As it happens, I posted some cleanups for this last week: https://patchew.org/QEMU/20200302175829.2183-1-richard.hender...@linaro.org/
Some of them have been queued to Peter's target-arm.next branch, but that hasn't made it to master yet. ** Changed in: qemu Status: New => In Progress ** Changed in: qemu Assignee: (unassigned) => Richard Henderson (rth) -- You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1867072 Title: ARM: tag bits cleared in FAR_EL1 Status in QEMU: In Progress Bug description: The ARM Architecture Reference Manual provides the following for FAR_EL1: "For a Data Abort or Watchpoint exception, if address tagging is enabled for the address accessed by the data access that caused the exception, then this field includes the tag." However, I have found that the tag bits in FAR_EL1 are always clear, even if the tag bits were set in the original access. I can reproduce the problem on both 4.1.1 and master (6e8a73e911f066527e775e04b98f31ebd19db600). To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/1867072/+subscriptions