diff mbox series

[for-9.0] target/arm: take HSTR traps of cp15 accesses to EL2, not EL1

Message ID 20240325133116.2075362-1-peter.maydell@linaro.org
State New
Headers show
Series [for-9.0] target/arm: take HSTR traps of cp15 accesses to EL2, not EL1 | expand

Commit Message

Peter Maydell March 25, 2024, 1:31 p.m. UTC
The HSTR_EL2 register allows the hypervisor to trap AArch32 EL1 and
EL0 accesses to cp15 registers.  We incorrectly implemented this so
they trap to EL1 when we detect the need for a HSTR trap at code
generation time.  (The check in access_check_cp_reg() which we do at
runtime to catch traps from EL0 is correctly routing them to EL2.)

Use the correct target EL when generating the code to take the trap.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2226
Fixes: 049edada5e93df ("target/arm: Make HSTR_EL2 traps take priority over UNDEF-at-EL1")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Richard Henderson March 25, 2024, 6:28 p.m. UTC | #1
On 3/25/24 03:31, Peter Maydell wrote:
> The HSTR_EL2 register allows the hypervisor to trap AArch32 EL1 and
> EL0 accesses to cp15 registers.  We incorrectly implemented this so
> they trap to EL1 when we detect the need for a HSTR trap at code
> generation time.  (The check in access_check_cp_reg() which we do at
> runtime to catch traps from EL0 is correctly routing them to EL2.)
> 
> Use the correct target EL when generating the code to take the trap.
> 
> Cc:qemu-stable@nongnu.org
> Resolves:https://gitlab.com/qemu-project/qemu/-/issues/2226
> Fixes: 049edada5e93df ("target/arm: Make HSTR_EL2 traps take priority over UNDEF-at-EL1")
> Signed-off-by: Peter Maydell<peter.maydell@linaro.org>
> ---
>   target/arm/tcg/translate.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~
diff mbox series

Patch

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index c8a24706750..69585e6003d 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -4585,7 +4585,7 @@  static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
             tcg_gen_andi_i32(t, t, 1u << maskbit);
             tcg_gen_brcondi_i32(TCG_COND_EQ, t, 0, over.label);
 
-            gen_exception_insn(s, 0, EXCP_UDEF, syndrome);
+            gen_exception_insn_el(s, 0, EXCP_UDEF, syndrome, 2);
             /*
              * gen_exception_insn() will set is_jmp to DISAS_NORETURN,
              * but since we're conditionally branching over it, we want