From 553e230088953635dd9e4ccab1f154bcfa273bf3 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Tue, 20 Feb 2018 22:17:43 -0500 Subject: [PATCH] target-arm: Raw CPSR writes should skip checks and bank switching Raw CPSR writes should skip the architectural checks for whether we're allowed to set the A or F bits and should also not do the switching of register banks if the mode changes. Handle this inside cpsr_write(), which allows us to drop the "manually set the mode bits to avoid the bank switch" code from all the callsites which are using CPSRWriteRaw. This fixes a bug in 32-bit KVM handling where we had forgotten the "manually set the mode bits" part and could thus potentially trash the register state if the mode from the last exit to userspace differed from the mode on this exit. Backports commit f8c88bbcda76d5674e4bb125471371b41d330df8 from qemu --- qemu/target-arm/helper.c | 5 +++-- qemu/target-arm/op_helper.c | 5 ++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/qemu/target-arm/helper.c b/qemu/target-arm/helper.c index 78c4c1a0..a6d6b8d6 100644 --- a/qemu/target-arm/helper.c +++ b/qemu/target-arm/helper.c @@ -4571,7 +4571,7 @@ void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, * In a V8 implementation, it is permitted for privileged software to * change the CPSR A/F bits regardless of the SCR.AW/FW bits. */ - if (!arm_feature(env, ARM_FEATURE_V8) && + if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && arm_feature(env, ARM_FEATURE_EL3) && !arm_feature(env, ARM_FEATURE_EL2) && !arm_is_secure(env)) { @@ -4618,7 +4618,8 @@ void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, env->daif &= ~(CPSR_AIF & mask); env->daif |= val & CPSR_AIF & mask; - if ((env->uncached_cpsr ^ val) & mask & CPSR_M) { + if (write_type != CPSRWriteRaw && + ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { if (bad_mode_switch(env, val & CPSR_M)) { /* Attempt to switch to an invalid mode: this is UNPREDICTABLE. * We choose to ignore the attempt and leave the CPSR M field diff --git a/qemu/target-arm/op_helper.c b/qemu/target-arm/op_helper.c index ee4feb9c..942ea69e 100644 --- a/qemu/target-arm/op_helper.c +++ b/qemu/target-arm/op_helper.c @@ -779,7 +779,10 @@ void HELPER(exception_return)(CPUARMState *env) if (!return_to_aa64) { env->aarch64 = 0; - env->uncached_cpsr = spsr & CPSR_M; + /* We do a raw CPSR write because aarch64_sync_64_to_32() + * will sort the register banks out for us, and we've already + * caught all the bad-mode cases in el_from_spsr(). + */ cpsr_write(env, spsr, ~0, CPSRWriteRaw); if (!arm_singlestep_active(env)) { env->uncached_cpsr &= ~PSTATE_SS;