From 0da067f2a83c61efc6f1688d4379269420838b28 Mon Sep 17 00:00:00 2001 From: Idan Horowitz Date: Fri, 1 Apr 2022 15:35:48 +0100 Subject: [PATCH] target/arm: Fix MTE access checks for disabled SEL2 While not mentioned anywhere in the actual specification text, the HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current security state. This can be observed in the psuedo-code implementation of AArch64.AllocationTagAccessIsEnabled(). Signed-off-by: Idan Horowitz Reviewed-by: Richard Henderson Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com Signed-off-by: Peter Maydell --- target/arm/helper.c | 2 +- target/arm/internals.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index 812ca591f4..3aeaea4068 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -7176,7 +7176,7 @@ static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri, { int el = arm_current_el(env); - if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) { + if (el < 2 && arm_is_el2_enabled(env)) { uint64_t hcr = arm_hcr_el2_eff(env); if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) { return CP_ACCESS_TRAP_EL2; diff --git a/target/arm/internals.h b/target/arm/internals.h index a34be2e459..7f696cd36a 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -1094,7 +1094,7 @@ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el, && !(env->cp15.scr_el3 & SCR_ATA)) { return false; } - if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) { + if (el < 2 && arm_is_el2_enabled(env)) { uint64_t hcr = arm_hcr_el2_eff(env); if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) { return false;