target/arm: fix TTA instruction S bit for IDAU-exempt addresses

The TTA (Test Target Alternate Domain) instruction is specific to ARMv8-M processors with the Security Extension (TrustZone). It allows Secure code to query the security attributes and access permissions of a memory address as seen from the Non-secure domain, and is typically used by Secure code to validate pointers received from Non-secure callers before dereferencing them. The TTA instruction incorrectly reports the S bit (bit 22) of the result register for IDAU-exempt addresses when executed from Secure state. According to the ARMv8-M Architecture Reference Manual (DDI0553B.z), the TTResp() pseudocode (E2.1.408) always calls SecurityCheck() with the current security state, regardless of the alt flag: sAttributes = SecurityCheck(address, FALSE, IsSecure()); The alt flag only affects which MPU bank is queried for the R/RW/MREGION fields. It does not affect the SAU/IDAU security attribute lookup that determines the S bit. For an IDAU-exempt address, SecurityCheck() (E2.1.366) sets: result.ns = !isSecure; // isSecure = current CPU security state So TTA executed from Secure state on an IDAU-exempt address should return S=1. This is confirmed by testing on real Cortex-M33 hardware. QEMU currently passes targetsec (which is flipped to !env->v7m.secure when alt=true) to v8m_security_lookup(), causing the IDAU-exempt path to set sattrs->ns = TRUE and return S=0 instead. Fix this by always passing the current security state to v8m_security_lookup(), as the spec requires. Cc: qemu-stable@nongnu.org Fixes: 5158de241b0f ("target/arm: Implement TT instruction") (the is_secure argument to v8m_security_lookup() was only added in dbf2a71ad62b992 ("target/arm: Add is_secure parameter to v8m_security_lookup"), but the code before that implicitly had the equivalent bug.) Signed-off-by: Alexandre Frey <alexandre.frey@nxp.com> Message-id: ZR6PR04MB44238851A057F385D7EECEAD3599AE2@ZR6PR04MB442388.eurprd04.prod.outlook.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: added comment] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>