Enable ARMv8.5-A MTE Synchronous Mode for Linux Userspace Memory Safety

Desired Outcome

Run a Linux userspace application with ARM Memory Tagging Extension (MTE) in synchronous mode so that spatial and temporal memory safety violations—buffer overflows, use-after-free, out-of-bounds accesses—trigger precise hardware traps delivered as SIGSEGV with si_code=SEGV_MTEERR. Expect roughly 2–5% CPU overhead and 0.1–0.5% memory overhead for tag storage.

Prerequisites

Hardware

ARMv8.5-A or later CPU with MTE support. Examples: Neoverse V1/N2, Cortex-A710/X1/X2, Apple M-series. Verify with:

lscpu | grep -i mte
# or
grep -i mte /proc/cpuinfo

Output must show mte in the Features line.

Kernel

Linux 5.10+ with CONFIG_ARM64_MTE=y. Check:

grep CONFIG_ARM64_MTE /boot/config-$(uname -r)

Should return CONFIG_ARM64_MTE=y. For reliable synchronous mode, kernel 5.19+ is recommended; 5.10–5.18 only stabilized async mode.

Userspace Toolchain

• glibc 2.33+ or musl 1.2.2+ (malloc returns tagged pointers automatically when MTE detected)
• GCC 11+ or Clang 13+ with -fsanitize=memtag support
• No root required for userspace enablement

Procedure

1. Compile with MTE Instrumentation

Add -fsanitize=memtag -fno-omit-frame-pointer -g to compile and link flags. This instruments stack, globals, and heap accesses with tag checks. For Clang 16+, you can also use -fsanitize=memtag-stack -fsanitize=memtag-globals explicitly. GCC 13+ supports equivalent flags.

gcc -fsanitize=memtag -fno-omit-frame-pointer -g -O2 app.c -o app

If you cannot recompile, glibc 2.33+ still tags heap allocations when MTE is enabled at runtime, but stack/globals remain unprotected.

2. Enable Synchronous Mode at Runtime

Call prctl() early in main() before any allocations:

#include <sys/prctl.h>
#include <linux/prctl.h>

int main() {
    prctl(PR_SET_TAGGED_ADDR_CTRL,
          PR_TAGGED_ADDR_ENABLE | PR_MTE_TCF_SYNC,
          0, 0, 0);
    // ... rest of program
}

PR_MTE_TCF_SYNC requests synchronous faults. The call succeeds on supported kernels; check return value (-1 with errno=EINVAL means unsupported).

3. Verify Enablement

After the prctl call, confirm the thread's tagged address control state:

grep TaggedAddrCtrl /proc/self/status

Expected output includes MTE: synchronous.

Expected Checks

Trigger a Known Violation

Compile and run this test to confirm synchronous trapping:

cat > test_mte.c <'EOF'
#include <stdlib.h>
#include <sys/prctl.h>
#include <linux/prctl.h>

int main() {
    prctl(PR_SET_TAGGED_ADDR_CTRL,
          PR_TAGGED_ADDR_ENABLE | PR_MTE_TCF_SYNC,
          0, 0, 0);
    char *p = malloc(16);
    p[16] = 0;  // one-byte overflow
    return 0;
}
EOF
gcc -fsanitize=memtag -g test_mte.c -o test_mte
./test_mte

The process should terminate with SIGSEGV. A signal handler with SA_SIGINFO receives si_code == SEGV_MTEERR and si_addr pointing to the faulting address.

Kernel Logs

dmesg -T | grep -i mte

Shows kernel-side MTE fault entries with fault address and tag values.

Kernel Selftest

Run the upstream MTE selftest (requires root for some subtests):

cd tools/testing/selftests/arm64/mte
make
./mte_check

Hardware Counters

perf stat -e mte_faults,mte_tag_faults ./test_mte

Confirms hardware tag faults are being generated.

Recovery and Mitigation Options

Signal Handler for Diagnostics

Install an async-signal-safe handler to log fault details:

static void mte_handler(int sig, siginfo_t *si, void *uc) {
    // async-signal-safe only: write(2), getauxval(AT_MTE_TAG_MASK)
    // avoid malloc, locks, backtrace()
    _exit(1);
}

struct sigaction sa = { .sa_sigaction = mte_handler, .sa_flags = SA_SIGINFO };
sigaction(SIGSEGV, &sa, NULL);

Use getauxval(AT_MTE_TAG_MASK) to decode the tag from the faulting pointer's top byte.

Phased Deployment Strategy

1. Async mode in CI/CD: Use PR_MTE_TCF_ASYNC to collect telemetry without crashing. Monitor dmesg or perf counters for tag fault rates.
2. Synchronous in staging: Switch to PR_MTE_TCF_SYNC after triaging false positives.
3. Per-thread opt-out: For incompatible code regions (JIT, legacy asm, pointer-compressed runtimes), disable locally:

   prctl(PR_SET_TAGGED_ADDR_CTRL, 0, 0, 0, 0);

4. Fallback: Rebuild without -fsanitize=memtag if overhead is unacceptable.

Limitations and Cautions

• Top-byte ignition (TBI): MTE stores 4-bit tags in the top byte of 64-bit pointers. Code assuming 48-bit virtual addresses or doing integer arithmetic on raw pointers breaks. Use uintptr_t for integer-pointer casts.
• False positives: Synchronous mode traps on every tag mismatch, including allocator metadata, custom allocators, and pointer compression schemes. Test thoroughly before production.
• Stack/globals require instrumentation: Heap tagging is automatic with glibc 2.33+. Stack and global variable tagging needs -fsanitize=memtag-stack/-fsanitize=memtag-globals (Clang 16+, GCC 13+).
• Signal handler constraints: Must be async-signal-safe. No malloc, locks, or complex unwinding.
• Container/VM: Requires host CPU, kernel, and VMM (QEMU 6.0+, KVM) support. Nested virtualization may trap MTE instructions to L0 hypervisor.
• Android differs: Android 12+ enables async MTE by default for system_server; synchronous opt-in via android:memtagMode in manifest.
• Granule alignment: Tags apply per 16-byte granule. Kernel page size (4K/16K/64K) affects alignment; allocations not granule-aligned may have partial tag coverage.

Verification Checklist

• lscpu | grep -i mte shows feature flag
• grep CONFIG_ARM64_MTE /boot/config-$(uname -r) shows =y
• grep TaggedAddrCtrl /proc/self/status shows MTE: synchronous after prctl
• Test program traps with SEGV_MTEERR
• malloc(1) returns pointer with non-zero top byte; free() clears tag
• perf stat -e mte_faults,mte_tag_faults increments on violations

Defense-in-Depth Context

MTE complements, not replaces, other mitigations. Combine with KASAN (kernel) and HWASAN (userspace) for layered coverage. For JIT runtimes (V8, SpiderMonkey, JVM), use mprotect(PROT_MTE) on code pages and manage tags explicitly via ldg/stg instructions. Monitor perf stat -e mte_* counters in production to detect tag fault rate regressions.