From 4051e12c5df1c46b542b28ed43f1614a42245ecf Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Tue, 19 Aug 2014 18:56:26 +0100 Subject: target-arm: Don't allow AArch32 to access RES0 CPSR bits The CPSR has a new-in-v8 execution state bit (IL), and also some state which has effects in AArch32 but appears only in the SPSR format (SS) but is RES0 in the CPSR. Add the IL bit to CPSR_EXEC, and enforce that guest direct reads and writes to CPSR can't read or write the RES0 bits, so the guest can't get at the SS bit which we store in uncached_cpsr. This includes not permitting exception returns to copy reserved bits from an SPSR into CPSR. Signed-off-by: Peter Maydell Reviewed-by: Edgar E. Iglesias --- target-arm/op_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'target-arm/op_helper.c') diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c index 25ad902e04..180a4a096b 100644 --- a/target-arm/op_helper.c +++ b/target-arm/op_helper.c @@ -258,7 +258,7 @@ void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp, uint32_t HELPER(cpsr_read)(CPUARMState *env) { - return cpsr_read(env) & ~CPSR_EXEC; + return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED); } void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask) -- cgit 1.4.1