target/arm: load on canonical tag loads ext bits
Loading tags from canonically tagged regions should use the canonical tags (extension bits), not allocation tags. See AArch64_MemTagRead(). Signed-off-by: Gabriel Brookman <brookmangabriel@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20260529-feat-mte4-v7-9-ccbd3c14eb3c@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Gabriel Brookman committed
May 29, 2026 at 12:52 UTC
8912ceced8151ed6beff42c653d5d0da9a42220f
3 files changed
+16
-6
target/arm/tcg/helper-a64-defs.h
+2
-2
@@ -102,14 +102,14 @@ DEF_HELPER_FLAGS_3(mte_check, TCG_CALL_NO_WG, i64, env, i32, i64)
102
DEF_HELPER_FLAGS_3(mte_check_zva, TCG_CALL_NO_WG, i64, env, i32, i64)
103
DEF_HELPER_FLAGS_3(irg, TCG_CALL_NO_RWG, i64, env, i64, i64)
104
DEF_HELPER_FLAGS_4(addsubg, TCG_CALL_NO_RWG_SE, i64, env, i64, s32, i32)
105
-DEF_HELPER_FLAGS_3(ldg, TCG_CALL_NO_WG, i64, env, i64, i64)
105
+DEF_HELPER_FLAGS_4(ldg, TCG_CALL_NO_WG, i64, env, i64, i64, i32)
106
DEF_HELPER_FLAGS_3(stg, TCG_CALL_NO_WG, void, env, i64, i64)
107
DEF_HELPER_FLAGS_3(stg_parallel, TCG_CALL_NO_WG, void, env, i64, i64)
108
DEF_HELPER_FLAGS_2(stg_stub, TCG_CALL_NO_WG, void, env, i64)
109
DEF_HELPER_FLAGS_3(st2g, TCG_CALL_NO_WG, void, env, i64, i64)
110
DEF_HELPER_FLAGS_3(st2g_parallel, TCG_CALL_NO_WG, void, env, i64, i64)
111
DEF_HELPER_FLAGS_2(st2g_stub, TCG_CALL_NO_WG, void, env, i64)
112
-DEF_HELPER_FLAGS_2(ldgm, TCG_CALL_NO_WG, i64, env, i64)
112
+DEF_HELPER_FLAGS_3(ldgm, TCG_CALL_NO_WG, i64, env, i64, i32)
113
DEF_HELPER_FLAGS_3(stgm, TCG_CALL_NO_WG, void, env, i64, i64)
114
DEF_HELPER_FLAGS_3(stzgm_tags, TCG_CALL_NO_WG, void, env, i64, i64)
115
target/arm/tcg/mte_helper.c
+12
-2
@@ -304,7 +304,7 @@ int load_tag1(uint64_t ptr, uint8_t *mem)
304
return extract32(*mem, ofs, 4);
305
}
306
307
-uint64_t HELPER(ldg)(CPUARMState *env, uint64_t ptr, uint64_t xt)
307
+uint64_t HELPER(ldg)(CPUARMState *env, uint64_t ptr, uint64_t xt, uint32_t mtx)
308
{
309
int mmu_idx = arm_env_mmu_index(env);
310
uint8_t *mem;
@@ -317,6 +317,9 @@ uint64_t HELPER(ldg)(CPUARMState *env, uint64_t ptr, uint64_t xt)
317
/* Load if page supports tags. */
318
if (mem) {
319
rtag = load_tag1(ptr, mem);
320
+ } else if (mtx) {
321
+ uint64_t bit55 = extract64(ptr, 55, 1);
322
+ rtag = 0xF * bit55;
323
}
324
325
return address_with_allocation_tag(xt, rtag);
@@ -458,7 +461,7 @@ void HELPER(st2g_stub)(CPUARMState *env, uint64_t ptr)
461
}
462
}
463
461
-uint64_t HELPER(ldgm)(CPUARMState *env, uint64_t ptr)
464
+uint64_t HELPER(ldgm)(CPUARMState *env, uint64_t ptr, uint32_t mtx)
465
{
466
int mmu_idx = arm_env_mmu_index(env);
467
uintptr_t ra = GETPC();
@@ -476,6 +479,13 @@ uint64_t HELPER(ldgm)(CPUARMState *env, uint64_t ptr)
479
480
/* The tag is squashed to zero if the page does not support tags. */
481
if (!tag_mem) {
482
+ /* Load canonical value if mtx is set (untagged memory region) */
483
+ if (mtx) {
484
+ bool bit55 = extract64(ptr, 55, 1);
485
+ ret = extract64(-bit55, 0, 1 << gm_bs);
486
+ shift = extract64(ptr, LOG2_TAG_GRANULE, 4) * 4;
487
+ return ret << shift;
488
+ }
489
return 0;
490
}
491
target/arm/tcg/translate-a64.c
+2
-2
@@ -4801,7 +4801,7 @@ static bool trans_LDGM(DisasContext *s, arg_ldst_tag *a)
4801
tcg_rt = cpu_reg(s, a->rt);
4802
4803
if (s->ata[0]) {
4804
- gen_helper_ldgm(tcg_rt, tcg_env, addr);
4804
+ gen_helper_ldgm(tcg_rt, tcg_env, addr, tcg_constant_i32(s->mtx));
4805
} else {
4806
MMUAccessType acc = MMU_DATA_LOAD;
4807
int size = 4 << s->gm_blocksize;
@@ -4836,7 +4836,7 @@ static bool trans_LDG(DisasContext *s, arg_ldst_tag *a)
4836
tcg_gen_andi_i64(addr, addr, -TAG_GRANULE);
4837
tcg_rt = cpu_reg(s, a->rt);
4838
if (s->ata[0]) {
4839
- gen_helper_ldg(tcg_rt, tcg_env, addr, tcg_rt);
4839
+ gen_helper_ldg(tcg_rt, tcg_env, addr, tcg_rt, tcg_constant_i32(s->mtx));
4840
} else {
4841
/*
4842
* Tag access disabled: we must check for aborts on the load