ARM CPU security features

MTE (Memory Tagging Extension) (PDF)

The Arm Memory Tagging Extension implements lock and key access to memory. Locks can be set on memory and keys provided during memory access. If the key matches the lock, the access is permitted. If it does not match, an error is reported.

Memory locations are tagged by adding four bits of metadata to each 16 bytes of physical memory. This is the Tag Granule. Tagging memory implements the lock.

Pointers, and therefore virtual addresses, are modified to contain the key

Interesting links:

• The Arm64 memory tagging extension in Linux
• Arm Memory Tagging Extension
• Memory Tagging Extension (MTE) in AArch64 Linux