Register number in ESR is incorrect for certain banked registers when switching from AA32 to AA64
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
I am running into a situation where I have:
- A hypervisor running in EL2, AA64
- A guest running in EL1, AA32
We trap certain accesses to special registers such as DACR (via HCR.TVM). One instruction that is trapped is:
ee03ef10 -> mcr 15, 0, lr, cr3, cr0, {0}
The guest is running in SVC mode. So, LR should refer to LR_svc there. LR_svc is mapped to X18 in AA64. So, ESR should reflect that. However, the actual ESR value is: 0xfe00dc0
If we decode the 'rt':
>>> (0xfe00dc0 >> 5) & 0x1f
14
My understanding is that 14 is incorrect in the context of AA64. rt should be set to 18. The current mode being SVC, LR refers to LR_svc not LR_usr. In other words, the mapping between registers in AA64 and AA32 doesn't seem to be accounted for. I've tested this with Qemu 5.0.0
Let me know if that makes sense and if you would like more info. I am also happy to test patches.
Thanks for all the great work on Qemu!
tags: | added: arm |
Changed in qemu: | |
status: | In Progress → Fix Committed |
This is with qemu-system-aarch64 - forgot to mention it explicitly. So, it will only affect qemu for ARM 64-bit.