Commit acf8f311a8 for qemu.org

commit acf8f311a8622b4b11753c5ef8889f7616f5927e
Author: Richard Henderson <richard.henderson@linaro.org>
Date:   Fri Sep 25 14:50:03 2026 -0700

    target/arm: Honor PSTATE.UINJ during translation

    Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Message-id: 20260925215004.456336-14-richard.henderson@linaro.org
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 7f858654c4..5d5b11e2da 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -11174,7 +11174,7 @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     s->fp_access_checked = 0;
     s->sve_access_checked = 0;

-    if (check_il(s)) {
+    if (check_il_uinj(s)) {
         return;
     }

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index fbacc3b757..6983153ffc 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -1164,12 +1164,16 @@ void unallocated_encoding(DisasContext *s)
  * must be checked after reading the instruction.  They have more priority
  * than the AArch64 BTI exception.
  */
-bool check_il(DisasContext *s)
+bool check_il_uinj(DisasContext *s)
 {
     if (s->pstate_il) {
         gen_exception_insn(s, 0, EXCP_UDEF, syn_illegalstate());
         return true;
     }
+    if (s->pstate_uinj) {
+        unallocated_encoding(s);
+        return true;
+    }
     return false;
 }

@@ -6167,7 +6171,7 @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         return;
     }

-    if (check_il(s)) {
+    if (check_il_uinj(s)) {
         return;
     }

@@ -6737,7 +6741,7 @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     dc->base.pc_next = pc;
     dc->insn = insn;

-    if (check_il(dc)) {
+    if (check_il_uinj(dc)) {
         return;
     }

diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index 7eba9b764c..57e45ea872 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -382,7 +382,7 @@ void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
 void arm_gen_test_cc(int cc, TCGLabel *label);
 MemOp pow2_align(unsigned i);
 void unallocated_encoding(DisasContext *s);
-bool check_il(DisasContext *s);
+bool check_il_uinj(DisasContext *s);
 void gen_exception_internal(int excp);
 void gen_exception_insn_el(DisasContext *s, int64_t pc_diff, int excp,
                            uint32_t syn, uint32_t target_el);