From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42858) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1abRM4-0002PC-DJ for qemu-devel@nongnu.org; Thu, 03 Mar 2016 06:23:44 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1abRLz-0007nH-1d for qemu-devel@nongnu.org; Thu, 03 Mar 2016 06:23:35 -0500 Date: Mon, 22 Feb 2016 23:25:54 +0100 From: Ralf-Philipp Weinmann Message-ID: <20160222222554.GA11598@beta.comsecuris.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] [PATCH] Fix bug: SRS instructions would trap to EL3 in Secure EL1 even if specified mode was not monitor mode. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-arm@nongnu.org Cc: qemu-devel@nongnu.org According to the ARMv8 Architecture reference manual [F6.1.203], ALL of the following conditions need to be met for SRS to trap to EL3: * It is executed at Secure PL1. * The specified mode is monitor mode. * EL3 is using AArch64. --- target-arm/translate.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/target-arm/translate.c b/target-arm/translate.c index c29c47f..a7688bb 100644 --- a/target-arm/translate.c +++ b/target-arm/translate.c @@ -7582,7 +7582,8 @@ static void gen_srs(DisasContext *s, bool undef = false; /* SRS is: - * - trapped to EL3 if EL3 is AArch64 and we are at Secure EL1 + * - trapped to EL3 if EL3 is AArch64 and we are at Secure EL1 and + * mode is monitor mode * - UNDEFINED in Hyp mode * - UNPREDICTABLE in User or System mode * - UNPREDICTABLE if the specified mode is: @@ -7592,7 +7593,7 @@ static void gen_srs(DisasContext *s, * -- Monitor, if we are Non-secure * For the UNPREDICTABLE cases we choose to UNDEF. */ - if (s->current_el == 1 && !s->ns) { + if (s->current_el == 1 && !s->ns && mode == ARM_CPU_MODE_MON) { gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), 3); return; } -- 2.5.4 (Apple Git-61)