xref: /qemu/target/arm/tcg/m_helper.c (revision df6fe2abf2e990f767ce755d426bc439c7bba336)
1 /*
2  * ARM generic helpers.
3  *
4  * This code is licensed under the GNU GPL v2 or later.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "cpu.h"
11 #include "internals.h"
12 #include "cpu-features.h"
13 #include "gdbstub/helpers.h"
14 #include "exec/helper-proto.h"
15 #include "qemu/main-loop.h"
16 #include "qemu/bitops.h"
17 #include "qemu/log.h"
18 #include "exec/page-protection.h"
19 #ifdef CONFIG_TCG
20 #include "accel/tcg/cpu-ldst.h"
21 #include "semihosting/common-semi.h"
22 #endif
23 #if !defined(CONFIG_USER_ONLY)
24 #include "hw/intc/armv7m_nvic.h"
25 #endif
26 
27 static void v7m_msr_xpsr(CPUARMState *env, uint32_t mask,
28                          uint32_t reg, uint32_t val)
29 {
30     /* Only APSR is actually writable */
31     if (!(reg & 4)) {
32         uint32_t apsrmask = 0;
33 
34         if (mask & 8) {
35             apsrmask |= XPSR_NZCV | XPSR_Q;
36         }
37         if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
38             apsrmask |= XPSR_GE;
39         }
40         xpsr_write(env, val, apsrmask);
41     }
42 }
43 
44 static uint32_t v7m_mrs_xpsr(CPUARMState *env, uint32_t reg, unsigned el)
45 {
46     uint32_t mask = 0;
47 
48     if ((reg & 1) && el) {
49         mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */
50     }
51     if (!(reg & 4)) {
52         mask |= XPSR_NZCV | XPSR_Q; /* APSR */
53         if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
54             mask |= XPSR_GE;
55         }
56     }
57     /* EPSR reads as zero */
58     return xpsr_read(env) & mask;
59 }
60 
61 uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure)
62 {
63     uint32_t value = env->v7m.control[secure];
64 
65     if (!secure) {
66         /* SFPA is RAZ/WI from NS; FPCA is stored in the M_REG_S bank */
67         value |= env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK;
68     }
69     return value;
70 }
71 
72 #ifdef CONFIG_USER_ONLY
73 
74 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
75 {
76     uint32_t mask = extract32(maskreg, 8, 4);
77     uint32_t reg = extract32(maskreg, 0, 8);
78 
79     switch (reg) {
80     case 0 ... 7: /* xPSR sub-fields */
81         v7m_msr_xpsr(env, mask, reg, val);
82         break;
83     case 20: /* CONTROL */
84         /* There are no sub-fields that are actually writable from EL0. */
85         break;
86     default:
87         /* Unprivileged writes to other registers are ignored */
88         break;
89     }
90 }
91 
92 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
93 {
94     switch (reg) {
95     case 0 ... 7: /* xPSR sub-fields */
96         return v7m_mrs_xpsr(env, reg, 0);
97     case 20: /* CONTROL */
98         return arm_v7m_mrs_control(env, 0);
99     default:
100         /* Unprivileged reads others as zero.  */
101         return 0;
102     }
103 }
104 
105 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
106 {
107     /* translate.c should never generate calls here in user-only mode */
108     g_assert_not_reached();
109 }
110 
111 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
112 {
113     /* translate.c should never generate calls here in user-only mode */
114     g_assert_not_reached();
115 }
116 
117 void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
118 {
119     /* translate.c should never generate calls here in user-only mode */
120     g_assert_not_reached();
121 }
122 
123 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
124 {
125     /* translate.c should never generate calls here in user-only mode */
126     g_assert_not_reached();
127 }
128 
129 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
130 {
131     /* translate.c should never generate calls here in user-only mode */
132     g_assert_not_reached();
133 }
134 
135 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
136 {
137     /*
138      * The TT instructions can be used by unprivileged code, but in
139      * user-only emulation we don't have the MPU.
140      * Luckily since we know we are NonSecure unprivileged (and that in
141      * turn means that the A flag wasn't specified), all the bits in the
142      * register must be zero:
143      *  IREGION: 0 because IRVALID is 0
144      *  IRVALID: 0 because NS
145      *  S: 0 because NS
146      *  NSRW: 0 because NS
147      *  NSR: 0 because NS
148      *  RW: 0 because unpriv and A flag not set
149      *  R: 0 because unpriv and A flag not set
150      *  SRVALID: 0 because NS
151      *  MRVALID: 0 because unpriv and A flag not set
152      *  SREGION: 0 because SRVALID is 0
153      *  MREGION: 0 because MRVALID is 0
154      */
155     return 0;
156 }
157 
158 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
159 {
160     return ARMMMUIdx_MUser;
161 }
162 
163 #else /* !CONFIG_USER_ONLY */
164 
165 static ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
166                                      bool secstate, bool priv, bool negpri)
167 {
168     ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
169 
170     if (priv) {
171         mmu_idx |= ARM_MMU_IDX_M_PRIV;
172     }
173 
174     if (negpri) {
175         mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
176     }
177 
178     if (secstate) {
179         mmu_idx |= ARM_MMU_IDX_M_S;
180     }
181 
182     return mmu_idx;
183 }
184 
185 static ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
186                                                        bool secstate, bool priv)
187 {
188     bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
189 
190     return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
191 }
192 
193 /* Return the MMU index for a v7M CPU in the specified security state */
194 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
195 {
196     bool priv = arm_v7m_is_handler_mode(env) ||
197         !(env->v7m.control[secstate] & 1);
198 
199     return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
200 }
201 
202 /*
203  * What kind of stack write are we doing? This affects how exceptions
204  * generated during the stacking are treated.
205  */
206 typedef enum StackingMode {
207     STACK_NORMAL,
208     STACK_IGNFAULTS,
209     STACK_LAZYFP,
210 } StackingMode;
211 
212 static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
213                             ARMMMUIdx mmu_idx, StackingMode mode)
214 {
215     CPUState *cs = CPU(cpu);
216     CPUARMState *env = &cpu->env;
217     MemTxResult txres;
218     GetPhysAddrResult res = {};
219     ARMMMUFaultInfo fi = {};
220     bool secure = mmu_idx & ARM_MMU_IDX_M_S;
221     int exc;
222     bool exc_secure;
223 
224     if (get_phys_addr(env, addr, MMU_DATA_STORE, 0, mmu_idx, &res, &fi)) {
225         /* MPU/SAU lookup failed */
226         if (fi.type == ARMFault_QEMU_SFault) {
227             if (mode == STACK_LAZYFP) {
228                 qemu_log_mask(CPU_LOG_INT,
229                               "...SecureFault with SFSR.LSPERR "
230                               "during lazy stacking\n");
231                 env->v7m.sfsr |= R_V7M_SFSR_LSPERR_MASK;
232             } else {
233                 qemu_log_mask(CPU_LOG_INT,
234                               "...SecureFault with SFSR.AUVIOL "
235                               "during stacking\n");
236                 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
237             }
238             env->v7m.sfsr |= R_V7M_SFSR_SFARVALID_MASK;
239             env->v7m.sfar = addr;
240             exc = ARMV7M_EXCP_SECURE;
241             exc_secure = false;
242         } else {
243             if (mode == STACK_LAZYFP) {
244                 qemu_log_mask(CPU_LOG_INT,
245                               "...MemManageFault with CFSR.MLSPERR\n");
246                 env->v7m.cfsr[secure] |= R_V7M_CFSR_MLSPERR_MASK;
247             } else {
248                 qemu_log_mask(CPU_LOG_INT,
249                               "...MemManageFault with CFSR.MSTKERR\n");
250                 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK;
251             }
252             exc = ARMV7M_EXCP_MEM;
253             exc_secure = secure;
254         }
255         goto pend_fault;
256     }
257     address_space_stl_le(arm_addressspace(cs, res.f.attrs), res.f.phys_addr,
258                          value, res.f.attrs, &txres);
259     if (txres != MEMTX_OK) {
260         /* BusFault trying to write the data */
261         if (mode == STACK_LAZYFP) {
262             qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.LSPERR\n");
263             env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_LSPERR_MASK;
264         } else {
265             qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n");
266             env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK;
267         }
268         exc = ARMV7M_EXCP_BUS;
269         exc_secure = false;
270         goto pend_fault;
271     }
272     return true;
273 
274 pend_fault:
275     /*
276      * By pending the exception at this point we are making
277      * the IMPDEF choice "overridden exceptions pended" (see the
278      * MergeExcInfo() pseudocode). The other choice would be to not
279      * pend them now and then make a choice about which to throw away
280      * later if we have two derived exceptions.
281      * The only case when we must not pend the exception but instead
282      * throw it away is if we are doing the push of the callee registers
283      * and we've already generated a derived exception (this is indicated
284      * by the caller passing STACK_IGNFAULTS). Even in this case we will
285      * still update the fault status registers.
286      */
287     switch (mode) {
288     case STACK_NORMAL:
289         armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure);
290         break;
291     case STACK_LAZYFP:
292         armv7m_nvic_set_pending_lazyfp(env->nvic, exc, exc_secure);
293         break;
294     case STACK_IGNFAULTS:
295         break;
296     }
297     return false;
298 }
299 
300 static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
301                            ARMMMUIdx mmu_idx)
302 {
303     CPUState *cs = CPU(cpu);
304     CPUARMState *env = &cpu->env;
305     MemTxResult txres;
306     GetPhysAddrResult res = {};
307     ARMMMUFaultInfo fi = {};
308     bool secure = mmu_idx & ARM_MMU_IDX_M_S;
309     int exc;
310     bool exc_secure;
311     uint32_t value;
312 
313     if (get_phys_addr(env, addr, MMU_DATA_LOAD, 0, mmu_idx, &res, &fi)) {
314         /* MPU/SAU lookup failed */
315         if (fi.type == ARMFault_QEMU_SFault) {
316             qemu_log_mask(CPU_LOG_INT,
317                           "...SecureFault with SFSR.AUVIOL during unstack\n");
318             env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
319             env->v7m.sfar = addr;
320             exc = ARMV7M_EXCP_SECURE;
321             exc_secure = false;
322         } else {
323             qemu_log_mask(CPU_LOG_INT,
324                           "...MemManageFault with CFSR.MUNSTKERR\n");
325             env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK;
326             exc = ARMV7M_EXCP_MEM;
327             exc_secure = secure;
328         }
329         goto pend_fault;
330     }
331 
332     value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
333                               res.f.phys_addr, res.f.attrs, &txres);
334     if (txres != MEMTX_OK) {
335         /* BusFault trying to read the data */
336         qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
337         env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK;
338         exc = ARMV7M_EXCP_BUS;
339         exc_secure = false;
340         goto pend_fault;
341     }
342 
343     *dest = value;
344     return true;
345 
346 pend_fault:
347     /*
348      * By pending the exception at this point we are making
349      * the IMPDEF choice "overridden exceptions pended" (see the
350      * MergeExcInfo() pseudocode). The other choice would be to not
351      * pend them now and then make a choice about which to throw away
352      * later if we have two derived exceptions.
353      */
354     armv7m_nvic_set_pending(env->nvic, exc, exc_secure);
355     return false;
356 }
357 
358 void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
359 {
360     /*
361      * Preserve FP state (because LSPACT was set and we are about
362      * to execute an FP instruction). This corresponds to the
363      * PreserveFPState() pseudocode.
364      * We may throw an exception if the stacking fails.
365      */
366     ARMCPU *cpu = env_archcpu(env);
367     bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
368     bool negpri = !(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_HFRDY_MASK);
369     bool is_priv = !(env->v7m.fpccr[is_secure] & R_V7M_FPCCR_USER_MASK);
370     bool splimviol = env->v7m.fpccr[is_secure] & R_V7M_FPCCR_SPLIMVIOL_MASK;
371     uint32_t fpcar = env->v7m.fpcar[is_secure];
372     bool stacked_ok = true;
373     bool ts = is_secure && (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
374     bool take_exception;
375 
376     /* Take the BQL as we are going to touch the NVIC */
377     bql_lock();
378 
379     /* Check the background context had access to the FPU */
380     if (!v7m_cpacr_pass(env, is_secure, is_priv)) {
381         armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, is_secure);
382         env->v7m.cfsr[is_secure] |= R_V7M_CFSR_NOCP_MASK;
383         stacked_ok = false;
384     } else if (!is_secure && !extract32(env->v7m.nsacr, 10, 1)) {
385         armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
386         env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
387         stacked_ok = false;
388     }
389 
390     if (!splimviol && stacked_ok) {
391         /* We only stack if the stack limit wasn't violated */
392         int i;
393         ARMMMUIdx mmu_idx;
394 
395         mmu_idx = arm_v7m_mmu_idx_all(env, is_secure, is_priv, negpri);
396         for (i = 0; i < (ts ? 32 : 16); i += 2) {
397             uint64_t dn = *aa32_vfp_dreg(env, i / 2);
398             uint32_t faddr = fpcar + 4 * i;
399             uint32_t slo = extract64(dn, 0, 32);
400             uint32_t shi = extract64(dn, 32, 32);
401 
402             if (i >= 16) {
403                 faddr += 8; /* skip the slot for the FPSCR/VPR */
404             }
405             stacked_ok = stacked_ok &&
406                 v7m_stack_write(cpu, faddr, slo, mmu_idx, STACK_LAZYFP) &&
407                 v7m_stack_write(cpu, faddr + 4, shi, mmu_idx, STACK_LAZYFP);
408         }
409 
410         stacked_ok = stacked_ok &&
411             v7m_stack_write(cpu, fpcar + 0x40,
412                             vfp_get_fpscr(env), mmu_idx, STACK_LAZYFP);
413         if (cpu_isar_feature(aa32_mve, cpu)) {
414             stacked_ok = stacked_ok &&
415                 v7m_stack_write(cpu, fpcar + 0x44,
416                                 env->v7m.vpr, mmu_idx, STACK_LAZYFP);
417         }
418     }
419 
420     /*
421      * We definitely pended an exception, but it's possible that it
422      * might not be able to be taken now. If its priority permits us
423      * to take it now, then we must not update the LSPACT or FP regs,
424      * but instead jump out to take the exception immediately.
425      * If it's just pending and won't be taken until the current
426      * handler exits, then we do update LSPACT and the FP regs.
427      */
428     take_exception = !stacked_ok &&
429         armv7m_nvic_can_take_pending_exception(env->nvic);
430 
431     bql_unlock();
432 
433     if (take_exception) {
434         raise_exception_ra(env, EXCP_LAZYFP, 0, 1, GETPC());
435     }
436 
437     env->v7m.fpccr[is_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
438 
439     if (ts) {
440         /* Clear s0 to s31 and the FPSCR and VPR */
441         int i;
442 
443         for (i = 0; i < 32; i += 2) {
444             *aa32_vfp_dreg(env, i / 2) = 0;
445         }
446         vfp_set_fpscr(env, 0);
447         if (cpu_isar_feature(aa32_mve, cpu)) {
448             env->v7m.vpr = 0;
449         }
450     }
451     /*
452      * Otherwise s0 to s15, FPSCR and VPR are UNKNOWN; we choose to leave them
453      * unchanged.
454      */
455 }
456 
457 /*
458  * Write to v7M CONTROL.SPSEL bit for the specified security bank.
459  * This may change the current stack pointer between Main and Process
460  * stack pointers if it is done for the CONTROL register for the current
461  * security state.
462  */
463 static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
464                                                  bool new_spsel,
465                                                  bool secstate)
466 {
467     bool old_is_psp = v7m_using_psp(env);
468 
469     env->v7m.control[secstate] =
470         deposit32(env->v7m.control[secstate],
471                   R_V7M_CONTROL_SPSEL_SHIFT,
472                   R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
473 
474     if (secstate == env->v7m.secure) {
475         bool new_is_psp = v7m_using_psp(env);
476         uint32_t tmp;
477 
478         if (old_is_psp != new_is_psp) {
479             tmp = env->v7m.other_sp;
480             env->v7m.other_sp = env->regs[13];
481             env->regs[13] = tmp;
482         }
483     }
484 }
485 
486 /*
487  * Write to v7M CONTROL.SPSEL bit. This may change the current
488  * stack pointer between Main and Process stack pointers.
489  */
490 static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
491 {
492     write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
493 }
494 
495 void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
496 {
497     /*
498      * Write a new value to v7m.exception, thus transitioning into or out
499      * of Handler mode; this may result in a change of active stack pointer.
500      */
501     bool new_is_psp, old_is_psp = v7m_using_psp(env);
502     uint32_t tmp;
503 
504     env->v7m.exception = new_exc;
505 
506     new_is_psp = v7m_using_psp(env);
507 
508     if (old_is_psp != new_is_psp) {
509         tmp = env->v7m.other_sp;
510         env->v7m.other_sp = env->regs[13];
511         env->regs[13] = tmp;
512     }
513 }
514 
515 /* Switch M profile security state between NS and S */
516 static void switch_v7m_security_state(CPUARMState *env, bool new_secstate)
517 {
518     uint32_t new_ss_msp, new_ss_psp;
519 
520     if (env->v7m.secure == new_secstate) {
521         return;
522     }
523 
524     /*
525      * All the banked state is accessed by looking at env->v7m.secure
526      * except for the stack pointer; rearrange the SP appropriately.
527      */
528     new_ss_msp = env->v7m.other_ss_msp;
529     new_ss_psp = env->v7m.other_ss_psp;
530 
531     if (v7m_using_psp(env)) {
532         env->v7m.other_ss_psp = env->regs[13];
533         env->v7m.other_ss_msp = env->v7m.other_sp;
534     } else {
535         env->v7m.other_ss_msp = env->regs[13];
536         env->v7m.other_ss_psp = env->v7m.other_sp;
537     }
538 
539     env->v7m.secure = new_secstate;
540 
541     if (v7m_using_psp(env)) {
542         env->regs[13] = new_ss_psp;
543         env->v7m.other_sp = new_ss_msp;
544     } else {
545         env->regs[13] = new_ss_msp;
546         env->v7m.other_sp = new_ss_psp;
547     }
548 }
549 
550 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
551 {
552     /*
553      * Handle v7M BXNS:
554      *  - if the return value is a magic value, do exception return (like BX)
555      *  - otherwise bit 0 of the return value is the target security state
556      */
557     uint32_t min_magic;
558 
559     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
560         /* Covers FNC_RETURN and EXC_RETURN magic */
561         min_magic = FNC_RETURN_MIN_MAGIC;
562     } else {
563         /* EXC_RETURN magic only */
564         min_magic = EXC_RETURN_MIN_MAGIC;
565     }
566 
567     if (dest >= min_magic) {
568         /*
569          * This is an exception return magic value; put it where
570          * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT.
571          * Note that if we ever add gen_ss_advance() singlestep support to
572          * M profile this should count as an "instruction execution complete"
573          * event (compare gen_bx_excret_final_code()).
574          */
575         env->regs[15] = dest & ~1;
576         env->thumb = dest & 1;
577         HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT);
578         /* notreached */
579     }
580 
581     /* translate.c should have made BXNS UNDEF unless we're secure */
582     assert(env->v7m.secure);
583 
584     if (!(dest & 1)) {
585         env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
586     }
587     switch_v7m_security_state(env, dest & 1);
588     env->thumb = true;
589     env->regs[15] = dest & ~1;
590     arm_rebuild_hflags(env);
591 }
592 
593 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
594 {
595     /*
596      * Handle v7M BLXNS:
597      *  - bit 0 of the destination address is the target security state
598      */
599 
600     /* At this point regs[15] is the address just after the BLXNS */
601     uint32_t nextinst = env->regs[15] | 1;
602     uint32_t sp = env->regs[13] - 8;
603     uint32_t saved_psr;
604 
605     /* translate.c will have made BLXNS UNDEF unless we're secure */
606     assert(env->v7m.secure);
607 
608     if (dest & 1) {
609         /*
610          * Target is Secure, so this is just a normal BLX,
611          * except that the low bit doesn't indicate Thumb/not.
612          */
613         env->regs[14] = nextinst;
614         env->thumb = true;
615         env->regs[15] = dest & ~1;
616         return;
617     }
618 
619     /* Target is non-secure: first push a stack frame */
620     if (!QEMU_IS_ALIGNED(sp, 8)) {
621         qemu_log_mask(LOG_GUEST_ERROR,
622                       "BLXNS with misaligned SP is UNPREDICTABLE\n");
623     }
624 
625     if (sp < v7m_sp_limit(env)) {
626         raise_exception(env, EXCP_STKOF, 0, 1);
627     }
628 
629     saved_psr = env->v7m.exception;
630     if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
631         saved_psr |= XPSR_SFPA;
632     }
633 
634     /* Note that these stores can throw exceptions on MPU faults */
635     ARMMMUIdx mmu_idx = arm_mmu_idx(env);
636     MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN,
637                                  arm_to_core_mmu_idx(mmu_idx));
638     cpu_stl_mmu(env, sp, nextinst, oi, GETPC());
639     cpu_stl_mmu(env, sp + 4, saved_psr, oi, GETPC());
640 
641     env->regs[13] = sp;
642     env->regs[14] = 0xfeffffff;
643     if (arm_v7m_is_handler_mode(env)) {
644         /*
645          * Write a dummy value to IPSR, to avoid leaking the current secure
646          * exception number to non-secure code. This is guaranteed not
647          * to cause write_v7m_exception() to actually change stacks.
648          */
649         write_v7m_exception(env, 1);
650     }
651     env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
652     switch_v7m_security_state(env, 0);
653     env->thumb = true;
654     env->regs[15] = dest;
655     arm_rebuild_hflags(env);
656 }
657 
658 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
659                                 uint32_t *pvec)
660 {
661     CPUState *cs = CPU(cpu);
662     CPUARMState *env = &cpu->env;
663     MemTxResult result;
664     uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4;
665     uint32_t vector_entry;
666     MemTxAttrs attrs = {};
667     ARMMMUIdx mmu_idx;
668     bool exc_secure;
669 
670     qemu_log_mask(CPU_LOG_INT,
671                   "...loading from element %d of %s vector table at 0x%x\n",
672                   exc, targets_secure ? "secure" : "non-secure", addr);
673 
674     mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
675 
676     /*
677      * We don't do a get_phys_addr() here because the rules for vector
678      * loads are special: they always use the default memory map, and
679      * the default memory map permits reads from all addresses.
680      * Since there's no easy way to pass through to pmsav8_mpu_lookup()
681      * that we want this special case which would always say "yes",
682      * we just do the SAU lookup here followed by a direct physical load.
683      */
684     attrs.secure = targets_secure;
685     attrs.user = false;
686 
687     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
688         V8M_SAttributes sattrs = {};
689 
690         v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
691                             targets_secure, &sattrs);
692         if (sattrs.ns) {
693             attrs.secure = false;
694         } else if (!targets_secure) {
695             /*
696              * NS access to S memory: the underlying exception which we escalate
697              * to HardFault is SecureFault, which always targets Secure.
698              */
699             exc_secure = true;
700             goto load_fail;
701         }
702     }
703 
704     vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
705                                      attrs, &result);
706     if (result != MEMTX_OK) {
707         /*
708          * Underlying exception is BusFault: its target security state
709          * depends on BFHFNMINS.
710          */
711         exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
712         goto load_fail;
713     }
714     *pvec = vector_entry;
715     qemu_log_mask(CPU_LOG_INT, "...loaded new PC 0x%x\n", *pvec);
716     return true;
717 
718 load_fail:
719     /*
720      * All vector table fetch fails are reported as HardFault, with
721      * HFSR.VECTTBL and .FORCED set. (FORCED is set because
722      * technically the underlying exception is a SecureFault or BusFault
723      * that is escalated to HardFault.) This is a terminal exception,
724      * so we will either take the HardFault immediately or else enter
725      * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
726      * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
727      * secure); otherwise it targets the same security state as the
728      * underlying exception.
729      * In v8.1M HardFaults from vector table fetch fails don't set FORCED.
730      */
731     if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
732         exc_secure = true;
733     }
734     env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK;
735     if (!arm_feature(env, ARM_FEATURE_V8_1M)) {
736         env->v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
737     }
738     armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
739     return false;
740 }
741 
742 static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
743 {
744     /*
745      * Return the integrity signature value for the callee-saves
746      * stack frame section. @lr is the exception return payload/LR value
747      * whose FType bit forms bit 0 of the signature if FP is present.
748      */
749     uint32_t sig = 0xfefa125a;
750 
751     if (!cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))
752         || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
753         sig |= 1;
754     }
755     return sig;
756 }
757 
758 static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
759                                   bool ignore_faults)
760 {
761     /*
762      * For v8M, push the callee-saves register part of the stack frame.
763      * Compare the v8M pseudocode PushCalleeStack().
764      * In the tailchaining case this may not be the current stack.
765      */
766     CPUARMState *env = &cpu->env;
767     uint32_t *frame_sp_p;
768     uint32_t frameptr;
769     ARMMMUIdx mmu_idx;
770     bool stacked_ok;
771     uint32_t limit;
772     bool want_psp;
773     uint32_t sig;
774     StackingMode smode = ignore_faults ? STACK_IGNFAULTS : STACK_NORMAL;
775 
776     if (dotailchain) {
777         bool mode = lr & R_V7M_EXCRET_MODE_MASK;
778         bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) ||
779             !mode;
780 
781         mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
782         frame_sp_p = arm_v7m_get_sp_ptr(env, M_REG_S, mode,
783                                         lr & R_V7M_EXCRET_SPSEL_MASK);
784         want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
785         if (want_psp) {
786             limit = env->v7m.psplim[M_REG_S];
787         } else {
788             limit = env->v7m.msplim[M_REG_S];
789         }
790     } else {
791         mmu_idx = arm_mmu_idx(env);
792         frame_sp_p = &env->regs[13];
793         limit = v7m_sp_limit(env);
794     }
795 
796     frameptr = *frame_sp_p - 0x28;
797     if (frameptr < limit) {
798         /*
799          * Stack limit failure: set SP to the limit value, and generate
800          * STKOF UsageFault. Stack pushes below the limit must not be
801          * performed. It is IMPDEF whether pushes above the limit are
802          * performed; we choose not to.
803          */
804         qemu_log_mask(CPU_LOG_INT,
805                       "...STKOF during callee-saves register stacking\n");
806         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
807         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
808                                 env->v7m.secure);
809         *frame_sp_p = limit;
810         return true;
811     }
812 
813     /*
814      * Write as much of the stack frame as we can. A write failure may
815      * cause us to pend a derived exception.
816      */
817     sig = v7m_integrity_sig(env, lr);
818     stacked_ok =
819         v7m_stack_write(cpu, frameptr, sig, mmu_idx, smode) &&
820         v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, smode) &&
821         v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, smode) &&
822         v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, smode) &&
823         v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, smode) &&
824         v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, smode) &&
825         v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, smode) &&
826         v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, smode) &&
827         v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, smode);
828 
829     /* Update SP regardless of whether any of the stack accesses failed. */
830     *frame_sp_p = frameptr;
831 
832     return !stacked_ok;
833 }
834 
835 static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
836                                 bool ignore_stackfaults)
837 {
838     /*
839      * Do the "take the exception" parts of exception entry,
840      * but not the pushing of state to the stack. This is
841      * similar to the pseudocode ExceptionTaken() function.
842      */
843     CPUARMState *env = &cpu->env;
844     uint32_t addr;
845     bool targets_secure;
846     int exc;
847     bool push_failed = false;
848 
849     armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);
850     qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n",
851                   targets_secure ? "secure" : "nonsecure", exc);
852 
853     if (dotailchain) {
854         /* Sanitize LR FType and PREFIX bits */
855         if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
856             lr |= R_V7M_EXCRET_FTYPE_MASK;
857         }
858         lr = deposit32(lr, 24, 8, 0xff);
859     }
860 
861     if (arm_feature(env, ARM_FEATURE_V8)) {
862         if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
863             (lr & R_V7M_EXCRET_S_MASK)) {
864             /*
865              * The background code (the owner of the registers in the
866              * exception frame) is Secure. This means it may either already
867              * have or now needs to push callee-saves registers.
868              */
869             if (targets_secure) {
870                 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
871                     /*
872                      * We took an exception from Secure to NonSecure
873                      * (which means the callee-saved registers got stacked)
874                      * and are now tailchaining to a Secure exception.
875                      * Clear DCRS so eventual return from this Secure
876                      * exception unstacks the callee-saved registers.
877                      */
878                     lr &= ~R_V7M_EXCRET_DCRS_MASK;
879                 }
880             } else {
881                 /*
882                  * We're going to a non-secure exception; push the
883                  * callee-saves registers to the stack now, if they're
884                  * not already saved.
885                  */
886                 if (lr & R_V7M_EXCRET_DCRS_MASK &&
887                     !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) {
888                     push_failed = v7m_push_callee_stack(cpu, lr, dotailchain,
889                                                         ignore_stackfaults);
890                 }
891                 lr |= R_V7M_EXCRET_DCRS_MASK;
892             }
893         }
894 
895         lr &= ~R_V7M_EXCRET_ES_MASK;
896         if (targets_secure) {
897             lr |= R_V7M_EXCRET_ES_MASK;
898         }
899         lr &= ~R_V7M_EXCRET_SPSEL_MASK;
900         if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
901             lr |= R_V7M_EXCRET_SPSEL_MASK;
902         }
903 
904         /*
905          * Clear registers if necessary to prevent non-secure exception
906          * code being able to see register values from secure code.
907          * Where register values become architecturally UNKNOWN we leave
908          * them with their previous values. v8.1M is tighter than v8.0M
909          * here and always zeroes the caller-saved registers regardless
910          * of the security state the exception is targeting.
911          */
912         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
913             if (!targets_secure || arm_feature(env, ARM_FEATURE_V8_1M)) {
914                 /*
915                  * Always clear the caller-saved registers (they have been
916                  * pushed to the stack earlier in v7m_push_stack()).
917                  * Clear callee-saved registers if the background code is
918                  * Secure (in which case these regs were saved in
919                  * v7m_push_callee_stack()).
920                  */
921                 int i;
922                 /*
923                  * r4..r11 are callee-saves, zero only if background
924                  * state was Secure (EXCRET.S == 1) and exception
925                  * targets Non-secure state
926                  */
927                 bool zero_callee_saves = !targets_secure &&
928                     (lr & R_V7M_EXCRET_S_MASK);
929 
930                 for (i = 0; i < 13; i++) {
931                     if (i < 4 || i > 11 || zero_callee_saves) {
932                         env->regs[i] = 0;
933                     }
934                 }
935                 /* Clear EAPSR */
936                 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
937             }
938         }
939     }
940 
941     if (push_failed && !ignore_stackfaults) {
942         /*
943          * Derived exception on callee-saves register stacking:
944          * we might now want to take a different exception which
945          * targets a different security state, so try again from the top.
946          */
947         qemu_log_mask(CPU_LOG_INT,
948                       "...derived exception on callee-saves register stacking");
949         v7m_exception_taken(cpu, lr, true, true);
950         return;
951     }
952 
953     if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) {
954         /* Vector load failed: derived exception */
955         qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load");
956         v7m_exception_taken(cpu, lr, true, true);
957         return;
958     }
959 
960     /*
961      * Now we've done everything that might cause a derived exception
962      * we can go ahead and activate whichever exception we're going to
963      * take (which might now be the derived exception).
964      */
965     armv7m_nvic_acknowledge_irq(env->nvic);
966 
967     /* Switch to target security state -- must do this before writing SPSEL */
968     switch_v7m_security_state(env, targets_secure);
969     write_v7m_control_spsel(env, 0);
970     arm_clear_exclusive(env);
971     /* Clear SFPA and FPCA (has no effect if no FPU) */
972     env->v7m.control[M_REG_S] &=
973         ~(R_V7M_CONTROL_FPCA_MASK | R_V7M_CONTROL_SFPA_MASK);
974     /* Clear IT bits */
975     env->condexec_bits = 0;
976     env->regs[14] = lr;
977     env->regs[15] = addr & 0xfffffffe;
978     env->thumb = addr & 1;
979     arm_rebuild_hflags(env);
980 }
981 
982 static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
983                              bool apply_splim)
984 {
985     /*
986      * Like the pseudocode UpdateFPCCR: save state in FPCAR and FPCCR
987      * that we will need later in order to do lazy FP reg stacking.
988      */
989     bool is_secure = env->v7m.secure;
990     NVICState *nvic = env->nvic;
991     /*
992      * Some bits are unbanked and live always in fpccr[M_REG_S]; some bits
993      * are banked and we want to update the bit in the bank for the
994      * current security state; and in one case we want to specifically
995      * update the NS banked version of a bit even if we are secure.
996      */
997     uint32_t *fpccr_s = &env->v7m.fpccr[M_REG_S];
998     uint32_t *fpccr_ns = &env->v7m.fpccr[M_REG_NS];
999     uint32_t *fpccr = &env->v7m.fpccr[is_secure];
1000     bool hfrdy, bfrdy, mmrdy, ns_ufrdy, s_ufrdy, sfrdy, monrdy;
1001 
1002     env->v7m.fpcar[is_secure] = frameptr & ~0x7;
1003 
1004     if (apply_splim && arm_feature(env, ARM_FEATURE_V8)) {
1005         bool splimviol;
1006         uint32_t splim = v7m_sp_limit(env);
1007         bool ign = armv7m_nvic_neg_prio_requested(nvic, is_secure) &&
1008             (env->v7m.ccr[is_secure] & R_V7M_CCR_STKOFHFNMIGN_MASK);
1009 
1010         splimviol = !ign && frameptr < splim;
1011         *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, SPLIMVIOL, splimviol);
1012     }
1013 
1014     *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, LSPACT, 1);
1015 
1016     *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, S, is_secure);
1017 
1018     *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, USER, arm_current_el(env) == 0);
1019 
1020     *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, THREAD,
1021                         !arm_v7m_is_handler_mode(env));
1022 
1023     hfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_HARD, false);
1024     *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
1025 
1026     bfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_BUS, false);
1027     *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
1028 
1029     mmrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_MEM, is_secure);
1030     *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, MMRDY, mmrdy);
1031 
1032     ns_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, false);
1033     *fpccr_ns = FIELD_DP32(*fpccr_ns, V7M_FPCCR, UFRDY, ns_ufrdy);
1034 
1035     monrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_DEBUG, false);
1036     *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, MONRDY, monrdy);
1037 
1038     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1039         s_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, true);
1040         *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, UFRDY, s_ufrdy);
1041 
1042         sfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_SECURE, false);
1043         *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, SFRDY, sfrdy);
1044     }
1045 }
1046 
1047 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
1048 {
1049     /* fptr is the value of Rn, the frame pointer we store the FP regs to */
1050     ARMCPU *cpu = env_archcpu(env);
1051     bool s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1052     bool lspact = env->v7m.fpccr[s] & R_V7M_FPCCR_LSPACT_MASK;
1053     uintptr_t ra = GETPC();
1054     ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1055     MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN,
1056                                  arm_to_core_mmu_idx(mmu_idx));
1057 
1058     assert(env->v7m.secure);
1059 
1060     if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1061         return;
1062     }
1063 
1064     /* Check access to the coprocessor is permitted */
1065     if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1066         raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1067     }
1068 
1069     if (lspact) {
1070         /* LSPACT should not be active when there is active FP state */
1071         raise_exception_ra(env, EXCP_LSERR, 0, 1, GETPC());
1072     }
1073 
1074     if (fptr & 7) {
1075         raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1076     }
1077 
1078     /*
1079      * Note that we do not use v7m_stack_write() here, because the
1080      * accesses should not set the FSR bits for stacking errors if they
1081      * fail. (In pseudocode terms, they are AccType_NORMAL, not AccType_STACK
1082      * or AccType_LAZYFP). Faults in cpu_stl_mmu() will throw exceptions
1083      * and longjmp out.
1084      */
1085     if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1086         bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1087         int i;
1088 
1089         for (i = 0; i < (ts ? 32 : 16); i += 2) {
1090             uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1091             uint32_t faddr = fptr + 4 * i;
1092             uint32_t slo = extract64(dn, 0, 32);
1093             uint32_t shi = extract64(dn, 32, 32);
1094 
1095             if (i >= 16) {
1096                 faddr += 8; /* skip the slot for the FPSCR */
1097             }
1098             cpu_stl_mmu(env, faddr, slo, oi, ra);
1099             cpu_stl_mmu(env, faddr + 4, shi, oi, ra);
1100         }
1101         cpu_stl_mmu(env, fptr + 0x40, vfp_get_fpscr(env), oi, ra);
1102         if (cpu_isar_feature(aa32_mve, cpu)) {
1103             cpu_stl_mmu(env, fptr + 0x44, env->v7m.vpr, oi, ra);
1104         }
1105 
1106         /*
1107          * If TS is 0 then s0 to s15, FPSCR and VPR are UNKNOWN; we choose to
1108          * leave them unchanged, matching our choice in v7m_preserve_fp_state.
1109          */
1110         if (ts) {
1111             for (i = 0; i < 32; i += 2) {
1112                 *aa32_vfp_dreg(env, i / 2) = 0;
1113             }
1114             vfp_set_fpscr(env, 0);
1115             if (cpu_isar_feature(aa32_mve, cpu)) {
1116                 env->v7m.vpr = 0;
1117             }
1118         }
1119     } else {
1120         v7m_update_fpccr(env, fptr, false);
1121     }
1122 
1123     env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
1124 }
1125 
1126 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
1127 {
1128     ARMCPU *cpu = env_archcpu(env);
1129     uintptr_t ra = GETPC();
1130     ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1131     MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN,
1132                                  arm_to_core_mmu_idx(mmu_idx));
1133 
1134     /* fptr is the value of Rn, the frame pointer we load the FP regs from */
1135     assert(env->v7m.secure);
1136 
1137     if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1138         return;
1139     }
1140 
1141     /* Check access to the coprocessor is permitted */
1142     if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1143         raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1144     }
1145 
1146     if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1147         /* State in FP is still valid */
1148         env->v7m.fpccr[M_REG_S] &= ~R_V7M_FPCCR_LSPACT_MASK;
1149     } else {
1150         bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1151         int i;
1152         uint32_t fpscr;
1153 
1154         if (fptr & 7) {
1155             raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1156         }
1157 
1158         for (i = 0; i < (ts ? 32 : 16); i += 2) {
1159             uint32_t slo, shi;
1160             uint64_t dn;
1161             uint32_t faddr = fptr + 4 * i;
1162 
1163             if (i >= 16) {
1164                 faddr += 8; /* skip the slot for the FPSCR and VPR */
1165             }
1166 
1167             slo = cpu_ldl_mmu(env, faddr, oi, ra);
1168             shi = cpu_ldl_mmu(env, faddr + 4, oi, ra);
1169 
1170             dn = (uint64_t) shi << 32 | slo;
1171             *aa32_vfp_dreg(env, i / 2) = dn;
1172         }
1173         fpscr = cpu_ldl_mmu(env, fptr + 0x40, oi, ra);
1174         vfp_set_fpscr(env, fpscr);
1175         if (cpu_isar_feature(aa32_mve, cpu)) {
1176             env->v7m.vpr = cpu_ldl_mmu(env, fptr + 0x44, oi, ra);
1177         }
1178     }
1179 
1180     env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
1181 }
1182 
1183 static bool v7m_push_stack(ARMCPU *cpu)
1184 {
1185     /*
1186      * Do the "set up stack frame" part of exception entry,
1187      * similar to pseudocode PushStack().
1188      * Return true if we generate a derived exception (and so
1189      * should ignore further stack faults trying to process
1190      * that derived exception.)
1191      */
1192     bool stacked_ok = true, limitviol = false;
1193     CPUARMState *env = &cpu->env;
1194     uint32_t xpsr = xpsr_read(env);
1195     uint32_t frameptr = env->regs[13];
1196     ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1197     uint32_t framesize;
1198     bool nsacr_cp10 = extract32(env->v7m.nsacr, 10, 1);
1199 
1200     if ((env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) &&
1201         (env->v7m.secure || nsacr_cp10)) {
1202         if (env->v7m.secure &&
1203             env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK) {
1204             framesize = 0xa8;
1205         } else {
1206             framesize = 0x68;
1207         }
1208     } else {
1209         framesize = 0x20;
1210     }
1211 
1212     /* Align stack pointer if the guest wants that */
1213     if ((frameptr & 4) &&
1214         (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) {
1215         frameptr -= 4;
1216         xpsr |= XPSR_SPREALIGN;
1217     }
1218 
1219     xpsr &= ~XPSR_SFPA;
1220     if (env->v7m.secure &&
1221         (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1222         xpsr |= XPSR_SFPA;
1223     }
1224 
1225     frameptr -= framesize;
1226 
1227     if (arm_feature(env, ARM_FEATURE_V8)) {
1228         uint32_t limit = v7m_sp_limit(env);
1229 
1230         if (frameptr < limit) {
1231             /*
1232              * Stack limit failure: set SP to the limit value, and generate
1233              * STKOF UsageFault. Stack pushes below the limit must not be
1234              * performed. It is IMPDEF whether pushes above the limit are
1235              * performed; we choose not to.
1236              */
1237             qemu_log_mask(CPU_LOG_INT,
1238                           "...STKOF during stacking\n");
1239             env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
1240             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1241                                     env->v7m.secure);
1242             env->regs[13] = limit;
1243             /*
1244              * We won't try to perform any further memory accesses but
1245              * we must continue through the following code to check for
1246              * permission faults during FPU state preservation, and we
1247              * must update FPCCR if lazy stacking is enabled.
1248              */
1249             limitviol = true;
1250             stacked_ok = false;
1251         }
1252     }
1253 
1254     /*
1255      * Write as much of the stack frame as we can. If we fail a stack
1256      * write this will result in a derived exception being pended
1257      * (which may be taken in preference to the one we started with
1258      * if it has higher priority).
1259      */
1260     stacked_ok = stacked_ok &&
1261         v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, STACK_NORMAL) &&
1262         v7m_stack_write(cpu, frameptr + 4, env->regs[1],
1263                         mmu_idx, STACK_NORMAL) &&
1264         v7m_stack_write(cpu, frameptr + 8, env->regs[2],
1265                         mmu_idx, STACK_NORMAL) &&
1266         v7m_stack_write(cpu, frameptr + 12, env->regs[3],
1267                         mmu_idx, STACK_NORMAL) &&
1268         v7m_stack_write(cpu, frameptr + 16, env->regs[12],
1269                         mmu_idx, STACK_NORMAL) &&
1270         v7m_stack_write(cpu, frameptr + 20, env->regs[14],
1271                         mmu_idx, STACK_NORMAL) &&
1272         v7m_stack_write(cpu, frameptr + 24, env->regs[15],
1273                         mmu_idx, STACK_NORMAL) &&
1274         v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, STACK_NORMAL);
1275 
1276     if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) {
1277         /* FPU is active, try to save its registers */
1278         bool fpccr_s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1279         bool lspact = env->v7m.fpccr[fpccr_s] & R_V7M_FPCCR_LSPACT_MASK;
1280 
1281         if (lspact && arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1282             qemu_log_mask(CPU_LOG_INT,
1283                           "...SecureFault because LSPACT and FPCA both set\n");
1284             env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1285             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1286         } else if (!env->v7m.secure && !nsacr_cp10) {
1287             qemu_log_mask(CPU_LOG_INT,
1288                           "...Secure UsageFault with CFSR.NOCP because "
1289                           "NSACR.CP10 prevents stacking FP regs\n");
1290             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
1291             env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1292         } else {
1293             if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1294                 /* Lazy stacking disabled, save registers now */
1295                 int i;
1296                 bool cpacr_pass = v7m_cpacr_pass(env, env->v7m.secure,
1297                                                  arm_current_el(env) != 0);
1298 
1299                 if (stacked_ok && !cpacr_pass) {
1300                     /*
1301                      * Take UsageFault if CPACR forbids access. The pseudocode
1302                      * here does a full CheckCPEnabled() but we know the NSACR
1303                      * check can never fail as we have already handled that.
1304                      */
1305                     qemu_log_mask(CPU_LOG_INT,
1306                                   "...UsageFault with CFSR.NOCP because "
1307                                   "CPACR.CP10 prevents stacking FP regs\n");
1308                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1309                                             env->v7m.secure);
1310                     env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK;
1311                     stacked_ok = false;
1312                 }
1313 
1314                 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1315                     uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1316                     uint32_t faddr = frameptr + 0x20 + 4 * i;
1317                     uint32_t slo = extract64(dn, 0, 32);
1318                     uint32_t shi = extract64(dn, 32, 32);
1319 
1320                     if (i >= 16) {
1321                         faddr += 8; /* skip the slot for the FPSCR and VPR */
1322                     }
1323                     stacked_ok = stacked_ok &&
1324                         v7m_stack_write(cpu, faddr, slo,
1325                                         mmu_idx, STACK_NORMAL) &&
1326                         v7m_stack_write(cpu, faddr + 4, shi,
1327                                         mmu_idx, STACK_NORMAL);
1328                 }
1329                 stacked_ok = stacked_ok &&
1330                     v7m_stack_write(cpu, frameptr + 0x60,
1331                                     vfp_get_fpscr(env), mmu_idx, STACK_NORMAL);
1332                 if (cpu_isar_feature(aa32_mve, cpu)) {
1333                     stacked_ok = stacked_ok &&
1334                         v7m_stack_write(cpu, frameptr + 0x64,
1335                                         env->v7m.vpr, mmu_idx, STACK_NORMAL);
1336                 }
1337                 if (cpacr_pass) {
1338                     for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1339                         *aa32_vfp_dreg(env, i / 2) = 0;
1340                     }
1341                     vfp_set_fpscr(env, 0);
1342                     if (cpu_isar_feature(aa32_mve, cpu)) {
1343                         env->v7m.vpr = 0;
1344                     }
1345                 }
1346             } else {
1347                 /* Lazy stacking enabled, save necessary info to stack later */
1348                 v7m_update_fpccr(env, frameptr + 0x20, true);
1349             }
1350         }
1351     }
1352 
1353     /*
1354      * If we broke a stack limit then SP was already updated earlier;
1355      * otherwise we update SP regardless of whether any of the stack
1356      * accesses failed or we took some other kind of fault.
1357      */
1358     if (!limitviol) {
1359         env->regs[13] = frameptr;
1360     }
1361 
1362     return !stacked_ok;
1363 }
1364 
1365 static void do_v7m_exception_exit(ARMCPU *cpu)
1366 {
1367     CPUARMState *env = &cpu->env;
1368     uint32_t excret;
1369     uint32_t xpsr, xpsr_mask;
1370     bool ufault = false;
1371     bool sfault = false;
1372     bool return_to_sp_process;
1373     bool return_to_handler;
1374     bool rettobase = false;
1375     bool exc_secure = false;
1376     bool return_to_secure;
1377     bool ftype;
1378     bool restore_s16_s31 = false;
1379 
1380     /*
1381      * If we're not in Handler mode then jumps to magic exception-exit
1382      * addresses don't have magic behaviour. However for the v8M
1383      * security extensions the magic secure-function-return has to
1384      * work in thread mode too, so to avoid doing an extra check in
1385      * the generated code we allow exception-exit magic to also cause the
1386      * internal exception and bring us here in thread mode. Correct code
1387      * will never try to do this (the following insn fetch will always
1388      * fault) so we the overhead of having taken an unnecessary exception
1389      * doesn't matter.
1390      */
1391     if (!arm_v7m_is_handler_mode(env)) {
1392         return;
1393     }
1394 
1395     /*
1396      * In the spec pseudocode ExceptionReturn() is called directly
1397      * from BXWritePC() and gets the full target PC value including
1398      * bit zero. In QEMU's implementation we treat it as a normal
1399      * jump-to-register (which is then caught later on), and so split
1400      * the target value up between env->regs[15] and env->thumb in
1401      * gen_bx(). Reconstitute it.
1402      */
1403     excret = env->regs[15];
1404     if (env->thumb) {
1405         excret |= 1;
1406     }
1407 
1408     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
1409                   " previous exception %d\n",
1410                   excret, env->v7m.exception);
1411 
1412     if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
1413         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
1414                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
1415                       excret);
1416     }
1417 
1418     ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
1419 
1420     if (!ftype && !cpu_isar_feature(aa32_vfp_simd, cpu)) {
1421         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
1422                       "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
1423                       "if FPU not present\n",
1424                       excret);
1425         ftype = true;
1426     }
1427 
1428     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1429         /*
1430          * EXC_RETURN.ES validation check (R_SMFL). We must do this before
1431          * we pick which FAULTMASK to clear.
1432          */
1433         if (!env->v7m.secure &&
1434             ((excret & R_V7M_EXCRET_ES_MASK) ||
1435              !(excret & R_V7M_EXCRET_DCRS_MASK))) {
1436             sfault = 1;
1437             /* For all other purposes, treat ES as 0 (R_HXSR) */
1438             excret &= ~R_V7M_EXCRET_ES_MASK;
1439         }
1440         exc_secure = excret & R_V7M_EXCRET_ES_MASK;
1441     }
1442 
1443     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
1444         /*
1445          * Auto-clear FAULTMASK on return from other than NMI.
1446          * If the security extension is implemented then this only
1447          * happens if the raw execution priority is >= 0; the
1448          * value of the ES bit in the exception return value indicates
1449          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
1450          */
1451         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1452             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
1453                 env->v7m.faultmask[exc_secure] = 0;
1454             }
1455         } else {
1456             env->v7m.faultmask[M_REG_NS] = 0;
1457         }
1458     }
1459 
1460     switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception,
1461                                      exc_secure)) {
1462     case -1:
1463         /* attempt to exit an exception that isn't active */
1464         ufault = true;
1465         break;
1466     case 0:
1467         /* still an irq active now */
1468         break;
1469     case 1:
1470         /*
1471          * We returned to base exception level, no nesting.
1472          * (In the pseudocode this is written using "NestedActivation != 1"
1473          * where we have 'rettobase == false'.)
1474          */
1475         rettobase = true;
1476         break;
1477     default:
1478         g_assert_not_reached();
1479     }
1480 
1481     return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
1482     return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
1483     return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
1484         (excret & R_V7M_EXCRET_S_MASK);
1485 
1486     if (arm_feature(env, ARM_FEATURE_V8)) {
1487         if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1488             /*
1489              * UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
1490              * we choose to take the UsageFault.
1491              */
1492             if ((excret & R_V7M_EXCRET_S_MASK) ||
1493                 (excret & R_V7M_EXCRET_ES_MASK) ||
1494                 !(excret & R_V7M_EXCRET_DCRS_MASK)) {
1495                 ufault = true;
1496             }
1497         }
1498         if (excret & R_V7M_EXCRET_RES0_MASK) {
1499             ufault = true;
1500         }
1501     } else {
1502         /* For v7M we only recognize certain combinations of the low bits */
1503         switch (excret & 0xf) {
1504         case 1: /* Return to Handler */
1505             break;
1506         case 13: /* Return to Thread using Process stack */
1507         case 9: /* Return to Thread using Main stack */
1508             /*
1509              * We only need to check NONBASETHRDENA for v7M, because in
1510              * v8M this bit does not exist (it is RES1).
1511              */
1512             if (!rettobase &&
1513                 !(env->v7m.ccr[env->v7m.secure] &
1514                   R_V7M_CCR_NONBASETHRDENA_MASK)) {
1515                 ufault = true;
1516             }
1517             break;
1518         default:
1519             ufault = true;
1520         }
1521     }
1522 
1523     /*
1524      * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
1525      * Handler mode (and will be until we write the new XPSR.Interrupt
1526      * field) this does not switch around the current stack pointer.
1527      * We must do this before we do any kind of tailchaining, including
1528      * for the derived exceptions on integrity check failures, or we will
1529      * give the guest an incorrect EXCRET.SPSEL value on exception entry.
1530      */
1531     write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
1532 
1533     /*
1534      * Clear scratch FP values left in caller saved registers; this
1535      * must happen before any kind of tail chaining.
1536      */
1537     if ((env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_CLRONRET_MASK) &&
1538         (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
1539         if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1540             env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1541             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1542             qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1543                           "stackframe: error during lazy state deactivation\n");
1544             v7m_exception_taken(cpu, excret, true, false);
1545             return;
1546         } else {
1547             if (arm_feature(env, ARM_FEATURE_V8_1M)) {
1548                 /* v8.1M adds this NOCP check */
1549                 bool nsacr_pass = exc_secure ||
1550                     extract32(env->v7m.nsacr, 10, 1);
1551                 bool cpacr_pass = v7m_cpacr_pass(env, exc_secure, true);
1552                 if (!nsacr_pass) {
1553                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1554                     env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1555                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1556                         "stackframe: NSACR prevents clearing FPU registers\n");
1557                     v7m_exception_taken(cpu, excret, true, false);
1558                     return;
1559                 } else if (!cpacr_pass) {
1560                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1561                                             exc_secure);
1562                     env->v7m.cfsr[exc_secure] |= R_V7M_CFSR_NOCP_MASK;
1563                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1564                         "stackframe: CPACR prevents clearing FPU registers\n");
1565                     v7m_exception_taken(cpu, excret, true, false);
1566                     return;
1567                 }
1568             }
1569             /* Clear s0..s15, FPSCR and VPR */
1570             int i;
1571 
1572             for (i = 0; i < 16; i += 2) {
1573                 *aa32_vfp_dreg(env, i / 2) = 0;
1574             }
1575             vfp_set_fpscr(env, 0);
1576             if (cpu_isar_feature(aa32_mve, cpu)) {
1577                 env->v7m.vpr = 0;
1578             }
1579         }
1580     }
1581 
1582     if (sfault) {
1583         env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
1584         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1585         qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1586                       "stackframe: failed EXC_RETURN.ES validity check\n");
1587         v7m_exception_taken(cpu, excret, true, false);
1588         return;
1589     }
1590 
1591     if (ufault) {
1592         /*
1593          * Bad exception return: instead of popping the exception
1594          * stack, directly take a usage fault on the current stack.
1595          */
1596         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1597         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1598         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1599                       "stackframe: failed exception return integrity check\n");
1600         v7m_exception_taken(cpu, excret, true, false);
1601         return;
1602     }
1603 
1604     /*
1605      * Tailchaining: if there is currently a pending exception that
1606      * is high enough priority to preempt execution at the level we're
1607      * about to return to, then just directly take that exception now,
1608      * avoiding an unstack-and-then-stack. Note that now we have
1609      * deactivated the previous exception by calling armv7m_nvic_complete_irq()
1610      * our current execution priority is already the execution priority we are
1611      * returning to -- none of the state we would unstack or set based on
1612      * the EXCRET value affects it.
1613      */
1614     if (armv7m_nvic_can_take_pending_exception(env->nvic)) {
1615         qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n");
1616         v7m_exception_taken(cpu, excret, true, false);
1617         return;
1618     }
1619 
1620     switch_v7m_security_state(env, return_to_secure);
1621 
1622     {
1623         /*
1624          * The stack pointer we should be reading the exception frame from
1625          * depends on bits in the magic exception return type value (and
1626          * for v8M isn't necessarily the stack pointer we will eventually
1627          * end up resuming execution with). Get a pointer to the location
1628          * in the CPU state struct where the SP we need is currently being
1629          * stored; we will use and modify it in place.
1630          * We use this limited C variable scope so we don't accidentally
1631          * use 'frame_sp_p' after we do something that makes it invalid.
1632          */
1633         bool spsel = env->v7m.control[return_to_secure] & R_V7M_CONTROL_SPSEL_MASK;
1634         uint32_t *frame_sp_p = arm_v7m_get_sp_ptr(env, return_to_secure,
1635                                                   !return_to_handler, spsel);
1636         uint32_t frameptr = *frame_sp_p;
1637         bool pop_ok = true;
1638         ARMMMUIdx mmu_idx;
1639         bool return_to_priv = return_to_handler ||
1640             !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK);
1641 
1642         mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure,
1643                                                         return_to_priv);
1644 
1645         if (!QEMU_IS_ALIGNED(frameptr, 8) &&
1646             arm_feature(env, ARM_FEATURE_V8)) {
1647             qemu_log_mask(LOG_GUEST_ERROR,
1648                           "M profile exception return with non-8-aligned SP "
1649                           "for destination state is UNPREDICTABLE\n");
1650         }
1651 
1652         /* Do we need to pop callee-saved registers? */
1653         if (return_to_secure &&
1654             ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
1655              (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
1656             uint32_t actual_sig;
1657 
1658             pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
1659 
1660             if (pop_ok && v7m_integrity_sig(env, excret) != actual_sig) {
1661                 /* Take a SecureFault on the current stack */
1662                 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
1663                 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1664                 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1665                               "stackframe: failed exception return integrity "
1666                               "signature check\n");
1667                 v7m_exception_taken(cpu, excret, true, false);
1668                 return;
1669             }
1670 
1671             pop_ok = pop_ok &&
1672                 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
1673                 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
1674                 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) &&
1675                 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) &&
1676                 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) &&
1677                 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) &&
1678                 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) &&
1679                 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx);
1680 
1681             frameptr += 0x28;
1682         }
1683 
1684         /* Pop registers */
1685         pop_ok = pop_ok &&
1686             v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) &&
1687             v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) &&
1688             v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) &&
1689             v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) &&
1690             v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) &&
1691             v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) &&
1692             v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) &&
1693             v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx);
1694 
1695         if (!pop_ok) {
1696             /*
1697              * v7m_stack_read() pended a fault, so take it (as a tail
1698              * chained exception on the same stack frame)
1699              */
1700             qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n");
1701             v7m_exception_taken(cpu, excret, true, false);
1702             return;
1703         }
1704 
1705         /*
1706          * Returning from an exception with a PC with bit 0 set is defined
1707          * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
1708          * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
1709          * the lsbit, and there are several RTOSes out there which incorrectly
1710          * assume the r15 in the stack frame should be a Thumb-style "lsbit
1711          * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
1712          * complain about the badly behaved guest.
1713          */
1714         if (env->regs[15] & 1) {
1715             env->regs[15] &= ~1U;
1716             if (!arm_feature(env, ARM_FEATURE_V8)) {
1717                 qemu_log_mask(LOG_GUEST_ERROR,
1718                               "M profile return from interrupt with misaligned "
1719                               "PC is UNPREDICTABLE on v7M\n");
1720             }
1721         }
1722 
1723         if (arm_feature(env, ARM_FEATURE_V8)) {
1724             /*
1725              * For v8M we have to check whether the xPSR exception field
1726              * matches the EXCRET value for return to handler/thread
1727              * before we commit to changing the SP and xPSR.
1728              */
1729             bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
1730             if (return_to_handler != will_be_handler) {
1731                 /*
1732                  * Take an INVPC UsageFault on the current stack.
1733                  * By this point we will have switched to the security state
1734                  * for the background state, so this UsageFault will target
1735                  * that state.
1736                  */
1737                 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1738                                         env->v7m.secure);
1739                 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1740                 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1741                               "stackframe: failed exception return integrity "
1742                               "check\n");
1743                 v7m_exception_taken(cpu, excret, true, false);
1744                 return;
1745             }
1746         }
1747 
1748         if (!ftype) {
1749             /* FP present and we need to handle it */
1750             if (!return_to_secure &&
1751                 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK)) {
1752                 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1753                 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1754                 qemu_log_mask(CPU_LOG_INT,
1755                               "...taking SecureFault on existing stackframe: "
1756                               "Secure LSPACT set but exception return is "
1757                               "not to secure state\n");
1758                 v7m_exception_taken(cpu, excret, true, false);
1759                 return;
1760             }
1761 
1762             restore_s16_s31 = return_to_secure &&
1763                 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
1764 
1765             if (env->v7m.fpccr[return_to_secure] & R_V7M_FPCCR_LSPACT_MASK) {
1766                 /* State in FPU is still valid, just clear LSPACT */
1767                 env->v7m.fpccr[return_to_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
1768             } else {
1769                 int i;
1770                 uint32_t fpscr;
1771                 bool cpacr_pass, nsacr_pass;
1772 
1773                 cpacr_pass = v7m_cpacr_pass(env, return_to_secure,
1774                                             return_to_priv);
1775                 nsacr_pass = return_to_secure ||
1776                     extract32(env->v7m.nsacr, 10, 1);
1777 
1778                 if (!cpacr_pass) {
1779                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1780                                             return_to_secure);
1781                     env->v7m.cfsr[return_to_secure] |= R_V7M_CFSR_NOCP_MASK;
1782                     qemu_log_mask(CPU_LOG_INT,
1783                                   "...taking UsageFault on existing "
1784                                   "stackframe: CPACR.CP10 prevents unstacking "
1785                                   "FP regs\n");
1786                     v7m_exception_taken(cpu, excret, true, false);
1787                     return;
1788                 } else if (!nsacr_pass) {
1789                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1790                     env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_INVPC_MASK;
1791                     qemu_log_mask(CPU_LOG_INT,
1792                                   "...taking Secure UsageFault on existing "
1793                                   "stackframe: NSACR.CP10 prevents unstacking "
1794                                   "FP regs\n");
1795                     v7m_exception_taken(cpu, excret, true, false);
1796                     return;
1797                 }
1798 
1799                 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1800                     uint32_t slo, shi;
1801                     uint64_t dn;
1802                     uint32_t faddr = frameptr + 0x20 + 4 * i;
1803 
1804                     if (i >= 16) {
1805                         faddr += 8; /* Skip the slot for the FPSCR and VPR */
1806                     }
1807 
1808                     pop_ok = pop_ok &&
1809                         v7m_stack_read(cpu, &slo, faddr, mmu_idx) &&
1810                         v7m_stack_read(cpu, &shi, faddr + 4, mmu_idx);
1811 
1812                     if (!pop_ok) {
1813                         break;
1814                     }
1815 
1816                     dn = (uint64_t)shi << 32 | slo;
1817                     *aa32_vfp_dreg(env, i / 2) = dn;
1818                 }
1819                 pop_ok = pop_ok &&
1820                     v7m_stack_read(cpu, &fpscr, frameptr + 0x60, mmu_idx);
1821                 if (pop_ok) {
1822                     vfp_set_fpscr(env, fpscr);
1823                 }
1824                 if (cpu_isar_feature(aa32_mve, cpu)) {
1825                     pop_ok = pop_ok &&
1826                         v7m_stack_read(cpu, &env->v7m.vpr,
1827                                        frameptr + 0x64, mmu_idx);
1828                 }
1829                 if (!pop_ok) {
1830                     /*
1831                      * These regs are 0 if security extension present;
1832                      * otherwise merely UNKNOWN. We zero always.
1833                      */
1834                     for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1835                         *aa32_vfp_dreg(env, i / 2) = 0;
1836                     }
1837                     vfp_set_fpscr(env, 0);
1838                     if (cpu_isar_feature(aa32_mve, cpu)) {
1839                         env->v7m.vpr = 0;
1840                     }
1841                 }
1842             }
1843         }
1844         env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1845                                                V7M_CONTROL, FPCA, !ftype);
1846 
1847         /* Commit to consuming the stack frame */
1848         frameptr += 0x20;
1849         if (!ftype) {
1850             frameptr += 0x48;
1851             if (restore_s16_s31) {
1852                 frameptr += 0x40;
1853             }
1854         }
1855         /*
1856          * Undo stack alignment (the SPREALIGN bit indicates that the original
1857          * pre-exception SP was not 8-aligned and we added a padding word to
1858          * align it, so we undo this by ORing in the bit that increases it
1859          * from the current 8-aligned value to the 8-unaligned value. (Adding 4
1860          * would work too but a logical OR is how the pseudocode specifies it.)
1861          */
1862         if (xpsr & XPSR_SPREALIGN) {
1863             frameptr |= 4;
1864         }
1865         *frame_sp_p = frameptr;
1866     }
1867 
1868     xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
1869     if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
1870         xpsr_mask &= ~XPSR_GE;
1871     }
1872     /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
1873     xpsr_write(env, xpsr, xpsr_mask);
1874 
1875     if (env->v7m.secure) {
1876         bool sfpa = xpsr & XPSR_SFPA;
1877 
1878         env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1879                                                V7M_CONTROL, SFPA, sfpa);
1880     }
1881 
1882     /*
1883      * The restored xPSR exception field will be zero if we're
1884      * resuming in Thread mode. If that doesn't match what the
1885      * exception return excret specified then this is a UsageFault.
1886      * v7M requires we make this check here; v8M did it earlier.
1887      */
1888     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
1889         /*
1890          * Take an INVPC UsageFault by pushing the stack again;
1891          * we know we're v7M so this is never a Secure UsageFault.
1892          */
1893         bool ignore_stackfaults;
1894 
1895         assert(!arm_feature(env, ARM_FEATURE_V8));
1896         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
1897         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1898         ignore_stackfaults = v7m_push_stack(cpu);
1899         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
1900                       "failed exception return integrity check\n");
1901         v7m_exception_taken(cpu, excret, false, ignore_stackfaults);
1902         return;
1903     }
1904 
1905     /* Otherwise, we have a successful exception exit. */
1906     arm_clear_exclusive(env);
1907     arm_rebuild_hflags(env);
1908     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
1909 }
1910 
1911 static bool do_v7m_function_return(ARMCPU *cpu)
1912 {
1913     /*
1914      * v8M security extensions magic function return.
1915      * We may either:
1916      *  (1) throw an exception (longjump)
1917      *  (2) return true if we successfully handled the function return
1918      *  (3) return false if we failed a consistency check and have
1919      *      pended a UsageFault that needs to be taken now
1920      *
1921      * At this point the magic return value is split between env->regs[15]
1922      * and env->thumb. We don't bother to reconstitute it because we don't
1923      * need it (all values are handled the same way).
1924      */
1925     CPUARMState *env = &cpu->env;
1926     uint32_t newpc, newpsr, newpsr_exc;
1927 
1928     qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
1929 
1930     {
1931         bool threadmode, spsel;
1932         MemOpIdx oi;
1933         ARMMMUIdx mmu_idx;
1934         uint32_t *frame_sp_p;
1935         uint32_t frameptr;
1936 
1937         /* Pull the return address and IPSR from the Secure stack */
1938         threadmode = !arm_v7m_is_handler_mode(env);
1939         spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
1940 
1941         frame_sp_p = arm_v7m_get_sp_ptr(env, true, threadmode, spsel);
1942         frameptr = *frame_sp_p;
1943 
1944         /*
1945          * These loads may throw an exception (for MPU faults). We want to
1946          * do them as secure, so work out what MMU index that is.
1947          */
1948         mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1949         oi = make_memop_idx(MO_LEUL | MO_ALIGN, arm_to_core_mmu_idx(mmu_idx));
1950         newpc = cpu_ldl_mmu(env, frameptr, oi, 0);
1951         newpsr = cpu_ldl_mmu(env, frameptr + 4, oi, 0);
1952 
1953         /* Consistency checks on new IPSR */
1954         newpsr_exc = newpsr & XPSR_EXCP;
1955         if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
1956               (env->v7m.exception == 1 && newpsr_exc != 0))) {
1957             /* Pend the fault and tell our caller to take it */
1958             env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1959             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1960                                     env->v7m.secure);
1961             qemu_log_mask(CPU_LOG_INT,
1962                           "...taking INVPC UsageFault: "
1963                           "IPSR consistency check failed\n");
1964             return false;
1965         }
1966 
1967         *frame_sp_p = frameptr + 8;
1968     }
1969 
1970     /* This invalidates frame_sp_p */
1971     switch_v7m_security_state(env, true);
1972     env->v7m.exception = newpsr_exc;
1973     env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1974     if (newpsr & XPSR_SFPA) {
1975         env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
1976     }
1977     xpsr_write(env, 0, XPSR_IT);
1978     env->thumb = newpc & 1;
1979     env->regs[15] = newpc & ~1;
1980     arm_rebuild_hflags(env);
1981 
1982     qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
1983     return true;
1984 }
1985 
1986 static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, bool secure,
1987                                uint32_t addr, uint16_t *insn)
1988 {
1989     /*
1990      * Load a 16-bit portion of a v7M instruction, returning true on success,
1991      * or false on failure (in which case we will have pended the appropriate
1992      * exception).
1993      * We need to do the instruction fetch's MPU and SAU checks
1994      * like this because there is no MMU index that would allow
1995      * doing the load with a single function call. Instead we must
1996      * first check that the security attributes permit the load
1997      * and that they don't mismatch on the two halves of the instruction,
1998      * and then we do the load as a secure load (ie using the security
1999      * attributes of the address, not the CPU, as architecturally required).
2000      */
2001     CPUState *cs = CPU(cpu);
2002     CPUARMState *env = &cpu->env;
2003     V8M_SAttributes sattrs = {};
2004     GetPhysAddrResult res = {};
2005     ARMMMUFaultInfo fi = {};
2006     MemTxResult txres;
2007 
2008     v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, secure, &sattrs);
2009     if (!sattrs.nsc || sattrs.ns) {
2010         /*
2011          * This must be the second half of the insn, and it straddles a
2012          * region boundary with the second half not being S&NSC.
2013          */
2014         env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2015         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2016         qemu_log_mask(CPU_LOG_INT,
2017                       "...really SecureFault with SFSR.INVEP\n");
2018         return false;
2019     }
2020     if (get_phys_addr(env, addr, MMU_INST_FETCH, 0, mmu_idx, &res, &fi)) {
2021         /* the MPU lookup failed */
2022         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2023         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
2024         qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
2025         return false;
2026     }
2027     *insn = address_space_lduw_le(arm_addressspace(cs, res.f.attrs),
2028                                   res.f.phys_addr, res.f.attrs, &txres);
2029     if (txres != MEMTX_OK) {
2030         env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2031         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2032         qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
2033         return false;
2034     }
2035     return true;
2036 }
2037 
2038 static bool v7m_read_sg_stack_word(ARMCPU *cpu, ARMMMUIdx mmu_idx,
2039                                    uint32_t addr, uint32_t *spdata)
2040 {
2041     /*
2042      * Read a word of data from the stack for the SG instruction,
2043      * writing the value into *spdata. If the load succeeds, return
2044      * true; otherwise pend an appropriate exception and return false.
2045      * (We can't use data load helpers here that throw an exception
2046      * because of the context we're called in, which is halfway through
2047      * arm_v7m_cpu_do_interrupt().)
2048      */
2049     CPUState *cs = CPU(cpu);
2050     CPUARMState *env = &cpu->env;
2051     MemTxResult txres;
2052     GetPhysAddrResult res = {};
2053     ARMMMUFaultInfo fi = {};
2054     uint32_t value;
2055 
2056     if (get_phys_addr(env, addr, MMU_DATA_LOAD, 0, mmu_idx, &res, &fi)) {
2057         /* MPU/SAU lookup failed */
2058         if (fi.type == ARMFault_QEMU_SFault) {
2059             qemu_log_mask(CPU_LOG_INT,
2060                           "...SecureFault during stack word read\n");
2061             env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
2062             env->v7m.sfar = addr;
2063             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2064         } else {
2065             qemu_log_mask(CPU_LOG_INT,
2066                           "...MemManageFault during stack word read\n");
2067             env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_DACCVIOL_MASK |
2068                 R_V7M_CFSR_MMARVALID_MASK;
2069             env->v7m.mmfar[M_REG_S] = addr;
2070             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, false);
2071         }
2072         return false;
2073     }
2074     value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
2075                               res.f.phys_addr, res.f.attrs, &txres);
2076     if (txres != MEMTX_OK) {
2077         /* BusFault trying to read the data */
2078         qemu_log_mask(CPU_LOG_INT,
2079                       "...BusFault during stack word read\n");
2080         env->v7m.cfsr[M_REG_NS] |=
2081             (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2082         env->v7m.bfar = addr;
2083         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2084         return false;
2085     }
2086 
2087     *spdata = value;
2088     return true;
2089 }
2090 
2091 static bool v7m_handle_execute_nsc(ARMCPU *cpu)
2092 {
2093     /*
2094      * Check whether this attempt to execute code in a Secure & NS-Callable
2095      * memory region is for an SG instruction; if so, then emulate the
2096      * effect of the SG instruction and return true. Otherwise pend
2097      * the correct kind of exception and return false.
2098      */
2099     CPUARMState *env = &cpu->env;
2100     ARMMMUIdx mmu_idx;
2101     uint16_t insn;
2102 
2103     /*
2104      * We should never get here unless get_phys_addr_pmsav8() caused
2105      * an exception for NS executing in S&NSC memory.
2106      */
2107     assert(!env->v7m.secure);
2108     assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2109 
2110     /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
2111     mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
2112 
2113     if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15], &insn)) {
2114         return false;
2115     }
2116 
2117     if (!env->thumb) {
2118         goto gen_invep;
2119     }
2120 
2121     if (insn != 0xe97f) {
2122         /*
2123          * Not an SG instruction first half (we choose the IMPDEF
2124          * early-SG-check option).
2125          */
2126         goto gen_invep;
2127     }
2128 
2129     if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15] + 2, &insn)) {
2130         return false;
2131     }
2132 
2133     if (insn != 0xe97f) {
2134         /*
2135          * Not an SG instruction second half (yes, both halves of the SG
2136          * insn have the same hex value)
2137          */
2138         goto gen_invep;
2139     }
2140 
2141     /*
2142      * OK, we have confirmed that we really have an SG instruction.
2143      * We know we're NS in S memory so don't need to repeat those checks.
2144      */
2145     qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
2146                   ", executing it\n", env->regs[15]);
2147 
2148     if (cpu_isar_feature(aa32_m_sec_state, cpu) &&
2149         !arm_v7m_is_handler_mode(env)) {
2150         /*
2151          * v8.1M exception stack frame integrity check. Note that we
2152          * must perform the memory access even if CCR_S.TRD is zero
2153          * and we aren't going to check what the data loaded is.
2154          */
2155         uint32_t spdata, sp;
2156 
2157         /*
2158          * We know we are currently NS, so the S stack pointers must be
2159          * in other_ss_{psp,msp}, not in regs[13]/other_sp.
2160          */
2161         sp = v7m_using_psp(env) ? env->v7m.other_ss_psp : env->v7m.other_ss_msp;
2162         if (!v7m_read_sg_stack_word(cpu, mmu_idx, sp, &spdata)) {
2163             /* Stack access failed and an exception has been pended */
2164             return false;
2165         }
2166 
2167         if (env->v7m.ccr[M_REG_S] & R_V7M_CCR_TRD_MASK) {
2168             if (((spdata & ~1) == 0xfefa125a) ||
2169                 !(env->v7m.control[M_REG_S] & 1)) {
2170                 goto gen_invep;
2171             }
2172         }
2173     }
2174 
2175     env->regs[14] &= ~1;
2176     env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2177     switch_v7m_security_state(env, true);
2178     xpsr_write(env, 0, XPSR_IT);
2179     env->regs[15] += 4;
2180     arm_rebuild_hflags(env);
2181     return true;
2182 
2183 gen_invep:
2184     env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2185     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2186     qemu_log_mask(CPU_LOG_INT,
2187                   "...really SecureFault with SFSR.INVEP\n");
2188     return false;
2189 }
2190 
2191 void arm_v7m_cpu_do_interrupt(CPUState *cs)
2192 {
2193     ARMCPU *cpu = ARM_CPU(cs);
2194     CPUARMState *env = &cpu->env;
2195     uint32_t lr;
2196     bool ignore_stackfaults;
2197 
2198     arm_log_exception(cs);
2199 
2200     /*
2201      * For exceptions we just mark as pending on the NVIC, and let that
2202      * handle it.
2203      */
2204     switch (cs->exception_index) {
2205     case EXCP_UDEF:
2206         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2207         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK;
2208         break;
2209     case EXCP_NOCP:
2210     {
2211         /*
2212          * NOCP might be directed to something other than the current
2213          * security state if this fault is because of NSACR; we indicate
2214          * the target security state using exception.target_el.
2215          */
2216         int target_secstate;
2217 
2218         if (env->exception.target_el == 3) {
2219             target_secstate = M_REG_S;
2220         } else {
2221             target_secstate = env->v7m.secure;
2222         }
2223         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, target_secstate);
2224         env->v7m.cfsr[target_secstate] |= R_V7M_CFSR_NOCP_MASK;
2225         break;
2226     }
2227     case EXCP_INVSTATE:
2228         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2229         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK;
2230         break;
2231     case EXCP_STKOF:
2232         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2233         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
2234         break;
2235     case EXCP_LSERR:
2236         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2237         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
2238         break;
2239     case EXCP_UNALIGNED:
2240         /* Unaligned faults reported by M-profile aware code */
2241         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2242         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2243         break;
2244     case EXCP_DIVBYZERO:
2245         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2246         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_DIVBYZERO_MASK;
2247         break;
2248     case EXCP_SWI:
2249         /* The PC already points to the next instruction.  */
2250         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure);
2251         break;
2252     case EXCP_PREFETCH_ABORT:
2253     case EXCP_DATA_ABORT:
2254         /*
2255          * Note that for M profile we don't have a guest facing FSR, but
2256          * the env->exception.fsr will be populated by the code that
2257          * raises the fault, in the A profile short-descriptor format.
2258          *
2259          * Log the exception.vaddress now regardless of subtype, because
2260          * logging below only logs it when it goes into a guest visible
2261          * register.
2262          */
2263         qemu_log_mask(CPU_LOG_INT, "...at fault address 0x%x\n",
2264                       (uint32_t)env->exception.vaddress);
2265         switch (env->exception.fsr & 0xf) {
2266         case M_FAKE_FSR_NSC_EXEC:
2267             /*
2268              * Exception generated when we try to execute code at an address
2269              * which is marked as Secure & Non-Secure Callable and the CPU
2270              * is in the Non-Secure state. The only instruction which can
2271              * be executed like this is SG (and that only if both halves of
2272              * the SG instruction have the same security attributes.)
2273              * Everything else must generate an INVEP SecureFault, so we
2274              * emulate the SG instruction here.
2275              */
2276             if (v7m_handle_execute_nsc(cpu)) {
2277                 return;
2278             }
2279             break;
2280         case M_FAKE_FSR_SFAULT:
2281             /*
2282              * Various flavours of SecureFault for attempts to execute or
2283              * access data in the wrong security state.
2284              */
2285             switch (cs->exception_index) {
2286             case EXCP_PREFETCH_ABORT:
2287                 if (env->v7m.secure) {
2288                     env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
2289                     qemu_log_mask(CPU_LOG_INT,
2290                                   "...really SecureFault with SFSR.INVTRAN\n");
2291                 } else {
2292                     env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2293                     qemu_log_mask(CPU_LOG_INT,
2294                                   "...really SecureFault with SFSR.INVEP\n");
2295                 }
2296                 break;
2297             case EXCP_DATA_ABORT:
2298                 /* This must be an NS access to S memory */
2299                 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
2300                 qemu_log_mask(CPU_LOG_INT,
2301                               "...really SecureFault with SFSR.AUVIOL\n");
2302                 break;
2303             }
2304             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2305             break;
2306         case 0x8: /* External Abort */
2307             switch (cs->exception_index) {
2308             case EXCP_PREFETCH_ABORT:
2309                 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2310                 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
2311                 break;
2312             case EXCP_DATA_ABORT:
2313                 env->v7m.cfsr[M_REG_NS] |=
2314                     (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2315                 env->v7m.bfar = env->exception.vaddress;
2316                 qemu_log_mask(CPU_LOG_INT,
2317                               "...with CFSR.PRECISERR and BFAR 0x%x\n",
2318                               env->v7m.bfar);
2319                 break;
2320             }
2321             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2322             break;
2323         case 0x1: /* Alignment fault reported by generic code */
2324             qemu_log_mask(CPU_LOG_INT,
2325                           "...really UsageFault with UFSR.UNALIGNED\n");
2326             env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2327             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
2328                                     env->v7m.secure);
2329             break;
2330         default:
2331             /*
2332              * All other FSR values are either MPU faults or "can't happen
2333              * for M profile" cases.
2334              */
2335             switch (cs->exception_index) {
2336             case EXCP_PREFETCH_ABORT:
2337                 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2338                 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
2339                 break;
2340             case EXCP_DATA_ABORT:
2341                 env->v7m.cfsr[env->v7m.secure] |=
2342                     (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
2343                 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress;
2344                 qemu_log_mask(CPU_LOG_INT,
2345                               "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
2346                               env->v7m.mmfar[env->v7m.secure]);
2347                 break;
2348             }
2349             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM,
2350                                     env->v7m.secure);
2351             break;
2352         }
2353         break;
2354     case EXCP_SEMIHOST:
2355         qemu_log_mask(CPU_LOG_INT,
2356                       "...handling as semihosting call 0x%x\n",
2357                       env->regs[0]);
2358 #ifdef CONFIG_TCG
2359         do_common_semihosting(cs);
2360 #else
2361         g_assert_not_reached();
2362 #endif
2363         env->regs[15] += env->thumb ? 2 : 4;
2364         return;
2365     case EXCP_BKPT:
2366         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
2367         break;
2368     case EXCP_IRQ:
2369         break;
2370     case EXCP_EXCEPTION_EXIT:
2371         if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
2372             /* Must be v8M security extension function return */
2373             assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
2374             assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2375             if (do_v7m_function_return(cpu)) {
2376                 return;
2377             }
2378         } else {
2379             do_v7m_exception_exit(cpu);
2380             return;
2381         }
2382         break;
2383     case EXCP_LAZYFP:
2384         /*
2385          * We already pended the specific exception in the NVIC in the
2386          * v7m_preserve_fp_state() helper function.
2387          */
2388         break;
2389     default:
2390         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
2391         return; /* Never happens.  Keep compiler happy.  */
2392     }
2393 
2394     if (arm_feature(env, ARM_FEATURE_V8)) {
2395         lr = R_V7M_EXCRET_RES1_MASK |
2396             R_V7M_EXCRET_DCRS_MASK;
2397         /*
2398          * The S bit indicates whether we should return to Secure
2399          * or NonSecure (ie our current state).
2400          * The ES bit indicates whether we're taking this exception
2401          * to Secure or NonSecure (ie our target state). We set it
2402          * later, in v7m_exception_taken().
2403          * The SPSEL bit is also set in v7m_exception_taken() for v8M.
2404          * This corresponds to the ARM ARM pseudocode for v8M setting
2405          * some LR bits in PushStack() and some in ExceptionTaken();
2406          * the distinction matters for the tailchain cases where we
2407          * can take an exception without pushing the stack.
2408          */
2409         if (env->v7m.secure) {
2410             lr |= R_V7M_EXCRET_S_MASK;
2411         }
2412     } else {
2413         lr = R_V7M_EXCRET_RES1_MASK |
2414             R_V7M_EXCRET_S_MASK |
2415             R_V7M_EXCRET_DCRS_MASK |
2416             R_V7M_EXCRET_ES_MASK;
2417         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
2418             lr |= R_V7M_EXCRET_SPSEL_MASK;
2419         }
2420     }
2421     if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
2422         lr |= R_V7M_EXCRET_FTYPE_MASK;
2423     }
2424     if (!arm_v7m_is_handler_mode(env)) {
2425         lr |= R_V7M_EXCRET_MODE_MASK;
2426     }
2427 
2428     ignore_stackfaults = v7m_push_stack(cpu);
2429     v7m_exception_taken(cpu, lr, false, ignore_stackfaults);
2430 }
2431 
2432 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
2433 {
2434     unsigned el = arm_current_el(env);
2435 
2436     /* First handle registers which unprivileged can read */
2437     switch (reg) {
2438     case 0 ... 7: /* xPSR sub-fields */
2439         return v7m_mrs_xpsr(env, reg, el);
2440     case 20: /* CONTROL */
2441         return arm_v7m_mrs_control(env, env->v7m.secure);
2442     case 0x94: /* CONTROL_NS */
2443         /*
2444          * We have to handle this here because unprivileged Secure code
2445          * can read the NS CONTROL register.
2446          */
2447         if (!env->v7m.secure) {
2448             return 0;
2449         }
2450         return env->v7m.control[M_REG_NS] |
2451             (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK);
2452     }
2453 
2454     if (el == 0) {
2455         return 0; /* unprivileged reads others as zero */
2456     }
2457 
2458     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2459         switch (reg) {
2460         case 0x88: /* MSP_NS */
2461             if (!env->v7m.secure) {
2462                 return 0;
2463             }
2464             return env->v7m.other_ss_msp;
2465         case 0x89: /* PSP_NS */
2466             if (!env->v7m.secure) {
2467                 return 0;
2468             }
2469             return env->v7m.other_ss_psp;
2470         case 0x8a: /* MSPLIM_NS */
2471             if (!env->v7m.secure) {
2472                 return 0;
2473             }
2474             return env->v7m.msplim[M_REG_NS];
2475         case 0x8b: /* PSPLIM_NS */
2476             if (!env->v7m.secure) {
2477                 return 0;
2478             }
2479             return env->v7m.psplim[M_REG_NS];
2480         case 0x90: /* PRIMASK_NS */
2481             if (!env->v7m.secure) {
2482                 return 0;
2483             }
2484             return env->v7m.primask[M_REG_NS];
2485         case 0x91: /* BASEPRI_NS */
2486             if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2487                 goto bad_reg;
2488             }
2489             if (!env->v7m.secure) {
2490                 return 0;
2491             }
2492             return env->v7m.basepri[M_REG_NS];
2493         case 0x93: /* FAULTMASK_NS */
2494             if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2495                 goto bad_reg;
2496             }
2497             if (!env->v7m.secure) {
2498                 return 0;
2499             }
2500             return env->v7m.faultmask[M_REG_NS];
2501         case 0x98: /* SP_NS */
2502         {
2503             /*
2504              * This gives the non-secure SP selected based on whether we're
2505              * currently in handler mode or not, using the NS CONTROL.SPSEL.
2506              */
2507             bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2508 
2509             if (!env->v7m.secure) {
2510                 return 0;
2511             }
2512             if (!arm_v7m_is_handler_mode(env) && spsel) {
2513                 return env->v7m.other_ss_psp;
2514             } else {
2515                 return env->v7m.other_ss_msp;
2516             }
2517         }
2518         default:
2519             break;
2520         }
2521     }
2522 
2523     switch (reg) {
2524     case 8: /* MSP */
2525         return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
2526     case 9: /* PSP */
2527         return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
2528     case 10: /* MSPLIM */
2529         if (!arm_feature(env, ARM_FEATURE_V8)) {
2530             goto bad_reg;
2531         }
2532         return env->v7m.msplim[env->v7m.secure];
2533     case 11: /* PSPLIM */
2534         if (!arm_feature(env, ARM_FEATURE_V8)) {
2535             goto bad_reg;
2536         }
2537         return env->v7m.psplim[env->v7m.secure];
2538     case 16: /* PRIMASK */
2539         return env->v7m.primask[env->v7m.secure];
2540     case 17: /* BASEPRI */
2541     case 18: /* BASEPRI_MAX */
2542         if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2543             goto bad_reg;
2544         }
2545         return env->v7m.basepri[env->v7m.secure];
2546     case 19: /* FAULTMASK */
2547         if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2548             goto bad_reg;
2549         }
2550         return env->v7m.faultmask[env->v7m.secure];
2551     default:
2552     bad_reg:
2553         qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
2554                                        " register %d\n", reg);
2555         return 0;
2556     }
2557 }
2558 
2559 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
2560 {
2561     /*
2562      * We're passed bits [11..0] of the instruction; extract
2563      * SYSm and the mask bits.
2564      * Invalid combinations of SYSm and mask are UNPREDICTABLE;
2565      * we choose to treat them as if the mask bits were valid.
2566      * NB that the pseudocode 'mask' variable is bits [11..10],
2567      * whereas ours is [11..8].
2568      */
2569     uint32_t mask = extract32(maskreg, 8, 4);
2570     uint32_t reg = extract32(maskreg, 0, 8);
2571     int cur_el = arm_current_el(env);
2572 
2573     if (cur_el == 0 && reg > 7 && reg != 20) {
2574         /*
2575          * only xPSR sub-fields and CONTROL.SFPA may be written by
2576          * unprivileged code
2577          */
2578         return;
2579     }
2580 
2581     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2582         switch (reg) {
2583         case 0x88: /* MSP_NS */
2584             if (!env->v7m.secure) {
2585                 return;
2586             }
2587             env->v7m.other_ss_msp = val & ~3;
2588             return;
2589         case 0x89: /* PSP_NS */
2590             if (!env->v7m.secure) {
2591                 return;
2592             }
2593             env->v7m.other_ss_psp = val & ~3;
2594             return;
2595         case 0x8a: /* MSPLIM_NS */
2596             if (!env->v7m.secure) {
2597                 return;
2598             }
2599             env->v7m.msplim[M_REG_NS] = val & ~7;
2600             return;
2601         case 0x8b: /* PSPLIM_NS */
2602             if (!env->v7m.secure) {
2603                 return;
2604             }
2605             env->v7m.psplim[M_REG_NS] = val & ~7;
2606             return;
2607         case 0x90: /* PRIMASK_NS */
2608             if (!env->v7m.secure) {
2609                 return;
2610             }
2611             env->v7m.primask[M_REG_NS] = val & 1;
2612             return;
2613         case 0x91: /* BASEPRI_NS */
2614             if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2615                 goto bad_reg;
2616             }
2617             if (!env->v7m.secure) {
2618                 return;
2619             }
2620             env->v7m.basepri[M_REG_NS] = val & 0xff;
2621             return;
2622         case 0x93: /* FAULTMASK_NS */
2623             if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2624                 goto bad_reg;
2625             }
2626             if (!env->v7m.secure) {
2627                 return;
2628             }
2629             env->v7m.faultmask[M_REG_NS] = val & 1;
2630             return;
2631         case 0x94: /* CONTROL_NS */
2632             if (!env->v7m.secure) {
2633                 return;
2634             }
2635             write_v7m_control_spsel_for_secstate(env,
2636                                                  val & R_V7M_CONTROL_SPSEL_MASK,
2637                                                  M_REG_NS);
2638             if (arm_feature(env, ARM_FEATURE_M_MAIN)) {
2639                 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
2640                 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
2641             }
2642             /*
2643              * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0,
2644              * RES0 if the FPU is not present, and is stored in the S bank
2645              */
2646             if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env)) &&
2647                 extract32(env->v7m.nsacr, 10, 1)) {
2648                 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2649                 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2650             }
2651             return;
2652         case 0x98: /* SP_NS */
2653         {
2654             /*
2655              * This gives the non-secure SP selected based on whether we're
2656              * currently in handler mode or not, using the NS CONTROL.SPSEL.
2657              */
2658             bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2659             bool is_psp = !arm_v7m_is_handler_mode(env) && spsel;
2660             uint32_t limit;
2661 
2662             if (!env->v7m.secure) {
2663                 return;
2664             }
2665 
2666             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
2667 
2668             val &= ~0x3;
2669 
2670             if (val < limit) {
2671                 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
2672             }
2673 
2674             if (is_psp) {
2675                 env->v7m.other_ss_psp = val;
2676             } else {
2677                 env->v7m.other_ss_msp = val;
2678             }
2679             return;
2680         }
2681         default:
2682             break;
2683         }
2684     }
2685 
2686     switch (reg) {
2687     case 0 ... 7: /* xPSR sub-fields */
2688         v7m_msr_xpsr(env, mask, reg, val);
2689         break;
2690     case 8: /* MSP */
2691         if (v7m_using_psp(env)) {
2692             env->v7m.other_sp = val & ~3;
2693         } else {
2694             env->regs[13] = val & ~3;
2695         }
2696         break;
2697     case 9: /* PSP */
2698         if (v7m_using_psp(env)) {
2699             env->regs[13] = val & ~3;
2700         } else {
2701             env->v7m.other_sp = val & ~3;
2702         }
2703         break;
2704     case 10: /* MSPLIM */
2705         if (!arm_feature(env, ARM_FEATURE_V8)) {
2706             goto bad_reg;
2707         }
2708         env->v7m.msplim[env->v7m.secure] = val & ~7;
2709         break;
2710     case 11: /* PSPLIM */
2711         if (!arm_feature(env, ARM_FEATURE_V8)) {
2712             goto bad_reg;
2713         }
2714         env->v7m.psplim[env->v7m.secure] = val & ~7;
2715         break;
2716     case 16: /* PRIMASK */
2717         env->v7m.primask[env->v7m.secure] = val & 1;
2718         break;
2719     case 17: /* BASEPRI */
2720         if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2721             goto bad_reg;
2722         }
2723         env->v7m.basepri[env->v7m.secure] = val & 0xff;
2724         break;
2725     case 18: /* BASEPRI_MAX */
2726         if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2727             goto bad_reg;
2728         }
2729         val &= 0xff;
2730         if (val != 0 && (val < env->v7m.basepri[env->v7m.secure]
2731                          || env->v7m.basepri[env->v7m.secure] == 0)) {
2732             env->v7m.basepri[env->v7m.secure] = val;
2733         }
2734         break;
2735     case 19: /* FAULTMASK */
2736         if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2737             goto bad_reg;
2738         }
2739         env->v7m.faultmask[env->v7m.secure] = val & 1;
2740         break;
2741     case 20: /* CONTROL */
2742         /*
2743          * Writing to the SPSEL bit only has an effect if we are in
2744          * thread mode; other bits can be updated by any privileged code.
2745          * write_v7m_control_spsel() deals with updating the SPSEL bit in
2746          * env->v7m.control, so we only need update the others.
2747          * For v7M, we must just ignore explicit writes to SPSEL in handler
2748          * mode; for v8M the write is permitted but will have no effect.
2749          * All these bits are writes-ignored from non-privileged code,
2750          * except for SFPA.
2751          */
2752         if (cur_el > 0 && (arm_feature(env, ARM_FEATURE_V8) ||
2753                            !arm_v7m_is_handler_mode(env))) {
2754             write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
2755         }
2756         if (cur_el > 0 && arm_feature(env, ARM_FEATURE_M_MAIN)) {
2757             env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
2758             env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
2759         }
2760         if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
2761             /*
2762              * SFPA is RAZ/WI from NS or if no FPU.
2763              * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present.
2764              * Both are stored in the S bank.
2765              */
2766             if (env->v7m.secure) {
2767                 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2768                 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_SFPA_MASK;
2769             }
2770             if (cur_el > 0 &&
2771                 (env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_SECURITY) ||
2772                  extract32(env->v7m.nsacr, 10, 1))) {
2773                 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2774                 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2775             }
2776         }
2777         break;
2778     default:
2779     bad_reg:
2780         qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
2781                                        " register %d\n", reg);
2782         return;
2783     }
2784 }
2785 
2786 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
2787 {
2788     /* Implement the TT instruction. op is bits [7:6] of the insn. */
2789     bool forceunpriv = op & 1;
2790     bool alt = op & 2;
2791     V8M_SAttributes sattrs = {};
2792     uint32_t tt_resp;
2793     bool r, rw, nsr, nsrw, mrvalid;
2794     ARMMMUIdx mmu_idx;
2795     uint32_t mregion;
2796     bool targetpriv;
2797     bool targetsec = env->v7m.secure;
2798 
2799     /*
2800      * Work out what the security state and privilege level we're
2801      * interested in is...
2802      */
2803     if (alt) {
2804         targetsec = !targetsec;
2805     }
2806 
2807     if (forceunpriv) {
2808         targetpriv = false;
2809     } else {
2810         targetpriv = arm_v7m_is_handler_mode(env) ||
2811             !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK);
2812     }
2813 
2814     /* ...and then figure out which MMU index this is */
2815     mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv);
2816 
2817     /*
2818      * We know that the MPU and SAU don't care about the access type
2819      * for our purposes beyond that we don't want to claim to be
2820      * an insn fetch, so we arbitrarily call this a read.
2821      */
2822 
2823     /*
2824      * MPU region info only available for privileged or if
2825      * inspecting the other MPU state.
2826      */
2827     if (arm_current_el(env) != 0 || alt) {
2828         GetPhysAddrResult res = {};
2829         ARMMMUFaultInfo fi = {};
2830 
2831         /* We can ignore the return value as prot is always set */
2832         pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, targetsec,
2833                           &res, &fi, &mregion);
2834         if (mregion == -1) {
2835             mrvalid = false;
2836             mregion = 0;
2837         } else {
2838             mrvalid = true;
2839         }
2840         r = res.f.prot & PAGE_READ;
2841         rw = res.f.prot & PAGE_WRITE;
2842     } else {
2843         r = false;
2844         rw = false;
2845         mrvalid = false;
2846         mregion = 0;
2847     }
2848 
2849     if (env->v7m.secure) {
2850         v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
2851                             targetsec, &sattrs);
2852         nsr = sattrs.ns && r;
2853         nsrw = sattrs.ns && rw;
2854     } else {
2855         sattrs.ns = true;
2856         nsr = false;
2857         nsrw = false;
2858     }
2859 
2860     tt_resp = (sattrs.iregion << 24) |
2861         (sattrs.irvalid << 23) |
2862         ((!sattrs.ns) << 22) |
2863         (nsrw << 21) |
2864         (nsr << 20) |
2865         (rw << 19) |
2866         (r << 18) |
2867         (sattrs.srvalid << 17) |
2868         (mrvalid << 16) |
2869         (sattrs.sregion << 8) |
2870         mregion;
2871 
2872     return tt_resp;
2873 }
2874 
2875 #endif /* !CONFIG_USER_ONLY */
2876 
2877 uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
2878                              bool spsel)
2879 {
2880     /*
2881      * Return a pointer to the location where we currently store the
2882      * stack pointer for the requested security state and thread mode.
2883      * This pointer will become invalid if the CPU state is updated
2884      * such that the stack pointers are switched around (eg changing
2885      * the SPSEL control bit).
2886      * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
2887      * Unlike that pseudocode, we require the caller to pass us in the
2888      * SPSEL control bit value; this is because we also use this
2889      * function in handling of pushing of the callee-saves registers
2890      * part of the v8M stack frame (pseudocode PushCalleeStack()),
2891      * and in the tailchain codepath the SPSEL bit comes from the exception
2892      * return magic LR value from the previous exception. The pseudocode
2893      * opencodes the stack-selection in PushCalleeStack(), but we prefer
2894      * to make this utility function generic enough to do the job.
2895      */
2896     bool want_psp = threadmode && spsel;
2897 
2898     if (secure == env->v7m.secure) {
2899         if (want_psp == v7m_using_psp(env)) {
2900             return &env->regs[13];
2901         } else {
2902             return &env->v7m.other_sp;
2903         }
2904     } else {
2905         if (want_psp) {
2906             return &env->v7m.other_ss_psp;
2907         } else {
2908             return &env->v7m.other_ss_msp;
2909         }
2910     }
2911 }
2912