Debug exceptions that target AArch32 Hyp mode are reported differently
than on AAarch64. Internally, Qemu uses the AArch64 syndromes. Therefore
such exceptions need to be either converted to a prefetch abort
(breakpoints, vector catch) or a data abort (watchpoints).

Signed-off-by: Jan Klötzke <jan.kloetzke@kernkonzept.com>
---
v2:
 * Refactor watchpoint syndrome rewriting
 * Drop ARM_EL_ISV from watchpoint syndrome

 target/arm/helper.c   | 18 ++++++++++++++++++
 target/arm/syndrome.h |  8 ++++++++
 2 files changed, 26 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 945d8571a6..a0041aa0ec 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -11015,6 +11015,24 @@ static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
     }
 
     if (env->exception.target_el == 2) {
+        /* Debug exceptions are reported differently on AArch32 */
+        switch (syn_get_ec(env->exception.syndrome)) {
+        case EC_BREAKPOINT:
+        case EC_BREAKPOINT_SAME_EL:
+        case EC_AA32_BKPT:
+        case EC_VECTORCATCH:
+            env->exception.syndrome = syn_insn_abort(arm_current_el(env) == 2,
+                                                     0, 0, 0x22);
+            break;
+        case EC_WATCHPOINT:
+            env->exception.syndrome = syn_set_ec(env->exception.syndrome,
+                                                 EC_DATAABORT);
+            break;
+        case EC_WATCHPOINT_SAME_EL:
+            env->exception.syndrome = syn_set_ec(env->exception.syndrome,
+                                                 EC_DATAABORT_SAME_EL);
+            break;
+        }
         arm_cpu_do_interrupt_aarch32_hyp(cs);
         return;
     }
diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index 1a49767479..3244e0740d 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -25,6 +25,8 @@
 #ifndef TARGET_ARM_SYNDROME_H
 #define TARGET_ARM_SYNDROME_H
 
+#include "qemu/bitops.h"
+
 /* Valid Syndrome Register EC field values */
 enum arm_exception_class {
     EC_UNCATEGORIZED          = 0x00,
@@ -80,6 +82,7 @@ typedef enum {
     SME_ET_InactiveZA,
 } SMEExceptionType;
 
+#define ARM_EL_EC_LENGTH 6
 #define ARM_EL_EC_SHIFT 26
 #define ARM_EL_IL_SHIFT 25
 #define ARM_EL_ISV_SHIFT 24
@@ -94,6 +97,11 @@ static inline uint32_t syn_get_ec(uint32_t syn)
     return syn >> ARM_EL_EC_SHIFT;
 }
 
+static inline uint32_t syn_set_ec(uint32_t syn, uint32_t ec)
+{
+    return deposit32(syn, ARM_EL_EC_SHIFT, ARM_EL_EC_LENGTH, ec);
+}
+
 /*
  * Utility functions for constructing various kinds of syndrome value.
  * Note that in general we follow the AArch64 syndrome values; in a
-- 
2.39.2

On Sat, 27 Jan 2024 at 20:30, Jan Klötzke <jan.kloetzke@kernkonzept.com> wrote:
>
> Debug exceptions that target AArch32 Hyp mode are reported differently
> than on AAarch64. Internally, Qemu uses the AArch64 syndromes. Therefore
> such exceptions need to be either converted to a prefetch abort
> (breakpoints, vector catch) or a data abort (watchpoints).
>
> Signed-off-by: Jan Klötzke <jan.kloetzke@kernkonzept.com>
> ---
> v2:
>  * Refactor watchpoint syndrome rewriting
>  * Drop ARM_EL_ISV from watchpoint syndrome
>
>  target/arm/helper.c   | 18 ++++++++++++++++++
>  target/arm/syndrome.h |  8 ++++++++
>  2 files changed, 26 insertions(+)
>

Applied to target-arm.next, thanks (with a cc: qemu-stable header added).

By the way, if you're interested in incorrect syndromes with
AArch32 Hyp mode, the other one I know about is
https://gitlab.com/qemu-project/qemu/-/issues/1153
which describes some issues with the syndrome for traps
of VFP or Neon instructions. I don't know if that affects
your use-case.

thanks
-- PMM

On 27.01.2024 23:27, Jan Klötzke wrote:
> Debug exceptions that target AArch32 Hyp mode are reported differently
> than on AAarch64. Internally, Qemu uses the AArch64 syndromes. Therefore
> such exceptions need to be either converted to a prefetch abort
> (breakpoints, vector catch) or a data abort (watchpoints).

This seems to be a -stable matherial.  Please let me know if it is not.
Please Cc: qemu-stable@nongnu.org for other fixes suitable for stable
series.

Thanks,

/mjt

On 1/28/24 06:27, Jan Klötzke wrote:
> Debug exceptions that target AArch32 Hyp mode are reported differently
> than on AAarch64. Internally, Qemu uses the AArch64 syndromes. Therefore
> such exceptions need to be either converted to a prefetch abort
> (breakpoints, vector catch) or a data abort (watchpoints).
> 
> Signed-off-by: Jan Klötzke<jan.kloetzke@kernkonzept.com>
> ---
> v2:
>   * Refactor watchpoint syndrome rewriting
>   * Drop ARM_EL_ISV from watchpoint syndrome
> 
>   target/arm/helper.c   | 18 ++++++++++++++++++
>   target/arm/syndrome.h |  8 ++++++++
>   2 files changed, 26 insertions(+)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


r~