1 files changed, 33 insertions, 0 deletions

diff --git a/gitlab/issues/target_arm/host_missing/accel_TCG/1057.toml b/gitlab/issues/target_arm/host_missing/accel_TCG/1057.toml
new file mode 100644
index 000000000..b1ca6c08b
--- /dev/null
+++ b/gitlab/issues/target_arm/host_missing/accel_TCG/1057.toml
@@ -0,0 +1,33 @@
+id = 1057
+title = "AArch64: ISV is set to 1 in ESR_EL2 when taking a data abort with post-indexed instructions"
+state = "closed"
+created_at = "2022-06-02T20:50:04.695Z"
+closed_at = "2022-07-18T16:47:38.098Z"
+labels = ["accel: TCG", "target: arm", "workflow::In Progress"]
+url = "https://gitlab.com/qemu-project/qemu/-/issues/1057"
+host-os = "MacOS 12.4"
+host-arch = "ARM64"
+qemu-version = "QEMU emulator version 7.0.0"
+guest-os = "Custom - BedRock Hypervisor running with the NOVA microkernel"
+guest-arch = "ARMv8"
+description = """I think that I have a Qemu bug in my hands, but, I could still be missing something. Consider the following instruction:
+`0x0000000000000000:  C3 44 00 B8    str   w3, [x6], #4`
+
+notice the last #4, I think this is what we would call a post-indexed instruction (falls into the category of instructions with writeback). As I understand it, those instructions should not have ISV=1 in ESR_EL2 when faulting.
+
+Here is the relevant part of the manual:
+
+```
+For other faults reported in ESR_EL2, ISV is 0 except for the following stage 2 aborts:
+• AArch64 loads and stores of a single general-purpose register (including the register specified with 0b11111, including those with Acquire/Release semantics, but excluding Load Exclusive or Store Exclusive and excluding those with writeback).
+```
+
+However, I can see that Qemu sets ISV to 1 here. The ARM hardware that I tested gave me a value of ISV=0 for similar instructions.
+
+Another example of instruction: `0x00000000000002f8:  01 1C 40 38    ldrb  w1, [x0, #1]!`"""
+reproduce = """1. Run some hypervisor in EL2
+2. Create a guest running at EL1 that executes one of the mentioned instructions (and make the instruction fault by writing to some unmapped page in SLP)
+3. Observe the value of ESR_EL2 on data abort
+
+Unfortunately, I cannot provide an image to reproduce this (the software is not open-source). But, I would be happy to help test a patch."""
+additional = "n/a"