From cccc104bbfc02c741d4535be0184a6425399345d Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Mon, 30 Jan 2023 18:24:41 +0000 Subject: [PATCH] target/arm: All UNDEF-at-EL0 traps take priority over HSTR_EL2 traps The HSTR_EL2 register has a collection of trap bits which allow trapping to EL2 for AArch32 EL0 or EL1 accesses to coprocessor registers. The specification of these bits is that when the bit is set we should trap * EL1 accesses * EL0 accesses, if the access is not UNDEFINED when the trap bit is 0 In other words, all UNDEF traps from EL0 to EL1 take precedence over the HSTR_EL2 trap to EL2. (Since this is all AArch32, the only kind of trap-to-EL1 is the UNDEF.) Our implementation doesn't quite get this right -- we check for traps in the order: * no such register * ARMCPRegInfo::access bits * HSTR_EL2 trap bits * ARMCPRegInfo::accessfn So UNDEFs that happen because of the access bits or because the register doesn't exist at all correctly take priority over the HSTR_EL2 trap, but where a register can UNDEF at EL0 because of the accessfn we are incorrectly always taking the HSTR_EL2 trap. There aren't many of these, but one example is the PMCR; if you look at the access pseudocode for this register you can see that UNDEFs taken because of the value of PMUSERENR.EN are checked before the HSTR_EL2 bit. Rearrange helper_access_check_cp_reg() so that we always call the accessfn, and use its return value if it indicates that the access traps to EL0 rather than continuing to do the HSTR_EL2 check. Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Tested-by: Fuad Tabba Message-id: 20230130182459.3309057-6-peter.maydell@linaro.org Message-id: 20230127175507.2895013-6-peter.maydell@linaro.org --- target/arm/op_helper.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c index def5d3515e..660dae696d 100644 --- a/target/arm/op_helper.c +++ b/target/arm/op_helper.c @@ -640,10 +640,24 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, goto fail; } + if (ri->accessfn) { + res = ri->accessfn(env, ri, isread); + } + /* - * Check for an EL2 trap due to HSTR_EL2. We expect EL0 accesses - * to sysregs non accessible at EL0 to have UNDEF-ed already. + * If the access function indicates a trap from EL0 to EL1 then + * that always takes priority over the HSTR_EL2 trap. (If it indicates + * a trap to EL3, then the HSTR_EL2 trap takes priority; if it indicates + * a trap to EL2, then the syndrome is the same either way so we don't + * care whether technically the architecture says that HSTR_EL2 trap or + * the other trap takes priority. So we take the "check HSTR_EL2" path + * for all of those cases.) */ + if (res != CP_ACCESS_OK && ((res & CP_ACCESS_EL_MASK) == 0) && + arm_current_el(env) == 0) { + goto fail; + } + if (!is_a64(env) && arm_current_el(env) < 2 && ri->cp == 15 && (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { uint32_t mask = 1 << ri->crn; @@ -661,9 +675,6 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, } } - if (ri->accessfn) { - res = ri->accessfn(env, ri, isread); - } if (likely(res == CP_ACCESS_OK)) { return ri; }