Linux 5.9 To Bring Arm Memory Tagging Extension Support

The 64-bit ARM code building up for the Linux 5.9 cycle is set to mainline Memory Tagging Extension (MTE) support as another security improvement inbound.

The Memory Tagging Extension (MTE) of the ARMv8.5-A specification is intended to help fend off potential memory safety violations that could lead to exploits of the system. MTE has the mechanism with supported hardware to detect the most common memory safety violations and can assist in detection of vulnerabilities.

MTE fundamentally provides lock and key access to memory and checking that the key matches a given lock otherwise an error is raised. Tagging is done by adding four bits of metadata to every 16 bytes of physical memory and implements the lock while memory pointers are modified to contain the key.

Arm MTE support requires a modified C library and OS kernel. With Linux 5.9 there is now mainline support for MTE. The kernel-side changes are about making the necessary portions of the kernel aware of memory tags.

More details on Arm Memory Tagging Extension functionality can be found via this whitepaper.

What there is new to report on is MTE functionality currently being queued as part of the key ARM64 changes for the next version of the kernel, Linux 5.9. The Linux 5.9 cycle will formally kick off in August and release around October with this Arm memory safety feature.