6 ms·

Enable ARMv9 Memory Tagging Extension (MTE) on Pixel 8

111 points by transpute 3y ago

maxloh 3y ago
Why isn't it enabled by default?
- vesinisa 3y ago
  There's probably a very good reason for it. I would definitely advice anyone against enabling "Developer options" on your phone without having a good understanding what those options do. They are hidden and hard to access for a reason.
  - j1elo 3y ago
    Sadly they contain some options which ought to be part of the normal system settings, but they aren't. Such as animation speed. I hate _so much_ all the wobblyness of the GUI! Everything bouncing, sliding, and hovering around. Thankfully one can enable Developer options and set all that stuff to 0x, which effectively disables everything and now the system becomes crisp and instant, as it should be. Another essential setting for saving much precious battery, is to not have the cellular data active at all times even when WiFi is active. If I come home and enable wifi, I do not want the cellular data to stay active too in the background. It's much better waiting the couple seconds it might take to switch networks, in exchange for some extra juice.
    - tuukkah 3y ago
      Also, configure "Smallest width" to a high dp value to fit more content on the screen.
      - j1elo 3y ago
        For sure! that one is a very good candidate for basic option to tune on any phone. I always up it a bit to gain more screen estate.
- helloooooooo 3y ago
  Because it keeps catching poorly written code that hasn’t yet been fixed.
  - benibela 3y ago
    Or clever code that should not be fixed I just added my own tagging to my pointers. I have 48-bit pointers and 16-bit of tagging data. I replaced all my struct { word type; char* data }; with something like (type << 48) | data. This saves a memory allocation and pointer indirection. It is much faster
- muricula 3y ago
  There is almost certainly a performance and battery life hit. Each pointer dereference will trigger a lookup in the MTE tag table, and a comparison between the pointer's tag and the table's tag. So you have a decently sized chunk of RAM set aside for the tag table, more memory bandwidth used up by table lookups, and the cost of the actual tag checks.
shermozle 3y ago
Multicultural Toronto English? Something else? (site seems dead)
- darkamaul 3y ago
  Memory Tagging Extension (MTE) This allows to assign tag to each memory allocation. And subsequent accesses to the same memory area must be made with a pointer having a correct tag.
- zerocrates 3y ago
  Memory Tagging Extension, an arm v9 hardware feature for mitigating some memory safety bugs.
  - LoganDark 3y ago
    Is this the outcome of the Morello project? Honestly sounds nice.
    - akyuu 3y ago
      No, AFAIK Morello project is about designing an Arm CPU with CHERI, a hardware architecture with extra security capabilities that is still WIP: https://tratt.net/laurie/blog/2023/two_stories_for_what_is_cheri.html https://tratt.net/laurie/blog/2023/two_stories_for_what_is_c...
      - LoganDark 3y ago
        I've been trying to get a Morello board for months, but they only offer them to large research institutions, not individuals who just want a hobby project. I'm aware of CHERI being different from this, but it still seems similar.
    - obnauticus 3y ago
      CHERI vs MTE is a bit of a nuanced topic. At least one part of the limiting factor for MTE is that you get a finite number of tag “color codes” which opens the opportunity for some form of probabilistic attacks. Of course this helps with defense in depth as it’s yet another layer of security, but it isn’t as strong of a prevention as a CHERI capability for example. This page explains it pretty well: https://msrc.microsoft.com/blog/2022/01/an_armful_of_cheris/ https://msrc.microsoft.com/blog/2022/01/an_armful_of_cheris/
Moldoteck 3y ago
Memory tagged extension, to prevent some memory access bugs Here more info: https://brandulox.medium.com/pixel-8-and-8-pro-the-first-smartphones-with-android-14s-advanced-feature-4fdf2b0a02b4 https://brandulox.medium.com/pixel-8-and-8-pro-the-first-sma...
cjnicholls 3y ago
https://archive.is/09uCE https://archive.is/09uCE
akyuu 3y ago
Consider using GrapheneOS instead of stock Android for an improved version of MTE (and extra security and privacy as a bonus): https://discuss.grapheneos.org/d/8439-mte-support-status-for-grapheneos/34 https://discuss.grapheneos.org/d/8439-mte-support-status-for... > Stock Pixel OS has it as a developer option which isn't usable in practice since it breaks far too much. The implementation is also much less powerful than hardened_malloc. > We integrated it into hardened_malloc where it's able to provide stronger security properties than the experimental stock OS implementation. > When fully integrated into the compiler and each heap allocator, MTE enforces a form of memory safety. It detects memory corruption as it happens. 4 bit tags limit it to probabilistic detection for the general case, but deterministic guarantees are possible via reserving tags. In hardened_malloc, we deterministically prevent sequential overflows by excluding adjacent tags. Also, currently it's not clear if it makes sense to enable kernel MTE: > MTE support for protecting the Linux kernel isn't enabled yet, but we can likely enable that by default too. However, it's currently part of kasan and is more oriented towards debugging than hardening. It's not entirely clear that enabling it in the current state is a good idea.
- matheusmoreira 3y ago
  GrapheneOS is the number one reason to get a Pixel. They do a lot of good work. Strcat's posts are very informative: https://news.ycombinator.com/threads?id=strcat https://news.ycombinator.com/threads?id=strcat
- mikae1 3y ago
  Writing this from a Pixel running GrapheneOS. I've been away from Graphene (using Lineage) since the CopperheadOS days. Coming back I can safely say I will be buying Pixels as long as GrapheneOS is around. The robustness a finish is just amazing. To anyone using a Pixel: install and donate (if you can)! The web installer[1] is basically a few clicks on a web page. So damned impressed. [1] https://grapheneos.org/install/web https://grapheneos.org/install/web
  - galangalalgol 3y ago
    Do you lose the whole play store? Does it even make sense if I use gmail? I like the idea at least. And my 4a isn't getting updates now(on graphene either apparently) which is a shame because I still like it. I used to ise lineage on Samsung devices.
transpute 3y ago
Arm memory tagging whitepaper (2019), https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/Arm_Memory_Tagging_Extension_Whitepaper.pdf https://developer.arm.com/-/media/Arm%20Developer%20Communit... > MTE provides a mechanism to detect both [spatial, temporal] categories of memory safety violation. MTE assists the detection of potential vulnerabilities before deployment by increasing the effectiveness of testing and fuzzing. MTE also assists detection of vulnerabilities at scale after deployment ... Memory locations are tagged by adding four bits of metadata to each 16 bytes of physical memory. This is the Tag Granule. Tagging memory implements the lock. Pointers, and therefore virtual addresses, are modified to contain the key.
- kramerger 3y ago
  And Googles announcement from 2019... https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html?m=1 https://security.googleblog.com/2019/08/adopting-arm-memory-...
  - transpute 3y ago
    Project Zero today, https://googleprojectzero.blogspot.com/2023/11/first-handset-with-mte-on-market.html https://googleprojectzero.blogspot.com/2023/11/first-handset... > The ability of MTE to detect memory corruption exploitation at the first dangerous access is a significant improvement in diagnostic and potential security effectiveness. The availability of MTE on a production handset for the first time is a big step forward, and I think there's real potential to use this technology to make 0-day harder.
soulbadguy 3y ago
Sounds very useful. Even just for testing. Does x86 have something comparable?
- kafrofrite 3y ago
  IIRC, Intel announced about a year later plans to develop something similar. That being said, at the time they didn't have a specific timeline.
- higherhalf 3y ago
  Yes. Kind of. AMD processors have Upper Address Ignore (UAI) with 7 bits of ancillary data, for Intel there is Linear Address Masking (LAM) with 6 or 15 bits [1]. The latter has made it into Linux after some initial resistance [2]. [1]: https://lwn.net/Articles/888914 https://lwn.net/Articles/888914 [2]: https://www.phoronix.com/news/Intel-LAM-Merged-Linux-6.4 https://www.phoronix.com/news/Intel-LAM-Merged-Linux-6.4
  - Liquid_Fire 3y ago
    Those sound analogous to the TBI feature in Arm, rather than MTE itself (which uses TBI).
- pjmlp 3y ago
  They did, MPX, however the design was buggy and eventually removed. Currently x86 is the only mainstrem architecture without a plan for hardware memory tagging. Even RISC-V has an ongoing discussion for hardware memory tagging extensions.
  - hmry 3y ago
    If AMD and Intel drag their feet long enough, CHERI will be production ready before then.
    - pjmlp 3y ago
      True, however unless Windows developer community finally embraces ARM, that is something that will only worry them on the server with UNIX based workloads.
howtofly 3y ago
MTE is something like hardware-blessed address sanitizer. For more on MTE, I would recommend this nice short article: https://lwn.net/Articles/834289/ https://lwn.net/Articles/834289/
kramerger 3y ago
Wait, is this the first ARMv9 chip? (Apple M3 is ARMv8.x, with X being 4 or 6 depending on who you ask)
- saagarjha 3y ago
  Tensor G3 uses Cortex-X3/Cortex-A715/Cortex-510 from ARM, which are all ARMv9 cores. That said, there are other, earlier cores that also implement the ISA: Cortex-X2/Cortex-A710, for example.
vzaliva 3y ago
I would love to hear a first-hand report of running in this mode from a week or two. Any bugs? Performance isses?
- CuriousCosmic 3y ago
  GrapheneOS runs with MTE on by default and it works great. I can't speak to issues with stock AOSP or Pixel roms but if there are issues, the GrapheneOS team has patched over them well enough that I haven't noticed one yet
_ea1k 3y ago
I just wish there were a great virtual machine manager for Pixels. Apparently it is now possible without root, but only nestbox is available, AFAIK. It might be ok, but the monthly fee isn't a great deal, IMO.
chenxiaolong 3y ago
Per [1], I've also enabled MTE for user applications via the `persist.arm64.memtag.app_default` property. So far, the only crashes I've seen have been in apps that use cgo (eg. syncthing and rclone). With root access, things can be persistently whitelisted on a per-app basis [2]: su -c 'setprop persist.arm64.memtag.app.<package name> off' or based on basename(argv[0]) [3]: su -c 'setprop persist.device_config.memory_safety_native.mode_override.process.<basename> off' [1] https://googleprojectzero.blogspot.com/2023/11/first-handset-with-mte-on-market.html https://googleprojectzero.blogspot.com/2023/11/first-handset... [2] https://cs.android.com/android/platform/superproject/main/+/main:frameworks/base/core/java/com/android/internal/os/Zygote.java;l=1299;drc=4651c3f89d1a234a70298803eab707ed5192e812 https://cs.android.com/android/platform/superproject/main/+/... [3] https://cs.android.com/android/platform/superproject/main/+/main:bionic/libc/bionic/libc_init_static.cpp;l=270;drc=7c1f3770afb1e4a3188de34d7649b23c16a49376 https://cs.android.com/android/platform/superproject/main/+/...

111 points by transpute 3y ago

maxloh 3y ago

Why isn't it enabled by default?

vesinisa 3y ago
There's probably a very good reason for it. I would definitely advice anyone against enabling "Developer options" on your phone without having a good understanding what those options do. They are hidden and hard to access for a reason.
- j1elo 3y ago
  Sadly they contain some options which ought to be part of the normal system settings, but they aren't. Such as animation speed. I hate _so much_ all the wobblyness of the GUI! Everything bouncing, sliding, and hovering around. Thankfully one can enable Developer options and set all that stuff to 0x, which effectively disables everything and now the system becomes crisp and instant, as it should be. Another essential setting for saving much precious battery, is to not have the cellular data active at all times even when WiFi is active. If I come home and enable wifi, I do not want the cellular data to stay active too in the background. It's much better waiting the couple seconds it might take to switch networks, in exchange for some extra juice.
  - tuukkah 3y ago
    Also, configure "Smallest width" to a high dp value to fit more content on the screen.
    - j1elo 3y ago
      For sure! that one is a very good candidate for basic option to tune on any phone. I always up it a bit to gain more screen estate.
helloooooooo 3y ago
Because it keeps catching poorly written code that hasn’t yet been fixed.
- benibela 3y ago
  Or clever code that should not be fixed I just added my own tagging to my pointers. I have 48-bit pointers and 16-bit of tagging data. I replaced all my struct { word type; char* data }; with something like (type << 48) | data. This saves a memory allocation and pointer indirection. It is much faster
muricula 3y ago
There is almost certainly a performance and battery life hit. Each pointer dereference will trigger a lookup in the MTE tag table, and a comparison between the pointer's tag and the table's tag. So you have a decently sized chunk of RAM set aside for the tag table, more memory bandwidth used up by table lookups, and the cost of the actual tag checks.

shermozle 3y ago

Multicultural Toronto English? Something else? (site seems dead)

darkamaul 3y ago
Memory Tagging Extension (MTE) This allows to assign tag to each memory allocation. And subsequent accesses to the same memory area must be made with a pointer having a correct tag.
zerocrates 3y ago
Memory Tagging Extension, an arm v9 hardware feature for mitigating some memory safety bugs.
- LoganDark 3y ago
  Is this the outcome of the Morello project? Honestly sounds nice.
  - akyuu 3y ago
    No, AFAIK Morello project is about designing an Arm CPU with CHERI, a hardware architecture with extra security capabilities that is still WIP: https://tratt.net/laurie/blog/2023/two_stories_for_what_is_cheri.html https://tratt.net/laurie/blog/2023/two_stories_for_what_is_c...
    - LoganDark 3y ago
      I've been trying to get a Morello board for months, but they only offer them to large research institutions, not individuals who just want a hobby project. I'm aware of CHERI being different from this, but it still seems similar.
  - obnauticus 3y ago
    CHERI vs MTE is a bit of a nuanced topic. At least one part of the limiting factor for MTE is that you get a finite number of tag “color codes” which opens the opportunity for some form of probabilistic attacks. Of course this helps with defense in depth as it’s yet another layer of security, but it isn’t as strong of a prevention as a CHERI capability for example. This page explains it pretty well: https://msrc.microsoft.com/blog/2022/01/an_armful_of_cheris/ https://msrc.microsoft.com/blog/2022/01/an_armful_of_cheris/

Moldoteck 3y ago

Memory tagged extension, to prevent some memory access bugs Here more info: https://brandulox.medium.com/pixel-8-and-8-pro-the-first-smartphones-with-android-14s-advanced-feature-4fdf2b0a02b4 https://brandulox.medium.com/pixel-8-and-8-pro-the-first-sma...

cjnicholls 3y ago

https://archive.is/09uCE https://archive.is/09uCE

akyuu 3y ago

Consider using GrapheneOS instead of stock Android for an improved version of MTE (and extra security and privacy as a bonus): https://discuss.grapheneos.org/d/8439-mte-support-status-for-grapheneos/34 https://discuss.grapheneos.org/d/8439-mte-support-status-for... > Stock Pixel OS has it as a developer option which isn't usable in practice since it breaks far too much. The implementation is also much less powerful than hardened_malloc. > We integrated it into hardened_malloc where it's able to provide stronger security properties than the experimental stock OS implementation. > When fully integrated into the compiler and each heap allocator, MTE enforces a form of memory safety. It detects memory corruption as it happens. 4 bit tags limit it to probabilistic detection for the general case, but deterministic guarantees are possible via reserving tags. In hardened_malloc, we deterministically prevent sequential overflows by excluding adjacent tags. Also, currently it's not clear if it makes sense to enable kernel MTE: > MTE support for protecting the Linux kernel isn't enabled yet, but we can likely enable that by default too. However, it's currently part of kasan and is more oriented towards debugging than hardening. It's not entirely clear that enabling it in the current state is a good idea.

matheusmoreira 3y ago
GrapheneOS is the number one reason to get a Pixel. They do a lot of good work. Strcat's posts are very informative: https://news.ycombinator.com/threads?id=strcat https://news.ycombinator.com/threads?id=strcat
mikae1 3y ago
Writing this from a Pixel running GrapheneOS. I've been away from Graphene (using Lineage) since the CopperheadOS days. Coming back I can safely say I will be buying Pixels as long as GrapheneOS is around. The robustness a finish is just amazing. To anyone using a Pixel: install and donate (if you can)! The web installer[1] is basically a few clicks on a web page. So damned impressed. [1] https://grapheneos.org/install/web https://grapheneos.org/install/web
- galangalalgol 3y ago
  Do you lose the whole play store? Does it even make sense if I use gmail? I like the idea at least. And my 4a isn't getting updates now(on graphene either apparently) which is a shame because I still like it. I used to ise lineage on Samsung devices.

transpute 3y ago

Arm memory tagging whitepaper (2019), https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/Arm_Memory_Tagging_Extension_Whitepaper.pdf https://developer.arm.com/-/media/Arm%20Developer%20Communit... > MTE provides a mechanism to detect both [spatial, temporal] categories of memory safety violation. MTE assists the detection of potential vulnerabilities before deployment by increasing the effectiveness of testing and fuzzing. MTE also assists detection of vulnerabilities at scale after deployment ... Memory locations are tagged by adding four bits of metadata to each 16 bytes of physical memory. This is the Tag Granule. Tagging memory implements the lock. Pointers, and therefore virtual addresses, are modified to contain the key.

kramerger 3y ago
And Googles announcement from 2019... https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html?m=1 https://security.googleblog.com/2019/08/adopting-arm-memory-...
- transpute 3y ago
  Project Zero today, https://googleprojectzero.blogspot.com/2023/11/first-handset-with-mte-on-market.html https://googleprojectzero.blogspot.com/2023/11/first-handset... > The ability of MTE to detect memory corruption exploitation at the first dangerous access is a significant improvement in diagnostic and potential security effectiveness. The availability of MTE on a production handset for the first time is a big step forward, and I think there's real potential to use this technology to make 0-day harder.

soulbadguy 3y ago

Sounds very useful. Even just for testing. Does x86 have something comparable?

kafrofrite 3y ago
IIRC, Intel announced about a year later plans to develop something similar. That being said, at the time they didn't have a specific timeline.
higherhalf 3y ago
Yes. Kind of. AMD processors have Upper Address Ignore (UAI) with 7 bits of ancillary data, for Intel there is Linear Address Masking (LAM) with 6 or 15 bits [1]. The latter has made it into Linux after some initial resistance [2]. [1]: https://lwn.net/Articles/888914 https://lwn.net/Articles/888914 [2]: https://www.phoronix.com/news/Intel-LAM-Merged-Linux-6.4 https://www.phoronix.com/news/Intel-LAM-Merged-Linux-6.4
- Liquid_Fire 3y ago
  Those sound analogous to the TBI feature in Arm, rather than MTE itself (which uses TBI).
pjmlp 3y ago
They did, MPX, however the design was buggy and eventually removed. Currently x86 is the only mainstrem architecture without a plan for hardware memory tagging. Even RISC-V has an ongoing discussion for hardware memory tagging extensions.
- hmry 3y ago
  If AMD and Intel drag their feet long enough, CHERI will be production ready before then.
  - pjmlp 3y ago
    True, however unless Windows developer community finally embraces ARM, that is something that will only worry them on the server with UNIX based workloads.

howtofly 3y ago

MTE is something like hardware-blessed address sanitizer. For more on MTE, I would recommend this nice short article: https://lwn.net/Articles/834289/ https://lwn.net/Articles/834289/

kramerger 3y ago

Wait, is this the first ARMv9 chip? (Apple M3 is ARMv8.x, with X being 4 or 6 depending on who you ask)

saagarjha 3y ago
Tensor G3 uses Cortex-X3/Cortex-A715/Cortex-510 from ARM, which are all ARMv9 cores. That said, there are other, earlier cores that also implement the ISA: Cortex-X2/Cortex-A710, for example.

vzaliva 3y ago

I would love to hear a first-hand report of running in this mode from a week or two. Any bugs? Performance isses?

CuriousCosmic 3y ago
GrapheneOS runs with MTE on by default and it works great. I can't speak to issues with stock AOSP or Pixel roms but if there are issues, the GrapheneOS team has patched over them well enough that I haven't noticed one yet

_ea1k 3y ago

I just wish there were a great virtual machine manager for Pixels. Apparently it is now possible without root, but only nestbox is available, AFAIK. It might be ok, but the monthly fee isn't a great deal, IMO.

chenxiaolong 3y ago

Per [1], I've also enabled MTE for user applications via the `persist.arm64.memtag.app_default` property. So far, the only crashes I've seen have been in apps that use cgo (eg. syncthing and rclone). With root access, things can be persistently whitelisted on a per-app basis [2]: su -c 'setprop persist.arm64.memtag.app.<package name> off' or based on basename(argv[0]) [3]: su -c 'setprop persist.device_config.memory_safety_native.mode_override.process.<basename> off' [1] https://googleprojectzero.blogspot.com/2023/11/first-handset-with-mte-on-market.html https://googleprojectzero.blogspot.com/2023/11/first-handset... [2] https://cs.android.com/android/platform/superproject/main/+/main:frameworks/base/core/java/com/android/internal/os/Zygote.java;l=1299;drc=4651c3f89d1a234a70298803eab707ed5192e812 https://cs.android.com/android/platform/superproject/main/+/... [3] https://cs.android.com/android/platform/superproject/main/+/main:bionic/libc/bionic/libc_init_static.cpp;l=270;drc=7c1f3770afb1e4a3188de34d7649b23c16a49376 https://cs.android.com/android/platform/superproject/main/+/...