From d81feac6423bc2fa9b3ca5a9d98dbe0be5a29daa Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Thu, 25 Feb 2021 13:56:33 -0500 Subject: [PATCH] target/arm: Improve masking of SCR RES0 bits Protect reads of aa64 id registers with ARM_CP_STATE_AA64. Use this as a simpler test than arm_el_is_aa64, since EL3 cannot change mode. Backports commit 252e8c69669599b4bcff802df300726300292f47 from qemu --- qemu/target/arm/helper.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/qemu/target/arm/helper.c b/qemu/target/arm/helper.c index 7f8ad302..a39ff20a 100644 --- a/qemu/target/arm/helper.c +++ b/qemu/target/arm/helper.c @@ -1707,9 +1707,16 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) uint32_t valid_mask = 0x3fff; ARMCPU *cpu = env_archcpu(env); - if (arm_el_is_aa64(env, 3)) { + if (ri->state == ARM_CP_STATE_AA64) { value |= SCR_FW | SCR_AW; /* these two bits are RES1. */ valid_mask &= ~SCR_NET; + + if (cpu_isar_feature(aa64_lor, cpu)) { + valid_mask |= SCR_TLOR; + } + if (cpu_isar_feature(aa64_pauth, cpu)) { + valid_mask |= SCR_API | SCR_APK; + } } else { valid_mask &= ~(SCR_RW | SCR_ST); }