<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Incorrect code generation when enabled stack instrumentation with arm64 MTE"
href="https://bugs.llvm.org/show_bug.cgi?id=51362">51362</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Incorrect code generation when enabled stack instrumentation with arm64 MTE
</td>
</tr>
<tr>
<th>Product</th>
<td>clang
</td>
</tr>
<tr>
<th>Version</th>
<td>12.0
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>C
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedclangbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>scopichmu@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>blitzrakete@gmail.com, dgregor@apple.com, erik.pilkington@gmail.com, llvm-bugs@lists.llvm.org, richard-llvm@metafoo.co.uk
</td>
</tr></table>
<p>
<div>
<pre>Stack instrumentation with arm64 MTE were enabled using such options: "-target
aarch64-linux -march=armv8+memtag -fsanitize=memtag". Clang generates such
code:
```
00000000000014a0 <test_func>:
14a0: d100c3ff sub sp, sp, #0x30
14a4: a9027bfd stp x29, x30, [sp, #32]
14a8: 910083fd add x29, sp, #0x20
...
14c8: f81f83a8 stur x8, [x29, #-8]
...
```
Here Clang copies address of stack into 'x29' register then copy 'x8' register
into stack using 'x29' register. This violates arm spec. and causes false
positive Tag Check Fault MTE reports.
When CPU executes 'stur' instruction (at address 14c8), Synchronous Tag Check
Fault exception is triggered. Exception happens because only 'sp' allows to be
used to perform Tag Unchecked access - all load and store instructions with SP
base register and immediate offset do not check tags. Arm spec. says:
```
A Tag Unchecked access will be generated for a load or store that uses either
of the following:
• A base register only, with the SP as the base register.
• A base register plus immediate offset addressing form, with the SP as the
base register.
```</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>