[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 03/14] target/arm: Enforce that M-profile SP low 2 bits are always
From: |
Peter Maydell |
Subject: |
[PULL 03/14] target/arm: Enforce that M-profile SP low 2 bits are always zero |
Date: |
Tue, 27 Jul 2021 11:47:50 +0100 |
For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
RES0H, which is to say that they must be hardwired to zero so that
guest attempts to write non-zero values to them are ignored.
Implement this behaviour by masking out the low bits:
* for writes to r13 by the gdbstub
* for writes to any of the various flavours of SP via MSR
* for writes to r13 via store_reg() in generated code
Note that all the direct uses of cpu_R[] in translate.c are in places
where the register is definitely not r13 (usually because that has
been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
UNDEF).
All the other writes to regs[13] in C code are either:
* A-profile only code
* writes of values we can guarantee to be aligned, such as
- writes of previous-SP-value plus or minus a 4-aligned constant
- writes of the value in an SP limit register (which we already
enforce to be aligned)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
---
target/arm/gdbstub.c | 4 ++++
target/arm/m_helper.c | 14 ++++++++------
target/arm/translate.c | 3 +++
3 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index a8fff2a3d09..826601b3415 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -84,6 +84,10 @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t
*mem_buf, int n)
if (n < 16) {
/* Core integer register. */
+ if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
+ /* M profile SP low bits are always 0 */
+ tmp &= ~3;
+ }
env->regs[n] = tmp;
return 4;
}
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index 7a1e35ab5b6..f9a9cb466c9 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -2563,13 +2563,13 @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t
maskreg, uint32_t val)
if (!env->v7m.secure) {
return;
}
- env->v7m.other_ss_msp = val;
+ env->v7m.other_ss_msp = val & ~3;
return;
case 0x89: /* PSP_NS */
if (!env->v7m.secure) {
return;
}
- env->v7m.other_ss_psp = val;
+ env->v7m.other_ss_psp = val & ~3;
return;
case 0x8a: /* MSPLIM_NS */
if (!env->v7m.secure) {
@@ -2638,6 +2638,8 @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg,
uint32_t val)
limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
+ val &= ~0x3;
+
if (val < limit) {
raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
}
@@ -2660,16 +2662,16 @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t
maskreg, uint32_t val)
break;
case 8: /* MSP */
if (v7m_using_psp(env)) {
- env->v7m.other_sp = val;
+ env->v7m.other_sp = val & ~3;
} else {
- env->regs[13] = val;
+ env->regs[13] = val & ~3;
}
break;
case 9: /* PSP */
if (v7m_using_psp(env)) {
- env->regs[13] = val;
+ env->regs[13] = val & ~3;
} else {
- env->v7m.other_sp = val;
+ env->v7m.other_sp = val & ~3;
}
break;
case 10: /* MSPLIM */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index 351afa43a29..80c282669f0 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -291,6 +291,9 @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
*/
tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
s->base.is_jmp = DISAS_JUMP;
+ } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
+ /* For M-profile SP bits [1:0] are always zero */
+ tcg_gen_andi_i32(var, var, ~3);
}
tcg_gen_mov_i32(cpu_R[reg], var);
tcg_temp_free_i32(var);
--
2.20.1
- [PULL 00/14] target-arm queue, Peter Maydell, 2021/07/27
- [PULL 01/14] hw/arm/smmuv3: Check 31st bit to see if CD is valid, Peter Maydell, 2021/07/27
- [PULL 04/14] target/arm: Add missing 'return's after calling v7m_exception_taken(), Peter Maydell, 2021/07/27
- [PULL 03/14] target/arm: Enforce that M-profile SP low 2 bits are always zero,
Peter Maydell <=
- [PULL 02/14] qemu-options.hx: Fix formatting of -machine memory-backend option, Peter Maydell, 2021/07/27
- [PULL 07/14] hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING, Peter Maydell, 2021/07/27
- [PULL 06/14] hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts, Peter Maydell, 2021/07/27
- [PULL 05/14] target/arm: Report M-profile alignment faults correctly to the guest, Peter Maydell, 2021/07/27
- [PULL 11/14] target/arm: Export aarch64_sve_zcr_get_valid_len, Peter Maydell, 2021/07/27
- [PULL 09/14] docs: Update path that mentions deprecated.rst, Peter Maydell, 2021/07/27
- [PULL 10/14] target/arm: Correctly bound length in sve_zcr_get_valid_len, Peter Maydell, 2021/07/27
- [PULL 12/14] target/arm: Add sve-default-vector-length cpu property, Peter Maydell, 2021/07/27
- [PULL 13/14] hw/arm/nseries: Display hexadecimal value with '0x' prefix, Peter Maydell, 2021/07/27
- [PULL 08/14] hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS, Peter Maydell, 2021/07/27