The TGE bit routes all asynchronous exceptions to EL2.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index b059d9f81a..e0b8c81c5f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -8316,6 +8316,12 @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
         break;
     };
 
+    /*
+     * For these purposes, TGE and AMO/IMO/FMO both force the
+     * interrupt to EL2.  Fold TGE into the bit extracted above.
+     */
+    hcr |= (hcr_el2 & HCR_TGE) != 0;
+
     /* Perform a table-lookup for the target EL given the current state */
     target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el];
 
-- 
2.17.1

On Tue, 3 Dec 2019 at 02:30, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> The TGE bit routes all asynchronous exceptions to EL2.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  target/arm/helper.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index b059d9f81a..e0b8c81c5f 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -8316,6 +8316,12 @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
>          break;
>      };
>
> +    /*
> +     * For these purposes, TGE and AMO/IMO/FMO both force the
> +     * interrupt to EL2.  Fold TGE into the bit extracted above.
> +     */
> +    hcr |= (hcr_el2 & HCR_TGE) != 0;
> +

This only has an effect if HCR_EL2.E2H is 1, because if
E2H is 0 then arm_hcr_el2_eff() has already forced
the AMO/IMO/FMO bits to 1. But it seems to match the
way the Arm ARM phrases things in section D1.13.1 and
its accompanying tables.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM