[Qemu-devel] [Bug 1806824] Re: SIE-200 (TrustZone) MPC: BLK_MAX returns an incorrect value

[YVT]

Command line:

    $ qemu-system-arm -kernel Image.elf -machine mps2-an505 -nographic
-d guest_errors -s -semihosting

The guest I'm running is an unreleased program for a research purpose.
I'm not aware of any publicly-known application or operating system that
make use of the hardware register concerned by this issue.

The attached program is an artificial example that reproduces the issue.
The program writes a random value to every LUT block within [0,
BLK_MAX]. After that, it examines the content of every LUT block to see
if it has the intended value or not.

With the AN505 FPGA image, you get the following output (via UART1,
115200 baud):

    ==== The test program has started ====
     LUT[0x00000000] = 07345a3f
     LUT[0x00000001] = 020c7cc6
    ==== The test program has completed ====

With QEMU, you get the following output because the LUT index 0x00000040 
doesn't actually exist and is wrapped around to the first block:
    
    $ make qemu
    qemu-system-arm -kernel Image.elf -machine mps2-an505 -nographic -d 
guest_errors -s -semihosting
    ==== The test program has started ====
     LUT[0x00000000] = 07345a3f
     LUT[0x00000001] = 020c7cc6
     ...
     LUT[0x0000003f] = ce3b657b
     LUT[0x00000040] = f01ed211
    [ERROR] Verify failed at 0x00000000 - expected 0x07345a3f, got 0xf01ed211.
    ==== The test program has completed ====

** Attachment added: "An artificial example that reproduces the issue"
   
https://bugs.launchpad.net/qemu/+bug/1806824/+attachment/5222023/+files/qemu-1806824-test.tar.gz

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1806824

Title:
  SIE-200 (TrustZone) MPC: BLK_MAX returns an incorrect value

Status in QEMU:
  New

Bug description:
  Version: 
  $ qemu-system-arm --version
  QEMU emulator version 3.0.92 (v3.1.0-rc2-31-gd522fba244)

  Arm SIE-200 Technical Reference Manual describes that BLK_MAX
  indicates the maximum value of "block based index register" (BLK_IDX).
  For example, the value 1 would indicate that BLK_IDX can be 0 or 1.
  According to my experiments, the AN505 FPGA image apparently follows
  this behavior.

  In the current implementation of QEMU, it appears to indicate the
  number of possible values for BLK_IDX, i.e., one plus the value it's
  supposed to return.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1806824/+subscriptions