[MTE] [llvm-readobj] Add globals section parsing to --memtag

[hctim]

Summary

Global variables are described in a metadata table called
SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC. It's basically a ULEB-encoded skip
list with some other fancy encoding tricks to make it smaller. You can
see the ABI at
https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#83encoding-of-sht_aarch64_memtag_globals_dynamic

This extends readelf/readobj to understand these sections.

[jhenderson]

llvm/lib/ObjectYAML/ELFYAML.cpp

711–712

Could you please check to see if the other machine-specific section types have any specific YAML testing, please? (Usually in the form of a yaml2obj lit test, but could be in obj2yaml lit tests or ObjectYAML unit tests).

llvm/test/tools/llvm-readobj/ELF/AArch64/memtag.test

150

Honestly, I'm finding this comment incomprehensible (possibly because I know nothing about memtags). What is it trying to show?

llvm/tools/llvm-readobj/ELFDumper.cpp

5295

This seems unrelated?

5323

Can you use the new C++17 structured bindings to name both first and second values here, rather than just doing Descriptors.first and Descriptors.second, please?

5324–5325

You don't need the llvm:: prefixes here.

5979

Are you sure cantFail is appropriate here? What happens if the sh_offset field of the section is invalid? In fact, if you're using cantFail, why are you storing the result in an Expected?

5981–5982

This isn't how errors or warnings are reported in llvm-readobj. Please take a look at other examples and fix appropriately. (You probably want reportUniqueWarning)

5993–5994

These aren't named in compliance with LLVM's naming scheme.

6048–6051

See above re. errors and warnings in llvm-readobj.

Also please refer to https://llvm.org/docs/CodingStandards.html#error-and-warning-messages

6058

I not i.

6065–6066

As above.

6077–6078

As above

7537

Drop llvm::. Also, the std::string construction is unnecessary. Also, consider using Twine here and in other string concatenation places.

[MaskRay]

(I'm going to be out for 3 weeks in the next 4 weeks. Happy if others are happy. Don't wait on me :) )

llvm/tools/llvm-readobj/ELFDumper.cpp

6056

Delete blank line.

Also, add a link to the ABI doc describing the encoding scheme?

7537

std::string("0x") => "0x" as llvm::utohexstr returns a std::string.

printHex takes a StringRef, so Twine cannot be used (without toStringRef).

[hctim]

Address jhenderson@'s comments.

llvm/lib/ObjectYAML/ELFYAML.cpp

711–712

sure, added bits to machine-specific-section-types.test

llvm/test/tools/llvm-readobj/ELF/AArch64/memtag.test

150

I've tried to flesh out the comments so that it's clear that this is the hand-asembling of the .memtag.globals.dynamic section contents. HTH.

llvm/tools/llvm-readobj/ELFDumper.cpp

5295

It's a slight formatting fix that I found during this patch. There's an extra unnecessary newline between the Android note (if present) and the

Given that this is all --memtag related parsing, seems right to clean up this spurious newline while we're adding more text.

5979

yeah, i reckon the cantFail wrapping here was vestigial. removed.

7537

dropped the namespace prefix and explicit construction of 0x, but yeah, can't use twine here unfortunately

[jhenderson]

This is going to need review by somebody with memtag experience still.

Meanwhile, I think some test cases are needed for a few of the warnings.

llvm/tools/llvm-readobj/ELFDumper.cpp

5979

I don't think this is tested?

6063

Test case?

6075

Test case?

[hctim]

llvm/tools/llvm-readobj/ELFDumper.cpp

5979

this isn't really testable here; getSectionContents() has a few failure conditions but none of them are really memtag-relevant.

i have however added a check that the address of the SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC section is the same as the DT_AARCH64_MEMTAG_GLOBALS dynamic table entry, and tested it.

[hctim]

Add some extra edge case tests.

[jhenderson]

llvm/test/tools/llvm-readobj/ELF/AArch64/memtag.test

342

I think you need to check the context of the message to show that the right warning is being emitted (since there are two possible locations where this could come from). This will make the test less at risk of rotting in the future too.

llvm/tools/llvm-readobj/ELFDumper.cpp

5979

We should still have a test that shows that if getSectionContents fails, we handle the failure appropriately. The easiest way of doing this is probably to simply override the sh_offset value of the section, using the ShOffset YAML key. There are a number of good examples of things like this in llvm-readobj tests. A simple one is in stackmap.test, where the same YAML is used, but with the yaml2obj -D option used to provide a specific sh_offset value for one test case that is for the equivalent of what you're checking here.

[hctim]

Add more tests for edge cases in decoding.

llvm/tools/llvm-readobj/ELFDumper.cpp

5979

thanks for the handy link to stackmap.test, done.

[jhenderson]

No more comments from me, as aside from one minor suggestion in the test.

It probably needs a review from someone familiar with the memtag encoding though, as I'm not.

llvm/test/tools/llvm-readobj/ELF/AArch64/memtag.test

334

I don't think we have the same line length expectations in lit tests, so I personally wouldn't split the messages across multiple checks like this, due to the fact they have a slight difference in behaviour. However, I don't have a strong opinion on it, so if you prefer it this way, that's fine. I would make it a CHECK-SAME directive though (and if you do that, I'd add some spaces before "warning" to make the second CHECK's contents line up with the first one i.e.

# BAD-STREAM1:      warning: ...
# BAD-STREAM1-SAME: SHT_...

Same comment applies below.

[pcc]

LGTM

[hctim]

llvm/test/tools/llvm-readobj/ELF/AArch64/memtag.test

334

sure, done, in submit.

llvm/lib/Object/ELF.cpp

case ELF::EM_MIPS_RS3_LE:
     }
     break;
   case ELF::EM_MSP430:
     switch (Type) { STRINGIFY_ENUM_CASE(ELF, SHT_MSP430_ATTRIBUTES); }
     break;
   case ELF::EM_RISCV:
     switch (Type) { STRINGIFY_ENUM_CASE(ELF, SHT_RISCV_ATTRIBUTES); }
     break;
+  case ELF::EM_AARCH64:
+    switch (Type) {
+      STRINGIFY_ENUM_CASE(ELF, SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC);
+      STRINGIFY_ENUM_CASE(ELF, SHT_AARCH64_MEMTAG_GLOBALS_STATIC);
+    }
   default:
     break;
   }
 
   switch (Type) {
     STRINGIFY_ENUM_CASE(ELF, SHT_NULL);
     STRINGIFY_ENUM_CASE(ELF, SHT_PROGBITS);
     STRINGIFY_ENUM_CASE(ELF, SHT_SYMTAB);

llvm/lib/ObjectYAML/ELFYAML.cpp

case ELF::EM_MIPS:
     ECase(SHT_MIPS_ABIFLAGS);
     break;
   case ELF::EM_RISCV:
     ECase(SHT_RISCV_ATTRIBUTES);
     break;
   case ELF::EM_MSP430:
     ECase(SHT_MSP430_ATTRIBUTES);
     break;
+  case ELF::EM_AARCH64:
+    ECase(SHT_AARCH64_MEMTAG_GLOBALS_STATIC);
+    ECase(SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC);
+    break;
   default:
     // Nothing to do.
     break;
   }
 #undef ECase
   IO.enumFallback<Hex32>(Value);
 }
 

llvm/test/tools/llvm-readobj/ELF/AArch64/memtag.test

 # NOSTACK-SAME: AARCH64_MEMTAG_STACK
 # NOSTACK-SAME: Disabled (0)
 
 # INVALID:      0x000000007000000{{[cC]}}
 # INVALID-SAME: AARCH64_MEMTAG_STACK
 # INVALID-SAME: Unknown (2)
 
 # LLVM:  0x000000007000000D AARCH64_MEMTAG_GLOBALS   0xdeadbeef
-# LLVM:  0x000000007000000F AARCH64_MEMTAG_GLOBALSSZ 1234
+# LLVM:  0x000000007000000F AARCH64_MEMTAG_GLOBALSSZ 15
 
 # GNU: 0x000000007000000d (AARCH64_MEMTAG_GLOBALS)   0xdeadbeef0
-# GNU: 0x000000007000000f (AARCH64_MEMTAG_GLOBALSSZ) 1234
+# GNU: 0x000000007000000f (AARCH64_MEMTAG_GLOBALSSZ) 15
 
 # GNU:          Displaying notes found in: .note.android.memtag
 # GNU-NEXT:     Owner    Data size   Description
 # GNU-OK-NEXT:  Android  0x00000004  NT_ANDROID_TYPE_MEMTAG (Android memory tagging information)
 # GNU-BAD-NEXT: Android  0x00000000  NT_ANDROID_TYPE_MEMTAG (Android memory tagging information)
 
 # LLVM:      Notes [
 # LLVM-NEXT:   NoteSection {

 # SYNC:    AARCH64_MEMTAG_MODE: Synchronous (0)
 # ASYNC:   AARCH64_MEMTAG_MODE: Asynchronous (1)
 # HEAP:    AARCH64_MEMTAG_HEAP: Enabled (1)
 # NOHEAP:  AARCH64_MEMTAG_HEAP: Disabled (0)
 # STACK:   AARCH64_MEMTAG_STACK: Enabled (1)
 # NOSTACK: AARCH64_MEMTAG_STACK: Disabled (0)
 # LLVM:    AARCH64_MEMTAG_GLOBALS: 0xdeadbeef0
 # GNU:     AARCH64_MEMTAG_GLOBALS: 0xdeadbeef0
-# LLVM:    AARCH64_MEMTAG_GLOBALSSZ: 1234
-# GNU:     AARCH64_MEMTAG_GLOBALSSZ: 1234
+# LLVM:    AARCH64_MEMTAG_GLOBALSSZ: 15
+# GNU:     AARCH64_MEMTAG_GLOBALSSZ: 15
 
 # LLVM-OK: Memtag Android Note
 # GNU-OK:  Memtag Android Note
 
 # SYNC:    Tagging Mode: SYNC
 # ASYNC:   Tagging Mode: ASYNC
 # UNKNOWN: Tagging Mode: Unknown (3)
 # HEAP:    Heap: Enabled
 # NOHEAP:  Heap: Disabled
 # STACK:   Stack: Enabled
 # NOSTACK: Stack: Disabled
 
+## Below is the maths for calculating the hand-written `.memtag.globals.dynamic` section contents.
+## This is based on the AArch64 MemtagABI:
+## https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#83encoding-of-sht_aarch64_memtag_globals_dynamic
+## You may find the following python one-liner helpful to encode your own values:
+##     `binascii.hexlify(leb128.u.encode(value_to_encode))`
+## Remember that a granule is 16 bytes.
+##   1. Tagged region of 16 bytes at 0xdead0000
+##      - Distance from the end of the last tagged region: 0xdead0000 bytes, 0xdead000 granules
+##      - Size: 0x10 bytes, 0x1 granules
+##      - Value to encode: (0xdead000 << 3) + 0x1 = 0x6f568001
+##      - ULEB-encoded value: 0x81 0x80 0xda 0xfa 0x06
+##   2. Tagged region of 32 bytes at 0xdead0010
+##      - Distance from the end of the last tagged region: 0x0 bytes, 0x0 granules
+##      - Size: 0x20 bytes, 0x2 granules
+##      - Value to encode: (0 << 3) + 0x2 == 0x2
+##      - ULEB-encoded value: 0x2
+##   3. Tagged region of 64 bytes at 0xdead0100
+##      - Distance: 0xdead0100 - 0xdead0010 - 32 = 0xd0 bytes, 0xd granules
+##      - Size: 0x40 bytes, 0x4 granules.
+##      - Value to encode: (0xd << 3) + 0x4 = 0x6c
+##      - ULEB-encoded value: 0x6c
+##   4. Tagged region of 0x1000 bytes at 0xdeadf000
+##      - Distance: 0xdeadf000 - 0xdead0100 - 64 = 0xeec0 bytes, 0xeec granules
+##      - Size: 0x1000 bytes, 0x100 granules.
+##        (note: size of 0x100 granules exceeds the 3-bit size allowance in value to encode, so the
+##         size needs to go to its own value, minus one).
+##      - 1st value to encode (distance only): (0xeec << 3) == 0x7760
+##      - 1st ULEB-encoded value: 0xe0 0xee 0x01
+##      - 2nd value to encode (size only): 0x100 - 1
+##      - 2nd ULEB-encoded value: 0xff 0x01
+##   5. Tagged region of 16 bytes at 0xdeae0000
+##      - Distance: 0xdeae000 - 0xdeadf000 - 0x1000 = 0x0 bytes, 0x0 granules (regions are adjacent)
+##      - Size: 0x10 bytes, 0x1 granules
+##      - Value to encode: (0x0 << 3) + 0x1
+##      - ULEB-encoded value: 0x01
+##   6. Tagged region of 16 bytes at 0xdeae0010
+##      - Distance: 0x0 (regions are adjacent)
+##      - Size: 0x10 bytes, 0x1 granules
+##      - Value to encode: (0x0 << 3) + 0x1
+##      - ULEB-encoded value: 0x01
+##   6. Tagged region of 16 bytes at 0xdeae0020
+##      - Distance: 0x0 (regions are adjacent)
+##      - Size: 0x10 bytes, 0x1 granules
+##      - Value to encode: (0x0 << 3) + 0x1
+##      - ULEB-encoded value: 0x01
+
+# LLVM-OK:      Memtag Global Descriptors: [
+# LLVM-OK-NEXT:    0xDEAD0000: 0x10
+# LLVM-OK-NEXT:    0xDEAD0010: 0x20
+# LLVM-OK-NEXT:    0xDEAD0100: 0x40
+# LLVM-OK-NEXT:    0xDEADF000: 0x1000
+# LLVM-OK-NEXT:    0xDEAE0000: 0x10
+# LLVM-OK-NEXT:    0xDEAE0010: 0x10
+# LLVM-OK-NEXT:    0xDEAE0020: 0x10
+# LLVM-OK-NEXT: ]
+# GNU-OK:       Memtag Global Descriptors:
+# GNU-OK-NEXT:     0xdead0000: 0x10
+# GNU-OK-NEXT:     0xdead0010: 0x20
+# GNU-OK-NEXT:     0xdead0100: 0x40
+# GNU-OK-NEXT:     0xdeadf000: 0x1000
+# GNU-OK-NEXT:     0xdeae0000: 0x10
+# GNU-OK-NEXT:     0xdeae0010: 0x10
+# GNU-OK-NEXT:     0xdeae0020: 0x10
+# GNU-OK-NOT:   {{.}}
+
 #########################################
 ## --docnum=1 (default)
 #########################################
 
 --- !ELF
 FileHeader:
   Class:   ELFCLASS64
   Data:    ELFDATA2LSB
Entries:
         Value: [[MODE]]
       - Tag:   DT_AARCH64_MEMTAG_HEAP
         Value: [[HEAP]]
       - Tag:   DT_AARCH64_MEMTAG_STACK
         Value: [[STACK]]
       - Tag:   DT_AARCH64_MEMTAG_GLOBALS
         Value: 0xdeadbeef0
       - Tag:   DT_AARCH64_MEMTAG_GLOBALSSZ
-        Value: 1234
+        Value: 15
       - Tag:   DT_INIT_ARRAY
         Value: 0x1000
+  - Name:            .memtag.globals.dynamic
+    Type:            SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC
+    Flags:           [ SHF_ALLOC ]
+    Address:         0xdeadbeef0
+    AddressAlign:    0x4
+    Content:         8180DAFA06026CE0EE01ff01010101
+
+#########################################
+## Ensure the header is printed, even if there's no relevant dynamic entries,
+## and that nothing else is printed.
+#########################################
 
 # RUN: yaml2obj --docnum=2 %s -o %t
 # RUN: llvm-readelf --memtag %t | FileCheck %s --check-prefixes=MISSING-GNU
 # RUN: llvm-readobj --memtag %t | FileCheck %s --check-prefixes=MISSING-LLVM
 
-## Ensure the header is printed, even if there's no relevant dynamic entries,
-## and that nothing else is printed.
-
 # MISSING-GNU-NOT:  {{.}}
 # MISSING-GNU:      Memtag Dynamic Entries:
 # MISSING-GNU-NEXT: < none found >
 # MISSING-GNU-NOT:  {{.}}
 
 # MISSING-LLVM-NOT:  {{.}}
 # MISSING-LLVM:      File: {{.*}}memtag.test
 # MISSING-LLVM-NEXT: Format: elf64-littleaarch64
FileHeader:
   Type:    ET_DYN
   Machine: EM_AARCH64
 Sections:
   - Name: .dynamic
     Type: SHT_DYNAMIC
     Entries:
       - Tag:   DT_INIT_ARRAY
         Value: 0x1000
+
+#########################################
+## Ensure that we fail if DT_AARCH64_MEMTAG_GLOBALSSZ doesn't match the actual
+## section size.
+#########################################
+
+# RUN: yaml2obj --docnum=3 %s -o %t \
+# RUN:   -D DT_AARCH64_MEMTAG_GLOBALSSZ=0x1337 \
+# RUN:   -D GLOBALS_SECTION_CONTENTS=12345678901234567890
+# RUN: llvm-readelf --memtag %t 2>&1 | FileCheck %s --check-prefixes=SIZE-MISMATCH
+# RUN: llvm-readobj --memtag %t 2>&1 | FileCheck %s --check-prefixes=SIZE-MISMATCH
+
+# SIZE-MISMATCH:      warning: {{.*}} mismatch between DT_AARCH64_MEMTAG_GLOBALSSZ (0x1337) and
+# SIZE-MISMATCH-SAME: SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC section size (0xa)
+
+#########################################
+## Ensure that we fail if DT_AARCH64_MEMTAG_GLOBALS doesn't agree with the address of the section.
+#########################################
+
+# RUN: yaml2obj --docnum=3 %s -o %t \
+# RUN:   -D DT_AARCH64_MEMTAG_GLOBALS=0xdeadbeef123 \
+# RUN:   -D DT_AARCH64_MEMTAG_GLOBALSSZ=10 \
+# RUN:   -D GLOBALS_SECTION_CONTENTS=00000000000000000000
+# RUN: llvm-readelf --memtag %t 2>&1 | FileCheck %s --check-prefixes=BAD-SECTION
+# RUN: llvm-readobj --memtag %t 2>&1 | FileCheck %s --check-prefixes=BAD-SECTION
+
+# BAD-SECTION:      warning: {{.*}} SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC section was unexpectedly at
+# BAD-SECTION-SAME: 0xdeadbeef, when DT_AARCH64_MEMTAG_GLOBALS says it should be at 0xdeadbeef123
+
+#########################################
+## Ensure that we fail if the ULEB-encoded globals stream can't be decoded.
+#########################################
+
+# RUN: yaml2obj --docnum=3 %s -o %t \
+# RUN:   -D DT_AARCH64_MEMTAG_GLOBALSSZ=3 \
+# RUN:   -D GLOBALS_SECTION_CONTENTS=808080
+# RUN: llvm-readelf --memtag %t 2>&1 | FileCheck %s --check-prefixes=BAD-STREAM1
+# RUN: llvm-readobj --memtag %t 2>&1 | FileCheck %s --check-prefixes=BAD-STREAM1
+
+# BAD-STREAM1:      warning: {{.*}} error decoding distance uleb, 3 byte(s) into
+# BAD-STREAM1-SAME: SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC
+
+# RUN: yaml2obj --docnum=3 %s -o %t \
+# RUN:   -D DT_AARCH64_MEMTAG_GLOBALSSZ=2 \
+# RUN:   -D GLOBALS_SECTION_CONTENTS=0080
+# RUN: llvm-readelf --memtag %t 2>&1 | FileCheck %s --check-prefixes=BAD-STREAM2
+# RUN: llvm-readobj --memtag %t 2>&1 | FileCheck %s --check-prefixes=BAD-STREAM2
+
+# BAD-STREAM2:      warning: {{.*}} error decoding size-only uleb, 1 byte(s) into
+# BAD-STREAM2-SAME: SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC
+
+# RUN: yaml2obj --docnum=3 %s -o %t \
+# RUN:   -D SH_OFFSET=0xffff \
+# RUN:   -D DT_AARCH64_MEMTAG_GLOBALSSZ=10 \
+# RUN:   -D GLOBALS_SECTION_CONTENTS=00000000000000000000
+# RUN: llvm-readelf --memtag %t 2>&1 | FileCheck %s --check-prefixes=UNREADABLE-SECTION
+# RUN: llvm-readobj --memtag %t 2>&1 | FileCheck %s --check-prefixes=UNREADABLE-SECTION
+
+# UNREADABLE-SECTION:      couldn't get SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC section contents: section
+# UNREADABLE-SECTION-SAME: [index 2] has a sh_offset (0xffff) + sh_size (0xa) that is greater than
+# UNREADABLE-SECTION-SAME: the file size
+
+#########################################
+## --docnum=3
+#########################################
+
+--- !ELF
+FileHeader:
+  Class:   ELFCLASS64
+  Data:    ELFDATA2LSB
+  Type:    ET_DYN
+  Machine: EM_AARCH64
+Sections:
+  - Name: .dynamic
+    Type: SHT_DYNAMIC
+    Entries:
+      - Tag:   DT_AARCH64_MEMTAG_MODE
+        Value: 0
+      - Tag:   DT_AARCH64_MEMTAG_HEAP
+        Value: 0
+      - Tag:   DT_AARCH64_MEMTAG_STACK
+        Value: 0
+      - Tag:   DT_AARCH64_MEMTAG_GLOBALS
+        Value: [[DT_AARCH64_MEMTAG_GLOBALS=0xdeadbeef]]
+      - Tag:   DT_AARCH64_MEMTAG_GLOBALSSZ
+        Value: [[DT_AARCH64_MEMTAG_GLOBALSSZ]]
+  - Name:         .memtag.globals.dynamic
+    Type:         SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC
+    Flags:        [ SHF_ALLOC ]
+    Address:      0xdeadbeef
+    AddressAlign: 0x4
+    Content:      [[GLOBALS_SECTION_CONTENTS]]
+    ShOffset:     [[SH_OFFSET=<none>]]

llvm/test/tools/llvm-readobj/ELF/machine-specific-section-types.test

 # Show that all machine-specific section types are properly printed for both LLVM and
 # GNU styles for ELF files with that machine type.
 
 # RUN: yaml2obj %s --docnum=1 -o %t-arm.o
 # RUN: llvm-readobj --section-headers %t-arm.o | FileCheck %s --check-prefix=ARM-LLVM
 # RUN: llvm-readelf --section-headers %t-arm.o | FileCheck %s --check-prefix=ARM-GNU
 
 # RUN: yaml2obj %s --docnum=2 -o %t-x86_64.o
 # RUN: llvm-readobj --section-headers %t-x86_64.o | FileCheck %s --check-prefix=X86-LLVM
 # RUN: llvm-readelf --section-headers %t-x86_64.o | FileCheck %s --check-prefix=X86-GNU
 
 # RUN: yaml2obj %s --docnum=3 -o %t-mips.o
 # RUN: llvm-readobj --section-headers %t-mips.o | FileCheck %s --check-prefix=MIPS-LLVM
 # RUN: llvm-readelf --section-headers %t-mips.o | FileCheck %s --check-prefix=MIPS-GNU
 
+# RUN: yaml2obj %s --docnum=4 -o %t-aarch64.o
+# RUN: llvm-readobj --section-headers %t-aarch64.o | FileCheck %s --check-prefix=AARCH64-LLVM
+# RUN: llvm-readelf --section-headers %t-aarch64.o | FileCheck %s --check-prefix=AARCH64-GNU
+
 # ARM-LLVM: Name: exidx
 # ARM-LLVM: Type: SHT_ARM_EXIDX
 # ARM-LLVM: Name: preemptmap
 # ARM-LLVM: Type: SHT_ARM_PREEMPTMAP
 # ARM-LLVM: Name: attributes
 # ARM-LLVM: Type: SHT_ARM_ATTRIBUTES
 # ARM-LLVM: Name: debugoverlay
 # ARM-LLVM: Type: SHT_ARM_DEBUGOVERLAY

 # MIPS-LLVM: Name: dwarf
 # MIPS-LLVM: Type: SHT_MIPS_DWARF
 
 # MIPS-GNU: reginfo  MIPS_REGINFO
 # MIPS-GNU: options  MIPS_OPTIONS
 # MIPS-GNU: abiflags MIPS_ABIFLAGS
 # MIPS-GNU: dwarf    MIPS_DWARF
 
+# AARCH64-LLVM: Name: .memtag.globals.dynamic
+# AARCH64-LLVM: Type: SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC
+# AARCH64-LLVM: Name: .memtag.globals.static
+# AARCH64-LLVM: Type: SHT_AARCH64_MEMTAG_GLOBALS_STATIC
+
+# AARCH64-GNU: .memtag.globals.dynamic AARCH64_MEMTAG_GLOBALS_DYNAMIC
+# AARCH64-GNU: .memtag.globals.static  AARCH64_MEMTAG_GLOBALS_STATIC
+
 --- !ELF
 FileHeader:
   Class:   ELFCLASS64
   Data:    ELFDATA2LSB
   Type:    ET_REL
   Machine: EM_ARM
 Sections:
   - Name: exidx
- Name: reginfo
     Type: SHT_MIPS_REGINFO
   - Name: options
     Type: SHT_MIPS_OPTIONS
   - Name: abiflags
     Type: SHT_MIPS_ABIFLAGS
     ISA:  MIPS64
   - Name: dwarf
     Type: SHT_MIPS_DWARF
+
+--- !ELF
+FileHeader:
+  Class:   ELFCLASS64
+  Data:    ELFDATA2LSB
+  Type:    ET_REL
+  Machine: EM_AARCH64
+Sections:
+  - Name:  .memtag.globals.dynamic
+    Type:  SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC
+  - Name:  .memtag.globals.static
+    Type:  SHT_AARCH64_MEMTAG_GLOBALS_STATIC

llvm/tools/llvm-readobj/ELFDumper.cpp

public:
   void printNeededLibraries() override;
   void printHashTable() override;
   void printGnuHashTable() override;
   void printLoadName() override;
   void printVersionInfo() override;
   void printArchSpecificInfo() override;
   void printStackMap() const override;
   void printMemtag() override;
+  ArrayRef<uint8_t> getMemtagGlobalsSectionContents(uintptr_t ExpectedAddr);
 
   // Hash histogram shows statistics of how efficient the hash was for the
   // dynamic symbol table. The table shows the number of hash buckets for
   // different lengths of chains as an absolute number and percentage of the
   // total buckets, and the cumulative coverage of symbols for each set of
   // buckets.
   void printHashHistograms() override;
 
virtual void printSymbol(const Elf_Sym &Symbol, unsigned SymIndex,
                            bool NonVisibilityBitsUsed) const = 0;
 
   virtual void printMipsABIFlags() = 0;
   virtual void printMipsGOT(const MipsGOTParser<ELFT> &Parser) = 0;
   virtual void printMipsPLT(const MipsGOTParser<ELFT> &Parser) = 0;
 
   virtual void printMemtag(
       const ArrayRef<std::pair<std::string, std::string>> DynamicEntries,
-      const ArrayRef<uint8_t> AndroidNoteDesc) = 0;
+      const ArrayRef<uint8_t> AndroidNoteDesc,
+      const ArrayRef<std::pair<uint64_t, uint64_t>> Descriptors) = 0;
 
   virtual void printHashHistogram(const Elf_Hash &HashTable) const;
   virtual void printGnuHashHistogram(const Elf_GnuHash &GnuHashTable) const;
   virtual void printHashHistogramStats(size_t NBucket, size_t MaxChain,
                                        size_t TotalSyms, ArrayRef<size_t> Count,
                                        bool IsGnu) const = 0;
 
   Expected<ArrayRef<Elf_Versym>>
public:
   void printCGProfile() override;
   void printBBAddrMaps() override;
   void printAddrsig() override;
   void printNotes() override;
   void printELFLinkerOptions() override;
   void printStackSizes() override;
   void printMemtag(
       const ArrayRef<std::pair<std::string, std::string>> DynamicEntries,
-      const ArrayRef<uint8_t> AndroidNoteDesc) override;
+      const ArrayRef<uint8_t> AndroidNoteDesc,
+      const ArrayRef<std::pair<uint64_t, uint64_t>> Descriptors) override;
   void printHashHistogramStats(size_t NBucket, size_t MaxChain,
                                size_t TotalSyms, ArrayRef<size_t> Count,
                                bool IsGnu) const override;
 
 private:
   void printHashTableSymbols(const Elf_Hash &HashTable);
   void printGnuHashTableSymbols(const Elf_GnuHash &GnuHashTable);
 
public:
   void printCGProfile() override;
   void printBBAddrMaps() override;
   void printAddrsig() override;
   void printNotes() override;
   void printELFLinkerOptions() override;
   void printStackSizes() override;
   void printMemtag(
       const ArrayRef<std::pair<std::string, std::string>> DynamicEntries,
-      const ArrayRef<uint8_t> AndroidNoteDesc) override;
+      const ArrayRef<uint8_t> AndroidNoteDesc,
+      const ArrayRef<std::pair<uint64_t, uint64_t>> Descriptors) override;
   void printSymbolSection(const Elf_Sym &Symbol, unsigned SymIndex,
                           DataRegion<Elf_Word> ShndxTable) const;
   void printHashHistogramStats(size_t NBucket, size_t MaxChain,
                                size_t TotalSyms, ArrayRef<size_t> Count,
                                bool IsGnu) const override;
 
 private:
   void printRelrReloc(const Elf_Relr &R) override;

 static bool printAndroidNote(raw_ostream &OS, uint32_t NoteType,
                              ArrayRef<uint8_t> Desc) {
   // Return true if we were able to pretty-print the note, false otherwise.
   AndroidNoteProperties Props = getAndroidNoteProperties(NoteType, Desc);
   if (Props.empty())
     return false;
   for (const auto &KV : Props)
     OS << "    " << KV.first << ": " << KV.second << '\n';
-  OS << '\n';
   return true;
 }
 
 template <class ELFT>
 void GNUELFDumper<ELFT>::printMemtag(
     const ArrayRef<std::pair<std::string, std::string>> DynamicEntries,
-    const ArrayRef<uint8_t> AndroidNoteDesc) {
+    const ArrayRef<uint8_t> AndroidNoteDesc,
+    const ArrayRef<std::pair<uint64_t, uint64_t>> Descriptors) {
   OS << "Memtag Dynamic Entries:\n";
   if (DynamicEntries.empty())
     OS << "    < none found >\n";
   for (const auto &DynamicEntryKV : DynamicEntries)
     OS << "    " << DynamicEntryKV.first << ": " << DynamicEntryKV.second
        << "\n";
 
   if (!AndroidNoteDesc.empty()) {
     OS << "Memtag Android Note:\n";
     printAndroidNote(OS, ELF::NT_ANDROID_TYPE_MEMTAG, AndroidNoteDesc);
   }
+
+  if (Descriptors.empty())
+    return;
+
+  OS << "Memtag Global Descriptors:\n";
+  for (const auto &[Addr, BytesToTag] : Descriptors) {
+    OS << "    0x" << utohexstr(Addr, /*LowerCase=*/true) << ": 0x"
+       << utohexstr(BytesToTag, /*LowerCase=*/true) << "\n";
+  }
 }
 
 template <typename ELFT>
 static bool printLLVMOMPOFFLOADNote(raw_ostream &OS, uint32_t NoteType,
                                     ArrayRef<uint8_t> Desc) {
   switch (NoteType) {
   default:
     return false;
auto ProcessNote = [&](const Elf_Note &Note, bool IsCore) -> Error {
     }
     return Error::success();
   };
 
   processNotesHelper(*this, /*StartNotesFn=*/PrintHeader,
                      /*ProcessNoteFn=*/ProcessNote, /*FinishNotesFn=*/[]() {});
 }
 
+template <class ELFT>
+ArrayRef<uint8_t>
+ELFDumper<ELFT>::getMemtagGlobalsSectionContents(uintptr_t ExpectedAddr) {
+  for (const typename ELFT::Shdr &Sec : cantFail(Obj.sections())) {
+    if (Sec.sh_type != SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC)
+      continue;
+    if (Sec.sh_addr != ExpectedAddr) {
+      reportUniqueWarning(
+          "SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC section was unexpectedly at 0x" +
+          Twine::utohexstr(Sec.sh_addr) +
+          ", when DT_AARCH64_MEMTAG_GLOBALS says it should be at 0x" +
+          Twine::utohexstr(ExpectedAddr));
+      return ArrayRef<uint8_t>();
+    }
+    Expected<ArrayRef<uint8_t>> Contents = Obj.getSectionContents(Sec);
+    if (auto E = Contents.takeError()) {
+      reportUniqueWarning(
+          "couldn't get SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC section contents: " +
+          toString(std::move(E)));
+      return ArrayRef<uint8_t>();
+    }
+    return Contents.get();
+  }
+  return ArrayRef<uint8_t>();
+}
+
+// Reserve the lower three bits of the first byte of the step distance when
+// encoding the memtag descriptors. Found to be the best overall size tradeoff
+// when compiling Android T with full MTE globals enabled.
+constexpr uint64_t MemtagStepVarintReservedBits = 3;
+constexpr uint64_t MemtagGranuleSize = 16;
+
 template <typename ELFT> void ELFDumper<ELFT>::printMemtag() {
   if (Obj.getHeader().e_machine != EM_AARCH64) return;
   std::vector<std::pair<std::string, std::string>> DynamicEntries;
+  size_t MemtagGlobalsSz = 0;
+  uintptr_t MemtagGlobals = 0;
   for (const typename ELFT::Dyn &Entry : dynamic_table()) {
     uintX_t Tag = Entry.getTag();
     switch (Tag) {
+    case DT_AARCH64_MEMTAG_GLOBALSSZ:
+      MemtagGlobalsSz = Entry.getVal();
+      DynamicEntries.emplace_back(Obj.getDynamicTagAsString(Tag),
+                                  getDynamicEntry(Tag, Entry.getVal()));
+      break;
+    case DT_AARCH64_MEMTAG_GLOBALS:
+      MemtagGlobals = Entry.getVal();
+      DynamicEntries.emplace_back(Obj.getDynamicTagAsString(Tag),
+                                  getDynamicEntry(Tag, Entry.getVal()));
+      break;
     case DT_AARCH64_MEMTAG_MODE:
     case DT_AARCH64_MEMTAG_HEAP:
     case DT_AARCH64_MEMTAG_STACK:
-    case DT_AARCH64_MEMTAG_GLOBALSSZ:
-    case DT_AARCH64_MEMTAG_GLOBALS:
       DynamicEntries.emplace_back(Obj.getDynamicTagAsString(Tag),
                                   getDynamicEntry(Tag, Entry.getVal()));
+      break;
     }
   }
 
   ArrayRef<uint8_t> AndroidNoteDesc;
   auto FindAndroidNote = [&](const Elf_Note &Note, bool IsCore) -> Error {
     if (Note.getName() == "Android" &&
         Note.getType() == ELF::NT_ANDROID_TYPE_MEMTAG)
       AndroidNoteDesc = Note.getDesc();
     return Error::success();
   };
 
   processNotesHelper(
       *this,
       /*StartNotesFn=*/
       [](std::optional<StringRef>, const typename ELFT::Off,
          const typename ELFT::Addr) {},
       /*ProcessNoteFn=*/FindAndroidNote, /*FinishNotesFn=*/[]() {});
 
-  printMemtag(DynamicEntries, AndroidNoteDesc);
+  ArrayRef<uint8_t> Contents = getMemtagGlobalsSectionContents(MemtagGlobals);
+  if (Contents.size() != MemtagGlobalsSz) {
+    reportUniqueWarning(
+        "mismatch between DT_AARCH64_MEMTAG_GLOBALSSZ (0x" +
+        Twine::utohexstr(MemtagGlobalsSz) +
+        ") and SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC section size (0x" +
+        Twine::utohexstr(Contents.size()) + ")");
+    Contents = ArrayRef<uint8_t>();
+  }
+
+  std::vector<std::pair<uint64_t, uint64_t>> GlobalDescriptors;
+  uint64_t Address = 0;
+  // See the AArch64 MemtagABI document for a description of encoding scheme:
+  // https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#83encoding-of-sht_aarch64_memtag_globals_dynamic
+  for (size_t I = 0; I < Contents.size();) {
+    const char *Error = nullptr;
+    unsigned DecodedBytes = 0;
+    uint64_t Value = decodeULEB128(Contents.data() + I, &DecodedBytes,
+                                   Contents.end(), &Error);
+    I += DecodedBytes;
+    if (Error) {
+      reportUniqueWarning(
+          "error decoding distance uleb, " + Twine(DecodedBytes) +
+          " byte(s) into SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC: " + Twine(Error));
+      GlobalDescriptors.clear();
+      break;
+    }
+    uint64_t Distance = Value >> MemtagStepVarintReservedBits;
+    uint64_t GranulesToTag = Value & ((1 << MemtagStepVarintReservedBits) - 1);
+    if (GranulesToTag == 0) {
+      GranulesToTag = decodeULEB128(Contents.data() + I, &DecodedBytes,
+                                    Contents.end(), &Error) +
+                      1;
+      I += DecodedBytes;
+      if (Error) {
+        reportUniqueWarning(
+            "error decoding size-only uleb, " + Twine(DecodedBytes) +
+            " byte(s) into SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC: " + Twine(Error));
+        GlobalDescriptors.clear();
+        break;
+      }
+    }
+    Address += Distance * MemtagGranuleSize;
+    GlobalDescriptors.emplace_back(Address, GranulesToTag * MemtagGranuleSize);
+    Address += GranulesToTag * MemtagGranuleSize;
+  }
+
+  printMemtag(DynamicEntries, AndroidNoteDesc, GlobalDescriptors);
 }
 
 template <class ELFT> void GNUELFDumper<ELFT>::printELFLinkerOptions() {
   OS << "printELFLinkerOptions not implemented!\n";
 }
 
 template <class ELFT>
 void ELFDumper<ELFT>::printDependentLibsHelper(
static bool printAndroidNoteLLVMStyle(uint32_t NoteType, ArrayRef<uint8_t> Desc,
   for (const auto &KV : Props)
     W.printString(KV.first, KV.second);
   return true;
 }
 
 template <class ELFT>
 void LLVMELFDumper<ELFT>::printMemtag(
     const ArrayRef<std::pair<std::string, std::string>> DynamicEntries,
-    const ArrayRef<uint8_t> AndroidNoteDesc) {
+    const ArrayRef<uint8_t> AndroidNoteDesc,
+    const ArrayRef<std::pair<uint64_t, uint64_t>> Descriptors) {
+  {
     ListScope L(W, "Memtag Dynamic Entries:");
     if (DynamicEntries.empty())
       W.printString("< none found >");
     for (const auto &DynamicEntryKV : DynamicEntries)
       W.printString(DynamicEntryKV.first, DynamicEntryKV.second);
+  }
 
   if (!AndroidNoteDesc.empty()) {
     ListScope L(W, "Memtag Android Note:");
     printAndroidNoteLLVMStyle(ELF::NT_ANDROID_TYPE_MEMTAG, AndroidNoteDesc, W);
   }
+
+  if (Descriptors.empty())
+    return;
+
+  {
+    ListScope L(W, "Memtag Global Descriptors:");
+    for (const auto &[Addr, BytesToTag] : Descriptors) {
+      W.printHex("0x" + utohexstr(Addr), BytesToTag);
+    }
+  }
 }
 
 template <typename ELFT>
 static bool printLLVMOMPOFFLOADNoteLLVMStyle(uint32_t NoteType,
                                              ArrayRef<uint8_t> Desc,
                                              ScopedPrinter &W) {
   switch (NoteType) {
   default: