From 02fcca9b6ff8a6f8db06cbd3f897956bc218a544 Mon Sep 17 00:00:00 2001
From: Dylan Johnson <Dylan.Johnson@ARM.com>
Date: Tue, 2 Aug 2016 10:38:03 +0100
Subject: [PATCH] arm: Fix trapping to Hypervisor during MSR/MRS read/write

This patch restricts trapping to hypervisor only if we are in the
correct exception level for the trap to happen.

Change-Id: I0a382b6a572ef835ea36d2702b8a81b633bd3df0
---
 src/arch/arm/isa/insts/data64.isa |  4 ++--
 src/arch/arm/utility.cc           | 25 ++++++++++++++-----------
 src/arch/arm/utility.hh           |  4 ++--
 3 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/src/arch/arm/isa/insts/data64.isa b/src/arch/arm/isa/insts/data64.isa
index cb5671b1e..adf87c4e5 100644
--- a/src/arch/arm/isa/insts/data64.isa
+++ b/src/arch/arm/isa/insts/data64.isa
@@ -1,6 +1,6 @@
 // -*- mode:c++ -*-
 
-// Copyright (c) 2011-2013 ARM Limited
+// Copyright (c) 2011-2013, 2016 ARM Limited
 // All rights reserved
 //
 // The license below extends only to copyright in the software and shall
@@ -310,7 +310,7 @@ let {{
 
         // Check for traps to hypervisor
         if ((ArmSystem::haveVirtualization(xc->tcBase()) && el <= EL2) &&
-            msrMrs64TrapToHyp(flat_idx, %s, CptrEl264, Hcr64, &is_vfp_neon)) {
+            msrMrs64TrapToHyp(flat_idx, el, %s, CptrEl264, Hcr64, &is_vfp_neon)) {
             return std::make_shared<HypervisorTrap>(
                 machInst, is_vfp_neon ? 0x1E00000 : imm,
                 is_vfp_neon ? EC_TRAPPED_SIMD_FP : EC_TRAPPED_MSR_MRS_64);
diff --git a/src/arch/arm/utility.cc b/src/arch/arm/utility.cc
index ea7fa2bde..56a21ae2d 100644
--- a/src/arch/arm/utility.cc
+++ b/src/arch/arm/utility.cc
@@ -590,7 +590,9 @@ msrMrs64TrapToSup(const MiscRegIndex miscReg, ExceptionLevel el,
 }
 
 bool
-msrMrs64TrapToHyp(const MiscRegIndex miscReg, bool isRead,
+msrMrs64TrapToHyp(const MiscRegIndex miscReg,
+                  ExceptionLevel el,
+                  bool isRead,
                   CPTR cptr /* CPTR_EL2 */,
                   HCR hcr /* HCR_EL2 */,
                   bool * isVfpNeon)
@@ -608,7 +610,7 @@ msrMrs64TrapToHyp(const MiscRegIndex miscReg, bool isRead,
         break;
       // CPACR
       case MISCREG_CPACR_EL1:
-        trapToHyp = cptr.tcpac;
+        trapToHyp = cptr.tcpac && el == EL1;
         break;
       // Virtual memory control regs
       case MISCREG_SCTLR_EL1:
@@ -622,7 +624,8 @@ msrMrs64TrapToHyp(const MiscRegIndex miscReg, bool isRead,
       case MISCREG_MAIR_EL1:
       case MISCREG_AMAIR_EL1:
       case MISCREG_CONTEXTIDR_EL1:
-        trapToHyp = (hcr.trvm && isRead) || (hcr.tvm && !isRead);
+        trapToHyp = ((hcr.trvm && isRead) || (hcr.tvm && !isRead))
+                    && el == EL1;
         break;
       // TLB maintenance instructions
       case MISCREG_TLBI_VMALLE1:
@@ -637,30 +640,30 @@ msrMrs64TrapToHyp(const MiscRegIndex miscReg, bool isRead,
       case MISCREG_TLBI_VAAE1IS_Xt:
       case MISCREG_TLBI_VALE1IS_Xt:
       case MISCREG_TLBI_VAALE1IS_Xt:
-        trapToHyp = hcr.ttlb;
+        trapToHyp = hcr.ttlb && el == EL1;
         break;
       // Cache maintenance instructions to the point of unification
       case MISCREG_IC_IVAU_Xt:
       case MISCREG_ICIALLU:
       case MISCREG_ICIALLUIS:
       case MISCREG_DC_CVAU_Xt:
-        trapToHyp = hcr.tpu;
+        trapToHyp = hcr.tpu && el <= EL1;
         break;
       // Data/Unified cache maintenance instructions to the point of coherency
       case MISCREG_DC_IVAC_Xt:
       case MISCREG_DC_CIVAC_Xt:
       case MISCREG_DC_CVAC_Xt:
-        trapToHyp = hcr.tpc;
+        trapToHyp = hcr.tpc && el <= EL1;
         break;
       // Data/Unified cache maintenance instructions by set/way
       case MISCREG_DC_ISW_Xt:
       case MISCREG_DC_CSW_Xt:
       case MISCREG_DC_CISW_Xt:
-        trapToHyp = hcr.tsw;
+        trapToHyp = hcr.tsw && el == EL1;
         break;
       // ACTLR
       case MISCREG_ACTLR_EL1:
-        trapToHyp = hcr.tacr;
+        trapToHyp = hcr.tacr && el == EL1;
         break;
 
       // @todo: Trap implementation-dependent functionality based on
@@ -695,20 +698,20 @@ msrMrs64TrapToHyp(const MiscRegIndex miscReg, bool isRead,
       case MISCREG_ID_AA64AFR0_EL1:
       case MISCREG_ID_AA64AFR1_EL1:
         assert(isRead);
-        trapToHyp = hcr.tid3;
+        trapToHyp = hcr.tid3 && el == EL1;
         break;
       // ID regs, group 2
       case MISCREG_CTR_EL0:
       case MISCREG_CCSIDR_EL1:
       case MISCREG_CLIDR_EL1:
       case MISCREG_CSSELR_EL1:
-        trapToHyp = hcr.tid2;
+        trapToHyp = hcr.tid2 && el <= EL1;
         break;
       // ID regs, group 1
       case MISCREG_AIDR_EL1:
       case MISCREG_REVIDR_EL1:
         assert(isRead);
-        trapToHyp = hcr.tid1;
+        trapToHyp = hcr.tid1 && el == EL1;
         break;
       default:
         break;
diff --git a/src/arch/arm/utility.hh b/src/arch/arm/utility.hh
index 4b87dcc13..3a5a468dd 100644
--- a/src/arch/arm/utility.hh
+++ b/src/arch/arm/utility.hh
@@ -265,8 +265,8 @@ mcrrMrrc15TrapToHyp(const MiscRegIndex miscReg, CPSR cpsr, SCR scr, HSTR hstr,
 
 bool msrMrs64TrapToSup(const MiscRegIndex miscReg, ExceptionLevel el,
                        CPACR cpacr);
-bool msrMrs64TrapToHyp(const MiscRegIndex miscReg, bool isRead, CPTR cptr,
-                       HCR hcr, bool * isVfpNeon);
+bool msrMrs64TrapToHyp(const MiscRegIndex miscReg, ExceptionLevel el,
+                       bool isRead, CPTR cptr, HCR hcr, bool * isVfpNeon);
 bool msrMrs64TrapToMon(const MiscRegIndex miscReg, CPTR cptr,
                        ExceptionLevel el, bool * isVfpNeon);