From 9826fc4414b9d3b86d464b44b785582279048a94 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Sun, 18 Feb 2018 22:47:21 -0500 Subject: [PATCH] target-arm: Implement remaining illegal return event checks We already implement almost all the checks for the illegal return events from AArch64 state described in the ARM ARM section D1.11.2. Add the two missing ones: * return to EL2 when EL3 is implemented and SCR_EL3.NS is 0 * return to Non-secure EL1 when EL2 is implemented and HCR_EL2.TGE is 1 (We don't implement external debug, so the case of "debug state exit from EL0 using AArch64 state to EL0 using AArch32 state" doesn't apply for QEMU.) Backports commit e393f339af87da7210f6c86902b321df6a2e8bf5 from qemu --- qemu/target-arm/op_helper.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/qemu/target-arm/op_helper.c b/qemu/target-arm/op_helper.c index e1045eb7..e84b119b 100644 --- a/qemu/target-arm/op_helper.c +++ b/qemu/target-arm/op_helper.c @@ -719,6 +719,16 @@ void HELPER(exception_return)(CPUARMState *env) goto illegal_return; } + if (new_el == 2 && arm_is_secure_below_el3(env)) { + /* Return to the non-existent secure-EL2 */ + goto illegal_return; + } + + if (new_el == 1 && (env->cp15.hcr_el2 & HCR_TGE) + && !arm_is_secure_below_el3(env)) { + goto illegal_return; + } + if (!return_to_aa64) { env->aarch64 = 0; env->uncached_cpsr = spsr & CPSR_M;