The LDG instruction loads the tag from a memory address (identified
by [Xn + offset]), and then merges that tag into the destination
register Xt. We implemented this correctly for the case when
allocation tags are enabled, but didn't get it right when ATA=0:
instead of merging the tag bits into Xt, we merged them into the
memory address [Xn + offset] and then set Xt to that.

Merge the tag bits into the old Xt value, as they should be.

Cc: qemu-stable@nongnu.org
Fixes: c15294c1e36a7dd9b25 ("target/arm: Implement LDG, STG, ST2G instructions")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
Spotted this while I was doing decodetree conversion stuff.
I guess nobody runs with MTE available but not turned on :-)
---
 target/arm/tcg/translate-a64.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index aa93f37e216..9ead91a450b 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -4187,9 +4187,13 @@ static void disas_ldst_tag(DisasContext *s, uint32_t insn)
         if (s->ata) {
             gen_helper_ldg(tcg_rt, cpu_env, addr, tcg_rt);
         } else {
+            /*
+             * Tag access disabled: we must check for aborts on the load
+             * load from [rn+offset], and then insert a 0 tag into rt.
+             */
             clean_addr = clean_data_tbi(s, addr);
             gen_probe_access(s, clean_addr, MMU_DATA_LOAD, MO_8);
-            gen_address_with_allocation_tag0(tcg_rt, addr);
+            gen_address_with_allocation_tag0(tcg_rt, tcg_rt);
         }
     } else {
         tcg_rt = cpu_reg_sp(s, rt);
-- 
2.34.1

On 6/9/23 08:54, Peter Maydell wrote:
> The LDG instruction loads the tag from a memory address (identified
> by [Xn + offset]), and then merges that tag into the destination
> register Xt. We implemented this correctly for the case when
> allocation tags are enabled, but didn't get it right when ATA=0:
> instead of merging the tag bits into Xt, we merged them into the
> memory address [Xn + offset] and then set Xt to that.
> 
> Merge the tag bits into the old Xt value, as they should be.
> 
> Cc:qemu-stable@nongnu.org
> Fixes: c15294c1e36a7dd9b25 ("target/arm: Implement LDG, STG, ST2G instructions")
> Signed-off-by: Peter Maydell<peter.maydell@linaro.org>
> ---
> Spotted this while I was doing decodetree conversion stuff.
> I guess nobody runs with MTE available but not turned on :-)

Indeed.  :-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


r~