target/arm: Restore security state on exception return

Now that we can handle the CONTROL.SPSEL bit not necessarily being
in sync with the current stack pointer, we can restore the correct
security state on exception return. This happens before we start
to read registers off the stack frame, but after we have taken
possible usage faults for bad exception return magic values and
updated CONTROL.SPSEL.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-5-git-send-email-peter.maydell@linaro.org

target/arm/helper.c

@@ -6381,6 +6381,8 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      */
     write_v7m_control_spsel(env, return_to_sp_process);
 
+    switch_v7m_security_state(env, return_to_secure);
+
     {
         /* The stack pointer we should be reading the exception frame from
          * depends on bits in the magic exception return type value (and