1 /* 2 * QEMU RISC-V Native Debug Support 3 * 4 * Copyright (c) 2022 Wind River Systems, Inc. 5 * 6 * Author: 7 * Bin Meng <bin.meng@windriver.com> 8 * 9 * This provides the native debug support via the Trigger Module, as defined 10 * in the RISC-V Debug Specification: 11 * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf 12 * 13 * This program is free software; you can redistribute it and/or modify it 14 * under the terms and conditions of the GNU General Public License, 15 * version 2 or later, as published by the Free Software Foundation. 16 * 17 * This program is distributed in the hope it will be useful, but WITHOUT 18 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 19 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 20 * more details. 21 * 22 * You should have received a copy of the GNU General Public License along with 23 * this program. If not, see <http://www.gnu.org/licenses/>. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 #include "trace.h" 31 #include "exec/exec-all.h" 32 #include "exec/helper-proto.h" 33 34 /* 35 * The following M-mode trigger CSRs are implemented: 36 * 37 * - tselect 38 * - tdata1 39 * - tdata2 40 * - tdata3 41 * - tinfo 42 * 43 * The following triggers are initialized by default: 44 * 45 * Index | Type | tdata mapping | Description 46 * ------+------+------------------------+------------ 47 * 0 | 2 | tdata1, tdata2 | Address / Data Match 48 * 1 | 2 | tdata1, tdata2 | Address / Data Match 49 */ 50 51 /* tdata availability of a trigger */ 52 typedef bool tdata_avail[TDATA_NUM]; 53 54 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = { 55 [TRIGGER_TYPE_NO_EXIST] = { false, false, false }, 56 [TRIGGER_TYPE_AD_MATCH] = { true, true, true }, 57 [TRIGGER_TYPE_INST_CNT] = { true, false, true }, 58 [TRIGGER_TYPE_INT] = { true, true, true }, 59 [TRIGGER_TYPE_EXCP] = { true, true, true }, 60 [TRIGGER_TYPE_AD_MATCH6] = { true, true, true }, 61 [TRIGGER_TYPE_EXT_SRC] = { true, false, false }, 62 [TRIGGER_TYPE_UNAVAIL] = { true, true, true } 63 }; 64 65 /* only breakpoint size 1/2/4/8 supported */ 66 static int access_size[SIZE_NUM] = { 67 [SIZE_ANY] = 0, 68 [SIZE_1B] = 1, 69 [SIZE_2B] = 2, 70 [SIZE_4B] = 4, 71 [SIZE_6B] = -1, 72 [SIZE_8B] = 8, 73 [6 ... 15] = -1, 74 }; 75 76 static inline target_ulong extract_trigger_type(CPURISCVState *env, 77 target_ulong tdata1) 78 { 79 switch (riscv_cpu_mxl(env)) { 80 case MXL_RV32: 81 return extract32(tdata1, 28, 4); 82 case MXL_RV64: 83 case MXL_RV128: 84 return extract64(tdata1, 60, 4); 85 default: 86 g_assert_not_reached(); 87 } 88 } 89 90 static inline target_ulong get_trigger_type(CPURISCVState *env, 91 target_ulong trigger_index) 92 { 93 return extract_trigger_type(env, env->tdata1[trigger_index]); 94 } 95 96 static trigger_action_t get_trigger_action(CPURISCVState *env, 97 target_ulong trigger_index) 98 { 99 target_ulong tdata1 = env->tdata1[trigger_index]; 100 int trigger_type = get_trigger_type(env, trigger_index); 101 trigger_action_t action = DBG_ACTION_NONE; 102 103 switch (trigger_type) { 104 case TRIGGER_TYPE_AD_MATCH: 105 action = (tdata1 & TYPE2_ACTION) >> 12; 106 break; 107 case TRIGGER_TYPE_AD_MATCH6: 108 action = (tdata1 & TYPE6_ACTION) >> 12; 109 break; 110 case TRIGGER_TYPE_INST_CNT: 111 case TRIGGER_TYPE_INT: 112 case TRIGGER_TYPE_EXCP: 113 case TRIGGER_TYPE_EXT_SRC: 114 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 115 trigger_type); 116 break; 117 case TRIGGER_TYPE_NO_EXIST: 118 case TRIGGER_TYPE_UNAVAIL: 119 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 120 trigger_type); 121 break; 122 default: 123 g_assert_not_reached(); 124 } 125 126 return action; 127 } 128 129 static inline target_ulong build_tdata1(CPURISCVState *env, 130 trigger_type_t type, 131 bool dmode, target_ulong data) 132 { 133 target_ulong tdata1; 134 135 switch (riscv_cpu_mxl(env)) { 136 case MXL_RV32: 137 tdata1 = RV32_TYPE(type) | 138 (dmode ? RV32_DMODE : 0) | 139 (data & RV32_DATA_MASK); 140 break; 141 case MXL_RV64: 142 case MXL_RV128: 143 tdata1 = RV64_TYPE(type) | 144 (dmode ? RV64_DMODE : 0) | 145 (data & RV64_DATA_MASK); 146 break; 147 default: 148 g_assert_not_reached(); 149 } 150 151 return tdata1; 152 } 153 154 bool tdata_available(CPURISCVState *env, int tdata_index) 155 { 156 int trigger_type = get_trigger_type(env, env->trigger_cur); 157 158 if (unlikely(tdata_index >= TDATA_NUM)) { 159 return false; 160 } 161 162 return tdata_mapping[trigger_type][tdata_index]; 163 } 164 165 target_ulong tselect_csr_read(CPURISCVState *env) 166 { 167 return env->trigger_cur; 168 } 169 170 void tselect_csr_write(CPURISCVState *env, target_ulong val) 171 { 172 if (val < RV_MAX_TRIGGERS) { 173 env->trigger_cur = val; 174 } 175 } 176 177 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val, 178 trigger_type_t t) 179 { 180 uint32_t type, dmode; 181 target_ulong tdata1; 182 183 switch (riscv_cpu_mxl(env)) { 184 case MXL_RV32: 185 type = extract32(val, 28, 4); 186 dmode = extract32(val, 27, 1); 187 tdata1 = RV32_TYPE(t); 188 break; 189 case MXL_RV64: 190 case MXL_RV128: 191 type = extract64(val, 60, 4); 192 dmode = extract64(val, 59, 1); 193 tdata1 = RV64_TYPE(t); 194 break; 195 default: 196 g_assert_not_reached(); 197 } 198 199 if (type != t) { 200 qemu_log_mask(LOG_GUEST_ERROR, 201 "ignoring type write to tdata1 register\n"); 202 } 203 204 if (dmode != 0) { 205 qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n"); 206 } 207 208 return tdata1; 209 } 210 211 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask, 212 const char *msg) 213 { 214 if (val & mask) { 215 qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg); 216 } 217 } 218 219 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index) 220 { 221 trigger_action_t action = get_trigger_action(env, trigger_index); 222 223 switch (action) { 224 case DBG_ACTION_NONE: 225 break; 226 case DBG_ACTION_BP: 227 riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0); 228 break; 229 case DBG_ACTION_DBG_MODE: 230 case DBG_ACTION_TRACE0: 231 case DBG_ACTION_TRACE1: 232 case DBG_ACTION_TRACE2: 233 case DBG_ACTION_TRACE3: 234 case DBG_ACTION_EXT_DBG0: 235 case DBG_ACTION_EXT_DBG1: 236 qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action); 237 break; 238 default: 239 g_assert_not_reached(); 240 } 241 } 242 243 /* type 2 trigger */ 244 245 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl) 246 { 247 uint32_t sizelo, sizehi = 0; 248 249 if (riscv_cpu_mxl(env) == MXL_RV64) { 250 sizehi = extract32(ctrl, 21, 2); 251 } 252 sizelo = extract32(ctrl, 16, 2); 253 return (sizehi << 2) | sizelo; 254 } 255 256 static inline bool type2_breakpoint_enabled(target_ulong ctrl) 257 { 258 bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M)); 259 bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 260 261 return mode && rwx; 262 } 263 264 static target_ulong type2_mcontrol_validate(CPURISCVState *env, 265 target_ulong ctrl) 266 { 267 target_ulong val; 268 uint32_t size; 269 270 /* validate the generic part first */ 271 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH); 272 273 /* validate unimplemented (always zero) bits */ 274 warn_always_zero_bit(ctrl, TYPE2_MATCH, "match"); 275 warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain"); 276 warn_always_zero_bit(ctrl, TYPE2_ACTION, "action"); 277 warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing"); 278 warn_always_zero_bit(ctrl, TYPE2_SELECT, "select"); 279 warn_always_zero_bit(ctrl, TYPE2_HIT, "hit"); 280 281 /* validate size encoding */ 282 size = type2_breakpoint_size(env, ctrl); 283 if (access_size[size] == -1) { 284 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n", 285 size); 286 } else { 287 val |= (ctrl & TYPE2_SIZELO); 288 if (riscv_cpu_mxl(env) == MXL_RV64) { 289 val |= (ctrl & TYPE2_SIZEHI); 290 } 291 } 292 293 /* keep the mode and attribute bits */ 294 val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M | 295 TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC)); 296 297 return val; 298 } 299 300 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index) 301 { 302 target_ulong ctrl = env->tdata1[index]; 303 target_ulong addr = env->tdata2[index]; 304 bool enabled = type2_breakpoint_enabled(ctrl); 305 CPUState *cs = env_cpu(env); 306 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 307 uint32_t size; 308 309 if (!enabled) { 310 return; 311 } 312 313 if (ctrl & TYPE2_EXEC) { 314 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 315 } 316 317 if (ctrl & TYPE2_LOAD) { 318 flags |= BP_MEM_READ; 319 } 320 if (ctrl & TYPE2_STORE) { 321 flags |= BP_MEM_WRITE; 322 } 323 324 if (flags & BP_MEM_ACCESS) { 325 size = type2_breakpoint_size(env, ctrl); 326 if (size != 0) { 327 cpu_watchpoint_insert(cs, addr, size, flags, 328 &env->cpu_watchpoint[index]); 329 } else { 330 cpu_watchpoint_insert(cs, addr, 8, flags, 331 &env->cpu_watchpoint[index]); 332 } 333 } 334 } 335 336 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index) 337 { 338 CPUState *cs = env_cpu(env); 339 340 if (env->cpu_breakpoint[index]) { 341 cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]); 342 env->cpu_breakpoint[index] = NULL; 343 } 344 345 if (env->cpu_watchpoint[index]) { 346 cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]); 347 env->cpu_watchpoint[index] = NULL; 348 } 349 } 350 351 static void type2_reg_write(CPURISCVState *env, target_ulong index, 352 int tdata_index, target_ulong val) 353 { 354 target_ulong new_val; 355 356 switch (tdata_index) { 357 case TDATA1: 358 new_val = type2_mcontrol_validate(env, val); 359 if (new_val != env->tdata1[index]) { 360 env->tdata1[index] = new_val; 361 type2_breakpoint_remove(env, index); 362 type2_breakpoint_insert(env, index); 363 } 364 break; 365 case TDATA2: 366 if (val != env->tdata2[index]) { 367 env->tdata2[index] = val; 368 type2_breakpoint_remove(env, index); 369 type2_breakpoint_insert(env, index); 370 } 371 break; 372 case TDATA3: 373 qemu_log_mask(LOG_UNIMP, 374 "tdata3 is not supported for type 2 trigger\n"); 375 break; 376 default: 377 g_assert_not_reached(); 378 } 379 380 return; 381 } 382 383 /* type 6 trigger */ 384 385 static inline bool type6_breakpoint_enabled(target_ulong ctrl) 386 { 387 bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M)); 388 bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 389 390 return mode && rwx; 391 } 392 393 static target_ulong type6_mcontrol6_validate(CPURISCVState *env, 394 target_ulong ctrl) 395 { 396 target_ulong val; 397 uint32_t size; 398 399 /* validate the generic part first */ 400 val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6); 401 402 /* validate unimplemented (always zero) bits */ 403 warn_always_zero_bit(ctrl, TYPE6_MATCH, "match"); 404 warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain"); 405 warn_always_zero_bit(ctrl, TYPE6_ACTION, "action"); 406 warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing"); 407 warn_always_zero_bit(ctrl, TYPE6_SELECT, "select"); 408 warn_always_zero_bit(ctrl, TYPE6_HIT, "hit"); 409 410 /* validate size encoding */ 411 size = extract32(ctrl, 16, 4); 412 if (access_size[size] == -1) { 413 qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n", 414 size); 415 } else { 416 val |= (ctrl & TYPE6_SIZE); 417 } 418 419 /* keep the mode and attribute bits */ 420 val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M | 421 TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC)); 422 423 return val; 424 } 425 426 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index) 427 { 428 target_ulong ctrl = env->tdata1[index]; 429 target_ulong addr = env->tdata2[index]; 430 bool enabled = type6_breakpoint_enabled(ctrl); 431 CPUState *cs = env_cpu(env); 432 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 433 uint32_t size; 434 435 if (!enabled) { 436 return; 437 } 438 439 if (ctrl & TYPE6_EXEC) { 440 cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]); 441 } 442 443 if (ctrl & TYPE6_LOAD) { 444 flags |= BP_MEM_READ; 445 } 446 447 if (ctrl & TYPE6_STORE) { 448 flags |= BP_MEM_WRITE; 449 } 450 451 if (flags & BP_MEM_ACCESS) { 452 size = extract32(ctrl, 16, 4); 453 if (size != 0) { 454 cpu_watchpoint_insert(cs, addr, size, flags, 455 &env->cpu_watchpoint[index]); 456 } else { 457 cpu_watchpoint_insert(cs, addr, 8, flags, 458 &env->cpu_watchpoint[index]); 459 } 460 } 461 } 462 463 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index) 464 { 465 type2_breakpoint_remove(env, index); 466 } 467 468 static void type6_reg_write(CPURISCVState *env, target_ulong index, 469 int tdata_index, target_ulong val) 470 { 471 target_ulong new_val; 472 473 switch (tdata_index) { 474 case TDATA1: 475 new_val = type6_mcontrol6_validate(env, val); 476 if (new_val != env->tdata1[index]) { 477 env->tdata1[index] = new_val; 478 type6_breakpoint_remove(env, index); 479 type6_breakpoint_insert(env, index); 480 } 481 break; 482 case TDATA2: 483 if (val != env->tdata2[index]) { 484 env->tdata2[index] = val; 485 type6_breakpoint_remove(env, index); 486 type6_breakpoint_insert(env, index); 487 } 488 break; 489 case TDATA3: 490 qemu_log_mask(LOG_UNIMP, 491 "tdata3 is not supported for type 6 trigger\n"); 492 break; 493 default: 494 g_assert_not_reached(); 495 } 496 497 return; 498 } 499 500 /* icount trigger type */ 501 static inline int 502 itrigger_get_count(CPURISCVState *env, int index) 503 { 504 return get_field(env->tdata1[index], ITRIGGER_COUNT); 505 } 506 507 static inline void 508 itrigger_set_count(CPURISCVState *env, int index, int value) 509 { 510 env->tdata1[index] = set_field(env->tdata1[index], 511 ITRIGGER_COUNT, value); 512 } 513 514 static bool check_itrigger_priv(CPURISCVState *env, int index) 515 { 516 target_ulong tdata1 = env->tdata1[index]; 517 if (riscv_cpu_virt_enabled(env)) { 518 /* check VU/VS bit against current privilege level */ 519 return (get_field(tdata1, ITRIGGER_VS) == env->priv) || 520 (get_field(tdata1, ITRIGGER_VU) == env->priv); 521 } else { 522 /* check U/S/M bit against current privilege level */ 523 return (get_field(tdata1, ITRIGGER_M) == env->priv) || 524 (get_field(tdata1, ITRIGGER_S) == env->priv) || 525 (get_field(tdata1, ITRIGGER_U) == env->priv); 526 } 527 } 528 529 bool riscv_itrigger_enabled(CPURISCVState *env) 530 { 531 int count; 532 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 533 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 534 continue; 535 } 536 if (check_itrigger_priv(env, i)) { 537 continue; 538 } 539 count = itrigger_get_count(env, i); 540 if (!count) { 541 continue; 542 } 543 return true; 544 } 545 546 return false; 547 } 548 549 void helper_itrigger_match(CPURISCVState *env) 550 { 551 int count; 552 for (int i = 0; i < RV_MAX_TRIGGERS; i++) { 553 if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) { 554 continue; 555 } 556 if (check_itrigger_priv(env, i)) { 557 continue; 558 } 559 count = itrigger_get_count(env, i); 560 if (!count) { 561 continue; 562 } 563 itrigger_set_count(env, i, count--); 564 if (!count) { 565 do_trigger_action(env, i); 566 } 567 } 568 } 569 570 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index) 571 { 572 switch (tdata_index) { 573 case TDATA1: 574 return env->tdata1[env->trigger_cur]; 575 case TDATA2: 576 return env->tdata2[env->trigger_cur]; 577 case TDATA3: 578 return env->tdata3[env->trigger_cur]; 579 default: 580 g_assert_not_reached(); 581 } 582 } 583 584 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val) 585 { 586 int trigger_type; 587 588 if (tdata_index == TDATA1) { 589 trigger_type = extract_trigger_type(env, val); 590 } else { 591 trigger_type = get_trigger_type(env, env->trigger_cur); 592 } 593 594 switch (trigger_type) { 595 case TRIGGER_TYPE_AD_MATCH: 596 type2_reg_write(env, env->trigger_cur, tdata_index, val); 597 break; 598 case TRIGGER_TYPE_AD_MATCH6: 599 type6_reg_write(env, env->trigger_cur, tdata_index, val); 600 break; 601 case TRIGGER_TYPE_INST_CNT: 602 case TRIGGER_TYPE_INT: 603 case TRIGGER_TYPE_EXCP: 604 case TRIGGER_TYPE_EXT_SRC: 605 qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n", 606 trigger_type); 607 break; 608 case TRIGGER_TYPE_NO_EXIST: 609 case TRIGGER_TYPE_UNAVAIL: 610 qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n", 611 trigger_type); 612 break; 613 default: 614 g_assert_not_reached(); 615 } 616 } 617 618 target_ulong tinfo_csr_read(CPURISCVState *env) 619 { 620 /* assume all triggers support the same types of triggers */ 621 return BIT(TRIGGER_TYPE_AD_MATCH) | 622 BIT(TRIGGER_TYPE_AD_MATCH6); 623 } 624 625 void riscv_cpu_debug_excp_handler(CPUState *cs) 626 { 627 RISCVCPU *cpu = RISCV_CPU(cs); 628 CPURISCVState *env = &cpu->env; 629 630 if (cs->watchpoint_hit) { 631 if (cs->watchpoint_hit->flags & BP_CPU) { 632 cs->watchpoint_hit = NULL; 633 do_trigger_action(env, DBG_ACTION_BP); 634 } 635 } else { 636 if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) { 637 do_trigger_action(env, DBG_ACTION_BP); 638 } 639 } 640 } 641 642 bool riscv_cpu_debug_check_breakpoint(CPUState *cs) 643 { 644 RISCVCPU *cpu = RISCV_CPU(cs); 645 CPURISCVState *env = &cpu->env; 646 CPUBreakpoint *bp; 647 target_ulong ctrl; 648 target_ulong pc; 649 int trigger_type; 650 int i; 651 652 QTAILQ_FOREACH(bp, &cs->breakpoints, entry) { 653 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 654 trigger_type = get_trigger_type(env, i); 655 656 switch (trigger_type) { 657 case TRIGGER_TYPE_AD_MATCH: 658 /* type 2 trigger cannot be fired in VU/VS mode */ 659 if (riscv_cpu_virt_enabled(env)) { 660 return false; 661 } 662 663 ctrl = env->tdata1[i]; 664 pc = env->tdata2[i]; 665 666 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) { 667 /* check U/S/M bit against current privilege level */ 668 if ((ctrl >> 3) & BIT(env->priv)) { 669 return true; 670 } 671 } 672 break; 673 case TRIGGER_TYPE_AD_MATCH6: 674 ctrl = env->tdata1[i]; 675 pc = env->tdata2[i]; 676 677 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) { 678 if (riscv_cpu_virt_enabled(env)) { 679 /* check VU/VS bit against current privilege level */ 680 if ((ctrl >> 23) & BIT(env->priv)) { 681 return true; 682 } 683 } else { 684 /* check U/S/M bit against current privilege level */ 685 if ((ctrl >> 3) & BIT(env->priv)) { 686 return true; 687 } 688 } 689 } 690 break; 691 default: 692 /* other trigger types are not supported or irrelevant */ 693 break; 694 } 695 } 696 } 697 698 return false; 699 } 700 701 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) 702 { 703 RISCVCPU *cpu = RISCV_CPU(cs); 704 CPURISCVState *env = &cpu->env; 705 target_ulong ctrl; 706 target_ulong addr; 707 int trigger_type; 708 int flags; 709 int i; 710 711 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 712 trigger_type = get_trigger_type(env, i); 713 714 switch (trigger_type) { 715 case TRIGGER_TYPE_AD_MATCH: 716 /* type 2 trigger cannot be fired in VU/VS mode */ 717 if (riscv_cpu_virt_enabled(env)) { 718 return false; 719 } 720 721 ctrl = env->tdata1[i]; 722 addr = env->tdata2[i]; 723 flags = 0; 724 725 if (ctrl & TYPE2_LOAD) { 726 flags |= BP_MEM_READ; 727 } 728 if (ctrl & TYPE2_STORE) { 729 flags |= BP_MEM_WRITE; 730 } 731 732 if ((wp->flags & flags) && (wp->vaddr == addr)) { 733 /* check U/S/M bit against current privilege level */ 734 if ((ctrl >> 3) & BIT(env->priv)) { 735 return true; 736 } 737 } 738 break; 739 case TRIGGER_TYPE_AD_MATCH6: 740 ctrl = env->tdata1[i]; 741 addr = env->tdata2[i]; 742 flags = 0; 743 744 if (ctrl & TYPE6_LOAD) { 745 flags |= BP_MEM_READ; 746 } 747 if (ctrl & TYPE6_STORE) { 748 flags |= BP_MEM_WRITE; 749 } 750 751 if ((wp->flags & flags) && (wp->vaddr == addr)) { 752 if (riscv_cpu_virt_enabled(env)) { 753 /* check VU/VS bit against current privilege level */ 754 if ((ctrl >> 23) & BIT(env->priv)) { 755 return true; 756 } 757 } else { 758 /* check U/S/M bit against current privilege level */ 759 if ((ctrl >> 3) & BIT(env->priv)) { 760 return true; 761 } 762 } 763 } 764 break; 765 default: 766 /* other trigger types are not supported */ 767 break; 768 } 769 } 770 771 return false; 772 } 773 774 void riscv_trigger_init(CPURISCVState *env) 775 { 776 target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0); 777 int i; 778 779 /* init to type 2 triggers */ 780 for (i = 0; i < RV_MAX_TRIGGERS; i++) { 781 /* 782 * type = TRIGGER_TYPE_AD_MATCH 783 * dmode = 0 (both debug and M-mode can write tdata) 784 * maskmax = 0 (unimplemented, always 0) 785 * sizehi = 0 (match against any size, RV64 only) 786 * hit = 0 (unimplemented, always 0) 787 * select = 0 (always 0, perform match on address) 788 * timing = 0 (always 0, trigger before instruction) 789 * sizelo = 0 (match against any size) 790 * action = 0 (always 0, raise a breakpoint exception) 791 * chain = 0 (unimplemented, always 0) 792 * match = 0 (always 0, when any compare value equals tdata2) 793 */ 794 env->tdata1[i] = tdata1; 795 env->tdata2[i] = 0; 796 env->tdata3[i] = 0; 797 env->cpu_breakpoint[i] = NULL; 798 env->cpu_watchpoint[i] = NULL; 799 } 800 } 801