target/arm: Handle trapping to EL2 of AArch32 VMRS instructions

HCR_EL2.TID3 requires that AArch32 reads of MVFR[012] are trapped to
EL2, and HCR_EL2.TID0 does the same for reads of FPSID.
In order to handle this, introduce a new TCG helper function that
checks for these control bits before executing the VMRC instruction.

Tested with a hacked-up version of KVM/arm64 that sets the control
bits for 32bit guests.

Backports commit 9ca1d776cb49c09b09579d9edd0447542970c834 from qemu

qemu/aarch64.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_aarch64
 #define helper_be_stq_mmu helper_be_stq_mmu_aarch64
 #define helper_be_stw_mmu helper_be_stw_mmu_aarch64
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_aarch64
 #define helper_clrsb_i32 helper_clrsb_i32_aarch64
 #define helper_clrsb_i64 helper_clrsb_i64_aarch64
 #define helper_clz_i32 helper_clz_i32_aarch64

qemu/aarch64eb.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_aarch64eb
 #define helper_be_stq_mmu helper_be_stq_mmu_aarch64eb
 #define helper_be_stw_mmu helper_be_stw_mmu_aarch64eb
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_aarch64eb
 #define helper_clrsb_i32 helper_clrsb_i32_aarch64eb
 #define helper_clrsb_i64 helper_clrsb_i64_aarch64eb
 #define helper_clz_i32 helper_clz_i32_aarch64eb

qemu/arm.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_arm
 #define helper_be_stq_mmu helper_be_stq_mmu_arm
 #define helper_be_stw_mmu helper_be_stw_mmu_arm
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_arm
 #define helper_clrsb_i32 helper_clrsb_i32_arm
 #define helper_clrsb_i64 helper_clrsb_i64_arm
 #define helper_clz_i32 helper_clz_i32_arm

qemu/armeb.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_armeb
 #define helper_be_stq_mmu helper_be_stq_mmu_armeb
 #define helper_be_stw_mmu helper_be_stw_mmu_armeb
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_armeb
 #define helper_clrsb_i32 helper_clrsb_i32_armeb
 #define helper_clrsb_i64 helper_clrsb_i64_armeb
 #define helper_clz_i32 helper_clz_i32_armeb

qemu/header_gen.py

@@ -1063,6 +1063,7 @@ symbols = (
     'helper_be_stl_mmu',
     'helper_be_stq_mmu',
     'helper_be_stw_mmu',
+    'helper_check_hcr_el2_trap',
     'helper_clrsb_i32',
     'helper_clrsb_i64',
     'helper_clz_i32',

qemu/m68k.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_m68k
 #define helper_be_stq_mmu helper_be_stq_mmu_m68k
 #define helper_be_stw_mmu helper_be_stw_mmu_m68k
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_m68k
 #define helper_clrsb_i32 helper_clrsb_i32_m68k
 #define helper_clrsb_i64 helper_clrsb_i64_m68k
 #define helper_clz_i32 helper_clz_i32_m68k

qemu/mips.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_mips
 #define helper_be_stq_mmu helper_be_stq_mmu_mips
 #define helper_be_stw_mmu helper_be_stw_mmu_mips
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_mips
 #define helper_clrsb_i32 helper_clrsb_i32_mips
 #define helper_clrsb_i64 helper_clrsb_i64_mips
 #define helper_clz_i32 helper_clz_i32_mips

qemu/mips64.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_mips64
 #define helper_be_stq_mmu helper_be_stq_mmu_mips64
 #define helper_be_stw_mmu helper_be_stw_mmu_mips64
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_mips64
 #define helper_clrsb_i32 helper_clrsb_i32_mips64
 #define helper_clrsb_i64 helper_clrsb_i64_mips64
 #define helper_clz_i32 helper_clz_i32_mips64

qemu/mips64el.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_mips64el
 #define helper_be_stq_mmu helper_be_stq_mmu_mips64el
 #define helper_be_stw_mmu helper_be_stw_mmu_mips64el
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_mips64el
 #define helper_clrsb_i32 helper_clrsb_i32_mips64el
 #define helper_clrsb_i64 helper_clrsb_i64_mips64el
 #define helper_clz_i32 helper_clz_i32_mips64el

qemu/mipsel.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_mipsel
 #define helper_be_stq_mmu helper_be_stq_mmu_mipsel
 #define helper_be_stw_mmu helper_be_stw_mmu_mipsel
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_mipsel
 #define helper_clrsb_i32 helper_clrsb_i32_mipsel
 #define helper_clrsb_i64 helper_clrsb_i64_mipsel
 #define helper_clz_i32 helper_clz_i32_mipsel

qemu/powerpc.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_powerpc
 #define helper_be_stq_mmu helper_be_stq_mmu_powerpc
 #define helper_be_stw_mmu helper_be_stw_mmu_powerpc
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_powerpc
 #define helper_clrsb_i32 helper_clrsb_i32_powerpc
 #define helper_clrsb_i64 helper_clrsb_i64_powerpc
 #define helper_clz_i32 helper_clz_i32_powerpc

qemu/riscv32.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_riscv32
 #define helper_be_stq_mmu helper_be_stq_mmu_riscv32
 #define helper_be_stw_mmu helper_be_stw_mmu_riscv32
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_riscv32
 #define helper_clrsb_i32 helper_clrsb_i32_riscv32
 #define helper_clrsb_i64 helper_clrsb_i64_riscv32
 #define helper_clz_i32 helper_clz_i32_riscv32

qemu/riscv64.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_riscv64
 #define helper_be_stq_mmu helper_be_stq_mmu_riscv64
 #define helper_be_stw_mmu helper_be_stw_mmu_riscv64
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_riscv64
 #define helper_clrsb_i32 helper_clrsb_i32_riscv64
 #define helper_clrsb_i64 helper_clrsb_i64_riscv64
 #define helper_clz_i32 helper_clz_i32_riscv64

qemu/sparc.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_sparc
 #define helper_be_stq_mmu helper_be_stq_mmu_sparc
 #define helper_be_stw_mmu helper_be_stw_mmu_sparc
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_sparc
 #define helper_clrsb_i32 helper_clrsb_i32_sparc
 #define helper_clrsb_i64 helper_clrsb_i64_sparc
 #define helper_clz_i32 helper_clz_i32_sparc

qemu/sparc64.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_sparc64
 #define helper_be_stq_mmu helper_be_stq_mmu_sparc64
 #define helper_be_stw_mmu helper_be_stw_mmu_sparc64
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_sparc64
 #define helper_clrsb_i32 helper_clrsb_i32_sparc64
 #define helper_clrsb_i64 helper_clrsb_i64_sparc64
 #define helper_clz_i32 helper_clz_i32_sparc64

qemu/target/arm/helper.h

@@ -224,6 +224,8 @@ DEF_HELPER_FLAGS_2(rintd, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_2(vjcvt, TCG_CALL_NO_RWG, i32, f64, env)
 DEF_HELPER_FLAGS_2(fjcvtzs, TCG_CALL_NO_RWG, i64, f64, ptr)
 
+DEF_HELPER_FLAGS_3(check_hcr_el2_trap, TCG_CALL_NO_WG, void, env, i32, i32)
+
 /* neon_helper.c */
 DEF_HELPER_FLAGS_3(neon_qadd_u8, TCG_CALL_NO_RWG, i32, env, i32, i32)
 DEF_HELPER_FLAGS_3(neon_qadd_s8, TCG_CALL_NO_RWG, i32, env, i32, i32)

qemu/target/arm/translate-vfp.inc.c

@@ -771,13 +771,25 @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
     if (a->l) {
         /* VMRS, move VFP special register to gp register */
         switch (a->reg) {
+        case ARM_VFP_MVFR0:
+        case ARM_VFP_MVFR1:
+        case ARM_VFP_MVFR2:
+            if (s->current_el == 1) {
+                TCGv_i32 tcg_reg, tcg_rt;
+
+                gen_set_condexec(s);
+                gen_set_pc_im(s, s->pc_curr);
+                tcg_reg = tcg_const_i32(tcg_ctx, a->reg);
+                tcg_rt = tcg_const_i32(tcg_ctx, a->rt);
+                gen_helper_check_hcr_el2_trap(tcg_ctx, tcg_ctx->cpu_env, tcg_rt, tcg_reg);
+                tcg_temp_free_i32(tcg_ctx, tcg_reg);
+                tcg_temp_free_i32(tcg_ctx, tcg_rt);
+            }
+            /* fall through */
         case ARM_VFP_FPSID:
         case ARM_VFP_FPEXC:
         case ARM_VFP_FPINST:
         case ARM_VFP_FPINST2:
-        case ARM_VFP_MVFR0:
-        case ARM_VFP_MVFR1:
-        case ARM_VFP_MVFR2:
             tmp = load_cpu_field(s, vfp.xregs[a->reg]);
             break;
         case ARM_VFP_FPSCR:

qemu/target/arm/vfp_helper.c

@@ -1343,5 +1343,34 @@ float64 HELPER(frint64_d)(float64 f, void *fpst)
     return frint_d(f, fpst, 64);
 }
 
+void HELPER(check_hcr_el2_trap)(CPUARMState *env, uint32_t rt, uint32_t reg)
+{
+    uint32_t syndrome;
+
+    switch (reg) {
+    case ARM_VFP_MVFR0:
+    case ARM_VFP_MVFR1:
+    case ARM_VFP_MVFR2:
+        if (!(arm_hcr_el2_eff(env) & HCR_TID3)) {
+            return;
+        }
+        break;
+    case ARM_VFP_FPSID:
+        if (!(arm_hcr_el2_eff(env) & HCR_TID0)) {
+            return;
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    syndrome = ((EC_FPIDTRAP << ARM_EL_EC_SHIFT)
+                | ARM_EL_IL
+                | (1 << 24) | (0xe << 20) | (7 << 14)
+                | (reg << 10) | (rt << 5) | 1);
+
+    raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
+}
+
 #endif
 

qemu/x86_64.h

@@ -1057,6 +1057,7 @@
 #define helper_be_stl_mmu helper_be_stl_mmu_x86_64
 #define helper_be_stq_mmu helper_be_stq_mmu_x86_64
 #define helper_be_stw_mmu helper_be_stw_mmu_x86_64
+#define helper_check_hcr_el2_trap helper_check_hcr_el2_trap_x86_64
 #define helper_clrsb_i32 helper_clrsb_i32_x86_64
 #define helper_clrsb_i64 helper_clrsb_i64_x86_64
 #define helper_clz_i32 helper_clz_i32_x86_64