diff --git a/qemu/target/arm/cpu.h b/qemu/target/arm/cpu.h
index 09057938..a4090447 100644
--- a/qemu/target/arm/cpu.h
+++ b/qemu/target/arm/cpu.h
@@ -3065,10 +3065,10 @@ typedef ARMCPU ArchCPU;
  * |              |     |   TBFLAG_A32   |              |
  * |              |     +-----+----------+  TBFLAG_AM32 |
  * |  TBFLAG_ANY  |           |TBFLAG_M32|              |
- * |              |         +-+----------+--------------|
- * |              |         |         TBFLAG_A64        |
- * +--------------+---------+---------------------------+
- *  31          20        15                           0
+ * |              +-----------+----------+--------------|
+ * |              |            TBFLAG_A64               |
+ * +--------------+-------------------------------------+
+ *  31          20                                     0
  *
  */
 FIELD(TBFLAG_ANY, AARCH64_STATE, 31, 1)
@@ -3133,6 +3133,11 @@ FIELD(TBFLAG_A64, BT, 9, 1)
 FIELD(TBFLAG_A64, BTYPE, 10, 2)
 FIELD(TBFLAG_A64, TBID, 12, 2)
 FIELD(TBFLAG_A64, UNPRIV, 14, 1)
+FIELD(TBFLAG_A64, ATA, 15, 1)
+FIELD(TBFLAG_A64, TCMA, 16, 2)
+FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
+FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
+
 
 static inline bool bswap_code(bool sctlr_b)
 {
diff --git a/qemu/target/arm/helper.c b/qemu/target/arm/helper.c
index 1b348930..7b04ec8f 100644
--- a/qemu/target/arm/helper.c
+++ b/qemu/target/arm/helper.c
@@ -10415,6 +10415,16 @@ static int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
     }
 }
 
+static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
+{
+    if (regime_has_2_ranges(mmu_idx)) {
+        return extract64(tcr, 57, 2);
+    } else {
+        /* Replicate the single TCMA bit so we always have 2 bits.  */
+        return extract32(tcr, 30, 1) * 3;
+    }
+}
+
 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data)
 {
@@ -12279,17 +12289,15 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
         flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1);
         ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
 
-        {
-            uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
-            int tbii, tbid;
+        uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+        int tbii, tbid;
 
-            /* Get control bits for tagged addresses.  */
-            tbid = aa64_va_parameter_tbi(tcr, mmu_idx);
-            tbii = tbid & ~aa64_va_parameter_tbid(tcr, mmu_idx);
+        /* Get control bits for tagged addresses.  */
+        tbid = aa64_va_parameter_tbi(tcr, mmu_idx);
+        tbii = tbid & ~aa64_va_parameter_tbid(tcr, mmu_idx);
 
-            flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii);
-            flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid);
-        }
+        flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii);
+        flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid);
 
         if (cpu_isar_feature(aa64_sve, cpu)) {
             int sve_el = sve_exception_el(env, current_el);
@@ -12355,6 +12363,36 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                 break;
             }
         }
+
+        if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
+            /*
+             * Set MTE_ACTIVE if any access may be Checked, and leave clear
+             * if all accesses must be Unchecked:
+             * 1) If no TBI, then there are no tags in the address to check,
+             * 2) If Tag Check Override, then all accesses are Unchecked,
+             * 3) If Tag Check Fail == 0, then Checked access have no effect,
+             * 4) If no Allocation Tag Access, then all accesses are Unchecked.
+             */
+            if (allocation_tag_access_enabled(env, current_el, sctlr)) {
+                flags = FIELD_DP32(flags, TBFLAG_A64, ATA, 1);
+                if (tbid
+                    && !(env->pstate & PSTATE_TCO)
+                    && (sctlr & (current_el == 0 ? SCTLR_TCF0 : SCTLR_TCF))) {
+                    flags = FIELD_DP32(flags, TBFLAG_A64, MTE_ACTIVE, 1);
+                }
+            }
+            /* And again for unprivileged accesses, if required.  */
+            if (FIELD_EX32(flags, TBFLAG_A64, UNPRIV)
+                && tbid
+                && !(env->pstate & PSTATE_TCO)
+                && (sctlr & SCTLR_TCF0)
+                && allocation_tag_access_enabled(env, 0, sctlr)) {
+                flags = FIELD_DP32(flags, TBFLAG_A64, MTE0_ACTIVE, 1);
+            }
+            /* Cache TCMA as well as TBI. */
+            flags = FIELD_DP32(flags, TBFLAG_A64, TCMA,
+                               aa64_va_parameter_tcma(tcr, mmu_idx));
+        }
     } else {
         *pc = env->regs[15];
         flags = FIELD_DP32(flags, TBFLAG_AM32, THUMB, env->thumb);
diff --git a/qemu/target/arm/internals.h b/qemu/target/arm/internals.h
index 9e7e93a3..01c66970 100644
--- a/qemu/target/arm/internals.h
+++ b/qemu/target/arm/internals.h
@@ -1204,6 +1204,24 @@ static inline int exception_target_el(CPUARMState *env)
     return target_el;
 }
 
+/* Determine if allocation tags are available.  */
+static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
+                                                 uint64_t sctlr)
+{
+    if (el < 3
+        && arm_feature(env, ARM_FEATURE_EL3)
+        && !(env->cp15.scr_el3 & SCR_ATA)) {
+        return false;
+    }
+    if (el < 2
+        && arm_feature(env, ARM_FEATURE_EL2)
+        && !(arm_hcr_el2_eff(env) & HCR_ATA)) {
+        return false;
+    }
+    sctlr &= (el == 0 ? SCTLR_ATA0 : SCTLR_ATA);
+    return sctlr != 0;
+}
+
 #ifndef CONFIG_USER_ONLY
 
 /* Security attributes for an address, as returned by v8m_security_lookup. */
diff --git a/qemu/target/arm/translate-a64.c b/qemu/target/arm/translate-a64.c
index 4da61e2c..7f6d17a2 100644
--- a/qemu/target/arm/translate-a64.c
+++ b/qemu/target/arm/translate-a64.c
@@ -14496,6 +14496,7 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->mmu_idx = core_to_aa64_mmu_idx(core_mmu_idx);
     dc->tbii = FIELD_EX32(tb_flags, TBFLAG_A64, TBII);
     dc->tbid = FIELD_EX32(tb_flags, TBFLAG_A64, TBID);
+    dc->tcma = FIELD_EX32(tb_flags, TBFLAG_A64, TCMA);
     dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
 #if !defined(CONFIG_USER_ONLY)
     dc->user = (dc->current_el == 0);
@@ -14507,6 +14508,9 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->bt = FIELD_EX32(tb_flags, TBFLAG_A64, BT);
     dc->btype = FIELD_EX32(tb_flags, TBFLAG_A64, BTYPE);
     dc->unpriv = FIELD_EX32(tb_flags, TBFLAG_A64, UNPRIV);
+    dc->ata = FIELD_EX32(tb_flags, TBFLAG_A64, ATA);
+    dc->mte_active[0] = FIELD_EX32(tb_flags, TBFLAG_A64, MTE_ACTIVE);
+    dc->mte_active[1] = FIELD_EX32(tb_flags, TBFLAG_A64, MTE0_ACTIVE);
     dc->vec_len = 0;
     dc->vec_stride = 0;
     dc->cp_regs = arm_cpu->cp_regs;
diff --git a/qemu/target/arm/translate.h b/qemu/target/arm/translate.h
index e75809b9..5ef5ae6b 100644
--- a/qemu/target/arm/translate.h
+++ b/qemu/target/arm/translate.h
@@ -29,6 +29,7 @@ typedef struct DisasContext {
     ARMMMUIdx mmu_idx; /* MMU index to use for normal loads/stores */
     uint8_t tbii;      /* TBI1|TBI0 for insns */
     uint8_t tbid;      /* TBI1|TBI0 for data */
+    uint8_t tcma;      /* TCMA1|TCMA0 for MTE */
     bool ns;        /* Use non-secure CPREG bank on access */
     int fp_excp_el; /* FP exception EL or 0 if enabled */
     int sve_excp_el; /* SVE exception EL or 0 if enabled */
@@ -76,6 +77,10 @@ typedef struct DisasContext {
     bool unpriv;
     /* True if v8.3-PAuth is active.  */
     bool pauth_active;
+    /* True if v8.5-MTE access to tags is enabled.  */
+    bool ata;
+    /* True if v8.5-MTE tag checks affect the PE; index with is_unpriv.  */
+    bool mte_active[2];
     /* Bottom two bits of XScale c15_cpar coprocessor access control reg */
     int c15_cpar;
     /* True with v8.5-BTI and SCTLR_ELx.BT* set.  */