[PATCH v3 1/2] rtld: Enable MTE for stack when specified in .dynamic
Adhemerval Zanella Netto
adhemerval.zanella@linaro.org
Fri Mar 13 18:58:43 GMT 2026
On 10/03/26 11:11, claudiu.zissulescu-ianculescu@oracle.com wrote:
> From: Cupertino Miranda <cupertino.miranda@oracle.com>
>
> This patch enables Memory Tag Extension (MTE) for stack tagging in the
> rtld. Parse DT_AARCH64_MEMTAG_STACK and DT_AARCH64_MEMTAG_MODE from
> the main program and enable stack memory tagging in the dynamic
> loader, as described in ARM's ABI [1] documentation.
>
> Ref:
> [1] https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst
> ---
> elf/elf.h | 7 +-
> sysdeps/aarch64/Makefile | 1 +
> sysdeps/aarch64/cpu-features.h | 12 +++
> sysdeps/aarch64/dl-mte.c | 85 +++++++++++++++++++
> sysdeps/aarch64/dl-prop.h | 4 +
> sysdeps/unix/sysv/linux/aarch64/Makefile | 4 +
> .../unix/sysv/linux/aarch64/dl-mte-stack.c | 45 ++++++++++
> 7 files changed, 157 insertions(+), 1 deletion(-)
> create mode 100644 sysdeps/aarch64/dl-mte.c
> create mode 100644 sysdeps/unix/sysv/linux/aarch64/dl-mte-stack.c
>
> diff --git a/elf/elf.h b/elf/elf.h
> index 46a01281cb..02c4125cb1 100644
> --- a/elf/elf.h
> +++ b/elf/elf.h
> @@ -3039,7 +3039,12 @@ enum
> #define DT_AARCH64_BTI_PLT (DT_LOPROC + 1)
> #define DT_AARCH64_PAC_PLT (DT_LOPROC + 3)
> #define DT_AARCH64_VARIANT_PCS (DT_LOPROC + 5)
> -#define DT_AARCH64_NUM 6
> +#define DT_AARCH64_MEMTAG_MODE (DT_LOPROC + 9)
> +#define DT_AARCH64_MEMTAG_HEAP (DT_LOPROC + 11)
> +#define DT_AARCH64_MEMTAG_STACK (DT_LOPROC + 12)
> +#define DT_AARCH64_MEMTAG_GLOBALS (DT_LOPROC + 13)
> +#define DT_AARCH64_MEMTAG_GLOBALSSZ (DT_LOPROC + 15)
> +#define DT_AARCH64_NUM 16
>
> /* AArch64 specific values for the st_other field. */
> #define STO_AARCH64_VARIANT_PCS 0x80
> diff --git a/sysdeps/aarch64/Makefile b/sysdeps/aarch64/Makefile
> index d6c5cc96ca..dfbc33d2f4 100644
> --- a/sysdeps/aarch64/Makefile
> +++ b/sysdeps/aarch64/Makefile
> @@ -4,6 +4,7 @@ ifeq ($(subdir),elf)
> sysdep-dl-routines += \
> dl-bti \
> dl-gcs \
> + dl-mte \
> # sysdep-dl-routines
>
> tests += \
> diff --git a/sysdeps/aarch64/cpu-features.h b/sysdeps/aarch64/cpu-features.h
> index 1fe35d986b..91e0ce9a90 100644
> --- a/sysdeps/aarch64/cpu-features.h
> +++ b/sysdeps/aarch64/cpu-features.h
> @@ -74,4 +74,16 @@ struct cpu_features
> bool mops;
> };
>
> +#define ARCH_MTE_MODE_SYNC (1 << 1)
> +#define ARCH_MTE_MODE_ASYNC (1 << 2)
> +#define AARCH64_CPU_FEATURE_MTE_STATE_STACK (1 << 3)
> +
> +#define AARCH64_CPU_FEATURE_MTE_STATE_MODE_MASK (0x3)
> +#define AARCH64_CPU_FEATURE_MTE_STATE_MODE_ASYNC (1)
> +#define AARCH64_CPU_FEATURE_MTE_STATE_MODE_SYNC (1 << 1)
> +
> +#ifndef ARCH_INIT_MEMORY_STACK_TAGGING
> +# define ARCH_INIT_MEMORY_STACK_TAGGING _dl_mte_stack_protect
> +#endif
> +
> #endif /* _CPU_FEATURES_AARCH64_H */
> diff --git a/sysdeps/aarch64/dl-mte.c b/sysdeps/aarch64/dl-mte.c
> new file mode 100644
> index 0000000000..e73c5311a6
> --- /dev/null
> +++ b/sysdeps/aarch64/dl-mte.c
> @@ -0,0 +1,85 @@
> +/* AArch64 MTE Stack functions.
> + Copyright (C) 2026 Free Software Foundation, Inc.
> +
> + The GNU C Library is free software; you can redistribute it and/or
> + modify it under the terms of the GNU Lesser General Public
> + License as published by the Free Software Foundation; either
> + version 2.1 of the License, or (at your option) any later version.
> +
> + The GNU C Library is distributed in the hope that it will be useful,
> + but WITHOUT ANY WARRANTY; without even the implied warranty of
> + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> + Lesser General Public License for more details.
> +
> + You should have received a copy of the GNU Lesser General Public
> + License along with the GNU C Library; if not, see
> + <https://www.gnu.org/licenses/>. */
> +
> +#include <errno.h>
> +#include <ldsodefs.h>
> +#include <libintl.h>
> +#include <stackinfo.h>
> +#include <sys/mman.h>
> +#include <unistd.h>
> +
> +extern int _dl_mte_mode (void);
> +
> +void
> +_dl_mte_stack_check (struct link_map *l,
> + const char *program __attribute__((unused)))
> +{
> + ElfW (Dyn) *d;
> + bool mte_enabled = false;
> + bool mte_mode_selected = false;
> +
> + for (d = l->l_ld; d->d_tag != DT_NULL; ++d)
> + {
> + if (d->d_tag == DT_AARCH64_MEMTAG_STACK)
> + {
> + GLRO (dl_aarch64_cpu_features).mte_state
> + |= AARCH64_CPU_FEATURE_MTE_STATE_STACK;
> + mte_enabled = true;
> + }
> + else if (d->d_tag == DT_AARCH64_MEMTAG_MODE)
> + {
> + GLRO (dl_aarch64_cpu_features).mte_state
> + &= ~AARCH64_CPU_FEATURE_MTE_STATE_MODE_MASK;
> + if (d->d_un.d_val == 1)
> + GLRO (dl_aarch64_cpu_features).mte_state
> + |= AARCH64_CPU_FEATURE_MTE_STATE_MODE_ASYNC;
> + else
> + GLRO (dl_aarch64_cpu_features).mte_state
> + |= AARCH64_CPU_FEATURE_MTE_STATE_MODE_SYNC;
> + mte_mode_selected = true;
> + }
> + }
This is already done by elf_get_dynamic_info on _dl_map_object_from_fd,
I think it would be better to add a arch-specific hook to set a the
expected mode and enable on dl-procruntime.c instead of parsing this
against here.
> +
> + if (mte_enabled && mte_mode_selected)
> + {
> + int errval = 0;
> + _dl_mte_mode ();
> + GL (dl_stack_prot_flags) |= PROT_MTE;
> +
> + uintptr_t page = ((uintptr_t) __libc_stack_end
> + & -(uintptr_t) GLRO (dl_pagesize));
> +
> + if (__mprotect ((void *) page, GLRO (dl_pagesize),
> + GL (dl_stack_prot_flags)
> +#if _STACK_GROWS_DOWN
> + | PROT_GROWSDOWN
> +#elif _STACK_GROWS_UP
> + | PROT_GROWSUP
> +#endif
This a arch-specific file and aarch64 only supports _STACK_GROWS_DOWN,
there is no need to specify neither flag.
> + ) != 0)
> + errval = errno;
> +
> + if (errval != 0)
> + {
> + const char *name = "MTE Stack";
> + struct dl_exception exception;
> + _dl_exception_create (&exception, name,
> + N_("cannot set stack with PROT_MTE"));
> + _dl_signal_exception (errval, &exception, NULL);
> + }
> + }
> +}
> diff --git a/sysdeps/aarch64/dl-prop.h b/sysdeps/aarch64/dl-prop.h
> index cf236df59b..2ca0fd0f62 100644
> --- a/sysdeps/aarch64/dl-prop.h
> +++ b/sysdeps/aarch64/dl-prop.h
> @@ -27,11 +27,15 @@ extern void _dl_bti_check (struct link_map *, const char *)
> extern void _dl_gcs_check (struct link_map *, const char *, int)
> attribute_hidden;
>
> +extern void _dl_mte_stack_check (struct link_map *, const char *)
> + attribute_hidden;
> +
> static inline void __attribute__ ((always_inline))
> _rtld_main_check (struct link_map *m, const char *program)
> {
> _dl_bti_check (m, program);
> _dl_gcs_check (m, program, 0);
> + _dl_mte_stack_check (m, program);
> }
>
How MTE play with GCS shadow stack? Is is handled transparent by the kernel
or does it need extra userland handling?
> static inline void __attribute__ ((always_inline))
> diff --git a/sysdeps/unix/sysv/linux/aarch64/Makefile b/sysdeps/unix/sysv/linux/aarch64/Makefile
> index 57461fded7..a2e79cf3d6 100644
> --- a/sysdeps/unix/sysv/linux/aarch64/Makefile
> +++ b/sysdeps/unix/sysv/linux/aarch64/Makefile
> @@ -9,6 +9,10 @@ modules-names += \
> LDFLAGS-tst-tlsdesc-pac = -rdynamic
>
> $(objpfx)tst-tlsdesc-pac.out: $(objpfx)tst-tlsdesc-pac-mod.so
> +
> +sysdep-dl-routines += \
> + dl-mte-stack \
> + # sysdep-dl-routines
> endif
>
> ifeq ($(subdir),misc)
> diff --git a/sysdeps/unix/sysv/linux/aarch64/dl-mte-stack.c b/sysdeps/unix/sysv/linux/aarch64/dl-mte-stack.c
> new file mode 100644
> index 0000000000..c93ca6a670
> --- /dev/null
> +++ b/sysdeps/unix/sysv/linux/aarch64/dl-mte-stack.c
> @@ -0,0 +1,45 @@
> +/* Memory tagging handling for GNU dynamic linker. AArch64 version.
> + Copyright (C) 2026 Free Software Foundation, Inc.
> + This file is part of the GNU C Library.
> +
> + The GNU C Library is free software; you can redistribute it and/or
> + modify it under the terms of the GNU Lesser General Public
> + License as published by the Free Software Foundation; either
> + version 2.1 of the License, or (at your option) any later version.
> +
> + The GNU C Library is distributed in the hope that it will be useful,
> + but WITHOUT ANY WARRANTY; without even the implied warranty of
> + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> + Lesser General Public License for more details.
> +
> + You should have received a copy of the GNU Lesser General Public
> + License along with the GNU C Library; if not, see
> + <https://www.gnu.org/licenses/>. */
> +
> +#include <cpu-features.h>
> +#include <ldsodefs.h>
> +#include <sys/prctl.h>
> +
> +#define MTE_ALLOWED_TAGS (0xfffe << PR_MTE_TAG_SHIFT)
> +
> +int
> +_dl_mte_mode (void)
> +{
> + int err = 0;
> +
> + if (GLRO (dl_aarch64_cpu_features).mte_state
> + & AARCH64_CPU_FEATURE_MTE_STATE_MODE_SYNC)
> + err = __prctl (PR_SET_TAGGED_ADDR_CTRL,
> + (PR_TAGGED_ADDR_ENABLE | PR_MTE_TCF_SYNC | MTE_ALLOWED_TAGS),
> + 0, 0, 0);
> + else if (GLRO (dl_aarch64_cpu_features).mte_state
> + & AARCH64_CPU_FEATURE_MTE_STATE_MODE_ASYNC)
> + err = __prctl (PR_SET_TAGGED_ADDR_CTRL,
> + (PR_TAGGED_ADDR_ENABLE | PR_MTE_TCF_ASYNC
> + | MTE_ALLOWED_TAGS),
> + 0, 0, 0);
> +
> + return (err != 0
> + && (GLRO (dl_aarch64_cpu_features).mte_state
> + & AARCH64_CPU_FEATURE_MTE_STATE_MODE_MASK) != 0);
> +}
More information about the Libc-alpha
mailing list