qemu

FORK: QEMU emulator
git clone https://git.neptards.moe/neptards/qemu.git
Log | Files | Refs | Submodules | LICENSE

debug.c (21180B)


      1 /*
      2  * QEMU RISC-V Native Debug Support
      3  *
      4  * Copyright (c) 2022 Wind River Systems, Inc.
      5  *
      6  * Author:
      7  *   Bin Meng <bin.meng@windriver.com>
      8  *
      9  * This provides the native debug support via the Trigger Module, as defined
     10  * in the RISC-V Debug Specification:
     11  * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf
     12  *
     13  * This program is free software; you can redistribute it and/or modify it
     14  * under the terms and conditions of the GNU General Public License,
     15  * version 2 or later, as published by the Free Software Foundation.
     16  *
     17  * This program is distributed in the hope it will be useful, but WITHOUT
     18  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
     19  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
     20  * more details.
     21  *
     22  * You should have received a copy of the GNU General Public License along with
     23  * this program.  If not, see <http://www.gnu.org/licenses/>.
     24  */
     25 
     26 #include "qemu/osdep.h"
     27 #include "qemu/log.h"
     28 #include "qapi/error.h"
     29 #include "cpu.h"
     30 #include "trace.h"
     31 #include "exec/exec-all.h"
     32 
     33 /*
     34  * The following M-mode trigger CSRs are implemented:
     35  *
     36  * - tselect
     37  * - tdata1
     38  * - tdata2
     39  * - tdata3
     40  * - tinfo
     41  *
     42  * The following triggers are initialized by default:
     43  *
     44  * Index | Type |          tdata mapping | Description
     45  * ------+------+------------------------+------------
     46  *     0 |    2 |         tdata1, tdata2 | Address / Data Match
     47  *     1 |    2 |         tdata1, tdata2 | Address / Data Match
     48  */
     49 
     50 /* tdata availability of a trigger */
     51 typedef bool tdata_avail[TDATA_NUM];
     52 
     53 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = {
     54     [TRIGGER_TYPE_NO_EXIST] = { false, false, false },
     55     [TRIGGER_TYPE_AD_MATCH] = { true, true, true },
     56     [TRIGGER_TYPE_INST_CNT] = { true, false, true },
     57     [TRIGGER_TYPE_INT] = { true, true, true },
     58     [TRIGGER_TYPE_EXCP] = { true, true, true },
     59     [TRIGGER_TYPE_AD_MATCH6] = { true, true, true },
     60     [TRIGGER_TYPE_EXT_SRC] = { true, false, false },
     61     [TRIGGER_TYPE_UNAVAIL] = { true, true, true }
     62 };
     63 
     64 /* only breakpoint size 1/2/4/8 supported */
     65 static int access_size[SIZE_NUM] = {
     66     [SIZE_ANY] = 0,
     67     [SIZE_1B]  = 1,
     68     [SIZE_2B]  = 2,
     69     [SIZE_4B]  = 4,
     70     [SIZE_6B]  = -1,
     71     [SIZE_8B]  = 8,
     72     [6 ... 15] = -1,
     73 };
     74 
     75 static inline target_ulong extract_trigger_type(CPURISCVState *env,
     76                                                 target_ulong tdata1)
     77 {
     78     switch (riscv_cpu_mxl(env)) {
     79     case MXL_RV32:
     80         return extract32(tdata1, 28, 4);
     81     case MXL_RV64:
     82     case MXL_RV128:
     83         return extract64(tdata1, 60, 4);
     84     default:
     85         g_assert_not_reached();
     86     }
     87 }
     88 
     89 static inline target_ulong get_trigger_type(CPURISCVState *env,
     90                                             target_ulong trigger_index)
     91 {
     92     return extract_trigger_type(env, env->tdata1[trigger_index]);
     93 }
     94 
     95 static trigger_action_t get_trigger_action(CPURISCVState *env,
     96                                            target_ulong trigger_index)
     97 {
     98     target_ulong tdata1 = env->tdata1[trigger_index];
     99     int trigger_type = get_trigger_type(env, trigger_index);
    100     trigger_action_t action = DBG_ACTION_NONE;
    101 
    102     switch (trigger_type) {
    103     case TRIGGER_TYPE_AD_MATCH:
    104         action = (tdata1 & TYPE2_ACTION) >> 12;
    105         break;
    106     case TRIGGER_TYPE_AD_MATCH6:
    107         action = (tdata1 & TYPE6_ACTION) >> 12;
    108         break;
    109     case TRIGGER_TYPE_INST_CNT:
    110     case TRIGGER_TYPE_INT:
    111     case TRIGGER_TYPE_EXCP:
    112     case TRIGGER_TYPE_EXT_SRC:
    113         qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
    114                       trigger_type);
    115         break;
    116     case TRIGGER_TYPE_NO_EXIST:
    117     case TRIGGER_TYPE_UNAVAIL:
    118         qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
    119                       trigger_type);
    120         break;
    121     default:
    122         g_assert_not_reached();
    123     }
    124 
    125     return action;
    126 }
    127 
    128 static inline target_ulong build_tdata1(CPURISCVState *env,
    129                                         trigger_type_t type,
    130                                         bool dmode, target_ulong data)
    131 {
    132     target_ulong tdata1;
    133 
    134     switch (riscv_cpu_mxl(env)) {
    135     case MXL_RV32:
    136         tdata1 = RV32_TYPE(type) |
    137                  (dmode ? RV32_DMODE : 0) |
    138                  (data & RV32_DATA_MASK);
    139         break;
    140     case MXL_RV64:
    141     case MXL_RV128:
    142         tdata1 = RV64_TYPE(type) |
    143                  (dmode ? RV64_DMODE : 0) |
    144                  (data & RV64_DATA_MASK);
    145         break;
    146     default:
    147         g_assert_not_reached();
    148     }
    149 
    150     return tdata1;
    151 }
    152 
    153 bool tdata_available(CPURISCVState *env, int tdata_index)
    154 {
    155     int trigger_type = get_trigger_type(env, env->trigger_cur);
    156 
    157     if (unlikely(tdata_index >= TDATA_NUM)) {
    158         return false;
    159     }
    160 
    161     return tdata_mapping[trigger_type][tdata_index];
    162 }
    163 
    164 target_ulong tselect_csr_read(CPURISCVState *env)
    165 {
    166     return env->trigger_cur;
    167 }
    168 
    169 void tselect_csr_write(CPURISCVState *env, target_ulong val)
    170 {
    171     if (val < RV_MAX_TRIGGERS) {
    172         env->trigger_cur = val;
    173     }
    174 }
    175 
    176 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
    177                                     trigger_type_t t)
    178 {
    179     uint32_t type, dmode;
    180     target_ulong tdata1;
    181 
    182     switch (riscv_cpu_mxl(env)) {
    183     case MXL_RV32:
    184         type = extract32(val, 28, 4);
    185         dmode = extract32(val, 27, 1);
    186         tdata1 = RV32_TYPE(t);
    187         break;
    188     case MXL_RV64:
    189     case MXL_RV128:
    190         type = extract64(val, 60, 4);
    191         dmode = extract64(val, 59, 1);
    192         tdata1 = RV64_TYPE(t);
    193         break;
    194     default:
    195         g_assert_not_reached();
    196     }
    197 
    198     if (type != t) {
    199         qemu_log_mask(LOG_GUEST_ERROR,
    200                       "ignoring type write to tdata1 register\n");
    201     }
    202 
    203     if (dmode != 0) {
    204         qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n");
    205     }
    206 
    207     return tdata1;
    208 }
    209 
    210 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
    211                                         const char *msg)
    212 {
    213     if (val & mask) {
    214         qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg);
    215     }
    216 }
    217 
    218 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
    219 {
    220     trigger_action_t action = get_trigger_action(env, trigger_index);
    221 
    222     switch (action) {
    223     case DBG_ACTION_NONE:
    224         break;
    225     case DBG_ACTION_BP:
    226         riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
    227         break;
    228     case DBG_ACTION_DBG_MODE:
    229     case DBG_ACTION_TRACE0:
    230     case DBG_ACTION_TRACE1:
    231     case DBG_ACTION_TRACE2:
    232     case DBG_ACTION_TRACE3:
    233     case DBG_ACTION_EXT_DBG0:
    234     case DBG_ACTION_EXT_DBG1:
    235         qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action);
    236         break;
    237     default:
    238         g_assert_not_reached();
    239     }
    240 }
    241 
    242 /* type 2 trigger */
    243 
    244 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
    245 {
    246     uint32_t size, sizelo, sizehi = 0;
    247 
    248     if (riscv_cpu_mxl(env) == MXL_RV64) {
    249         sizehi = extract32(ctrl, 21, 2);
    250     }
    251     sizelo = extract32(ctrl, 16, 2);
    252     size = (sizehi << 2) | sizelo;
    253 
    254     return size;
    255 }
    256 
    257 static inline bool type2_breakpoint_enabled(target_ulong ctrl)
    258 {
    259     bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M));
    260     bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
    261 
    262     return mode && rwx;
    263 }
    264 
    265 static target_ulong type2_mcontrol_validate(CPURISCVState *env,
    266                                             target_ulong ctrl)
    267 {
    268     target_ulong val;
    269     uint32_t size;
    270 
    271     /* validate the generic part first */
    272     val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH);
    273 
    274     /* validate unimplemented (always zero) bits */
    275     warn_always_zero_bit(ctrl, TYPE2_MATCH, "match");
    276     warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain");
    277     warn_always_zero_bit(ctrl, TYPE2_ACTION, "action");
    278     warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing");
    279     warn_always_zero_bit(ctrl, TYPE2_SELECT, "select");
    280     warn_always_zero_bit(ctrl, TYPE2_HIT, "hit");
    281 
    282     /* validate size encoding */
    283     size = type2_breakpoint_size(env, ctrl);
    284     if (access_size[size] == -1) {
    285         qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
    286                       size);
    287     } else {
    288         val |= (ctrl & TYPE2_SIZELO);
    289         if (riscv_cpu_mxl(env) == MXL_RV64) {
    290             val |= (ctrl & TYPE2_SIZEHI);
    291         }
    292     }
    293 
    294     /* keep the mode and attribute bits */
    295     val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M |
    296                     TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
    297 
    298     return val;
    299 }
    300 
    301 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
    302 {
    303     target_ulong ctrl = env->tdata1[index];
    304     target_ulong addr = env->tdata2[index];
    305     bool enabled = type2_breakpoint_enabled(ctrl);
    306     CPUState *cs = env_cpu(env);
    307     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
    308     uint32_t size;
    309 
    310     if (!enabled) {
    311         return;
    312     }
    313 
    314     if (ctrl & TYPE2_EXEC) {
    315         cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
    316     }
    317 
    318     if (ctrl & TYPE2_LOAD) {
    319         flags |= BP_MEM_READ;
    320     }
    321     if (ctrl & TYPE2_STORE) {
    322         flags |= BP_MEM_WRITE;
    323     }
    324 
    325     if (flags & BP_MEM_ACCESS) {
    326         size = type2_breakpoint_size(env, ctrl);
    327         if (size != 0) {
    328             cpu_watchpoint_insert(cs, addr, size, flags,
    329                                   &env->cpu_watchpoint[index]);
    330         } else {
    331             cpu_watchpoint_insert(cs, addr, 8, flags,
    332                                   &env->cpu_watchpoint[index]);
    333         }
    334     }
    335 }
    336 
    337 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
    338 {
    339     CPUState *cs = env_cpu(env);
    340 
    341     if (env->cpu_breakpoint[index]) {
    342         cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
    343         env->cpu_breakpoint[index] = NULL;
    344     }
    345 
    346     if (env->cpu_watchpoint[index]) {
    347         cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
    348         env->cpu_watchpoint[index] = NULL;
    349     }
    350 }
    351 
    352 static void type2_reg_write(CPURISCVState *env, target_ulong index,
    353                             int tdata_index, target_ulong val)
    354 {
    355     target_ulong new_val;
    356 
    357     switch (tdata_index) {
    358     case TDATA1:
    359         new_val = type2_mcontrol_validate(env, val);
    360         if (new_val != env->tdata1[index]) {
    361             env->tdata1[index] = new_val;
    362             type2_breakpoint_remove(env, index);
    363             type2_breakpoint_insert(env, index);
    364         }
    365         break;
    366     case TDATA2:
    367         if (val != env->tdata2[index]) {
    368             env->tdata2[index] = val;
    369             type2_breakpoint_remove(env, index);
    370             type2_breakpoint_insert(env, index);
    371         }
    372         break;
    373     case TDATA3:
    374         qemu_log_mask(LOG_UNIMP,
    375                       "tdata3 is not supported for type 2 trigger\n");
    376         break;
    377     default:
    378         g_assert_not_reached();
    379     }
    380 
    381     return;
    382 }
    383 
    384 /* type 6 trigger */
    385 
    386 static inline bool type6_breakpoint_enabled(target_ulong ctrl)
    387 {
    388     bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
    389     bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
    390 
    391     return mode && rwx;
    392 }
    393 
    394 static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
    395                                              target_ulong ctrl)
    396 {
    397     target_ulong val;
    398     uint32_t size;
    399 
    400     /* validate the generic part first */
    401     val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6);
    402 
    403     /* validate unimplemented (always zero) bits */
    404     warn_always_zero_bit(ctrl, TYPE6_MATCH, "match");
    405     warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain");
    406     warn_always_zero_bit(ctrl, TYPE6_ACTION, "action");
    407     warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing");
    408     warn_always_zero_bit(ctrl, TYPE6_SELECT, "select");
    409     warn_always_zero_bit(ctrl, TYPE6_HIT, "hit");
    410 
    411     /* validate size encoding */
    412     size = extract32(ctrl, 16, 4);
    413     if (access_size[size] == -1) {
    414         qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
    415                       size);
    416     } else {
    417         val |= (ctrl & TYPE6_SIZE);
    418     }
    419 
    420     /* keep the mode and attribute bits */
    421     val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M |
    422                     TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
    423 
    424     return val;
    425 }
    426 
    427 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
    428 {
    429     target_ulong ctrl = env->tdata1[index];
    430     target_ulong addr = env->tdata2[index];
    431     bool enabled = type6_breakpoint_enabled(ctrl);
    432     CPUState *cs = env_cpu(env);
    433     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
    434     uint32_t size;
    435 
    436     if (!enabled) {
    437         return;
    438     }
    439 
    440     if (ctrl & TYPE6_EXEC) {
    441         cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
    442     }
    443 
    444     if (ctrl & TYPE6_LOAD) {
    445         flags |= BP_MEM_READ;
    446     }
    447 
    448     if (ctrl & TYPE6_STORE) {
    449         flags |= BP_MEM_WRITE;
    450     }
    451 
    452     if (flags & BP_MEM_ACCESS) {
    453         size = extract32(ctrl, 16, 4);
    454         if (size != 0) {
    455             cpu_watchpoint_insert(cs, addr, size, flags,
    456                                   &env->cpu_watchpoint[index]);
    457         } else {
    458             cpu_watchpoint_insert(cs, addr, 8, flags,
    459                                   &env->cpu_watchpoint[index]);
    460         }
    461     }
    462 }
    463 
    464 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
    465 {
    466     type2_breakpoint_remove(env, index);
    467 }
    468 
    469 static void type6_reg_write(CPURISCVState *env, target_ulong index,
    470                             int tdata_index, target_ulong val)
    471 {
    472     target_ulong new_val;
    473 
    474     switch (tdata_index) {
    475     case TDATA1:
    476         new_val = type6_mcontrol6_validate(env, val);
    477         if (new_val != env->tdata1[index]) {
    478             env->tdata1[index] = new_val;
    479             type6_breakpoint_remove(env, index);
    480             type6_breakpoint_insert(env, index);
    481         }
    482         break;
    483     case TDATA2:
    484         if (val != env->tdata2[index]) {
    485             env->tdata2[index] = val;
    486             type6_breakpoint_remove(env, index);
    487             type6_breakpoint_insert(env, index);
    488         }
    489         break;
    490     case TDATA3:
    491         qemu_log_mask(LOG_UNIMP,
    492                       "tdata3 is not supported for type 6 trigger\n");
    493         break;
    494     default:
    495         g_assert_not_reached();
    496     }
    497 
    498     return;
    499 }
    500 
    501 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
    502 {
    503     switch (tdata_index) {
    504     case TDATA1:
    505         return env->tdata1[env->trigger_cur];
    506     case TDATA2:
    507         return env->tdata2[env->trigger_cur];
    508     case TDATA3:
    509         return env->tdata3[env->trigger_cur];
    510     default:
    511         g_assert_not_reached();
    512     }
    513 }
    514 
    515 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
    516 {
    517     int trigger_type;
    518 
    519     if (tdata_index == TDATA1) {
    520         trigger_type = extract_trigger_type(env, val);
    521     } else {
    522         trigger_type = get_trigger_type(env, env->trigger_cur);
    523     }
    524 
    525     switch (trigger_type) {
    526     case TRIGGER_TYPE_AD_MATCH:
    527         type2_reg_write(env, env->trigger_cur, tdata_index, val);
    528         break;
    529     case TRIGGER_TYPE_AD_MATCH6:
    530         type6_reg_write(env, env->trigger_cur, tdata_index, val);
    531         break;
    532     case TRIGGER_TYPE_INST_CNT:
    533     case TRIGGER_TYPE_INT:
    534     case TRIGGER_TYPE_EXCP:
    535     case TRIGGER_TYPE_EXT_SRC:
    536         qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
    537                       trigger_type);
    538         break;
    539     case TRIGGER_TYPE_NO_EXIST:
    540     case TRIGGER_TYPE_UNAVAIL:
    541         qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
    542                       trigger_type);
    543         break;
    544     default:
    545         g_assert_not_reached();
    546     }
    547 }
    548 
    549 target_ulong tinfo_csr_read(CPURISCVState *env)
    550 {
    551     /* assume all triggers support the same types of triggers */
    552     return BIT(TRIGGER_TYPE_AD_MATCH) |
    553            BIT(TRIGGER_TYPE_AD_MATCH6);
    554 }
    555 
    556 void riscv_cpu_debug_excp_handler(CPUState *cs)
    557 {
    558     RISCVCPU *cpu = RISCV_CPU(cs);
    559     CPURISCVState *env = &cpu->env;
    560 
    561     if (cs->watchpoint_hit) {
    562         if (cs->watchpoint_hit->flags & BP_CPU) {
    563             cs->watchpoint_hit = NULL;
    564             do_trigger_action(env, DBG_ACTION_BP);
    565         }
    566     } else {
    567         if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) {
    568             do_trigger_action(env, DBG_ACTION_BP);
    569         }
    570     }
    571 }
    572 
    573 bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
    574 {
    575     RISCVCPU *cpu = RISCV_CPU(cs);
    576     CPURISCVState *env = &cpu->env;
    577     CPUBreakpoint *bp;
    578     target_ulong ctrl;
    579     target_ulong pc;
    580     int trigger_type;
    581     int i;
    582 
    583     QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
    584         for (i = 0; i < RV_MAX_TRIGGERS; i++) {
    585             trigger_type = get_trigger_type(env, i);
    586 
    587             switch (trigger_type) {
    588             case TRIGGER_TYPE_AD_MATCH:
    589                 /* type 2 trigger cannot be fired in VU/VS mode */
    590                 if (riscv_cpu_virt_enabled(env)) {
    591                     return false;
    592                 }
    593 
    594                 ctrl = env->tdata1[i];
    595                 pc = env->tdata2[i];
    596 
    597                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
    598                     /* check U/S/M bit against current privilege level */
    599                     if ((ctrl >> 3) & BIT(env->priv)) {
    600                         return true;
    601                     }
    602                 }
    603                 break;
    604             case TRIGGER_TYPE_AD_MATCH6:
    605                 ctrl = env->tdata1[i];
    606                 pc = env->tdata2[i];
    607 
    608                 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
    609                     if (riscv_cpu_virt_enabled(env)) {
    610                         /* check VU/VS bit against current privilege level */
    611                         if ((ctrl >> 23) & BIT(env->priv)) {
    612                             return true;
    613                         }
    614                     } else {
    615                         /* check U/S/M bit against current privilege level */
    616                         if ((ctrl >> 3) & BIT(env->priv)) {
    617                             return true;
    618                         }
    619                     }
    620                 }
    621                 break;
    622             default:
    623                 /* other trigger types are not supported or irrelevant */
    624                 break;
    625             }
    626         }
    627     }
    628 
    629     return false;
    630 }
    631 
    632 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
    633 {
    634     RISCVCPU *cpu = RISCV_CPU(cs);
    635     CPURISCVState *env = &cpu->env;
    636     target_ulong ctrl;
    637     target_ulong addr;
    638     int trigger_type;
    639     int flags;
    640     int i;
    641 
    642     for (i = 0; i < RV_MAX_TRIGGERS; i++) {
    643         trigger_type = get_trigger_type(env, i);
    644 
    645         switch (trigger_type) {
    646         case TRIGGER_TYPE_AD_MATCH:
    647             /* type 2 trigger cannot be fired in VU/VS mode */
    648             if (riscv_cpu_virt_enabled(env)) {
    649                 return false;
    650             }
    651 
    652             ctrl = env->tdata1[i];
    653             addr = env->tdata2[i];
    654             flags = 0;
    655 
    656             if (ctrl & TYPE2_LOAD) {
    657                 flags |= BP_MEM_READ;
    658             }
    659             if (ctrl & TYPE2_STORE) {
    660                 flags |= BP_MEM_WRITE;
    661             }
    662 
    663             if ((wp->flags & flags) && (wp->vaddr == addr)) {
    664                 /* check U/S/M bit against current privilege level */
    665                 if ((ctrl >> 3) & BIT(env->priv)) {
    666                     return true;
    667                 }
    668             }
    669             break;
    670         case TRIGGER_TYPE_AD_MATCH6:
    671             ctrl = env->tdata1[i];
    672             addr = env->tdata2[i];
    673             flags = 0;
    674 
    675             if (ctrl & TYPE6_LOAD) {
    676                 flags |= BP_MEM_READ;
    677             }
    678             if (ctrl & TYPE6_STORE) {
    679                 flags |= BP_MEM_WRITE;
    680             }
    681 
    682             if ((wp->flags & flags) && (wp->vaddr == addr)) {
    683                 if (riscv_cpu_virt_enabled(env)) {
    684                     /* check VU/VS bit against current privilege level */
    685                     if ((ctrl >> 23) & BIT(env->priv)) {
    686                         return true;
    687                     }
    688                 } else {
    689                     /* check U/S/M bit against current privilege level */
    690                     if ((ctrl >> 3) & BIT(env->priv)) {
    691                         return true;
    692                     }
    693                 }
    694             }
    695             break;
    696         default:
    697             /* other trigger types are not supported */
    698             break;
    699         }
    700     }
    701 
    702     return false;
    703 }
    704 
    705 void riscv_trigger_init(CPURISCVState *env)
    706 {
    707     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
    708     int i;
    709 
    710     /* init to type 2 triggers */
    711     for (i = 0; i < RV_MAX_TRIGGERS; i++) {
    712         /*
    713          * type = TRIGGER_TYPE_AD_MATCH
    714          * dmode = 0 (both debug and M-mode can write tdata)
    715          * maskmax = 0 (unimplemented, always 0)
    716          * sizehi = 0 (match against any size, RV64 only)
    717          * hit = 0 (unimplemented, always 0)
    718          * select = 0 (always 0, perform match on address)
    719          * timing = 0 (always 0, trigger before instruction)
    720          * sizelo = 0 (match against any size)
    721          * action = 0 (always 0, raise a breakpoint exception)
    722          * chain = 0 (unimplemented, always 0)
    723          * match = 0 (always 0, when any compare value equals tdata2)
    724          */
    725         env->tdata1[i] = tdata1;
    726         env->tdata2[i] = 0;
    727         env->tdata3[i] = 0;
    728         env->cpu_breakpoint[i] = NULL;
    729         env->cpu_watchpoint[i] = NULL;
    730     }
    731 }