target/arm: Add v8M stack limit checks on NS function calls

qemu/aarch64.h

@@ -4255,6 +4255,7 @@
 #define new_tmp_a64 new_tmp_a64_aarch64
 #define new_tmp_a64_zero new_tmp_a64_zero_aarch64
 #define pred_esz_masks pred_esz_masks_aarch64
+#define raise_exception raise_exception_aarch64
 #define read_cpu_reg read_cpu_reg_aarch64
 #define read_cpu_reg_sp read_cpu_reg_sp_aarch64
 #define sve_access_check sve_access_check_aarch64

qemu/aarch64eb.h

@@ -4255,6 +4255,7 @@
 #define new_tmp_a64 new_tmp_a64_aarch64eb
 #define new_tmp_a64_zero new_tmp_a64_zero_aarch64eb
 #define pred_esz_masks pred_esz_masks_aarch64eb
+#define raise_exception raise_exception_aarch64eb
 #define read_cpu_reg read_cpu_reg_aarch64eb
 #define read_cpu_reg_sp read_cpu_reg_sp_aarch64eb
 #define sve_access_check sve_access_check_aarch64eb

qemu/arm.h

@@ -3276,6 +3276,7 @@
 #define arm_set_cpu_off arm_set_cpu_off_arm
 #define arm_set_cpu_on arm_set_cpu_on_arm
 #define fp_exception_el fp_exception_el_arm
+#define raise_exception raise_exception_arm
 #define sve_exception_el sve_exception_el_arm
 #define sve_zcr_len_for_el sve_zcr_len_for_el_arm
 #endif

qemu/armeb.h

@@ -3276,6 +3276,7 @@
 #define arm_set_cpu_off arm_set_cpu_off_armeb
 #define arm_set_cpu_on arm_set_cpu_on_armeb
 #define fp_exception_el fp_exception_el_armeb
+#define raise_exception raise_exception_armeb
 #define sve_exception_el sve_exception_el_armeb
 #define sve_zcr_len_for_el sve_zcr_len_for_el_armeb
 #endif

qemu/header_gen.py

@@ -3285,6 +3285,7 @@ arm_symbols = (
     'arm_set_cpu_off',
     'arm_set_cpu_on',
     'fp_exception_el',
+    'raise_exception',
     'sve_exception_el',
     'sve_zcr_len_for_el',
 )
@@ -4279,6 +4280,7 @@ aarch64_symbols = (
     'new_tmp_a64',
     'new_tmp_a64_zero',
     'pred_esz_masks',
+    'raise_exception',
     'read_cpu_reg',
     'read_cpu_reg_sp',
     'sve_access_check',

qemu/target/arm/helper.c

@@ -5925,6 +5925,10 @@ void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
                       "BLXNS with misaligned SP is UNPREDICTABLE\n");
     }
 
+    if (sp < v7m_sp_limit(env)) {
+        raise_exception(env, EXCP_STKOF, 0, 1);
+    }
+
     saved_psr = env->v7m.exception;
     if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
         saved_psr |= XPSR_SFPA;

qemu/target/arm/internals.h

@@ -94,6 +94,15 @@ FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
 #define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
 #define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
 
+/**
+ * raise_exception: Raise the specified exception.
+ * Raise a guest exception with the specified value, syndrome register
+ * and target exception level. This should be called from helper functions,
+ * and never returns because we will longjump back up to the CPU main loop.
+ */
+void QEMU_NORETURN raise_exception(CPUARMState *env, uint32_t excp,
+                                   uint32_t syndrome, uint32_t target_el);
+
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
  * Note that this mapping and the AArch32 mapping defined in bank_number()

qemu/target/arm/op_helper.c

@@ -27,8 +27,8 @@
 #define SIGNBIT (uint32_t)0x80000000
 #define SIGNBIT64 ((uint64_t)1 << 63)
 
-static void raise_exception(CPUARMState *env, uint32_t excp,
+void raise_exception(CPUARMState *env, uint32_t excp,
-                            uint32_t syndrome, uint32_t target_el)
+                     uint32_t syndrome, uint32_t target_el)
 {
     CPUState *cs = CPU(arm_env_get_cpu(env));