/M bit against current privilege level */
 524         return (get_field(tdata1, ITRIGGER_M) == env->priv) ||
 525                (get_field(tdata1, ITRIGGER_S) == env->priv) ||
 526                (get_field(tdata1, ITRIGGER_U) == env->priv);
 527     }
 528 }
 529
 530 bool riscv_itrigger_enabled(CPURISCVState *env)
 531 {
 532     int count;
 533     for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
 534         if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
 535             continue;
 536         }
 537         if (check_itrigger_priv(env, i)) {
 538             continue;
 539         }
 540         count = itrigger_get_count(env, i);
 541         if (!count) {
 542             continue;
 543         }
 544         return true;
 545     }
 546
 547     return false;
 548 }
 549
 550 void helper_itrigger_match(CPURISCVState *env)
 551 {
 552     int count;
 553     for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
 554         if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
 555             continue;
 556         }
 557         if (check_itrigger_priv(env, i)) {
 558             continue;
 559         }
 560         count = itrigger_get_count(env, i);
 561         if (!count) {
 562             continue;
 563         }
 564         itrigger_set_count(env, i, count--);
 565         if (!count) {
 566             env->itrigger_enabled = riscv_itrigger_enabled(env);
 567             do_trigger_action(env, i);
 568         }
 569     }
 570 }
 571
 572 static void riscv_itrigger_update_count(CPURISCVState *env)
 573 {
 574     int count, executed;
 575     /*
 576      * Record last icount, so that we can evaluate the executed instructions
 577      * since last privilege mode change or timer expire.
 578      */
 579     int64_t last_icount = env->last_icount, current_icount;
 580     current_icount = env->last_icount = icount_get_raw();
 581
 582     for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
 583         if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
 584             continue;
 585         }
 586         count = itrigger_get_count(env, i);
 587         if (!count) {
 588             continue;
 589         }
 590         /*
 591          * Only when privilege is changed or itrigger timer expires,
 592          * the count field in itrigger tdata1 register is updated.
 593          * And the count field in itrigger only contains remaining value.
 594          */
 595         if (check_itrigger_priv(env, i)) {
 596             /*
 597              * If itrigger enabled in this privilege mode, the number of
 598              * executed instructions since last privilege change
 599              * should be reduced from current itrigger count.
 600              */
 601             executed = current_icount - last_icount;
 602             itrigger_set_count(env, i, count - executed);
 603             if (count == executed) {
 604                 do_trigger_action(env, i);
 605             }
 606         } else {
 607             /*
 608              * If itrigger is not enabled in this privilege mode,
 609              * the number of executed instructions will be discard and
 610              * the count field in itrigger will not change.
 611              */
 612             timer_mod(env->itrigger_timer[i],
 613                       current_icount + count);
 614         }
 615     }
 616 }
 617
 618 static void riscv_itrigger_timer_cb(void *opaque)
 619 {
 620     riscv_itrigger_update_count((CPURISCVState *)opaque);
 621 }
 622
 623 void riscv_itrigger_update_priv(CPURISCVState *env)
 624 {
 625     riscv_itrigger_update_count(env);
 626 }
 627
 628 static target_ulong itrigger_validate(CPURISCVState *env,
 629                                       target_ulong ctrl)
 630 {
 631     target_ulong val;
 632
 633     /* validate the generic part first */
 634     val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT);
 635
 636     /* validate unimplemented (always zero) bits */
 637     warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action");
 638     warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit");
 639     warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending");
 640
 641     /* keep the mode and attribute bits */
 642     val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S |
 643                    ITRIGGER_M | ITRIGGER_COUNT);
 644
 645     return val;
 646 }
 647
 648 static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
 649                                int tdata_index, target_ulong val)
 650 {
 651     target_ulong new_val;
 652
 653     switch (tdata_index) {
 654     case TDATA1:
 655         /* set timer for icount */
 656         new_val = itrigger_validate(env, val);
 657         if (new_val != env->tdata1[index]) {
 658             env->tdata1[index] = new_val;
 659             if (icount_enabled()) {
 660                 env->last_icount = icount_get_raw();
 661                 /* set the count to timer */
 662                 timer_mod(env->itrigger_timer[index],
 663                           env->last_icount + itrigger_get_count(env, index));
 664             } else {
 665                 env->itrigger_enabled = riscv_itrigger_enabled(env);
 666             }
 667         }
 668         break;
 669     case TDATA2:
 670         qemu_log_mask(LOG_UNIMP,
 671                       "tdata2 is not supported for icount trigger\n");
 672         break;
 673     case TDATA3:
 674         qemu_log_mask(LOG_UNIMP,
 675                       "tdata3 is not supported for icount trigger\n");
 676         break;
 677     default:
 678         g_assert_not_reached();
 679     }
 680
 681     return;
 682 }
 683
 684 static int itrigger_get_adjust_count(CPURISCVState *env)
 685 {
 686     int count = itrigger_get_count(env, env->trigger_cur), executed;
 687     if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) {
 688         executed = icount_get_raw() - env->last_icount;
 689         count += executed;
 690     }
 691     return count;
 692 }
 693
 694 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
 695 {
 696     int trigger_type;
 697     switch (tdata_index) {
 698     case TDATA1:
 699         trigger_type = extract_trigger_type(env,
 700                                             env->tdata1[env->trigger_cur]);
 701         if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) {
 702             return deposit64(env->tdata1[env->trigger_cur], 10, 14,
 703                              itrigger_get_adjust_count(env));
 704         }
 705         return env->tdata1[env->trigger_cur];
 706     case TDATA2:
 707         return env->tdata2[env->trigger_cur];
 708     case TDATA3:
 709         return env->tdata3[env->trigger_cur];
 710     default:
 711         g_assert_not_reached();
 712     }
 713 }
 714
 715 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
 716 {
 717     int trigger_type;
 718
 719     if (tdata_index == TDATA1) {
 720         trigger_type = extract_trigger_type(env, val);
 721     } else {
 722         trigger_type = get_trigger_type(env, env->trigger_cur);
 723     }
 724
 725     switch (trigger_type) {
 726     case TRIGGER_TYPE_AD_MATCH:
 727         type2_reg_write(env, env->trigger_cur, tdata_index, val);
 728         break;
 729     case TRIGGER_TYPE_AD_MATCH6:
 730         type6_reg_write(env, env->trigger_cur, tdata_index, val);
 731         break;
 732     case TRIGGER_TYPE_INST_CNT:
 733         itrigger_reg_write(env, env->trigger_cur, tdata_index, val);
 734         break;
 735     case TRIGGER_TYPE_INT:
 736     case TRIGGER_TYPE_EXCP:
 737     case TRIGGER_TYPE_EXT_SRC:
 738         qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
 739                       trigger_type);
 740         break;
 741     case TRIGGER_TYPE_NO_EXIST:
 742     case TRIGGER_TYPE_UNAVAIL:
 743         qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
 744                       trigger_type);
 745         break;
 746     default:
 747         g_assert_not_reached();
 748     }
 749 }
 750
 751 target_ulong tinfo_csr_read(CPURISCVState *env)
 752 {
 753     /* assume all triggers support the same types of triggers */
 754     return BIT(TRIGGER_TYPE_AD_MATCH) |
 755            BIT(TRIGGER_TYPE_AD_MATCH6);
 756 }
 757
 758 void riscv_cpu_debug_excp_handler(CPUState *cs)
 759 {
 760     RISCVCPU *cpu = RISCV_CPU(cs);
 761     CPURISCVState *env = &cpu->env;
 762
 763     if (cs->watchpoint_hit) {
 764         if (cs->watchpoint_hit->flags & BP_CPU) {
 765             do_trigger_action(env, DBG_ACTION_BP);
 766         }
 767     } else {
 768         if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) {
 769             do_trigger_action(env, DBG_ACTION_BP);
 770         }
 771     }
 772 }
 773
 774 bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
 775 {
 776     RISCVCPU *cpu = RISCV_CPU(cs);
 777     CPURISCVState *env = &cpu->env;
 778     CPUBreakpoint *bp;
 779     target_ulong ctrl;
 780     target_ulong pc;
 781     int trigger_type;
 782     int i;
 783
 784     QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
 785         for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 786             trigger_type = get_trigger_type(env, i);
 787
 788             switch (trigger_type) {
 789             case TRIGGER_TYPE_AD_MATCH:
 790                 /* type 2 trigger cannot be fired in VU/VS mode */
 791                 if (env->virt_enabled) {
 792                     return false;
 793                 }
 794
 795                 ctrl = env->tdata1[i];
 796                 pc = env->tdata2[i];
 797
 798                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
 799                     /* check U/S/M bit against current privilege level */
 800                     if ((ctrl >> 3) & BIT(env->priv)) {
 801                         return true;
 802                     }
 803                 }
 804                 break;
 805             case TRIGGER_TYPE_AD_MATCH6:
 806                 ctrl = env->tdata1[i];
 807                 pc = env->tdata2[i];
 808
 809                 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
 810                     if (env->virt_enabled) {
 811                         /* check VU/VS bit against current privilege level */
 812                         if ((ctrl >> 23) & BIT(env->priv)) {
 813                             return true;
 814                         }
 815                     } else {
 816                         /* check U/S/M bit against current privilege level */
 817                         if ((ctrl >> 3) & BIT(env->priv)) {
 818                             return true;
 819                         }
 820                     }
 821                 }
 822                 break;
 823             default:
 824                 /* other trigger types are not supported or irrelevant */
 825                 break;
 826             }
 827         }
 828     }
 829
 830     return false;
 831 }
 832
 833 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 834 {
 835     RISCVCPU *cpu = RISCV_CPU(cs);
 836     CPURISCVState *env = &cpu->env;
 837     target_ulong ctrl;
 838     target_ulong addr;
 839     int trigger_type;
 840     int flags;
 841     int i;
 842
 843     for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 844         trigger_type = get_trigger_type(env, i);
 845
 846         switch (trigger_type) {
 847         case TRIGGER_TYPE_AD_MATCH:
 848             /* type 2 trigger cannot be fired in VU/VS mode */
 849             if (env->virt_enabled) {
 850                 return false;
 851             }
 852
 853             ctrl = env->tdata1[i];
 854             addr = env->tdata2[i];
 855             flags = 0;
 856
 857             if (ctrl & TYPE2_LOAD) {
 858                 flags |= BP_MEM_READ;
 859             }
 860             if (ctrl & TYPE2_STORE) {
 861                 flags |= BP_MEM_WRITE;
 862             }
 863
 864             if ((wp->flags & flags) && (wp->vaddr == addr)) {
 865                 /* check U/S/M bit against current privilege level */
 866                 if ((ctrl >> 3) & BIT(env->priv)) {
 867                     return true;
 868                 }
 869             }
 870             break;
 871         case TRIGGER_TYPE_AD_MATCH6:
 872             ctrl = env->tdata1[i];
 873             addr = env->tdata2[i];
 874             flags = 0;
 875
 876             if (ctrl & TYPE6_LOAD) {
 877                 flags |= BP_MEM_READ;
 878             }
 879             if (ctrl & TYPE6_STORE) {
 880                 flags |= BP_MEM_WRITE;
 881             }
 882
 883             if ((wp->flags & flags) && (wp->vaddr == addr)) {
 884                 if (env->virt_enabled) {
 885                     /* check VU/VS bit against current privilege level */
 886                     if ((ctrl >> 23) & BIT(env->priv)) {
 887                         return true;
 888                     }
 889                 } else {
 890                     /* check U/S/M bit against current privilege level */
 891                     if ((ctrl >> 3) & BIT(env->priv)) {
 892                         return true;
 893                     }
 894                 }
 895             }
 896             break;
 897         default:
 898             /* other trigger types are not supported */
 899             break;
 900         }
 901     }
 902
 903     return false;
 904 }
 905
 906 void riscv_trigger_realize(CPURISCVState *env)
 907 {
 908     int i;
 909
 910     for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 911         env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 912                                               riscv_itrigger_timer_cb, env);
 913     }
 914 }
 915
 916 void riscv_trigger_reset_hold(CPURISCVState *env)
 917 {
 918     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
 919     int i;
 920
 921     /* init to type 2 triggers */
 922     for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 923         /*
 924          * type = TRIGGER_TYPE_AD_MATCH
 925          * dmode = 0 (both debug and M-mode can write tdata)
 926          * maskmax = 0 (unimplemented, always 0)
 927          * sizehi = 0 (match against any size, RV64 only)
 928          * hit = 0 (unimplemented, always 0)
 929          * select = 0 (always 0, perform match on address)
 930          * timing = 0 (always 0, trigger before instruction)
 931          * sizelo = 0 (match against any size)
 932          * action = 0 (always 0, raise a breakpoint exception)
 933          * chain = 0 (unimplemented, always 0)
 934          * match = 0 (always 0, when any compare value equals tdata2)
 935          */
 936         env->tdata1[i] = tdata1;
 937         env->tdata2[i] = 0;
 938         env->tdata3[i] = 0;
 939         env->cpu_breakpoint[i] = NULL;
 940         env->cpu_watchpoint[i] = NULL;
 941         timer_del(env->itrigger_timer[i]);
 942     }
 943 }