{"id":1608,"date":"2023-10-26T12:19:46","date_gmt":"2023-10-26T19:19:46","guid":{"rendered":"https:\/\/outflux.net\/blog\/?p=1608"},"modified":"2023-10-26T12:26:31","modified_gmt":"2023-10-26T19:26:31","slug":"enable-mte-on-pixel-8","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2023\/10\/26\/enable-mte-on-pixel-8\/","title":{"rendered":"Enable MTE on Pixel 8"},"content":{"rendered":"<p>The Pixel 8 hardware (<a href=\"https:\/\/www.androidpolice.com\/google-tensor-g3\/\">Tensor G3<\/a>) supports the ARM <a href=\"https:\/\/source.android.com\/docs\/security\/test\/memory-safety\/arm-mte\">Memory Tagging Extension (MTE)<\/a>, and software support is available both in Android userspace and the Linux kernel. This feature is a powerful defense against linear buffer overflows and many types of use-after-free flaws. I&#8217;m extremely happy to see this hardware finally available in the real world.<\/p>\n<p>Turning it on for userspace is already wired up the Android UI: <code>Settings \/ System \/ Developer options \/ Memory Tagging Extension \/ Enable MTE until you turn if off<\/code>. Once enabled it will internally change an Android &#8220;system property&#8221; named &#8220;<a href=\"https:\/\/source.android.com\/docs\/security\/test\/memory-safety\/bootloader-support\"><code>arm64.memtag.bootctl<\/code><\/a>&#8221; by adding the option &#8220;<code>memtag<\/code>&#8220;.<\/p>\n<p>Turning it on for the kernel is slightly more involved, but not difficult at all. This requires manually setting the &#8220;<code>arm64.memtag.bootctl<\/code>&#8221; property mentioned above to include &#8220;<code>memtag-kernel<\/code>&#8221; as well:<\/p>\n<ul>\n<li>Plug your phone into a system that can run the <code>adb<\/code> tool<\/li>\n<li>If not already installed, install <code>adb<\/code>. For example on Debian\/Ubuntu: <code>sudo apt install adb<\/code><\/li>\n<li>Turn on &#8220;USB Debugging&#8221; in the phone&#8217;s &#8220;Developer options&#8221; menu, and accept the debugging session confirmation that will pop up when you first run <code>adb<\/code><\/li>\n<li>Verify the current setting: <code>adb shell getprop | grep memtag.bootctl<\/code><\/li>\n<p>  <code>[arm64.memtag.bootctl]: [memtag]<\/code><\/p>\n<li>Enable kernel MTE: <code>adb shell setprop arm64.memtag.bootctl memtag,memtag-kernel<\/code><\/li>\n<li>Check the results: <code>adb shell getprop | grep memtag.bootctl<\/code><\/li>\n<p>  <code>[arm64.memtag.bootctl]: [memtag,memtag-kernel]<\/code><\/p>\n<li>Reboot your phone\n<\/ul>\n<p>To check that MTE is enabled for the kernel (which is implemented using <a href=\"https:\/\/docs.kernel.org\/dev-tools\/kasan.html#hardware-tag-based-kasan\">Kernel Address Sanitizer&#8217;s Hardware Tagging<\/a> mode), you can check the kernel command line after rebooting:<\/p>\n<pre class=\"brush:shell\">\r\n$ mkdir foo && cd foo\r\n$ adb bugreport\r\n...\r\n$ mkdir unpacked && cd unpacked\r\n$ unzip ..\/bugreport*.zip\r\n...\r\n$ grep kasan= bugreport*.txt\r\n...: Command line: ... kasan=off ... kasan=on ...\r\n<\/pre>\n<p>The latter &#8220;<code>kasan=on<\/code>&#8221; overrides the earlier &#8220;<code>kasan=off<\/code>&#8220;.<\/p>\n<p>Enjoy!<\/p>\n<p style='text-align:left'>&copy; 2023, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Pixel 8 hardware (Tensor G3) supports the ARM Memory Tagging Extension (MTE), and software support is available both in Android userspace and the Linux kernel. This feature is a powerful defense against linear buffer overflows and many types of use-after-free flaws. I&#8217;m extremely happy to see this hardware finally available in the real world. [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,21,6],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/1608"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=1608"}],"version-history":[{"count":10,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/1608\/revisions"}],"predecessor-version":[{"id":1618,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/1608\/revisions\/1618"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=1608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=1608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=1608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}