In order to support derived exceptions (exceptions generated in

the course of trying to take an exception), we need to be able

to handle prioritizing whether to take the original exception

or the derived exception.

We do this by introducing a new function

armv7m_nvic_set_pending_derived() which the exception-taking code in

helper.c will call when a derived exception occurs. Derived

exceptions are dealt with mostly like normal pending exceptions, so

we share the implementation with the armv7m_nvic_set_pending()

function.

Note that the way we structure this is significantly different

from the v8M Arm ARM pseudocode: that does all the prioritization

logic in the DerivedLateArrival() function, whereas we choose to

let the existing "identify highest priority exception" logic

do the prioritization for us. The effect is the same, though.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1517324542-6607-2-git-send-email-peter.maydell@linaro.org

---

target/arm/cpu.h | 13 ++++++++++

hw/intc/armv7m_nvic.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++++--

hw/intc/trace-events | 2 +-

3 files changed, 80 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)

* of architecturally banked exceptions.

*/

void armv7m_nvic_set_pending(void *opaque, int irq, bool secure);

+/**

+ * armv7m_nvic_set_pending_derived: mark this derived exception as pending

+ * @opaque: the NVIC

+ * @irq: the exception number to mark pending

+ * @secure: false for non-banked exceptions or for the nonsecure

+ * version of a banked exception, true for the secure version of a banked

+ * exception.

+ *

+ * Similar to armv7m_nvic_set_pending(), but specifically for derived

+ * exceptions (exceptions generated in the course of trying to take

+ * a different exception).

+ */

+void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure);

/**

* armv7m_nvic_acknowledge_irq: make highest priority pending exception active

* @opaque: the NVIC

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)

}

}

-void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)

+static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,

+ bool derived)

{

+ /* Pend an exception, including possibly escalating it to HardFault.

+ *

+ * This function handles both "normal" pending of interrupts and

+ * exceptions, and also derived exceptions (ones which occur as

+ * a result of trying to take some other exception).

+ *

+ * If derived == true, the caller guarantees that we are part way through

+ * trying to take an exception (but have not yet called

+ * armv7m_nvic_acknowledge_irq() to make it active), and so:

+ * - s->vectpending is the "original exception" we were trying to take

+ * - irq is the "derived exception"

+ * - nvic_exec_prio(s) gives the priority before exception entry

+ * Here we handle the prioritization logic which the pseudocode puts

+ * in the DerivedLateArrival() function.

+ */

+

NVICState *s = (NVICState *)opaque;

bool banked = exc_is_banked(irq);

VecInfo *vec;

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)

vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];

- trace_nvic_set_pending(irq, secure, vec->enabled, vec->prio);

+ trace_nvic_set_pending(irq, secure, derived, vec->enabled, vec->prio);

+

+ if (derived) {

+ /* Derived exceptions are always synchronous. */

+ assert(irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV);

+

+ if (irq == ARMV7M_EXCP_DEBUG &&

+ exc_group_prio(s, vec->prio, secure) >= nvic_exec_prio(s)) {

+ /* DebugMonitorFault, but its priority is lower than the

+ * preempted exception priority: just ignore it.

+ */

+ return;

+ }

+

+ if (irq == ARMV7M_EXCP_HARD && vec->prio >= s->vectpending_prio) {

+ /* If this is a terminal exception (one which means we cannot

+ * take the original exception, like a failure to read its

+ * vector table entry), then we must take the derived exception.

+ * If the derived exception can't take priority over the

+ * original exception, then we go into Lockup.

+ *

+ * For QEMU, we rely on the fact that a derived exception is

+ * terminal if and only if it's reported to us as HardFault,

+ * which saves having to have an extra argument is_terminal

+ * that we'd only use in one place.

+ */

+ cpu_abort(&s->cpu->parent_obj,

+ "Lockup: can't take terminal derived exception "

+ "(original exception priority %d)\n",

+ s->vectpending_prio);

+ }

+ /* We now continue with the same code as for a normal pending

+ * exception, which will cause us to pend the derived exception.

+ * We'll then take either the original or the derived exception

+ * based on which is higher priority by the usual mechanism

+ * for selecting the highest priority pending interrupt.

+ */

+ }

if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {

/* If a synchronous exception is pending then it may be

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)

}

}

+void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)

+{

+ do_armv7m_nvic_set_pending(opaque, irq, secure, false);

+}

+

+void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure)

+{

+ do_armv7m_nvic_set_pending(opaque, irq, secure, true);

+}

+

/* Make pending IRQ active. */

bool armv7m_nvic_acknowledge_irq(void *opaque)

{

diff --git a/hw/intc/trace-events b/hw/intc/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/trace-events

+++ b/hw/intc/trace-events

@@ -XXX,XX +XXX,XX @@ nvic_set_prio(int irq, bool secure, uint8_t prio) "NVIC set irq %d secure-bank %

nvic_irq_update(int vectpending, int pendprio, int exception_prio, int level) "NVIC vectpending %d pending prio %d exception_prio %d: setting irq line to %d"

nvic_escalate_prio(int irq, int irqprio, int runprio) "NVIC escalating irq %d to HardFault: insufficient priority %d >= %d"

nvic_escalate_disabled(int irq) "NVIC escalating irq %d to HardFault: disabled"

-nvic_set_pending(int irq, bool secure, int en, int prio) "NVIC set pending irq %d secure-bank %d (enabled: %d priority %d)"

+nvic_set_pending(int irq, bool secure, bool derived, int en, int prio) "NVIC set pending irq %d secure-bank %d derived %d (enabled: %d priority %d)"

nvic_clear_pending(int irq, bool secure, int en, int prio) "NVIC clear pending irq %d secure-bank %d (enabled: %d priority %d)"

nvic_set_pending_level(int irq) "NVIC set pending: irq %d higher prio than vectpending: setting irq line to 1"

nvic_acknowledge_irq(int irq, int prio, bool targets_secure) "NVIC acknowledge IRQ: %d now active (prio %d targets_secure %d)"

--

2.16.1

In the v8M architecture, if the process of taking an exception

results in a further exception this is called a derived exception

(for example, an MPU exception when writing the exception frame to

memory). If the derived exception happens while pushing the initial

stack frame, we must ignore any subsequent possible exception

pushing the callee-saves registers.

In preparation for making the stack writes check for exceptions,

add a return value from v7m_push_stack() and a new parameter to

v7m_exception_taken(), so that the former can tell the latter that

it needs to ignore failures to write to the stack. We also plumb

the argument through to v7m_push_callee_stack(), which is where

the code to ignore the failures will be.

(Note that the v8M ARM pseudocode structures this slightly differently:

derived exceptions cause the attempt to process the original

exception to be abandoned; then at the top level it calls

DerivedLateArrival to prioritize the derived exception and call

TakeException from there. We choose to let the NVIC do the prioritization

and continue forward with a call to TakeException which will then

take either the original or the derived exception. The effect is

the same, but this structure works better for QEMU because we don't

have a convenient top level place to do the abandon-and-retry logic.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1517324542-6607-4-git-send-email-peter.maydell@linaro.org

---

target/arm/helper.c | 35 +++++++++++++++++++++++------------

1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static uint32_t arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure)

return addr;

}

-static void v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain)

+static void v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,

+ bool ignore_faults)

{

/* For v8M, push the callee-saves register part of the stack frame.

* Compare the v8M pseudocode PushCalleeStack().

@@ -XXX,XX +XXX,XX @@ static void v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain)

*frame_sp_p = frameptr;

}

-static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)

+static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,

+ bool ignore_stackfaults)

{

/* Do the "take the exception" parts of exception entry,

* but not the pushing of state to the stack. This is

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)

*/

if (lr & R_V7M_EXCRET_DCRS_MASK &&

!(dotailchain && (lr & R_V7M_EXCRET_ES_MASK))) {

- v7m_push_callee_stack(cpu, lr, dotailchain);

+ v7m_push_callee_stack(cpu, lr, dotailchain,

+ ignore_stackfaults);

}

lr |= R_V7M_EXCRET_DCRS_MASK;

}

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)

env->thumb = addr & 1;

}

-static void v7m_push_stack(ARMCPU *cpu)

+static bool v7m_push_stack(ARMCPU *cpu)

{

/* Do the "set up stack frame" part of exception entry,

* similar to pseudocode PushStack().

+ * Return true if we generate a derived exception (and so

+ * should ignore further stack faults trying to process

+ * that derived exception.)

*/

CPUARMState *env = &cpu->env;

uint32_t xpsr = xpsr_read(env);

@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)

v7m_push(env, env->regs[2]);

v7m_push(env, env->regs[1]);

v7m_push(env, env->regs[0]);

+

+ return false;

}

static void do_v7m_exception_exit(ARMCPU *cpu)

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

if (sfault) {

env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);

- v7m_exception_taken(cpu, excret, true);

+ v7m_exception_taken(cpu, excret, true, false);

qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "

"stackframe: failed EXC_RETURN.ES validity check\n");

return;

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

*/

env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);

- v7m_exception_taken(cpu, excret, true);

+ v7m_exception_taken(cpu, excret, true, false);

qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "

"stackframe: failed exception return integrity check\n");

return;

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

/* Take a SecureFault on the current stack */

env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);

- v7m_exception_taken(cpu, excret, true);

+ v7m_exception_taken(cpu, excret, true, false);

qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "

"stackframe: failed exception return integrity "

"signature check\n");

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,

env->v7m.secure);

env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;

- v7m_exception_taken(cpu, excret, true);

+ v7m_exception_taken(cpu, excret, true, false);

qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "

"stackframe: failed exception return integrity "

"check\n");

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

/* Take an INVPC UsageFault by pushing the stack again;

* we know we're v7M so this is never a Secure UsageFault.

*/

+ bool ignore_stackfaults;

+

assert(!arm_feature(env, ARM_FEATURE_V8));

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);

env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;

- v7m_push_stack(cpu);

- v7m_exception_taken(cpu, excret, false);

+ ignore_stackfaults = v7m_push_stack(cpu);

+ v7m_exception_taken(cpu, excret, false, ignore_stackfaults);

qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "

"failed exception return integrity check\n");

return;

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

ARMCPU *cpu = ARM_CPU(cs);

CPUARMState *env = &cpu->env;

uint32_t lr;

+ bool ignore_stackfaults;

arm_log_exception(cs->exception_index);

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

lr |= R_V7M_EXCRET_MODE_MASK;

}

- v7m_push_stack(cpu);

- v7m_exception_taken(cpu, lr, false);

+ ignore_stackfaults = v7m_push_stack(cpu);

+ v7m_exception_taken(cpu, lr, false, ignore_stackfaults);

qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception);

}

--

2.16.1

The memory writes done to push registers on the stack

on exception entry in M profile CPUs are supposed to

go via MPU permissions checks, which may cause us to

take a derived exception instead of the original one of

the MPU lookup fails. We were implementing these as

always-succeeds direct writes to physical memory.

Rewrite v7m_push_stack() to do the necessary checks.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1517324542-6607-5-git-send-email-peter.maydell@linaro.org

---

target/arm/helper.c | 103 ++++++++++++++++++++++++++++++++++++++++++++--------

1 file changed, 87 insertions(+), 16 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,

return target_el;

}

-static void v7m_push(CPUARMState *env, uint32_t val)

+static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,

+ ARMMMUIdx mmu_idx, bool ignfault)

{

- CPUState *cs = CPU(arm_env_get_cpu(env));

+ CPUState *cs = CPU(cpu);

+ CPUARMState *env = &cpu->env;

+ MemTxAttrs attrs = {};

+ MemTxResult txres;

+ target_ulong page_size;

+ hwaddr physaddr;

+ int prot;

+ ARMMMUFaultInfo fi;

+ bool secure = mmu_idx & ARM_MMU_IDX_M_S;

+ int exc;

+ bool exc_secure;

- env->regs[13] -= 4;

- stl_phys(cs->as, env->regs[13], val);

+ if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr,

+ &attrs, &prot, &page_size, &fi, NULL)) {

+ /* MPU/SAU lookup failed */

+ if (fi.type == ARMFault_QEMU_SFault) {

+ qemu_log_mask(CPU_LOG_INT,

+ "...SecureFault with SFSR.AUVIOL during stacking\n");

+ env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;

+ env->v7m.sfar = addr;

+ exc = ARMV7M_EXCP_SECURE;

+ exc_secure = false;

+ } else {

+ qemu_log_mask(CPU_LOG_INT, "...MemManageFault with CFSR.MSTKERR\n");

+ env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK;

+ exc = ARMV7M_EXCP_MEM;

+ exc_secure = secure;

+ }

+ goto pend_fault;

+ }

+ address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value,

+ attrs, &txres);

+ if (txres != MEMTX_OK) {

+ /* BusFault trying to write the data */

+ qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n");

+ env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK;

+ exc = ARMV7M_EXCP_BUS;

+ exc_secure = false;

+ goto pend_fault;

+ }

+ return true;

+

+pend_fault:

+ /* By pending the exception at this point we are making

+ * the IMPDEF choice "overridden exceptions pended" (see the

+ * MergeExcInfo() pseudocode). The other choice would be to not

+ * pend them now and then make a choice about which to throw away

+ * later if we have two derived exceptions.

+ * The only case when we must not pend the exception but instead

+ * throw it away is if we are doing the push of the callee registers

+ * and we've already generated a derived exception. Even in this

+ * case we will still update the fault status registers.

+ */

+ if (!ignfault) {

+ armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure);

+ }

+ return false;

}

/* Return true if we're using the process stack pointer (not the MSP) */

@@ -XXX,XX +XXX,XX @@ static bool v7m_push_stack(ARMCPU *cpu)

* should ignore further stack faults trying to process

* that derived exception.)

*/

+ bool stacked_ok;

CPUARMState *env = &cpu->env;

uint32_t xpsr = xpsr_read(env);

+ uint32_t frameptr = env->regs[13];

+ ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));

/* Align stack pointer if the guest wants that */

- if ((env->regs[13] & 4) &&

+ if ((frameptr & 4) &&

(env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) {

- env->regs[13] -= 4;

+ frameptr -= 4;

xpsr |= XPSR_SPREALIGN;

}

- /* Switch to the handler mode. */

- v7m_push(env, xpsr);

- v7m_push(env, env->regs[15]);

- v7m_push(env, env->regs[14]);

- v7m_push(env, env->regs[12]);

- v7m_push(env, env->regs[3]);

- v7m_push(env, env->regs[2]);

- v7m_push(env, env->regs[1]);

- v7m_push(env, env->regs[0]);

- return false;

+ frameptr -= 0x20;

+

+ /* Write as much of the stack frame as we can. If we fail a stack

+ * write this will result in a derived exception being pended

+ * (which may be taken in preference to the one we started with

+ * if it has higher priority).

+ */

+ stacked_ok =

+ v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, false) &&

+ v7m_stack_write(cpu, frameptr + 4, env->regs[1], mmu_idx, false) &&

+ v7m_stack_write(cpu, frameptr + 8, env->regs[2], mmu_idx, false) &&

+ v7m_stack_write(cpu, frameptr + 12, env->regs[3], mmu_idx, false) &&

+ v7m_stack_write(cpu, frameptr + 16, env->regs[12], mmu_idx, false) &&

+ v7m_stack_write(cpu, frameptr + 20, env->regs[14], mmu_idx, false) &&

+ v7m_stack_write(cpu, frameptr + 24, env->regs[15], mmu_idx, false) &&

+ v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, false);

+

+ /* Update SP regardless of whether any of the stack accesses failed.

+ * When we implement v8M stack limit checking then this attempt to

+ * update SP might also fail and result in a derived exception.

+ */

+ env->regs[13] = frameptr;

+

+ return !stacked_ok;

}

static void do_v7m_exception_exit(ARMCPU *cpu)

--

2.16.1

Make v7m_push_callee_stack() honour the MPU by using the

new v7m_stack_write() function. We return a flag to indicate

whether the pushes failed, which we can then use in

v7m_exception_taken() to cause us to handle the derived

exception correctly.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 1517324542-6607-6-git-send-email-peter.maydell@linaro.org

---

target/arm/helper.c | 64 ++++++++++++++++++++++++++++++++++++++++-------------

1 file changed, 49 insertions(+), 15 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static uint32_t arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure)

return addr;

}

-static void v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,

+static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,

bool ignore_faults)

{

/* For v8M, push the callee-saves register part of the stack frame.

@@ -XXX,XX +XXX,XX @@ static void v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,

* In the tailchaining case this may not be the current stack.

*/

CPUARMState *env = &cpu->env;

- CPUState *cs = CPU(cpu);

uint32_t *frame_sp_p;

uint32_t frameptr;

+ ARMMMUIdx mmu_idx;

+ bool stacked_ok;

if (dotailchain) {

- frame_sp_p = get_v7m_sp_ptr(env, true,

- lr & R_V7M_EXCRET_MODE_MASK,

+ bool mode = lr & R_V7M_EXCRET_MODE_MASK;

+ bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) ||

+ !mode;

+

+ mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);

+ frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,

lr & R_V7M_EXCRET_SPSEL_MASK);

} else {

+ mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));

frame_sp_p = &env->regs[13];

}

frameptr = *frame_sp_p - 0x28;

- stl_phys(cs->as, frameptr, 0xfefa125b);

- stl_phys(cs->as, frameptr + 0x8, env->regs[4]);

- stl_phys(cs->as, frameptr + 0xc, env->regs[5]);

- stl_phys(cs->as, frameptr + 0x10, env->regs[6]);

- stl_phys(cs->as, frameptr + 0x14, env->regs[7]);

- stl_phys(cs->as, frameptr + 0x18, env->regs[8]);

- stl_phys(cs->as, frameptr + 0x1c, env->regs[9]);

- stl_phys(cs->as, frameptr + 0x20, env->regs[10]);

- stl_phys(cs->as, frameptr + 0x24, env->regs[11]);

+ /* Write as much of the stack frame as we can. A write failure may

+ * cause us to pend a derived exception.

+ */

+ stacked_ok =

+ v7m_stack_write(cpu, frameptr, 0xfefa125b, mmu_idx, ignore_faults) &&

+ v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx,

+ ignore_faults) &&

+ v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx,

+ ignore_faults) &&

+ v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx,

+ ignore_faults) &&

+ v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx,

+ ignore_faults) &&

+ v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx,

+ ignore_faults) &&

+ v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx,

+ ignore_faults) &&

+ v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx,

+ ignore_faults) &&

+ v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx,

+ ignore_faults);

+ /* Update SP regardless of whether any of the stack accesses failed.

+ * When we implement v8M stack limit checking then this attempt to

+ * update SP might also fail and result in a derived exception.

+ */

*frame_sp_p = frameptr;

+

+ return !stacked_ok;

}

static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,

uint32_t addr;

bool targets_secure;

int exc;

+ bool push_failed = false;

armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,

*/

if (lr & R_V7M_EXCRET_DCRS_MASK &&

!(dotailchain && (lr & R_V7M_EXCRET_ES_MASK))) {

- v7m_push_callee_stack(cpu, lr, dotailchain,

- ignore_stackfaults);

+ push_failed = v7m_push_callee_stack(cpu, lr, dotailchain,

+ ignore_stackfaults);

}

lr |= R_V7M_EXCRET_DCRS_MASK;

}

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,

}

}

+ if (push_failed && !ignore_stackfaults) {

+ /* Derived exception on callee-saves register stacking:

+ * we might now want to take a different exception which

+ * targets a different security state, so try again from the top.

+ */

+ v7m_exception_taken(cpu, lr, true, true);

+ return;

+ }

+

addr = arm_v7m_load_vector(cpu, exc, targets_secure);

/* Now we've done everything that might cause a derived exception

--

2.16.1

Make the load of the exception vector from the vector table honour

the SAU and any bus error on the load (possibly provoking a derived

exception), rather than simply aborting if the load fails.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1517324542-6607-7-git-send-email-peter.maydell@linaro.org

---

target/arm/helper.c | 71 +++++++++++++++++++++++++++++++++++++++++------------

1 file changed, 55 insertions(+), 16 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,

}

}

-static uint32_t arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure)

+static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,

+ uint32_t *pvec)

{

CPUState *cs = CPU(cpu);

CPUARMState *env = &cpu->env;

MemTxResult result;

- hwaddr vec = env->v7m.vecbase[targets_secure] + exc * 4;

- uint32_t addr;

+ uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4;

+ uint32_t vector_entry;

+ MemTxAttrs attrs = {};

+ ARMMMUIdx mmu_idx;

+ bool exc_secure;

+

+ mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);

- addr = address_space_ldl(cs->as, vec,

- MEMTXATTRS_UNSPECIFIED, &result);

+ /* We don't do a get_phys_addr() here because the rules for vector

+ * loads are special: they always use the default memory map, and

+ * the default memory map permits reads from all addresses.

+ * Since there's no easy way to pass through to pmsav8_mpu_lookup()

+ * that we want this special case which would always say "yes",

+ * we just do the SAU lookup here followed by a direct physical load.

+ */

+ attrs.secure = targets_secure;

+ attrs.user = false;

+

+ if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {

+ V8M_SAttributes sattrs = {};

+

+ v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);

+ if (sattrs.ns) {

+ attrs.secure = false;

+ } else if (!targets_secure) {

+ /* NS access to S memory */

+ goto load_fail;

+ }

+ }

+

+ vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,

+ attrs, &result);

if (result != MEMTX_OK) {

- /* Architecturally this should cause a HardFault setting HSFR.VECTTBL,

- * which would then be immediately followed by our failing to load

- * the entry vector for that HardFault, which is a Lockup case.

- * Since we don't model Lockup, we just report this guest error

- * via cpu_abort().

- */

- cpu_abort(cs, "Failed to read from %s exception vector table "

- "entry %08x\n", targets_secure ? "secure" : "nonsecure",

- (unsigned)vec);

+ goto load_fail;

}

- return addr;

+ *pvec = vector_entry;

+ return true;

+

+load_fail:

+ /* All vector table fetch fails are reported as HardFault, with

+ * HFSR.VECTTBL and .FORCED set. (FORCED is set because

+ * technically the underlying exception is a MemManage or BusFault

+ * that is escalated to HardFault.) This is a terminal exception,

+ * so we will either take the HardFault immediately or else enter

+ * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).

+ */

+ exc_secure = targets_secure ||

+ !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);

+ env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;

+ armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);

+ return false;

}

static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,

return;

}

- addr = arm_v7m_load_vector(cpu, exc, targets_secure);

+ if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) {

+ /* Vector load failed: derived exception */

+ v7m_exception_taken(cpu, lr, true, true);

+ return;

+ }

/* Now we've done everything that might cause a derived exception

* we can go ahead and activate whichever exception we're going to

--

2.16.1

Handle possible MPU faults, SAU faults or bus errors when

popping register state off the stack during exception return.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1517324542-6607-8-git-send-email-peter.maydell@linaro.org

---

target/arm/helper.c | 115 ++++++++++++++++++++++++++++++++++++++++++----------

1 file changed, 94 insertions(+), 21 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ pend_fault:

return false;

}

+static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,

+ ARMMMUIdx mmu_idx)

+{

+ CPUState *cs = CPU(cpu);

+ CPUARMState *env = &cpu->env;

+ MemTxAttrs attrs = {};

+ MemTxResult txres;

+ target_ulong page_size;

+ hwaddr physaddr;

+ int prot;

+ ARMMMUFaultInfo fi;

+ bool secure = mmu_idx & ARM_MMU_IDX_M_S;

+ int exc;

+ bool exc_secure;

+ uint32_t value;

+

+ if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr,

+ &attrs, &prot, &page_size, &fi, NULL)) {

+ /* MPU/SAU lookup failed */

+ if (fi.type == ARMFault_QEMU_SFault) {

+ qemu_log_mask(CPU_LOG_INT,

+ "...SecureFault with SFSR.AUVIOL during unstack\n");

+ env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;

+ env->v7m.sfar = addr;

+ exc = ARMV7M_EXCP_SECURE;

+ exc_secure = false;

+ } else {

+ qemu_log_mask(CPU_LOG_INT,

+ "...MemManageFault with CFSR.MUNSTKERR\n");

+ env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK;

+ exc = ARMV7M_EXCP_MEM;

+ exc_secure = secure;

+ }

+ goto pend_fault;

+ }

+

+ value = address_space_ldl(arm_addressspace(cs, attrs), physaddr,

+ attrs, &txres);

+ if (txres != MEMTX_OK) {

+ /* BusFault trying to read the data */

+ qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");

+ env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK;

+ exc = ARMV7M_EXCP_BUS;

+ exc_secure = false;

+ goto pend_fault;

+ }

+

+ *dest = value;

+ return true;

+

+pend_fault:

+ /* By pending the exception at this point we are making

+ * the IMPDEF choice "overridden exceptions pended" (see the

+ * MergeExcInfo() pseudocode). The other choice would be to not

+ * pend them now and then make a choice about which to throw away

+ * later if we have two derived exceptions.

+ */

+ armv7m_nvic_set_pending(env->nvic, exc, exc_secure);

+ return false;

+}

+

/* Return true if we're using the process stack pointer (not the MSP) */

static bool v7m_using_psp(CPUARMState *env)

{

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)