target-arm: ignore ELR_ELx[1] for exception return to 32-bit ARM mode

The architecture requires that for an exception return to AArch32 the
low bits of ELR_ELx are ignored when the PC is set from them:
* if returning to Thumb mode, ignore ELR_ELx[0]
* if returning to ARM mode, ignore ELR_ELx[1:0]

We were only squashing bit 0; also squash bit 1 if the SPSR T bit
indicates this is a return to ARM code.

Backports commit c1e0371442bf3a7e42ad53c2a3d816ed7099f81d from qemu
This commit is contained in:
Peter Maydell 2018-02-18 22:50:16 -05:00 committed by Lioncash
parent 9826fc4414
commit f4ae64e78a
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7

View file

@ -738,7 +738,11 @@ void HELPER(exception_return)(CPUARMState *env)
}
aarch64_sync_64_to_32(env);
env->regs[15] = env->elr_el[cur_el] & ~0x1;
if (spsr & CPSR_T) {
env->regs[15] = env->elr_el[cur_el] & ~0x1;
} else {
env->regs[15] = env->elr_el[cur_el] & ~0x3;
}
} else {
env->aarch64 = 1;
pstate_write(env, spsr);