prev_page = ptr & TARGET_PAGE_MASK;
next_page = prev_page + TARGET_PAGE_SIZE;
- if (likely(tag_last - prev_page <= TARGET_PAGE_SIZE)) {
+ if (likely(tag_last - prev_page < TARGET_PAGE_SIZE)) {
/* Memory access stays on one page. */
tag_size = ((tag_byte_last - tag_byte_first) / (2 * TAG_GRANULE)) + 1;
mem1 = allocation_tag_mem(env, mmu_idx, ptr, type, sizem1 + 1,
# MTE Tests
ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_ARMV8_MTE),)
-AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6
+AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6 mte-7
mte-%: CFLAGS += -march=armv8.5-a+memtag
endif
--- /dev/null
+/*
+ * Memory tagging, unaligned access crossing pages.
+ * https://gitlab.com/qemu-project/qemu/-/issues/403
+ *
+ * Copyright (c) 2021 Linaro Ltd
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "mte.h"
+
+int main(int ac, char **av)
+{
+ void *p;
+
+ enable_mte(PR_MTE_TCF_SYNC);
+ p = alloc_mte_mem(2 * 0x1000);
+
+ /* Tag the pointer. */
+ p = (void *)((unsigned long)p | (1ul << 56));
+
+ /* Store tag in sequential granules. */
+ asm("stg %0, [%0]" : : "r"(p + 0x0ff0));
+ asm("stg %0, [%0]" : : "r"(p + 0x1000));
+
+ /*
+ * Perform an unaligned store with tag 1 crossing the pages.
+ * Failure dies with SIGSEGV.
+ */
+ asm("str %0, [%0]" : : "r"(p + 0x0ffc));
+ return 0;
+}