mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

target/arm: Return correct result for LDG when ATA=0

Browse Source 
The LDG instruction loads the tag from a memory address (identified
by [Xn + offset]), and then merges that tag into the destination
register Xt. We implemented this correctly for the case when
allocation tags are enabled, but didn't get it right when ATA=0:
instead of merging the tag bits into Xt, we merged them into the
memory address [Xn + offset] and then set Xt to that.

Merge the tag bits into the old Xt value, as they should be.

Cc: qemu-stable@nongnu.org
Fixes: c15294c1e36a7dd9b25 ("target/arm: Implement LDG, STG, ST2G instructions")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 7e2788471f9e079fff696a694721a7d41a451839)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Peter Maydell 2023-06-19 11:20:18 +01:00 committed by Michael Tokarev
parent 1bc596d079
commit d0040c60f7
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
target/arm/translate-a64.c
View File

@ -4190,9 +4190,13 @@ static void disas_ldst_tag(DisasContext *s, uint32_t insn)
if (s->ata) { if (s->ata) {
gen_helper_ldg(tcg_rt, cpu_env, addr, tcg_rt); gen_helper_ldg(tcg_rt, cpu_env, addr, tcg_rt);
} else { } else {
/*
* Tag access disabled: we must check for aborts on the load
* load from [rn+offset], and then insert a 0 tag into rt.
*/
clean_addr = clean_data_tbi(s, addr); clean_addr = clean_data_tbi(s, addr);
gen_probe_access(s, clean_addr, MMU_DATA_LOAD, MO_8); gen_probe_access(s, clean_addr, MMU_DATA_LOAD, MO_8);
gen_address_with_allocation_tag0(tcg_rt, addr); gen_address_with_allocation_tag0(tcg_rt, tcg_rt);
} }
} else { } else {
tcg_rt = cpu_reg_sp(s, rt); tcg_rt = cpu_reg_sp(s, rt);