[PATCH 0/2] xen/arm: remove unreachable EL0 handling from register emulation

[PATCH 0/2] xen/arm: remove unreachable EL0 handling from register emulation

[Michal Orzel]

Noticed while reviewing recent vsysreg patches.

Michal Orzel (2):
  xen/arm: drop unreachable EL0 check when emulating ACTLR
  xen/arm: drop incorrect EL0 accessibility comments for
    PMINTEN{SET,CLR}

 xen/arch/arm/arm64/vsysreg.c | 6 ------
 xen/arch/arm/vcpreg.c        | 3 ---
 2 files changed, 9 deletions(-)

-- 
2.43.0

[PATCH 1/2] xen/arm: drop unreachable EL0 check when emulating ACTLR

[Michal Orzel]

do_sysreg() and do_cp15_32() inject an undefined exception when the
trapped access to ACTLR_EL1 (resp. ACTLR) originates from EL0. That
branch cannot be taken. ACTLR_EL1 can be accessed by EL1 and above, and no
enable makes them accessible at EL0. The only trap covering them,
HCR_EL2.TACR (HCR.TAC on AArch32), applies to accesses from EL1 only.

Refer Arm ARM (DDI 0487M.b) D1.4.5.6 "Prioritization of Synchronous
exceptions": "attempting to execute an instruction that is defined to
never be accessible at the current Exception level and Security state,
regardless of any enables or traps" is priority 18, whereas an exception
taken to EL2 as the result of a configuration control in HCR_EL2 is
priority 24. The former wins, so an access from EL0 is UNDEFINED and the
TACR trap is not taken.

An EL0 access therefore never reaches EL2: it is taken to EL1, as Xen
never sets HCR_EL2.TGE for guests, and it is reported with EC=0x00
(Unknown reason) rather than EC=0x18/0x03.

Signed-off-by: Michal Orzel <michal.orzel@amd.com>
---
 xen/arch/arm/arm64/vsysreg.c | 2 --
 xen/arch/arm/vcpreg.c        | 2 --
 2 files changed, 4 deletions(-)

diff --git a/xen/arch/arm/arm64/vsysreg.c b/xen/arch/arm/arm64/vsysreg.c
index a02ad951f9c1..a59848889659 100644
--- a/xen/arch/arm/arm64/vsysreg.c
+++ b/xen/arch/arm/arm64/vsysreg.c
@@ -95,8 +95,6 @@ void do_sysreg(struct cpu_user_regs *regs,
      * ARMv8 (DDI 0487A.d): D7.2.1
      */
     case HSR_SYSREG_ACTLR_EL1:
-        if ( regs_mode_is_user(regs) )
-            return inject_undef_exception(regs);
         if ( hsr.sysreg.read )
             set_user_reg(regs, regidx, v->arch.actlr);
         break;
diff --git a/xen/arch/arm/vcpreg.c b/xen/arch/arm/vcpreg.c
index d6f9326b712c..749ce6d3a57c 100644
--- a/xen/arch/arm/vcpreg.c
+++ b/xen/arch/arm/vcpreg.c
@@ -219,8 +219,6 @@ void do_cp15_32(struct cpu_user_regs *regs, const union hsr hsr)
      * ARMv8 (DDI 0487A.d): G6.2.1
      */
     case HSR_CPREG32(ACTLR):
-        if ( regs_mode_is_user(regs) )
-            return inject_undef_exception(regs);
         if ( cp32.read )
             set_user_reg(regs, regidx, v->arch.actlr);
         break;
-- 
2.43.0

Re: [PATCH 1/2] xen/arm: drop unreachable EL0 check when emulating ACTLR

[Stefano Stabellini]

On Tue, 11 Aug 2026, Michal Orzel wrote:
> do_sysreg() and do_cp15_32() inject an undefined exception when the
> trapped access to ACTLR_EL1 (resp. ACTLR) originates from EL0. That
> branch cannot be taken. ACTLR_EL1 can be accessed by EL1 and above, and no
> enable makes them accessible at EL0. The only trap covering them,
> HCR_EL2.TACR (HCR.TAC on AArch32), applies to accesses from EL1 only.
> 
> Refer Arm ARM (DDI 0487M.b) D1.4.5.6 "Prioritization of Synchronous
> exceptions": "attempting to execute an instruction that is defined to
> never be accessible at the current Exception level and Security state,
> regardless of any enables or traps" is priority 18, whereas an exception
> taken to EL2 as the result of a configuration control in HCR_EL2 is
> priority 24. The former wins, so an access from EL0 is UNDEFINED and the
> TACR trap is not taken.
> 
> An EL0 access therefore never reaches EL2: it is taken to EL1, as Xen
> never sets HCR_EL2.TGE for guests, and it is reported with EC=0x00
> (Unknown reason) rather than EC=0x18/0x03.
> 
> Signed-off-by: Michal Orzel <michal.orzel@amd.com>


Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>


> ---
>  xen/arch/arm/arm64/vsysreg.c | 2 --
>  xen/arch/arm/vcpreg.c        | 2 --
>  2 files changed, 4 deletions(-)
> 
> diff --git a/xen/arch/arm/arm64/vsysreg.c b/xen/arch/arm/arm64/vsysreg.c
> index a02ad951f9c1..a59848889659 100644
> --- a/xen/arch/arm/arm64/vsysreg.c
> +++ b/xen/arch/arm/arm64/vsysreg.c
> @@ -95,8 +95,6 @@ void do_sysreg(struct cpu_user_regs *regs,
>       * ARMv8 (DDI 0487A.d): D7.2.1
>       */
>      case HSR_SYSREG_ACTLR_EL1:
> -        if ( regs_mode_is_user(regs) )
> -            return inject_undef_exception(regs);
>          if ( hsr.sysreg.read )
>              set_user_reg(regs, regidx, v->arch.actlr);
>          break;
> diff --git a/xen/arch/arm/vcpreg.c b/xen/arch/arm/vcpreg.c
> index d6f9326b712c..749ce6d3a57c 100644
> --- a/xen/arch/arm/vcpreg.c
> +++ b/xen/arch/arm/vcpreg.c
> @@ -219,8 +219,6 @@ void do_cp15_32(struct cpu_user_regs *regs, const union hsr hsr)
>       * ARMv8 (DDI 0487A.d): G6.2.1
>       */
>      case HSR_CPREG32(ACTLR):
> -        if ( regs_mode_is_user(regs) )
> -            return inject_undef_exception(regs);
>          if ( cp32.read )
>              set_user_reg(regs, regidx, v->arch.actlr);
>          break;
> -- 
> 2.43.0
> 

[PATCH 2/2] xen/arm: drop incorrect EL0 accessibility comments for PMINTEN{SET,CLR}

[Michal Orzel]

The comments on the PMINTENSET/PMINTENCLR cases claim that an EL0 access
may be trapped to EL2 when MDCR_EL2.TPM is set, and that such a case is
handled. Both are inaccurate. PMINTENSET_EL1/PMINTENCLR_EL1 are accessible
at EL1 and above only, with no enable making them accessible at EL0.

Arm ARM (DDI 0487M.b) D1.4.5.6 "Prioritization of Synchronous
exceptions" orders the two exceptions. An access that is never
accessible at the current Exception level regardless of any enables or
traps is priority 18, whereas an exception taken to EL2 as the result of
a configuration control in MDCR_EL2 is priority 24. An EL0 access is
therefore UNDEFINED and taken to EL1.

Signed-off-by: Michal Orzel <michal.orzel@amd.com>
---
 xen/arch/arm/arm64/vsysreg.c | 4 ----
 xen/arch/arm/vcpreg.c        | 1 -
 2 files changed, 5 deletions(-)

diff --git a/xen/arch/arm/arm64/vsysreg.c b/xen/arch/arm/arm64/vsysreg.c
index a59848889659..2ada791f4ea7 100644
--- a/xen/arch/arm/arm64/vsysreg.c
+++ b/xen/arch/arm/arm64/vsysreg.c
@@ -228,10 +228,6 @@ void do_sysreg(struct cpu_user_regs *regs,
      */
     case HSR_SYSREG_PMINTENSET_EL1:
     case HSR_SYSREG_PMINTENCLR_EL1:
-        /*
-         * Accessible from EL1 only, but if EL0 trap happens handle as
-         * undef.
-         */
         return handle_raz_wi(regs, regidx, hsr.sysreg.read, hsr, 1);
     case HSR_SYSREG_PMUSERENR_EL0:
         /* RO at EL0. RAZ/WI at EL1 */
diff --git a/xen/arch/arm/vcpreg.c b/xen/arch/arm/vcpreg.c
index 749ce6d3a57c..b0f3c7759a04 100644
--- a/xen/arch/arm/vcpreg.c
+++ b/xen/arch/arm/vcpreg.c
@@ -295,7 +295,6 @@ void do_cp15_32(struct cpu_user_regs *regs, const union hsr hsr)
             return handle_raz_wi(regs, regidx, cp32.read, hsr, 1);
     case HSR_CPREG32(PMINTENSET):
     case HSR_CPREG32(PMINTENCLR):
-        /* EL1 only, however MDCR_EL2.TPM==1 means EL0 may trap here also. */
         return handle_raz_wi(regs, regidx, cp32.read, hsr, 1);
     case HSR_CPREG32(PMCR):
     case HSR_CPREG32(PMCNTENSET):
-- 
2.43.0

Re: [PATCH 2/2] xen/arm: drop incorrect EL0 accessibility comments for PMINTEN{SET,CLR}

[Stefano Stabellini]

On Tue, 11 Aug 2026, Michal Orzel wrote:
> The comments on the PMINTENSET/PMINTENCLR cases claim that an EL0 access
> may be trapped to EL2 when MDCR_EL2.TPM is set, and that such a case is
> handled. Both are inaccurate. PMINTENSET_EL1/PMINTENCLR_EL1 are accessible
> at EL1 and above only, with no enable making them accessible at EL0.
> 
> Arm ARM (DDI 0487M.b) D1.4.5.6 "Prioritization of Synchronous
> exceptions" orders the two exceptions. An access that is never
> accessible at the current Exception level regardless of any enables or
> traps is priority 18, whereas an exception taken to EL2 as the result of
> a configuration control in MDCR_EL2 is priority 24. An EL0 access is
> therefore UNDEFINED and taken to EL1.
> 
> Signed-off-by: Michal Orzel <michal.orzel@amd.com>

Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>


> ---
>  xen/arch/arm/arm64/vsysreg.c | 4 ----
>  xen/arch/arm/vcpreg.c        | 1 -
>  2 files changed, 5 deletions(-)
> 
> diff --git a/xen/arch/arm/arm64/vsysreg.c b/xen/arch/arm/arm64/vsysreg.c
> index a59848889659..2ada791f4ea7 100644
> --- a/xen/arch/arm/arm64/vsysreg.c
> +++ b/xen/arch/arm/arm64/vsysreg.c
> @@ -228,10 +228,6 @@ void do_sysreg(struct cpu_user_regs *regs,
>       */
>      case HSR_SYSREG_PMINTENSET_EL1:
>      case HSR_SYSREG_PMINTENCLR_EL1:
> -        /*
> -         * Accessible from EL1 only, but if EL0 trap happens handle as
> -         * undef.
> -         */
>          return handle_raz_wi(regs, regidx, hsr.sysreg.read, hsr, 1);
>      case HSR_SYSREG_PMUSERENR_EL0:
>          /* RO at EL0. RAZ/WI at EL1 */
> diff --git a/xen/arch/arm/vcpreg.c b/xen/arch/arm/vcpreg.c
> index 749ce6d3a57c..b0f3c7759a04 100644
> --- a/xen/arch/arm/vcpreg.c
> +++ b/xen/arch/arm/vcpreg.c
> @@ -295,7 +295,6 @@ void do_cp15_32(struct cpu_user_regs *regs, const union hsr hsr)
>              return handle_raz_wi(regs, regidx, cp32.read, hsr, 1);
>      case HSR_CPREG32(PMINTENSET):
>      case HSR_CPREG32(PMINTENCLR):
> -        /* EL1 only, however MDCR_EL2.TPM==1 means EL0 may trap here also. */
>          return handle_raz_wi(regs, regidx, cp32.read, hsr, 1);
>      case HSR_CPREG32(PMCR):
>      case HSR_CPREG32(PMCNTENSET):
> -- 
> 2.43.0
>