On Sun, 7 Jun 2026 at 19:22, Jason Wright <[email protected]> wrote: > > Commit 887eaa8a29 ("target/arm: implement FEAT_RNG_TRAP for RNDR/RNDRRS") > gave ID_AA64ISAR0_EL1 a readfn so the RNDR field can reflect SCR_EL3.TRNDR > at read time, and marked the cpreg ARM_CP_NO_RAW in the system-emulation > path. HVF then trips its hvf_arch_init_vcpu() assertion that no ID > register in hvf_sreg_list[] is NO_RAW, aborting on boot on Apple Silicon: > > Assertion failed: (!(ri->type & ARM_CP_NO_RAW)), > function hvf_arch_init_vcpu, file hvf.c, line 1442. > > Reproduce with: > > qemu-system-aarch64 -M virt,accel=hvf -cpu host \ > -nographic -display none -bios /dev/null > > Mirror the existing treatment of ID_AA64PFR0_EL1: move > HV_SYS_REG_ID_AA64ISAR0_EL1 into the SYNC_NO_RAW_REGS block in > sysreg.c.inc so the assert loop skips it, and push QEMU's view of the > register to the vCPU at init time. HVF does not expose EL3, so > SCR_EL3.TRNDR is never set and the readfn is functionally static there. > > Reported-by: Zenghui Yu <[email protected]> > Fixes: 887eaa8a29 ("target/arm: implement FEAT_RNG_TRAP for RNDR/RNDRRS") > Signed-off-by: Jason Wright <[email protected]> > --- > target/arm/hvf/hvf.c | 4 ++++ > target/arm/hvf/sysreg.c.inc | 2 +- > 2 files changed, 5 insertions(+), 1 deletion(-) > > diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c > index d88cbe7c82..afa1120c8a 100644 > --- a/target/arm/hvf/hvf.c > +++ b/target/arm/hvf/hvf.c > @@ -1485,6 +1485,10 @@ int hvf_arch_init_vcpu(CPUState *cpu) > ret = hv_vcpu_set_sys_reg(cpu->accel->fd, HV_SYS_REG_ID_AA64PFR0_EL1, > pfr); > assert_hvf_ok(ret); > > + ret = hv_vcpu_set_sys_reg(cpu->accel->fd, HV_SYS_REG_ID_AA64ISAR0_EL1, > + GET_IDREG(&arm_cpu->isar, ID_AA64ISAR0)); > + assert_hvf_ok(ret); > +
For ID_AA64PFR0_EL1, we do "read the value from hvf, update it, write it back", and we do not either read or write the isar.idregs[] entry for it. For ID_AA64MMFR0_EL1, we read the hvf value into the isar.idregs[] array entry, update it there, and write it back to hvf. For ID_AA64ISAR0_EL1, we write whatever is in the isar.idregs[] array entry into hvf. Why do we do three different things for these three registers ? thanks -- PMM
