[Bug 1879587] [NEW] Register number in ESR is incorrect for certain banked registers when switching from AA32 to AA64

[Julien Freche]

Public bug reported:

I am running into a situation where I have:
- A hypervisor running in EL2, AA64
- A guest running in EL1, AA32

We trap certain accesses to special registers such as DACR (via
HCR.TVM). One instruction that is trapped is:

ee03ef10  ->    mcr     15, 0, lr, cr3, cr0, {0}

The guest is running in SVC mode. So, LR should refer to LR_svc there.
LR_svc is mapped to X18 in AA64. So, ESR should reflect that. However,
the actual ESR value is: 0xfe00dc0

If we decode the 'rt':
>>> (0xfe00dc0 >> 5) & 0x1f
14

My understanding is that 14 is incorrect in the context of AA64. rt
should be set to 18. The current mode being SVC, LR refers to LR_svc not
LR_usr. In other words, the mapping between registers in AA64 and AA32
doesn't seem to be accounted for. I've tested this with Qemu 5.0.0

Let me know if that makes sense and if you would like more info. I am also 
happy to test patches.
Thanks for all the great work on Qemu!

** Affects: qemu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1879587

Title:
  Register number in ESR is incorrect for certain banked registers when
  switching from AA32 to AA64

Status in QEMU:
  New

Bug description:
  I am running into a situation where I have:
  - A hypervisor running in EL2, AA64
  - A guest running in EL1, AA32

  We trap certain accesses to special registers such as DACR (via
  HCR.TVM). One instruction that is trapped is:

  ee03ef10  ->    mcr     15, 0, lr, cr3, cr0, {0}

  The guest is running in SVC mode. So, LR should refer to LR_svc there.
  LR_svc is mapped to X18 in AA64. So, ESR should reflect that. However,
  the actual ESR value is: 0xfe00dc0

  If we decode the 'rt':
  >>> (0xfe00dc0 >> 5) & 0x1f
  14

  My understanding is that 14 is incorrect in the context of AA64. rt
  should be set to 18. The current mode being SVC, LR refers to LR_svc
  not LR_usr. In other words, the mapping between registers in AA64 and
  AA32 doesn't seem to be accounted for. I've tested this with Qemu
  5.0.0

  Let me know if that makes sense and if you would like more info. I am also 
happy to test patches.
  Thanks for all the great work on Qemu!

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1879587/+subscriptions