@@ -1179,6 +1179,10 @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx)
CPUARMState *env = cs->env_ptr;
unsigned int cur_el = arm_current_pl(env);
unsigned int target_el = arm_excp_target_el(cs, excp_idx);
+ /* FIXME: Use actual secure state. */
+ bool secure = false;
+ /* If in EL1/0, Physical IRQ routing to EL2 only happens from NS state. */
+ bool irq_can_hyp = !secure && cur_el < 2 && target_el == 2;
/* Don't take exceptions if they target a lower EL. */
if (cur_el > target_el) {
@@ -1187,8 +1191,14 @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx)
switch (excp_idx) {
case EXCP_FIQ:
+ if (irq_can_hyp && (env->cp15.hcr_el2 & HCR_FMO)) {
+ return true;
+ }
return !(env->daif & PSTATE_F);
case EXCP_IRQ:
+ if (irq_can_hyp && (env->cp15.hcr_el2 & HCR_IMO)) {
+ return true;
+ }
return !(env->daif & PSTATE_I)
&& (!IS_M(env) || env->regs[15] < 0xfffffff0);
default:
@@ -3656,6 +3656,8 @@ unsigned int arm_excp_target_el(CPUState *cs, unsigned int excp_idx)
CPUARMState *env = &cpu->env;
unsigned int cur_el = arm_current_pl(env);
unsigned int target_el;
+ /* FIXME: Use actual secure state. */
+ bool secure = false;
if (!env->aarch64) {
/* TODO: Add EL2 and 3 exception handling for AArch32. */
@@ -3670,6 +3672,21 @@ unsigned int arm_excp_target_el(CPUState *cs, unsigned int excp_idx)
case EXCP_SMC:
target_el = 3;
break;
+ case EXCP_FIQ:
+ case EXCP_IRQ:
+ {
+ const uint64_t hcr_mask = excp_idx == EXCP_FIQ ? HCR_FMO : HCR_IMO;
+ const uint32_t scr_mask = excp_idx == EXCP_FIQ ? SCR_FIQ : SCR_IRQ;
+
+ target_el = 1;
+ if (!secure && (env->cp15.hcr_el2 & hcr_mask)) {
+ target_el = 2;
+ }
+ if (env->cp15.scr_el3 & scr_mask) {
+ target_el = 3;
+ }
+ break;
+ }
default:
target_el = MAX(cur_el, 1);
break;