From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41127) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WmJwc-0000vy-MH for qemu-devel@nongnu.org; Mon, 19 May 2014 05:33:24 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WmJwV-0008ME-DL for qemu-devel@nongnu.org; Mon, 19 May 2014 05:33:18 -0400 Received: from mail-we0-x22e.google.com ([2a00:1450:400c:c03::22e]:37930) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WmJwV-0008M7-6h for qemu-devel@nongnu.org; Mon, 19 May 2014 05:33:11 -0400 Received: by mail-we0-f174.google.com with SMTP id k48so5108855wev.5 for ; Mon, 19 May 2014 02:33:10 -0700 (PDT) From: "Edgar E. Iglesias" Date: Mon, 19 May 2014 19:22:55 +1000 Message-Id: <1400491383-6725-15-git-send-email-edgar.iglesias@gmail.com> In-Reply-To: <1400491383-6725-1-git-send-email-edgar.iglesias@gmail.com> References: <1400491383-6725-1-git-send-email-edgar.iglesias@gmail.com> Subject: [Qemu-devel] [PATCH v3 14/22] target-arm: A64: Forbid ERET to increase the EL List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org, peter.maydell@linaro.org Cc: rob.herring@linaro.org, peter.crosthwaite@xilinx.com, aggelerf@ethz.ch, agraf@suse.de, john.williams@xilinx.com, alex.bennee@linaro.org, christoffer.dall@linaro.org, rth@twiddle.net From: "Edgar E. Iglesias" Reviewed-by: Peter Crosthwaite Signed-off-by: Edgar E. Iglesias --- target-arm/op_helper.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c index c05a839..a6eedb2 100644 --- a/target-arm/op_helper.c +++ b/target-arm/op_helper.c @@ -389,6 +389,7 @@ void HELPER(exception_return)(CPUARMState *env) unsigned int spsr_idx = is_a64(env) ? aarch64_banked_spsr_index(1) : 0; uint32_t spsr = env->banked_spsr[spsr_idx]; int new_el, i; + int cur_el = arm_current_pl(env); if (env->pstate & PSTATE_SP) { env->sp_el[1] = env->xregs[31]; @@ -410,6 +411,10 @@ void HELPER(exception_return)(CPUARMState *env) env->regs[15] = env->elr_el[1] & ~0x1; } else { new_el = extract32(spsr, 2, 2); + if (new_el > cur_el) { + /* Disallow returns to higher ELs than the current one. */ + goto illegal_return; + } if (new_el > 1) { /* Return to unimplemented EL */ goto illegal_return; -- 1.8.3.2