Message ID | 20230609155457.87848-1-peter.maydell@linaro.org |
---|---|
State | Superseded |
Headers | show |
Series | target/arm: Return correct result for LDG when ATA=0 | expand |
On 6/9/23 08:54, Peter Maydell wrote: > The LDG instruction loads the tag from a memory address (identified > by [Xn + offset]), and then merges that tag into the destination > register Xt. We implemented this correctly for the case when > allocation tags are enabled, but didn't get it right when ATA=0: > instead of merging the tag bits into Xt, we merged them into the > memory address [Xn + offset] and then set Xt to that. > > Merge the tag bits into the old Xt value, as they should be. > > Cc:qemu-stable@nongnu.org > Fixes: c15294c1e36a7dd9b25 ("target/arm: Implement LDG, STG, ST2G instructions") > Signed-off-by: Peter Maydell<peter.maydell@linaro.org> > --- > Spotted this while I was doing decodetree conversion stuff. > I guess nobody runs with MTE available but not turned on :-) Indeed. :-) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> r~
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c index aa93f37e216..9ead91a450b 100644 --- a/target/arm/tcg/translate-a64.c +++ b/target/arm/tcg/translate-a64.c @@ -4187,9 +4187,13 @@ static void disas_ldst_tag(DisasContext *s, uint32_t insn) if (s->ata) { gen_helper_ldg(tcg_rt, cpu_env, addr, tcg_rt); } else { + /* + * Tag access disabled: we must check for aborts on the load + * load from [rn+offset], and then insert a 0 tag into rt. + */ clean_addr = clean_data_tbi(s, addr); gen_probe_access(s, clean_addr, MMU_DATA_LOAD, MO_8); - gen_address_with_allocation_tag0(tcg_rt, addr); + gen_address_with_allocation_tag0(tcg_rt, tcg_rt); } } else { tcg_rt = cpu_reg_sp(s, rt);
The LDG instruction loads the tag from a memory address (identified by [Xn + offset]), and then merges that tag into the destination register Xt. We implemented this correctly for the case when allocation tags are enabled, but didn't get it right when ATA=0: instead of merging the tag bits into Xt, we merged them into the memory address [Xn + offset] and then set Xt to that. Merge the tag bits into the old Xt value, as they should be. Cc: qemu-stable@nongnu.org Fixes: c15294c1e36a7dd9b25 ("target/arm: Implement LDG, STG, ST2G instructions") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- Spotted this while I was doing decodetree conversion stuff. I guess nobody runs with MTE available but not turned on :-) --- target/arm/tcg/translate-a64.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)