content/docs/12.10.0/debugging/mte.html - nuttx-website - Git at Google

 <!--
  Documentation/_templates/layout.html

  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.  The
  ASF licenses this file to you under the Apache License, Version 2.0 (the
  "License"); you may not use this file except in compliance with the
  License.  You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
  License for the specific language governing permissions and limitations
  under the License.
 -->


 <!DOCTYPE html>
 <html class="writer-html5" lang="en">
 <head>
   <meta charset="utf-8" /><meta name="generator" content="Docutils 0.19: https://docutils.sourceforge.io/" />

   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>ATM64 MTE extension &mdash; NuttX latest documentation</title>
       <link rel="stylesheet" type="text/css" href="../_static/pygments.css" />
       <link rel="stylesheet" type="text/css" href="../_static/css/theme.css" />
       <link rel="stylesheet" type="text/css" href="../_static/copybutton.css" />
       <link rel="stylesheet" type="text/css" href="../_static/design-style.1e8bd061cd6da7fc9cf755528e8ffc24.min.css" />
       <link rel="stylesheet" type="text/css" href="../_static/custom.css" />


     <link rel="shortcut icon" href="../_static/favicon.ico"/>
       <script src="../_static/jquery.js"></script>
       <script src="../_static/_sphinx_javascript_frameworks_compat.js"></script>
       <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
       <script src="../_static/doctools.js"></script>
       <script src="../_static/sphinx_highlight.js"></script>
       <script src="../_static/clipboard.min.js"></script>
       <script src="../_static/copybutton.js"></script>
       <script src="../_static/design-tabs.js"></script>
     <script src="../_static/js/theme.js"></script>
     <link rel="index" title="Index" href="../genindex.html" />
     <link rel="search" title="Search" href="../search.html" />
     <link rel="next" title="Guides" href="../guides/index.html" />
     <link rel="prev" title="Analyzing Cortex-M Hardfaults" href="cortexmhardfaults.html" />
 </head>

 <body class="wy-body-for-nav">
   <div class="wy-grid-for-nav">
     <nav data-toggle="wy-nav-shift" class="wy-nav-side">
       <div class="wy-side-scroll">
         <div class="wy-side-nav-search" >

     <a href="../index.html" class="icon icon-home"> NuttX


   </a>

   <!-- this version selector is quite ugly, should be probably replaced by something
        more modern -->

   <div class="version-selector">
     <select onchange="javascript:location.href = this.value;">

     <option value="../../latest" selected="selected">latest</option>

     <option value="../../10.0.0" >10.0.0</option>

     <option value="../../10.0.1" >10.0.1</option>

     <option value="../../10.1.0" >10.1.0</option>

     <option value="../../10.2.0" >10.2.0</option>

     <option value="../../10.3.0" >10.3.0</option>

     <option value="../../11.0.0" >11.0.0</option>

     <option value="../../12.0.0" >12.0.0</option>

     <option value="../../12.1.0" >12.1.0</option>

     <option value="../../12.2.0" >12.2.0</option>

     <option value="../../12.2.1" >12.2.1</option>

     <option value="../../12.3.0" >12.3.0</option>

     <option value="../../12.4.0" >12.4.0</option>

     <option value="../../12.5.0" >12.5.0</option>

     <option value="../../12.5.1" >12.5.1</option>

     <option value="../../12.6.0" >12.6.0</option>

     <option value="../../12.7.0" >12.7.0</option>

     <option value="../../12.8.0" >12.8.0</option>

     <option value="../../12.9.0" >12.9.0</option>

     <option value="../../12.10.0" >12.10.0</option>

     <option value="../../12.11.0" >12.11.0</option>

     </select>
   </div>


 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
     <input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
     <input type="hidden" name="check_keywords" value="yes" />
     <input type="hidden" name="area" value="default" />
   </form>
 </div>

         </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
               <p class="caption" role="heading"><span class="caption-text">Table of Contents</span></p>
 <ul class="current">
 <li class="toctree-l1"><a class="reference internal" href="../index.html">Home</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../introduction/index.html">Introduction</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../quickstart/index.html">Getting Started</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../contributing/index.html">Contributing</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../introduction/inviolables.html">The Inviolable Principles of NuttX</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../platforms/index.html">Supported Platforms</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../components/index.html">OS Components</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../applications/index.html">Applications</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../implementation/index.html">Implementation Details</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../reference/index.html">API Reference</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../faq/index.html">FAQ</a></li>
 <li class="toctree-l1 current"><a class="reference internal" href="index.html">Debugging</a><ul class="current">
 <li class="toctree-l2"><a class="reference internal" href="gdbwithpython.html">GDB with Python</a></li>
 <li class="toctree-l2"><a class="reference internal" href="qemugdb.html">How to debug NuttX using QEMU and GDB</a></li>
 <li class="toctree-l2"><a class="reference internal" href="gdbserver.html">gdbserver</a></li>
 <li class="toctree-l2"><a class="reference internal" href="debugging_elf_loadable_modules.html">Debugging ELF Loadable Modules</a></li>
 <li class="toctree-l2"><a class="reference internal" href="tasktrace.html">Task Trace</a></li>
 <li class="toctree-l2"><a class="reference internal" href="kasan.html">The Kernel Address Sanitizer (KASAN)</a></li>
 <li class="toctree-l2"><a class="reference internal" href="coredump.html">Core Dump</a></li>
 <li class="toctree-l2"><a class="reference internal" href="coresight.html">Coresight - HW Assisted Tracing on ARM</a></li>
 <li class="toctree-l2"><a class="reference internal" href="stackcheck.html">Stack Overflow Check</a></li>
 <li class="toctree-l2"><a class="reference internal" href="stackrecord.html">Run time stack statistics</a></li>
 <li class="toctree-l2"><a class="reference internal" href="disabling_stackdumpdebug.html">Disabling the Stack Dump During Debugging</a></li>
 <li class="toctree-l2"><a class="reference internal" href="debuggingflash_nuttxonarm.html">Debugging / flashing NuttX on ARM with hardware debugger (JTAG/SWD)</a></li>
 <li class="toctree-l2"><a class="reference internal" href="cortexmhardfaults.html">Analyzing Cortex-M Hardfaults</a></li>
 <li class="toctree-l2 current"><a class="current reference internal" href="#">ATM64 MTE extension</a><ul>
 <li class="toctree-l3"><a class="reference internal" href="#introduction">Introduction</a></li>
 <li class="toctree-l3"><a class="reference internal" href="#principle">Principle</a></li>
 <li class="toctree-l3"><a class="reference internal" href="#architectural-details">Architectural Details</a></li>
 <li class="toctree-l3"><a class="reference internal" href="#usage">Usage</a></li>
 </ul>
 </li>
 </ul>
 </li>
 <li class="toctree-l1"><a class="reference internal" href="../guides/index.html">Guides</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../glossary.html">Glossary</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../logos/index.html">NuttX Logos</a></li>
 <li class="toctree-l1"><a class="reference internal" href="../_tags/tagsindex.html">Tags</a></li>
 </ul>

         </div>
       </div>
     </nav>

     <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
           <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
           <a href="../index.html">NuttX</a>
       </nav>

       <div class="wy-nav-content">
         <div class="rst-content">
           <div role="navigation" aria-label="Page navigation">
   <ul class="wy-breadcrumbs">
       <li><a href="../index.html" class="icon icon-home" aria-label="Home"></a></li>
           <li class="breadcrumb-item"><a href="index.html">Debugging</a></li>
       <li class="breadcrumb-item active">ATM64 MTE extension</li>
       <li class="wy-breadcrumbs-aside">
               <a href="https://github.com/apache/nuttx/blob/master/Documentation/debugging/mte.rst" class="fa fa-github"> Edit on GitHub</a>
       </li>
   </ul>
   <hr/>
 </div>
           <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
            <div itemprop="articleBody">

   <section id="atm64-mte-extension">
 <h1>ATM64 MTE extension<a class="headerlink" href="#atm64-mte-extension" title="Permalink to this heading"></a></h1>
 <section id="introduction">
 <h2>Introduction<a class="headerlink" href="#introduction" title="Permalink to this heading"></a></h2>
 <p>Arm v8.5 introduced the Arm Memory Tagging Extension (MTE),
 a hardware implementation of tagged memory.</p>
 <p>Basically, MTE tags every memory allocation/deallocation
 with additional metadata. It assigns a tag to a memory location,
 which can then be associated with a pointer that references
 that memory location. At runtime, the CPU checks that the pointer
 and metadata tags match with every load and store.</p>
 <p>NX OS currently supports deploying MTE on ARM64 QEMU,
 which is supported at the EL1 level of NX OS.</p>
 </section>
 <section id="principle">
 <h2>Principle<a class="headerlink" href="#principle" title="Permalink to this heading"></a></h2>
 <p>The Arm Memory Tagging Extension implements lock and key access to memory.
 Locks can be set on memory and keys provided during memory access. If the key matches
 the lock, the access is permitted. If it does not match, an error is reported.</p>
 <p>Memory locations are tagged by adding four bits of metadata to each 16 bytes
 of physical memory. This is the Tag Granule. Tagging memory implements the lock.
 Pointers, and therefore virtual addresses, are modified to contain the key.
 In order to implement the key bits without requiring larger pointers MTE uses the Top Byte
 Ignore (TBI) feature of the Armv8-A Architecture. When TBI is enabled, the top byte of
 a virtual address is ignored when using it as an input for address translation. This allows the
 top byte to store metadata. In MTE four bits of the top byte are used to provide the key</p>
 </section>
 <section id="architectural-details">
 <h2>Architectural Details<a class="headerlink" href="#architectural-details" title="Permalink to this heading"></a></h2>
 <p>MTE adds instructions to the Armv8-A Architecture that are outlined below and grouped
 into three different categories [6]:
 Instructions for tag manipulation applicable to stack and heap tagging.</p>
 <p>IRG
 In order for the statistical basis of MTE to be valid, a source of random tags is required.
 IRG is defined to provide this in hardware and insert such a tag into a register for use
 by other instructions.</p>
 <p>GMI
 This instruction is for manipulating the excluded set of tags for use with the IRG instruction.
 This is intended for cases where software uses specific tag values for special purposes
 while retaining random tag behavior for normal allocations.</p>
 <p>LDG, STG, and STZG
 These instructions allow getting or setting tags in memory. They are intended for changing
 tags in memory either without modifying the data or zeroing the data.</p>
 <p>ST2G and STZ2G
 These are denser alternatives to STG and STZG which operate on two granules of memory
 when allocation size allows them to be used.</p>
 <p>STGP
 This instruction stores both tag and data to memory.
 Instructions Intended for pointer arithmetic and stack tagging:</p>
 <p>ADDG and SUBG
 These are variants of the ADD and SUB instructions, intended for arithmetic on addresses.
 They allow both the tag and address to be separately modified by an immediate value.
 These instructions are intended for creating the addresses of objects on the stack.</p>
 <p>SUBP(S)
 This instruction provides a 56-bit subtract with optional flag setting which is required
 for pointer arithmetic that ignores the tag in the top byte.</p>
 <p>Instructions intended for system use:
 LDGM, STGM, and STZGM
 These are bulk tag manipulation instructions which are UNDEFINED at EL0. These are
 intended for system software to manipulate tags for the purposes of initialization and
 serialization. For example, they can be used to implement swapping of tagged memory
 to a medium which is not tag-aware. The zeroing form can be used for efficient
 initialization of memory.</p>
 <p>Currently NX OS supports the execution of the above instructions,
 such as irg, ldg, stg instructions.
 Their test programs are stored in “apps/system/mte” to test whether the current system supports</p>
 </section>
 <section id="usage">
 <h2>Usage<a class="headerlink" href="#usage" title="Permalink to this heading"></a></h2>
 <p>If you want to experience the MTE function of NX OS, you can refer to the following：
 To enable ARM64_MTE, configure the kernel with:</p>
 <div class="highlight-none notranslate"><div class="highlight"><pre><span></span>CONFIG_ARM64_MTE=y
 </pre></div>
 </div>
 <p>Of course you can also run it with the existing configuration：</p>
 <blockquote>
 <div><p>boards/arm64/qemu/qemu-armv8a/configs/mte</p>
 </div></blockquote>
 </section>
 </section>


            </div>
           </div>
           <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
         <a href="cortexmhardfaults.html" class="btn btn-neutral float-left" title="Analyzing Cortex-M Hardfaults" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
         <a href="../guides/index.html" class="btn btn-neutral float-right" title="Guides" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
     </div>

   <hr/>

   <div role="contentinfo">
     <p>&#169; Copyright 2023, The Apache Software Foundation.</p>
   </div>


 </footer>
         </div>
       </div>
     </section>
   </div>
   <script>
       jQuery(function () {
           SphinxRtdTheme.Navigation.enable(true);
       });
   </script>

 </body>
 </html>
	<!--
	Documentation/_templates/layout.html

	Licensed to the Apache Software Foundation (ASF) under one or more
	contributor license agreements. See the NOTICE file distributed with
	this work for additional information regarding copyright ownership. The
	ASF licenses this file to you under the Apache License, Version 2.0 (the
	"License"); you may not use this file except in compliance with the
	License. You may obtain a copy of the License at

	http://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing, software
	distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
	WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
	License for the specific language governing permissions and limitations
	under the License.
	-->



	<!DOCTYPE html>
	<html class="writer-html5" lang="en">
	<head>
	<meta charset="utf-8" /><meta name="generator" content="Docutils 0.19: https://docutils.sourceforge.io/" />

	<meta name="viewport" content="width=device-width, initial-scale=1.0" />
	<title>ATM64 MTE extension — NuttX latest documentation</title>
	<link rel="stylesheet" type="text/css" href="../_static/pygments.css" />
	<link rel="stylesheet" type="text/css" href="../_static/css/theme.css" />
	<link rel="stylesheet" type="text/css" href="../_static/copybutton.css" />
	<link rel="stylesheet" type="text/css" href="../_static/design-style.1e8bd061cd6da7fc9cf755528e8ffc24.min.css" />
	<link rel="stylesheet" type="text/css" href="../_static/custom.css" />


	<link rel="shortcut icon" href="../_static/favicon.ico"/>
	<script src="../_static/jquery.js"></script>
	<script src="../_static/_sphinx_javascript_frameworks_compat.js"></script>
	<script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
	<script src="../_static/doctools.js"></script>
	<script src="../_static/sphinx_highlight.js"></script>
	<script src="../_static/clipboard.min.js"></script>
	<script src="../_static/copybutton.js"></script>
	<script src="../_static/design-tabs.js"></script>
	<script src="../_static/js/theme.js"></script>
	<link rel="index" title="Index" href="../genindex.html" />
	<link rel="search" title="Search" href="../search.html" />
	<link rel="next" title="Guides" href="../guides/index.html" />
	<link rel="prev" title="Analyzing Cortex-M Hardfaults" href="cortexmhardfaults.html" />
	</head>

	<body class="wy-body-for-nav">
	<div class="wy-grid-for-nav">
	<nav data-toggle="wy-nav-shift" class="wy-nav-side">
	<div class="wy-side-scroll">
	<div class="wy-side-nav-search" >

	<a href="../index.html" class="icon icon-home"> NuttX



	</a>

	<!-- this version selector is quite ugly, should be probably replaced by something
	more modern -->

	<div class="version-selector">
	<select onchange="javascript:location.href = this.value;">

	<option value="../../latest" selected="selected">latest</option>

	<option value="../../10.0.0" >10.0.0</option>

	<option value="../../10.0.1" >10.0.1</option>

	<option value="../../10.1.0" >10.1.0</option>

	<option value="../../10.2.0" >10.2.0</option>

	<option value="../../10.3.0" >10.3.0</option>

	<option value="../../11.0.0" >11.0.0</option>

	<option value="../../12.0.0" >12.0.0</option>

	<option value="../../12.1.0" >12.1.0</option>

	<option value="../../12.2.0" >12.2.0</option>

	<option value="../../12.2.1" >12.2.1</option>

	<option value="../../12.3.0" >12.3.0</option>

	<option value="../../12.4.0" >12.4.0</option>

	<option value="../../12.5.0" >12.5.0</option>

	<option value="../../12.5.1" >12.5.1</option>

	<option value="../../12.6.0" >12.6.0</option>

	<option value="../../12.7.0" >12.7.0</option>

	<option value="../../12.8.0" >12.8.0</option>

	<option value="../../12.9.0" >12.9.0</option>

	<option value="../../12.10.0" >12.10.0</option>

	<option value="../../12.11.0" >12.11.0</option>

	</select>
	</div>


	<div role="search">
	<form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
	<input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
	<input type="hidden" name="check_keywords" value="yes" />
	<input type="hidden" name="area" value="default" />
	</form>
	</div>

	</div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
	<p class="caption" role="heading"><span class="caption-text">Table of Contents</span></p>
	<ul class="current">
	<li class="toctree-l1"><a class="reference internal" href="../index.html">Home</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../introduction/index.html">Introduction</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../quickstart/index.html">Getting Started</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../contributing/index.html">Contributing</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../introduction/inviolables.html">The Inviolable Principles of NuttX</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../platforms/index.html">Supported Platforms</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../components/index.html">OS Components</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../applications/index.html">Applications</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../implementation/index.html">Implementation Details</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../reference/index.html">API Reference</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../faq/index.html">FAQ</a></li>
	<li class="toctree-l1 current"><a class="reference internal" href="index.html">Debugging</a><ul class="current">
	<li class="toctree-l2"><a class="reference internal" href="gdbwithpython.html">GDB with Python</a></li>
	<li class="toctree-l2"><a class="reference internal" href="qemugdb.html">How to debug NuttX using QEMU and GDB</a></li>
	<li class="toctree-l2"><a class="reference internal" href="gdbserver.html">gdbserver</a></li>
	<li class="toctree-l2"><a class="reference internal" href="debugging_elf_loadable_modules.html">Debugging ELF Loadable Modules</a></li>
	<li class="toctree-l2"><a class="reference internal" href="tasktrace.html">Task Trace</a></li>
	<li class="toctree-l2"><a class="reference internal" href="kasan.html">The Kernel Address Sanitizer (KASAN)</a></li>
	<li class="toctree-l2"><a class="reference internal" href="coredump.html">Core Dump</a></li>
	<li class="toctree-l2"><a class="reference internal" href="coresight.html">Coresight - HW Assisted Tracing on ARM</a></li>
	<li class="toctree-l2"><a class="reference internal" href="stackcheck.html">Stack Overflow Check</a></li>
	<li class="toctree-l2"><a class="reference internal" href="stackrecord.html">Run time stack statistics</a></li>
	<li class="toctree-l2"><a class="reference internal" href="disabling_stackdumpdebug.html">Disabling the Stack Dump During Debugging</a></li>
	<li class="toctree-l2"><a class="reference internal" href="debuggingflash_nuttxonarm.html">Debugging / flashing NuttX on ARM with hardware debugger (JTAG/SWD)</a></li>
	<li class="toctree-l2"><a class="reference internal" href="cortexmhardfaults.html">Analyzing Cortex-M Hardfaults</a></li>
	<li class="toctree-l2 current"><a class="current reference internal" href="#">ATM64 MTE extension</a><ul>
	<li class="toctree-l3"><a class="reference internal" href="#introduction">Introduction</a></li>
	<li class="toctree-l3"><a class="reference internal" href="#principle">Principle</a></li>
	<li class="toctree-l3"><a class="reference internal" href="#architectural-details">Architectural Details</a></li>
	<li class="toctree-l3"><a class="reference internal" href="#usage">Usage</a></li>
	</ul>
	</li>
	</ul>
	</li>
	<li class="toctree-l1"><a class="reference internal" href="../guides/index.html">Guides</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../glossary.html">Glossary</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../logos/index.html">NuttX Logos</a></li>
	<li class="toctree-l1"><a class="reference internal" href="../_tags/tagsindex.html">Tags</a></li>
	</ul>

	</div>
	</div>
	</nav>

	<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
	<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
	<a href="../index.html">NuttX</a>
	</nav>

	<div class="wy-nav-content">
	<div class="rst-content">
	<div role="navigation" aria-label="Page navigation">
	<ul class="wy-breadcrumbs">
	<li><a href="../index.html" class="icon icon-home" aria-label="Home"></a></li>
	<li class="breadcrumb-item"><a href="index.html">Debugging</a></li>
	<li class="breadcrumb-item active">ATM64 MTE extension</li>
	<li class="wy-breadcrumbs-aside">
	<a href="https://github.com/apache/nuttx/blob/master/Documentation/debugging/mte.rst" class="fa fa-github"> Edit on GitHub</a>
	</li>
	</ul>
	<hr/>
	</div>
	<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
	<div itemprop="articleBody">

	<section id="atm64-mte-extension">
	<h1>ATM64 MTE extension<a class="headerlink" href="#atm64-mte-extension" title="Permalink to this heading"></a></h1>
	<section id="introduction">
	<h2>Introduction<a class="headerlink" href="#introduction" title="Permalink to this heading"></a></h2>
	<p>Arm v8.5 introduced the Arm Memory Tagging Extension (MTE),
	a hardware implementation of tagged memory.</p>
	<p>Basically, MTE tags every memory allocation/deallocation
	with additional metadata. It assigns a tag to a memory location,
	which can then be associated with a pointer that references
	that memory location. At runtime, the CPU checks that the pointer
	and metadata tags match with every load and store.</p>
	<p>NX OS currently supports deploying MTE on ARM64 QEMU,
	which is supported at the EL1 level of NX OS.</p>
	</section>
	<section id="principle">
	<h2>Principle<a class="headerlink" href="#principle" title="Permalink to this heading"></a></h2>
	<p>The Arm Memory Tagging Extension implements lock and key access to memory.
	Locks can be set on memory and keys provided during memory access. If the key matches
	the lock, the access is permitted. If it does not match, an error is reported.</p>
	<p>Memory locations are tagged by adding four bits of metadata to each 16 bytes
	of physical memory. This is the Tag Granule. Tagging memory implements the lock.
	Pointers, and therefore virtual addresses, are modified to contain the key.
	In order to implement the key bits without requiring larger pointers MTE uses the Top Byte
	Ignore (TBI) feature of the Armv8-A Architecture. When TBI is enabled, the top byte of
	a virtual address is ignored when using it as an input for address translation. This allows the
	top byte to store metadata. In MTE four bits of the top byte are used to provide the key</p>
	</section>
	<section id="architectural-details">
	<h2>Architectural Details<a class="headerlink" href="#architectural-details" title="Permalink to this heading"></a></h2>
	<p>MTE adds instructions to the Armv8-A Architecture that are outlined below and grouped
	into three different categories [6]:
	Instructions for tag manipulation applicable to stack and heap tagging.</p>
	<p>IRG
	In order for the statistical basis of MTE to be valid, a source of random tags is required.
	IRG is defined to provide this in hardware and insert such a tag into a register for use
	by other instructions.</p>
	<p>GMI
	This instruction is for manipulating the excluded set of tags for use with the IRG instruction.
	This is intended for cases where software uses specific tag values for special purposes
	while retaining random tag behavior for normal allocations.</p>
	<p>LDG, STG, and STZG
	These instructions allow getting or setting tags in memory. They are intended for changing
	tags in memory either without modifying the data or zeroing the data.</p>
	<p>ST2G and STZ2G
	These are denser alternatives to STG and STZG which operate on two granules of memory
	when allocation size allows them to be used.</p>
	<p>STGP
	This instruction stores both tag and data to memory.
	Instructions Intended for pointer arithmetic and stack tagging:</p>
	<p>ADDG and SUBG
	These are variants of the ADD and SUB instructions, intended for arithmetic on addresses.
	They allow both the tag and address to be separately modified by an immediate value.
	These instructions are intended for creating the addresses of objects on the stack.</p>
	<p>SUBP(S)
	This instruction provides a 56-bit subtract with optional flag setting which is required
	for pointer arithmetic that ignores the tag in the top byte.</p>
	<p>Instructions intended for system use:
	LDGM, STGM, and STZGM
	These are bulk tag manipulation instructions which are UNDEFINED at EL0. These are
	intended for system software to manipulate tags for the purposes of initialization and
	serialization. For example, they can be used to implement swapping of tagged memory
	to a medium which is not tag-aware. The zeroing form can be used for efficient
	initialization of memory.</p>
	<p>Currently NX OS supports the execution of the above instructions,
	such as irg, ldg, stg instructions.
	Their test programs are stored in “apps/system/mte” to test whether the current system supports</p>
	</section>
	<section id="usage">
	<h2>Usage<a class="headerlink" href="#usage" title="Permalink to this heading"></a></h2>
	<p>If you want to experience the MTE function of NX OS, you can refer to the following：
	To enable ARM64_MTE, configure the kernel with:</p>
	<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>CONFIG_ARM64_MTE=y
	</pre></div>
	</div>
	<p>Of course you can also run it with the existing configuration：</p>
	<blockquote>
	<div><p>boards/arm64/qemu/qemu-armv8a/configs/mte</p>
	</div></blockquote>
	</section>
	</section>


	</div>
	</div>
	<footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
	<a href="cortexmhardfaults.html" class="btn btn-neutral float-left" title="Analyzing Cortex-M Hardfaults" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
	<a href="../guides/index.html" class="btn btn-neutral float-right" title="Guides" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
	</div>

	<hr/>

	<div role="contentinfo">
	<p>© Copyright 2023, The Apache Software Foundation.</p>
	</div>



	</footer>
	</div>
	</div>
	</section>
	</div>
	<script>
	jQuery(function () {
	SphinxRtdTheme.Navigation.enable(true);
	});
	</script>

	</body>
	</html>