RISC-V Debug Module

bool debug_module_t::perform_abstract_command() {
    // register access
    unsigned size = get_field(command, AC_ACCESS_REGISTER_AARSIZE);
    bool write = get_field(command, AC_ACCESS_REGISTER_WRITE);
    unsigned regno = get_field(command, AC_ACCESS_REGISTER_REGNO);

    unsigned i = 0;
    if (get_field(command, AC_ACCESS_REGISTER_TRANSFER)) {
        if (regno >= 0x1000 && regno < 0x1020) {
            unsigned regnum = regno - 0x1000;
            switch (size) {
                case 2:
                    if (write)
                        /* NOTE: 针对 read/write regnum, 在 debug_abstract 处开
                         * 始生成了对应的 lw/sw 指令, 且结果写在
                         * debug_data_start, debug_data_start 对应的实际就是
                         * data0 (因为 debug_module 本身是一个 mem_t, 参考它的
                         * load/store 函数) */
                        write32(
                            debug_abstract, i++,
                            lw(regnum, ZERO, debug_data_start));
                    else
                        write32(
                            debug_abstract, i++,
                            sw(regnum, ZERO, debug_data_start));
                    break;
                /* ... */
                default:
                    abstractcs.cmderr = CMDERR_NOTSUP;
                    return true;
            }
            /* ... */
        }
        /* ... */
    }
    if (get_field(command, AC_ACCESS_REGISTER_POSTEXEC)) {
        /* NOTE: 这里会生成指令跳到 debug_progbuf, 以支持 progbuf 功能, 且 jtag
         * 需要保证 progbuf 最后需要以 ebreak 结束 */
        write32(
            debug_abstract, i,
            jal(ZERO, debug_progbuf_start - debug_abstract_start - 4 * i));
        i++;
    } else {
        /* NOTE: ebreak 会导致 debug_abstract 执行完后跳转到 debug_rom 的 entry
         * 以重新开始 loop */
        write32(debug_abstract, i++, ebreak());
    }
    debug_rom_flags[dmcontrol.hartsel] |= 1 << DEBUG_ROM_FLAG_GO;
    return true;
}

debug_module_t::debug_module_t(sim_t *sim, const debug_module_config_t &config)
    : {
    /* ... */
    write32(
        debug_rom_whereto, 0,
        jal(ZERO, debug_abstract_start - DEBUG_ROM_WHERETO));
    reset();
}

/* NOTE: 其中 debug_rom_whereto 对应 DEBUG_ROM_WHERETO (0x300) 地址的数据 */
/* NOTE: 而 0x300 在 debug_rom.S 对应的 whereto 这个符号  */
bool debug_module_t::load(reg_t addr, size_t len, uint8_t *bytes) {
    /* ... */
    if (addr >= DEBUG_ROM_WHERETO && (addr + len) <= (DEBUG_ROM_WHERETO + 4)) {
        memcpy(bytes, debug_rom_whereto + addr - DEBUG_ROM_WHERETO, len);
        return true;
    }
    /* ... */
    return false;
}

void processor_t::step(size_t n) {
    if (!state.debug_mode) {
        /* NOTE: DM_DMCONTROL_HALTREQ  */
        if (halt_request == HR_REGULAR) {
            enter_debug_mode(DCSR_CAUSE_DEBUGINT);
        }
        /* ... */
    }
    /* execute_insn */
}

void processor_t::enter_debug_mode(uint8_t cause) {
    state.debug_mode = true;
    state.dcsr->write_cause_and_prv(cause, state.prv);
    set_privilege(PRV_M);
    /* NOTE: 在退出 debug_mode 时需要用到 dpc */
    state.dpc->write(state.pc);
    /* NOTE: DEBUG_ROM_ENTRY 是 debug_rom.S 中的 entry */
    state.pc = DEBUG_ROM_ENTRY;
}

    .option norvc
    .global entry
    .global exception

    # NOTE: entry 地址是 DEBUG_ROM_ENTRY, 它是 enter_debug_mode 时指定的 pc
entry:
    jal zero, _entry
resume:
    jal zero, _resume

_entry:
    fence
    csrw CSR_DSCRATCH, s0  // Save s0 to allow signaling MHARTID
entry_loop:
    csrr s0, CSR_MHARTID
    sw   s0, DEBUG_ROM_HALTED(zero)
    lbu  s0, DEBUG_ROM_FLAGS(s0) // 1 byte flag per hart. Only one hart advances here.
    andi s0, s0, (1 << DEBUG_ROM_FLAG_GO)
    # NOTE: going 会执行 abstract command
    bnez s0, going
    # ...
    jal  zero, entry_loop

going:
    # ...
    # NOTE: whereto 里的指令是 debug_module_t 初始化时写入的 jal debug_abstract_start
    jalr zero, zero, %lo(whereto)

_resume:
    # ...
    #NOTE: jtag 的 DM_DMCONTROL_RESUMEREQ 最终会调用到这里, 通过 dret 退出 debug mode
    dret

/* ebreak.h: */
throw trap_breakpoint(STATE.v, pc);

/* processor.cc: */
void processor_t::take_trap(trap_t& t, reg_t epc) {
    if (state.debug_mode) {
        if (t.cause() == CAUSE_BREAKPOINT) {
            /* NOTE: debug_abstract 或 progbuf 执行完以后重新开始 debug_rom 的
             * loop */
            state.pc = DEBUG_ROM_ENTRY;
        } else {
            state.pc = DEBUG_ROM_TVEC;
        }
        return;
    }
    /* ... */
}

/* ebreak.h */
throw trap_breakpoint(STATE.v, pc);

/* processor.cc */

void processor_t::take_trap(trap_t& t, reg_t epc) {
    if (t.cause() == CAUSE_BREAKPOINT &&
        ((state.prv == PRV_M && state.dcsr->ebreakm) ||
         /* NOTE: ebreak 是进入 debug mode 还是作为 trap 是通过 dcsr 配置的,
          * 使用 jtags 时需要配置该项, 使用 gdb native debug 时则不能配置该项 */
         (state.prv == PRV_S && state.dcsr->ebreaks) ||
         (state.prv == PRV_U && state.dcsr->ebreaku))) {
        enter_debug_mode(DCSR_CAUSE_SWBP);
        return;
    }
    /* ... */
}

inline tlb_entry_t translate_insn_addr(reg_t addr) {
    /* ... */
    if (tlb_insn_tag[vpn % TLB_ENTRIES] == (vpn | TLB_CHECK_TRIGGERS)) {
        /* ... */
        triggers::action_t action;
        /* NOTE: trigger 是否与 addr match */
        auto match = proc->TM.memory_access_match(
            &action, triggers::OPERATION_EXECUTE, addr, from_target(*ptr));
        if (match != triggers::MATCH_NONE) {
            throw triggers::matched_t(
                triggers::OPERATION_EXECUTE, addr, from_target(*ptr), action);
        }
    }
    return result;
}

void processor_t::step(size_t n) {
    while (n > 0) {
        size_t instret = 0;
        reg_t pc = state.pc;
        mmu_t* _mmu = mmu;

        try {
            /* execute_insn... */
        } catch (triggers::matched_t& t) {
            switch (t.action) {
                case triggers::ACTION_DEBUG_MODE:
                    enter_debug_mode(DCSR_CAUSE_HWBP);
                    break;
                    /* ... */
            }
        }
    }
}