target-arm: Correctly handle 'sub pc, pc, 1' for ARMv6

In the ARM v6 architecture, 'sub pc, pc, 1' is not an interworking
branch, so the computed new value is written to r15 as a normal
value. The architecture says that in this case, bits [1:0] of
the value written must be ignored if we are in ARM mode (or
bit [0] ignored if in Thumb mode); this is a change from the
ARMv4/v5 specification that behaviour is UNPREDICTABLE.
Use the correct mask on the PC value when doing a non-interworking
store to PC.

A popular library used on RaspberryPi uses this instruction
as part of a trick to determine whether it is running on
ARMv6 or ARMv7, and we were mishandling the sequence.

Fixes bug: https://bugs.launchpad.net/bugs/1625295

Reported-by: <stu.axon@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1474380941-4730-1-git-send-email-peter.maydell@linaro.org
1 file changed
tree: 764d96006cedc488328f6c346115d4e2e423bd0e
  1. audio/
  2. backends/
  3. block/
  4. bsd-user/
  5. contrib/
  6. crypto/
  7. default-configs/
  8. disas/
  9. docs/
  10. fpu/
  11. fsdev/
  12. gdb-xml/
  13. hw/
  14. include/
  15. io/
  16. libdecnumber/
  17. linux-headers/
  18. linux-user/
  19. migration/
  20. nbd/
  21. net/
  22. pc-bios/
  23. po/
  24. qapi/
  25. qga/
  26. qobject/
  27. qom/
  28. replay/
  29. roms/
  30. scripts/
  31. slirp/
  32. stubs/
  33. target-alpha/
  34. target-arm/
  35. target-cris/
  36. target-i386/
  37. target-lm32/
  38. target-m68k/
  39. target-microblaze/
  40. target-mips/
  41. target-moxie/
  42. target-openrisc/
  43. target-ppc/
  44. target-s390x/
  45. target-sh4/
  46. target-sparc/
  47. target-tilegx/
  48. target-tricore/
  49. target-unicore32/
  50. target-xtensa/
  51. tcg/
  52. tests/
  53. trace/
  54. ui/
  55. util/
  56. .dir-locals.el
  57. .exrc
  58. .gitignore
  59. .gitmodules
  60. .mailmap
  61. .travis.yml
  62. accel.c
  63. aio-posix.c
  64. aio-win32.c
  65. arch_init.c
  66. async.c
  67. balloon.c
  68. block.c
  69. blockdev-nbd.c
  70. blockdev.c
  71. blockjob.c
  72. bootdevice.c
  73. bt-host.c
  74. bt-vhci.c
  75. Changelog
  76. CODING_STYLE
  77. configure
  78. COPYING
  79. COPYING.LIB
  80. cpu-exec-common.c
  81. cpu-exec.c
  82. cpus-common.c
  83. cpus.c
  84. cputlb.c
  85. device-hotplug.c
  86. device_tree.c
  87. disas.c
  88. dma-helpers.c
  89. dump.c
  90. exec.c
  91. gdbstub.c
  92. HACKING
  93. hmp-commands-info.hx
  94. hmp-commands.hx
  95. hmp.c
  96. hmp.h
  97. iohandler.c
  98. ioport.c
  99. iothread.c
  100. kvm-all.c
  101. kvm-stub.c
  102. LICENSE
  103. main-loop.c
  104. MAINTAINERS
  105. Makefile
  106. Makefile.objs
  107. Makefile.target
  108. memory.c
  109. memory_mapping.c
  110. module-common.c
  111. monitor.c
  112. numa.c
  113. os-posix.c
  114. os-win32.c
  115. page_cache.c
  116. qapi-schema.json
  117. qdev-monitor.c
  118. qdict-test-data.txt
  119. qemu-bridge-helper.c
  120. qemu-char.c
  121. qemu-doc.texi
  122. qemu-ga.texi
  123. qemu-img-cmds.hx
  124. qemu-img.c
  125. qemu-img.texi
  126. qemu-io-cmds.c
  127. qemu-io.c
  128. qemu-nbd.c
  129. qemu-nbd.texi
  130. qemu-option-trace.texi
  131. qemu-options-wrapper.h
  132. qemu-options.h
  133. qemu-options.hx
  134. qemu-seccomp.c
  135. qemu-tech.texi
  136. qemu-timer.c
  137. qemu.nsi
  138. qemu.sasl
  139. qmp.c
  140. qtest.c
  141. README
  142. replication.c
  143. replication.h
  144. rules.mak
  145. softmmu_template.h
  146. spice-qemu-char.c
  147. tcg-runtime.c
  148. tci.c
  149. thread-pool.c
  150. thunk.c
  151. tpm.c
  152. trace-events
  153. translate-all.c
  154. translate-all.h
  155. translate-common.c
  156. user-exec.c
  157. VERSION
  158. version.rc
  159. vl.c
  160. xen-common-stub.c
  161. xen-common.c
  162. xen-hvm-stub.c
  163. xen-hvm.c
  164. xen-mapcache.c