From: Alexandre Frey <[email protected]> The TTA (Test Target Alternate Domain) instruction is specific to ARMv8-M processors with the Security Extension (TrustZone). It allows Secure code to query the security attributes and access permissions of a memory address as seen from the Non-secure domain, and is typically used by Secure code to validate pointers received from Non-secure callers before dereferencing them.
The TTA instruction incorrectly reports the S bit (bit 22) of the result register for IDAU-exempt addresses when executed from Secure state. According to the ARMv8-M Architecture Reference Manual (DDI0553B.z), the TTResp() pseudocode (E2.1.408) always calls SecurityCheck() with the current security state, regardless of the alt flag: sAttributes = SecurityCheck(address, FALSE, IsSecure()); The alt flag only affects which MPU bank is queried for the R/RW/MREGION fields. It does not affect the SAU/IDAU security attribute lookup that determines the S bit. For an IDAU-exempt address, SecurityCheck() (E2.1.366) sets: result.ns = !isSecure; // isSecure = current CPU security state So TTA executed from Secure state on an IDAU-exempt address should return S=1. This is confirmed by testing on real Cortex-M33 hardware. QEMU currently passes targetsec (which is flipped to !env->v7m.secure when alt=true) to v8m_security_lookup(), causing the IDAU-exempt path to set sattrs->ns = TRUE and return S=0 instead. Fix this by always passing the current security state to v8m_security_lookup(), as the spec requires. Cc: [email protected] Fixes: 5158de241b0f ("target/arm: Implement TT instruction") (the is_secure argument to v8m_security_lookup() was only added in dbf2a71ad62b992 ("target/arm: Add is_secure parameter to v8m_security_lookup"), but the code before that implicitly had the equivalent bug.) Signed-off-by: Alexandre Frey <[email protected]> Message-id: zr6pr04mb44238851a057f385d7eecead3599...@zr6pr04mb442388.eurprd04.prod.outlook.com Reviewed-by: Peter Maydell <[email protected]> [PMM: added comment] Signed-off-by: Peter Maydell <[email protected]> (cherry picked from commit f63124af78462f2210b90b07ef62a74bc32281a3) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c index f7354f3c6e0..71c300edcb6 100644 --- a/target/arm/tcg/m_helper.c +++ b/target/arm/tcg/m_helper.c @@ -2839,8 +2839,9 @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op) } if (env->v7m.secure) { + /* Note that security check is done as Secure even if alt is true */ v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, - targetsec, &sattrs); + env->v7m.secure, &sattrs); nsr = sattrs.ns && r; nsrw = sattrs.ns && rw; } else { -- 2.47.3
