For the arm926 CPU we reset the SCTLR to 0x00090078.  This is not the
value specified in the ARM926EJ-S TRM (ARM DDI 0198E), which states
that bits 16 and 18 are SBO, bit 17 is SBZ, and bits [31:19] are SBZ.
It's also not the value seen on real hardware.

Similarly, for the arm1026 we use the same SCTLR reset value but
the TRM says that bits 18 and 16 are the SBO ones.

This has been wrong in QEMU since 2007 when we first started actively
resetting the SCTLR to some fixed value rather than zero.

This wrong value didn't affect any of QEMU's behaviour, because we
don't implement any handling of the old pre-v6 meanings of these bits
(which were IMPDEF), and their v8 reuse is guarded by appropriate
version checks.

Correct the reset values to 0x00050078 (i.e set bit 18 and not 19).

Cc: qemu-stable@nongnu.org
Fixes: 610c3c8afd99f4f11 ("Reset ARM cp15.c1_sys to default values. Fix XScale cp15 accesses.")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4202
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
v2: fix arm1026 as well, since RTH found its TRM
---
 target/arm/tcg/cpu32.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index 8220d785f5b..c49265e673c 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -33,7 +33,7 @@ static void arm926_initfn(Object *obj)
     cpu->midr = 0x41069265;
     cpu->reset_fpsid = 0x41011090;
     cpu->ctr = 0x1dd20d2;
-    cpu->reset_sctlr = 0x00090078;
+    cpu->reset_sctlr = 0x00050078;
 
     /*
      * ARMv5 does not have the ID_ISAR registers, but we can still
@@ -74,7 +74,7 @@ static void arm1026_initfn(Object *obj)
     cpu->midr = 0x4106a262;
     cpu->reset_fpsid = 0x410110a0;
     cpu->ctr = 0x1dd20d2;
-    cpu->reset_sctlr = 0x00090078;
+    cpu->reset_sctlr = 0x00050078;
     cpu->reset_auxcr = 1;
 
     /*
-- 
2.43.0

On 8/21/26 04:41, Peter Maydell wrote:
> For the arm926 CPU we reset the SCTLR to 0x00090078.  This is not the
> value specified in the ARM926EJ-S TRM (ARM DDI 0198E), which states
> that bits 16 and 18 are SBO, bit 17 is SBZ, and bits [31:19] are SBZ.
> It's also not the value seen on real hardware.
> 
> Similarly, for the arm1026 we use the same SCTLR reset value but
> the TRM says that bits 18 and 16 are the SBO ones.
> 
> This has been wrong in QEMU since 2007 when we first started actively
> resetting the SCTLR to some fixed value rather than zero.
> 
> This wrong value didn't affect any of QEMU's behaviour, because we
> don't implement any handling of the old pre-v6 meanings of these bits
> (which were IMPDEF), and their v8 reuse is guarded by appropriate
> version checks.
> 
> Correct the reset values to 0x00050078 (i.e set bit 18 and not 19).
> 
> Cc:qemu-stable@nongnu.org
> Fixes: 610c3c8afd99f4f11 ("Reset ARM cp15.c1_sys to default values. Fix XScale cp15 accesses.")
> Resolves:https://gitlab.com/qemu-project/qemu/-/work_items/4202
> Signed-off-by: Peter Maydell<peter.maydell@linaro.org>
> ---
> v2: fix arm1026 as well, since RTH found its TRM
> ---
>   target/arm/tcg/cpu32.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~