qemu/target/arm
Peter Maydell 3bb8a96f53 arm: Implement M profile exception return properly
On M profile, return from exceptions happen when code in Handler mode
executes one of the following function call return instructions:
 * POP or LDM which loads the PC
 * LDR to PC
 * BX register
and the new PC value is 0xFFxxxxxx.

QEMU tries to implement this by not treating the instruction
specially but then catching the attempt to execute from the magic
address value.  This is not ideal, because:
 * there are guest visible differences from the architecturally
   specified behaviour (for instance jumping to 0xFFxxxxxx via a
   different instruction should not cause an exception return but it
   will in the QEMU implementation)
 * we have to account for it in various places (like refusing to take
   an interrupt if the PC is at a magic value, and making sure that
   the MPU doesn't deny execution at the magic value addresses)

Drop these hacks, and instead implement exception return the way the
architecture specifies -- by having the relevant instructions check
for the magic value and raise the 'do an exception return' QEMU
internal exception immediately.

The effect on the generated code is minor:

 bx lr, old code (and new code for Thread mode):
  TCG:
   mov_i32 tmp5,r14
   movi_i32 tmp6,$0xfffffffffffffffe
   and_i32 pc,tmp5,tmp6
   movi_i32 tmp6,$0x1
   and_i32 tmp5,tmp5,tmp6
   st_i32 tmp5,env,$0x218
   exit_tb $0x0
   set_label $L0
   exit_tb $0x7f2aabd61993
  x86_64 generated code:
   0x7f2aabe87019:  mov    %ebx,%ebp
   0x7f2aabe8701b:  and    $0xfffffffffffffffe,%ebp
   0x7f2aabe8701e:  mov    %ebp,0x3c(%r14)
   0x7f2aabe87022:  and    $0x1,%ebx
   0x7f2aabe87025:  mov    %ebx,0x218(%r14)
   0x7f2aabe8702c:  xor    %eax,%eax
   0x7f2aabe8702e:  jmpq   0x7f2aabe7c016

 bx lr, new code when in Handler mode:
  TCG:
   mov_i32 tmp5,r14
   movi_i32 tmp6,$0xfffffffffffffffe
   and_i32 pc,tmp5,tmp6
   movi_i32 tmp6,$0x1
   and_i32 tmp5,tmp5,tmp6
   st_i32 tmp5,env,$0x218
   movi_i32 tmp5,$0xffffffffff000000
   brcond_i32 pc,tmp5,geu,$L1
   exit_tb $0x0
   set_label $L1
   movi_i32 tmp5,$0x8
   call exception_internal,$0x0,$0,env,tmp5
  x86_64 generated code:
   0x7fe8fa1264e3:  mov    %ebp,%ebx
   0x7fe8fa1264e5:  and    $0xfffffffffffffffe,%ebx
   0x7fe8fa1264e8:  mov    %ebx,0x3c(%r14)
   0x7fe8fa1264ec:  and    $0x1,%ebp
   0x7fe8fa1264ef:  mov    %ebp,0x218(%r14)
   0x7fe8fa1264f6:  cmp    $0xff000000,%ebx
   0x7fe8fa1264fc:  jae    0x7fe8fa126509
   0x7fe8fa126502:  xor    %eax,%eax
   0x7fe8fa126504:  jmpq   0x7fe8fa122016
   0x7fe8fa126509:  mov    %r14,%rdi
   0x7fe8fa12650c:  mov    $0x8,%esi
   0x7fe8fa126511:  mov    $0x56095dbeccf5,%r10
   0x7fe8fa12651b:  callq  *%r10

which is a difference of one cmp/branch-not-taken. This will
be lost in the noise of having to exit generated code and
look up the next TB anyway.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1491844419-12485-9-git-send-email-peter.maydell@linaro.org
2017-04-20 17:39:17 +01:00
..
arch_dump.c
arm_ldst.h Fix Thumb-1 BE32 execution and disassembly. 2017-02-07 18:29:59 +00:00
arm-powerctl.c target-arm/powerctl: defer cpu reset work to CPU context 2017-02-24 10:32:46 +00:00
arm-powerctl.h target-arm/powerctl: defer cpu reset work to CPU context 2017-02-24 10:32:46 +00:00
arm-semi.c
cpu64.c target-arm: Enable EL2 feature bit on A53 and A57 2017-01-20 11:15:10 +00:00
cpu-qom.h
cpu.c armv7m: Fix condition check for taking exceptions 2017-02-28 12:08:17 +00:00
cpu.h arm: Track M profile handler mode state in TB flags 2017-04-20 17:39:17 +01:00
crypto_helper.c
gdbstub64.c
gdbstub.c
helper-a64.c target-arm: Use clrsb helper 2017-01-10 08:47:48 -08:00
helper-a64.h target-arm: Use clrsb helper 2017-01-10 08:47:48 -08:00
helper.c arm: Move excnames[] array into arm_log_exceptions() 2017-04-20 17:39:17 +01:00
helper.h target-arm: Use clz opcode 2017-01-10 08:06:11 -08:00
internals.h arm: Move excnames[] array into arm_log_exceptions() 2017-04-20 17:39:17 +01:00
iwmmxt_helper.c
kvm32.c
kvm64.c arm/kvm: Remove trailing newlines from error_report() 2017-04-20 17:39:17 +01:00
kvm_arm.h
kvm-consts.h arm: add trailing ; after MISMATCH_CHECK 2017-02-01 03:37:18 +02:00
kvm-stub.c
kvm.c KVM: do not use sigtimedwait to catch SIGBUS 2017-03-03 16:40:02 +01:00
machine.c target-arm/powerctl: defer cpu reset work to CPU context 2017-02-24 10:32:46 +00:00
Makefile.objs
monitor.c
neon_helper.c
op_addsub.h
op_helper.c target/arm: Add assertion about FSC format for syndrome registers 2017-04-20 17:39:17 +01:00
psci.c target-arm/powerctl: defer cpu reset work to CPU context 2017-02-24 10:32:46 +00:00
trace-events
translate-a64.c Add missing fp_access_check() to aarch64 crypto instructions 2017-02-28 12:08:15 +00:00
translate.c arm: Implement M profile exception return properly 2017-04-20 17:39:17 +01:00
translate.h arm: Implement M profile exception return properly 2017-04-20 17:39:17 +01:00