[Xen-devel] xen/arm: potential bug in advance_pc

[Lukas Jünger <lukas.juenger@xxxxxxxxxxxxxxxxxx>]

Hello all,

in the function advance_pc in xen/arch/arm/traps.c in line 1655,1656 you 
can find the following code:
1655     BUG_ON( (!psr_mode_is_32bit(cpsr)||!(cpsr&PSR_THUMB))
1656             && (cpsr&PSR_IT_MASK) );

This code seems to check that we are not running in thumb mode and that 
the PSR_IT_MASK is not set.
On ARMv8.5-BTI systems bits [11:10] of spsr_el2 indicate the BTYPE (see 
https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/spsr_el2).
If an exception is taken in the guest (e.g. write to system register) 
from AArch64 state these bits might be set.
The PSR_IT_MASK for thumb mode overlaps with these bits and BUG_ON is 
executed.
This seems to be a bug.
Is it really necessary to check the PSR_IT_MASK for BUG_ON here?
Why is the execution mode checked twice with psr_mode_is_32bit and 
cpsr&PSR_THUMB, as they seem to do the same thing?
If PSR_IT_MASK does not need to be checked for BUG_ON, the if statement 
in the following line should check for thumb mode again, right?
Best regards,
Lukas

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel