| Message ID | 20230127175507.2895013-8-peter.maydell@linaro.org |
|---|---|
| State | Superseded |
| Headers | show |
| Series | target/arm: Implement FEAT_FGT fine-grained traps | expand |
On 1/27/23 07:54, Peter Maydell wrote: > The HSTR_EL2 register is not supposed to have an effect unless EL2 is > enabled in the current security state. We weren't checking for this, > which meant that if the guest set up the HSTR_EL2 register we would > incorrectly trap even for accesses from Secure EL0 and EL1. > > Add the missing checks. (Other places where we look at HSTR_EL2 > for the not-in-v8A bits TTEE and TJDBX are already checking that > we are in NS EL0 or EL1, so there we alredy know EL2 is enabled.) > > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > target/arm/helper.c | 2 +- > target/arm/op_helper.c | 1 + > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/target/arm/helper.c b/target/arm/helper.c > index 6f6772d8e04..66966869218 100644 > --- a/target/arm/helper.c > +++ b/target/arm/helper.c > @@ -11716,7 +11716,7 @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el, > DP_TBFLAG_A32(flags, VFPEN, 1); > } > > - if (el < 2 && env->cp15.hstr_el2 && > + if (el < 2 && env->cp15.hstr_el2 && arm_is_el2_enabled(env) && > (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { Reviewed-by: Richard Henderson <richard.henderson@linaro.org> r~
diff --git a/target/arm/helper.c b/target/arm/helper.c index 6f6772d8e04..66966869218 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -11716,7 +11716,7 @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el, DP_TBFLAG_A32(flags, VFPEN, 1); } - if (el < 2 && env->cp15.hstr_el2 && + if (el < 2 && env->cp15.hstr_el2 && arm_is_el2_enabled(env) && (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1); } diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c index 8ac176e0742..5c17a5bd176 100644 --- a/target/arm/op_helper.c +++ b/target/arm/op_helper.c @@ -670,6 +670,7 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, * we only need to check here for traps from EL0. */ if (!is_a64(env) && arm_current_el(env) == 0 && ri->cp == 15 && + arm_is_el2_enabled(env) && (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { uint32_t mask = 1 << ri->crn;
The HSTR_EL2 register is not supposed to have an effect unless EL2 is enabled in the current security state. We weren't checking for this, which meant that if the guest set up the HSTR_EL2 register we would incorrectly trap even for accesses from Secure EL0 and EL1. Add the missing checks. (Other places where we look at HSTR_EL2 for the not-in-v8A bits TTEE and TJDBX are already checking that we are in NS EL0 or EL1, so there we alredy know EL2 is enabled.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/helper.c | 2 +- target/arm/op_helper.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)