From nobody Mon Feb 9 04:35:52 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1534250743734993.9935290121191; Tue, 14 Aug 2018 05:45:43 -0700 (PDT) Received: from localhost ([::1]:44170 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fpYhc-0007Gi-KE for importer@patchew.org; Tue, 14 Aug 2018 08:45:36 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43857) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fpYfJ-0005XT-Go for qemu-devel@nongnu.org; Tue, 14 Aug 2018 08:43:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fpYfI-0002L9-84 for qemu-devel@nongnu.org; Tue, 14 Aug 2018 08:43:13 -0400 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:44334) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fpYfF-0002F2-KJ; Tue, 14 Aug 2018 08:43:09 -0400 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.89) (envelope-from ) id 1fpYfE-0006r7-Hd; Tue, 14 Aug 2018 13:43:08 +0100 From: Peter Maydell To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Date: Tue, 14 Aug 2018 13:42:52 +0100 Message-Id: <20180814124254.5229-9-peter.maydell@linaro.org> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20180814124254.5229-1-peter.maydell@linaro.org> References: <20180814124254.5229-1-peter.maydell@linaro.org> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:8b0:1d0::2 Subject: [Qemu-devel] [PATCH 08/10] target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked) X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: edgari@xilinx.com, Luc Michel , patches@linaro.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RDMRC_1 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp from either Monitor or Hyp mode. Our translate time check was overly strict and only permitted access from Monitor mode. The runtime check wo do in msr_mrs_banked_exc_checks() had the correct code in it, but never got there because of the earlier "currmode =3D=3D tgtmode" check. Special case ELR_Hyp. Signed-off-by: Peter Maydell Reviewed-By: Luc Michel Reviewed-by: Edgar E. Iglesias --- target/arm/op_helper.c | 22 +++++++++++----------- target/arm/translate.c | 10 +++++++--- 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c index d550978b5b9..952b8d122b7 100644 --- a/target/arm/op_helper.c +++ b/target/arm/op_helper.c @@ -611,6 +611,14 @@ static void msr_mrs_banked_exc_checks(CPUARMState *env= , uint32_t tgtmode, */ int curmode =3D env->uncached_cpsr & CPSR_M; =20 + if (regno =3D=3D 17) { + /* ELR_Hyp: a special case because access from tgtmode is OK */ + if (curmode !=3D ARM_CPU_MODE_HYP && curmode !=3D ARM_CPU_MODE_MON= ) { + goto undef; + } + return; + } + if (curmode =3D=3D tgtmode) { goto undef; } @@ -638,17 +646,9 @@ static void msr_mrs_banked_exc_checks(CPUARMState *env= , uint32_t tgtmode, } =20 if (tgtmode =3D=3D ARM_CPU_MODE_HYP) { - switch (regno) { - case 17: /* ELR_Hyp */ - if (curmode !=3D ARM_CPU_MODE_HYP && curmode !=3D ARM_CPU_MODE= _MON) { - goto undef; - } - break; - default: - if (curmode !=3D ARM_CPU_MODE_MON) { - goto undef; - } - break; + /* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */ + if (curmode !=3D ARM_CPU_MODE_MON) { + goto undef; } } =20 diff --git a/target/arm/translate.c b/target/arm/translate.c index f845da7c638..3f5751d4826 100644 --- a/target/arm/translate.c +++ b/target/arm/translate.c @@ -4506,10 +4506,14 @@ static bool msr_banked_access_decode(DisasContext *= s, int r, int sysm, int rn, } break; case ARM_CPU_MODE_HYP: - /* Note that we can forbid accesses from EL2 here because they - * must be from Hyp mode itself + /* + * SPSR_hyp and r13_hyp can only be accessed from Monitor mode + * (and so we can forbid accesses from EL2 or below). elr_hyp + * can be accessed also from Hyp mode, so forbid accesses from + * EL0 or EL1. */ - if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 3) { + if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 2 || + (s->current_el < 3 && *regno !=3D 17)) { goto undef; } break; --=20 2.18.0