[lldb][AArch64] Add support for memory tags in core files

[DavidSpickett]

Summary

This teaches ProcessElfCore to recognise the MTE tag segments.

https://www.kernel.org/doc/html/latest/arm64/memory-tagging-extension.html#core-dump-support

These segments contain all the tags for a matching memory segment
which will have the same size in virtual address terms. In real terms
it's 2 tags per byte so the data in the segment is much smaller.

Since MTE is the only tag type supported I have hardcoded some
things to those values. We could and should support more formats
as they appear but doing so now would leave code untested until that
happens.

A few things to note:

• /proc/pid/smaps is not in the core file, only the details you have in "maps". Meaning we mark a region tagged only if it has a tag segment.
• A core file supports memory tagging if it has at least 1 memory tag segment, there is no other flag we can check to tell if memory tagging was enabled. (unlike a live process that can support memory tagging even if there are currently no tagged memory regions)

Tests have been added at the commands level for a core file with
mte and without.

There is a lot of overlap between the "memory tag read" tests here and the unit tests for
MemoryTagManagerAArch64MTE::UnpackTagsFromCoreFileSegment, but I think it's
worth keeping to check ProcessElfCore doesn't cause an assert.

Depends on D129487

[DavidSpickett]

This change is purely about reading the tags.

There will be another change to get fault reporting working. Right now lldb only looks at signo so you see a segfault but not what type of segfault.

[DavidSpickett]

Add a release note.

[omjavaid]

I am wondering if we should also test memory reads with correct/wrong tags for corefiles as well? Do you see any value on doing it or have done it already in above test and i skipped it?

lldb/test/API/linux/aarch64/mte_core_file/main.c

2

Do we have a hardware board that supports MTE or we are still using QEMU?

[DavidSpickett]

I am wondering if we should also test memory reads with correct/wrong tags for corefiles as well? Do you see any value on doing it or have done it already in above test and i skipped it?

You mean "memory read <the tagged memory buffer> --show-tags"? The details are tested on live processes already but a simple smoke test wouldn't hurt, I'll do that.

lldb/test/API/linux/aarch64/mte_core_file/main.c

2

Still using QEMU.

[DavidSpickett]

rebase

[DavidSpickett]

You mean "memory read <the tagged memory buffer> --show-tags"? The details are tested on live processes already but a simple smoke test wouldn't hurt, I'll do that.

I checked and to include the memory contents takes the core file from 20k to 300 something k. This isn't the end of the world but thinking about it, the code that powers "memory read --show-tags" is built on top of the stuff that's already tested here.

And that show tags code is tested via unit tests and live processes elsewhere, so I don't think we need anything for it here.

[omjavaid]

In D129489#3665218, @DavidSpickett wrote:

You mean "memory read <the tagged memory buffer> --show-tags"? The details are tested on live processes already but a simple smoke test wouldn't hurt, I'll do that.

I checked and to include the memory contents takes the core file from 20k to 300 something k. This isn't the end of the world but thinking about it, the code that powers "memory read --show-tags" is built on top of the stuff that's already tested here.

And that show tags code is tested via unit tests and live processes elsewhere, so I don't think we need anything for it here.

Agreed!

[DavidSpickett]

@labath (or indeed anyone else) any objections to this or the previous patch?

Happy to make changes but if it's ok as is I'd like to get it landed before the branch next week.

lldb/include/lldb/Target/Process.h

/// \see Process::Notifications
   /// \param[in] len
   ///     Length of memory range to read tags for (in bytes).
   ///
   /// \return
   ///     If this architecture or process does not support memory tagging,
   ///     an error saying so.
   ///     If it does, either the memory tags or an error describing a
   ///     failure to read or unpack them.
-  llvm::Expected<std::vector<lldb::addr_t>> ReadMemoryTags(lldb::addr_t addr,
-                                                           size_t len);
+  virtual llvm::Expected<std::vector<lldb::addr_t>>
+  ReadMemoryTags(lldb::addr_t addr, size_t len);
 
   /// Write memory tags for a range of memory.
   /// (calls DoWriteMemoryTags to do the target specific work)
   ///
   /// \param[in] addr
   ///     The address to start writing tags from. It is assumed that this
   ///     address is granule aligned.
   ///

lldb/source/Plugins/Process/elf-core/ProcessElfCore.h

public:
 
   // Process Memory
   size_t ReadMemory(lldb::addr_t addr, void *buf, size_t size,
                     lldb_private::Status &error) override;
 
   size_t DoReadMemory(lldb::addr_t addr, void *buf, size_t size,
                       lldb_private::Status &error) override;
 
+  // We do not implement DoReadMemoryTags. Instead all the work is done in
+  // ReadMemoryTags which avoids having to unpack and repack tags.
+  llvm::Expected<std::vector<lldb::addr_t>> ReadMemoryTags(lldb::addr_t addr,
+                                                           size_t len) override;
+
   lldb::addr_t GetImageInfoAddress() override;
 
   lldb_private::ArchSpec GetArchitecture();
 
   // Returns AUXV structure found in the core file
   lldb_private::DataExtractor GetAuxvData() override;
 
   bool GetProcessInfo(lldb_private::ProcessInstanceInfo &info) override;
 
 protected:
   void Clear();
 
   bool DoUpdateThreadList(lldb_private::ThreadList &old_thread_list,
                           lldb_private::ThreadList &new_thread_list) override;
 
   lldb_private::Status
   DoGetMemoryRegionInfo(lldb::addr_t load_addr,
                         lldb_private::MemoryRegionInfo &region_info) override;
 
+  bool SupportsMemoryTagging() override { return !m_core_tag_ranges.IsEmpty(); }
+
 private:
   struct NT_FILE_Entry {
     lldb::addr_t start;
     lldb::addr_t end;
     lldb::addr_t file_ofs;
     lldb_private::ConstString path;
   };
 
private:
   lldb_private::DataExtractor m_auxv;
 
   // Address ranges found in the core
   VMRangeToFileOffset m_core_aranges;
 
   // Permissions for all ranges
   VMRangeToPermissions m_core_range_infos;
 
+  // Memory tag ranges found in the core
+  VMRangeToFileOffset m_core_tag_ranges;
+
   // NT_FILE entries found from the NOTE segment
   std::vector<NT_FILE_Entry> m_nt_file_entries;
 
   // Parse thread(s) data structures(prstatus, prpsinfo) from given NOTE segment
   llvm::Error ParseThreadContextsFromNoteSegment(
       const elf::ELFProgramHeader &segment_header,
       const lldb_private::DataExtractor &segment_data);
 
   // Returns number of thread contexts stored in the core file
   uint32_t GetNumThreadContexts();
 
   // Parse a contiguous address range of the process from LOAD segment
   lldb::addr_t
   AddAddressRangeFromLoadSegment(const elf::ELFProgramHeader &header);
 
+  // Parse a contiguous address range from a memory tag segment
+  lldb::addr_t
+  AddAddressRangeFromMemoryTagSegment(const elf::ELFProgramHeader &header);
+
   llvm::Expected<std::vector<lldb_private::CoreNote>>
   parseSegment(const lldb_private::DataExtractor &segment);
   llvm::Error parseFreeBSDNotes(llvm::ArrayRef<lldb_private::CoreNote> notes);
   llvm::Error parseNetBSDNotes(llvm::ArrayRef<lldb_private::CoreNote> notes);
   llvm::Error parseOpenBSDNotes(llvm::ArrayRef<lldb_private::CoreNote> notes);
   llvm::Error parseLinuxNotes(llvm::ArrayRef<lldb_private::CoreNote> notes);
 };
 
 #endif // LLDB_SOURCE_PLUGINS_PROCESS_ELF_CORE_PROCESSELFCORE_H

lldb/source/Plugins/Process/elf-core/ProcessElfCore.cpp

const uint32_t permissions =
       ((header.p_flags & llvm::ELF::PF_X) ? lldb::ePermissionsExecutable : 0u);
 
   m_core_range_infos.Append(
       VMRangeToPermissions::Entry(addr, header.p_memsz, permissions));
 
   return addr;
 }
 
+lldb::addr_t ProcessElfCore::AddAddressRangeFromMemoryTagSegment(
+    const elf::ELFProgramHeader &header) {
+  // If lldb understood multiple kinds of tag segments we would record the type
+  // of the segment here also. As long as there is only 1 type lldb looks for,
+  // there is no need.
+  FileRange file_range(header.p_offset, header.p_filesz);
+  m_core_tag_ranges.Append(
+      VMRangeToFileOffset::Entry(header.p_vaddr, header.p_memsz, file_range));
+
+  return header.p_vaddr;
+}
+
 // Process Control
 Status ProcessElfCore::DoLoadCore() {
   Status error;
   if (!m_core_module_sp) {
     error.SetErrorString("invalid core module");
     return error;
   }
 
Status ProcessElfCore::DoLoadCore() {
   }
 
   SetCanJIT(false);
 
   m_thread_data_valid = true;
 
   bool ranges_are_sorted = true;
   lldb::addr_t vm_addr = 0;
+  lldb::addr_t tag_addr = 0;
   /// Walk through segments and Thread and Address Map information.
   /// PT_NOTE - Contains Thread and Register information
   /// PT_LOAD - Contains a contiguous range of Process Address Space
+  /// PT_AARCH64_MEMTAG_MTE - Contains AArch64 MTE memory tags for a range of
+  ///                         Process Address Space.
   for (const elf::ELFProgramHeader &H : segments) {
     DataExtractor data = core->GetSegmentData(H);
 
     // Parse thread contexts and auxv structure
     if (H.p_type == llvm::ELF::PT_NOTE) {
       if (llvm::Error error = ParseThreadContextsFromNoteSegment(H, data))
         return Status(std::move(error));
     }
     // PT_LOAD segments contains address map
     if (H.p_type == llvm::ELF::PT_LOAD) {
       lldb::addr_t last_addr = AddAddressRangeFromLoadSegment(H);
       if (vm_addr > last_addr)
         ranges_are_sorted = false;
       vm_addr = last_addr;
+    } else if (H.p_type == llvm::ELF::PT_AARCH64_MEMTAG_MTE) {
+      lldb::addr_t last_addr = AddAddressRangeFromMemoryTagSegment(H);
+      if (tag_addr > last_addr)
+        ranges_are_sorted = false;
+      tag_addr = last_addr;
     }
   }
 
   if (!ranges_are_sorted) {
     m_core_aranges.Sort();
     m_core_range_infos.Sort();
+    m_core_tag_ranges.Sort();
   }
 
   // Even if the architecture is set in the target, we need to override it to
   // match the core file which is always single arch.
   ArchSpec arch(m_core_module_sp->GetArchitecture());
 
   ArchSpec target_arch = GetTarget().GetArchitecture();
   ArchSpec core_arch(m_core_module_sp->GetArchitecture());
if (permission_entry->Contains(load_addr)) {
                                   : MemoryRegionInfo::eNo);
       region_info.SetWritable(permissions.Test(lldb::ePermissionsWritable)
                                   ? MemoryRegionInfo::eYes
                                   : MemoryRegionInfo::eNo);
       region_info.SetExecutable(permissions.Test(lldb::ePermissionsExecutable)
                                     ? MemoryRegionInfo::eYes
                                     : MemoryRegionInfo::eNo);
       region_info.SetMapped(MemoryRegionInfo::eYes);
+
+      // A region is memory tagged if there is a memory tag segment that covers
+      // the exact same range.
+      region_info.SetMemoryTagged(MemoryRegionInfo::eNo);
+      const VMRangeToFileOffset::Entry *tag_entry =
+          m_core_tag_ranges.FindEntryStartsAt(permission_entry->GetRangeBase());
+      if (tag_entry &&
+          tag_entry->GetRangeEnd() == permission_entry->GetRangeEnd())
+        region_info.SetMemoryTagged(MemoryRegionInfo::eYes);
     } else if (load_addr < permission_entry->GetRangeBase()) {
       region_info.GetRange().SetRangeBase(load_addr);
       region_info.GetRange().SetRangeEnd(permission_entry->GetRangeBase());
       region_info.SetReadable(MemoryRegionInfo::eNo);
       region_info.SetWritable(MemoryRegionInfo::eNo);
       region_info.SetExecutable(MemoryRegionInfo::eNo);
       region_info.SetMapped(MemoryRegionInfo::eNo);
+      region_info.SetMemoryTagged(MemoryRegionInfo::eNo);
     }
     return Status();
   }
 
   region_info.GetRange().SetRangeBase(load_addr);
   region_info.GetRange().SetRangeEnd(LLDB_INVALID_ADDRESS);
   region_info.SetReadable(MemoryRegionInfo::eNo);
   region_info.SetWritable(MemoryRegionInfo::eNo);
   region_info.SetExecutable(MemoryRegionInfo::eNo);
   region_info.SetMapped(MemoryRegionInfo::eNo);
+  region_info.SetMemoryTagged(MemoryRegionInfo::eNo);
   return Status();
 }
 
 size_t ProcessElfCore::DoReadMemory(lldb::addr_t addr, void *buf, size_t size,
                                     Status &error) {
   ObjectFile *core_objfile = m_core_module_sp->GetObjectFile();
 
   if (core_objfile == nullptr)
size_t ProcessElfCore::DoReadMemory(lldb::addr_t addr, void *buf, size_t size,
   // If there is data available on the core file read it
   if (bytes_to_read)
     bytes_copied =
         core_objfile->CopyData(offset + file_start, bytes_to_read, buf);
 
   return bytes_copied;
 }
 
+llvm::Expected<std::vector<lldb::addr_t>>
+ProcessElfCore::ReadMemoryTags(lldb::addr_t addr, size_t len) {
+  ObjectFile *core_objfile = m_core_module_sp->GetObjectFile();
+  if (core_objfile == nullptr)
+    return llvm::createStringError(llvm::inconvertibleErrorCode(),
+                                   "No core object file.");
+
+  llvm::Expected<const MemoryTagManager *> tag_manager_or_err =
+      GetMemoryTagManager();
+  if (!tag_manager_or_err)
+    return tag_manager_or_err.takeError();
+
+  // LLDB only supports AArch64 MTE tag segments so we do not need to worry
+  // about the segment type here. If you got here then you must have a tag
+  // manager (meaning you are debugging AArch64) and all the segments in this
+  // list will have had type PT_AARCH64_MEMTAG_MTE.
+  const VMRangeToFileOffset::Entry *tag_entry =
+      m_core_tag_ranges.FindEntryThatContains(addr);
+  // If we don't have a tag segment or the range asked for extends outside the
+  // segment.
+  if (!tag_entry || (addr + len) >= tag_entry->GetRangeEnd())
+    return llvm::createStringError(llvm::inconvertibleErrorCode(),
+                                   "No tag segment that covers this range.");
+
+  const MemoryTagManager *tag_manager = *tag_manager_or_err;
+  return tag_manager->UnpackTagsFromCoreFileSegment(
+      [core_objfile](lldb::offset_t offset, size_t length, void *dst) {
+        return core_objfile->CopyData(offset, length, dst);
+      },
+      tag_entry->GetRangeBase(), tag_entry->data.GetRangeBase(), addr, len);
+}
+
 void ProcessElfCore::Clear() {
   m_thread_list.Clear();
 
   SetUnixSignals(std::make_shared<UnixSignals>());
 }
 
 void ProcessElfCore::Initialize() {
   static llvm::once_flag g_once_flag;

lldb/test/API/linux/aarch64/mte_core_file/TestAArch64LinuxMTEMemoryTagCoreFile.py

+"""
+Test that memory tagging features work with Linux core files.
+"""
+
+
+import lldb
+from lldbsuite.test.decorators import *
+from lldbsuite.test.lldbtest import *
+
+
+class AArch64LinuxMTEMemoryTagCoreFileTestCase(TestBase):
+
+    mydir = TestBase.compute_mydir(__file__)
+
+    NO_DEBUG_INFO_TESTCASE = True
+
+    MTE_BUF_ADDR = hex(0xffff82c74000)
+    BUF_ADDR = hex(0xffff82c73000)
+
+    @skipIfLLVMTargetMissing("AArch64")
+    def test_mte_tag_core_file_memory_region(self):
+        """ Test that memory regions are marked as tagged when there is a tag
+            segment in the core file. """
+        self.runCmd("target create --core core.mte")
+
+        # There should only be one tagged region.
+        self.runCmd("memory region --all")
+        got = self.res.GetOutput()
+        found_tagged_region = False
+
+        for line in got.splitlines():
+            if "memory tagging: enabled" in line:
+                if found_tagged_region:
+                    self.fail("Expected only one tagged region.")
+                found_tagged_region = True
+
+        self.assertTrue(found_tagged_region, "Did not find a tagged memory region.")
+
+        # mte_buf is tagged, buf is not.
+        tagged = "memory tagging: enabled"
+        self.expect("memory region {}".format(self.MTE_BUF_ADDR),
+                patterns=[tagged])
+        self.expect("memory region {}".format(self.BUF_ADDR),
+                patterns=[tagged], matching=False)
+
+    @skipIfLLVMTargetMissing("AArch64")
+    def test_mte_tag_core_file_tag_write(self):
+        """ Test that "memory tag write" does not work with core files
+            as they are read only. """
+        self.runCmd("target create --core core.mte")
+
+        self.expect("memory tag write {} 1".format(self.MTE_BUF_ADDR), error=True,
+                patterns=["error: elf-core does not support writing memory tags"])
+
+    @skipIfLLVMTargetMissing("AArch64")
+    def test_mte_tag_core_file_tag_read(self):
+        """ Test that "memory tag read" works with core files."""
+        self.runCmd("target create --core core.mte")
+
+        # Tags are packed 2 per byte meaning that in addition to granule alignment
+        # there is also 2 x granule alignment going on.
+
+        # All input validation should work as normal.
+        not_tagged_pattern = ("error: Address range 0x[A-Fa-f0-9]+:0x[A-Fa-f0-9]+ "
+                              "is not in a memory tagged region")
+        self.expect("memory tag read {}".format(self.BUF_ADDR),
+                    error=True, patterns=[not_tagged_pattern])
+        # The first part of this range is not tagged.
+        self.expect("memory tag read {addr}-16 {addr}+16".format(
+                addr=self.MTE_BUF_ADDR), error=True,
+                patterns=[not_tagged_pattern])
+        # The last part of this range is not tagged.
+        self.expect("memory tag read {addr}+4096-16 {addr}+4096+16".format(
+                addr=self.MTE_BUF_ADDR), error=True,
+                patterns=[not_tagged_pattern])
+
+        self.expect("memory tag read {addr}+16 {addr}".format(
+                addr=self.MTE_BUF_ADDR), error=True,
+                patterns=["error: End address \(0x[A-Fa-f0-9]+\) "
+                          "must be greater than the start address "
+                          "\(0x[A-Fa-f0-9]+\)"])
+
+        # The simplest scenario. 2 granules means 1 byte of packed tags
+        # with no realignment required.
+        self.expect("memory tag read {addr} {addr}+32".format(
+                addr=self.MTE_BUF_ADDR),
+                patterns=[
+                    "Allocation tags:\n"
+                    "\[0x[A-Fa-f0-9]+00, 0x[A-Fa-f0-9]+10\): 0x0\n"
+                    "\[0x[A-Fa-f0-9]+10, 0x[A-Fa-f0-9]+20\): 0x1 \(mismatch\)$"])
+
+        # Here we want just one tag so must use half of the first byte.
+        # (start is aligned length is not)
+        self.expect("memory tag read {addr} {addr}+16".format(
+                addr=self.MTE_BUF_ADDR),
+                patterns=[
+                    "Allocation tags:\n"
+                    "\[0x[A-Fa-f0-9]+00, 0x[A-Fa-f0-9]+10\): 0x0$"])
+        # Get the other half of the first byte.
+        # (end is aligned start is not)
+        self.expect("memory tag read {addr}+16 {addr}+32".format(
+                addr=self.MTE_BUF_ADDR),
+                patterns=[
+                    "Allocation tags:\n"
+                    "\[0x[A-Fa-f0-9]+10, 0x[A-Fa-f0-9]+20\): 0x1 \(mismatch\)$"])
+
+        # Same thing but with a starting range > 1 granule.
+        self.expect("memory tag read {addr} {addr}+48".format(
+                addr=self.MTE_BUF_ADDR),
+                patterns=[
+                    "Allocation tags:\n"
+                    "\[0x[A-Fa-f0-9]+00, 0x[A-Fa-f0-9]+10\): 0x0\n"
+                    "\[0x[A-Fa-f0-9]+10, 0x[A-Fa-f0-9]+20\): 0x1 \(mismatch\)\n"
+                    "\[0x[A-Fa-f0-9]+20, 0x[A-Fa-f0-9]+30\): 0x2 \(mismatch\)$"])
+        self.expect("memory tag read {addr}+16 {addr}+64".format(
+                addr=self.MTE_BUF_ADDR),
+                patterns=[
+                    "Allocation tags:\n"
+                    "\[0x[A-Fa-f0-9]+10, 0x[A-Fa-f0-9]+20\): 0x1 \(mismatch\)\n"
+                    "\[0x[A-Fa-f0-9]+20, 0x[A-Fa-f0-9]+30\): 0x2 \(mismatch\)\n"
+                    "\[0x[A-Fa-f0-9]+30, 0x[A-Fa-f0-9]+40\): 0x3 \(mismatch\)$"])
+        # Here both start and end are unaligned.
+        self.expect("memory tag read {addr}+16 {addr}+80".format(
+                addr=self.MTE_BUF_ADDR),
+                patterns=[
+                    "Allocation tags:\n"
+                    "\[0x[A-Fa-f0-9]+10, 0x[A-Fa-f0-9]+20\): 0x1 \(mismatch\)\n"
+                    "\[0x[A-Fa-f0-9]+20, 0x[A-Fa-f0-9]+30\): 0x2 \(mismatch\)\n"
+                    "\[0x[A-Fa-f0-9]+30, 0x[A-Fa-f0-9]+40\): 0x3 \(mismatch\)\n"
+                    "\[0x[A-Fa-f0-9]+40, 0x[A-Fa-f0-9]+50\): 0x4 \(mismatch\)$"])
+
+        # For the intial alignment of start/end to granule boundaries the tag manager
+        # is used, so this reads 1 tag as it would normally.
+        self.expect("memory tag read {addr} {addr}+1".format(
+                addr=self.MTE_BUF_ADDR),
+                patterns=[
+                    "Allocation tags:\n"
+                    "\[0x[A-Fa-f0-9]+00, 0x[A-Fa-f0-9]+10\): 0x0$"])
+
+        # This range is aligned to granules as mte_buf to mte_buf+32 so the result
+        # should be 2 granules.
+        self.expect("memory tag read {addr} {addr}+17".format(
+                addr=self.MTE_BUF_ADDR),
+                patterns=[
+                    "Allocation tags:\n"
+                    "\[0x[A-Fa-f0-9]+00, 0x[A-Fa-f0-9]+10\): 0x0\n"
+                    "\[0x[A-Fa-f0-9]+10, 0x[A-Fa-f0-9]+20\): 0x1 \(mismatch\)$"])
+
+        # Alignment of this range causes it to become unaligned to 2*granule boundaries.
+        self.expect("memory tag read {addr} {addr}+33".format(
+                addr=self.MTE_BUF_ADDR),
+                patterns=[
+                    "Allocation tags:\n"
+                    "\[0x[A-Fa-f0-9]+00, 0x[A-Fa-f0-9]+10\): 0x0\n"
+                    "\[0x[A-Fa-f0-9]+10, 0x[A-Fa-f0-9]+20\): 0x1 \(mismatch\)\n",
+                    "\[0x[A-Fa-f0-9]+20, 0x[A-Fa-f0-9]+30\): 0x2 \(mismatch\)$"])
+
+    @skipIfLLVMTargetMissing("AArch64")
+    def test_mte_commands_no_mte(self):
+        """ Test that memory tagging commands fail on an AArch64 corefile without
+            any tag segments."""
+
+        self.runCmd("target create --core core.nomte")
+
+        self.expect("memory tag read 0 1",
+                substrs=["error: Process does not support memory tagging"], error=True)
+        # Note that this tells you memory tagging is not supported at all, versus
+        # the MTE core file which does support it but does not allow writing tags.
+        self.expect("memory tag write 0 1",
+                substrs=["error: Process does not support memory tagging"], error=True)

lldb/test/API/linux/aarch64/mte_core_file/main.c

+// Program to generate core files to test MTE tag features.
+//
+// This file uses ACLE intrinsics as detailed in:
+// https://developer.arm.com/documentation/101028/0012/10--Memory-tagging-intrinsics?lang=en
+//
+// Compile with:
+// <gcc or clang> -march=armv8.5-a+memtag -g main.c -o a.out.mte
+// <gcc or clang> -march=armv8.5-a+memtag -g main.c -DNO_MTE -o a.out.nomte
+//
+// /proc/self/coredump_filter was set to 2 when the core files were made.
+
+#include <arm_acle.h>
+#include <asm/mman.h>
+#include <stdio.h>
+#include <sys/mman.h>
+#include <sys/prctl.h>
+#include <unistd.h>
+
+int main(int argc, char const *argv[]) {
+#ifdef NO_MTE
+  *(char *)(0) = 0;
+#endif
+
+  if (prctl(PR_SET_TAGGED_ADDR_CTRL,
+            PR_TAGGED_ADDR_ENABLE | PR_MTE_TCF_SYNC |
+                // Allow all tags to be generated by the addg
+                // instruction __arm_mte_increment_tag produces.
+                (0xffff << PR_MTE_TAG_SHIFT),
+            0, 0, 0)) {
+    return 1;
+  }
+
+  size_t page_size = sysconf(_SC_PAGESIZE);
+  char *mte_buf = mmap(0, page_size, PROT_READ | PROT_WRITE | PROT_MTE,
+                       MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+  if (!mte_buf)
+    return 1;
+
+  printf("mte_buf: %p\n", mte_buf);
+
+  // Allocate some untagged memory before the tagged memory.
+  char *buf = mmap(0, page_size, PROT_READ | PROT_WRITE,
+                   MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+  if (!buf)
+    return 1;
+
+  printf("buf: %p\n", buf);
+
+  // This write means that the memory for buf is included in the corefile.
+  // So we can read from the end of it into mte_buf during the test.
+  *buf = 1;
+
+  // These must be next to each other for the tests to work.
+  // <high address>
+  // mte_buf
+  // buf
+  // <low address>
+  if ((mte_buf - buf) != page_size) {
+    return 1;
+  }
+
+  // Set incrementing tags until end of the page.
+  char *tagged_ptr = mte_buf;
+  // This ignores tag bits when subtracting the addresses.
+  while (__arm_mte_ptrdiff(tagged_ptr, mte_buf) < page_size) {
+    // Set the allocation tag for this location.
+    __arm_mte_set_tag(tagged_ptr);
+    // + 16 for 16 byte granules.
+    // Earlier we allowed all tag values, so this will give us an
+    // incrementing pattern 0-0xF wrapping back to 0.
+    tagged_ptr = __arm_mte_increment_tag(tagged_ptr + 16, 1);
+  }
+
+  // Will fault because logical tag 0 != allocation tag 1.
+  *(mte_buf + 16) = 1;
+
+  return 0;
+}

llvm/docs/ReleaseNotes.rst

* Various memory related parts of LLDB have been updated to handle
   * All the read and write memory methods on SBProccess and SBTarget can
     be used with addreses with non-address bits.
   * When printing a pointer expression, LLDB can now dereference the result
     even if it has non-address bits.
   * The memory cache now ignores non-address bits when looking up memory
     locations. This prevents us reading locations multiple times, or not
     writing out new values if the addresses have different non-address bits.
 
+* LLDB now supports reading memory tags from AArch64 Linux core files.
+
 Changes to Sanitizers
 ---------------------
 
 
 Other Changes
 -------------
 * The code for the `LLVM Visual Studio integration
   <https://marketplace.visualstudio.com/items?itemName=LLVMExtensions.llvm-toolchain>`_

llvm/include/llvm/BinaryFormat/ELF.h

enum {
   PT_OPENBSD_WXNEEDED = 0x65a3dbe7,  // Program does W^X violations.
   PT_OPENBSD_BOOTDATA = 0x65a41be6,  // Section for boot arguments.
 
   // ARM program header types.
   PT_ARM_ARCHEXT = 0x70000000, // Platform architecture compatibility info
   // These all contain stack unwind tables.
   PT_ARM_EXIDX = 0x70000001,
   PT_ARM_UNWIND = 0x70000001,
+  // MTE memory tag segment type
+  PT_AARCH64_MEMTAG_MTE = 0x70000002,
 
   // MIPS program header types.
   PT_MIPS_REGINFO = 0x70000000,  // Register usage information.
   PT_MIPS_RTPROC = 0x70000001,   // Runtime procedure table.
   PT_MIPS_OPTIONS = 0x70000002,  // Options segment.
   PT_MIPS_ABIFLAGS = 0x70000003, // Abiflags segment.
 
   // RISCV program header types.