From 893b9f7f96c0fd57ed9a013107d540c2900a3faa Mon Sep 17 00:00:00 2001 From: Ralf-Philipp Weinmann Date: Wed, 21 Feb 2018 02:49:15 -0500 Subject: [PATCH] target-arm: Only trap SRS from S-EL1 if specified mode is MON Commit cbc0326b6fb9 caused SRS instructions executed from Secure EL1 to trap to EL3 even if the specified mode was not monitor mode. According to the ARMv8 Architecture reference manual [F6.1.203], ALL of the following conditions need to be met for SRS to trap to EL3: * It is executed at Secure PL1. * The specified mode is monitor mode. * EL3 is using AArch64. Correct the condition governing the trap to EL3 to check the specified mode. Backports commit ba63cf47a93041137a94e86b7d0cd87fc896949b from qemu --- qemu/target-arm/translate.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/qemu/target-arm/translate.c b/qemu/target-arm/translate.c index f05e35b0..3a08c688 100644 --- a/qemu/target-arm/translate.c +++ b/qemu/target-arm/translate.c @@ -7781,6 +7781,7 @@ static void gen_srs(DisasContext *s, /* SRS is: * - trapped to EL3 if EL3 is AArch64 and we are at Secure EL1 + * and specified mode is monitor mode * - UNDEFINED in Hyp mode * - UNPREDICTABLE in User or System mode * - UNPREDICTABLE if the specified mode is: @@ -7790,7 +7791,7 @@ static void gen_srs(DisasContext *s, * -- Monitor, if we are Non-secure * For the UNPREDICTABLE cases we choose to UNDEF. */ - if (s->current_el == 1 && !s->ns) { + if (s->current_el == 1 && !s->ns && mode == ARM_CPU_MODE_MON) { gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), 3); return; }