arm: Add missing hflag update after writing xpsr

[wuetj]

This adds a missing hflag update after updating the xpsr.
Currently when using an Arm Cortex-M CPU, which does not feature ARM_FEATURE_M_SECURITY, the EXC_RETURN interrupt is not triggered.
After some debugging it turns out the v7m_handler_mode condition here is never true:

unicorn/qemu/target/arm/translate.c

Lines 827 to 830 in c24c9eb

	if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY) ||
	(s->v7m_handler_mode && arm_dc_feature(s, ARM_FEATURE_M))) {
	s->base.is_jmp = DISAS_BX_EXCRET;
	}

v7m_handler_mode is evaluated based on the HANDLER flag which is set when rebuilding hflags:

unicorn/qemu/target/arm/helper.c

Lines 11592 to 11594 in c24c9eb

	if (arm_v7m_is_handler_mode(env)) {
	FIELD_DP32(flags, TBFLAG_M32, HANDLER, 1, flags);
	}

Since setting IPSR using uc_reg_write does not rebuild hflags, qemu doesn't realize that it's currently in an exception and returning from an exception causes a hard fault.
This fixes this by rebuilding hflags after updating xPSR.
This doesn't matter for processors with the security feature since the condition is always true in that case. I've updated the test to catch this.

[PhilippTakacs]

Can you create a second test instead changing the used CPU? Maybe add a CPU parameter to the function and write two tests simply calling test_arm_m_exc_return.

[wuetj]

I'm not sure why UC_CPU_ARM_CORTEX_A15 is being used here since it's not an M-class CPU. UC_MODE_MCLASS overwrites the cpu model with UC_CPU_ARM_CORTEX_M33, so this value is ignored anyways.
I could create two separate test cases for UC_CPU_ARM_CORTEX_M33 (with M security feature) and UC_CPU_ARM_CORTEX_M4 (no M security feature) if necessary.

[PhilippTakacs]

This are two different code path so we should have two tests. One for M33 and one for this bug.

[wuetj]

The check for EXC_RETURN is simply always true if the CPU has security extension, since in that case the EXC_RETURN code can also be triggered in thread mode.

unicorn/qemu/target/arm/translate.c

Lines 807 to 811 in c24c9eb

	* To avoid having to do multiple comparisons in inline generated code,
	* we make the check we do here loose, so it will match for EXC_RETURN
	* in Thread mode. For system emulation do_v7m_exception_exit() checks
	* for these spurious cases and returns without doing anything (giving
	* the same behaviour as for a branch to a non-magic address).

If EXC_RETURN works for the M7, it will always work for the M33.

I can add tests for both the M7 and M33 though, if you think it's necessary.