Re: [PATCH 1/2] xen/arm: drop unreachable EL0 check when emulating ACTLR

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

On Tue, 11 Aug 2026, Michal Orzel wrote:
> do_sysreg() and do_cp15_32() inject an undefined exception when the
> trapped access to ACTLR_EL1 (resp. ACTLR) originates from EL0. That
> branch cannot be taken. ACTLR_EL1 can be accessed by EL1 and above, and no
> enable makes them accessible at EL0. The only trap covering them,
> HCR_EL2.TACR (HCR.TAC on AArch32), applies to accesses from EL1 only.
> 
> Refer Arm ARM (DDI 0487M.b) D1.4.5.6 "Prioritization of Synchronous
> exceptions": "attempting to execute an instruction that is defined to
> never be accessible at the current Exception level and Security state,
> regardless of any enables or traps" is priority 18, whereas an exception
> taken to EL2 as the result of a configuration control in HCR_EL2 is
> priority 24. The former wins, so an access from EL0 is UNDEFINED and the
> TACR trap is not taken.
> 
> An EL0 access therefore never reaches EL2: it is taken to EL1, as Xen
> never sets HCR_EL2.TGE for guests, and it is reported with EC=0x00
> (Unknown reason) rather than EC=0x18/0x03.
> 
> Signed-off-by: Michal Orzel <michal.orzel@xxxxxxx>


Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>


> ---
>  xen/arch/arm/arm64/vsysreg.c | 2 --
>  xen/arch/arm/vcpreg.c        | 2 --
>  2 files changed, 4 deletions(-)
> 
> diff --git a/xen/arch/arm/arm64/vsysreg.c b/xen/arch/arm/arm64/vsysreg.c
> index a02ad951f9c1..a59848889659 100644
> --- a/xen/arch/arm/arm64/vsysreg.c
> +++ b/xen/arch/arm/arm64/vsysreg.c
> @@ -95,8 +95,6 @@ void do_sysreg(struct cpu_user_regs *regs,
>       * ARMv8 (DDI 0487A.d): D7.2.1
>       */
>      case HSR_SYSREG_ACTLR_EL1:
> -        if ( regs_mode_is_user(regs) )
> -            return inject_undef_exception(regs);
>          if ( hsr.sysreg.read )
>              set_user_reg(regs, regidx, v->arch.actlr);
>          break;
> diff --git a/xen/arch/arm/vcpreg.c b/xen/arch/arm/vcpreg.c
> index d6f9326b712c..749ce6d3a57c 100644
> --- a/xen/arch/arm/vcpreg.c
> +++ b/xen/arch/arm/vcpreg.c
> @@ -219,8 +219,6 @@ void do_cp15_32(struct cpu_user_regs *regs, const union 
> hsr hsr)
>       * ARMv8 (DDI 0487A.d): G6.2.1
>       */
>      case HSR_CPREG32(ACTLR):
> -        if ( regs_mode_is_user(regs) )
> -            return inject_undef_exception(regs);
>          if ( cp32.read )
>              set_user_reg(regs, regidx, v->arch.actlr);
>          break;
> -- 
> 2.43.0
>