QEMU Abort in Cortex-M Exception raising Description of problem: When an exception should be raised in a ARM Cortex-M board QEMU aborts. ``` $ qemu-system-arm --version QEMU emulator version 8.0.2 $ qemu-system-arm -M stm32vldiscovery -device loader,file=/tmp/raw-hardfault.hex -d in_asm,exec,int [...] Trace 0: 0x7f2aa8000680 [00800400/00000110/00000110/ff200000] ---------------- IN: 0x00000140: f64b 6eef movw lr, #0xbeef 0x00000144: f6cd 6ead movt lr, #0xdead 0x00000148: 4770 bx lr Linking TBs 0x7f2aa8000680 index 0 -> 0x7f2aa80007c0 Trace 0: 0x7f2aa80007c0 [00800400/00000140/00000110/ff200000] qemu-system-arm: ../qemu-8.0.2/target/arm/cpu.h:2396: arm_is_secure_below_el3: Assertion `!arm_feature(env, ARM_FEATURE_M)' failed. ``` Expected behavior: ``` $ qemu-system-arm --version QEMU emulator version 7.1.0 $ qemu-system-arm -M stm32vldiscovery -device loader,file=raw-hardfault.hex -d in_asm,exec,int [...] Trace 0: 0x7fb488000680 [00800400/00000110/00000110/ff000000] ---------------- IN: 0x00000140: f64b 6eef movw lr, #0xbeef 0x00000144: f6cd 6ead movt lr, #0xdead 0x00000148: 4770 bx lr Linking TBs 0x7fb488000680 [00000110] index 0 -> 0x7fb488000780 [00000140] Trace 0: 0x7fb488000780 [00800400/00000140/00000110/ff000000] Taking exception 3 [Prefetch Abort] on CPU 0 ...at fault address 0xdeadbeee ...with CFSR.IACCVIOL ...BusFault with BFSR.STKERR ...taking pending nonsecure exception 3 ...loading from element 3 of non-secure vector table at 0xc ...loaded new PC 0x0 ``` Steps to reproduce: 1. Run any Cortex-M firmware that raises an exception. (minimal example attached) Additional information: - Minimal Reproducer: [raw-hardfault.hex](/uploads/113889116675b608e05748280d1db354/raw-hardfault.hex) - Assert introduced in fcc7404eff24b4c8b322fb27ca5ae7f3113129c3. - Stacktrace: ``` #4 0x00007ffff6a483d6 in __assert_fail () from /usr/lib/libc.so.6 #5 0x00007ffff73afe67 in arm_is_secure_below_el3 (env=0x55555712f9b0) at target/arm/cpu.h:2396 #6 0x00007ffff73afedd in arm_is_el2_enabled (env=0x55555712f9b0) at target/arm/cpu.h:2448 #7 0x00007ffff73afcd4 in arm_el_is_aa64 (env=0x55555712f9b0, el=0x1) at target/arm/cpu.h:2509 #8 0x00007ffff73af68f in compute_fsr_fsc (env=0x55555712f9b0, fi=0x7fffffff7098, target_el=0x1, mmu_idx=0x1, ret_fsc=0x7fffffff6fe0) at target/arm/tcg/tlb_helper.c:71 #9 0x00007ffff73af483 in arm_deliver_fault (cpu=0x55555712d250, addr=0xdeadbeee, access_type=MMU_INST_FETCH, mmu_idx=0x1, fi=0x7fffffff7098) at target/arm/tcg/tlb_helper.c:114 #10 0x00007ffff73afa4c in arm_cpu_tlb_fill (cs=0x55555712d250, address=0xdeadbeee, size=0x1, access_type=MMU_INST_FETCH, mmu_idx=0x1, probe=0x0, retaddr=0x0) at target/arm/tcg/tlb_helper.c:242 #11 0x00007ffff74a3a1e in probe_access_internal (env=0x55555712f9b0, addr=0xdeadbeee, fault_size=0x1, access_type=MMU_INST_FETCH, mmu_idx=0x1, nonfault=0x0, phost=0x7fffffff71c8, pfull=0x7fffffff71d0, retaddr=0x0) at accel/tcg/cputlb.c:1555 #12 0x00007ffff74a4085 in get_page_addr_code_hostp (env=0x55555712f9b0, addr=0xdeadbeee, hostp=0x0) at accel/tcg/cputlb.c:1694 #13 0x00007ffff7490c0f in get_page_addr_code (env=0x55555712f9b0, addr=0xdeadbeee) at include/exec/exec-all.h:748 #14 0x00007ffff7490b2a in tb_htable_lookup (cpu=0x55555712d250, pc=0xdeadbeee, cs_base=0x800408, flags=0x110, cflags=0xff200200) at accel/tcg/cpu-exec.c:233 #15 0x00007ffff748f719 in tb_lookup (cpu=0x55555712d250, pc=0xdeadbeee, cs_base=0x800408, flags=0x110, cflags=0xff200200) at accel/tcg/cpu-exec.c:270 #16 0x00007ffff748f463 in helper_lookup_tb_ptr (env=0x55555712f9b0) at accel/tcg/cpu-exec.c:425 #17 0x00007fff6800091c in code_gen_buffer () ```