| Message ID | 1433861440-30133-1-git-send-email-peter.maydell@linaro.org |
|---|---|
| State | Superseded |
| Headers | show |
diff --git a/target-arm/translate.c b/target-arm/translate.c index 39692d7..239322d 100644 --- a/target-arm/translate.c +++ b/target-arm/translate.c @@ -7175,7 +7175,7 @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn) break; } - gen_set_pc_im(s, s->pc); + gen_set_pc_im(s, s->pc - 4); tmpptr = tcg_const_ptr(ri); tcg_syn = tcg_const_i32(syndrome); gen_helper_access_check_cp_reg(cpu_env, tmpptr, tcg_syn);
The architecture defines that when taking an exception trying to access a coprocessor register, the "preferred return address" for the exception is the address of the instruction that caused the exception. Correct an off-by-4 error which meant we were returning the address after the instruction for traps which happened because of a failure of a runtime access-check function on an AArch32 register. (Traps caused by translate-time checkable permissions failures had the correct address, as did traps on AArch64 registers.) This fixes https://bugs.launchpad.net/qemu/+bug/1463338 Reported-by: Robert Buhren <robert@robertbuhren.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target-arm/translate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)