From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60095) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aJmvx-00076p-Aj for qemu-devel@nongnu.org; Thu, 14 Jan 2016 13:47:46 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aJmvw-0002IC-C8 for qemu-devel@nongnu.org; Thu, 14 Jan 2016 13:47:45 -0500 From: Peter Maydell Date: Thu, 14 Jan 2016 18:34:11 +0000 Message-Id: <1452796451-2946-9-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1452796451-2946-1-git-send-email-peter.maydell@linaro.org> References: <1452796451-2946-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PATCH 8/8] target-arm: ignore ELR_ELx[1] for exception return to 32-bit ARM mode List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Alex=20Benn=C3=A9e?= , Paolo Bonzini , qemu-arm@nongnu.org, "Edgar E. Iglesias" , patches@linaro.org The architecture requires that for an exception return to AArch32 the low bits of ELR_ELx are ignored when the PC is set from them: * if returning to Thumb mode, ignore ELR_ELx[0] * if returning to ARM mode, ignore ELR_ELx[1:0] We were only squashing bit 0; also squash bit 1 if the SPSR T bit indicates this is a return to ARM code. Signed-off-by: Peter Maydell --- target-arm/op_helper.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c index 5789ccb..171d6b8 100644 --- a/target-arm/op_helper.c +++ b/target-arm/op_helper.c @@ -738,7 +738,11 @@ void HELPER(exception_return)(CPUARMState *env) } aarch64_sync_64_to_32(env); - env->regs[15] = env->elr_el[cur_el] & ~0x1; + if (spsr & CPSR_T) { + env->regs[15] = env->elr_el[cur_el] & ~0x1; + } else { + env->regs[15] = env->elr_el[cur_el] & ~0x3; + } } else { env->aarch64 = 1; pstate_write(env, spsr); -- 1.9.1