From 8c41572624aca9fa48f833fe2cc4e87618e43326 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Wed, 22 Aug 2018 12:51:39 -0400 Subject: [PATCH] target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked) The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp from either Monitor or Hyp mode. Our translate time check was overly strict and only permitted access from Monitor mode. The runtime check we do in msr_mrs_banked_exc_checks() had the correct code in it, but never got there because of the earlier "currmode == tgtmode" check. Special case ELR_Hyp. Backports commit aec4dd09f172ee64c19222b78269d5952fd9c1dc from qemu --- qemu/target/arm/op_helper.c | 22 +++++++++++----------- qemu/target/arm/translate.c | 10 +++++++--- 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/qemu/target/arm/op_helper.c b/qemu/target/arm/op_helper.c index 044abced..ac7c77e6 100644 --- a/qemu/target/arm/op_helper.c +++ b/qemu/target/arm/op_helper.c @@ -613,6 +613,14 @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode, */ int curmode = env->uncached_cpsr & CPSR_M; + if (regno == 17) { + /* ELR_Hyp: a special case because access from tgtmode is OK */ + if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) { + goto undef; + } + return; + } + if (curmode == tgtmode) { goto undef; } @@ -640,17 +648,9 @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode, } if (tgtmode == ARM_CPU_MODE_HYP) { - switch (regno) { - case 17: /* ELR_Hyp */ - if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) { - goto undef; - } - break; - default: - if (curmode != ARM_CPU_MODE_MON) { - goto undef; - } - break; + /* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */ + if (curmode != ARM_CPU_MODE_MON) { + goto undef; } } diff --git a/qemu/target/arm/translate.c b/qemu/target/arm/translate.c index 4b486a5c..1c6b2cc6 100644 --- a/qemu/target/arm/translate.c +++ b/qemu/target/arm/translate.c @@ -4640,10 +4640,14 @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn, } break; case ARM_CPU_MODE_HYP: - /* Note that we can forbid accesses from EL2 here because they - * must be from Hyp mode itself + /* + * SPSR_hyp and r13_hyp can only be accessed from Monitor mode + * (and so we can forbid accesses from EL2 or below). elr_hyp + * can be accessed also from Hyp mode, so forbid accesses from + * EL0 or EL1. */ - if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 3) { + if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 2 || + (s->current_el < 3 && *regno != 17)) { goto undef; } break;