[lld] Synthesize metadata for MTE globals

[hctim]

Summary

As per the ABI at
https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst,
this patch interprets the SHT_AARCH64_MEMTAG_GLOBALS_STATIC section,
which contains R_NONE relocations to tagged globals, and emits a
SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC section, with the correct
DT_AARCH64_MEMTAG_GLOBALS and DT_AARCH64_MEMTAG_GLOBALSSZ dynamic
entries. This section describes, in a uleb-encoded stream, global memory
ranges that should be tagged with MTE.

We are also out of bits to spare in the LLD Symbol class. As a result,
I've reused the 'needsTocRestore' bit, which is a PPC64 only feature.
Now, it's also used for 'isTagged' on AArch64.

An entry in SHT_AARCH64_MEMTAG_GLOBALS_STATIC is practically a guarantee
from an objfile that all references to the linked symbol are through the
GOT, and meet correct alignment requirements. As a result, we go through
all symbols and make sure that, for all symbols $SYM, all object files
that reference $SYM also have a SHT_AARCH64_MEMTAG_GLOBALS_STATIC entry
for $SYM. If this isn't the case, we demote the symbol to being
untagged. Symbols that are imported from other DSOs should always be
fine, as they're GOT-referenced (and thus the GOT entry either has the
correct tag or not, depending on whether it's tagged in the defining DSO
or not).

Additionally hand-tested by building {libc, libm, libc++, libm, and libnetd}
on Android with some experimental MTE globals support in the
linker/libc.

[peter.smith]

I'll try and take a look over the next few days. Will need to reload my brain with the MTE spec first.

[peter.smith]

Just a few small comments so far. I've got up to Relocations.cpp. Hope to carry on later this week.

lld/ELF/Arch/AArch64.cpp

387

A small nit. LLD tends to prefer no curly brackets when there is only one statement.

668

IIUC this will change an ADRP, ADD into an ADR, which is just a shorter ranged ADRP/ADD. This relaxation doesn't change the destination address like tryRelaxAdrpLdr might.

.

782

To help prevent future relaxations from not considering MTE, It may be worth moving the sym.isTagged() to here with a general condition similar to needsGot in relocations.cpp.

For example don't relax if the symbol is tagged and is relative to a GOT reference.

Alternatively could be worth a comment in the Relaxer class to highlight the restriction.

lld/ELF/Driver.cpp

360

Not sure what this difference is from. If it has come from clang-format it may be worth NFC committing it separately to avoid it getting associated with this patch.

763

To check my understanding; this is being deleted because protecting globals is independent of heap and stack tagging.

[peter.smith]

I've gone through all of the LLD changes now.

lld/ELF/Driver.cpp

2571

I think Fuchsia uses REL dynamic relocations with -z rel , may be worth making this a user visible error message as this could happen with user input.

2936

At this stage can you use ctx.objectFiles this seems to be more idiomatic than processing the files directly.

2942

I think clang-format will prefer

if (section == nullptr)
  continue;

It is coming out all as one line on my screen, apologies if that is just Phabricator.
May want to combine the two if statements into one. Also LLD tends to use !section

if (!section || section->type != SHT_AARCH64_MEMTAG_GLOBALS_STATIC)
  continue;

Given that this is after Garbage Collection I think you'll need to check if s== &InputSection::discarded.

2949

Is it ever possible to get a case where a STB_LOCAL binding symbol definition is incorrectly tagged? For example all references to it should be within the same TU, which should share the same command line options. It is possible some function attribute might prevent this though.

If it isn't possible then you might be able to just iterate the global symbols.

2960

I'm pretty sure this isn't necessary, I've not seen any other code that checks. I guess it might be possible that a broken object file might contain a 0 index for a symbol, but if it does LLD will already have crashed by now.

lld/ELF/SyntheticSections.cpp

3908

Although not ideal either, would writeULEB128 be a better name as compute implies that it is just computing the value and not writing it?

I guess computeOrWrite is the most descriptive but possibly a bit long.

3921

Although it may not be worth dealing with, I think you could pull this out into a separate function that you could call after the first address assignment in finalizeAddressDependentContent, as by that time the relative order of the symbols would be fixed.

3949

One possibility would be to have an internal buffer that could cache the results so that writeTo would just need to write it out. I guess the problem is that we won't know how big to make it, so I guess it would need to be a self expanding buffer.

Not sure if it is worth doing, as it might end up more complicated than it is already.

3963

By caller's do you mean call-sites?

3977

At first glance I thought that the contents of the MemtagDescriptors would be stable and could be cached, but I think the uleb encoding could change depending on the addresses so it will need recalculating.

If I'm right it could be worth adding a comment.

lld/ELF/SyntheticSections.h

1234

Looks like the call site has this check before calling addSymbol. Is it worth making that an assert instead?

[hctim]

lld/ELF/Arch/AArch64.cpp

668

yep, good point, removed

782

Done, moved it to a general conditional branch.

lld/ELF/Driver.cpp

360

ack, removed from diff

763

Yeah, that's correct. We want to allow --android-memtag-mode=sync without requiring heap/stack, as we want to enable building globals-only binaries.

2949

Ooh, nice tip! I've made addTaggedSymbolReferences mark them immediately as tagged.

2960

Done. I swear I added this for a reason, but I'll rebuild Android and check.

lld/ELF/SyntheticSections.cpp

3908

let's go with computeOrWriteULEB128

3921

done (glued it up inside finalizeAddressDependentContent)

3949

now that we're not sorting on the size call (and only doing it in the finalization of the address dependent content), less worth doing anything this complicated.

3963

this is gone with the new glue around finalizeAddressDependentContent

3977

done, in the header

[hctim]

Update from Peter's comments (thanks for the review!).

[peter.smith]

Thanks for the updates. The code-changes look good to me on my current understanding. I've made a few suggestions on the testing. I'm hoping to read through the spec in detail to see if I've missed anything, but I don't want to let that hold up the patch if I can't get round to it in a reasonable amount of time.

lld/test/ELF/Inputs/aarch64-memtag-globals-1.s

12 ↗

(On Diff #535757)

Speaking of hidden, I'm guessing that attribute((visibility("hidden"))) might affect a variable being in the GOT in the same way as static. If it does then could be worth adding a test.

51 ↗

(On Diff #535757)

The spec says that TLS variables are not tagged (although that could change), is it worth adding a case for TLS.

lld/test/ELF/aarch64-memtag-globals.s

5

One thing that might be worth doing is using split-file (see aarch64-thunk-pi.s for an example ) to include instructions to create aarch64-memtag-globals-1.s and memtag-globals-2.s in the same source file. There's a chance it makes it too big to be worth the effort, but could be worth an expirement to see if it is easier to read than splitting across several files.

11

typo in relocatiosn

17

Worth dumping the dynamic tags to check for DT_AARCH64_MEMTAG_GLOBALS and DT_AARCH64_MEMTAG_GLOBALSSZ ?

Also could be worth dumping section headers to check for SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC

[hctim]

lld/test/ELF/aarch64-memtag-globals.s

17

The dynamic entries are dumped by --memtag (see the checks near "CHECK: Memtag Dynamic Entries").

For SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC, done.

[hctim]

Update from Peter's test comments.

[peter.smith]

Thanks for the updates. One query about the R_AARCH64_PREL64 relocation as it looks like that needs to be separated out, but otherwise looks good to me. I'll be happy to approve, although I think it would be good to get MaskRay's approval as well.

lld/ELF/Arch/AArch64.cpp

378

Does R_AARCH64_PREL64 need this behaviour? It isn't a dynamic relocation, won't generate a R_AARCH64_RELATIVE and calculates an offset to symbol from the place. I can't see it in the spec either.

Does it need to be?

case R_AARCH64_PREL64:
  write64(loc, val);
  break;
case R_AARCH64_ABS64:
  // As below

Just for clarification, an R_AARCH64_ABS64 static relocation can be either converted to a relative or can be a dynamic reloc itself

extern int foo;
int *bar = &foo;

Is it OK to encode the addend as for R_AARCH64_RELATIVE in both cases?

[hctim]

Update from comments.

[hctim]

lld/ELF/Arch/AArch64.cpp

378

Done, removed it from the PREL64 branch. Yes, the encoded addend is intended and desirable for RELATIVE as well. It handles the case when we have an out-of-bounds (e.g. 'endptr') pointer to a local global variable.

[peter.smith]

Thanks for the updates. This looks good to me. Will be good to wait for a few days to see if MaskRay has any comments or objections.

[MaskRay]

I'll read this shortly...

lld/test/ELF/aarch64-memtag-globals.s

4

We typically rm -rf %t the directory, especially for a large test with many temporary files. Otherwise, if we remove an output file, the test may sometimes still pass as there is a lingering file in our build directory.

19

For newer tests, we align the value of CHECK to look better

# CHECK:      check
# CHECK-NEXT: no indentation
# CHECK-NEXT:   2-space indentation

20

Ignoring a decimal number prefers [[#]]

22

[0-9a-f]+ can be replaced with [[#%x,xxx:]], though the references need to look like [[#xxx]]

[MaskRay]

lld/ELF/SyntheticSections.cpp

3961

If we have aliases, std::sort will exhibit different behaviors for different std::sort implementations or libc++ with https://libcxx.llvm.org/DesignDocs/UnspecifiedBehaviorRandomization.html
Consider stable_sort

lld/ELF/SyntheticSections.h

1227

final

lld/test/ELF/Inputs/aarch64-memtag-globals.s

384

no trailing blank line

lld/test/ELF/aarch64-memtag-globals.s

16

FileCheck %s < %t.out

[MaskRay]

lld/ELF/Arch/AArch64.cpp

388

Just use the unary operator.

lld/ELF/Driver.cpp

2563

the lambda is only used once. just expand it.

2570

TLS blocks => TLS symbols

2579

LLVM coding style prefers pre-increments

2929

We probably should move the whole function and referenced function template addTaggedSymbolReferences to AArch64.cpp.

2937

Avoid referencing an individual user. When needed (actually very rarely done for lld), reference a public issue link.

In this case, bitcode files should already work. This place is after compileBitcodeFiles, so `ctx.objectFiles contains all relocatable object files (including extracted lazy object files) and compiled bitcode files.

lld/ELF/SyntheticSections.cpp

1456

This is guaranteed to be non-null.

3925

We typically just use addr instead of vAddr.

3936

When buf is null, addr is 0. If size is 0, we'd report an error without knowing the actual address. We should drop the address from the diagnostic.

[MaskRay]

We need a --pack-dyn-relocs=relr test to show that we don't use RELR for a relative relocation referencing a tagged symbol.

This test should also check that a GOT-generating relocation referencing a non-preemptible memtag symbol does not use .relr.dyn (see local-got-shared.s).

[hctim]

Update w/ Ray's comments.

lld/ELF/Arch/AArch64.cpp

388

Unfortunately not possible here. e.g. ~17 != -1 * 17. While we could change the ABI to be granules-away (and then do a % 16 on the offset at the end of the calculation), giving an exact offset in bytes gives a nice easy way to debug the exact address of the tag derivation (and doesn't waste any bytes doing so).

lld/ELF/Driver.cpp

2937

Thanks for the tip!

lld/ELF/SyntheticSections.cpp

1456

isNeeded() is even better :).

lld/test/ELF/Inputs/aarch64-memtag-globals.s

384

assuming you mean no double-trailing-newline, done

lld/test/ELF/aarch64-memtag-globals.s

20

Yep, for ignoring sizes, done.

For ignoring relocation types, changed to {{[0-9a-f]+}} which to me is more understandable than [[#%x,]]`.

[MaskRay]

lld/ELF/Arch/AArch64.cpp

388

Sorry for being clear. I mean write64(loc, -rel.addend);.

We use unary operator elsewhere. It's much more common than -1 * xxx

[hctim]

Move to '-' from '-1 *'

[hctim]

Friendly ping @MaskRay

[MaskRay]

Thank you for the updates and sorry for the delayed response. I took a look again.

You can ping me more frequently:) I am going to take a trip and will likely have slow response for ~2 weeks since Jul 27.

lld/ELF/Arch/AArch64.cpp

385

rel.sym is guaranteed to be non-null. The nullness check can be removed

386

Consider using a single unsigned comparison and omitting the zero comparison.

979

This assert is unneeded now that this code lives in AArch64.cpp

980

We use const references to assert non-nullness.

984

This error is untested. We can use yaml2obj to craft a test.

1027

A BinaryFile has just one .data section. There can't be SHT_AARCH64_MEMTAG_GLOBALS_STATIC sections.

1061

llvm style prefers pre-increments.

lld/ELF/Relocations.cpp

861

case R_AARCH64_ABS64: in AArch64.cpp uses the signed int64_t, different from here.

Perhaps we can just omit the < 0 comparison and rely on unsigned comparison? If int64_t(addend) < 0, uint64_t(addend) will be very large.

Then adjust the comment to

// For tagged symbols with addends outside of [0, sym.getSize()), ...

lld/ELF/SyntheticSections.h

532

This change is untested. We seem to need a --apply-dynamic-relocs test inspecting the relocated data with llvm-readelf -x or llvm-objdump -s.

1232

clang-format will remove the space

1242

For new code, we use const reference to assert non-nullness.

1247

Why is the !config->isStatic && condition?

isConfig can be toggled by -Bstatic/-static and -Bdynamic.
-Bstatic can be used with a dynamically linked executable as well.

1251

Nit: SmallVector<const Symbol *, 0> is likely more efficient due to smaller size :)

1287

Place this after memtagAndroidNote for an alphabetical order

lld/test/ELF/aarch64-memtag-globals.s

88

Add -NEXT whenever appropriate.

91

Do you mean this?

99

Perhaps:

# CHECK:      Memtag Global Descriptors:
# CHECK-NEXT:   0x[[#POINTER_TO_GLOBAL]]: 0x10
# CHECK-NEXT:   0x[[#POINTER_INSIDE_GLOBAL]]: 0x10
...
# CHECK-NOT:  {{.}}

We already rely on the order, so we can just use -NEXT: patterns to avoid CHECK-NOT:

[hctim]

Update with comments from Ray.

lld/ELF/Arch/AArch64.cpp

385

Surprisingly, this causes failures in other tests if removed:

lld :: ELF/aarch64-call26-thunk.s
lld :: ELF/aarch64-cortex-a53-843419-large.s
lld :: ELF/aarch64-cortex-a53-843419-thunk.s
lld :: ELF/aarch64-jump26-thunk.s
lld :: ELF/aarch64-range-thunk-extension-plt32.s

For now, leaving as-is.

386

(see same comment below about unsigned comparison)

980

Made the parameter byref, assuming you also mean the same about non-const refs.

lld/ELF/Relocations.cpp

861

I've gone ahead and fleshed out the comment, but I really don't think that relying on "signed integer when converted to unsigned is so large as to be out of range" is a great idea. While it may reduce one arithmetic operation, it decreases readability as the intent is no longer evident from the code (no matter how well it's described in the comments).

lld/ELF/SyntheticSections.h

532

Removed this condition here, and banned --apply-dynamic-relocs when using MTE globals.

We could make it so --apply-dynamic-relocs works in all the places where it *can*, but this seems really prone to confusion ("why do I have the correct relocation here but not there? Oh, it's because of the MTE globals relocs!" isn't completely obvious).

1247

MTE globals are not supported for fully static executables, there needs to be a dynamic loader that processes relocations.

Is there a better way to describe this in code? Maybe pulling needsInterpSection out of Writer.cpp?

lld/test/ELF/aarch64-memtag-globals.s

91

Yeah, ish. [0-9a-f]+ is fine though.

[MaskRay]

Thanks!

lld/ELF/Arch/AArch64.cpp

761

rel.sym && can be removed. relocateAlloc guarantees that rel.sym != nullptr.

Sorry for my suggestion in another place. R_AARCH64_ABS64 does need a rel.sym check as it is used by relocateNoSym for thunks and relocateNonAlloc. I have done D73254 in the past to clean it a bit. I will do more cleanup so that
R_AARCH64_ABS64 can remove the rel.sym check as well.

1042

Remove this comment. As mentioned, LTO is already supported.

lld/ELF/SyntheticSections.cpp

3922

3929

Consider errorOrWarn so that --noinhibit-exec links can produce output even with errors.

I'm fine with no testing if this is difficult to do.

3931

no trailing full stop

lld/ELF/Writer.h

58

Below addReservedSymbols may be a good place. The last few declarations are for mips.

[hctim]

lld/ELF/SyntheticSections.cpp

3922

Added the type, but it's actually const Symbol* as the container needs to store pointers to allow sorting.

lld/ELF/SyntheticSections.h

1247

@MaskRay - any suggestions here?

[hctim]

More comment updates.

[MaskRay]

LGTM again. Feel free to file a request to merge this into https://github.com/llvm/llvm-project/tree/release/17.x if you prefer.

lld/ELF/SyntheticSections.h

1247

Yes, moving needsInterpSection to Writer.h and exposing it here looks good to me.

You will need to move isNeeded to SyntheticSections.cpp as we cannot make SyntheticSections.h include Writer.h.

Ideally SyntheticSections.cpp does not use more functions from Writer.h, so SyntheticSections.cpp defining needsInterpSection is also fine.

[hctim]

lld/ELF/SyntheticSections.h

1247

Yeah, so it needed a little bit more precise of a check, which I put straight in the relevant bit of Writer.cpp (so it doesn't need to be exported).

We don't allow MTE globals for fully-static binaries, as the loader needs to do some work. I added a test with --static (and nothing else, as this is what clang -static seems to emit, along with ctrbegin/end as static) as well. We basically error-out when you try and --android-memtag-mode on a non-DSO non-partially-linked (--relocatable) non-interpreted binary.

[hctim]

Final updates.

lld/ELF/Arch/AArch64.cpp

case R_AARCH64_PREL32:
     checkIntUInt(loc, val, 32, rel);
     write32(loc, val);
     break;
   case R_AARCH64_PLT32:
     checkInt(loc, val, 32, rel);
     write32(loc, val);
     break;
   case R_AARCH64_ABS64:
   case R_AARCH64_PREL64:
+    // AArch64 relocations to tagged symbols have extended semantics, as
+    // described here:
+    // https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#841extended-semantics-of-r_aarch64_relative.
+    // tl;dr: encode the symbol's special addend in the place, which is an
+    // offset to the point where the logical tag is derived from. Quick hack, if
+    // the addend is within the symbol's bounds, no need to encode the tag
+    // derivation offset.
+    if (rel.sym && rel.sym->isTagged() &&
+        (rel.addend < 0 ||
+         rel.addend >= static_cast<int64_t>(rel.sym->getSize())))
+      write64(loc, -1 * rel.addend);
+    else
       write64(loc, val);
     break;
   case R_AARCH64_ADD_ABS_LO12_NC:
     or32AArch64Imm(loc, val);
     break;
   case R_AARCH64_ADR_GOT_PAGE:
   case R_AARCH64_ADR_PREL_PG_HI21:
   case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
   case R_AARCH64_TLSDESC_ADR_PAGE21:
if ((adrpInstr & 0x9f000000) != 0x90000000 ||
     return false;
   uint32_t adrpDestReg = adrpInstr & 0x1f;
   uint32_t addDestReg = addInstr & 0x1f;
   uint32_t addSrcReg = (addInstr >> 5) & 0x1f;
   if (adrpDestReg != addDestReg || adrpDestReg != addSrcReg)
     return false;
 
   Symbol &sym = *adrpRel.sym;
   // Check if the address difference is within 1MiB range.
   int64_t val = sym.getVA() - (secAddr + addRel.offset);
   if (val < -1024 * 1024 || val >= 1024 * 1024)
     return false;
 
   Relocation adrRel = {R_ABS, R_AARCH64_ADR_PREL_LO21, addRel.offset,
                        /*addend=*/0, &sym};
   // nop
   write32le(buf + adrpRel.offset, 0xd503201f);
target->relocate(buf + adrpSymRel.offset, adrpSymRel,
                    SignExtend64(getAArch64Page(sym.getVA()) -
                                     getAArch64Page(secAddr + adrpSymRel.offset),
                                 64));
   target->relocate(buf + addRel.offset, addRel, SignExtend64(sym.getVA(), 64));
   tryRelaxAdrpAdd(adrpSymRel, addRel, secAddr, buf);
   return true;
 }
 
+// Tagged symbols have upper address bits that are added by the dynamic loader,
+// and thus need the full 64-bit GOT entry. Do not relax such symbols.
+static bool needsGotForMemtag(const Relocation &rel) {
+  return rel.sym && rel.sym->isTagged() && needsGot(rel.expr);
+}
+
 void AArch64::relocateAlloc(InputSectionBase &sec, uint8_t *buf) const {
   uint64_t secAddr = sec.getOutputSection()->addr;
   if (auto *s = dyn_cast<InputSection>(&sec))
     secAddr += s->outSecOff;
   AArch64Relaxer relaxer(sec.relocs());
   for (size_t i = 0, size = sec.relocs().size(); i != size; ++i) {
     const Relocation &rel = sec.relocs()[i];
     uint8_t *loc = buf + rel.offset;
     const uint64_t val =
         sec.getRelocTargetVA(sec.file, rel.type, rel.addend,
                              secAddr + rel.offset, *rel.sym, rel.expr);
+
+    if (needsGotForMemtag(rel)) {
+      relocate(loc, rel, val);
+      continue;
+    }
+
     switch (rel.expr) {
     case R_AARCH64_GOT_PAGE_PC:
       if (i + 1 < size &&
           relaxer.tryRelaxAdrpLdr(rel, sec.relocs()[i + 1], secAddr, buf)) {
         ++i;
         continue;
       }
       break;
     case R_AARCH64_PAGE_PC:
       if (i + 1 < size &&
if ((config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI) ||
       config->zPacPlt) {
     static AArch64BtiPac t;
     return &t;
   }
   static AArch64 t;
   return &t;
 }
 
 TargetInfo *elf::getAArch64TargetInfo() { return getTargetInfo(); }

lld/ELF/Arch/PPC64.cpp

for (const Relocation &rel : sec.relocs()) {
     case R_PPC64_CALL:
       // If this is a call to __tls_get_addr, it may be part of a TLS
       // sequence that has been relaxed and turned into a nop. In this
       // case, we don't want to handle it as a call.
       if (read32(loc) == 0x60000000) // nop
         break;
 
       // Patch a nop (0x60000000) to a ld.
-      if (rel.sym->needsTocRestore) {
+      if (rel.sym->needsTocRestore()) {
         // gcc/gfortran 5.4, 6.3 and earlier versions do not add nop for
         // recursive calls even if the function is preemptible. This is not
         // wrong in the common case where the function is not preempted at
         // runtime. Just ignore.
         if ((rel.offset + 8 > sec.content().size() ||
              read32(loc + 4) != 0x60000000) &&
             rel.sym->file != sec.file) {
           // Use substr(6) to remove the "__plt_" prefix.

lld/ELF/Driver.cpp

if (config->fixCortexA8 && config->emachine != EM_ARM)
     error("--fix-cortex-a8 is only supported on ARM targets");
 
   if (config->armBe8 && config->emachine != EM_ARM)
     error("--be8 is only supported on ARM targets");
 
   if (config->fixCortexA8 && !config->isLE)
     error("--fix-cortex-a8 is not supported on big endian targets");
 
   if (config->tocOptimize && config->emachine != EM_PPC64)
     error("--toc-optimize is only supported on PowerPC64 targets");
 
   if (config->pcRelOptimize && config->emachine != EM_PPC64)
     error("--pcrel-optimize is only supported on PowerPC64 targets");
 
   if (config->relaxGP && config->emachine != EM_RISCV)
     error("--relax-gp is only supported on RISC-V targets");
 
if (config->androidMemtagStack)
       warn("--android-memtag-mode is unspecified, leaving "
            "--android-memtag-stack a no-op");
     else if (config->androidMemtagHeap)
       warn("--android-memtag-mode is unspecified, leaving "
            "--android-memtag-heap a no-op");
     return ELF::NT_MEMTAG_LEVEL_NONE;
   }
 
-  if (!config->androidMemtagHeap && !config->androidMemtagStack) {
-    error("when using --android-memtag-mode, at least one of "
-          "--android-memtag-heap or "
-          "--android-memtag-stack is required");
-    return ELF::NT_MEMTAG_LEVEL_NONE;
-  }
-
   if (memtagModeArg == "sync")
     return ELF::NT_MEMTAG_LEVEL_SYNC;
   if (memtagModeArg == "async")
     return ELF::NT_MEMTAG_LEVEL_ASYNC;
   if (memtagModeArg == "none")
     return ELF::NT_MEMTAG_LEVEL_NONE;
 
   error("unknown --android-memtag-mode value: \"" + memtagModeArg +
static void postParseObjectFile(ELFFileBase *file) {
   case ELF64BEKind:
     cast<ObjFile<ELF64BE>>(file)->postParse();
     break;
   default:
     llvm_unreachable("");
   }
 }
 
+template <class ELFT>
+static void
+addTaggedSymbolReferences(InputSectionBase *sec,
+                          DenseMap<Symbol *, unsigned> &referenceCount) {
+  assert(config->emachine == EM_AARCH64);
+  assert(sec && sec->type == SHT_AARCH64_MEMTAG_GLOBALS_STATIC);
+
+  auto f = [&](auto relArray) {
+    for (const typename ELFT::Rela &rel : relArray) {
+      Symbol &sym = sec->getFile<ELFT>()->getRelocTargetSym(rel);
+      // Linker-synthesized symbols such as __executable_start may be referenced
+      // as tagged in input objfiles, and we don't want them to be tagged. A
+      // cheap way to exclude them is the type check, but their type is
+      // STT_NOTYPE. In addition, this save us from checking untaggable symbols,
+      // like functions or TLS blocks.
+      if (sym.type != STT_OBJECT)
+        continue;
+      // STB_LOCAL symbols can't be referenced from outside the object file, and
+      // thus don't need to be checked for references from other object files.
+      if (sym.binding == STB_LOCAL) {
+        sym.setIsTagged(true);
+        continue;
+      }
+      referenceCount[&sym]++;
+    }
+  };
+
+  const RelsOrRelas<ELFT> rels = sec->relsOrRelas<ELFT>();
+  if (rels.areRelocsRel())
+    error("non-RELA relocations are not allowed with memtag globals");
+  f(rels.relas);
+  sec->markDead();
+}
+
 // Do actual linking. Note that when this function is called,
 // all linker scripts have already been parsed.
 void LinkerDriver::link(opt::InputArgList &args) {
   llvm::TimeTraceScope timeScope("Link", StringRef("LinkerDriver::Link"));
   // If a --hash-style option was not given, set to a default value,
   // which varies depending on the target.
   if (!args.hasArg(OPT_hash_style)) {
     if (config->emachine == EM_MIPS)
void LinkerDriver::link(opt::InputArgList &args) {
   // Garbage collection and removal of shared symbols from unused shared objects.
   invokeELFT(markLive,);
   demoteSharedAndLazySymbols();
 
   // Make copies of any input sections that need to be copied into each
   // partition.
   copySectionsIntoPartitions();
 
+  // A tagged symbol must be denoted as being tagged by all references and the
+  // chosen definition. For simplicity, here, it must also be denoted as tagged
+  // for all definitions. Otherwise:
+  //
+  //  1. A tagged definition can be used by an untagged declaration, in which
+  //     case the untagged access may be PC-relative, causing a tag mismatch at
+  //     runtime.
+  //  2. An untagged definition can be used by a tagged declaration, where the
+  //     compiler has taken advantage of the increased alignment of the tagged
+  //     declaration, but the alignment at runtime is wrong, causing a fault.
+  //
+  // Ideally, this isn't a problem, as any TU that imports or exports tagged
+  // symbols should also be built with tagging. But, to handle these cases, we
+  // demote the symbol to be untagged.
+  if (config->emachine == EM_AARCH64 &&
+      config->androidMemtagMode != ELF::NT_MEMTAG_LEVEL_NONE) {
+    llvm::TimeTraceScope timeScope("Process memory tagged symbols");
+
+    // First, collect all symbols that are marked as tagged, and count how many
+    // times they're marked as tagged.
+    DenseMap<Symbol *, unsigned> taggedSymbolReferenceCount;
+    for (InputFile* file : files) {
+      // TODO(hctim): Add bitcode (LTO) support.
+      if (file->kind() != InputFile::BinaryKind &&
+          file->kind() != InputFile::ObjKind)
+        continue;
+      for (InputSectionBase *section : file->getSections()) {
+        if (!section || section->type != SHT_AARCH64_MEMTAG_GLOBALS_STATIC ||
+            section == &InputSection::discarded)
+          continue;
+        invokeELFT(addTaggedSymbolReferences, section,
+                   taggedSymbolReferenceCount);
+      }
+    }
+
+    // Now, go through all the symbols. If the number of declarations +
+    // definitions to a symbol exceeds the amount of times they're marked as
+    // tagged, it means we have an objfile that uses the untagged variant of the
+    // symbol.
+    for (InputFile *file : ctx.objectFiles) {
+      // TODO(hctim): Add bitcode (LTO) support.
+      if (file->kind() != InputFile::BinaryKind &&
+          file->kind() != InputFile::ObjKind)
+        continue;
+
+      for (Symbol *symbol : file->getSymbols()) {
+        // See `addTaggedSymbolReferences` for more details.
+        if (symbol->type != STT_OBJECT ||
+            symbol->binding == STB_LOCAL)
+          continue;
+        auto it = taggedSymbolReferenceCount.find(symbol);
+        if (it == taggedSymbolReferenceCount.end()) continue;
+        unsigned &remainingAllowedTaggedRefs = it->second;
+        if (remainingAllowedTaggedRefs == 0) {
+          taggedSymbolReferenceCount.erase(it);
+          continue;
+        }
+        remainingAllowedTaggedRefs--;
+      }
+    }
+
+    // Now, `taggedSymbolReferenceCount` should only contain symbols that are
+    // defined as tagged exactly the same amount as it's referenced, meaning all
+    // uses are tagged.
+    for (auto &[symbol, remainingTaggedRefs] : taggedSymbolReferenceCount) {
+      assert(remainingTaggedRefs == 0 &&
+             "Symbol is defined as tagged more times than it's used");
+      symbol->setIsTagged(true);
+    }
+  }
+
   // Create synthesized sections such as .got and .plt. This is called before
   // processSectionCommands() so that they can be placed by SECTIONS commands.
   invokeELFT(createSyntheticSections,);
 
   // Some input sections that are used for exception handling need to be moved
   // into synthetic sections. Do that now so that they aren't assigned to
   // output sections in the usual way.
   if (!config->relocatable)

lld/ELF/Relocations.h

ArrayRef<RelTy> sortRels(ArrayRef<RelTy> rels, SmallVector<RelTy, 0> &storage) {
   };
   if (!llvm::is_sorted(rels, cmp)) {
     storage.assign(rels.begin(), rels.end());
     llvm::stable_sort(storage, cmp);
     rels = storage;
   }
   return rels;
 }
+
+// Returns true if Expr refers a GOT entry. Note that this function returns
+// false for TLS variables even though they need GOT, because TLS variables uses
+// GOT differently than the regular variables.
+bool needsGot(RelExpr expr);
 } // namespace lld::elf
 
 #endif

lld/ELF/Relocations.cpp

 #include "SymbolTable.h"
 #include "Symbols.h"
 #include "SyntheticSections.h"
 #include "Target.h"
 #include "Thunks.h"
 #include "lld/Common/ErrorHandler.h"
 #include "lld/Common/Memory.h"
 #include "llvm/ADT/SmallSet.h"
+#include "llvm/BinaryFormat/ELF.h"
 #include "llvm/Demangle/Demangle.h"
 #include "llvm/Support/Endian.h"
 #include <algorithm>
 
 using namespace llvm;
 using namespace llvm::ELF;
 using namespace llvm::object;
 using namespace llvm::support::endian;

 }
 
 // Returns true if Expr refers a PLT entry.
 static bool needsPlt(RelExpr expr) {
   return oneof<R_PLT, R_PLT_PC, R_PLT_GOTPLT, R_PPC32_PLTREL, R_PPC64_CALL_PLT>(
       expr);
 }
 
-// Returns true if Expr refers a GOT entry. Note that this function
-// returns false for TLS variables even though they need GOT, because
-// TLS variables uses GOT differently than the regular variables.
-static bool needsGot(RelExpr expr) {
+bool lld::elf::needsGot(RelExpr expr) {
   return oneof<R_GOT, R_GOT_OFF, R_MIPS_GOT_LOCAL_PAGE, R_MIPS_GOT_OFF,
                R_MIPS_GOT_OFF32, R_AARCH64_GOT_PAGE_PC, R_GOT_PC, R_GOTPLT,
                R_AARCH64_GOT_PAGE>(expr);
 }
 
 // True if this expression is of the form Sym - X, where X is a position in the
 // file (PC, or GOT for example).
 static bool isRelExpr(RelExpr expr) {

 }
 
 template <bool shard = false>
 static void addRelativeReloc(InputSectionBase &isec, uint64_t offsetInSec,
                              Symbol &sym, int64_t addend, RelExpr expr,
                              RelType type) {
   Partition &part = isec.getPartition();
 
+  if (sym.isTagged()) {
+    std::lock_guard<std::mutex> lock(relocMutex);
+    part.relaDyn->addRelativeReloc(target->relativeRel, isec, offsetInSec, sym,
+                                   addend, type, expr);
+    // For tagged symbols with addends, store the relative offset to where the
+    // tag should be derived from.
+    if (addend < 0 || static_cast<uint64_t>(addend) >= sym.getSize())
+      isec.relocations.push_back({expr, type, offsetInSec, addend, &sym});
+    return;
+  }
+
   // Add a relative relocation. If relrDyn section is enabled, and the
   // relocation offset is guaranteed to be even, add the relocation to
   // the relrDyn section, otherwise add it to the relaDyn section.
   // relrDyn sections don't support odd offsets. Also, relrDyn sections
   // don't store the addend values, so we must write it to the relocated
   // address.
   if (part.relrDyn && isec.addralign >= 2 && offsetInSec % 2 == 0) {
     isec.addReloc({expr, type, offsetInSec, addend, &sym});
static bool handleNonPreemptibleIfunc(Symbol &sym, uint16_t flags) {
   return true;
 }
 
 void elf::postScanRelocations() {
   auto fn = [](Symbol &sym) {
     auto flags = sym.flags.load(std::memory_order_relaxed);
     if (handleNonPreemptibleIfunc(sym, flags))
       return;
+
+    if (sym.isTagged() && sym.isDefined())
+      mainPart->memtagDescriptors->addSymbol(&sym);
+
     if (!sym.needsDynReloc())
       return;
     sym.allocateAux();
 
     if (flags & NEEDS_GOT)
       addGotEntry(sym);
     if (flags & NEEDS_PLT)
       addPltEntry(*in.plt, *in.gotPlt, *in.relaPlt, target->pltRel, sym);

lld/ELF/Symbols.h

 
 private:
   bool shouldReplace(const Defined &other) const;
 
 protected:
   Symbol(Kind k, InputFile *file, StringRef name, uint8_t binding,
          uint8_t stOther, uint8_t type)
       : file(file), nameData(name.data()), nameSize(name.size()), type(type),
-        binding(binding), stOther(stOther), symbolKind(k),
-        exportDynamic(false) {}
+        binding(binding), stOther(stOther), symbolKind(k), exportDynamic(false),
+        archSpecificBit(false) {}
 
   void overwrite(Symbol &sym, Kind k) const {
     if (sym.traced)
       printTraceSymbol(*this, sym.getName());
     sym.file = file;
     sym.type = type;
     sym.binding = binding;
     sym.stOther = (stOther & ~3) | sym.visibility();
     sym.symbolKind = k;
   }
 
 public:
   // True if this symbol is in the Iplt sub-section of the Plt and the Igot
   // sub-section of the .got.plt or .got.
   uint8_t isInIplt : 1;
 
   // True if this symbol needs a GOT entry and its GOT entry is actually in
   // Igot. This will be true only for certain non-preemptible ifuncs.
   uint8_t gotInIgot : 1;
 
   // True if defined relative to a section discarded by ICF.
   uint8_t folded : 1;
 
-  // True if a call to this symbol needs to be followed by a restore of the
-  // PPC64 toc pointer.
-  uint8_t needsTocRestore : 1;
+  // Allow reuse of a bit between architecture-exclusive symbol flags.
+  // - needsTocRestore(): On PPC64, true if a call to this symbol needs to be
+  //   followed by a restore of the toc pointer.
+  // - isTagged(): On AArch64, true if the symbol needs special relocation and
+  //   metadata semantics because it's tagged, under the AArch64 MemtagABI.
+  uint8_t archSpecificBit : 1;
+  bool needsTocRestore() const { return archSpecificBit; }
+  bool isTagged() const { return archSpecificBit; }
+  void setNeedsTocRestore(bool v) { archSpecificBit = v; }
+  void setIsTagged(bool v) {
+    archSpecificBit = v;
+  }
 
   // True if this symbol is defined by a symbol assignment or wrapped by --wrap.
   //
   // LTO shouldn't inline the symbol because it doesn't know the final content
   // of the symbol.
   uint8_t scriptDefined : 1;
 
   // True if defined in a DSO as protected visibility.

lld/ELF/SyntheticSections.h

 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLD_ELF_SYNTHETIC_SECTIONS_H
 #define LLD_ELF_SYNTHETIC_SECTIONS_H
 
 #include "Config.h"
 #include "InputSection.h"
+#include "Symbols.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/ADT/MapVector.h"
+#include "llvm/BinaryFormat/ELF.h"
 #include "llvm/MC/StringTableBuilder.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/Endian.h"
 #include "llvm/Support/Parallel.h"
 #include "llvm/Support/Threading.h"
 
 namespace lld::elf {
 class Defined;
public:
   void addAddendOnlyRelocIfNonPreemptible(RelType dynType, GotSection &sec,
                                           uint64_t offsetInSec, Symbol &sym,
                                           RelType addendRelType);
   template <bool shard = false>
   void addReloc(DynamicReloc::Kind kind, RelType dynType, InputSectionBase &sec,
                 uint64_t offsetInSec, Symbol &sym, int64_t addend, RelExpr expr,
                 RelType addendRelType) {
     // Write the addends to the relocated address if required. We skip
-    // it if the written value would be zero.
-    if (config->writeAddends && (expr != R_ADDEND || addend != 0))
+    // it if the written value would be zero. For tagged globals, we use the
+    // relocated place for a special addend, and so don't replace it here.
+    if (config->writeAddends && (expr != R_ADDEND || addend != 0) &&
+        !sym.isTagged())
       sec.addReloc({expr, addendRelType, offsetInSec, addend, &sym});
     addReloc<shard>({dynType, &sec, offsetInSec, kind, sym, addend, expr});
   }
   bool isNeeded() const override {
     return !relocs.empty() ||
            llvm::any_of(relocsVec, [](auto &v) { return !v.empty(); });
   }
   size_t getSize() const override { return relocs.size() * this->entsize; }

 public:
   PackageMetadataNote()
       : SyntheticSection(llvm::ELF::SHF_ALLOC, llvm::ELF::SHT_NOTE,
                          /*alignment=*/4, ".note.package") {}
   void writeTo(uint8_t *buf) override;
   size_t getSize() const override;
 };
 
+class MemtagDescriptors : public SyntheticSection {
+public:
+  MemtagDescriptors()
+      : SyntheticSection(llvm::ELF::SHF_ALLOC,
+                         llvm::ELF::SHT_AARCH64_MEMTAG_GLOBALS_DYNAMIC,
+                         /*alignment=*/ 4, ".memtag.globals.dynamic") {}
+  void writeTo(uint8_t *buf) override;
+  // The size of the section is non-computable until all addresses are
+  // synthetized, because the section's contents contain a sorted
+  // varint-compressed list of pointers to global variables. We only know the
+  // final size after `finalizeAddressDependentContent()`.
+  size_t getSize() const override;
+  bool updateAllocSize() override;
+
+  void addSymbol(const Symbol *sym) {
+    assert(sym && sym->isDefined());
+    symbols.push_back(sym);
+  }
+
+  bool isNeeded() const override {
+    return !config->isStatic && !symbols.empty();
+  }
+
+private:
+  std::vector<const Symbol *> symbols;
+};
+
 InputSection *createInterpSection();
 MergeInputSection *createCommentSection();
 template <class ELFT> void splitSections();
 void combineEhSections();
 
 template <typename ELFT> void writeEhdr(uint8_t *buf, Partition &part);
 template <typename ELFT> void writePhdrs(uint8_t *buf, Partition &part);
 
struct Partition {
   std::unique_ptr<StringTableSection> dynStrTab;
   std::unique_ptr<SymbolTableBaseSection> dynSymTab;
   std::unique_ptr<EhFrameHeader> ehFrameHdr;
   std::unique_ptr<EhFrameSection> ehFrame;
   std::unique_ptr<GnuHashTableSection> gnuHashTab;
   std::unique_ptr<HashTableSection> hashTab;
   std::unique_ptr<MemtagAndroidNote> memtagAndroidNote;
   std::unique_ptr<PackageMetadataNote> packageMetadataNote;
+  std::unique_ptr<MemtagDescriptors> memtagDescriptors;
   std::unique_ptr<RelocationBaseSection> relaDyn;
   std::unique_ptr<RelrBaseSection> relrDyn;
   std::unique_ptr<VersionDefinitionSection> verDef;
   std::unique_ptr<SyntheticSection> verNeed;
   std::unique_ptr<VersionTableSection> verSym;
 
   unsigned getNumber() const { return this - &partitions[0] + 1; }
 };

lld/ELF/SyntheticSections.cpp

if (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI)
       addInt(DT_AARCH64_BTI_PLT, 0);
     if (config->zPacPlt)
       addInt(DT_AARCH64_PAC_PLT, 0);
 
     if (config->androidMemtagMode != ELF::NT_MEMTAG_LEVEL_NONE) {
       addInt(DT_AARCH64_MEMTAG_MODE, config->androidMemtagMode == NT_MEMTAG_LEVEL_ASYNC);
       addInt(DT_AARCH64_MEMTAG_HEAP, config->androidMemtagHeap);
       addInt(DT_AARCH64_MEMTAG_STACK, config->androidMemtagStack);
+      if (mainPart->memtagDescriptors && mainPart->memtagDescriptors->getSize()) {
+        addInSec(DT_AARCH64_MEMTAG_GLOBALS, *mainPart->memtagDescriptors);
+        addInt(DT_AARCH64_MEMTAG_GLOBALSSZ, mainPart->memtagDescriptors->getSize());
+      }
     }
   }
 
   addInSec(DT_SYMTAB, *part.dynSymTab);
   addInt(DT_SYMENT, sizeof(Elf_Sym));
   addInSec(DT_STRTAB, *part.dynStrTab);
   addInt(DT_STRSZ, part.dynStrTab->getSize());
   if (!config->zText)
memcpy(buf + 16, config->packageMetadata.data(),
          config->packageMetadata.size());
 }
 
 size_t PackageMetadataNote::getSize() const {
   return sizeof(llvm::ELF::Elf64_Nhdr) + 4 +
          alignTo(config->packageMetadata.size() + 1, 4);
 }
 
+// Helper function, return the size of the ULEB128 for 'v', optionally writing
+// it to `*(buf + offset)` if `buf` is non-null.
+static size_t computeOrWriteULEB128(uint64_t v, uint8_t *buf, size_t offset) {
+  if (buf)
+    return encodeULEB128(v, buf + offset);
+  return getULEB128Size(v);
+}
+
+// https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#83encoding-of-sht_aarch64_memtag_globals_dynamic
+constexpr uint64_t kMemtagStepSizeBits = 3;
+constexpr uint64_t kMemtagGranuleSize = 16;
+static size_t createMemtagDescriptors(const std::vector<const Symbol *> &symbols,
+                                      uint8_t *buf = nullptr) {
+  size_t sectionSize = 0;
+  uint64_t lastGlobalEnd = 0;
+
+  for (const auto &sym : symbols) {
+    if (!includeInSymtab(*sym))
+      continue;
+    const uint64_t vAddr = sym->getVA();
+    const uint64_t size = sym->getSize();
+
+    if (vAddr <= kMemtagGranuleSize && buf != nullptr)
+      error("address of the tagged symbol \"" + sym->getName() +
+            "\" falls in the ELF header. This is indicative of a "
+            "compiler/linker bug.");
+    if (vAddr % kMemtagGranuleSize != 0)
+      error("address of the tagged symbol \"" + sym->getName() + "\" at 0x" +
+            Twine::utohexstr(vAddr) + "\" is not granule (16-byte) aligned");
+    if (size == 0)
+      error("size of the tagged symbol \"" + sym->getName() + "\" at 0x" +
+            Twine::utohexstr(vAddr) + "\" is not allowed to be zero");
+    if (size % kMemtagGranuleSize != 0)
+      error("size of the tagged symbol \"" + sym->getName() + "\" at 0x" +
+            Twine::utohexstr(vAddr) + "\" (size 0x" + Twine::utohexstr(size) +
+            ") is not granule (16-byte) aligned");
+
+    const uint64_t sizeToEncode = size / kMemtagGranuleSize;
+    const uint64_t stepToEncode = ((vAddr - lastGlobalEnd) / kMemtagGranuleSize) << kMemtagStepSizeBits;
+    if (sizeToEncode < (1 << kMemtagStepSizeBits)) {
+      sectionSize += computeOrWriteULEB128(stepToEncode | sizeToEncode, buf, sectionSize);
+    } else {
+      sectionSize += computeOrWriteULEB128(stepToEncode, buf, sectionSize);
+      sectionSize += computeOrWriteULEB128(sizeToEncode - 1, buf, sectionSize);
+    }
+    lastGlobalEnd = vAddr + size;
+  }
+
+  return sectionSize;
+}
+
+bool MemtagDescriptors::updateAllocSize() {
+  size_t oldSize = getSize();
+  std::sort(symbols.begin(), symbols.end(),
+            [](const Symbol *s1, const Symbol *s2) {
+              return s1->getVA() < s2->getVA();
+            });
+  return oldSize != getSize();
+}
+
+void MemtagDescriptors::writeTo(uint8_t *buf) {
+  createMemtagDescriptors(symbols, buf);
+}
+
+size_t MemtagDescriptors::getSize() const {
+  return createMemtagDescriptors(symbols);
+}
+
 InStruct elf::in;
 
 std::vector<Partition> elf::partitions;
 Partition *elf::mainPart;
 
 template GdbIndexSection *GdbIndexSection::create<ELF32LE>();
 template GdbIndexSection *GdbIndexSection::create<ELF32BE>();
 template GdbIndexSection *GdbIndexSection::create<ELF64LE>();
 template GdbIndexSection *GdbIndexSection::create<ELF64BE>();
 
 template void elf::splitSections<ELF32LE>();
 template void elf::splitSections<ELF32BE>();

lld/ELF/Thunks.cpp

void PPC64PltCallStub::writeTo(uint8_t *buf) {
   // Save the TOC pointer to the save-slot reserved in the call frame.
   write32(buf + 0, 0xf8410018); // std     r2,24(r1)
   writePPC64LoadAndBranch(buf + 4, offset);
 }
 
 void PPC64PltCallStub::addSymbols(ThunkSection &isec) {
   Defined *s = addSymbol(saver().save("__plt_" + destination.getName()),
                          STT_FUNC, 0, isec);
-  s->needsTocRestore = true;
+  s->setNeedsTocRestore(true);
   s->file = destination.file;
 }
 
 bool PPC64PltCallStub::isCompatibleWith(const InputSection &isec,
                                         const Relocation &rel) const {
   return rel.type == R_PPC64_REL24 || rel.type == R_PPC64_REL14;
 }
 
const int64_t offsetFromTOC =
         getPPC64TocBase();
     writePPC64LoadAndBranch(buf + 4, offsetFromTOC);
   }
 }
 
 void PPC64R2SaveStub::addSymbols(ThunkSection &isec) {
   Defined *s = addSymbol(saver().save("__toc_save_" + destination.getName()),
                          STT_FUNC, 0, isec);
-  s->needsTocRestore = true;
+  s->setNeedsTocRestore(true);
 }
 
 bool PPC64R2SaveStub::isCompatibleWith(const InputSection &isec,
                                        const Relocation &rel) const {
   return rel.type == R_PPC64_REL24 || rel.type == R_PPC64_REL14;
 }
 
 void PPC64R12SetupStub::writeTo(uint8_t *buf) {

lld/ELF/Writer.h

 template <class ELFT> uint32_t calcMipsEFlags();
 
 uint8_t getMipsFpAbiFlag(uint8_t oldFlag, uint8_t newFlag,
                          llvm::StringRef fileName);
 
 bool isMipsN32Abi(const InputFile *f);
 bool isMicroMips();
 bool isMipsR6();
+bool includeInSymtab(const Symbol &b);
 } // namespace lld::elf
 
 #endif

lld/ELF/Writer.cpp

for (Partition &part : partitions) {
     part.dynSymTab =
         std::make_unique<SymbolTableSection<ELFT>>(*part.dynStrTab);
     part.dynamic = std::make_unique<DynamicSection<ELFT>>();
 
     if (config->emachine == EM_AARCH64 &&
         config->androidMemtagMode != ELF::NT_MEMTAG_LEVEL_NONE) {
       part.memtagAndroidNote = std::make_unique<MemtagAndroidNote>();
       add(*part.memtagAndroidNote);
+      part.memtagDescriptors = std::make_unique<MemtagDescriptors>();
+      add(*part.memtagDescriptors);
     }
 
     if (config->androidPackDynRelocs)
       part.relaDyn = std::make_unique<AndroidPackedRelocationSection<ELFT>>(
           relaDynName, threadCount);
     else
       part.relaDyn = std::make_unique<RelocationSection<ELFT>>(
           relaDynName, config->zCombreloc, threadCount);
static bool shouldKeepInSymtab(const Defined &sym) {
   //   the assembler keeping the .L symbol.
   if (sym.getName().starts_with(".L") &&
       (config->discard == DiscardPolicy::Locals ||
        (sym.section && (sym.section->flags & SHF_MERGE))))
     return false;
   return true;
 }
 
-static bool includeInSymtab(const Symbol &b) {
+bool lld::elf::includeInSymtab(const Symbol &b) {
   if (auto *d = dyn_cast<Defined>(&b)) {
     // Always include absolute symbols.
     SectionBase *sec = d->section;
     if (!sec)
       return true;
 
     if (auto *s = dyn_cast<MergeInputSection>(sec))
       return s->getSectionPiece(d->value).live;
for (;;) {
 
     if (in.mipsGot)
       in.mipsGot->updateAllocSize();
 
     for (Partition &part : partitions) {
       changed |= part.relaDyn->updateAllocSize();
       if (part.relrDyn)
         changed |= part.relrDyn->updateAllocSize();
+      if (part.memtagDescriptors)
+        changed |= part.memtagDescriptors->updateAllocSize();
     }
 
     const Defined *changedSym = script->assignAddresses();
     if (!changed) {
       // Some symbols may be dependent on section addresses. When we break the
       // loop, the symbol values are finalized because a previous
       // assignAddresses() finalized section addresses.
       if (!changedSym)

lld/test/ELF/Inputs/aarch64-memtag-globals.s

+#--- input_1.s
+## Generated with:
+##
+##  - clang <input_file.c> -fsanitize=memtag-globals -O2 -S -fPIC -o - \
+##          --target=aarch64-linux-android31 -fno-asynchronous-unwind-tables
+##
+## <input_file.c> contents:
+##
+##    /// Global variables defined here, of various semantics.
+##    char global[30] = {};
+##    __attribute__((no_sanitize("memtag"))) int global_untagged = 0;
+##    const int const_global = 0;
+##    static const int hidden_const_global = 0;
+##    static char hidden_global[12] = {};
+##    __attribute__((visibility("hidden"))) int hidden_attr_global = 0;
+##    __attribute__((visibility("hidden"))) const int hidden_attr_const_global = 0;
+##    
+##    /// Should be untagged.
+##    __thread int tls_global;
+##    __thread static int hidden_tls_global;
+##    
+##    /// Tagged, from the other file.
+##    extern int global_extern;
+##    /// Untagged, from the other file.
+##    extern __attribute__((no_sanitize("memtag"))) int global_extern_untagged;
+##    /// Tagged, but from a different DSO (i.e. not this or the sister objfile).
+##    extern int global_extern_outside_this_dso;
+##    /// Tagged here (because it's non-const), but untagged in the definition found
+##    /// in the sister objfile as it's marked as const there.
+##    extern int global_extern_const_definition_but_nonconst_import;
+##    /// Tagged here, but untagged in the definition found in the sister objfile
+##    /// (explicitly).
+##    extern int global_extern_untagged_definition_but_tagged_import;
+##    
+##    /// ABS64 relocations. Also, forces symtab entries for local and external
+##    /// globals.
+##    char *pointer_to_global = &global[0];
+##    char *pointer_inside_global = &global[17];
+##    char *pointer_to_global_end = &global[30];
+##    char *pointer_past_global_end = &global[48];
+##    int *pointer_to_global_untagged = &global_untagged;
+##    const int *pointer_to_const_global = &const_global;
+##    /// RELATIVE relocations.
+##    const int *pointer_to_hidden_const_global = &hidden_const_global;
+##    char *pointer_to_hidden_global = &hidden_global[0];
+##    const int *pointer_to_hidden_attr_global = &hidden_attr_global;
+##    const int *pointer_to_hidden_attr_const_global = &hidden_attr_const_global;
+##    /// RELATIVE relocations with special AArch64 MemtagABI semantics, with the
+##    /// offset ('12' or '16') encoded in the place.
+##    char *pointer_to_hidden_global_end = &hidden_global[12];
+##    char *pointer_past_hidden_global_end = &hidden_global[16];
+##    /// ABS64 relocations.
+##    int *pointer_to_global_extern = &global_extern;
+##    int *pointer_to_global_extern_untagged = &global_extern_untagged;
+##    int *pointer_to_global_extern_outside_this_dso = &global_extern_outside_this_dso;
+##    int *pointer_to_global_extern_const_definition_but_nonconst_import =
+##        &global_extern_const_definition_but_nonconst_import;
+##    int *pointer_to_global_extern_untagged_definition_but_tagged_import =
+##        &global_extern_untagged_definition_but_tagged_import;
+##    
+##    int *get_address_to_tls_global() { return &tls_global; }
+##    int *get_address_to_hidden_tls_global() { return &hidden_tls_global; }
+
+  .text
+  .file "a.c"
+  .globl  get_address_to_tls_global       // -- Begin function get_address_to_tls_global
+  .p2align  2
+  .type get_address_to_tls_global,@function
+get_address_to_tls_global:              // @get_address_to_tls_global
+// %bb.0:                               // %entry
+  stp  x29, x30, [sp, #-16]!           // 16-byte Folded Spill
+  mov x29, sp
+  adrp  x0, :tlsdesc:tls_global
+  ldr  x1, [x0, :tlsdesc_lo12:tls_global]
+  add x0, x0, :tlsdesc_lo12:tls_global
+  .tlsdesccall tls_global
+  blr x1
+  mrs x8, TPIDR_EL0
+  add x0, x8, x0
+  ldp  x29, x30, [sp], #16             // 16-byte Folded Reload
+  ret
+.Lfunc_end0:
+  .size get_address_to_tls_global, .Lfunc_end0-get_address_to_tls_global
+                                        // -- End function
+  .globl  get_address_to_hidden_tls_global // -- Begin function get_address_to_hidden_tls_global
+  .p2align  2
+  .type get_address_to_hidden_tls_global,@function
+get_address_to_hidden_tls_global:       // @get_address_to_hidden_tls_global
+// %bb.0:                               // %entry
+  stp  x29, x30, [sp, #-16]!           // 16-byte Folded Spill
+  mov x29, sp
+  adrp  x0, :tlsdesc:hidden_tls_global
+  ldr  x1, [x0, :tlsdesc_lo12:hidden_tls_global]
+  add x0, x0, :tlsdesc_lo12:hidden_tls_global
+  .tlsdesccall hidden_tls_global
+  blr x1
+  mrs x8, TPIDR_EL0
+  add x0, x8, x0
+  ldp  x29, x30, [sp], #16             // 16-byte Folded Reload
+  ret
+.Lfunc_end1:
+  .size get_address_to_hidden_tls_global, .Lfunc_end1-get_address_to_hidden_tls_global
+                                        // -- End function
+  .memtag global                          // @global
+  .type global,@object
+  .bss
+  .globl  global
+  .p2align  4, 0x0
+global:
+  .zero 32
+  .size global, 32
+
+  .type global_untagged,@object         // @global_untagged
+  .globl  global_untagged
+  .p2align  2, 0x0
+global_untagged:
+  .word 0                               // 0x0
+  .size global_untagged, 4
+
+  .type const_global,@object            // @const_global
+  .section  .rodata,"a",@progbits
+  .globl  const_global
+  .p2align  2, 0x0
+const_global:
+  .word 0                               // 0x0
+  .size const_global, 4
+
+  .hidden hidden_attr_global              // @hidden_attr_global
+  .memtag hidden_attr_global
+  .type hidden_attr_global,@object
+  .bss
+  .globl  hidden_attr_global
+  .p2align  4, 0x0
+hidden_attr_global:
+  .zero 16
+  .size hidden_attr_global, 16
+
+  .hidden hidden_attr_const_global        // @hidden_attr_const_global
+  .type hidden_attr_const_global,@object
+  .section  .rodata,"a",@progbits
+  .globl  hidden_attr_const_global
+  .p2align  2, 0x0
+hidden_attr_const_global:
+  .word 0                               // 0x0
+  .size hidden_attr_const_global, 4
+
+  .memtag pointer_to_global               // @pointer_to_global
+  .type pointer_to_global,@object
+  .data
+  .globl  pointer_to_global
+  .p2align  4, 0x0
+pointer_to_global:
+  .xword  global
+  .zero 8
+  .size pointer_to_global, 16
+
+  .memtag pointer_inside_global           // @pointer_inside_global
+  .type pointer_inside_global,@object
+  .globl  pointer_inside_global
+  .p2align  4, 0x0
+pointer_inside_global:
+  .xword  global+17
+  .zero 8
+  .size pointer_inside_global, 16
+
+  .memtag pointer_to_global_end           // @pointer_to_global_end
+  .type pointer_to_global_end,@object
+  .globl  pointer_to_global_end
+  .p2align  4, 0x0
+pointer_to_global_end:
+  .xword  global+30
+  .zero 8
+  .size pointer_to_global_end, 16
+
+  .memtag pointer_past_global_end         // @pointer_past_global_end
+  .type pointer_past_global_end,@object
+  .globl  pointer_past_global_end
+  .p2align  4, 0x0
+pointer_past_global_end:
+  .xword  global+48
+  .zero 8
+  .size pointer_past_global_end, 16
+
+  .memtag pointer_to_global_untagged      // @pointer_to_global_untagged
+  .type pointer_to_global_untagged,@object
+  .globl  pointer_to_global_untagged
+  .p2align  4, 0x0
+pointer_to_global_untagged:
+  .xword  global_untagged
+  .zero 8
+  .size pointer_to_global_untagged, 16
+
+  .memtag pointer_to_const_global         // @pointer_to_const_global
+  .type pointer_to_const_global,@object
+  .globl  pointer_to_const_global
+  .p2align  4, 0x0
+pointer_to_const_global:
+  .xword  const_global
+  .zero 8
+  .size pointer_to_const_global, 16
+
+  .type hidden_const_global,@object     // @hidden_const_global
+  .section  .rodata,"a",@progbits
+  .p2align  2, 0x0
+hidden_const_global:
+  .word 0                               // 0x0
+  .size hidden_const_global, 4
+
+  .memtag pointer_to_hidden_const_global  // @pointer_to_hidden_const_global
+  .type pointer_to_hidden_const_global,@object
+  .data
+  .globl  pointer_to_hidden_const_global
+  .p2align  4, 0x0
+pointer_to_hidden_const_global:
+  .xword  hidden_const_global
+  .zero 8
+  .size pointer_to_hidden_const_global, 16
+
+  .memtag hidden_global                   // @hidden_global
+  .type hidden_global,@object
+  .local  hidden_global
+  .comm hidden_global,16,16
+  .memtag pointer_to_hidden_global        // @pointer_to_hidden_global
+  .type pointer_to_hidden_global,@object
+  .globl  pointer_to_hidden_global
+  .p2align  4, 0x0
+pointer_to_hidden_global:
+  .xword  hidden_global
+  .zero 8
+  .size pointer_to_hidden_global, 16
+
+  .memtag pointer_to_hidden_attr_global   // @pointer_to_hidden_attr_global
+  .type pointer_to_hidden_attr_global,@object
+  .globl  pointer_to_hidden_attr_global
+  .p2align  4, 0x0
+pointer_to_hidden_attr_global:
+  .xword  hidden_attr_global
+  .zero 8
+  .size pointer_to_hidden_attr_global, 16
+
+  .memtag pointer_to_hidden_attr_const_global // @pointer_to_hidden_attr_const_global
+  .type pointer_to_hidden_attr_const_global,@object
+  .globl  pointer_to_hidden_attr_const_global
+  .p2align  4, 0x0
+pointer_to_hidden_attr_const_global:
+  .xword  hidden_attr_const_global
+  .zero 8
+  .size pointer_to_hidden_attr_const_global, 16
+
+  .memtag pointer_to_hidden_global_end    // @pointer_to_hidden_global_end
+  .type pointer_to_hidden_global_end,@object
+  .globl  pointer_to_hidden_global_end
+  .p2align  4, 0x0
+pointer_to_hidden_global_end:
+  .xword  hidden_global+12
+  .zero 8
+  .size pointer_to_hidden_global_end, 16
+
+  .memtag pointer_past_hidden_global_end  // @pointer_past_hidden_global_end
+  .type pointer_past_hidden_global_end,@object
+  .globl  pointer_past_hidden_global_end
+  .p2align  4, 0x0
+pointer_past_hidden_global_end:
+  .xword  hidden_global+16
+  .zero 8
+  .size pointer_past_hidden_global_end, 16
+
+  .memtag global_extern
+  .memtag pointer_to_global_extern        // @pointer_to_global_extern
+  .type pointer_to_global_extern,@object
+  .globl  pointer_to_global_extern
+  .p2align  4, 0x0
+pointer_to_global_extern:
+  .xword  global_extern
+  .zero 8
+  .size pointer_to_global_extern, 16
+
+  .memtag pointer_to_global_extern_untagged // @pointer_to_global_extern_untagged
+  .type pointer_to_global_extern_untagged,@object
+  .globl  pointer_to_global_extern_untagged
+  .p2align  4, 0x0
+pointer_to_global_extern_untagged:
+  .xword  global_extern_untagged
+  .zero 8
+  .size pointer_to_global_extern_untagged, 16
+
+  .memtag global_extern_outside_this_dso
+  .memtag pointer_to_global_extern_outside_this_dso // @pointer_to_global_extern_outside_this_dso
+  .type pointer_to_global_extern_outside_this_dso,@object
+  .globl  pointer_to_global_extern_outside_this_dso
+  .p2align  4, 0x0
+pointer_to_global_extern_outside_this_dso:
+  .xword  global_extern_outside_this_dso
+  .zero 8
+  .size pointer_to_global_extern_outside_this_dso, 16
+
+  .memtag global_extern_const_definition_but_nonconst_import
+  .memtag pointer_to_global_extern_const_definition_but_nonconst_import // @pointer_to_global_extern_const_definition_but_nonconst_import
+  .type pointer_to_global_extern_const_definition_but_nonconst_import,@object
+  .globl  pointer_to_global_extern_const_definition_but_nonconst_import
+  .p2align  4, 0x0
+pointer_to_global_extern_const_definition_but_nonconst_import:
+  .xword  global_extern_const_definition_but_nonconst_import
+  .zero 8
+  .size pointer_to_global_extern_const_definition_but_nonconst_import, 16
+
+  .memtag global_extern_untagged_definition_but_tagged_import
+  .memtag pointer_to_global_extern_untagged_definition_but_tagged_import // @pointer_to_global_extern_untagged_definition_but_tagged_import
+  .type pointer_to_global_extern_untagged_definition_but_tagged_import,@object
+  .globl  pointer_to_global_extern_untagged_definition_but_tagged_import
+  .p2align  4, 0x0
+pointer_to_global_extern_untagged_definition_but_tagged_import:
+  .xword  global_extern_untagged_definition_but_tagged_import
+  .zero 8
+  .size pointer_to_global_extern_untagged_definition_but_tagged_import, 16
+
+  .type tls_global,@object              // @tls_global
+  .section  .tbss,"awT",@nobits
+  .globl  tls_global
+  .p2align  2, 0x0
+tls_global:
+  .word 0                               // 0x0
+  .size tls_global, 4
+
+  .type hidden_tls_global,@object       // @hidden_tls_global
+  .p2align  2, 0x0
+hidden_tls_global:
+  .word 0                               // 0x0
+  .size hidden_tls_global, 4
+
+  .ident  "clang version 17.0.0 (https://github.com/llvm/llvm-project.git 6130c9df99a7a7eb9c6adc118a48f8f2acc534ab)"
+  .section  ".note.GNU-stack","",@progbits
+
+#--- input_2.s
+## Generated with:
+##
+##  - clang <input_file.c> -fsanitize=memtag-globals -O2 -S -o - \
+##          --target=aarch64-linux-android31 -fno-asynchronous-unwind-tables
+##
+## <input_file.c> contents:
+##
+##     int global_extern;
+##     static int global_extern_hidden;
+##     __attribute__((no_sanitize("memtag"))) int global_extern_untagged;
+##     const int global_extern_const_definition_but_nonconst_import;
+##     __attribute__((no_sanitize(
+##         "memtag"))) int global_extern_untagged_definition_but_tagged_import;
+##
+
+  .text
+  .file "b.c"
+  .memtag global_extern
+  .type global_extern,@object
+  .bss
+  .globl  global_extern
+  .p2align  4, 0x0
+global_extern:
+  .zero 16
+  .size global_extern, 16
+
+  .type global_extern_untagged,@object
+  .globl  global_extern_untagged
+  .p2align  2, 0x0
+global_extern_untagged:
+  .word 0
+  .size global_extern_untagged, 4
+
+  .type global_extern_const_definition_but_nonconst_import,@object
+  .section  .rodata,"a",@progbits
+  .globl  global_extern_const_definition_but_nonconst_import
+  .p2align  2, 0x0
+global_extern_const_definition_but_nonconst_import:
+  .word 0
+  .size global_extern_const_definition_but_nonconst_import, 4
+
+  .type global_extern_untagged_definition_but_tagged_import,@object
+  .bss
+  .globl  global_extern_untagged_definition_but_tagged_import
+  .p2align  2, 0x0
+global_extern_untagged_definition_but_tagged_import:
+  .word 0
+  .size global_extern_untagged_definition_but_tagged_import, 4
+

lld/test/ELF/aarch64-memtag-android-abi.s

 # STACK-NEXT:   Stack: Enabled
 # NOSTACK-NEXT: Stack: Disabled
 
 # RUN: not ld.lld -shared --android-memtag-mode=asymm --android-memtag-heap 2>&1 | \
 # RUN:    FileCheck %s --check-prefix=BAD-MODE
 # BAD-MODE: error: unknown --android-memtag-mode value: "asymm", should be one of
 # BAD-MODE: {async, sync, none}
 
-# RUN: not ld.lld -shared --android-memtag-mode=async 2>&1 | \
-# RUN:    FileCheck %s --check-prefix=MISSING-STACK-OR-HEAP
-# MISSING-STACK-OR-HEAP: error: when using --android-memtag-mode, at least one of
-# MISSING-STACK-OR-HEAP: --android-memtag-heap or --android-memtag-stack is required
-
 .globl _start
 _start:
   ret

lld/test/ELF/aarch64-memtag-globals.s

+# REQUIRES: aarch64
+
+# RUN: split-file %S/Inputs/aarch64-memtag-globals.s %t
+# RUN: llvm-mc --filetype=obj -triple=aarch64-none-linux-android \
+# RUN:   %t/input_1.s -o %t1.o
+# RUN: llvm-mc --filetype=obj -triple=aarch64-none-linux-android \
+# RUN:   %t/input_2.s -o %t2.o
+# RUN: ld.lld -shared --android-memtag-mode=sync %t1.o %t2.o -o %t.so
+
+## Normally relocations are printed before the symbol tables, so reorder it a
+## bit to make it easier on matching addresses of relocations up with the
+## symbols.
+# RUN: llvm-readelf %t.so -s > %t.out
+# RUN: llvm-readelf %t.so --section-headers --relocs --memtag >> %t.out
+# RUN: cat %t.out | FileCheck %s
+# RUN: llvm-objdump -Dz %t.so | FileCheck %s --check-prefix=CHECK-SPECIAL-RELOCS
+
+# CHECK: Symbol table '.dynsym' contains
+# CHECK-DAG: {{0*}}[[GLOBAL:[0-9a-f]+]] 32 OBJECT GLOBAL DEFAULT {{.*}} global{{$}}
+# CHECK-DAG: {{0*}}[[GLOBAL_UNTAGGED:[0-9a-f]+]] 4 OBJECT GLOBAL DEFAULT {{.*}} global_untagged{{$}}
+# CHECK-DAG: {{0*}}[[CONST_GLOBAL:[0-9a-f]+]] 4 OBJECT GLOBAL DEFAULT {{.*}} const_global{{$}}
+# CHECK-DAG: {{0*}}[[GLOBAL_EXTERN:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} global_extern{{$}}
+# CHECK-DAG: {{0*}}[[GLOBAL_EXTERN_UNTAGGED:[0-9a-f]+]] 4 OBJECT GLOBAL DEFAULT {{.*}} global_extern_untagged{{$}}
+# CHECK-DAG: 0 NOTYPE GLOBAL DEFAULT {{.*}} global_extern_outside_this_dso{{$}}
+# CHECK-DAG: {{0*}}[[GLOBAL_EXTERN_CONST_DEFINITION_BUT_NONCONST_IMPORT:[0-9a-f]+]] 4 OBJECT GLOBAL DEFAULT {{.*}} global_extern_untagged_definition_but_tagged_import{{$}}
+# CHECK-DAG: {{0*}}[[GLOBAL_EXTERN_UNTAGGED_DEFINITION_BUT_TAGGED_IMPORT:[0-9a-f]+]] 4 OBJECT GLOBAL DEFAULT {{.*}} global_extern_const_definition_but_nonconst_import{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_GLOBAL:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_global{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_INSIDE_GLOBAL:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_inside_global{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_GLOBAL_END:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_global_end{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_PAST_GLOBAL_END:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_past_global_end{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_GLOBAL_UNTAGGED:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_global_untagged{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_CONST_GLOBAL:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_const_global{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_HIDDEN_CONST_GLOBAL:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_hidden_const_global{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_HIDDEN_GLOBAL:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_hidden_global{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_HIDDEN_GLOBAL_END:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_hidden_global_end{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_PAST_HIDDEN_GLOBAL_END:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_past_hidden_global_end{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_HIDDEN_ATTR_GLOBAL:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_hidden_attr_global{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_HIDDEN_ATTR_CONST_GLOBAL:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_hidden_attr_const_global{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_GLOBAL_EXTERN:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_global_extern{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_GLOBAL_EXTERN_UNTAGGED:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_global_extern_untagged{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_GLOBAL_EXTERN_OUTSIDE_THIS_DSO:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_global_extern_outside_this_dso{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_GLOBAL_EXTERN_CONST_DEFINITION_BUT_NONCONST_IMPORT:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_global_extern_const_definition_but_nonconst_import{{$}}
+# CHECK-DAG: {{0*}}[[POINTER_TO_GLOBAL_EXTERN_UNTAGGED_DEFINITION_BUT_TAGGED_IMPORT:[0-9a-f]+]] 16 OBJECT GLOBAL DEFAULT {{.*}} pointer_to_global_extern_untagged_definition_but_tagged_import{{$}}
+
+# CHECK: Symbol table '.symtab' contains
+# CHECK-DAG: {{0*}}[[HIDDEN_CONST_GLOBAL:[0-9a-f]+]] 4 OBJECT LOCAL DEFAULT {{.*}} hidden_const_global{{$}}
+# CHECK-DAG: {{0*}}[[#%x,HIDDEN_GLOBAL:]] 16 OBJECT LOCAL DEFAULT {{.*}} hidden_global{{$}}
+# CHECK-DAG: {{0*}}[[HIDDEN_ATTR_GLOBAL:[0-9a-f]+]] 16 OBJECT LOCAL HIDDEN {{.*}} hidden_attr_global{{$}}
+# CHECK-DAG: {{0*}}[[HIDDEN_ATTR_CONST_GLOBAL:[0-9a-f]+]] 4 OBJECT LOCAL HIDDEN {{.*}} hidden_attr_const_global{{$}}
+
+# CHECK: Section Headers:
+# CHECK: .memtag.globals.dynamic AARCH64_MEMTAG_GLOBALS_DYNAMIC
+# CHECK-NOT: .memtag.globals.static
+# CHECK-NOT: AARCH64_MEMTAG_GLOBALS_STATIC
+
+# CHECK: Relocation section '.rela.dyn'
+# CHECK-DAG: [[POINTER_TO_GLOBAL]] {{.*}} R_AARCH64_ABS64 {{.*}} global + 0
+# CHECK-DAG: [[POINTER_INSIDE_GLOBAL]] {{.*}} R_AARCH64_ABS64 {{.*}} global + 11
+# CHECK-DAG: [[POINTER_TO_GLOBAL_END]] {{.*}} R_AARCH64_ABS64 {{.*}} global + 1e
+# CHECK-DAG: [[POINTER_PAST_GLOBAL_END]] {{.*}} R_AARCH64_ABS64 {{.*}} global + 30
+# CHECK-DAG: [[POINTER_TO_GLOBAL_UNTAGGED]] {{.*}} R_AARCH64_ABS64 {{.*}} global_untagged + 0
+# CHECK-DAG: [[POINTER_TO_CONST_GLOBAL]] {{.*}} R_AARCH64_ABS64 {{.*}} const_global + 0
+
+## RELATIVE relocations.
+# CHECK-DAG: [[POINTER_TO_HIDDEN_CONST_GLOBAL]] {{.*}} R_AARCH64_RELATIVE {{0*}}[[HIDDEN_CONST_GLOBAL]]
+# CHECK-DAG: [[POINTER_TO_HIDDEN_GLOBAL]] {{.*}} R_AARCH64_RELATIVE {{0*}}[[#HIDDEN_GLOBAL]]
+
+## AArch64 MemtagABI special RELATIVE relocation semantics, where the offset is encoded in the place.
+# CHECK-DAG: [[POINTER_TO_HIDDEN_GLOBAL_END]] {{.*}} R_AARCH64_RELATIVE {{0*}}[[#HIDDEN_GLOBAL + 12]]
+# CHECK-SPECIAL-RELOCS: <pointer_to_hidden_global_end>:
+# CHECK-SPECIAL-RELOCS-NEXT: .word 0x00000000
+# CHECK-SPECIAL-RELOCS-NEXT: .word 0x00000000
+# CHECK-DAG: [[POINTER_PAST_HIDDEN_GLOBAL_END]] {{.*}} R_AARCH64_RELATIVE {{0*}}[[#HIDDEN_GLOBAL + 16]]
+# CHECK-SPECIAL-RELOCS: <pointer_past_hidden_global_end>:
+# CHECK-SPECIAL-RELOCS-NEXT: .word 0xfffffff0
+# CHECK-SPECIAL-RELOCS-NEXT: .word 0xffffffff
+
+## More ABS64 relocations.
+# CHECK-DAG: [[POINTER_TO_GLOBAL_EXTERN]] {{.*}} R_AARCH64_ABS64 {{.*}} global_extern + 0
+# CHECK-DAG: [[POINTER_TO_GLOBAL_EXTERN_UNTAGGED]] {{.*}} R_AARCH64_ABS64 {{.*}} global_extern_untagged + 0
+# CHECK-DAG: [[POINTER_TO_GLOBAL_EXTERN_OUTSIDE_THIS_DSO]] {{.*}} R_AARCH64_ABS64 {{.*}} global_extern_outside_this_dso + 0
+# CHECK-DAG: [[POINTER_TO_GLOBAL_EXTERN_CONST_DEFINITION_BUT_NONCONST_IMPORT]] {{.*}} R_AARCH64_ABS64 {{.*}} global_extern_const_definition_but_nonconst_import + 0
+# CHECK-DAG: [[POINTER_TO_GLOBAL_EXTERN_UNTAGGED_DEFINITION_BUT_TAGGED_IMPORT]] {{.*}} R_AARCH64_ABS64 {{.*}} global_extern_untagged_definition_but_tagged_import + 0
+
+# CHECK: Memtag Dynamic Entries
+# CHECK: AARCH64_MEMTAG_MODE: Synchronous (0)
+# CHECK: AARCH64_MEMTAG_HEAP: Disabled (0)
+# CHECK: AARCH64_MEMTAG_STACK: Disabled (0)
+# CHECK: AARCH64_MEMTAG_GLOBALS: {{.*[1-9a-f]+}}
+# CHECK: AARCH64_MEMTAG_GLOBALSSZ: 23
+
+# CHECK: Memtag Android Note
+# CHECK: Tagging Mode: SYNC
+# CHECK: Heap: Disabled
+# CHECK: Stack: Disabled
+
+# CHECK: Memtag Global Descriptors:
+# CHECK-NOT: 0x[[GLOBAL_UNTAGGED]]:
+# CHECK-NOT: 0x[[CONST_GLOBAL]]:
+# CHECK-NOT: 0x[[HIDDEN_CONST_GLOBAL]]:
+# CHECK-NOT: 0x[[GLOBAL_EXTERN_UNTAGGED]]:
+# CHECK-NOT: 0x[[GLOBAL_EXTERN_CONST_DEFINITION_BUT_NONCONST_IMPORT]]:
+# CHECK-NOT: 0x[[GLOBAL_EXTERN_UNTAGGED_DEFINITION_BUT_TAGGED_IMPORT]]:
+
+## Global variable order hopefully isn't too brittle of a test here, but this allows us to make sure
+## that we have all the global variables we expect, and no more.
+# CHECK: 0x[[POINTER_TO_GLOBAL]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_INSIDE_GLOBAL]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_GLOBAL_END]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_PAST_GLOBAL_END]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_GLOBAL_UNTAGGED]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_CONST_GLOBAL]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_HIDDEN_CONST_GLOBAL]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_HIDDEN_GLOBAL]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_HIDDEN_ATTR_GLOBAL]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_HIDDEN_ATTR_CONST_GLOBAL]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_HIDDEN_GLOBAL_END]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_PAST_HIDDEN_GLOBAL_END]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_GLOBAL_EXTERN]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_GLOBAL_EXTERN_UNTAGGED]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_GLOBAL_EXTERN_OUTSIDE_THIS_DSO]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_GLOBAL_EXTERN_CONST_DEFINITION_BUT_NONCONST_IMPORT]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[POINTER_TO_GLOBAL_EXTERN_UNTAGGED_DEFINITION_BUT_TAGGED_IMPORT]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[GLOBAL]]: 0x20
+# CHECK-NOT: 0x
+# CHECK: 0x[[HIDDEN_ATTR_GLOBAL]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[#HIDDEN_GLOBAL]]: 0x10
+# CHECK-NOT: 0x
+# CHECK: 0x[[GLOBAL_EXTERN]]: 0x10
+# CHECK-NOT: 0x