[FFe] Include Memory Tagging Extension support in the arm64 glibc build

[Proposed changes]

Enable memory tagging support in the arm64 build of glibc. Memory tagging is a security feature in some ARM64 CPUs to detect memory safety issues by adding tags to small memory regions, allowing runtime checking of pointer provenance.

Even when included in the build, this feature is disabled by default and can be enabled using tunables:
https://www.gnu.org/software/libc/manual/html_node/Memory-Related-Tunables.html

This has been enabled in Debian unstable since December 2011.

The actual code change can be seen there:
https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/glibc/commit/?id=3e6f5fb8e0bc4094a4d73159bf5865130f019290

[Rationale]

I believe this change falls under the HWE umbrella. Additionally, I believe the risks are minimal due to the feature being disabled by default, and having been deployed in Debian for a while.

[Original report]

Hello,
For Debian Bookworm, Memory Tagging Extension (MTE) support is enabled in glibc:
https://sources.debian.org/src/glibc/2.35-3/debian/sysdeps/arm64.mk/

Would it be possible to please do a similar thing for the Ubuntu package?

For more information, please see:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995269

===

glibc 2.33 onwards has support for 'Memory Tagging Extension' on
arm64. Could you please enable this feature (by setting
--enable-memory-tagging in the config).

The effect is to add colouring bits into heap pointers so that typical
illegal accesses (either temporally or spatially) can be detected and
faulted. Glibc just has the userspace heap tagging - there is also
corresponding kernel support.

The functionality operates on arm ISA 8.5 or later, which has extra
instructions to manipulate the tag bits in pointers.

The details are explained in
https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/Arm_Memory_Tagging_Extension_Whitepaper.pdf

The implementation has been designed so that it is safe to enable in
distros (which makes a change!). ifunc and HWCAP are used to link
MTE-ready versions of relevant functions on hardware supporting
ARMv8.5 instruction set or later. On eailer hardware things will work
just as they do now.

Here is the (trivial) patch:
diff -u debian/sysdeps/arm64.mk~ debian/sysdeps/arm64.mk
--- debian/sysdeps/arm64.mk~ 2021-08-24 14:31:06.000000000 +0000
+++ debian/sysdeps/arm64.mk 2021-09-28 19:43:58.782118977 +0000
@@ -1,2 +1,2 @@
 # configuration options for all flavours
-extra_config_options = --enable-multi-arch --enable-static-pie
+extra_config_options = --enable-multi-arch --enable-static-pie --enable-memory-tagging

--
Wookey