Arm patches for rc3 : just a handful of bug fixes.

The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

* handle FTYPE flag correctly in v7M exception return

for v7M CPUs with an FPU (v8M CPUs were already correct)

* versal: Add the CRP as unimplemented

* Fix ISR_EL1 tracking when executing at EL2

* Honor HCR_EL2.TID3 trapping requirements

Edgar E. Iglesias (1):

hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):

target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):

target/arm: Fix ISR_EL1 tracking when executing at EL2

target/arm: Honor HCR_EL2.TID3 trapping requirements

include/hw/arm/xlnx-versal.h | 3 ++

hw/arm/xlnx-versal.c | 2 ++

target/arm/helper.c | 83 ++++++++++++++++++++++++++++++++++++++++++--

target/arm/m_helper.c | 7 ++--

4 files changed, 89 insertions(+), 6 deletions(-)

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the CRP as unimplemented thus avoiding bus errors when

guests access these registers.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com

include/hw/arm/xlnx-versal.h | 3 +++

hw/arm/xlnx-versal.c | 2 ++

2 files changed, 5 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h

--- a/include/hw/arm/xlnx-versal.h

+++ b/include/hw/arm/xlnx-versal.h

@@ -XXX,XX +XXX,XX @@ typedef struct Versal {

#define MM_IOU_SCNTRS_SIZE 0x10000

#define MM_FPD_CRF 0xfd1a0000U

#define MM_FPD_CRF_SIZE 0x140000

+

+#define MM_PMC_CRP 0xf1260000U

+#define MM_PMC_CRP_SIZE 0x10000

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal.c

+++ b/hw/arm/xlnx-versal.c

@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)

MM_CRL, MM_CRL_SIZE);

versal_unimp_area(s, "crf", &s->mr_ps,

MM_FPD_CRF, MM_FPD_CRF_SIZE);

+ versal_unimp_area(s, "crp", &s->mr_ps,

+ MM_PMC_CRP, MM_PMC_CRP_SIZE);

versal_unimp_area(s, "iou-scntr", &s->mr_ps,

MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);

versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,

2.20.1

From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>

According to the PushStack() pseudocode in the armv7m RM,

bit 4 of the LR should be set to NOT(CONTROL.PFCA) when

an FPU is present. Current implementation is doing it for

armv8, but not for armv7. This patch makes the existing

logic applicable to both code paths.

Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/m_helper.c | 7 +++----

1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c

--- a/target/arm/m_helper.c

+++ b/target/arm/m_helper.c

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

if (env->v7m.secure) {

lr |= R_V7M_EXCRET_S_MASK;

}

- if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {

- lr |= R_V7M_EXCRET_FTYPE_MASK;

- }

} else {

lr = R_V7M_EXCRET_RES1_MASK |

R_V7M_EXCRET_S_MASK |

R_V7M_EXCRET_DCRS_MASK |

- R_V7M_EXCRET_FTYPE_MASK |

R_V7M_EXCRET_ES_MASK;

if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {

lr |= R_V7M_EXCRET_SPSEL_MASK;

}

}

+ if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {

+ lr |= R_V7M_EXCRET_FTYPE_MASK;

+ }

if (!arm_v7m_is_handler_mode(env)) {

lr |= R_V7M_EXCRET_MODE_MASK;

}

2.20.1

From: Marc Zyngier <maz@kernel.org>

HCR_EL2.TID3 mandates that access from EL1 to a long list of id

registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,

while the hypervisor doesn't want to expose the feature to its guest.

To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this

case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes

that the feature is present in the HW, starts using it, and dies

a horrible death when KVM injects an UNDEF, because the feature

*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR

registers from AArch32 (they are accessed via the VMRS

instruction and need to be handled in a different way).

Reported-by: Will Deacon <will@kernel.org>

Signed-off-by: Marc Zyngier <maz@kernel.org>

Tested-by: Will Deacon <will@kernel.org>

Message-id: 20191123115618.29230-1-maz@kernel.org

[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;

changed names of access functions to include _tid3]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 76 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {

REGINFO_SENTINEL

};

+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,

+ bool isread)

+{

+ if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {

+ return CP_ACCESS_TRAP_EL2;

+ return CP_ACCESS_OK;

+}

+

+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,

+ bool isread)

+{

+ if (arm_feature(env, ARM_FEATURE_V8)) {

+ return access_aa64_tid3(env, ri, isread);

+ return CP_ACCESS_OK;

+}

+

void register_cp_regs_for_features(ARMCPU *cpu)

{

/* Register all the coprocessor registers based on feature bits */

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

{ .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->id_pfr0 },

/* ID_PFR1 is not a plain ARM_CP_CONST because we don't know

* the value of the GIC field until after we define these regs.

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

{ .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,

.access = PL1_R, .type = ARM_CP_NO_RAW,

+ .accessfn = access_aa32_tid3,

.readfn = id_pfr1_read,

.writefn = arm_cp_write_ignore },

{ .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->id_dfr0 },

{ .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->id_afr0 },

{ .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->id_mmfr0 },

{ .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->id_mmfr1 },

{ .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->id_mmfr2 },

{ .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->id_mmfr3 },

{ .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->isar.id_isar0 },

{ .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->isar.id_isar1 },

{ .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->isar.id_isar2 },

{ .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->isar.id_isar3 },

{ .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->isar.id_isar4 },

{ .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->isar.id_isar5 },

{ .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->id_mmfr4 },

{ .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa32_tid3,

.resetvalue = cpu->isar.id_isar6 },

REGINFO_SENTINEL

};

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

{ .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,

.access = PL1_R, .type = ARM_CP_NO_RAW,

+ .accessfn = access_aa64_tid3,

.readfn = id_aa64pfr0_read,

.writefn = arm_cp_write_ignore },

{ .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->isar.id_aa64pfr1},

{ .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

/* At present, only SVEver == 0 is defined anyway. */

.resetvalue = 0 },

{ .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->id_aa64dfr0 },

{ .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->id_aa64dfr1 },

{ .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->id_aa64afr0 },

{ .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->id_aa64afr1 },

{ .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->isar.id_aa64isar0 },

{ .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->isar.id_aa64isar1 },

{ .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->isar.id_aa64mmfr0 },

{ .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->isar.id_aa64mmfr1 },

{ .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->isar.mvfr0 },

{ .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->isar.mvfr1 },

{ .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->isar.mvfr2 },

{ .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,

.access = PL1_R, .type = ARM_CP_CONST,

+ .accessfn = access_aa64_tid3,

.resetvalue = 0 },

{ .name = "PMCEID0", .state = ARM_CP_STATE_AA32,

.cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,

2.20.1

From: Marc Zyngier <maz@kernel.org>

The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,

ISR_EL1 shows the pending status of the physical IRQ, FIQ, or

SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2

bits, and ignores the current exception level. This means a hypervisor

trying to look at its own interrupt state actually sees the guest

state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits

if not running in a virtualized context.

Fixes: 636540e9c40b

Reported-by: Quentin Perret <qperret@google.com>

Signed-off-by: Marc Zyngier <maz@kernel.org>

Message-id: 20191122135833.28953-1-maz@kernel.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

target/arm/helper.c | 7 +++++--

1 file changed, 5 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)

CPUState *cs = env_cpu(env);

uint64_t hcr_el2 = arm_hcr_el2_eff(env);

uint64_t ret = 0;

+ bool allow_virt = (arm_current_el(env) == 1 &&

+ (!arm_is_secure_below_el3(env) ||

+ (env->cp15.scr_el3 & SCR_EEL2)));

- if (hcr_el2 & HCR_IMO) {

+ if (allow_virt && (hcr_el2 & HCR_IMO)) {

if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {

ret |= CPSR_I;

}

@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)

- if (hcr_el2 & HCR_FMO) {

+ if (allow_virt && (hcr_el2 & HCR_FMO)) {

if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {

ret |= CPSR_F;

}