Skip to content

AArch64: ISV is set to 1 in ESR_EL2 when taking a data abort with post-indexed instructions

Host environment

  • Operating system: MacOS 12.4
  • OS/kernel version: Darwin MacBook-Pro-2.local 21.5.0 Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:37 PDT 2022; root:xnu-8020.121.3~4/RELEASE_ARM64_T6000 arm64
  • Architecture: ARM64
  • QEMU flavor: /opt/homebrew/bin/qemu-system-aarch64
  • QEMU version: QEMU emulator version 7.0.0 Copyright (c) 2003-2022 Fabrice Bellard and the QEMU Project developers
  • QEMU command line: /opt/homebrew/bin/qemu-system-aarch64 -m 4G -smp 4 -M virt,virtualization=on,secure=off,gic-version=2 -cpu cortex-a57 -display none -serial mon:stdio -device loader,file=bedrock.itb,addr=0x50000000,force-raw=on -kernel ../bhv/bin-qemu/apps/preboot

Emulated/Virtualized environment

  • Operating system: Custom - BedRock Hypervisor running with the NOVA microkernel
  • OS/kernel version: N/A
  • Architecture: ARMv8

Description of problem

I think that I have a Qemu bug in my hands, but, I could still be missing something. Consider the following instruction: 0x0000000000000000: C3 44 00 B8 str w3, [x6], #4

notice the last #4, I think this is what we would call a post-indexed instruction (falls into the category of instructions with writeback). As I understand it, those instructions should not have ISV=1 in ESR_EL2 when faulting.

Here is the relevant part of the manual:

For other faults reported in ESR_EL2, ISV is 0 except for the following stage 2 aborts:
• AArch64 loads and stores of a single general-purpose register (including the register specified with 0b11111, including those with Acquire/Release semantics, but excluding Load Exclusive or Store Exclusive and excluding those with writeback).

However, I can see that Qemu sets ISV to 1 here. The ARM hardware that I tested gave me a value of ISV=0 for similar instructions.

Another example of instruction: 0x00000000000002f8: 01 1C 40 38 ldrb w1, [x0, #1]!

Steps to reproduce

  1. Run some hypervisor in EL2
  2. Create a guest running at EL1 that executes one of the mentioned instructions (and make the instruction fault by writing to some unmapped page in SLP)
  3. Observe the value of ESR_EL2 on data abort

Unfortunately, I cannot provide an image to reproduce this (the software is not open-source). But, I would be happy to help test a patch.

Edited by Julien Freche
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information