From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50254) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bv4BC-0001TD-Tr for qemu-devel@nongnu.org; Fri, 14 Oct 2016 11:13:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bv4B8-0001IN-GO for qemu-devel@nongnu.org; Fri, 14 Oct 2016 11:13:50 -0400 Received: from mail-wm0-x231.google.com ([2a00:1450:400c:c09::231]:37744) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bv4B8-0001I4-2A for qemu-devel@nongnu.org; Fri, 14 Oct 2016 11:13:46 -0400 Received: by mail-wm0-x231.google.com with SMTP id c78so3208906wme.0 for ; Fri, 14 Oct 2016 08:13:46 -0700 (PDT) From: =?UTF-8?q?Alex=20Benn=C3=A9e?= Date: Fri, 14 Oct 2016 16:13:36 +0100 Message-Id: <20161014151336.31418-1-alex.bennee@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH] target-arm/translate.c: fix movs pc, lr exception return on ARMv7 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: peter.maydell@linaro.org Cc: qemu-arm@nongnu.org, qemu-devel@nongnu.org, =?UTF-8?q?Alex=20Benn=C3=A9e?= This was broken by the fix for 9b6a3ea7a699594162ed3d11e4e04b98568dc5c0. Specifically a movs pc,lr in the kernels ret_fast_syscall returning to some thumb mode user space code but store_reg unconditionally aligned the return PC instead of treating the return as an "interworking" branch. I suspect we need to audit all calls to store_reg that might involve the PC to ensure "interworking" branches are correctly handled. Also I'm not quite sure how the code worked before 9b6a3e as the store_reg path wouldn't have triggered the store_cpu_field(var, thumb) to set the processor mode back to thumb. Signed-off-by: Alex Bennée --- target-arm/translate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target-arm/translate.c b/target-arm/translate.c index 5e21b52..373d68a 100644 --- a/target-arm/translate.c +++ b/target-arm/translate.c @@ -4318,7 +4318,7 @@ static void gen_mrs_banked(DisasContext *s, int r, int sysm, int rn) static void gen_exception_return(DisasContext *s, TCGv_i32 pc) { TCGv_i32 tmp; - store_reg(s, 15, pc); + store_reg_bx(s, 15, pc); tmp = load_cpu_field(spsr); gen_helper_cpsr_write_eret(cpu_env, tmp); tcg_temp_free_i32(tmp); -- 2.9.3