Introduce `RemoteAddressSpaceView` and `VMReadContext`.

[delcypher]

Summary

RemoteAddressSpaceView is the remote memory counter part to
LocalAddressSpaceView that implements the AddressSpaceView
interface.

The RemoteAddressSpaceView implementation is a simple wrapper around a
VMReadContext object. A VMReadContext object implements the platform
specific code to

• Read memory from another process.
• Cache those reads and manage the cache lifetime.
• Manage the writability of the cached memory.

Two implementations are provided:

• A Darwin only implementation that allows in-process and out-of-process

reads. The reads are cached by a Darwin specific framework
(CoreSymbolication) and thus the VMReadContext implementation does not
implement a cache.

• A non-Darwin implementation that only allows in-process reads

(basically a no-op). This exists only for testing purposes.

Tests for this functionality will be added in later patches.

rdar://problem/45284065

[delcypher]

Fix some comments.

[kristina]

Would it make sense to also extend this to Linux using process_vm_readv/process_vm_writev?

[delcypher]

In D56206#1344618, @kristina wrote:

Would it make sense to also extend this to Linux using process_vm_readv/process_vm_writev?

Perhaps, but certainly not in this patch because I consider that out of scope. On Darwin we already have tools that will be using the new functionality, on Linux the tools don't exist yet. So implementing VMReadContext for Darwin is much more useful at this time.
The interface should be generic enough that we could add Linux support in the future.

[delcypher]

@kcc @vitalybuka Ping.

[vitalybuka]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

28

Why all these stuff needs to be static?

[delcypher]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

28

@vitalybuka Because the allocators don't receive an instance of RemoteAddressSpaceView, they receive the type as a template parameter (e.g. SizeClassAllocator64). This design choice means that everything in an implementation of the AddressSpaceView interface (i.e. LocalAddressSpaceView and RemoteAddressSpaceView) needs to be static.

To implement RemoteAddressSpaceView we have to store some state. All of this state and the read operations are encapsulated in the VMReadContext object. We cannot store any of this state inside the allocators because that could change the data-layout.

This design is not thread-safe of course but for allocator enumeration on Darwin will only ever be doing that in a single thread anyway.

[vitalybuka]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

28

Can you add some CHECKs validate this single thread assumption?

lib/sanitizer_common/sanitizer_vm_read_context.h

28

could you please init these inline?

[vitalybuka]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

26

struct -> class

69

maybe nested: ScopedRemoteAddressSpaceViewContext -> RemoteAddressSpaceView::ScopedContest
and make RemoteAddressSpaceView::set_context private

69

class and
private:

VMReadContext vmrc_;

lib/sanitizer_common/sanitizer_vm_read_context.h

25

Just define "typedef int ProcessHandle;" and remove process_vm_read_handle_t
On other platforms it does not matter, and we will add more specific type if needed later.

32

historically sanitizer common uses Google C++ naming convention so members need to have _ suffux.

51

Please remove all stuff you are not using in upcoming patches.
When can extend API when needed

74

If you can calculate it from target_process please remove member and simplify state

94

As I understand we do not expect a lot of context callers
so let remove default "writable = true" and make calls more verbose

lib/sanitizer_common/sanitizer_vm_read_context_common.cc

20 ↗

(On Diff #179889)

Remove it if you don't use it.
I'd expected ScopedContext is the why to reset it.

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

43

Just remove it. You'll add it when needed

[delcypher]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

26

LocalAddressSpaceView is a struct. Making RemoteAddressSpaceView be a class seems inconsistent. Why do you want to make this change?

28

Can you add some CHECKs validate this single thread assumption?

@vitalybuka

I don't see an easy way to do this because this code will be used in a context where there is no ThreadRegistry and there is no interception on pthread_create and other thread functions. I also couldn't see a non-asan specific (e.g. I found AsanThread* GetCurrentThread()) API to use because this code will be common to all sanitizers.

There are also examples of existing code that don't check the single thread assumption. E.g. from lib/asan/asan_thread.cc

ThreadRegistry &asanThreadRegistry() {
  static bool initialized;
  // Don't worry about thread_safety - this should be called when there is
  // a single thread.
...

I'm not against adding some sort of check to validate the single thread assumption but I need more guidance on how to do this using the available sanitizer internal APIs.

69

maybe nested: ScopedRemoteAddressSpaceViewContext -> RemoteAddressSpaceView::ScopedContest

and make RemoteAddressSpaceView::set_context private

That's a great idea. I'll do that.

lib/sanitizer_common/sanitizer_vm_read_context.h

25

Apart from that fact that it needs to be unsigned on Darwin. I'm not super comfortable doing that because the declaration of __sanitizer::process_vm_read_handle_t in sanitizer_internal_defs.h allows to detect if the system declaration of task_t disagrees with the Sanitizer runtimes type. This is because on Darwin we include system headers that do define the task_t type.

28

Yes. I'll do that.

32

I'll try to fix that.

51

I'll have a look through my out-of-tree implementation and see what I can remove.

94

Sure.

lib/sanitizer_common/sanitizer_vm_read_context_common.cc

20 ↗

(On Diff #179889)

Reset() gets called if the read call fails. Although I've just realised that's actually inconsistent with the API comments. I'll fix that.

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

43

By "it" I presume you mean that writable argument?

But if I do that, how far up the stack should I go? Taken to the extreme that means reverting what was landed in https://reviews.llvm.org/D54879 . I really don't want to do that because the distinction between writable and read-only access is likely important.

[delcypher]

Lots of clean-up.

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context.h

74

We cannot calculate it. It needs to be part of the sate.

[delcypher]

• Remote fields/methods in VMReadContext that won't be used.
• Remove default writable=true argument.

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context.h

51

I've removed several fields/methods from this patch that weren't being used in my internal implementation.

[delcypher]

@vitalybuka I've fixed what I can and I've left questions about things that aren't straightforward to fix or that I don't agree with. When you have time could you take another look?

[vitalybuka]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

26

Historically sanitizers follow google c++ style and class is more appropriate here
https://google.github.io/styleguide/cppguide.html#Structs_vs._Classes

as well for LocalAddressSpaceView

28

what about saving GetTid() on the first call of set_context()
then check that saved id matches GetTid() for all subsequent calls to
set_context()
get_context()
Load*()

I assume this is not going to be main thread?

68

same for class

lib/sanitizer_common/sanitizer_vm_read_context.h

31

please init target_process_ to something target_process_ as well

[vitalybuka]

lib/sanitizer_common/sanitizer_vm_read_context.h

18

empty live between define and include

25

then just define process_vm_read_handle_t as task_t in sanitizer_internal_defs for Darwin?

43

why copying is not acceptable?

74

We cannot calculate it. It needs to be part of the sate.

I read this as:

bool IsLocal() const {
  return config_ == nullptr || mach_task_self() == target_process_;
}

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

29

can you remove "config" argument and just initialize config_ to darwin specific stuff here?

30

if we keep it please remove {} for consistency

43

It still looks like better to split Read and ReadWriteble when we have different implementation for them.
So If you have/expect such patch quite soon, then fine, let's keep it. If this is just expectation that some-when in undefined future we will likely need to spit them, then I'd prefer we split when it's actually necessary.

51

why do we need config_?
from here looks like you expect a particular function
could you call it directly here?

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context.h

31

Not doing inline initialisation here is deliberate. The type is platform specific so we might not be able to initialise it using an int. This is why the platform specific constructors do the initialisation.

Technically we could initialise to 0 now because task_t happens to be a typedef for unsigned on Darwin but this might not work for other platforms in the future.

43

Because a VMReadContext object is supposed to manage the lifetime of memory it copies from another. The implementation might hold data structures to manage this memory and so copying a VMReadContext object is almost certainly a mistake.

For the Darwin implementation VMReadContext delegates this task to a Darwin specific framework that guarantees the lifetime of the copied memory will be longer than its client (VMReadContext). So technically nothing would go wrong right now if the VMReadContext copy constructor was called. However calling the VMReadContext is almost certainly a mistake and so it should be disallowed.

74

bool IsLocal() const {
 return config_ == nullptr || mach_task_self() == target_process_;
}

Oh I see. I thought you where talking about GetTargetProcess(). However in this latest revision IsLocal() has actually been removed because my internal implementation never called it.

I can probably bring it back though.

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

29

No. On Darwin config is a function pointer but on other platforms it can be anything (that's why it has type void*) that's needed to get access to the target process's memory. The config argument must be there to provide a consistent and flexible interface on all platforms.

There is no special function we can call from inside VMReadContext to get the function pointer. The client creating the VMReadContext on Darwin knows the value of the pointer and must pass it in.

30

Ok. I'll fix this.

51

No we cannot. It must be passed in via the VMReadContext constructor.

[delcypher]

Minor tweaks.

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context.h

18

Fixed.

32

Fixed.

74

I've brought the implementation back and removed the is_local_ field.

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

30

Done.

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context.h

25

I tried doing this in my internal implementation. It breaks compilation because sanitizer_internal_defs gets included very early and task_t at that point is not defined. Let's just keep it.

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

43

Using the read-only/writable information will land much later so I'm going to remove passing this information to VMReadContext.

[delcypher]

• Check thread id
• Use atomic variables

[delcypher]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

28

Okay I've added the thread check. I don't know if this code will be called on the main thread or not. Presumably that's irrelevant here?

[delcypher]

@vitalybuka I've done another pass over the patch and fixed everything I reasonably could. Please make another pass when you have time.

[vitalybuka]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

25

includes are not ordered

33

Why did you obfuscate context type?
There is not point in atomic if you are going to use single thread
maybe OK for owning_tid_ but we will crash immediately if this does not match

51

probably you should check if owning_tid_ is already set that they match

58

Please avoid reinterpret_cast, just return VMReadContext* as member

lib/sanitizer_common/sanitizer_vm_read_context.h

31

Maybe platform specific invalid_vm_read_handle near process_vm_read_handle_t?
also process_vm_read_handle_t is too specific, why not just some task_id?

43

"operator=" ?

48

(void*) -> reinterpret_cast<>

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

51

Instead of void* can you make it function pointer?
With type similar to memory_reader_t
If you make memory_reader_t return bool and handle error there, the only platform specific part of VMReadContext will be the callback.

also config_ -> native_reader_;

[delcypher]

Rebase on master and adopt new license headers.

[delcypher]

• Revert back to plain VMReadContext*
• Check owning_tid_ in set_context()
• Delete more methods from VMReadContext.

[delcypher]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

25

Oops. Good catch. Fixed.

33

Originally I did that because I was going to make this a DCHECK and I didn't want it to be possible for the pointer to change non-atomically. You're right though. Now that the CHECK happens in all builds I should just use VMContext*.

I've fixed this now.

51

That would require that I guarantee that owning_tid is 0 initially (i.e. before RemoteAddressSpaceView is ever used). I think this might already be the case because atomic_uint64_t RemoteAddressSpaceView::owning_tid is a global but I wasn't 100% sure. I wasn't sure how I was supposed to write an initializer for the global in sanitizer_remote_address_space_view.cc so I just left it out.

If we can confidently assume that owning_tid_ is zero initialized then I'll add the check.

I've gone ahead and made the fix. Seems to work.

lib/sanitizer_common/sanitizer_vm_read_context.h

43

That would also be bad. I've deleted that and also the move variants.

[delcypher]

• Remove C-style cast.

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context.h

48

Fixed.

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

51

Instead of void* can you make it function pointer?
With type similar to memory_reader_t
If you make memory_reader_t return bool and handle error there, the only platform specific part of VMReadContext will be the callback.

I could but I'm strongly against that because.

• A function pointer isn't great. It can't hold any state. Even in Darwin's case I'd have to write a wrapper function that implements the callback interface. That function needs to know the address of the actual function to call. So the callback would need to be able to receive arbitrary data (i.e. passing a void*) so I could pass that address.
• Having a function pointer encourages implementations to actually live outside of VMReadContext. This is the opposite of what VMReadContext() tries to do -- Hide as much platform specific behaviour as possible inside VMReadContext. It is a Darwin specific implementation detail that we have to pass a function pointer to VMReadContext, other platforms should not be forced to do that in-order to write their implementations. They should be able to pass whatever makes sense for their platform.
• On other platforms the interface may need to work differently. More parameters might need to be passed to the reader. In this case the void* would be a pointer to a struct containing the extra data needed by the platform.
• It ties the design of VMReadContext very closely to Darwin's memory_reader_t.

Besides, I could probably achieve the non-platform specific error handling simplify by refactoring Read(...) into the platform agnostic part Read(...) and the platform specific part ReadImpl(...).

I think we could clean up the interface in a better way. Instead of a void* argument to the constructor it could be

VMReadContextConfig* which would be

class VMReadContextConfig {
   public:
    __sanitizer::process_vm_read_handle_t target_process;
};

Then other platforms could sub-class this and add their own platform specific fields. For Darwin we'd add a function pointer field so that the Darwin specific function pointer can be passed.

That way

• At most one argument needs to be passed VMReadContext
• It allows for platform specific implementations in a way that's slightly more type safe than void*.
• We can pass arbitrary data to be passed to VMReadContext.
  
  We don't have RTTI or LLVM's dyn_cast so we would have to statically cast inside each implementation to the expected VMReadContextConfig sub-class.

[vitalybuka]

lib/sanitizer_common/CMakeLists.txt

48

Please return )

lib/sanitizer_common/sanitizer_remote_address_space_view.h

57

So data race is possible when one thread is releasing context and another is setting.
For simplicity I think you should never reset owning_tid_
As soon as one thread used it, no other allowed to interact with that.

Otherwise we need to design proper synchronization which is inconvenient with all these statics. E.g. as soon someone called Load and saved returned pointer
we will need to make sure that caller release the pointers before letting other threads to interact with context.

And maybe it's not bad idea. But you have option to go with "never reset owning_tid_" now and switch to Load/Unload with mutexes later, when needed.

58

Nothing prevents one thread to create ScopedContext and another thread to do LoadWritable. We need to check owning_tid_ in Load and LoadWritable

103

: vmrc() is not needed

lib/sanitizer_common/sanitizer_vm_read_context.h

31

Maybe platform specific invalid_vm_read_handle near process_vm_read_handle_t?
also process_vm_read_handle_t is too specific, why not just some task_id?

I still think you should remove process_vm_read_handle_t from sanitizer_internal_defs.h and just define it in the Context. u64 everywhere, like for tid_t, is good enough for me.

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

57

bool VMReadContext::IsLocal() const {
  return config_ == nullptr || mach_task_self() == target_process_;
}

[delcypher]

lib/sanitizer_common/sanitizer_remote_address_space_view.h

57

So data race is possible when one thread is releasing context and another is setting.
For simplicity I think you should never reset owning_tid_
As soon as one thread used it, no other allowed to interact with that.

I'm fine with that. Currently RemoteAddressSpaceView should only be used within a single-thread.

I'll update the patch as you suggest.

58

Did I miss something? Won't the CHECK_EQ(atomic_load_relaxed(&owning_tid_), current_tid) fire inside get_context() fire due to LoadWritable() or Load() eventually triggering a call to get_context()?

[delcypher]

• Add extra return in CMakeLists.txt.
• Only allow for owning_tid_ to be set once.
• Clean up IsLocal() darwin implementation.

[delcypher]

Add VMReadContextConfig to simplify usage of VMReadContext.

[delcypher]

Fix typo.

[delcypher]

lib/sanitizer_common/sanitizer_vm_read_context_config.h

1 ↗

(On Diff #183152)

@vitalybuka I had a go at adding VMReadContextConfig (see the header file below). The advantage of this is I'm able to pull the definition of task_t out of sanitizer_internal_defs.h and make the constructor of VMReadContextConfig a little nicer by not having it take a void*.

[delcypher]

Fix lint issues.

[delcypher]

Fix comments so the VMReadContext::Read() actually complies
in the case we are doing local reads.

[delcypher]

Tweaks.

[vitalybuka]

Removing stale patches from the "Ready to Review" list.

lib/sanitizer_common/CMakeLists.txt

set(SANITIZER_SOURCES_NOTERMINATION
   sanitizer_platform_limits_solaris.cc
   sanitizer_posix.cc
   sanitizer_printf.cc
   sanitizer_procmaps_common.cc
   sanitizer_procmaps_bsd.cc
   sanitizer_procmaps_linux.cc
   sanitizer_procmaps_mac.cc
   sanitizer_procmaps_solaris.cc
+  sanitizer_remote_address_space_view.cc
   sanitizer_rtems.cc
   sanitizer_solaris.cc
   sanitizer_stoptheworld_mac.cc
   sanitizer_suppressions.cc
   sanitizer_tls_get_addr.cc
   sanitizer_thread_registry.cc
   sanitizer_type_traits.cc
+  sanitizer_vm_read_context_mac.cc
+  sanitizer_vm_read_context_stubs.cc
   sanitizer_win.cc
   )
 
 if(UNIX AND NOT APPLE AND NOT OS_NAME MATCHES "SunOS")
   list(APPEND SANITIZER_SOURCES_NOTERMINATION
     sanitizer_linux_x86_64.S)
   list(APPEND SANITIZER_SOURCES_NOTERMINATION
     sanitizer_linux_mips64.S)
 endif()
 
 set(SANITIZER_SOURCES
   ${SANITIZER_SOURCES_NOTERMINATION} sanitizer_termination.cc)
set(SANITIZER_IMPL_HEADERS
   sanitizer_platform_interceptors.h
   sanitizer_platform_limits_netbsd.h
   sanitizer_platform_limits_openbsd.h
   sanitizer_platform_limits_posix.h
   sanitizer_platform_limits_solaris.h
   sanitizer_posix.h
   sanitizer_procmaps.h
   sanitizer_quarantine.h
+  sanitizer_remote_address_space_view.h
   sanitizer_report_decorator.h
   sanitizer_ring_buffer.h
   sanitizer_rtems.h
   sanitizer_signal_interceptors.inc
   sanitizer_stackdepot.h
   sanitizer_stackdepotbase.h
   sanitizer_stacktrace.h
   sanitizer_stacktrace_printer.h
   sanitizer_stoptheworld.h
   sanitizer_suppressions.h
   sanitizer_symbolizer.h
   sanitizer_symbolizer_fuchsia.h
   sanitizer_symbolizer_internal.h
   sanitizer_symbolizer_libbacktrace.h
   sanitizer_symbolizer_mac.h
   sanitizer_symbolizer_rtems.h
   sanitizer_syscall_generic.inc
   sanitizer_syscall_linux_aarch64.inc
   sanitizer_syscall_linux_arm.inc
   sanitizer_syscall_linux_x86_64.inc
   sanitizer_syscalls_netbsd.inc
   sanitizer_thread_registry.h
   sanitizer_tls_get_addr.h
   sanitizer_vector.h
+  sanitizer_vm_read_context.h
   sanitizer_win.h
   sanitizer_win_defs.h
   sanitizer_win_dll_thunk.h
   sanitizer_win_weak_interception.h
   )
 
 include_directories(..)
 

lib/sanitizer_common/sanitizer_internal_defs.h

 typedef int error_t;
 #endif
 #if SANITIZER_SOLARIS && !defined(_LP64)
 typedef long pid_t;
 #else
 typedef int pid_t;
 #endif
 
+// process_vm_read_handle_t is a platform specific type used by a platform to
+// read memory from another process.
+#if SANITIZER_MAC
+typedef unsigned int task_t;
+typedef task_t process_vm_read_handle_t;
+#else
+// Stub value for other platforms.
+typedef int process_vm_read_handle_t;
+#endif
+
 #if SANITIZER_FREEBSD || SANITIZER_NETBSD || \
     SANITIZER_OPENBSD || SANITIZER_MAC || \
     (SANITIZER_SOLARIS && (defined(_LP64) || _FILE_OFFSET_BITS == 64)) || \
     (SANITIZER_LINUX && defined(__x86_64__))
 typedef u64 OFF_T;
 #else
 typedef uptr OFF_T;
 #endif

lib/sanitizer_common/sanitizer_remote_address_space_view.h

+//===-- sanitizer_remote_address_space_view.h -------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// `RemoteAddressSpaceView` provides a remote implementation of the
+// `AddressSpaceView` interface which provides a simple interface to load memory
+// from another process (i.e. out-of-process).
+//
+// This implementation relies on an `VMReadContext` object to do the actual
+// work.
+//
+// Note that `RemoteAddressSpaceView` assumes it used exclusively from a
+// a single thread.
+//===----------------------------------------------------------------------===//
+#ifndef SANITIZER_REMOTE_ADDRES_SPACE_VIEW_H
+#define SANITIZER_REMOTE_ADDRES_SPACE_VIEW_H
+
+#include "sanitizer_atomic.h"
+#include "sanitizer_common.h"
+#include "sanitizer_internal_defs.h"
+#include "sanitizer_vm_read_context.h"
+
+namespace __sanitizer {
+
+class RemoteAddressSpaceView {
+ private:
+  static VMReadContext* vmrc_;
+  static atomic_uint64_t owning_tid_;
+  static void* internal_read(uptr target_address, uptr size) {
+    VMReadContext* vmrc = get_context();
+    CHECK_NE(vmrc, nullptr);
+    if (size == 0) {
+      // Don't error out because this code path can be hit
+      // in legitimate cases. Just return a nullptr and assume
+      // that any attempt to read from this address (or nearby it)
+      // will trigger a segfault.
+      return 0;
+    }
+    bool success = vmrc->Read(target_address, size);
+    CHECK(success);
+    return vmrc->GetLocalAddress();
+  }
+
+  // Set the `VMReadContext` object. Note once this function is called
+  // from a thread, all subsequent uses of RemoteAddressSpaceView
+  // must be performed by that same thread.
+  static void set_context(VMReadContext* ctx) {
+    tid_t current_tid = GetTid();
+    static_assert(sizeof(atomic_uint64_t) == sizeof(tid_t), "Size mismatch");
+    tid_t owning_tid = atomic_load_relaxed(&owning_tid_);
+    DCHECK_NE(current_tid, 0);
+    // We assume `owning_tid_` is zero initialized and that thread ID 0 is not a
+    // valid thread ID. This assumption lets us skip the check the first time
+    // `set_context(...)` is called, but have the check performed for all
+    // subsequent calls.
+    if (owning_tid)
+      CHECK_EQ(owning_tid, current_tid);
+    vmrc_ = ctx;
+    atomic_store_relaxed(&owning_tid_, current_tid);
+  }
+
+ public:
+  static VMReadContext* get_context() {
+    CHECK_EQ(atomic_load_relaxed(&owning_tid_), GetTid());
+    return vmrc_;
+  }
+
+  // TODO(dliew): `Load` and `LoadWritable` use same implementation for now
+  // because all VMReadContext implementations currently give back writable
+  // memory. In the future some platforms may require us to make the distinction
+  // between writable and read-only memory. We might also be able to make use of
+  // this information to optimize memory accesses on some platforms.
+
+  // See LocalAddressSpaceView for a description of the semantics of this
+  // function.
+  template <typename T>
+  static const T* Load(const T* target_address, uptr num_elements = 1) {
+    return reinterpret_cast<const T*>(internal_read(
+        reinterpret_cast<uptr>(target_address), sizeof(T) * num_elements));
+  }
+
+  // See LocalAddressSpaceView for a description of the semantics of this
+  // function.
+  template <typename T>
+  static T* LoadWritable(T* target_address, uptr num_elements = 1) {
+    return reinterpret_cast<T*>(internal_read(
+        reinterpret_cast<uptr>(target_address), sizeof(T) * num_elements));
+  }
+
+  // RAII style wrapper that holds the storage for a VMContext object
+  // and whilst alive has `RemoteAddressSpaceView` use that VMContext
+  // object.
+  class ScopedContext {
+   private:
+    VMReadContext vmrc;
+
+   public:
+    ScopedContext(void* config, VMReadContext::ProcessHandle target_process)
+        : vmrc(config, target_process) {
+      RemoteAddressSpaceView::set_context(&vmrc);
+    }
+    ScopedContext() : vmrc() {
+      RemoteAddressSpaceView::set_context(&vmrc);
+    }
+    ~ScopedContext() {
+      CHECK_EQ(RemoteAddressSpaceView::get_context(), &vmrc);
+      RemoteAddressSpaceView::set_context(nullptr);
+    }
+  };
+};
+
+}  // namespace __sanitizer
+
+#endif

lib/sanitizer_common/sanitizer_remote_address_space_view.cc

+//===-- sanitizer_remote_address_space_view.cc ------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+//
+//===----------------------------------------------------------------------===//
+#include "sanitizer_remote_address_space_view.h"
+
+namespace __sanitizer {
+
+VMReadContext* RemoteAddressSpaceView::vmrc_ = nullptr;
+atomic_uint64_t RemoteAddressSpaceView::owning_tid_;
+
+}

lib/sanitizer_common/sanitizer_vm_read_context.h

+//===-- sanitizer_vm_read_context.h -----------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// `VMReadContext` is a low-level abstraction the allows clients to read the
+// memory of a target process.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef SANITIZER_VM_READ_CONTEXT_H
+#define SANITIZER_VM_READ_CONTEXT_H
+#include "sanitizer_internal_defs.h"
+#include "sanitizer_platform.h"
+
+namespace __sanitizer {
+
+class VMReadContext {
+ public:
+  typedef __sanitizer::process_vm_read_handle_t ProcessHandle;
+
+ private:
+  uptr local_address_ = 0;
+  void* config_ = 0;
+  ProcessHandle target_process_;
+
+ public:
+  // Out-of-process mode constructor
+  //
+  // `config` - A pointer to platform specific data needed for set up.
+  // `target_process` - A platform specific handle to the target process.
+  VMReadContext(void* config, ProcessHandle target_process);
+
+  // In-process mode constructor
+  VMReadContext();
+
+  // Prevent moving/copying.
+  VMReadContext(const VMReadContext&) = delete;
+  VMReadContext(const VMReadContext&&) = delete;
+  VMReadContext& operator=(const VMReadContext&) = delete;
+  VMReadContext& operator=(const VMReadContext&&) = delete;
+
+  // Return the address to memory in the current process that
+  // is a copy of memory from the target process.
+  //
+  // Returns `nullptr` if no successful read has been performed.
+  void* GetLocalAddress() const {
+    return reinterpret_cast<void*>(local_address_);
+  }
+
+  // Return the platform specific handle to the target process.
+  ProcessHandle GetTargetProcess() { return target_process_; }
+
+  // Read memory from a remote process. The memory will be accessible (only if
+  // the read operation succeeds) at the address pointed to by
+  // `GetLocalAddress()`. This memory can be assumed to be writable
+  // but writes made in the local process will not propagate to the
+  // target process.
+  //
+  // The lifetime of the memory allocated by the `Read()` can be assumed
+  // to be valid for the lifetime of the VMReadContext object.
+  //
+  // Returns `true` on a sucessful read and `false` otherwise.
+  bool Read(uptr target_address, u64 size);
+
+  // Returns true iff the `VMReadContext` object is configured
+  // to read memory from the local process (i.e. target and local
+  // process are the same).
+  bool IsLocal() const;
+};
+}  // namespace __sanitizer
+#endif

lib/sanitizer_common/sanitizer_vm_read_context_mac.cc

+//===-- sanitizer_vm_read_context_mac.cc ------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Implementation of `VMReadContext` for Apple platforms.
+//
+//===----------------------------------------------------------------------===//
+#include "sanitizer_platform.h"
+#if SANITIZER_MAC
+#include <mach/mach_init.h>
+#include "sanitizer_common.h"
+#include "sanitizer_libc.h"
+#include "sanitizer_vm_read_context.h"
+
+// Taken from <malloc/malloc.h>
+typedef kern_return_t memory_reader_t(task_t remote_task,
+                                      vm_address_t remote_address,
+                                      vm_size_t size, void** local_memory);
+
+namespace __sanitizer {
+
+VMReadContext::VMReadContext(void* config, ProcessHandle target_process)
+    : config_(config), target_process_(target_process) {}
+
+VMReadContext::VMReadContext() : VMReadContext(nullptr, mach_task_self()) {}
+
+bool VMReadContext::Read(uptr target_address, u64 size) {
+  if (IsLocal()) {
+    // The remote is the current process, copy isn't necessary.
+    local_address_ = target_address;
+    return true;
+  }
+  CHECK_NE(config_, nullptr);
+  CHECK_GT(size, 0);
+
+  uptr local_address = 0;
+  memory_reader_t* native_reader = (memory_reader_t*)config_;
+  kern_return_t result = native_reader(target_process_, target_address, size,
+                                       (void**)(&(local_address)));
+  if (result == KERN_SUCCESS) {
+    CHECK_NE(local_address, nullptr);
+    local_address_ = local_address;
+    return true;
+  }
+  Report("Failed to read %p of size %d from remote process. Error code: %d\n",
+         target_address, size, result);
+  return false;
+}
+
+bool VMReadContext::IsLocal() const {
+  return config_ == nullptr || mach_task_self() == target_process_;
+}
+
+}  // namespace __sanitizer
+
+#endif

lib/sanitizer_common/sanitizer_vm_read_context_stubs.cc

+//===-- sanitizer_vm_read_context_stubs.cc --------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Stub implementation of `VMReadContext` for non-Apple platforms.
+//
+//===----------------------------------------------------------------------===//
+#include "sanitizer_platform.h"
+#if !SANITIZER_MAC
+#include "sanitizer_common.h"
+#include "sanitizer_vm_read_context.h"
+
+namespace __sanitizer {
+
+VMReadContext::VMReadContext(void* config, ProcessHandle target_process)
+    : config_(config), target_process_(target_process) {
+  // Only in-process reading is allowed in
+  // stub implementation.
+  CHECK_EQ(config_, nullptr);
+  CHECK_EQ(target_process_, 0);
+}
+
+VMReadContext::VMReadContext() : VMReadContext(nullptr, 0) {}
+
+bool VMReadContext::Read(uptr target_address, u64 size) {
+  // Stub implementation should only ever
+  // do in-process read.
+  CHECK(isLocal());
+  local_address_ = target_address;
+  return true;
+}
+
+bool VMReadContext::IsLocal() const {
+  // Stub implementation only supports local (in-process) reads.
+  return true;
+}
+
+}  // namespace __sanitizer
+
+#endif