QEMU hosting MTE enabled kernel does not raise fault - linux

Question

I'm trying to compile and test ARMv8.5 MTE extensions on QEMU environment (running MTE-enabled kernel).
I try to raise a fault on QEMU that hosts a kernel with MTE enabled. I have a simple C code I run that should raise a fault because of MTE, but it runs just fine (attaching logs and info). I cross compile the code to arm64 on a x86 machine, with the relevant clang MTE-related flags.
compiling on 5.4.0-1040-gcp #43-Ubuntu SMP Fri Mar 19 17:49:48 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
running the executable on Linux lab 5.11.13 #1 SMP PREEMPT Sun Apr 11 11:30:52 UTC 2021 aarch64 GNU/Linux with CONFIG_ARM64_MTE=y
The code:
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
int main()
{
printf("Hi %ld\n", (long)getpid());
int *array = (int*) malloc (sizeof(int) * 1);
array[32] = 1;
printf("here is the value: %d", array[32]);
return 0;
}
clang-11 flags:
clang-11 -target aarch64-linux-gnu -march=armv8+memtag -fsanitize=memtag main.c -static
QEMU version:
lab#qemu-mte:~$ qemu-system-aarch64 --version
QEMU emulator version 5.2.92
QEMU flags:
sudo /opt/qemu/build/qemu-system-aarch64 -machine virt,mte=on -cpu max -kernel Image -hda stretch.img -m 2G -display none -serial stdio -append "root=/dev/vda"
executable strace output:
root#lab:/# strace ./test
execve("./test", ["./test"], [/* 11 vars */]) = 0
brk(NULL) = 0x3ada7000
brk(0x3ada7f80) = 0x3ada7f80
uname({sysname="Linux", nodename="lab", ...}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/test", 4096) = 5
brk(0x3adc8f80) = 0x3adc8f80
brk(0x3adc9000) = 0x3adc9000
mprotect(0x489000, 4096, PROT_READ) = 0
getpid() = 235
fstat(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(204, 64), ...}) = 0
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
write(1, "Hi 235\n", 7Hi 235
) = 7
write(1, "here is the value: 1", 20here is the value: 1) = 20
exit_group(0) = ?
+++ exited with 0 +++
Am I missing something?
If any additional information is needed, please let me know.
Thanks.

Answer 1

Nothing in that strace log seems to be doing anything to enable MTE for the process, which seems suspicious. Try building and running the example MTE program given in the kernel documentation for MTE. That does MTE entirely "manually", i.e. without help from the compiler. If it works then you can start looking at the clang side of things; if it doesn't work then you need to check the QEMU and kernel.

Answer 2

For heap tagging, assuming you're using glibc for malloc, you probably need to enable the memory tagging tunable : see this : https://www.gnu.org/software/libc/manual/html_node/Memory-Related-Tunables.html
export GLIBC_TUNABLES=glibc.mem.tagging=1
You might actually need to compile glibc v2.35 with MTE support and then use it (https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html says that memory tagging support is disabled by default)