ARM64 Instruction Set – Memory tagging

Introduction

The Memory Tagging Extension, FEAT_MTE, catches bugs such as use after free and overruns. Memory is divided into tag granules of 16 bytes. Each granule has a 4-bit Allocation Tag, held apart from the data. Each pointer carries a 4-bit Logical Address Tag in bits 56 to 59 of the address. With checking on, an access whose two tags differ causes a tag check fault or is recorded for later, depending on the settings.

These instructions make pointers with new tags and write or read the tags in memory. Most of the tag stores are Unchecked accesses, so they are not themselves checked against the tag in memory. The GCR_EL1.Exclude register holds a set of tags that random tags must avoid.

Offsets on the tag load and store instructions are scaled by the tag granule, so they are multiples of 16. Only subps changes the flags. The memory set instructions also have forms that set tags, setg, and the dc tag operations are on the System instructions page.

The instructions

Pointers and tags

Mnemonic	Syntax	What it does	Flags
`irg`	`irg Xd, Xn`; `irg Xd, Xn, Xm`	Writes the address in `Xn` with a random Logical Address Tag. Tags in `Xm` or in `GCR_EL1.Exclude` are not chosen.	–
`gmi`	`gmi Xd, Xn, Xm`	Adds the tag held in the address in `Xn` to the set of excluded tags in `Xm`, and writes the new set to `Xd`.	–
`addg`	`addg Xd, Xn, #off, #tag`	Adds an offset scaled by the tag granule and changes the Logical Address Tag using an immediate. Tags in `GCR_EL1.Exclude` are avoided.	–
`subg`	`subg Xd, Xn, #off, #tag`	Subtracts a scaled offset and changes the Logical Address Tag in the same way.	–
`subp`	`subp Xd, Xn, Xm`	Subtracts the 56-bit address in `Xm` from the one in `Xn` and sign-extends the result to 64 bits, ignoring tags.	–
`subps`	`subps Xd, Xn, Xm`	As `subp`, setting the flags from the result.	NZCV

Loading and storing tags

Mnemonic	Syntax	What it does	Flags
`ldg`	`ldg Xt, [Xn, #imm]`	Reads the Allocation Tag at the address and merges it into the Logical Address Tag of `Xt`.	–
`stg`	`stg Xt, [Xn, #imm]`; pre-index and post-index forms	Writes one tag granule’s Allocation Tag, taken from the Logical Address Tag in `Xt`.	–
`stzg`	`stzg Xt, [Xn, #imm]`; pre-index and post-index forms	As `stg`, and also zeroes the data of the granule.	–
`st2g`	`st2g Xt, [Xn, #imm]`; pre-index and post-index forms	Writes the Allocation Tag to two granules.	–
`stz2g`	`stz2g Xt, [Xn, #imm]`; pre-index and post-index forms	Writes the Allocation Tag to two granules and zeroes their data.	–
`stgp`	`stgp Xt1, Xt2, [Xn, #imm]`; pre-index and post-index forms	Stores two doublewords and writes an Allocation Tag. The tag comes from the Logical Address Tag in the base register.	–

Tags in bulk

These act on a naturally aligned block of tags. They are undefined at EL0 and are used for tag maintenance by privileged code. The size of the block comes from GMID_EL1.BS for ldgm and stgm, and from DCZID_EL0.BS for stzgm.

Mnemonic	Syntax	What it does	Flags
`ldgm`	`ldgm Xt, [Xn]`	Reads a block of Allocation Tags into `Xt`. Each tag goes in the 4-bit position selected by its address. Other bits are 0.	–
`stgm`	`stgm Xt, [Xn]`	Writes a block of Allocation Tags from `Xt`.	–
`stzgm`	`stzgm Xt, [Xn]`	Writes the same tag, from bits 0 to 3 of `Xt`, across a block, and zeroes the data.	–