diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2019-08-15 09:46:42 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2019-08-16 14:02:49 +0100 |
| commit | 8bd587c1066f4456ddfe611b571d9439a947d74c (patch) | |
| tree | 3e5c1ce53b10d7b0fd221fc8e186d5e9ac31d1f0 /target/arm/translate-a64.c | |
| parent | c1d5f50f094ab204accfacc2ee6aafc9601dd5c4 (diff) | |
| download | qemu-8bd587c1066f4456ddfe611b571d9439a947d74c.zip qemu-8bd587c1066f4456ddfe611b571d9439a947d74c.tar.gz qemu-8bd587c1066f4456ddfe611b571d9439a947d74c.tar.bz2 | |
target/arm: Fix routing of singlestep exceptions
When generating an architectural single-step exception we were
routing it to the "default exception level", which is to say
the same exception level we execute at except that EL0 exceptions
go to EL1. This is incorrect because the debug exception level
can be configured by the guest for situations such as single
stepping of EL0 and EL1 code by EL2.
We have to track the target debug exception level in the TB
flags, because it is dependent on CPU state like HCR_EL2.TGE
and MDCR_EL2.TDE. (That we were previously calling the
arm_debug_target_el() function to determine dc->ss_same_el
is itself a bug, though one that would only have manifested
as incorrect syndrome information.) Since we are out of TB
flag bits unless we want to expand into the cs_base field,
we share some bits with the M-profile only HANDLER and
STACKCHECK bits, since only A-profile has this singlestep.
Fixes: https://bugs.launchpad.net/qemu/+bug/1838913
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190805130952.4415-3-peter.maydell@linaro.org
Diffstat (limited to 'target/arm/translate-a64.c')
| -rw-r--r-- | target/arm/translate-a64.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c index f6729b9..90850ea 100644 --- a/target/arm/translate-a64.c +++ b/target/arm/translate-a64.c @@ -14180,7 +14180,7 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase, dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE); dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS); dc->is_ldex = false; - dc->ss_same_el = (arm_debug_target_el(env) == dc->current_el); + dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL); /* Bound the number of insns to execute to those left on the page. */ bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4; |