docs/system/arm/emulation.rst | 5 ++ linux-user/aarch64/mte_user_helper.c | 11 ++- linux-user/aarch64/mte_user_helper.h | 14 ++-- linux-user/aarch64/target_prctl.h | 6 +- target/arm/cpu-features.h | 15 ++++ target/arm/cpu.h | 5 ++ target/arm/gdbstub64.c | 2 +- target/arm/helper.c | 36 +++++++-- target/arm/internals.h | 40 ++++++++-- target/arm/ptw.c | 60 ++++++++++++-- target/arm/tcg/cpu64.c | 5 ++ target/arm/tcg/helper-a64-defs.h | 16 ++-- target/arm/tcg/helper-a64.c | 7 +- target/arm/tcg/hflags.c | 25 +++++- target/arm/tcg/mte_helper.c | 146 +++++++++++++++++++++++++++++------ target/arm/tcg/pauth_helper.c | 18 ++++- target/arm/tcg/sme_helper.c | 4 +- target/arm/tcg/sve_helper.c | 6 +- target/arm/tcg/translate-a64.c | 45 +++++++---- target/arm/tcg/translate.h | 3 + tests/tcg/aarch64/Makefile.target | 2 +- tests/tcg/aarch64/mte-10.c | 49 ++++++++++++ tests/tcg/aarch64/mte-9.c | 48 ++++++++++++ tests/tcg/aarch64/mte.h | 7 +- 24 files changed, 484 insertions(+), 91 deletions(-)
This series implements ARM's Enhanced Memory Tagging Extension
(MTE4). MTE4 implies the presence of several subfeatures:
FEAT_MTE_CANONICAL_TAGS, FEAT_MTE_TAGGED_FAR, FEAT_MTE_STORE_ONLY,
FEAT_MTE_NO_ADDRESS_TAGS, and FEAT_MTE_PERM, none of which are
currently implemented in QEMU. This patch implements all five.
Testing:
- Included for FAR and STORE_ONLY.
- The MTE_CANONICAL/NAT test from v2, modified so MTE_CANONICAL is
enabled in user mode (removed from tree in v3).
- A bare-metal testsuite that sets up page tables for S1 and S2
translation, to test the Tagged NoTagAccess fault.
- The bare-metal testsuite also was used to test LDGM and similar
instructions not permitted in user-mode.
- The bare-metal testsuite also was used to test the mtx related
patches.
Thanks,
Gabriel Brookman
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3116
Signed-off-by: Gabriel Brookman <brookmangabriel@gmail.com>
---
Changes in v7:
- initialized "tagged" in combine_cacheattrs (MTEPERM), per Peter
- alphabetized MTE4 features on docs, per Richard
- moved comment in docs, per Richard
- rebased onto master, incrementing bits in TBFLAGS since FPMR_EL
- Link to v6: https://lore.kernel.org/qemu-devel/20260511-feat-mte4-v6-0-8557cc1313b9@gmail.com
Changes in v6:
- Moved certain functions between patches (Richard)
- Added G_NORETURN to canonical_tag_write_fail
- Updated ldg and bounds check functions to Richard's versions, tested
these
- Link to v5: https://lore.kernel.org/qemu-devel/20260504-feat-mte4-v5-0-232a648e63c6@gmail.com
Changes in v5:
- MTX check feature split into three commits as per Richard's suggestion
- MTX passed down to instruction helpers in a new argument
- allocation_tag_mem_probe checks for probe in MTEPERM case
- tbi helper combined into tbi_or_mtx_helper
- MTX checks added to sme and sve functions
- bug with type conversion in LDGM helper fixed
- fixed multi-page tag-check bug and multi-page ST2G bug
- removed erroneous changes to _stub functions
- reorganized PAuth & MTX interactions to make them more readable
- Link to v4: https://lore.kernel.org/qemu-devel/20260309-feat-mte4-v4-0-daaf0375620d@gmail.com
Changes in v4:
- MTX now interacts with PAuth.
- Canonical tag checking only takes place in canonically tagged regions
- MTX bits enable tag checking
- MTX bits are placed in MTEDESC for access in mte_check helper
- Separate feature bits are used to delineate each feature
- PRCTL functions renamed and refactored as per Richard's suggestion
- Link to v3: https://lore.kernel.org/qemu-devel/20260105-feat-mte4-v3-0-86a0d99ef2e4@gmail.com
Changes in v3:
- Added prctl for MTE_STORE_ONLY to linux-user
- mte_check is no longer generated on read when STORE_ONLY enabled
- Implemented LDGM instruction
- Removed "long" datatype as per Richard's suggestion
- Implemented masking for VA range checks when MTX bit enabled
- Implemented MTE_PERM, with NoTagAccess attribute
- Removed user-mode test for MTE_CANONICAL, since can't enable in
user-mode.
- Removed TBI from mte_check generation logic
- Link to v2: https://lore.kernel.org/qemu-devel/20251116-feat-mte4-v2-0-9a7122b7fa76@gmail.com
Changes in v2:
- Added tests for STORE_ONLY.
- Refined commit messages.
- Added FEAT_MTE_CANONICAL_TAGS and FEAT_MTE_NO_ADDRESS_TAGS + tests.
- fixed TCSO bit macro names.
- Link to v1: https://lore.kernel.org/qemu-devel/20251111-feat-mte4-v1-0-72ef5cf276f9@gmail.com
To: qemu-devel@nongnu.org
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-arm@nongnu.org
Cc: Laurent Vivier <laurent@vivier.eu>
Cc: Helge Deller <deller@gmx.de>
Cc: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
---
Gabriel Brookman (15):
target/arm: implement MTE_PERM
target/arm: add TCSO bitmasks to SCTLR
target/arm: mte_check unemitted on STORE_ONLY load
linux-user: add MTE_STORE_ONLY to prctl
target/arm: emit tag check when MTX without TBI
target/arm: add MTX to MTEDESC and DisasContext
target/arm: add canonical tag check helper
target/arm: add canonical MTE check logic
target/arm: load on canonical tag loads ext bits
target/arm: fault on tag store to canonical tag
target/arm: skip tag bit bounds check if MTX is on
target/arm: tag is not a part of PAuth with MTX
docs: add MTE4 features to docs
tests/tcg: add test for MTE FAR
tests/tcg: add test for MTE_STORE_ONLY
docs/system/arm/emulation.rst | 5 ++
linux-user/aarch64/mte_user_helper.c | 11 ++-
linux-user/aarch64/mte_user_helper.h | 14 ++--
linux-user/aarch64/target_prctl.h | 6 +-
target/arm/cpu-features.h | 15 ++++
target/arm/cpu.h | 5 ++
target/arm/gdbstub64.c | 2 +-
target/arm/helper.c | 36 +++++++--
target/arm/internals.h | 40 ++++++++--
target/arm/ptw.c | 60 ++++++++++++--
target/arm/tcg/cpu64.c | 5 ++
target/arm/tcg/helper-a64-defs.h | 16 ++--
target/arm/tcg/helper-a64.c | 7 +-
target/arm/tcg/hflags.c | 25 +++++-
target/arm/tcg/mte_helper.c | 146 +++++++++++++++++++++++++++++------
target/arm/tcg/pauth_helper.c | 18 ++++-
target/arm/tcg/sme_helper.c | 4 +-
target/arm/tcg/sve_helper.c | 6 +-
target/arm/tcg/translate-a64.c | 45 +++++++----
target/arm/tcg/translate.h | 3 +
tests/tcg/aarch64/Makefile.target | 2 +-
tests/tcg/aarch64/mte-10.c | 49 ++++++++++++
tests/tcg/aarch64/mte-9.c | 48 ++++++++++++
tests/tcg/aarch64/mte.h | 7 +-
24 files changed, 484 insertions(+), 91 deletions(-)
---
base-commit: 2db91528542672cf0db78b3f2cc0e22b36302b38
change-id: 20251109-feat-mte4-6740a6202e83
Best regards,
--
Gabriel Brookman <brookmangabriel@gmail.com>
On Fri, 29 May 2026 at 20:52, Gabriel Brookman <brookmangabriel@gmail.com> wrote: > > This series implements ARM's Enhanced Memory Tagging Extension > (MTE4). MTE4 implies the presence of several subfeatures: > FEAT_MTE_CANONICAL_TAGS, FEAT_MTE_TAGGED_FAR, FEAT_MTE_STORE_ONLY, > FEAT_MTE_NO_ADDRESS_TAGS, and FEAT_MTE_PERM, none of which are > currently implemented in QEMU. This patch implements all five. I just noticed that this patchset didn't add FEAT_MTE4 to the list of implemented features in docs/system/arm/emulation.rst. Are we missing anything to be able to call MTE4 complete and close https://gitlab.com/qemu-project/qemu/-/work_items/3116 ? thanks -- PMM
Sorry, repeating as I forgot to include the mailing list: Hello, According to ARM developer, FEAT_MTE4 only implies the existence of its 4 subfeatures, plus FEAT_MTE2, and MTE_PERM, all of which are now implemented. There are no features that MTE4 guarantees that aren't either already present or introduced by my series. This means that we can now claim to implement FEAT_MTE4, and close the issue. We can also add it to emulation.rst. My apologies -- I can't do that right now because of my current role, but it should be a trivial one-liner for whoever picks it up. Thanks, Gabriel
On Wed, 1 Jul 2026 at 06:38, Gabriel Brookman <brookmangabriel@gmail.com> wrote: > > Sorry, repeating as I forgot to include the mailing list: > > Hello, > > According to ARM developer, FEAT_MTE4 only implies the existence of > its 4 subfeatures, plus FEAT_MTE2, and MTE_PERM, all of which are now > implemented. There are no features that MTE4 guarantees that aren't > either already present or introduced by my series. This means that we > can now claim to implement FEAT_MTE4, and close the issue. > > We can also add it to emulation.rst. My apologies -- I can't do that > right now because of my current role, but it should be a trivial > one-liner for whoever picks it up. Great, thanks. I'll send out a patch which updates the docs, and close the issue. -- PMM
On Thu, 2 Jul 2026 at 15:45, Peter Maydell <peter.maydell@linaro.org> wrote: > > On Wed, 1 Jul 2026 at 06:38, Gabriel Brookman <brookmangabriel@gmail.com> wrote: > > > > Sorry, repeating as I forgot to include the mailing list: > > > > Hello, > > > > According to ARM developer, FEAT_MTE4 only implies the existence of > > its 4 subfeatures, plus FEAT_MTE2, and MTE_PERM, all of which are now > > implemented. There are no features that MTE4 guarantees that aren't > > either already present or introduced by my series. This means that we > > can now claim to implement FEAT_MTE4, and close the issue. > > > > We can also add it to emulation.rst. My apologies -- I can't do that > > right now because of my current role, but it should be a trivial > > one-liner for whoever picks it up. > > Great, thanks. I'll send out a patch which updates the docs, > and close the issue. Alex got there first: there's a patch adding FEAT_MTE4 to the docs in https://patchew.org/QEMU/20260708145841.3032079-1-alex.bennee@linaro.org/ I've closed the gitlab issue. -- PMM
Hello all, Friendly ping: I have an external deadline this Sunday, so if anything needs to be addressed on my end I'd want to know soon. (Re Peter's mte-10 segfault: like Richard, I can't reproduce it, but I am happy to dig in if Peter can share a way to reproduce it.) Thanks, Gabriel On Fri, May 29, 2026 at 12:52 PM Gabriel Brookman <brookmangabriel@gmail.com> wrote: > > This series implements ARM's Enhanced Memory Tagging Extension > (MTE4). MTE4 implies the presence of several subfeatures: > FEAT_MTE_CANONICAL_TAGS, FEAT_MTE_TAGGED_FAR, FEAT_MTE_STORE_ONLY, > FEAT_MTE_NO_ADDRESS_TAGS, and FEAT_MTE_PERM, none of which are > currently implemented in QEMU. This patch implements all five. > > Testing: > - Included for FAR and STORE_ONLY. > - The MTE_CANONICAL/NAT test from v2, modified so MTE_CANONICAL is > enabled in user mode (removed from tree in v3). > - A bare-metal testsuite that sets up page tables for S1 and S2 > translation, to test the Tagged NoTagAccess fault. > - The bare-metal testsuite also was used to test LDGM and similar > instructions not permitted in user-mode. > - The bare-metal testsuite also was used to test the mtx related > patches. > > Thanks, > Gabriel Brookman > > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3116 > Signed-off-by: Gabriel Brookman <brookmangabriel@gmail.com> > --- > Changes in v7: > - initialized "tagged" in combine_cacheattrs (MTEPERM), per Peter > - alphabetized MTE4 features on docs, per Richard > - moved comment in docs, per Richard > - rebased onto master, incrementing bits in TBFLAGS since FPMR_EL > - Link to v6: https://lore.kernel.org/qemu-devel/20260511-feat-mte4-v6-0-8557cc1313b9@gmail.com > > Changes in v6: > - Moved certain functions between patches (Richard) > - Added G_NORETURN to canonical_tag_write_fail > - Updated ldg and bounds check functions to Richard's versions, tested > these > - Link to v5: https://lore.kernel.org/qemu-devel/20260504-feat-mte4-v5-0-232a648e63c6@gmail.com > > Changes in v5: > - MTX check feature split into three commits as per Richard's suggestion > - MTX passed down to instruction helpers in a new argument > - allocation_tag_mem_probe checks for probe in MTEPERM case > - tbi helper combined into tbi_or_mtx_helper > - MTX checks added to sme and sve functions > - bug with type conversion in LDGM helper fixed > - fixed multi-page tag-check bug and multi-page ST2G bug > - removed erroneous changes to _stub functions > - reorganized PAuth & MTX interactions to make them more readable > - Link to v4: https://lore.kernel.org/qemu-devel/20260309-feat-mte4-v4-0-daaf0375620d@gmail.com > > Changes in v4: > - MTX now interacts with PAuth. > - Canonical tag checking only takes place in canonically tagged regions > - MTX bits enable tag checking > - MTX bits are placed in MTEDESC for access in mte_check helper > - Separate feature bits are used to delineate each feature > - PRCTL functions renamed and refactored as per Richard's suggestion > - Link to v3: https://lore.kernel.org/qemu-devel/20260105-feat-mte4-v3-0-86a0d99ef2e4@gmail.com > > Changes in v3: > - Added prctl for MTE_STORE_ONLY to linux-user > - mte_check is no longer generated on read when STORE_ONLY enabled > - Implemented LDGM instruction > - Removed "long" datatype as per Richard's suggestion > - Implemented masking for VA range checks when MTX bit enabled > - Implemented MTE_PERM, with NoTagAccess attribute > - Removed user-mode test for MTE_CANONICAL, since can't enable in > user-mode. > - Removed TBI from mte_check generation logic > - Link to v2: https://lore.kernel.org/qemu-devel/20251116-feat-mte4-v2-0-9a7122b7fa76@gmail.com > > Changes in v2: > - Added tests for STORE_ONLY. > - Refined commit messages. > - Added FEAT_MTE_CANONICAL_TAGS and FEAT_MTE_NO_ADDRESS_TAGS + tests. > - fixed TCSO bit macro names. > - Link to v1: https://lore.kernel.org/qemu-devel/20251111-feat-mte4-v1-0-72ef5cf276f9@gmail.com > > To: qemu-devel@nongnu.org > Cc: Peter Maydell <peter.maydell@linaro.org> > Cc: qemu-arm@nongnu.org > Cc: Laurent Vivier <laurent@vivier.eu> > Cc: Helge Deller <deller@gmx.de> > Cc: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> > > --- > Gabriel Brookman (15): > target/arm: implement MTE_PERM > target/arm: add TCSO bitmasks to SCTLR > target/arm: mte_check unemitted on STORE_ONLY load > linux-user: add MTE_STORE_ONLY to prctl > target/arm: emit tag check when MTX without TBI > target/arm: add MTX to MTEDESC and DisasContext > target/arm: add canonical tag check helper > target/arm: add canonical MTE check logic > target/arm: load on canonical tag loads ext bits > target/arm: fault on tag store to canonical tag > target/arm: skip tag bit bounds check if MTX is on > target/arm: tag is not a part of PAuth with MTX > docs: add MTE4 features to docs > tests/tcg: add test for MTE FAR > tests/tcg: add test for MTE_STORE_ONLY > > docs/system/arm/emulation.rst | 5 ++ > linux-user/aarch64/mte_user_helper.c | 11 ++- > linux-user/aarch64/mte_user_helper.h | 14 ++-- > linux-user/aarch64/target_prctl.h | 6 +- > target/arm/cpu-features.h | 15 ++++ > target/arm/cpu.h | 5 ++ > target/arm/gdbstub64.c | 2 +- > target/arm/helper.c | 36 +++++++-- > target/arm/internals.h | 40 ++++++++-- > target/arm/ptw.c | 60 ++++++++++++-- > target/arm/tcg/cpu64.c | 5 ++ > target/arm/tcg/helper-a64-defs.h | 16 ++-- > target/arm/tcg/helper-a64.c | 7 +- > target/arm/tcg/hflags.c | 25 +++++- > target/arm/tcg/mte_helper.c | 146 +++++++++++++++++++++++++++++------ > target/arm/tcg/pauth_helper.c | 18 ++++- > target/arm/tcg/sme_helper.c | 4 +- > target/arm/tcg/sve_helper.c | 6 +- > target/arm/tcg/translate-a64.c | 45 +++++++---- > target/arm/tcg/translate.h | 3 + > tests/tcg/aarch64/Makefile.target | 2 +- > tests/tcg/aarch64/mte-10.c | 49 ++++++++++++ > tests/tcg/aarch64/mte-9.c | 48 ++++++++++++ > tests/tcg/aarch64/mte.h | 7 +- > 24 files changed, 484 insertions(+), 91 deletions(-) > --- > base-commit: 2db91528542672cf0db78b3f2cc0e22b36302b38 > change-id: 20251109-feat-mte4-6740a6202e83 > > Best regards, > -- > Gabriel Brookman <brookmangabriel@gmail.com> >
On Thu, 4 Jun 2026 at 08:28, Gabriel Brookman <brookmangabriel@gmail.com> wrote: > > Hello all, > > Friendly ping: I have an external deadline this Sunday, so if anything > needs to be addressed on my end I'd want to know soon. > > (Re Peter's mte-10 segfault: like Richard, I can't reproduce it, but I > am happy to dig in if Peter can share a way to reproduce it.) I can't reproduce it now either -- I suspect something went wrong with my local rebase of your v6 patchset. Applied to target-arm.next, thanks. -- PMM
© 2016 - 2026 Red Hat, Inc.