@@ -1153,6 +1153,12 @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx)
CPUARMState *env = cs->env_ptr;
unsigned int cur_el = arm_current_pl(env);
unsigned int target_el = arm_excp_target_el(cs, excp_idx);
+ /* FIXME: Use actual secure state. */
+ bool secure = false;
+ /* Interrupts can only be hypervised and routed to
+ * EL2 if we are in NS EL0/1.
+ */
+ bool irq_can_hyp = !secure && cur_el < 2 && target_el == 2;
/* Don't take exceptions if they target a lower EL. */
if (cur_el > target_el) {
@@ -1161,8 +1167,14 @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx)
switch (excp_idx) {
case EXCP_FIQ:
+ if (irq_can_hyp && (env->cp15.hcr_el2 & HCR_FMO)) {
+ return true;
+ }
return !(env->daif & PSTATE_F);
case EXCP_IRQ:
+ if (irq_can_hyp && (env->cp15.hcr_el2 & HCR_IMO)) {
+ return true;
+ }
return ((IS_M(env) && env->regs[15] < 0xfffffff0)
|| !(env->daif & PSTATE_I));
default:
@@ -3339,6 +3339,20 @@ unsigned int arm_excp_target_el(CPUState *cs, unsigned int excp_idx)
target_el = 2;
}
break;
+ case EXCP_FIQ:
+ case EXCP_IRQ:
+ {
+ const uint64_t hcr_mask = excp_idx == EXCP_FIQ ? HCR_FMO : HCR_IMO;
+ const uint32_t scr_mask = excp_idx == EXCP_FIQ ? SCR_FIQ : SCR_IRQ;
+
+ if (!secure && (env->cp15.hcr_el2 & hcr_mask)) {
+ target_el = 2;
+ }
+ if (env->cp15.scr_el3 & scr_mask) {
+ target_el = 3;
+ }
+ break;
+ }
}
return target_el;
}