Re: [Qemu-devel] [PATCH 5/6] target-arm: Implement MDCR_EL2.TDA and MDCR_EL2.TDA traps

[Peter Maydell]

On 8 February 2016 at 16:31, Sergey Fedorov <address@hidden> wrote:
> One of the MDCR_EL2's should be MDCR_EL3 instead.

Oops, yes :-)

> On 05.02.2016 19:45, Peter Maydell wrote:
>> Implement the debug register traps controlled by MDCR_EL2.TDA
>> and MDCR_EL3.TDA.
>>
>> Signed-off-by: Peter Maydell <address@hidden>
>> ---
>>  target-arm/helper.c | 39 ++++++++++++++++++++++++++++++---------
>>  1 file changed, 30 insertions(+), 9 deletions(-)
>>
>> diff --git a/target-arm/helper.c b/target-arm/helper.c
>> index 8c2adbc..064b415 100644
>> --- a/target-arm/helper.c
>> +++ b/target-arm/helper.c
>> @@ -420,6 +420,24 @@ static CPAccessResult access_tdra(CPUARMState *env, 
>> const ARMCPRegInfo *ri,
>>      return CP_ACCESS_OK;
>>  }
>>
>> +/* Check for traps to general debug registers, which are controlled
>> + * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
>> + */
>> +static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
>> +                                  bool isread)
>> +{
>> +    int el = arm_current_el(env);
>> +
>> +    if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TDA)
>> +        && !arm_is_secure_below_el3(env)) {
>> +        return CP_ACCESS_TRAP_EL2;
>> +    }
>> +    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
>> +        return CP_ACCESS_TRAP_EL3;
>> +    }
>> +    return CP_ACCESS_OK;
>> +}
>> +
>>  static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t 
>> value)
>>  {
>>      ARMCPU *cpu = arm_env_get_cpu(env);
>> @@ -3385,7 +3403,8 @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
>>        .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
>>      { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
>>        .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
>> -      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
>> +      .access = PL2_RW, .accessfn = access_tda,
>> +      .type = ARM_CP_CONST, .resetvalue = 0 },
>>      { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH,
>>        .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
>>        .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
>> @@ -3804,7 +3823,7 @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
>>      /* Monitor debug system control register; the 32-bit alias is 
>> DBGDSCRext. */
>>      { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
>>        .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
>> -      .access = PL1_RW,
>> +      .access = PL1_RW, .accessfn = access_tda,
>>        .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
>>        .resetvalue = 0 },
>>      /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
>> @@ -3813,7 +3832,7 @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
>>      { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
>>        .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
>>        .type = ARM_CP_ALIAS,
>> -      .access = PL1_R,
>> +      .access = PL1_R, .accessfn = access_tda,
>
> From ARMv8 ARM rev. A.h: "If MDSCR_EL1.TDCC==1, EL0 read accesses to
> this register are trapped to EL1." But it seems like we just don't
> implement "Config-RO for EL0" so far.

Yes. There's a comment about this, though it's just outside the
context region that diff has produced.

> Maybe it's worth to implement a
> separate function for checks controlled by MDSCR_EL1.TDCC?

I think that's a separate issue from the EL2/EL3 traps and
should go in its own patch. This series is just trying to get
EL3 right.

thanks
-- PMM