The pseudocode for AT S1E2R and AT S1E2W says that they should be
UNDEFINED if executed at EL3 when EL2 is not enabled. We were
incorrectly using CP_ACCESS_TRAP and reporting the wrong exception
syndrome as a result. Use CP_ACCESS_TRAP_UNCATEGORIZED.

Cc: qemu-stable@nongnu.org
Fixes: 2a47df953202e1 ("target-arm: Wire up AArch64 EL2 and EL3 address translation ops")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 7ddeed0283f..74b556b6766 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3611,7 +3611,7 @@ static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     if (arm_current_el(env) == 3 &&
         !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) {
-        return CP_ACCESS_TRAP;
+        return CP_ACCESS_TRAP_UNCATEGORIZED;
     }
     return at_e012_access(env, ri, isread);
 }
-- 
2.34.1

On 1/30/25 10:22, Peter Maydell wrote:
> The pseudocode for AT S1E2R and AT S1E2W says that they should be
> UNDEFINED if executed at EL3 when EL2 is not enabled. We were
> incorrectly using CP_ACCESS_TRAP and reporting the wrong exception
> syndrome as a result. Use CP_ACCESS_TRAP_UNCATEGORIZED.
> 
> Cc: qemu-stable@nongnu.org
> Fixes: 2a47df953202e1 ("target-arm: Wire up AArch64 EL2 and EL3 address translation ops")
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>   target/arm/helper.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 7ddeed0283f..74b556b6766 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -3611,7 +3611,7 @@ static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
>   {
>       if (arm_current_el(env) == 3 &&
>           !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) {
> -        return CP_ACCESS_TRAP;
> +        return CP_ACCESS_TRAP_UNCATEGORIZED;

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

for the categorization fix.

BTW the line before seems like it would be clearer as arm_is_el2_enabled.  I think there 
no bug here because we don't register the cpreg unless EL2 is present, and EEL2 will not 
be set without FEAT_SEL2.  So all the checks have been done, but it's not obvious.


r~