In v8M the MSR and MRS instructions have extra register value

encodings to allow secure code to access the non-secure banked

version of various special registers.

(We don't implement the MSPLIM_NS or PSPLIM_NS aliases, because

we don't currently implement the stack limit registers at all.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505240046-11454-2-git-send-email-peter.maydell@linaro.org

---

target/arm/helper.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 110 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

break;

case 20: /* CONTROL */

return env->v7m.control[env->v7m.secure];

+ case 0x94: /* CONTROL_NS */

+ /* We have to handle this here because unprivileged Secure code

+ * can read the NS CONTROL register.

+ */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.control[M_REG_NS];

}

if (el == 0) {

return 0; /* unprivileged reads others as zero */

}

+ if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {

+ switch (reg) {

+ case 0x88: /* MSP_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.other_ss_msp;

+ case 0x89: /* PSP_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.other_ss_psp;

+ case 0x90: /* PRIMASK_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.primask[M_REG_NS];

+ case 0x91: /* BASEPRI_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.basepri[M_REG_NS];

+ case 0x93: /* FAULTMASK_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.faultmask[M_REG_NS];

+ case 0x98: /* SP_NS */

+ {

+ /* This gives the non-secure SP selected based on whether we're

+ * currently in handler mode or not, using the NS CONTROL.SPSEL.

+ */

+ bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;

+

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ if (!arm_v7m_is_handler_mode(env) && spsel) {

+ return env->v7m.other_ss_psp;

+ } else {

+ return env->v7m.other_ss_msp;

+ }

+ }

+ default:

+ break;

+ }

+ }

+

switch (reg) {

case 8: /* MSP */

return (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) ?

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)

return;

}

+ if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {

+ switch (reg) {

+ case 0x88: /* MSP_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.other_ss_msp = val;

+ return;

+ case 0x89: /* PSP_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.other_ss_psp = val;

+ return;

+ case 0x90: /* PRIMASK_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.primask[M_REG_NS] = val & 1;

+ return;

+ case 0x91: /* BASEPRI_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.basepri[M_REG_NS] = val & 0xff;

+ return;

+ case 0x93: /* FAULTMASK_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.faultmask[M_REG_NS] = val & 1;

+ return;

+ case 0x98: /* SP_NS */

+ {

+ /* This gives the non-secure SP selected based on whether we're

+ * currently in handler mode or not, using the NS CONTROL.SPSEL.

+ */

+ bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;

+

+ if (!env->v7m.secure) {

+ return;

+ }

+ if (!arm_v7m_is_handler_mode(env) && spsel) {

+ env->v7m.other_ss_psp = val;

+ } else {

+ env->v7m.other_ss_msp = val;

+ }

+ return;

+ }

+ default:

+ break;

+ }

+ }

+

switch (reg) {

case 0 ... 7: /* xPSR sub-fields */

/* only APSR is actually writable */

--

2.7.4

For the v8M security extension, some exceptions must be banked

between security states. Add the new vecinfo array which holds

the state for the banked exceptions and migrate it if the

CPU the NVIC is attached to implements the security extension.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

include/hw/intc/armv7m_nvic.h | 14 ++++++++++++

hw/intc/armv7m_nvic.c | 53 ++++++++++++++++++++++++++++++++++++++++++-

2 files changed, 66 insertions(+), 1 deletion(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/intc/armv7m_nvic.h

+++ b/include/hw/intc/armv7m_nvic.h

@@ -XXX,XX +XXX,XX @@

/* Highest permitted number of exceptions (architectural limit) */

#define NVIC_MAX_VECTORS 512

+/* Number of internal exceptions */

+#define NVIC_INTERNAL_VECTORS 16

typedef struct VecInfo {

/* Exception priorities can range from -3 to 255; only the unmodifiable

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

ARMCPU *cpu;

VecInfo vectors[NVIC_MAX_VECTORS];

+ /* If the v8M security extension is implemented, some of the internal

+ * exceptions are banked between security states (ie there exists both

+ * a Secure and a NonSecure version of the exception and its state):

+ * HardFault, MemManage, UsageFault, SVCall, PendSV, SysTick (R_PJHV)

+ * The rest (including all the external exceptions) are not banked, though

+ * they may be configurable to target either Secure or NonSecure state.

+ * We store the secure exception state in sec_vectors[] for the banked

+ * exceptions, and otherwise use only vectors[] (including for exceptions

+ * like SecureFault that unconditionally target Secure state).

+ * Entries in sec_vectors[] for non-banked exception numbers are unused.

+ */

+ VecInfo sec_vectors[NVIC_INTERNAL_VECTORS];

uint32_t prigroup;

/* vectpending and exception_prio are both cached state that can

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@

* For historical reasons QEMU tends to use "interrupt" and

* "exception" more or less interchangeably.

*/

-#define NVIC_FIRST_IRQ 16

+#define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS

#define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)

/* Effective running priority of the CPU when no exception is active

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_VecInfo = {

}

};

+static bool nvic_security_needed(void *opaque)

+{

+ NVICState *s = opaque;

+

+ return arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);

+}

+

+static int nvic_security_post_load(void *opaque, int version_id)

+{

+ NVICState *s = opaque;

+ int i;

+

+ /* Check for out of range priority settings */

+ if (s->sec_vectors[ARMV7M_EXCP_HARD].prio != -1) {

+ return 1;

+ }

+ for (i = ARMV7M_EXCP_MEM; i < ARRAY_SIZE(s->sec_vectors); i++) {

+ if (s->sec_vectors[i].prio & ~0xff) {

+ return 1;

+ }

+ }

+ return 0;

+}

+

+static const VMStateDescription vmstate_nvic_security = {

+ .name = "nvic/m-security",

+ .version_id = 1,

+ .minimum_version_id = 1,

+ .needed = nvic_security_needed,

+ .post_load = &nvic_security_post_load,

+ .fields = (VMStateField[]) {

+ VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,

+ vmstate_VecInfo, VecInfo),

+ VMSTATE_END_OF_LIST()

+ }

+};

+

static const VMStateDescription vmstate_nvic = {

.name = "armv7m_nvic",

.version_id = 4,

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nvic = {

vmstate_VecInfo, VecInfo),

VMSTATE_UINT32(prigroup, NVICState),

VMSTATE_END_OF_LIST()

+ },

+ .subsections = (const VMStateDescription*[]) {

+ &vmstate_nvic_security,

+ NULL

}

};

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)

s->vectors[ARMV7M_EXCP_NMI].prio = -2;

s->vectors[ARMV7M_EXCP_HARD].prio = -1;

+ if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {

+ s->sec_vectors[ARMV7M_EXCP_HARD].enabled = 1;

+ s->sec_vectors[ARMV7M_EXCP_SVC].enabled = 1;

+ s->sec_vectors[ARMV7M_EXCP_PENDSV].enabled = 1;

+ s->sec_vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;

+

+ /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */

+ s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;

+ }

+

/* Strictly speaking the reset handler should be enabled.

* However, we don't simulate soft resets through the NVIC,

* and the reset vector should never be pended.

--

2.7.4

With banked exceptions, just the exception number in

s->vectpending is no longer sufficient to uniquely identify

the pending exception. Add a vectpending_is_s_banked bool

which is true if the exception is using the sec_vectors[]

array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 1505240046-11454-4-git-send-email-peter.maydell@linaro.org

---

include/hw/intc/armv7m_nvic.h | 11 +++++++++--

hw/intc/armv7m_nvic.c | 1 +

2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/intc/armv7m_nvic.h

+++ b/include/hw/intc/armv7m_nvic.h

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

VecInfo sec_vectors[NVIC_INTERNAL_VECTORS];

uint32_t prigroup;

- /* vectpending and exception_prio are both cached state that can

- * be recalculated from the vectors[] array and the prigroup field.

+ /* The following fields are all cached state that can be recalculated

+ * from the vectors[] and sec_vectors[] arrays and the prigroup field:

+ * - vectpending

+ * - vectpending_is_secure

+ * - exception_prio

*/

unsigned int vectpending; /* highest prio pending enabled exception */

+ /* true if vectpending is a banked secure exception, ie it is in

+ * sec_vectors[] rather than vectors[]

+ */

+ bool vectpending_is_s_banked;

int exception_prio; /* group prio of the highest prio active exception */

MemoryRegion sysregmem;

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)

s->exception_prio = NVIC_NOEXC_PRIO;

s->vectpending = 0;

+ s->vectpending_is_s_banked = false;

}

static void nvic_systick_trigger(void *opaque, int n, int level)

--

2.7.4

Instead of looking up the pending priority

in nvic_pending_prio(), cache it in a new state struct

field. The calculation of the pending priority given

the interrupt number is more complicated in v8M with

the security extension, so the caching will be worthwhile.

This changes nvic_pending_prio() from returning a full

(group + subpriority) priority value to returning a group

priority. This doesn't require changes to its callsites

because we use it only in comparisons of the form

execution_prio > nvic_pending_prio()

and execution priority is always a group priority, so

a test (exec prio > full prio) is true if and only if

(execprio > group_prio).

(Architecturally the expected comparison is with the

group priority for this sort of "would we preempt" test;

we were only doing a test with a full priority as an

optimisation to avoid the mask, which is possible

precisely because the two comparisons always give the

same answer.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505240046-11454-5-git-send-email-peter.maydell@linaro.org

---

include/hw/intc/armv7m_nvic.h | 2 ++

hw/intc/armv7m_nvic.c | 23 +++++++++++++----------

hw/intc/trace-events | 2 +-

3 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/intc/armv7m_nvic.h

+++ b/include/hw/intc/armv7m_nvic.h

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

* - vectpending

* - vectpending_is_secure

* - exception_prio

+ * - vectpending_prio

*/

unsigned int vectpending; /* highest prio pending enabled exception */

/* true if vectpending is a banked secure exception, ie it is in

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

*/

bool vectpending_is_s_banked;

int exception_prio; /* group prio of the highest prio active exception */

+ int vectpending_prio; /* group prio of the exeception in vectpending */

MemoryRegion sysregmem;

MemoryRegion sysreg_ns_mem;

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = {

static int nvic_pending_prio(NVICState *s)

{

- /* return the priority of the current pending interrupt,

+ /* return the group priority of the current pending interrupt,

* or NVIC_NOEXC_PRIO if no interrupt is pending

*/

- return s->vectpending ? s->vectors[s->vectpending].prio : NVIC_NOEXC_PRIO;

+ return s->vectpending_prio;

}

/* Return the value of the ISCR RETTOBASE bit:

@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)

active_prio &= nvic_gprio_mask(s);

}

+ if (pend_prio > 0) {

+ pend_prio &= nvic_gprio_mask(s);

+ }

+

s->vectpending = pend_irq;

+ s->vectpending_prio = pend_prio;

s->exception_prio = active_prio;

- trace_nvic_recompute_state(s->vectpending, s->exception_prio);

+ trace_nvic_recompute_state(s->vectpending,

+ s->vectpending_prio,

+ s->exception_prio);

}

/* Return the current execution priority of the CPU

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)

CPUARMState *env = &s->cpu->env;

const int pending = s->vectpending;

const int running = nvic_exec_prio(s);

- int pendgroupprio;

VecInfo *vec;

assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)

assert(vec->enabled);

assert(vec->pending);

- pendgroupprio = vec->prio;

- if (pendgroupprio > 0) {

- pendgroupprio &= nvic_gprio_mask(s);

- }

- assert(pendgroupprio < running);

+ assert(s->vectpending_prio < running);

- trace_nvic_acknowledge_irq(pending, vec->prio);

+ trace_nvic_acknowledge_irq(pending, s->vectpending_prio);

vec->active = 1;

vec->pending = 0;

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)

s->exception_prio = NVIC_NOEXC_PRIO;

s->vectpending = 0;

s->vectpending_is_s_banked = false;

+ s->vectpending_prio = NVIC_NOEXC_PRIO;

}

static void nvic_systick_trigger(void *opaque, int n, int level)

diff --git a/hw/intc/trace-events b/hw/intc/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/trace-events

+++ b/hw/intc/trace-events

@@ -XXX,XX +XXX,XX @@ gicv3_redist_set_irq(uint32_t cpu, int irq, int level) "GICv3 redistributor 0x%x

gicv3_redist_send_sgi(uint32_t cpu, int irq) "GICv3 redistributor 0x%x pending SGI %d"

# hw/intc/armv7m_nvic.c

-nvic_recompute_state(int vectpending, int exception_prio) "NVIC state recomputed: vectpending %d exception_prio %d"

+nvic_recompute_state(int vectpending, int vectpending_prio, int exception_prio) "NVIC state recomputed: vectpending %d vectpending_prio %d exception_prio %d"

nvic_set_prio(int irq, uint8_t prio) "NVIC set irq %d priority %d"

nvic_irq_update(int vectpending, int pendprio, int exception_prio, int level) "NVIC vectpending %d pending prio %d exception_prio %d: setting irq line to %d"

nvic_escalate_prio(int irq, int irqprio, int runprio) "NVIC escalating irq %d to HardFault: insufficient priority %d >= %d"

--

2.7.4