[lld] Synthesize metadata for MTE globals

[hctim]

Summary

As per the ABI at
https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst,
this patch interprets the SHT_AARCH64_MEMTAG_GLOBALS_STATIC section,
which contains R_NONE relocations to tagged globals, and emits a
SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC section, with the correct
DT_AARCH64_MEMTAG_GLOBALS and DT_AARCH64_MEMTAG_GLOBALSSZ dynamic
entries. This section describes, in a uleb-encoded stream, global memory
ranges that should be tagged with MTE.

We are also out of bits to spare in the LLD Symbol class. As a result,
I've reused the 'needsTocRestore' bit, which is a PPC64 only feature.
Now, it's also used for 'isTagged' on AArch64.

An entry in SHT_AARCH64_MEMTAG_GLOBALS_STATIC is practically a guarantee
from an objfile that all references to the linked symbol are through the
GOT, and meet correct alignment requirements. As a result, we go through
all symbols and make sure that, for all symbols $SYM, all object files
that reference $SYM also have a SHT_AARCH64_MEMTAG_GLOBALS_STATIC entry
for $SYM. If this isn't the case, we demote the symbol to being
untagged. Symbols that are imported from other DSOs should always be
fine, as they're GOT-referenced (and thus the GOT entry either has the
correct tag or not, depending on whether it's tagged in the defining DSO
or not).

Additionally hand-tested by building {libc, libm, libc++, libm, and libnetd}
on Android with some experimental MTE globals support in the
linker/libc.

[peter.smith]

I'll try and take a look over the next few days. Will need to reload my brain with the MTE spec first.

[peter.smith]

Just a few small comments so far. I've got up to Relocations.cpp. Hope to carry on later this week.

lld/ELF/Arch/AArch64.cpp

404

A small nit. LLD tends to prefer no curly brackets when there is only one statement.

673

IIUC this will change an ADRP, ADD into an ADR, which is just a shorter ranged ADRP/ADD. This relaxation doesn't change the destination address like tryRelaxAdrpLdr might.

.

787

To help prevent future relaxations from not considering MTE, It may be worth moving the sym.isTagged() to here with a general condition similar to needsGot in relocations.cpp.

For example don't relax if the symbol is tagged and is relative to a GOT reference.

Alternatively could be worth a comment in the Relaxer class to highlight the restriction.

lld/ELF/Driver.cpp

386

Not sure what this difference is from. If it has come from clang-format it may be worth NFC committing it separately to avoid it getting associated with this patch.

789

To check my understanding; this is being deleted because protecting globals is independent of heap and stack tagging.

[peter.smith]

I've gone through all of the LLD changes now.

lld/ELF/Driver.cpp

2621

I think Fuchsia uses REL dynamic relocations with -z rel , may be worth making this a user visible error message as this could happen with user input.

2957

At this stage can you use ctx.objectFiles this seems to be more idiomatic than processing the files directly.

2963

I think clang-format will prefer

if (section == nullptr)
  continue;

It is coming out all as one line on my screen, apologies if that is just Phabricator.
May want to combine the two if statements into one. Also LLD tends to use !section

if (!section || section->type != SHT_AARCH64_MEMTAG_GLOBALS_STATIC)
  continue;

Given that this is after Garbage Collection I think you'll need to check if s== &InputSection::discarded.

2970

Is it ever possible to get a case where a STB_LOCAL binding symbol definition is incorrectly tagged? For example all references to it should be within the same TU, which should share the same command line options. It is possible some function attribute might prevent this though.

If it isn't possible then you might be able to just iterate the global symbols.

2981

I'm pretty sure this isn't necessary, I've not seen any other code that checks. I guess it might be possible that a broken object file might contain a 0 index for a symbol, but if it does LLD will already have crashed by now.

lld/ELF/SyntheticSections.cpp

3909

Although not ideal either, would writeULEB128 be a better name as compute implies that it is just computing the value and not writing it?

I guess computeOrWrite is the most descriptive but possibly a bit long.

3922

Although it may not be worth dealing with, I think you could pull this out into a separate function that you could call after the first address assignment in finalizeAddressDependentContent, as by that time the relative order of the symbols would be fixed.

3950

One possibility would be to have an internal buffer that could cache the results so that writeTo would just need to write it out. I guess the problem is that we won't know how big to make it, so I guess it would need to be a self expanding buffer.

Not sure if it is worth doing, as it might end up more complicated than it is already.

3964

By caller's do you mean call-sites?

3978

At first glance I thought that the contents of the MemtagDescriptors would be stable and could be cached, but I think the uleb encoding could change depending on the addresses so it will need recalculating.

If I'm right it could be worth adding a comment.

lld/ELF/SyntheticSections.h

1257

Looks like the call site has this check before calling addSymbol. Is it worth making that an assert instead?

[hctim]

lld/ELF/Arch/AArch64.cpp

673

yep, good point, removed

787

Done, moved it to a general conditional branch.

lld/ELF/Driver.cpp

386

ack, removed from diff

789

Yeah, that's correct. We want to allow --android-memtag-mode=sync without requiring heap/stack, as we want to enable building globals-only binaries.

2970

Ooh, nice tip! I've made addTaggedSymbolReferences mark them immediately as tagged.

2981

Done. I swear I added this for a reason, but I'll rebuild Android and check.

lld/ELF/SyntheticSections.cpp

3909

let's go with computeOrWriteULEB128

3922

done (glued it up inside finalizeAddressDependentContent)

3950

now that we're not sorting on the size call (and only doing it in the finalization of the address dependent content), less worth doing anything this complicated.

3964

this is gone with the new glue around finalizeAddressDependentContent

3978

done, in the header

[hctim]

Update from Peter's comments (thanks for the review!).

[peter.smith]

Thanks for the updates. The code-changes look good to me on my current understanding. I've made a few suggestions on the testing. I'm hoping to read through the spec in detail to see if I've missed anything, but I don't want to let that hold up the patch if I can't get round to it in a reasonable amount of time.

lld/test/ELF/Inputs/aarch64-memtag-globals-1.s

12 ↗

(On Diff #535757)

Speaking of hidden, I'm guessing that attribute((visibility("hidden"))) might affect a variable being in the GOT in the same way as static. If it does then could be worth adding a test.

51 ↗

(On Diff #535757)

The spec says that TLS variables are not tagged (although that could change), is it worth adding a case for TLS.

lld/test/ELF/aarch64-memtag-globals.s

5

One thing that might be worth doing is using split-file (see aarch64-thunk-pi.s for an example ) to include instructions to create aarch64-memtag-globals-1.s and memtag-globals-2.s in the same source file. There's a chance it makes it too big to be worth the effort, but could be worth an expirement to see if it is easier to read than splitting across several files.

11

typo in relocatiosn

17

Worth dumping the dynamic tags to check for DT_AARCH64_MEMTAG_GLOBALS and DT_AARCH64_MEMTAG_GLOBALSSZ ?

Also could be worth dumping section headers to check for SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC

[hctim]

lld/test/ELF/aarch64-memtag-globals.s

17

The dynamic entries are dumped by --memtag (see the checks near "CHECK: Memtag Dynamic Entries").

For SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC, done.

[hctim]

Update from Peter's test comments.

[peter.smith]

Thanks for the updates. One query about the R_AARCH64_PREL64 relocation as it looks like that needs to be separated out, but otherwise looks good to me. I'll be happy to approve, although I think it would be good to get MaskRay's approval as well.

lld/ELF/Arch/AArch64.cpp

395

Does R_AARCH64_PREL64 need this behaviour? It isn't a dynamic relocation, won't generate a R_AARCH64_RELATIVE and calculates an offset to symbol from the place. I can't see it in the spec either.

Does it need to be?

case R_AARCH64_PREL64:
  write64(loc, val);
  break;
case R_AARCH64_ABS64:
  // As below

Just for clarification, an R_AARCH64_ABS64 static relocation can be either converted to a relative or can be a dynamic reloc itself

extern int foo;
int *bar = &foo;

Is it OK to encode the addend as for R_AARCH64_RELATIVE in both cases?

[hctim]

Update from comments.

[hctim]

lld/ELF/Arch/AArch64.cpp

395

Done, removed it from the PREL64 branch. Yes, the encoded addend is intended and desirable for RELATIVE as well. It handles the case when we have an out-of-bounds (e.g. 'endptr') pointer to a local global variable.

[peter.smith]

Thanks for the updates. This looks good to me. Will be good to wait for a few days to see if MaskRay has any comments or objections.

[MaskRay]

I'll read this shortly...

lld/test/ELF/aarch64-memtag-globals.s

4

We typically rm -rf %t the directory, especially for a large test with many temporary files. Otherwise, if we remove an output file, the test may sometimes still pass as there is a lingering file in our build directory.

19

For newer tests, we align the value of CHECK to look better

# CHECK:      check
# CHECK-NEXT: no indentation
# CHECK-NEXT:   2-space indentation

20

Ignoring a decimal number prefers [[#]]

22

[0-9a-f]+ can be replaced with [[#%x,xxx:]], though the references need to look like [[#xxx]]

[MaskRay]

lld/ELF/SyntheticSections.cpp

3962

If we have aliases, std::sort will exhibit different behaviors for different std::sort implementations or libc++ with https://libcxx.llvm.org/DesignDocs/UnspecifiedBehaviorRandomization.html
Consider stable_sort

lld/ELF/SyntheticSections.h

1250

final

lld/test/ELF/Inputs/aarch64-memtag-globals.s

384

no trailing blank line

lld/test/ELF/aarch64-memtag-globals.s

16

FileCheck %s < %t.out

[MaskRay]

lld/ELF/Arch/AArch64.cpp

391

Just use the unary operator.

lld/ELF/Driver.cpp

2613

the lambda is only used once. just expand it.

2620

TLS blocks => TLS symbols

2629

LLVM coding style prefers pre-increments

2950

We probably should move the whole function and referenced function template addTaggedSymbolReferences to AArch64.cpp.

2958

Avoid referencing an individual user. When needed (actually very rarely done for lld), reference a public issue link.

In this case, bitcode files should already work. This place is after compileBitcodeFiles, so `ctx.objectFiles contains all relocatable object files (including extracted lazy object files) and compiled bitcode files.

lld/ELF/SyntheticSections.cpp

1456

This is guaranteed to be non-null.

3926

We typically just use addr instead of vAddr.

3937

When buf is null, addr is 0. If size is 0, we'd report an error without knowing the actual address. We should drop the address from the diagnostic.

[MaskRay]

We need a --pack-dyn-relocs=relr test to show that we don't use RELR for a relative relocation referencing a tagged symbol.

This test should also check that a GOT-generating relocation referencing a non-preemptible memtag symbol does not use .relr.dyn (see local-got-shared.s).

[hctim]

Update w/ Ray's comments.

lld/ELF/Arch/AArch64.cpp

391

Unfortunately not possible here. e.g. ~17 != -1 * 17. While we could change the ABI to be granules-away (and then do a % 16 on the offset at the end of the calculation), giving an exact offset in bytes gives a nice easy way to debug the exact address of the tag derivation (and doesn't waste any bytes doing so).

lld/ELF/Driver.cpp

2958

Thanks for the tip!

lld/ELF/SyntheticSections.cpp

1456

isNeeded() is even better :).

lld/test/ELF/Inputs/aarch64-memtag-globals.s

384

assuming you mean no double-trailing-newline, done

lld/test/ELF/aarch64-memtag-globals.s

20

Yep, for ignoring sizes, done.

For ignoring relocation types, changed to {{[0-9a-f]+}} which to me is more understandable than [[#%x,]]`.

[MaskRay]

lld/ELF/Arch/AArch64.cpp

391

Sorry for being clear. I mean write64(loc, -rel.addend);.

We use unary operator elsewhere. It's much more common than -1 * xxx

[hctim]

Move to '-' from '-1 *'

[hctim]

Friendly ping @MaskRay

[MaskRay]

Thank you for the updates and sorry for the delayed response. I took a look again.

You can ping me more frequently:) I am going to take a trip and will likely have slow response for ~2 weeks since Jul 27.

lld/ELF/Arch/AArch64.cpp

388

rel.sym is guaranteed to be non-null. The nullness check can be removed

389

Consider using a single unsigned comparison and omitting the zero comparison.

985

This assert is unneeded now that this code lives in AArch64.cpp

986

We use const references to assert non-nullness.

990

This error is untested. We can use yaml2obj to craft a test.

1033

A BinaryFile has just one .data section. There can't be SHT_AARCH64_MEMTAG_GLOBALS_STATIC sections.

1067

llvm style prefers pre-increments.

lld/ELF/Relocations.cpp

866

case R_AARCH64_ABS64: in AArch64.cpp uses the signed int64_t, different from here.

Perhaps we can just omit the < 0 comparison and rely on unsigned comparison? If int64_t(addend) < 0, uint64_t(addend) will be very large.

Then adjust the comment to

// For tagged symbols with addends outside of [0, sym.getSize()), ...

lld/ELF/SyntheticSections.h

533

This change is untested. We seem to need a --apply-dynamic-relocs test inspecting the relocated data with llvm-readelf -x or llvm-objdump -s.

1255

clang-format will remove the space

1265

For new code, we use const reference to assert non-nullness.

1270

Why is the !config->isStatic && condition?

isConfig can be toggled by -Bstatic/-static and -Bdynamic.
-Bstatic can be used with a dynamically linked executable as well.

1274

Nit: SmallVector<const Symbol *, 0> is likely more efficient due to smaller size :)

1310

Place this after memtagAndroidNote for an alphabetical order

lld/test/ELF/aarch64-memtag-globals.s

88

Add -NEXT whenever appropriate.

91

Do you mean this?

99

Perhaps:

# CHECK:      Memtag Global Descriptors:
# CHECK-NEXT:   0x[[#POINTER_TO_GLOBAL]]: 0x10
# CHECK-NEXT:   0x[[#POINTER_INSIDE_GLOBAL]]: 0x10
...
# CHECK-NOT:  {{.}}

We already rely on the order, so we can just use -NEXT: patterns to avoid CHECK-NOT:

[hctim]

Update with comments from Ray.

lld/ELF/Arch/AArch64.cpp

388

Surprisingly, this causes failures in other tests if removed:

lld :: ELF/aarch64-call26-thunk.s
lld :: ELF/aarch64-cortex-a53-843419-large.s
lld :: ELF/aarch64-cortex-a53-843419-thunk.s
lld :: ELF/aarch64-jump26-thunk.s
lld :: ELF/aarch64-range-thunk-extension-plt32.s

For now, leaving as-is.

389

(see same comment below about unsigned comparison)

986

Made the parameter byref, assuming you also mean the same about non-const refs.

lld/ELF/Relocations.cpp

866

I've gone ahead and fleshed out the comment, but I really don't think that relying on "signed integer when converted to unsigned is so large as to be out of range" is a great idea. While it may reduce one arithmetic operation, it decreases readability as the intent is no longer evident from the code (no matter how well it's described in the comments).

lld/ELF/SyntheticSections.h

533

Removed this condition here, and banned --apply-dynamic-relocs when using MTE globals.

We could make it so --apply-dynamic-relocs works in all the places where it *can*, but this seems really prone to confusion ("why do I have the correct relocation here but not there? Oh, it's because of the MTE globals relocs!" isn't completely obvious).

1270

MTE globals are not supported for fully static executables, there needs to be a dynamic loader that processes relocations.

Is there a better way to describe this in code? Maybe pulling needsInterpSection out of Writer.cpp?

lld/test/ELF/aarch64-memtag-globals.s

91

Yeah, ish. [0-9a-f]+ is fine though.

[MaskRay]

Thanks!

lld/ELF/Arch/AArch64.cpp

766

rel.sym && can be removed. relocateAlloc guarantees that rel.sym != nullptr.

Sorry for my suggestion in another place. R_AARCH64_ABS64 does need a rel.sym check as it is used by relocateNoSym for thunks and relocateNonAlloc. I have done D73254 in the past to clean it a bit. I will do more cleanup so that
R_AARCH64_ABS64 can remove the rel.sym check as well.

1048

Remove this comment. As mentioned, LTO is already supported.

lld/ELF/SyntheticSections.cpp

3923

3930

Consider errorOrWarn so that --noinhibit-exec links can produce output even with errors.

I'm fine with no testing if this is difficult to do.

3932

no trailing full stop

lld/ELF/Writer.h

59

Below addReservedSymbols may be a good place. The last few declarations are for mips.

[hctim]

lld/ELF/SyntheticSections.cpp

3923

Added the type, but it's actually const Symbol* as the container needs to store pointers to allow sorting.

lld/ELF/SyntheticSections.h

1270

@MaskRay - any suggestions here?

[hctim]

More comment updates.

[MaskRay]

LGTM again. Feel free to file a request to merge this into https://github.com/llvm/llvm-project/tree/release/17.x if you prefer.

lld/ELF/SyntheticSections.h

1270

Yes, moving needsInterpSection to Writer.h and exposing it here looks good to me.

You will need to move isNeeded to SyntheticSections.cpp as we cannot make SyntheticSections.h include Writer.h.

Ideally SyntheticSections.cpp does not use more functions from Writer.h, so SyntheticSections.cpp defining needsInterpSection is also fine.

[hctim]

lld/ELF/SyntheticSections.h

1270

Yeah, so it needed a little bit more precise of a check, which I put straight in the relevant bit of Writer.cpp (so it doesn't need to be exported).

We don't allow MTE globals for fully-static binaries, as the loader needs to do some work. I added a test with --static (and nothing else, as this is what clang -static seems to emit, along with ctrbegin/end as static) as well. We basically error-out when you try and --android-memtag-mode on a non-DSO non-partially-linked (--relocatable) non-interpreted binary.

[hctim]

Final updates.

lld/ELF/Arch/AArch64.cpp

 //===- AArch64.cpp --------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
+#include "InputFiles.h"
 #include "OutputSections.h"
 #include "Symbols.h"
 #include "SyntheticSections.h"
 #include "Target.h"
 #include "lld/Common/ErrorHandler.h"
 #include "llvm/BinaryFormat/ELF.h"
 #include "llvm/Support/Endian.h"
 
case R_AARCH64_PREL32:
     checkIntUInt(loc, val, 32, rel);
     write32(loc, val);
     break;
   case R_AARCH64_PLT32:
     checkInt(loc, val, 32, rel);
     write32(loc, val);
     break;
   case R_AARCH64_ABS64:
+    // AArch64 relocations to tagged symbols have extended semantics, as
+    // described here:
+    // https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#841extended-semantics-of-r_aarch64_relative.
+    // tl;dr: encode the symbol's special addend in the place, which is an
+    // offset to the point where the logical tag is derived from. Quick hack, if
+    // the addend is within the symbol's bounds, no need to encode the tag
+    // derivation offset.
+    if (rel.sym && rel.sym->isTagged() &&
+        (rel.addend < 0 ||
+         rel.addend >= static_cast<int64_t>(rel.sym->getSize())))
+      write64(loc, -rel.addend);
+    else
+      write64(loc, val);
+    break;
   case R_AARCH64_PREL64:
     write64(loc, val);
     break;
   case R_AARCH64_ADD_ABS_LO12_NC:
     or32AArch64Imm(loc, val);
     break;
   case R_AARCH64_ADR_GOT_PAGE:
   case R_AARCH64_ADR_PREL_PG_HI21:
   case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
   case R_AARCH64_TLSDESC_ADR_PAGE21:
     checkInt(loc, val, 33, rel);
     [[fallthrough]];
   case R_AARCH64_ADR_PREL_PG_HI21_NC:
     write32AArch64Addr(loc, val >> 12);
     break;
   case R_AARCH64_ADR_PREL_LO21:
     checkInt(loc, val, 21, rel);
     write32AArch64Addr(loc, val);
if ((adrpInstr & 0x9f000000) != 0x90000000 ||
     return false;
   uint32_t adrpDestReg = adrpInstr & 0x1f;
   uint32_t addDestReg = addInstr & 0x1f;
   uint32_t addSrcReg = (addInstr >> 5) & 0x1f;
   if (adrpDestReg != addDestReg || adrpDestReg != addSrcReg)
     return false;
 
   Symbol &sym = *adrpRel.sym;
   // Check if the address difference is within 1MiB range.
   int64_t val = sym.getVA() - (secAddr + addRel.offset);
   if (val < -1024 * 1024 || val >= 1024 * 1024)
     return false;
 
   Relocation adrRel = {R_ABS, R_AARCH64_ADR_PREL_LO21, addRel.offset,
                        /*addend=*/0, &sym};
   // nop
   write32le(buf + adrpRel.offset, 0xd503201f);
target->relocate(buf + adrpSymRel.offset, adrpSymRel,
                    SignExtend64(getAArch64Page(sym.getVA()) -
                                     getAArch64Page(secAddr + adrpSymRel.offset),
                                 64));
   target->relocate(buf + addRel.offset, addRel, SignExtend64(sym.getVA(), 64));
   tryRelaxAdrpAdd(adrpSymRel, addRel, secAddr, buf);
   return true;
 }
 
+// Tagged symbols have upper address bits that are added by the dynamic loader,
+// and thus need the full 64-bit GOT entry. Do not relax such symbols.
+static bool needsGotForMemtag(const Relocation &rel) {
+  return rel.sym->isTagged() && needsGot(rel.expr);
+}
+
 void AArch64::relocateAlloc(InputSectionBase &sec, uint8_t *buf) const {
   uint64_t secAddr = sec.getOutputSection()->addr;
   if (auto *s = dyn_cast<InputSection>(&sec))
     secAddr += s->outSecOff;
   AArch64Relaxer relaxer(sec.relocs());
   for (size_t i = 0, size = sec.relocs().size(); i != size; ++i) {
     const Relocation &rel = sec.relocs()[i];
     uint8_t *loc = buf + rel.offset;
     const uint64_t val =
         sec.getRelocTargetVA(sec.file, rel.type, rel.addend,
                              secAddr + rel.offset, *rel.sym, rel.expr);
+
+    if (needsGotForMemtag(rel)) {
+      relocate(loc, rel, val);
+      continue;
+    }
+
     switch (rel.expr) {
     case R_AARCH64_GOT_PAGE_PC:
       if (i + 1 < size &&
           relaxer.tryRelaxAdrpLdr(rel, sec.relocs()[i + 1], secAddr, buf)) {
         ++i;
         continue;
       }
       break;
     case R_AARCH64_PAGE_PC:
       if (i + 1 < size &&
if ((config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI) ||
     static AArch64BtiPac t;
     return &t;
   }
   static AArch64 t;
   return &t;
 }
 
 TargetInfo *elf::getAArch64TargetInfo() { return getTargetInfo(); }
+
+template <class ELFT>
+static void
+addTaggedSymbolReferences(InputSectionBase &sec,
+                          DenseMap<Symbol *, unsigned> &referenceCount) {
+  assert(sec.type == SHT_AARCH64_MEMTAG_GLOBALS_STATIC);
+
+  const RelsOrRelas<ELFT> rels = sec.relsOrRelas<ELFT>();
+  if (rels.areRelocsRel())
+    error("non-RELA relocations are not allowed with memtag globals");
+
+  for (const typename ELFT::Rela &rel : rels.relas) {
+    Symbol &sym = sec.getFile<ELFT>()->getRelocTargetSym(rel);
+    // Linker-synthesized symbols such as __executable_start may be referenced
+    // as tagged in input objfiles, and we don't want them to be tagged. A
+    // cheap way to exclude them is the type check, but their type is
+    // STT_NOTYPE. In addition, this save us from checking untaggable symbols,
+    // like functions or TLS symbols.
+    if (sym.type != STT_OBJECT)
+      continue;
+    // STB_LOCAL symbols can't be referenced from outside the object file, and
+    // thus don't need to be checked for references from other object files.
+    if (sym.binding == STB_LOCAL) {
+      sym.setIsTagged(true);
+      continue;
+    }
+    ++referenceCount[&sym];
+  }
+  sec.markDead();
+}
+
+// A tagged symbol must be denoted as being tagged by all references and the
+// chosen definition. For simplicity, here, it must also be denoted as tagged
+// for all definitions. Otherwise:
+//
+//  1. A tagged definition can be used by an untagged declaration, in which case
+//     the untagged access may be PC-relative, causing a tag mismatch at
+//     runtime.
+//  2. An untagged definition can be used by a tagged declaration, where the
+//     compiler has taken advantage of the increased alignment of the tagged
+//     declaration, but the alignment at runtime is wrong, causing a fault.
+//
+// Ideally, this isn't a problem, as any TU that imports or exports tagged
+// symbols should also be built with tagging. But, to handle these cases, we
+// demote the symbol to be untagged.
+void lld::elf::createTaggedSymbols(const SmallVector<ELFFileBase *, 0> &files) {
+  assert(config->emachine == EM_AARCH64 &&
+         config->androidMemtagMode != ELF::NT_MEMTAG_LEVEL_NONE);
+
+  // First, collect all symbols that are marked as tagged, and count how many
+  // times they're marked as tagged.
+  DenseMap<Symbol *, unsigned> taggedSymbolReferenceCount;
+  for (InputFile* file : files) {
+    if (file->kind() != InputFile::ObjKind)
+      continue;
+    for (InputSectionBase *section : file->getSections()) {
+      if (!section || section->type != SHT_AARCH64_MEMTAG_GLOBALS_STATIC ||
+          section == &InputSection::discarded)
+        continue;
+      invokeELFT(addTaggedSymbolReferences, *section,
+                 taggedSymbolReferenceCount);
+    }
+  }
+
+  // Now, go through all the symbols. If the number of declarations +
+  // definitions to a symbol exceeds the amount of times they're marked as
+  // tagged, it means we have an objfile that uses the untagged variant of the
+  // symbol.
+  for (InputFile *file : files) {
+    if (file->kind() != InputFile::BinaryKind &&
+        file->kind() != InputFile::ObjKind)
+      continue;
+
+    for (Symbol *symbol : file->getSymbols()) {
+      // See `addTaggedSymbolReferences` for more details.
+      if (symbol->type != STT_OBJECT ||
+          symbol->binding == STB_LOCAL)
+        continue;
+      auto it = taggedSymbolReferenceCount.find(symbol);
+      if (it == taggedSymbolReferenceCount.end()) continue;
+      unsigned &remainingAllowedTaggedRefs = it->second;
+      if (remainingAllowedTaggedRefs == 0) {
+        taggedSymbolReferenceCount.erase(it);
+        continue;
+      }
+      --remainingAllowedTaggedRefs;
+    }
+  }
+
+  // `addTaggedSymbolReferences` has already checked that we have RELA
+  // relocations, the only other way to get written addends is with
+  // --apply-dynamic-relocs.
+  if (!taggedSymbolReferenceCount.empty() && config->writeAddends)
+    error("--apply-dynamic-relocs cannot be used with MTE globals");
+
+  // Now, `taggedSymbolReferenceCount` should only contain symbols that are
+  // defined as tagged exactly the same amount as it's referenced, meaning all
+  // uses are tagged.
+  for (auto &[symbol, remainingTaggedRefs] : taggedSymbolReferenceCount) {
+    assert(remainingTaggedRefs == 0 &&
+            "Symbol is defined as tagged more times than it's used");
+    symbol->setIsTagged(true);
+  }
+}

lld/ELF/Arch/PPC64.cpp

for (const Relocation &rel : sec.relocs()) {
     case R_PPC64_CALL:
       // If this is a call to __tls_get_addr, it may be part of a TLS
       // sequence that has been relaxed and turned into a nop. In this
       // case, we don't want to handle it as a call.
       if (read32(loc) == 0x60000000) // nop
         break;
 
       // Patch a nop (0x60000000) to a ld.
-      if (rel.sym->needsTocRestore) {
+      if (rel.sym->needsTocRestore()) {
         // gcc/gfortran 5.4, 6.3 and earlier versions do not add nop for
         // recursive calls even if the function is preemptible. This is not
         // wrong in the common case where the function is not preempted at
         // runtime. Just ignore.
         if ((rel.offset + 8 > sec.content().size() ||
              read32(loc + 4) != 0x60000000) &&
             rel.sym->file != sec.file) {
           // Use substr(6) to remove the "__plt_" prefix.

lld/ELF/Driver.cpp

if (config->fixCortexA8 && config->emachine != EM_ARM)
     error("--fix-cortex-a8 is only supported on ARM targets");
 
   if (config->armBe8 && config->emachine != EM_ARM)
     error("--be8 is only supported on ARM targets");
 
   if (config->fixCortexA8 && !config->isLE)
     error("--fix-cortex-a8 is not supported on big endian targets");
 
   if (config->tocOptimize && config->emachine != EM_PPC64)
     error("--toc-optimize is only supported on PowerPC64 targets");
 
   if (config->pcRelOptimize && config->emachine != EM_PPC64)
     error("--pcrel-optimize is only supported on PowerPC64 targets");
 
   if (config->relaxGP && config->emachine != EM_RISCV)
     error("--relax-gp is only supported on RISC-V targets");
 
if (config->androidMemtagStack)
       warn("--android-memtag-mode is unspecified, leaving "
            "--android-memtag-stack a no-op");
     else if (config->androidMemtagHeap)
       warn("--android-memtag-mode is unspecified, leaving "
            "--android-memtag-heap a no-op");
     return ELF::NT_MEMTAG_LEVEL_NONE;
   }
 
-  if (!config->androidMemtagHeap && !config->androidMemtagStack) {
-    error("when using --android-memtag-mode, at least one of "
-          "--android-memtag-heap or "
-          "--android-memtag-stack is required");
-    return ELF::NT_MEMTAG_LEVEL_NONE;
-  }
-
   if (memtagModeArg == "sync")
     return ELF::NT_MEMTAG_LEVEL_SYNC;
   if (memtagModeArg == "async")
     return ELF::NT_MEMTAG_LEVEL_ASYNC;
   if (memtagModeArg == "none")
     return ELF::NT_MEMTAG_LEVEL_NONE;
 
   error("unknown --android-memtag-mode value: \"" + memtagModeArg +

 
 // Do actual linking. Note that when this function is called,
 // all linker scripts have already been parsed.
 void LinkerDriver::link(opt::InputArgList &args) {
   llvm::TimeTraceScope timeScope("Link", StringRef("LinkerDriver::Link"));
   // If a --hash-style option was not given, set to a default value,
   // which varies depending on the target.
   if (!args.hasArg(OPT_hash_style)) {
     if (config->emachine == EM_MIPS)
       config->sysvHash = true;
     else
       config->sysvHash = config->gnuHash = true;
   }
 
   // Default output filename is "a.out" by the Unix tradition.
   if (config->outputFile.empty())
     config->outputFile = "a.out";
 
   // Fail early if the output file or map file is not writable. If a user has a
   // long link, e.g. due to a large LTO link, they do not wish to run it and
   // find that it failed because there was a mistake in their command-line.
   {
     llvm::TimeTraceScope timeScope("Create output files");
     if (auto e = tryCreateFile(config->outputFile))
       error("cannot open output file " + config->outputFile + ": " +
             e.message());
     if (auto e = tryCreateFile(config->mapFile))
       error("cannot open map file " + config->mapFile + ": " + e.message());
     if (auto e = tryCreateFile(config->whyExtract))
       error("cannot open --why-extract= file " + config->whyExtract + ": " +
             e.message());
   }
   if (errorCount())
void LinkerDriver::link(opt::InputArgList &args) {
   // Garbage collection and removal of shared symbols from unused shared objects.
   invokeELFT(markLive,);
   demoteSharedAndLazySymbols();
 
   // Make copies of any input sections that need to be copied into each
   // partition.
   copySectionsIntoPartitions();
 
+  if (config->emachine == EM_AARCH64 &&
+      config->androidMemtagMode != ELF::NT_MEMTAG_LEVEL_NONE) {
+    llvm::TimeTraceScope timeScope("Process memory tagged symbols");
+    createTaggedSymbols(ctx.objectFiles);
+  }
+
   // Create synthesized sections such as .got and .plt. This is called before
   // processSectionCommands() so that they can be placed by SECTIONS commands.
   invokeELFT(createSyntheticSections,);
 
   // Some input sections that are used for exception handling need to be moved
   // into synthetic sections. Do that now so that they aren't assigned to
   // output sections in the usual way.
   if (!config->relocatable)
     combineEhSections();
 
   // Merge .riscv.attributes sections.
   if (config->emachine == EM_RISCV)
     mergeRISCVAttributesSections();
 
   {
     llvm::TimeTraceScope timeScope("Assign sections");
 
     // Create output sections described by SECTIONS commands.
     script->processSectionCommands();
 
     // Linker scripts control how input sections are assigned to output
     // sections. Input sections that were not handled by scripts are called
     // "orphans", and they are assigned to output sections by the default rule.
     // Process that.
     script->addOrphanSections();
   }
 
   {
     llvm::TimeTraceScope timeScope("Merge/finalize input sections");
 
     // Migrate InputSectionDescription::sectionBases to sections. This includes
     // merging MergeInputSections into a single MergeSyntheticSection. From this
     // point onwards InputSectionDescription::sections should be used instead of
     // sectionBases.
     for (SectionCommand *cmd : script->sectionCommands)
       if (auto *osd = dyn_cast<OutputDesc>(cmd))
         osd->osec.finalizeInputSections();
   }
 
   // Two input sections with different output sections should not be folded.
   // ICF runs after processSectionCommands() so that we know the output sections.
   if (config->icf != ICFLevel::None) {
     invokeELFT(findKeepUniqueSections, args);
     invokeELFT(doIcf,);
   }
 
   // Read the callgraph now that we know what was gced or icfed
   if (config->callGraphProfileSort) {

lld/ELF/Relocations.h

ArrayRef<RelTy> sortRels(ArrayRef<RelTy> rels, SmallVector<RelTy, 0> &storage) {
   };
   if (!llvm::is_sorted(rels, cmp)) {
     storage.assign(rels.begin(), rels.end());
     llvm::stable_sort(storage, cmp);
     rels = storage;
   }
   return rels;
 }
+
+// Returns true if Expr refers a GOT entry. Note that this function returns
+// false for TLS variables even though they need GOT, because TLS variables uses
+// GOT differently than the regular variables.
+bool needsGot(RelExpr expr);
 } // namespace lld::elf
 
 #endif

lld/ELF/Relocations.cpp

 #include "SymbolTable.h"
 #include "Symbols.h"
 #include "SyntheticSections.h"
 #include "Target.h"
 #include "Thunks.h"
 #include "lld/Common/ErrorHandler.h"
 #include "lld/Common/Memory.h"
 #include "llvm/ADT/SmallSet.h"
+#include "llvm/BinaryFormat/ELF.h"
 #include "llvm/Demangle/Demangle.h"
 #include "llvm/Support/Endian.h"
 #include <algorithm>
 
 using namespace llvm;
 using namespace llvm::ELF;
 using namespace llvm::object;
 using namespace llvm::support::endian;

 }
 
 // Returns true if Expr refers a PLT entry.
 static bool needsPlt(RelExpr expr) {
   return oneof<R_PLT, R_PLT_PC, R_PLT_GOTPLT, R_LOONGARCH_PLT_PAGE_PC,
                R_PPC32_PLTREL, R_PPC64_CALL_PLT>(expr);
 }
 
-// Returns true if Expr refers a GOT entry. Note that this function
-// returns false for TLS variables even though they need GOT, because
-// TLS variables uses GOT differently than the regular variables.
-static bool needsGot(RelExpr expr) {
+bool lld::elf::needsGot(RelExpr expr) {
   return oneof<R_GOT, R_GOT_OFF, R_MIPS_GOT_LOCAL_PAGE, R_MIPS_GOT_OFF,
                R_MIPS_GOT_OFF32, R_AARCH64_GOT_PAGE_PC, R_GOT_PC, R_GOTPLT,
                R_AARCH64_GOT_PAGE, R_LOONGARCH_GOT, R_LOONGARCH_GOT_PAGE_PC>(
       expr);
 }
 
 // True if this expression is of the form Sym - X, where X is a position in the
 // file (PC, or GOT for example).

 }
 
 template <bool shard = false>
 static void addRelativeReloc(InputSectionBase &isec, uint64_t offsetInSec,
                              Symbol &sym, int64_t addend, RelExpr expr,
                              RelType type) {
   Partition &part = isec.getPartition();
 
+  if (sym.isTagged()) {
+    std::lock_guard<std::mutex> lock(relocMutex);
+    part.relaDyn->addRelativeReloc(target->relativeRel, isec, offsetInSec, sym,
+                                   addend, type, expr);
+    // With MTE globals, we always want to derive the address tag by `ldg`-ing
+    // the symbol. When we have a RELATIVE relocation though, we no longer have
+    // a reference to the symbol. Because of this, when we have an addend that
+    // puts the result of the RELATIVE relocation out-of-bounds of the symbol
+    // (e.g. the addend is outside of [0, sym.getSize()]), the AArch64 MemtagABI
+    // says we should store the offset to the start of the symbol in the target
+    // field. This is described in further detail in:
+    // https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#841extended-semantics-of-r_aarch64_relative
+    if (addend < 0 || static_cast<uint64_t>(addend) >= sym.getSize())
+      isec.relocations.push_back({expr, type, offsetInSec, addend, &sym});
+    return;
+  }
+
   // Add a relative relocation. If relrDyn section is enabled, and the
   // relocation offset is guaranteed to be even, add the relocation to
   // the relrDyn section, otherwise add it to the relaDyn section.
   // relrDyn sections don't support odd offsets. Also, relrDyn sections
   // don't store the addend values, so we must write it to the relocated
   // address.
   if (part.relrDyn && isec.addralign >= 2 && offsetInSec % 2 == 0) {
     isec.addReloc({expr, type, offsetInSec, addend, &sym});
static bool handleNonPreemptibleIfunc(Symbol &sym, uint16_t flags) {
   return true;
 }
 
 void elf::postScanRelocations() {
   auto fn = [](Symbol &sym) {
     auto flags = sym.flags.load(std::memory_order_relaxed);
     if (handleNonPreemptibleIfunc(sym, flags))
       return;
+
+    if (sym.isTagged() && sym.isDefined())
+      mainPart->memtagDescriptors->addSymbol(sym);
+
     if (!sym.needsDynReloc())
       return;
     sym.allocateAux();
 
     if (flags & NEEDS_GOT)
       addGotEntry(sym);
     if (flags & NEEDS_PLT)
       addPltEntry(*in.plt, *in.gotPlt, *in.relaPlt, target->pltRel, sym);

lld/ELF/Symbols.h

 
 private:
   bool shouldReplace(const Defined &other) const;
 
 protected:
   Symbol(Kind k, InputFile *file, StringRef name, uint8_t binding,
          uint8_t stOther, uint8_t type)
       : file(file), nameData(name.data()), nameSize(name.size()), type(type),
-        binding(binding), stOther(stOther), symbolKind(k),
-        exportDynamic(false) {}
+        binding(binding), stOther(stOther), symbolKind(k), exportDynamic(false),
+        archSpecificBit(false) {}
 
   void overwrite(Symbol &sym, Kind k) const {
     if (sym.traced)
       printTraceSymbol(*this, sym.getName());
     sym.file = file;
     sym.type = type;
     sym.binding = binding;
     sym.stOther = (stOther & ~3) | sym.visibility();
     sym.symbolKind = k;
   }
 
 public:
   // True if this symbol is in the Iplt sub-section of the Plt and the Igot
   // sub-section of the .got.plt or .got.
   uint8_t isInIplt : 1;
 
   // True if this symbol needs a GOT entry and its GOT entry is actually in
   // Igot. This will be true only for certain non-preemptible ifuncs.
   uint8_t gotInIgot : 1;
 
   // True if defined relative to a section discarded by ICF.
   uint8_t folded : 1;
 
-  // True if a call to this symbol needs to be followed by a restore of the
-  // PPC64 toc pointer.
-  uint8_t needsTocRestore : 1;
+  // Allow reuse of a bit between architecture-exclusive symbol flags.
+  // - needsTocRestore(): On PPC64, true if a call to this symbol needs to be
+  //   followed by a restore of the toc pointer.
+  // - isTagged(): On AArch64, true if the symbol needs special relocation and
+  //   metadata semantics because it's tagged, under the AArch64 MemtagABI.
+  uint8_t archSpecificBit : 1;
+  bool needsTocRestore() const { return archSpecificBit; }
+  bool isTagged() const { return archSpecificBit; }
+  void setNeedsTocRestore(bool v) { archSpecificBit = v; }
+  void setIsTagged(bool v) {
+    archSpecificBit = v;
+  }
 
   // True if this symbol is defined by a symbol assignment or wrapped by --wrap.
   //
   // LTO shouldn't inline the symbol because it doesn't know the final content
   // of the symbol.
   uint8_t scriptDefined : 1;
 
   // True if defined in a DSO as protected visibility.

lld/ELF/SyntheticSections.h

 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLD_ELF_SYNTHETIC_SECTIONS_H
 #define LLD_ELF_SYNTHETIC_SECTIONS_H
 
 #include "Config.h"
 #include "InputSection.h"
+#include "Symbols.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/ADT/MapVector.h"
+#include "llvm/BinaryFormat/ELF.h"
 #include "llvm/MC/StringTableBuilder.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/Endian.h"
 #include "llvm/Support/Parallel.h"
 #include "llvm/Support/Threading.h"
 
 namespace lld::elf {
 class Defined;
public:
   void addReloc(DynamicReloc::Kind kind, RelType dynType, InputSectionBase &sec,
                 uint64_t offsetInSec, Symbol &sym, int64_t addend, RelExpr expr,
                 RelType addendRelType) {
     // Write the addends to the relocated address if required. We skip
     // it if the written value would be zero.
     if (config->writeAddends && (expr != R_ADDEND || addend != 0))
       sec.addReloc({expr, addendRelType, offsetInSec, addend, &sym});
     addReloc<shard>({dynType, &sec, offsetInSec, kind, sym, addend, expr});
   }
   bool isNeeded() const override {
     return !relocs.empty() ||
            llvm::any_of(relocsVec, [](auto &v) { return !v.empty(); });
   }
   size_t getSize() const override { return relocs.size() * this->entsize; }
   size_t getRelativeRelocCount() const { return numRelativeRelocs; }
   void mergeRels();
   void partitionRels();

 public:
   PackageMetadataNote()
       : SyntheticSection(llvm::ELF::SHF_ALLOC, llvm::ELF::SHT_NOTE,
                          /*alignment=*/4, ".note.package") {}
   void writeTo(uint8_t *buf) override;
   size_t getSize() const override;
 };
 
+class MemtagDescriptors final : public SyntheticSection {
+public:
+  MemtagDescriptors()
+      : SyntheticSection(llvm::ELF::SHF_ALLOC,
+                         llvm::ELF::SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC,
+                         /*alignment=*/4, ".memtag.globals.dynamic") {}
+  void writeTo(uint8_t *buf) override;
+  // The size of the section is non-computable until all addresses are
+  // synthetized, because the section's contents contain a sorted
+  // varint-compressed list of pointers to global variables. We only know the
+  // final size after `finalizeAddressDependentContent()`.
+  size_t getSize() const override;
+  bool updateAllocSize() override;
+
+  void addSymbol(const Symbol &sym) {
+    symbols.push_back(&sym);
+  }
+
+  bool isNeeded() const override {
+    return !symbols.empty();
+  }
+
+private:
+  SmallVector<const Symbol *, 0> symbols;
+};
+
 InputSection *createInterpSection();
 MergeInputSection *createCommentSection();
 template <class ELFT> void splitSections();
 void combineEhSections();
 
 template <typename ELFT> void writeEhdr(uint8_t *buf, Partition &part);
 template <typename ELFT> void writePhdrs(uint8_t *buf, Partition &part);
 
struct Partition {
   std::unique_ptr<SyntheticSection> dynamic;
   std::unique_ptr<StringTableSection> dynStrTab;
   std::unique_ptr<SymbolTableBaseSection> dynSymTab;
   std::unique_ptr<EhFrameHeader> ehFrameHdr;
   std::unique_ptr<EhFrameSection> ehFrame;
   std::unique_ptr<GnuHashTableSection> gnuHashTab;
   std::unique_ptr<HashTableSection> hashTab;
   std::unique_ptr<MemtagAndroidNote> memtagAndroidNote;
+  std::unique_ptr<MemtagDescriptors> memtagDescriptors;
   std::unique_ptr<PackageMetadataNote> packageMetadataNote;
   std::unique_ptr<RelocationBaseSection> relaDyn;
   std::unique_ptr<RelrBaseSection> relrDyn;
   std::unique_ptr<VersionDefinitionSection> verDef;
   std::unique_ptr<SyntheticSection> verNeed;
   std::unique_ptr<VersionTableSection> verSym;
 
   unsigned getNumber() const { return this - &partitions[0] + 1; }
 };
 

lld/ELF/SyntheticSections.cpp

if (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI)
       addInt(DT_AARCH64_BTI_PLT, 0);
     if (config->zPacPlt)
       addInt(DT_AARCH64_PAC_PLT, 0);
 
     if (config->androidMemtagMode != ELF::NT_MEMTAG_LEVEL_NONE) {
       addInt(DT_AARCH64_MEMTAG_MODE, config->androidMemtagMode == NT_MEMTAG_LEVEL_ASYNC);
       addInt(DT_AARCH64_MEMTAG_HEAP, config->androidMemtagHeap);
       addInt(DT_AARCH64_MEMTAG_STACK, config->androidMemtagStack);
+      if (mainPart->memtagDescriptors->isNeeded()) {
+        addInSec(DT_AARCH64_MEMTAG_GLOBALS, *mainPart->memtagDescriptors);
+        addInt(DT_AARCH64_MEMTAG_GLOBALSSZ, mainPart->memtagDescriptors->getSize());
+      }
     }
   }
 
   addInSec(DT_SYMTAB, *part.dynSymTab);
   addInt(DT_SYMENT, sizeof(Elf_Sym));
   addInSec(DT_STRTAB, *part.dynStrTab);
   addInt(DT_STRSZ, part.dynStrTab->getSize());
   if (!config->zText)
memcpy(buf + 16, config->packageMetadata.data(),
          config->packageMetadata.size());
 }
 
 size_t PackageMetadataNote::getSize() const {
   return sizeof(llvm::ELF::Elf64_Nhdr) + 4 +
          alignTo(config->packageMetadata.size() + 1, 4);
 }
 
+// Helper function, return the size of the ULEB128 for 'v', optionally writing
+// it to `*(buf + offset)` if `buf` is non-null.
+static size_t computeOrWriteULEB128(uint64_t v, uint8_t *buf, size_t offset) {
+  if (buf)
+    return encodeULEB128(v, buf + offset);
+  return getULEB128Size(v);
+}
+
+// https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#83encoding-of-sht_aarch64_memtag_globals_dynamic
+constexpr uint64_t kMemtagStepSizeBits = 3;
+constexpr uint64_t kMemtagGranuleSize = 16;
+static size_t createMemtagDescriptors(const SmallVector<const Symbol *, 0> &symbols,
+                                      uint8_t *buf = nullptr) {
+  size_t sectionSize = 0;
+  uint64_t lastGlobalEnd = 0;
+
+  for (const Symbol *sym : symbols) {
+    if (!includeInSymtab(*sym))
+      continue;
+    const uint64_t addr = sym->getVA();
+    const uint64_t size = sym->getSize();
+
+    if (addr <= kMemtagGranuleSize && buf != nullptr)
+      errorOrWarn("address of the tagged symbol \"" + sym->getName() +
+                  "\" falls in the ELF header. This is indicative of a "
+                  "compiler/linker bug");
+    if (addr % kMemtagGranuleSize != 0)
+      errorOrWarn("address of the tagged symbol \"" + sym->getName() +
+                  "\" at 0x" + Twine::utohexstr(addr) +
+                  "\" is not granule (16-byte) aligned");
+    if (size == 0)
+      errorOrWarn("size of the tagged symbol \"" + sym->getName() +
+                  "\" is not allowed to be zero");
+    if (size % kMemtagGranuleSize != 0)
+      errorOrWarn("size of the tagged symbol \"" + sym->getName() +
+                  "\" (size 0x" + Twine::utohexstr(size) +
+                  ") is not granule (16-byte) aligned");
+
+    const uint64_t sizeToEncode = size / kMemtagGranuleSize;
+    const uint64_t stepToEncode = ((addr - lastGlobalEnd) / kMemtagGranuleSize)
+                                  << kMemtagStepSizeBits;
+    if (sizeToEncode < (1 << kMemtagStepSizeBits)) {
+      sectionSize += computeOrWriteULEB128(stepToEncode | sizeToEncode, buf, sectionSize);
+    } else {
+      sectionSize += computeOrWriteULEB128(stepToEncode, buf, sectionSize);
+      sectionSize += computeOrWriteULEB128(sizeToEncode - 1, buf, sectionSize);
+    }
+    lastGlobalEnd = addr + size;
+  }
+
+  return sectionSize;
+}
+
+bool MemtagDescriptors::updateAllocSize() {
+  size_t oldSize = getSize();
+  std::stable_sort(symbols.begin(), symbols.end(),
+                   [](const Symbol *s1, const Symbol *s2) {
+                     return s1->getVA() < s2->getVA();
+                   });
+  return oldSize != getSize();
+}
+
+void MemtagDescriptors::writeTo(uint8_t *buf) {
+  createMemtagDescriptors(symbols, buf);
+}
+
+size_t MemtagDescriptors::getSize() const {
+  return createMemtagDescriptors(symbols);
+}
+
 InStruct elf::in;
 
 std::vector<Partition> elf::partitions;
 Partition *elf::mainPart;
 
 template GdbIndexSection *GdbIndexSection::create<ELF32LE>();
 template GdbIndexSection *GdbIndexSection::create<ELF32BE>();
 template GdbIndexSection *GdbIndexSection::create<ELF64LE>();
 template GdbIndexSection *GdbIndexSection::create<ELF64BE>();
 

lld/ELF/Target.h

 //===- Target.h -------------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLD_ELF_TARGET_H
 #define LLD_ELF_TARGET_H
 
 #include "Config.h"
 #include "InputSection.h"
 #include "lld/Common/ErrorHandler.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/Object/ELF.h"
+#include "llvm/Object/ELFTypes.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/MathExtras.h"
 #include <array>
 
 namespace lld {
 std::string toString(elf::RelType type);
 
 namespace elf {

 template <typename ELFT> void writeARMCmseImportLib();
 uint64_t getLoongArchPageDelta(uint64_t dest, uint64_t pc);
 void riscvFinalizeRelax(int passes);
 void mergeRISCVAttributesSections();
 void addArmInputSectionMappingSymbols();
 void addArmSyntheticSectionMappingSymbol(Defined *);
 void sortArmMappingSymbols();
 void convertArmInstructionstoBE8(InputSection *sec, uint8_t *buf);
+void createTaggedSymbols(const SmallVector<ELFFileBase *, 0> &files);
 
 LLVM_LIBRARY_VISIBILITY extern const TargetInfo *target;
 TargetInfo *getTarget();
 
 template <class ELFT> bool isMipsPIC(const Defined *sym);
 
 void reportRangeError(uint8_t *loc, const Relocation &rel, const Twine &v,
                       int64_t min, uint64_t max);

 } // namespace elf
 } // namespace lld
 
 #ifdef __clang__
 #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments"
 #endif
 #define invokeELFT(f, ...)                                                     \
   switch (config->ekind) {                                                     \
-  case ELF32LEKind:                                                            \
-    f<ELF32LE>(__VA_ARGS__);                                                   \
+  case lld::elf::ELF32LEKind:                                                  \
+    f<llvm::object::ELF32LE>(__VA_ARGS__);                                     \
     break;                                                                     \
-  case ELF32BEKind:                                                            \
-    f<ELF32BE>(__VA_ARGS__);                                                   \
+  case lld::elf::ELF32BEKind:                                                  \
+    f<llvm::object::ELF32BE>(__VA_ARGS__);                                     \
     break;                                                                     \
-  case ELF64LEKind:                                                            \
-    f<ELF64LE>(__VA_ARGS__);                                                   \
+  case lld::elf::ELF64LEKind:                                                  \
+    f<llvm::object::ELF64LE>(__VA_ARGS__);                                     \
     break;                                                                     \
-  case ELF64BEKind:                                                            \
-    f<ELF64BE>(__VA_ARGS__);                                                   \
+  case lld::elf::ELF64BEKind:                                                  \
+    f<llvm::object::ELF64BE>(__VA_ARGS__);                                     \
     break;                                                                     \
   default:                                                                     \
     llvm_unreachable("unknown config->ekind");                                 \
   }
 
 #endif

lld/ELF/Thunks.cpp

void PPC64PltCallStub::writeTo(uint8_t *buf) {
   // Save the TOC pointer to the save-slot reserved in the call frame.
   write32(buf + 0, 0xf8410018); // std     r2,24(r1)
   writePPC64LoadAndBranch(buf + 4, offset);
 }
 
 void PPC64PltCallStub::addSymbols(ThunkSection &isec) {
   Defined *s = addSymbol(saver().save("__plt_" + destination.getName()),
                          STT_FUNC, 0, isec);
-  s->needsTocRestore = true;
+  s->setNeedsTocRestore(true);
   s->file = destination.file;
 }
 
 bool PPC64PltCallStub::isCompatibleWith(const InputSection &isec,
                                         const Relocation &rel) const {
   return rel.type == R_PPC64_REL24 || rel.type == R_PPC64_REL14;
 }
 
const int64_t offsetFromTOC =
         getPPC64TocBase();
     writePPC64LoadAndBranch(buf + 4, offsetFromTOC);
   }
 }
 
 void PPC64R2SaveStub::addSymbols(ThunkSection &isec) {
   Defined *s = addSymbol(saver().save("__toc_save_" + destination.getName()),
                          STT_FUNC, 0, isec);
-  s->needsTocRestore = true;
+  s->setNeedsTocRestore(true);
 }
 
 bool PPC64R2SaveStub::isCompatibleWith(const InputSection &isec,
                                        const Relocation &rel) const {
   return rel.type == R_PPC64_REL24 || rel.type == R_PPC64_REL14;
 }
 
 void PPC64R12SetupStub::writeTo(uint8_t *buf) {

lld/ELF/Writer.h

struct PhdrEntry {
   OutputSection *firstSec = nullptr;
   OutputSection *lastSec = nullptr;
   bool hasLMA = false;
 
   uint64_t lmaOffset = 0;
 };
 
 void addReservedSymbols();
+bool includeInSymtab(const Symbol &b);
 
 template <class ELFT> uint32_t calcMipsEFlags();
 
 uint8_t getMipsFpAbiFlag(uint8_t oldFlag, uint8_t newFlag,
                          llvm::StringRef fileName);
 
 bool isMipsN32Abi(const InputFile *f);
 bool isMicroMips();
 bool isMipsR6();
 } // namespace lld::elf
 
 #endif

lld/ELF/Writer.cpp

for (Partition &part : partitions) {
 
     part.dynStrTab = std::make_unique<StringTableSection>(".dynstr", true);
     part.dynSymTab =
         std::make_unique<SymbolTableSection<ELFT>>(*part.dynStrTab);
     part.dynamic = std::make_unique<DynamicSection<ELFT>>();
 
     if (config->emachine == EM_AARCH64 &&
         config->androidMemtagMode != ELF::NT_MEMTAG_LEVEL_NONE) {
+      if (!config->relocatable && !config->shared && !needsInterpSection())
+        error("--android-memtag-mode is incompatible with fully-static "
+              "executables (-static)");
       part.memtagAndroidNote = std::make_unique<MemtagAndroidNote>();
       add(*part.memtagAndroidNote);
+      part.memtagDescriptors = std::make_unique<MemtagDescriptors>();
+      add(*part.memtagDescriptors);
     }
 
     if (config->androidPackDynRelocs)
       part.relaDyn = std::make_unique<AndroidPackedRelocationSection<ELFT>>(
           relaDynName, threadCount);
     else
       part.relaDyn = std::make_unique<RelocationSection<ELFT>>(
           relaDynName, config->zCombreloc, threadCount);
static bool shouldKeepInSymtab(const Defined &sym) {
   //   the assembler keeping the .L symbol.
   if (sym.getName().starts_with(".L") &&
       (config->discard == DiscardPolicy::Locals ||
        (sym.section && (sym.section->flags & SHF_MERGE))))
     return false;
   return true;
 }
 
-static bool includeInSymtab(const Symbol &b) {
+bool lld::elf::includeInSymtab(const Symbol &b) {
   if (auto *d = dyn_cast<Defined>(&b)) {
     // Always include absolute symbols.
     SectionBase *sec = d->section;
     if (!sec)
       return true;
 
     if (auto *s = dyn_cast<MergeInputSection>(sec))
       return s->getSectionPiece(d->value).live;
for (;;) {
 
     if (in.mipsGot)
       in.mipsGot->updateAllocSize();
 
     for (Partition &part : partitions) {
       changed |= part.relaDyn->updateAllocSize();
       if (part.relrDyn)
         changed |= part.relrDyn->updateAllocSize();
+      if (part.memtagDescriptors)
+        changed |= part.memtagDescriptors->updateAllocSize();
     }
 
     const Defined *changedSym = script->assignAddresses();
     if (!changed) {
       // Some symbols may be dependent on section addresses. When we break the
       // loop, the symbol values are finalized because a previous
       // assignAddresses() finalized section addresses.
       if (!changedSym)

lld/test/ELF/Inputs/aarch64-memtag-globals.s

+#--- input_1.s
+## Generated with:
+##
+##  - clang <input_file.c> -fsanitize=memtag-globals -O2 -S -fPIC -o - \
+##          --target=aarch64-linux-android31 -fno-asynchronous-unwind-tables
+##
+## <input_file.c> contents:
+##
+##    /// Global variables defined here, of various semantics.
+##    char global[30] = {};
+##    __attribute__((no_sanitize("memtag"))) int global_untagged = 0;
+##    const int const_global = 0;
+##    static const int hidden_const_global = 0;
+##    static char hidden_global[12] = {};
+##    __attribute__((visibility("hidden"))) int hidden_attr_global = 0;
+##    __attribute__((visibility("hidden"))) const int hidden_attr_const_global = 0;
+##
+##    /// Should be untagged.
+##    __thread int tls_global;
+##    __thread static int hidden_tls_global;
+##
+##    /// Tagged, from the other file.
+##    extern int global_extern;
+##    /// Untagged, from the other file.
+##    extern __attribute__((no_sanitize("memtag"))) int global_extern_untagged;
+##    /// Tagged, but from a different DSO (i.e. not this or the sister objfile).
+##    extern int global_extern_outside_this_dso;
+##    /// Tagged here (because it's non-const), but untagged in the definition found
+##    /// in the sister objfile as it's marked as const there.
+##    extern int global_extern_const_definition_but_nonconst_import;
+##    /// Tagged here, but untagged in the definition found in the sister objfile
+##    /// (explicitly).
+##    extern int global_extern_untagged_definition_but_tagged_import;
+##
+##    /// ABS64 relocations. Also, forces symtab entries for local and external
+##    /// globals.
+##    char *pointer_to_global = &global[0];
+##    char *pointer_inside_global = &global[17];
+##    char *pointer_to_global_end = &global[30];
+##    char *pointer_past_global_end = &global[48];
+##    int *pointer_to_global_untagged = &global_untagged;
+##    const int *pointer_to_const_global = &const_global;
+##    /// RELATIVE relocations.
+##    const int *pointer_to_hidden_const_global = &hidden_const_global;
+##    char *pointer_to_hidden_global = &hidden_global[0];
+##    const int *pointer_to_hidden_attr_global = &hidden_attr_global;
+##    const int *pointer_to_hidden_attr_const_global = &hidden_attr_const_global;
+##    /// RELATIVE relocations with special AArch64 MemtagABI semantics, with the
+##    /// offset ('12' or '16') encoded in the place.
+##    char *pointer_to_hidden_global_end = &hidden_global[12];
+##    char *pointer_past_hidden_global_end = &hidden_global[16];
+##    /// ABS64 relocations.
+##    int *pointer_to_global_extern = &global_extern;
+##    int *pointer_to_global_extern_untagged = &global_extern_untagged;
+##    int *pointer_to_global_extern_outside_this_dso = &global_extern_outside_this_dso;
+##    int *pointer_to_global_extern_const_definition_but_nonconst_import =
+##        &global_extern_const_definition_but_nonconst_import;
+##    int *pointer_to_global_extern_untagged_definition_but_tagged_import =
+##        &global_extern_untagged_definition_but_tagged_import;
+##
+##    int *get_address_to_tls_global() { return &tls_global; }
+##    int *get_address_to_hidden_tls_global() { return &hidden_tls_global; }
+
+  .text
+  .file "a.c"
+  .globl  get_address_to_tls_global       // -- Begin function get_address_to_tls_global
+  .p2align  2
+  .type get_address_to_tls_global,@function
+get_address_to_tls_global:              // @get_address_to_tls_global
+// %bb.0:                               // %entry
+  stp  x29, x30, [sp, #-16]!           // 16-byte Folded Spill
+  mov x29, sp
+  adrp  x0, :tlsdesc:tls_global
+  ldr  x1, [x0, :tlsdesc_lo12:tls_global]
+  add x0, x0, :tlsdesc_lo12:tls_global
+  .tlsdesccall tls_global
+  blr x1
+  mrs x8, TPIDR_EL0
+  add x0, x8, x0
+  ldp  x29, x30, [sp], #16             // 16-byte Folded Reload
+  ret
+.Lfunc_end0:
+  .size get_address_to_tls_global, .Lfunc_end0-get_address_to_tls_global
+                                        // -- End function
+  .globl  get_address_to_hidden_tls_global // -- Begin function get_address_to_hidden_tls_global
+  .p2align  2
+  .type get_address_to_hidden_tls_global,@function
+get_address_to_hidden_tls_global:       // @get_address_to_hidden_tls_global
+// %bb.0:                               // %entry
+  stp  x29, x30, [sp, #-16]!           // 16-byte Folded Spill
+  mov x29, sp
+  adrp  x0, :tlsdesc:hidden_tls_global
+  ldr  x1, [x0, :tlsdesc_lo12:hidden_tls_global]
+  add x0, x0, :tlsdesc_lo12:hidden_tls_global
+  .tlsdesccall hidden_tls_global
+  blr x1
+  mrs x8, TPIDR_EL0
+  add x0, x8, x0
+  ldp  x29, x30, [sp], #16             // 16-byte Folded Reload
+  ret
+.Lfunc_end1:
+  .size get_address_to_hidden_tls_global, .Lfunc_end1-get_address_to_hidden_tls_global
+                                        // -- End function
+  .memtag global                          // @global
+  .type global,@object
+  .bss
+  .globl  global
+  .p2align  4, 0x0
+global:
+  .zero 32
+  .size global, 32
+
+  .type global_untagged,@object         // @global_untagged
+  .globl  global_untagged
+  .p2align  2, 0x0
+global_untagged:
+  .word 0                               // 0x0
+  .size global_untagged, 4
+
+  .type const_global,@object            // @const_global
+  .section  .rodata,"a",@progbits
+  .globl  const_global
+  .p2align  2, 0x0
+const_global:
+  .word 0                               // 0x0
+  .size const_global, 4
+
+  .hidden hidden_attr_global              // @hidden_attr_global
+  .memtag hidden_attr_global
+  .type hidden_attr_global,@object
+  .bss
+  .globl  hidden_attr_global
+  .p2align  4, 0x0
+hidden_attr_global:
+  .zero 16
+  .size hidden_attr_global, 16
+
+  .hidden hidden_attr_const_global        // @hidden_attr_const_global
+  .type hidden_attr_const_global,@object
+  .section  .rodata,"a",@progbits
+  .globl  hidden_attr_const_global
+  .p2align  2, 0x0
+hidden_attr_const_global:
+  .word 0                               // 0x0
+  .size hidden_attr_const_global, 4
+
+  .memtag pointer_to_global               // @pointer_to_global
+  .type pointer_to_global,@object
+  .data
+  .globl  pointer_to_global
+  .p2align  4, 0x0
+pointer_to_global:
+  .xword  global
+  .zero 8
+  .size pointer_to_global, 16
+
+  .memtag pointer_inside_global           // @pointer_inside_global
+  .type pointer_inside_global,@object
+  .globl  pointer_inside_global
+  .p2align  4, 0x0
+pointer_inside_global:
+  .xword  global+17
+  .zero 8
+  .size pointer_inside_global, 16
+
+  .memtag pointer_to_global_end           // @pointer_to_global_end
+  .type pointer_to_global_end,@object
+  .globl  pointer_to_global_end
+  .p2align  4, 0x0
+pointer_to_global_end:
+  .xword  global+30
+  .zero 8
+  .size pointer_to_global_end, 16
+
+  .memtag pointer_past_global_end         // @pointer_past_global_end
+  .type pointer_past_global_end,@object
+  .globl  pointer_past_global_end
+  .p2align  4, 0x0
+pointer_past_global_end:
+  .xword  global+48
+  .zero 8
+  .size pointer_past_global_end, 16
+
+  .memtag pointer_to_global_untagged      // @pointer_to_global_untagged
+  .type pointer_to_global_untagged,@object
+  .globl  pointer_to_global_untagged
+  .p2align  4, 0x0
+pointer_to_global_untagged:
+  .xword  global_untagged
+  .zero 8
+  .size pointer_to_global_untagged, 16
+
+  .memtag pointer_to_const_global         // @pointer_to_const_global
+  .type pointer_to_const_global,@object
+  .globl  pointer_to_const_global
+  .p2align  4, 0x0
+pointer_to_const_global:
+  .xword  const_global
+  .zero 8
+  .size pointer_to_const_global, 16
+
+  .type hidden_const_global,@object     // @hidden_const_global
+  .section  .rodata,"a",@progbits
+  .p2align  2, 0x0
+hidden_const_global:
+  .word 0                               // 0x0
+  .size hidden_const_global, 4
+
+  .memtag pointer_to_hidden_const_global  // @pointer_to_hidden_const_global
+  .type pointer_to_hidden_const_global,@object
+  .data
+  .globl  pointer_to_hidden_const_global
+  .p2align  4, 0x0
+pointer_to_hidden_const_global:
+  .xword  hidden_const_global
+  .zero 8
+  .size pointer_to_hidden_const_global, 16
+
+  .memtag hidden_global                   // @hidden_global
+  .type hidden_global,@object
+  .local  hidden_global
+  .comm hidden_global,16,16
+  .memtag pointer_to_hidden_global        // @pointer_to_hidden_global
+  .type pointer_to_hidden_global,@object
+  .globl  pointer_to_hidden_global
+  .p2align  4, 0x0
+pointer_to_hidden_global:
+  .xword  hidden_global
+  .zero 8
+  .size pointer_to_hidden_global, 16
+
+  .memtag pointer_to_hidden_attr_global   // @pointer_to_hidden_attr_global
+  .type pointer_to_hidden_attr_global,@object
+  .globl  pointer_to_hidden_attr_global
+  .p2align  4, 0x0
+pointer_to_hidden_attr_global:
+  .xword  hidden_attr_global
+  .zero 8
+  .size pointer_to_hidden_attr_global, 16
+
+  .memtag pointer_to_hidden_attr_const_global // @pointer_to_hidden_attr_const_global
+  .type pointer_to_hidden_attr_const_global,@object
+  .globl  pointer_to_hidden_attr_const_global
+  .p2align  4, 0x0
+pointer_to_hidden_attr_const_global:
+  .xword  hidden_attr_const_global
+  .zero 8
+  .size pointer_to_hidden_attr_const_global, 16
+
+  .memtag pointer_to_hidden_global_end    // @pointer_to_hidden_global_end
+  .type pointer_to_hidden_global_end,@object
+  .globl  pointer_to_hidden_global_end
+  .p2align  4, 0x0
+pointer_to_hidden_global_end:
+  .xword  hidden_global+12
+  .zero 8
+  .size pointer_to_hidden_global_end, 16
+
+  .memtag pointer_past_hidden_global_end  // @pointer_past_hidden_global_end
+  .type pointer_past_hidden_global_end,@object
+  .globl  pointer_past_hidden_global_end
+  .p2align  4, 0x0
+pointer_past_hidden_global_end:
+  .xword  hidden_global+16
+  .zero 8
+  .size pointer_past_hidden_global_end, 16
+
+  .memtag global_extern
+  .memtag pointer_to_global_extern        // @pointer_to_global_extern
+  .type pointer_to_global_extern,@object
+  .globl  pointer_to_global_extern
+  .p2align  4, 0x0
+pointer_to_global_extern:
+  .xword  global_extern
+  .zero 8
+  .size pointer_to_global_extern, 16
+
+  .memtag pointer_to_global_extern_untagged // @pointer_to_global_extern_untagged
+  .type pointer_to_global_extern_untagged,@object
+  .globl  pointer_to_global_extern_untagged
+  .p2align  4, 0x0
+pointer_to_global_extern_untagged:
+  .xword  global_extern_untagged
+  .zero 8
+  .size pointer_to_global_extern_untagged, 16
+
+  .memtag global_extern_outside_this_dso
+  .memtag pointer_to_global_extern_outside_this_dso // @pointer_to_global_extern_outside_this_dso
+  .type pointer_to_global_extern_outside_this_dso,@object
+  .globl  pointer_to_global_extern_outside_this_dso
+  .p2align  4, 0x0
+pointer_to_global_extern_outside_this_dso:
+  .xword  global_extern_outside_this_dso
+  .zero 8
+  .size pointer_to_global_extern_outside_this_dso, 16
+
+  .memtag global_extern_const_definition_but_nonconst_import
+  .memtag pointer_to_global_extern_const_definition_but_nonconst_import // @pointer_to_global_extern_const_definition_but_nonconst_import
+  .type pointer_to_global_extern_const_definition_but_nonconst_import,@object
+  .globl  pointer_to_global_extern_const_definition_but_nonconst_import
+  .p2align  4, 0x0
+pointer_to_global_extern_const_definition_but_nonconst_import:
+  .xword  global_extern_const_definition_but_nonconst_import
+  .zero 8
+  .size pointer_to_global_extern_const_definition_but_nonconst_import, 16
+
+  .memtag global_extern_untagged_definition_but_tagged_import
+  .memtag pointer_to_global_extern_untagged_definition_but_tagged_import // @pointer_to_global_extern_untagged_definition_but_tagged_import
+  .type pointer_to_global_extern_untagged_definition_but_tagged_import,@object
+  .globl  pointer_to_global_extern_untagged_definition_but_tagged_import
+  .p2align  4, 0x0
+pointer_to_global_extern_untagged_definition_but_tagged_import:
+  .xword  global_extern_untagged_definition_but_tagged_import
+  .zero 8
+  .size pointer_to_global_extern_untagged_definition_but_tagged_import, 16
+
+  .type tls_global,@object              // @tls_global
+  .section  .tbss,"awT",@nobits
+  .globl  tls_global
+  .p2align  2, 0x0
+tls_global:
+  .word 0                               // 0x0
+  .size tls_global, 4
+
+  .type hidden_tls_global,@object       // @hidden_tls_global
+  .p2align  2, 0x0
+hidden_tls_global:
+  .word 0                               // 0x0
+  .size hidden_tls_global, 4
+
+  .ident  "clang version 17.0.0 (https://github.com/llvm/llvm-project.git 6130c9df99a7a7eb9c6adc118a48f8f2acc534ab)"
+  .section  ".note.GNU-stack","",@progbits
+
+#--- input_2.s
+## Generated with:
+##
+##  - clang <input_file.c> -fsanitize=memtag-globals -O2 -S -o - \
+##          --target=aarch64-linux-android31 -fno-asynchronous-unwind-tables
+##
+## <input_file.c> contents:
+##
+##     int global_extern;
+##     static int global_extern_hidden;
+##     __attribute__((no_sanitize("memtag"))) int global_extern_untagged;
+##     const int global_extern_const_definition_but_nonconst_import;
+##     __attribute__((no_sanitize(
+##         "memtag"))) int global_extern_untagged_definition_but_tagged_import;
+##
+
+  .text
+  .file "b.c"
+  .memtag global_extern
+  .type global_extern,@object
+  .bss
+  .globl  global_extern
+  .p2align  4, 0x0
+global_extern:
+  .zero 16
+  .size global_extern, 16
+
+  .type global_extern_untagged,@object
+  .globl  global_extern_untagged
+  .p2align  2, 0x0
+global_extern_untagged:
+  .word 0
+  .size global_extern_untagged, 4
+
+  .type global_extern_const_definition_but_nonconst_import,@object
+  .section  .rodata,"a",@progbits
+  .globl  global_extern_const_definition_but_nonconst_import
+  .p2align  2, 0x0
+global_extern_const_definition_but_nonconst_import:
+  .word 0
+  .size global_extern_const_definition_but_nonconst_import, 4
+
+  .type global_extern_untagged_definition_but_tagged_import,@object
+  .bss
+  .globl  global_extern_untagged_definition_but_tagged_import
+  .p2align  2, 0x0
+global_extern_untagged_definition_but_tagged_import:
+  .word 0
+  .size global_extern_untagged_definition_but_tagged_import, 4

lld/test/ELF/aarch64-memtag-android-abi.s

 # STACK-NEXT:   Stack: Enabled
 # NOSTACK-NEXT: Stack: Disabled
 
 # RUN: not ld.lld -shared --android-memtag-mode=asymm --android-memtag-heap 2>&1 | \
 # RUN:    FileCheck %s --check-prefix=BAD-MODE
 # BAD-MODE: error: unknown --android-memtag-mode value: "asymm", should be one of
 # BAD-MODE: {async, sync, none}
 
-# RUN: not ld.lld -shared --android-memtag-mode=async 2>&1 | \
-# RUN:    FileCheck %s --check-prefix=MISSING-STACK-OR-HEAP
-# MISSING-STACK-OR-HEAP: error: when using --android-memtag-mode, at least one of
-# MISSING-STACK-OR-HEAP: --android-memtag-heap or --android-memtag-stack is required
-
 .globl _start
 _start:
   ret

lld/test/ELF/aarch64-memtag-globals.s

+# REQUIRES: aarch64
+
+# RUN: rm -rf %t
+
+## Ensure MTE globals doesn't work with REL (only RELA).
+# RUN: yaml2obj %s -o %t.rel.o
+# RUN: not ld.lld -shared --android-memtag-mode=sync %t.rel.o 2>&1 | FileCheck %s --check-prefix=CHECK-RELA
+# CHECK-RELA: non-RELA relocations are not allowed with memtag globals
+--- !ELF
+FileHeader:
+  Class:           ELFCLASS64
+  Data:            ELFDATA2LSB
+  Type:            ET_REL
+  Machine:         EM_AARCH64
+  SectionHeaderStringTable: .strtab
+Sections:
+  - Name:            .text
+    Type:            SHT_PROGBITS
+    Flags:           [ SHF_ALLOC, SHF_EXECINSTR ]
+    AddressAlign:    0x4
+    Content:         '00'
+  - Name:            .data
+    Type:            SHT_PROGBITS
+    Flags:           [ SHF_WRITE, SHF_ALLOC ]
+    AddressAlign:    0x10
+    Content:         '00'
+  - Name:            .memtag.globals.static
+    Type:            SHT_AARCH64_MEMTAG_GLOBALS_STATIC
+    AddressAlign:    0x1
+  - Name:            .rel.memtag.globals.static
+    Type:            SHT_REL
+    Flags:           [ SHF_INFO_LINK ]
+    Link:            .symtab
+    AddressAlign:    0x8
+    Info:            .memtag.globals.static
+    Relocations:
+      - Symbol:          four
+        Type:            R_AARCH64_NONE
+  - Type:            SectionHeaderTable
+    Sections:
+      - Name:            .strtab
+      - Name:            .text
+      - Name:            .data
+      - Name:            .memtag.globals.static
+      - Name:            .rel.memtag.globals.static
+      - Name:            .symtab
+Symbols:
+  - Name:            four
+    Type:            STT_OBJECT
+    Section:         .data
+    Binding:         STB_GLOBAL
+    Value:           0x0
+    Size:            0x10
+
+## Functional testing for MTE globals.
+# RUN: split-file %S/Inputs/aarch64-memtag-globals.s %t
+# RUN: llvm-mc --filetype=obj -triple=aarch64-none-linux-android \
+# RUN:   %t/input_1.s -o %t1.o
+# RUN: llvm-mc --filetype=obj -triple=aarch64-none-linux-android \
+# RUN:   %t/input_2.s -o %t2.o
+# RUN: ld.lld -shared --android-memtag-mode=sync %t1.o %t2.o -o %t.so
+
+## Normally relocations are printed before the symbol tables, so reorder it a
+## bit to make it easier on matching addresses of relocations up with the
+## symbols.
+# RUN: llvm-readelf %t.so -s > %t.out
+# RUN: llvm-readelf %t.so --section-headers --relocs --memtag >> %t.out
+# RUN: FileCheck %s < %t.out
+# RUN: llvm-objdump -Dz %t.so | FileCheck %s --check-prefix=CHECK-SPECIAL-RELOCS
+
+## And ensure that --apply-dynamic-relocs is banned.
+# RUN: not ld.lld --apply-dynamic-relocs -shared --android-memtag-mode=sync \
+# RUN:   %t1.o %t2.o 2>&1 | FileCheck %s --check-prefix=CHECK-DYNRELOC
+# CHECK-DYNRELOC: --apply-dynamic-relocs cannot be used with MTE globals
+
+## And ensure that fully-static executables are banned.
+# RUN: not ld.lld --static --android-memtag-mode=sync \
+# RUN:   %t1.o %t2.o 2>&1 | FileCheck %s --check-prefix=CHECK-NOSTATIC
+# CHECK-NOSTATIC: --android-memtag-mode is incompatible with fully-static executables (-static)
+
+# CHECK:     Symbol table '.dynsym' contains
+# CHECK-DAG: [[#%x,GLOBAL:]] 32 OBJECT GLOBAL DEFAULT [[#]] global{{$}}
+# CHECK-DAG: [[#%x,GLOBAL_UNTAGGED:]] 4 OBJECT GLOBAL DEFAULT [[#]] global_untagged{{$}}
+# CHECK-DAG: [[#%x,CONST_GLOBAL:]] 4 OBJECT GLOBAL DEFAULT [[#]] const_global{{$}}
+# CHECK-DAG: [[#%x,GLOBAL_EXTERN:]] 16 OBJECT GLOBAL DEFAULT [[#]] global_extern{{$}}
+# CHECK-DAG: [[#%x,GLOBAL_EXTERN_UNTAGGED:]] 4 OBJECT GLOBAL DEFAULT [[#]] global_extern_untagged{{$}}
+# CHECK-DAG: 0 NOTYPE GLOBAL DEFAULT UND global_extern_outside_this_dso{{$}}
+# CHECK-DAG: [[#%x,GLOBAL_EXTERN_CONST_DEFINITION_BUT_NONCONST_IMPORT:]] 4 OBJECT GLOBAL DEFAULT [[#]] global_extern_untagged_definition_but_tagged_import{{$}}
+# CHECK-DAG: [[#%x,GLOBAL_EXTERN_UNTAGGED_DEFINITION_BUT_TAGGED_IMPORT:]] 4 OBJECT GLOBAL DEFAULT [[#]] global_extern_const_definition_but_nonconst_import{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_GLOBAL:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_global{{$}}
+# CHECK-DAG: [[#%x,POINTER_INSIDE_GLOBAL:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_inside_global{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_GLOBAL_END:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_global_end{{$}}
+# CHECK-DAG: [[#%x,POINTER_PAST_GLOBAL_END:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_past_global_end{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_GLOBAL_UNTAGGED:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_global_untagged{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_CONST_GLOBAL:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_const_global{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_HIDDEN_CONST_GLOBAL:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_hidden_const_global{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_HIDDEN_GLOBAL:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_hidden_global{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_HIDDEN_GLOBAL_END:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_hidden_global_end{{$}}
+# CHECK-DAG: [[#%x,POINTER_PAST_HIDDEN_GLOBAL_END:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_past_hidden_global_end{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_HIDDEN_ATTR_GLOBAL:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_hidden_attr_global{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_HIDDEN_ATTR_CONST_GLOBAL:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_hidden_attr_const_global{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_GLOBAL_EXTERN:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_global_extern{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_GLOBAL_EXTERN_UNTAGGED:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_global_extern_untagged{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_GLOBAL_EXTERN_OUTSIDE_THIS_DSO:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_global_extern_outside_this_dso{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_GLOBAL_EXTERN_CONST_DEFINITION_BUT_NONCONST_IMPORT:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_global_extern_const_definition_but_nonconst_import{{$}}
+# CHECK-DAG: [[#%x,POINTER_TO_GLOBAL_EXTERN_UNTAGGED_DEFINITION_BUT_TAGGED_IMPORT:]] 16 OBJECT GLOBAL DEFAULT [[#]] pointer_to_global_extern_untagged_definition_but_tagged_import{{$}}
+
+# CHECK:     Symbol table '.symtab' contains
+# CHECK-DAG: [[#%x,HIDDEN_CONST_GLOBAL:]] 4 OBJECT LOCAL DEFAULT [[#]] hidden_const_global{{$}}
+# CHECK-DAG: [[#%x,HIDDEN_GLOBAL:]] 16 OBJECT LOCAL DEFAULT [[#]] hidden_global{{$}}
+# CHECK-DAG: [[#%x,HIDDEN_ATTR_GLOBAL:]] 16 OBJECT LOCAL HIDDEN [[#]] hidden_attr_global{{$}}
+# CHECK-DAG: [[#%x,HIDDEN_ATTR_CONST_GLOBAL:]] 4 OBJECT LOCAL HIDDEN [[#]] hidden_attr_const_global{{$}}
+
+# CHECK:     Section Headers:
+# CHECK:     .memtag.globals.dynamic AARCH64_MEMTAG_GLOBALS_DYNAMIC
+# CHECK-NOT: .memtag.globals.static
+# CHECK-NOT: AARCH64_MEMTAG_GLOBALS_STATIC
+
+# CHECK: Relocation section '.rela.dyn'
+# CHECK-DAG: [[#POINTER_TO_GLOBAL]] {{.*}} R_AARCH64_ABS64 {{.*}} global + 0
+# CHECK-DAG: [[#POINTER_INSIDE_GLOBAL]] {{.*}} R_AARCH64_ABS64 {{.*}} global + 11
+# CHECK-DAG: [[#POINTER_TO_GLOBAL_END]] {{.*}} R_AARCH64_ABS64 {{.*}} global + 1e
+# CHECK-DAG: [[#POINTER_PAST_GLOBAL_END]] {{.*}} R_AARCH64_ABS64 {{.*}} global + 30
+# CHECK-DAG: [[#POINTER_TO_GLOBAL_UNTAGGED]] {{.*}} R_AARCH64_ABS64 {{.*}} global_untagged + 0
+# CHECK-DAG: [[#POINTER_TO_CONST_GLOBAL]] {{.*}} R_AARCH64_ABS64 {{.*}} const_global + 0
+
+## RELATIVE relocations.
+# CHECK-DAG: [[#POINTER_TO_HIDDEN_CONST_GLOBAL]] {{.*}} R_AARCH64_RELATIVE {{0*}}[[#HIDDEN_CONST_GLOBAL]]
+# CHECK-DAG: [[#POINTER_TO_HIDDEN_GLOBAL]] {{.*}} R_AARCH64_RELATIVE {{0*}}[[#HIDDEN_GLOBAL]]
+
+## AArch64 MemtagABI special RELATIVE relocation semantics, where the offset is encoded in the place.
+# CHECK-DAG:                 [[#POINTER_TO_HIDDEN_GLOBAL_END]] {{.*}} R_AARCH64_RELATIVE {{0*}}[[#HIDDEN_GLOBAL + 12]]
+# CHECK-SPECIAL-RELOCS:      <pointer_to_hidden_global_end>:
+# CHECK-SPECIAL-RELOCS-NEXT:   .word 0x00000000
+# CHECK-SPECIAL-RELOCS-NEXT:   .word 0x00000000
+# CHECK-DAG:                 [[#POINTER_PAST_HIDDEN_GLOBAL_END]] {{.*}} R_AARCH64_RELATIVE {{0*}}[[#HIDDEN_GLOBAL + 16]]
+# CHECK-SPECIAL-RELOCS:      <pointer_past_hidden_global_end>:
+# CHECK-SPECIAL-RELOCS-NEXT:   .word 0xfffffff0
+# CHECK-SPECIAL-RELOCS-NEXT:   .word 0xffffffff
+
+## More ABS64 relocations.
+# CHECK-DAG: [[#POINTER_TO_GLOBAL_EXTERN]] {{[0-9a-f]+}} R_AARCH64_ABS64 {{[0-9a-f]+}} global_extern + 0
+# CHECK-DAG: [[#POINTER_TO_GLOBAL_EXTERN_UNTAGGED]] {{[0-9a-f]+}} R_AARCH64_ABS64 {{[0-9a-f]+}} global_extern_untagged + 0
+# CHECK-DAG: [[#POINTER_TO_GLOBAL_EXTERN_OUTSIDE_THIS_DSO]] {{[0-9a-f]+}} R_AARCH64_ABS64 {{[0-9a-f]+}} global_extern_outside_this_dso + 0
+# CHECK-DAG: [[#POINTER_TO_GLOBAL_EXTERN_CONST_DEFINITION_BUT_NONCONST_IMPORT]] {{[0-9a-f]+}} R_AARCH64_ABS64 {{[0-9a-f]+}} global_extern_const_definition_but_nonconst_import + 0
+# CHECK-DAG: [[#POINTER_TO_GLOBAL_EXTERN_UNTAGGED_DEFINITION_BUT_TAGGED_IMPORT]] {{[0-9a-f]+}} R_AARCH64_ABS64 {{[0-9a-f]+}} global_extern_untagged_definition_but_tagged_import + 0
+
+# CHECK:      Memtag Dynamic Entries
+# CHECK-NEXT: AARCH64_MEMTAG_MODE: Synchronous (0)
+# CHECK-NEXT: AARCH64_MEMTAG_HEAP: Disabled (0)
+# CHECK-NEXT: AARCH64_MEMTAG_STACK: Disabled (0)
+# CHECK-NEXT: AARCH64_MEMTAG_GLOBALS: 0x{{[0-9a-f]+}}
+# CHECK-NEXT: AARCH64_MEMTAG_GLOBALSSZ: 23
+
+# CHECK:      Memtag Android Note
+# CHECK-NEXT: Tagging Mode: SYNC
+# CHECK-NEXT: Heap: Disabled
+# CHECK-NEXT: Stack: Disabled
+
+## Global variable order hopefully isn't too brittle of a test here, but this allows us to make sure
+## that we have all the global variables we expect, and no more.
+# CHECK:      Memtag Global Descriptors:
+# CHECK-NEXT: 0x[[#POINTER_TO_GLOBAL]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_INSIDE_GLOBAL]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_GLOBAL_END]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_PAST_GLOBAL_END]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_GLOBAL_UNTAGGED]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_CONST_GLOBAL]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_HIDDEN_CONST_GLOBAL]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_HIDDEN_GLOBAL]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_HIDDEN_ATTR_GLOBAL]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_HIDDEN_ATTR_CONST_GLOBAL]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_HIDDEN_GLOBAL_END]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_PAST_HIDDEN_GLOBAL_END]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_GLOBAL_EXTERN]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_GLOBAL_EXTERN_UNTAGGED]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_GLOBAL_EXTERN_OUTSIDE_THIS_DSO]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_GLOBAL_EXTERN_CONST_DEFINITION_BUT_NONCONST_IMPORT]]: 0x10
+# CHECK-NEXT: 0x[[#POINTER_TO_GLOBAL_EXTERN_UNTAGGED_DEFINITION_BUT_TAGGED_IMPORT]]: 0x10
+# CHECK-NEXT: 0x[[#GLOBAL]]: 0x20
+# CHECK-NEXT: 0x[[#HIDDEN_ATTR_GLOBAL]]: 0x10
+# CHECK-NEXT: 0x[[#HIDDEN_GLOBAL]]: 0x10
+# CHECK-NEXT: 0x[[#GLOBAL_EXTERN]]: 0x10
+# CHECK-NOT:  0x