SUBG Subtract with tag This instruction subtracts an immediate value scaled by the Tag Granule from the address in the source register, modifies the Logical Address Tag of the address using an immediate value, and writes the result to the destination register. Tags specified in GCR_EL1.Exclude are excluded from the possible outputs when modifying the Logical Address Tag. 1 1 0 1 0 0 0 1 1 0 (0) (0) SUBG <Xd|SP>, <Xn|SP>, #<uimm6>, #<uimm4> if !IsFeatureImplemented(FEAT_MTE) then EndOfDecode(Decode_UNDEF); end; let d : integer{} = UInt(Rd); let n : integer{} = UInt(Rn); let tag_offset : bits(4) = imm4; let offset : bits(64) = LSL(ZeroExtend{64}(imm6), LOG2_TAG_GRANULE); <Xd|SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" field. <Xn|SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. <uimm6> Is an unsigned immediate, a multiple of 16 in the range 0 to 1008, encoded in the "imm6" field. <uimm4> Is an unsigned immediate, in the range 0 to 15, encoded in the "imm4" field. let operand1 : bits(64) = if n == 31 then SP{64}() else X{64}(n); let start_tag : bits(4) = AArch64_AllocationTagFromAddress(operand1); let exclude : bits(16) = GCR_EL1().Exclude; let rtag : bits(4) = AArch64_ChooseNonExcludedTagOrZero(start_tag, tag_offset, exclude); var result : bits(64); (result, -) = AddWithCarry{64}(operand1, NOT(offset), '1'); result = AArch64_AddressWithAllocationTag(result, rtag); if d == 31 then SP{64}() = result; else X{64}(d) = result; end; 2026-03-26 20:27:25 2026-03_rel