[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ9YdLI5GC9ouHrCTKvOdnTamhzhBdcRdnpQ6CdMR02I":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":35,"sourceUrl":36,"status":37,"seoTitle":7,"seoDescription":9,"canonicalUrl":38,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"0376ac9f-8733-4176-bab5-0d693977ea1e","article","MTE：处理器怎样给内存加上“标签”，揪出越界访问？","arm-mte-memory-tagging-extension","Arm 的 Memory Tagging Extension 为指针和内存区域附加小型标签，访问时由硬件比对，帮助发现部分越界读写和释放后使用。本文拆解标签如何工作、能抓住哪些错误，以及它为何不是内存安全的万能保险。","手机和服务器里的软件每天都在读写内存，但一个常见错误是：程序拿着过期地址继续访问，或者不小心越过数组边界。过去，这类错误往往要等到崩溃、数据损坏甚至被利用后才露出迹象。Arm 的 Memory Tagging Extension（MTE）尝试让处理器在访问发生时，多做一次轻量的“标签核对”。\n\n## 指针也能带一枚小标签\n\n可以把内存想成有许多储物格。MTE 给每个 16 字节粒度的内存块附上一个分配标签；指针里也携带一个逻辑标签。程序通过该指针读写内存时，支持 MTE 的处理器会比较这两枚标签。匹配就继续，不匹配则产生标签检查故障。Linux 可以按线程选择同步或异步等处理方式：同步模式更容易把错误定位到当下的访问，异步模式则允许处理器先继续运行，再报告故障。\n\n这像是进入储物柜前核对腕带颜色。若程序已经释放一块内存，随后这块区域重新分配并换了标签，旧指针还拿着旧标签，访问便有机会被发现。若程序越过对象边界，落到标签不同的相邻区域，也可能触发故障。对开发者来说，这种检查能把一部分隐蔽的内存错误变成可观察的问题。\n\n## 它抓得到什么，又抓不到什么\n\n标签不是精确到每一个字节，而是以 16 字节为一个粒度。因此，某些越界若仍落在同一标签粒度内，就不一定被发现；释放后重用时，新旧标签也存在偶然相同的可能。MTE 更适合作为开发测试、运行时诊断或加固机制的一环，而不是证明程序“没有内存漏洞”的证书。\n\n它也不是加密：标签不会把数据变成密文，不能阻止别人读取存储介质。MTE 需要硬件支持，操作系统必须启用相应映射，程序也要选择标签检查策略；未启用的区域不会自动获得同样的检测。即便错误被发现，如何处理信号、保存现场、修复代码，仍是软件工程的一部分。\n\n理解 MTE 的关键，是把它看成处理器提供的动态检查工具：它在指针和内存块之间建立快速的一致性提示，帮助尽早揭露部分越界与释放后使用问题。真正稳健的内存安全，仍需要语言、编译器、测试、权限隔离和审慎设计共同承担。\n\n来源：[Linux 内核文档：Memory Tagging Extension](https:\u002F\u002Fdocs.kernel.org\u002Farch\u002Farm64\u002Fmemory-tagging-extension.html)","\u002Fuploads\u002F2026-10-17\u002Fb3ba5676-d466-4a2a-bf38-f1bc77aaff05.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"8d35e42e-9f5b-4dd9-b30f-dc2c53d06096","硬件","hardware",{"id":32,"name":33,"slug":34},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev","Linux Kernel Documentation","https:\u002F\u002Fdocs.kernel.org\u002Farch\u002Farm64\u002Fmemory-tagging-extension.html","published",null,false,50,0,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:27.651Z",[45,54,62],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"5f2d281d-4673-42f3-b5e4-4cc68974abc6","SR-IOV：一张实体网卡怎样变成多个可分配给虚拟机的设备？","sriov-pci-device-virtual-functions","SR-IOV 允许支持该能力的 PCIe 设备由物理功能创建多个虚拟功能，供不同工作负载更直接地使用。本文解释 PF\u002FVF 分工、性能价值，以及为什么硬件虚拟化本身不等于完整隔离。","\u002Fuploads\u002F2026-10-13\u002F8b63e99b-a5e9-4f90-bbdb-81b28a2a38be.jpg",44,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:46.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":42,"createdAt":61},"ccf00154-c4a8-4439-a8e8-4151b1c20721","AF_XDP：Linux 怎样把高速网卡数据直接交给用户程序？","linux-af-xdp-fast-packet-path","AF_XDP 是 Linux 面向高性能收发包的套接字接口，可把 XDP 处理后的数据送入用户态环形队列。本文从网卡、缓冲区和队列讲清数据路径，并说明所谓零拷贝依赖驱动与硬件支持。","\u002Fuploads\u002F2026-10-17\u002Ffdcc8edb-927f-41dc-8802-1e9053c47bfa.jpg",45,"2026-10-17T03:08:33.177Z",{"id":63,"type":6,"title":64,"slug":65,"summary":66,"coverUrl":67,"authorName":14,"sno":68,"publishedAt":52,"createdAt":69},"2ff97b85-3142-4a75-924f-e6afa339d700","NVMe ZNS：为什么有些 SSD 要求数据按区域顺序写？","nvme-zns-zoned-namespace","ZNS 把 SSD 命名空间划分为必须顺序写入的区域，让主机参与闪存数据布局与回收。本文解释这种分工如何减少无效搬运，也说明它给文件系统和应用带来的管理成本。","\u002Fuploads\u002F2026-10-13\u002Fd2d45247-533f-4b02-b1a8-56f14d1dade3.jpg",46,"2026-10-13T02:13:43.485Z"]