[lldb][AArch64] Add memory tag reading to lldb-server

[DavidSpickett]

Summary

This adds memory tag reading using the new "qMemTags"
packet and ptrace on AArch64 Linux.

This new packet is following the one used by GDB.
(https://sourceware.org/gdb/current/onlinedocs/gdb/General-Query-Packets.html)

On AArch64 Linux we use ptrace's PEEKMTETAGS to read
tags and we assume that lldb has already checked that the
memory region actually has tagging enabled.

We do not assume that lldb has expanded the requested range
to granules and expand it again to be sure.
(although lldb will be sending aligned ranges because it happens
to need them client side anyway)
Also we don't assume untagged addresses. So for AArch64 we'll
remove the top byte before using them. (the top byte includes
MTE and other non address data)

To do the ptrace read NativeProcessLinux will ask the native
register context for a memory tag manager based on the
type in the packet. This also gives you the ptrace numbers you need.
(it's called a register context but it also has non register data,
so it saves adding another per platform sub class)

The only supported platform for this is AArch64 Linux and the only
supported tag type is MTE allocation tags. Anything else will
error.

Ptrace can return a partial result but for lldb-server we will
be treating that as an error. To succeed we need to get all the tags
we expect.

(Note that the protocol leaves room for logical tags to be
read via qMemTags but this is not going to be implemented for lldb
at this time.)

[DavidSpickett]

This goes together with https://reviews.llvm.org/D95602, I've split them to make review more manageable.

@emaste I saw you were doing something in BSD land around MTE, if you see any blockers from that side of things please say. Otherwise just FYI. Obviously this first version is only doing Linux so out of the box it wouldn't work but I think the logic is generic enough to be moved around later to support BSD(s).

[omjavaid]

This patch looks quite neat overall I have a few minor questions, comments and suggestions.

1. To get the review going consider further splitting up these patches into separate chunks containing, for example MemoryTagHandler API and related unit tests, GDB remote addons, ptrace work etc. Also add reference to GDB mailing list discussion where design of qMemTag packet has been discussed.

2. Soft suggestion to rename MemoryTagHandler, IMO it sounds more like a routine rather than a set of helpers used for manipulating memory tags. Also lldb/include/lldb/Target doesnt seem like a good place for helper functions as MemoryTagHandler is not used as Memory Tag container class. May be consider putting it under source/Plugins/Process/Utility

3. Changes to lldb/packages/Python/lldbsuite/test/decorators.py look reasonable and can be committed right away with a small caveat.

Some other minor comments inline as well.

lldb/packages/Python/lldbsuite/test/decorators.py

825 ↗

(On Diff #319791)

Consider using Compiler instead of Toolchain to keep terminology consistent with rest of the code in this file.

858 ↗

(On Diff #319791)

Omit one space.

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1462

Do you think future architectures will have any different ptrace_read_req/ptrace_write_req than PTRACE_PEEKMTETAGS/PTRACE_POKEMTETAGS.

If not then there is is no advantage of putting them inside MemoryTaggingDetails

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux.h

62

Add comment about MemoryTaggingDetails

68

Can type be negative. Does gdb remote protocol specifies type as int32?

[DavidSpickett]

To get the review going consider further splitting up these patches into separate chunks containing, for example MemoryTagHandler API and related unit tests, GDB remote addons, ptrace work etc. Also add reference to GDB mailing list discussion where design of qMemTag packet has been discussed.

Will do. I erred on the side of larger patches so you could see the pieces connect in the same review.

Soft suggestion to rename MemoryTagHandler, IMO it sounds more like a routine rather than a set of helpers used for manipulating memory tags. Also lldb/include/lldb/Target doesnt seem like a good place for helper functions as MemoryTagHandler is not used as Memory Tag container class. May be consider putting it under source/Plugins/Process/Utility

How about "MemoryTagInterface"? It's very similar to a Java "interface" class.

I think my reasoning for putting the header in lldb/Target was because it's used in the client and the server, and one of them tends not to include from the latter location. I'll double check.

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1462

Given that "MTE" is in the name, I would think yes. (though they might end up being aliases to the same number)
I also want to avoid having AArch64 only (at the current time) constants in generic code.

[omjavaid]

In D95601#2563613, @DavidSpickett wrote:

To get the review going consider further splitting up these patches into separate chunks containing, for example MemoryTagHandler API and related unit tests, GDB remote addons, ptrace work etc. Also add reference to GDB mailing list discussion where design of qMemTag packet has been discussed.

Will do. I erred on the side of larger patches so you could see the pieces connect in the same review.

Soft suggestion to rename MemoryTagHandler, IMO it sounds more like a routine rather than a set of helpers used for manipulating memory tags. Also lldb/include/lldb/Target doesnt seem like a good place for helper functions as MemoryTagHandler is not used as Memory Tag container class. May be consider putting it under source/Plugins/Process/Utility

How about "MemoryTagInterface"? It's very similar to a Java "interface" class.

MemoryTagHandler class does indeed look like an interface class example of an interface class in LLDB code is RegisterInfosInterface which serves as an interface of varies arch dependent register infos. But MemoryTagHandler serves more like a provider or manager rather than a container

May be you can use MemoryTagManager or MemoryTagUtils but then this just a soft comment. You can keep the existing name or change it to interface or anything you feel appropriate.

I think my reasoning for putting the header in lldb/Target was because it's used in the client and the server, and one of them tends not to include from the latter location. I'll double check.

[DavidSpickett]

Split the patches into smaller changes. (see stack)

[DavidSpickett]

lldb/test/API/tools/lldb-server/memory-tagging/main.c

37

See https://developer.arm.com/documentation/101028/0012/10--Memory-tagging-intrinsics for in depth descriptions.

[omjavaid]

This looks good apart from minor nits inline

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1466

ptrace request is a success if number of tags requested is not equal to no of tags read? If not then this and following condition may be redundant.

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux_arm64.cpp

883

this piece needs to run clang-format

lldb/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationServerLLGS.cpp

3481

Just curious response starts with 'm'. Whats the design need for using m in qMemTags response?

lldb/test/API/tools/lldb-server/memory-tagging/TestGdbRemoteMemoryTagging.py

20

If skipUnlessAArch64MTELinuxCompiler can check for AArch64 and Linux then we wont need above two decorators.

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1466

Well ptracewrapper doesn't check the iovec, but I'll check the kernel source to see if it's actually possible for it to fail that way.

lldb/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationServerLLGS.cpp

3481

This is for future multi part replies ala qfThreadInfo (https://sourceware.org/gdb/current/onlinedocs/gdb/General-Query-Packets.html#General-Query-Packets). I'll add a comment with this too.

[DavidSpickett]

lldb/test/API/tools/lldb-server/memory-tagging/TestGdbRemoteMemoryTagging.py

20

I'll merge them into one (at least one you use in tests, separate functions). Also I just realised this is not checking that the remote supports MTE, only worked because I've been using the one qemu instance.

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1466

In linux/arch/arm64/kernel/mte.c __access_remote_tags there is a comment:

+/*
+ * Access MTE tags in another process' address space as given in mm. Update
+ * the number of tags copied. Return 0 if any tags copied, error otherwise.
+ * Inspired by __access_remote_vm().
+ */

*any tags* being the key words.

So the scenario is:

• ask to read from addr X in page 0, with length of pagesize+some so the range spills into page 1
• kernel can access page 0, reads tags until the end of the page
• tries to access page 1 to read the rest, fails, returns 0 (success) since *some* tags were read
• we see the ptrace call succeeded but with less tags than we expected

I don't see it's worth dealing with this corner case here since lldb will look before it leaps. It would have errored much earlier here because either page 1 isn't in the tracee's memory regions or it wasn't MTE enabled.

lldb/test/API/tools/lldb-server/memory-tagging/TestGdbRemoteMemoryTagging.py

20

On further consideration I don't think it's worth merging them. Sure we save 2 lines in each test but then anyone reading it is going to have to lookup what the combo does. I'd rather keep them listed like this for clarity (and later adding new platforms?).

Also I was wrong, the test does check for non MTE systems. If the tracee prints (nil) for the buffer, that means it's not an MTE system.
(we can't use the isAArch64MTE call in this type of test)

[DavidSpickett]

• Use RemoveNonAddressBits instead of RemoveLogicalTag
• Make the top byte of test buffer pointer non zero.

As noted, setting the top byte doesn't prove much
but it means if a future kernel gets more strict
we're already coping with that.

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1466

Added a comment in the code too.

[DavidSpickett]

• Comments for the MemoryTaggingDetails struct

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux.h

68

+@var{type} is the type of tag the request wants to fetch.  The type is a signed
+integer.

[omjavaid]

lldb/test/API/tools/lldb-server/memory-tagging/main.c

14

infinite loop in test program may not be a good idea.

[omjavaid]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1466

This means emitting less than requested number of tags is legit. However we have set tags vector size equal to whatever we have requested. We set error string which is actually not being used anywhere and can be removed in favor of a log message to help with debugging if needed.

Also we need to resize the vector after ptrace request so we use this size in gdb remote reply.

[omjavaid]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1454

is there a difference between Granule and GranuleSize?

lldb/test/API/tools/lldb-server/memory-tagging/TestGdbRemoteMemoryTagging.py

103

Do we test partial read case here?

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1454

Granule is used to mean the current Granule you're in. So if you were at address 0x10 you'd be in the [0x10,0x20) granule.
GranuleSize is the size of each granule.

If I saw manager->GetGranule I'd expect it to be something like std::pair<addr_t, addr_t> GetGranule(addr_t addr);.
As in, tell me which granule I'm in.

Though I admit this is more an issue of "ExpandToGranule" not being clear enough, rather than "GetGranuleSize" being too redunant.
AlignToGranule(s) perhaps? But then you ask "align how", hence "ExpandTo". Anyway.

1466

I'll log that error in in GDBRemoteCommunicationServerLLGS.cpp.

I'll do what you suggested to support partial read on the server side. Then lldb client can error if it doesn't get what it expected.
(testing partial reads on the lldb side is going to be very difficult anyway since we'd need a valid smaps entry to even issue one)

lldb/test/API/tools/lldb-server/memory-tagging/TestGdbRemoteMemoryTagging.py

103

Ack. No, but it should be a case of reading off of the end of the allocated buffer by some amount.

lldb/test/API/tools/lldb-server/memory-tagging/main.c

14

I'll check what the timeouts are on the expect packet sequence. I think it would get killed eventually if we didn't see the output we're looking for.
(I could do something more CPU friendly, sleep/halt/wait on something)

[omjavaid]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1454

Right I guess we can stay with current nomenclature. Thanks for detailed explanation.

1466

If we are following an approach similar to m/M gdb remote packets for tags then its ok to read partial data in case a part memory in requested address range was inaccessible. May be make appropriate adjustment for command output I dont recall what currently emit out for partial memory reads but should be something like <tags not available>

lldb/test/API/tools/lldb-server/memory-tagging/main.c

14

In past I have LLDB buildbot sometimes piling up excutables which python couldnt cleanup for whatever reason. Its better if executable can safely exit within a reasonable period.

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1466

I did some digging and lldb-server does not return partial data when a read fails.

for (bytes_read = 0; bytes_read < size; bytes_read += remainder) {
  Status error = NativeProcessLinux::PtraceWrapper(
      PTRACE_PEEKDATA, GetID(), (void *)addr, nullptr, 0, &data);
  if (error.Fail())
    return error;

  remainder = size - bytes_read;
  <...>
  dst += k_ptrace_word_size;
}
return Status();

I was able to test partial writes too. There too we don't attempt to restore if we only wrote a smaller amount, writing less than the total is a failure.

However, it is true that I'm not handling the syscall properly. I need to loop like readmemory does. So I'm going to do that.
Loop until we've read all tags, or return the error we get.

[omjavaid]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1466

Considering gdb remote protocol this is not complying with 'm' packet whick says:
"The reply may contain fewer addressable memory units than requested if the server was able to read only part of the region of memory."

May be we can fix this in a separate patch where LLDB should emit proper error code based on which either we can completely fail or send partial read data.
What do you think ?

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1466

That would be the ideal thing to do, however I was wrong about lldb not supporting it at all. In fact memory read can do partial results:

<step to clear caches>
(lldb) memory read 0x0000fffff7ff7000-16
lldb             <  34> send packet: $qMemoryRegionInfo:fffff7ff9010#df
lldb             <  55> read packet: $start:fffff7ff9000;size:1000;permissions:rw;flags:;#fa
lldb             <  50> send packet: $Mfffff7ff9010,f:000000000000000000000000000000#84
lldb             <   6> read packet: $OK#9a
lldb             <  34> send packet: $qMemoryRegionInfo:fffff7ff9010#df
lldb             <  55> read packet: $start:fffff7ff9000;size:1000;permissions:rw;flags:;#fa
lldb             <  36> send packet: $Mfffff7ff9010,8:0000000000000000#b6
lldb             <   6> read packet: $OK#9a
lldb             <  34> send packet: $qMemoryRegionInfo:fffff7ff9010#df
lldb             <  55> read packet: $start:fffff7ff9000;size:1000;permissions:rw;flags:;#fa
lldb             <  36> send packet: $Mfffff7ff9010,8:f06ffff7ffff0000#a9
lldb             <   6> read packet: $OK#9a
lldb             <  21> send packet: $xfffff7ff9000,200#00
lldb             < 516> read packet: $<512 bytes>#53
lldb             <  21> send packet: $xfffff7ff6e00,200#32
lldb             < 516> read packet: $<512 bytes>#0a
lldb             <  21> send packet: $xfffff7ff7000,200#fe    <<<< Fails to read the last 16 bytes
lldb             <   7> read packet: $E08#ad
0xfffff7ff6ff0: 01 02 03 04 00 00 00 00 00 00 00 00 00 00 00 00  ................
0xfffff7ff7000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
warning: Not all bytes (16/32) were able to be read from 0xfffff7ff6ff0.

Except we're not doing it by getting a smaller reply (not in this example anyway), it's working because we split up the reads in such a way that they tend to line up with the failing addresses.

So yeah it's probably worth fixing from a correctness point of view but for lldb to lldb-server we've got an equivalent already.

As for MTE would you be ok with not allowing partial reads, since the spec as proposed does not mention them?
(what I said before but just to be sure)

[DavidSpickett]

Correctly handle the ptrace call by looping until we
get all tags as an error.

I've gone ahead and treated anything anything less than all tags
as an error as far as lldb-server is concerned.

Tell me what you think of that.

[DavidSpickett]

lldb/test/API/tools/lldb-server/memory-tagging/TestGdbRemoteMemoryTagging.py

103

This has been added at the end of the tests here.

[DavidSpickett]

• Remove extra newline after test decorator

[DavidSpickett]

@omjavaid Current status is that a partial read of memory tags is converted into an error by lldb-server. I think this is justifiable given that the GDB protocol as it stands doesn't describe how to really communicate a partial read (though we could make a reasonable guess I'm sure). Plus, lldb itself will be looking ahead via memory regions so it won't issue things that would fail. (fail for reason of address range at least)

Sound good to you? I'll be applying the same logic to writing tags.

[DavidSpickett]

• Rebase onto main
• skipUnlessAArch64MTELinuxCompiler was committed already so not added here, just used by the new tests

[DavidSpickett]

Rebase onto main. (switch to m_current_process)

[DavidSpickett]

Rebase

[omjavaid]

it look good to me but I have some final minor nits inline.

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1458

may be rename to tags_iovec? because reading code below i had the tags vector in mind and confused it for that vector which was passed as parameter to this function.

1459

may be use tags.data() ?

1464

this loop condition is is a little fishy. num_tags is unsigned which means if by chance it doesnt end up going to zero we ll keep looping for ever.

lldb/test/API/tools/lldb-server/memory-tagging/main.c

54

Just a side question about TBI, for memroy reads/write or tags/query is it necessary to send non address bits to remote? (tags and pauth masks). Can we instead clear these bits before sending address over using the code/data masks we have calculated in our host process class.

[DavidSpickett]

lldb/test/API/tools/lldb-server/memory-tagging/main.c

54

You shouldn't need to include them as the stripped address is equivalent as far as ptrace is concerned.

If you were gonna JIT some code and use it to load from that address then yes we'd need the bits.

That said, I'm not sure lldb-server can make the assumption that they are stripped. At least for reading memory tags, I'll have to think about it since the protocol doesn't require the client to remove tag bits.

[DavidSpickett]

Address comments in general.

Added an assert in the loop where we call ptrace
so that we catch any unexpected condition that would
make it an infinite loop.

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

1464

I couldn't see another loop condition that made sense to use, so I've added an assert below:

assert(tags_read && (tags_read <= num_tags));

If num_tags was 0 we'd never enter the loop in the first place. Then we assert that if there was no error, the kernel returned at least 1 tag and no more tags than we asked for.

This should prevent num_tags wrapping around 0 and causing an infinite loop.

[pcc]

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux_arm64.cpp

15–16

[DavidSpickett]

Rebase, which brings in the header pcc mentioned.

[DavidSpickett]

I was looking at the wrong file, this adds the header.

[DavidSpickett]

Rebase

[DavidSpickett]

Rebase, this is now ready to land.

lldb/include/lldb/Host/common/NativeProcessProtocol.h

virtual Status GetMemoryRegionInfo(lldb::addr_t load_addr,
                                      MemoryRegionInfo &range_info);
 
   virtual Status ReadMemory(lldb::addr_t addr, void *buf, size_t size,
                             size_t &bytes_read) = 0;
 
   Status ReadMemoryWithoutTrap(lldb::addr_t addr, void *buf, size_t size,
                                size_t &bytes_read);
 
+  virtual Status ReadMemoryTags(int32_t type, lldb::addr_t addr, size_t len,
+                                std::vector<uint8_t> &tags);
+
   /// Reads a null terminated string from memory.
   ///
   /// Reads up to \p max_size bytes of memory until it finds a '\0'.
   /// If a '\0' is not found then it reads max_size-1 bytes as a string and a
   /// '\0' is added as the last character of the \p buffer.
   ///
   /// \param[in] addr
   ///     The address in memory to read from.

lldb/include/lldb/Host/linux/Ptrace.h

 #define PTRACE_ARCH_PRCTL 30
 #endif
 #ifndef ARCH_GET_FS
 #define ARCH_SET_GS 0x1001
 #define ARCH_SET_FS 0x1002
 #define ARCH_GET_FS 0x1003
 #define ARCH_GET_GS 0x1004
 #endif
+#ifndef PTRACE_PEEKMTETAGS
+#define PTRACE_PEEKMTETAGS 33
+#endif
+#ifndef PTRACE_POKEMTETAGS
+#define PTRACE_POKEMTETAGS 34
+#endif
 
 #define LLDB_PTRACE_NT_ARM_TLS 0x401 // ARM TLS register
 
 #endif // liblldb_Host_linux_Ptrace_h_

lldb/include/lldb/Utility/StringExtractorGDBRemote.h

enum ServerPacketType {
     eServerPacketType__m,
     eServerPacketType_notify, // '%' notification
 
     eServerPacketType_jLLDBTraceSupported,
     eServerPacketType_jLLDBTraceStart,
     eServerPacketType_jLLDBTraceStop,
     eServerPacketType_jLLDBTraceGetState,
     eServerPacketType_jLLDBTraceGetBinaryData,
+
+    eServerPacketType_qMemTags,
   };
 
   ServerPacketType GetServerPacketType() const;
 
   enum ResponseType { eUnsupported = 0, eAck, eNack, eError, eOK, eResponse };
 
   ResponseType GetResponseType() const;
 

lldb/source/Host/common/NativeProcessProtocol.cpp

 
 lldb_private::Status
 NativeProcessProtocol::GetMemoryRegionInfo(lldb::addr_t load_addr,
                                            MemoryRegionInfo &range_info) {
   // Default: not implemented.
   return Status("not implemented");
 }
 
+lldb_private::Status
+NativeProcessProtocol::ReadMemoryTags(int32_t type, lldb::addr_t addr,
+                                      size_t len, std::vector<uint8_t> &tags) {
+  return Status("not implemented");
+}
+
 llvm::Optional<WaitStatus> NativeProcessProtocol::GetExitStatus() {
   if (m_state == lldb::eStateExited)
     return m_exit_status;
 
   return llvm::None;
 }
 
 bool NativeProcessProtocol::SetExitStatus(WaitStatus status,

lldb/source/Plugins/Process/Linux/NativeProcessLinux.h

public:
   Status WriteMemory(lldb::addr_t addr, const void *buf, size_t size,
                      size_t &bytes_written) override;
 
   llvm::Expected<lldb::addr_t> AllocateMemory(size_t size,
                                               uint32_t permissions) override;
 
   llvm::Error DeallocateMemory(lldb::addr_t addr) override;
 
+  Status ReadMemoryTags(int32_t type, lldb::addr_t addr, size_t len,
+                        std::vector<uint8_t> &tags) override;
+
   size_t UpdateThreads() override;
 
   const ArchSpec &GetArchitecture() const override { return m_arch; }
 
   Status SetBreakpoint(lldb::addr_t addr, uint32_t size,
                        bool hardware) override;
 
   Status RemoveBreakpoint(lldb::addr_t addr, bool hardware = false) override;

lldb/source/Plugins/Process/Linux/NativeProcessLinux.cpp

llvm::Expected<uint64_t> Result =
       Syscall({mmap_data->SysMunmap, addr, it->second});
   if (!Result)
     return Result.takeError();
 
   m_allocated_memory.erase(it);
   return llvm::Error::success();
 }
 
+Status NativeProcessLinux::ReadMemoryTags(int32_t type, lldb::addr_t addr,
+                                          size_t len,
+                                          std::vector<uint8_t> &tags) {
+  llvm::Expected<NativeRegisterContextLinux::MemoryTaggingDetails> details =
+      GetCurrentThread()->GetRegisterContext().GetMemoryTaggingDetails(type);
+  if (!details)
+    return Status(details.takeError());
+
+  // Ignore 0 length read
+  if (!len)
+    return Status();
+
+  // lldb will align the range it requests but it is not required to by
+  // the protocol so we'll do it again just in case.
+  // Remove non address bits too. Ptrace calls may work regardless but that
+  // is not a guarantee.
+  MemoryTagManager::TagRange range(details->manager->RemoveNonAddressBits(addr),
+                                   len);
+  range = details->manager->ExpandToGranule(range);
+
+  // Allocate enough space for all tags to be read
+  size_t num_tags = range.GetByteSize() / details->manager->GetGranuleSize();
+  tags.resize(num_tags * details->manager->GetTagSizeInBytes());
+
+  struct iovec tags_iovec;
+  uint8_t *dest = tags.data();
+  lldb::addr_t read_addr = range.GetRangeBase();
+
+  // This call can return partial data so loop until we error or
+  // get all tags back.
+  while (num_tags) {
+    tags_iovec.iov_base = dest;
+    tags_iovec.iov_len = num_tags;
+
+    Status error = NativeProcessLinux::PtraceWrapper(
+        details->ptrace_read_req, GetID(), reinterpret_cast<void *>(read_addr),
+        static_cast<void *>(&tags_iovec), 0, nullptr);
+
+    if (error.Fail()) {
+      // Discard partial reads
+      tags.resize(0);
+      return error;
+    }
+
+    size_t tags_read = tags_iovec.iov_len;
+    assert(tags_read && (tags_read <= num_tags));
+
+    dest += tags_read * details->manager->GetTagSizeInBytes();
+    read_addr += details->manager->GetGranuleSize() * tags_read;
+    num_tags -= tags_read;
+  }
+
+  return Status();
+}
+
 size_t NativeProcessLinux::UpdateThreads() {
   // The NativeProcessLinux monitoring threads are always up to date with
   // respect to thread state and they keep the thread list populated properly.
   // All this method needs to do is return the thread count.
   return m_threads.size();
 }
 
 Status NativeProcessLinux::SetBreakpoint(lldb::addr_t addr, uint32_t size,

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux.h

 //===-- NativeRegisterContextLinux.h ----------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef lldb_NativeRegisterContextLinux_h
 #define lldb_NativeRegisterContextLinux_h
 
 #include "Plugins/Process/Utility/NativeRegisterContextRegisterInfo.h"
 #include "lldb/Host/common/NativeThreadProtocol.h"
+#include "lldb/Target/MemoryTagManager.h"
+#include "llvm/Support/Error.h"
 
 namespace lldb_private {
 namespace process_linux {
 
 class NativeThreadLinux;
 
 class NativeRegisterContextLinux
     : public virtual NativeRegisterContextRegisterInfo {
struct MmapData {
     // relevant architecture.
     unsigned SysMmap;   ///< mmap syscall number.
     unsigned SysMunmap; ///< munmap syscall number
   };
   /// Return the architecture-specific data needed to make mmap syscalls, if
   /// they are supported.
   virtual llvm::Optional<MmapData> GetMmapData() { return llvm::None; }
 
+  struct MemoryTaggingDetails {
+    /// Object with tag handling utilities. If the function below returns
+    /// a valid structure, you can assume that this pointer is valid.
+    std::unique_ptr<MemoryTagManager> manager;
+    int ptrace_read_req;  /// ptrace operation number for memory tag read
+    int ptrace_write_req; /// ptrace operation number for memory tag write
+  };
+  /// Return architecture specific data needed to use memory tags,
+  /// if they are supported.
+  virtual llvm::Expected<MemoryTaggingDetails>
+  GetMemoryTaggingDetails(int32_t type) {
+    return llvm::createStringError(
+        llvm::inconvertibleErrorCode(),
+        "Architecture does not support memory tagging");
+  }
+
 protected:
   // NB: This constructor is here only because gcc<=6.5 requires a virtual base
   // class initializer on abstract class (even though it is never used). It can
   // be deleted once we move to gcc>=7.0.
   NativeRegisterContextLinux(NativeThreadProtocol &thread)
       : NativeRegisterContextRegisterInfo(thread, nullptr) {}
 
   lldb::ByteOrder GetByteOrder() const;

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux_arm64.h

public:
 
   void InvalidateAllRegisters() override;
 
   std::vector<uint32_t>
   GetExpeditedRegisters(ExpeditedRegs expType) const override;
 
   bool RegisterOffsetIsDynamic() const override { return true; }
 
+  llvm::Expected<MemoryTaggingDetails>
+  GetMemoryTaggingDetails(int32_t type) override;
+
 protected:
   Status ReadGPR() override;
 
   Status WriteGPR() override;
 
   Status ReadFPR() override;
 
   Status WriteFPR() override;

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux_arm64.cpp

 //===-- NativeRegisterContextLinux_arm64.cpp ------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #if defined(__arm64__) || defined(__aarch64__)
 
 #include "NativeRegisterContextLinux_arm.h"
 #include "NativeRegisterContextLinux_arm64.h"
 
 
 #include "lldb/Host/common/NativeProcessProtocol.h"
+#include "lldb/Host/linux/Ptrace.h"
 #include "lldb/Utility/DataBufferHeap.h"
 #include "lldb/Utility/Log.h"
 #include "lldb/Utility/RegisterValue.h"
 #include "lldb/Utility/Status.h"
 
 #include "Plugins/Process/Linux/NativeProcessLinux.h"
 #include "Plugins/Process/Linux/Procfs.h"
 #include "Plugins/Process/POSIX/ProcessPOSIXLog.h"
+#include "Plugins/Process/Utility/MemoryTagManagerAArch64MTE.h"
 #include "Plugins/Process/Utility/RegisterInfoPOSIX_arm64.h"
 
 // System includes - They have to be included after framework includes because
 // they define some macros which collide with variable names in other modules
 #include <sys/socket.h>
 // NT_PRSTATUS and NT_FPREGSET definition
 #include <elf.h>
 
std::vector<uint32_t> NativeRegisterContextLinux_arm64::GetExpeditedRegisters(
   std::vector<uint32_t> expedited_reg_nums =
       NativeRegisterContext::GetExpeditedRegisters(expType);
   if (m_sve_state == SVEState::FPSIMD || m_sve_state == SVEState::Full)
     expedited_reg_nums.push_back(GetRegisterInfo().GetRegNumSVEVG());
 
   return expedited_reg_nums;
 }
 
+llvm::Expected<NativeRegisterContextLinux::MemoryTaggingDetails>
+NativeRegisterContextLinux_arm64::GetMemoryTaggingDetails(int32_t type) {
+  if (type == MemoryTagManagerAArch64MTE::eMTE_allocation) {
+    return MemoryTaggingDetails{std::make_unique<MemoryTagManagerAArch64MTE>(),
+                                PTRACE_PEEKMTETAGS, PTRACE_POKEMTETAGS};
+  }
+
+  return llvm::createStringError(llvm::inconvertibleErrorCode(),
+                                 "Unknown AArch64 memory tag type %d", type);
+}
+
 #endif // defined (__arm64__) || defined (__aarch64__)

lldb/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationServerLLGS.h

protected:
   PacketResult Handle_qWatchpointSupportInfo(StringExtractorGDBRemote &packet);
 
   PacketResult Handle_qFileLoadAddress(StringExtractorGDBRemote &packet);
 
   PacketResult Handle_QPassSignals(StringExtractorGDBRemote &packet);
 
   PacketResult Handle_g(StringExtractorGDBRemote &packet);
 
+  PacketResult Handle_qMemTags(StringExtractorGDBRemote &packet);
+
   void SetCurrentThreadID(lldb::tid_t tid);
 
   lldb::tid_t GetCurrentThreadID() const;
 
   void SetContinueThreadID(lldb::tid_t tid);
 
   lldb::tid_t GetContinueThreadID() const { return m_continue_tid; }
 

lldb/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationServerLLGS.cpp

 //===-- GDBRemoteCommunicationServerLLGS.cpp ------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include <cerrno>
 
 #include "lldb/Host/Config.h"
 
 
 #include <chrono>
 #include <cstring>
+#include <limits>
 #include <thread>
 
 #include "GDBRemoteCommunicationServerLLGS.h"
 #include "lldb/Host/ConnectionFileDescriptor.h"
 #include "lldb/Host/Debug.h"
 #include "lldb/Host/File.h"
 #include "lldb/Host/FileAction.h"
 #include "lldb/Host/FileSystem.h"
RegisterMemberFunctionHandler(
       &GDBRemoteCommunicationServerLLGS::Handle_jLLDBTraceGetState);
   RegisterMemberFunctionHandler(
       StringExtractorGDBRemote::eServerPacketType_jLLDBTraceGetBinaryData,
       &GDBRemoteCommunicationServerLLGS::Handle_jLLDBTraceGetBinaryData);
 
   RegisterMemberFunctionHandler(StringExtractorGDBRemote::eServerPacketType_g,
                                 &GDBRemoteCommunicationServerLLGS::Handle_g);
 
+  RegisterMemberFunctionHandler(
+      StringExtractorGDBRemote::eServerPacketType_qMemTags,
+      &GDBRemoteCommunicationServerLLGS::Handle_qMemTags);
+
   RegisterPacketHandler(StringExtractorGDBRemote::eServerPacketType_k,
                         [this](StringExtractorGDBRemote packet, Status &error,
                                bool &interrupt, bool &quit) {
                           quit = true;
                           return this->Handle_k(packet);
                         });
 }
 
GDBRemoteCommunicationServerLLGS::Handle_QPassSignals(
 
   Status error = m_current_process->IgnoreSignals(signals);
   if (error.Fail())
     return SendErrorResponse(69);
 
   return SendOKResponse();
 }
 
+GDBRemoteCommunication::PacketResult
+GDBRemoteCommunicationServerLLGS::Handle_qMemTags(
+    StringExtractorGDBRemote &packet) {
+  Log *log(GetLogIfAnyCategoriesSet(LIBLLDB_LOG_PROCESS));
+
+  // Ensure we have a process.
+  if (!m_current_process ||
+      (m_current_process->GetID() == LLDB_INVALID_PROCESS_ID)) {
+    LLDB_LOGF(
+        log,
+        "GDBRemoteCommunicationServerLLGS::%s failed, no process available",
+        __FUNCTION__);
+    return SendErrorResponse(1);
+  }
+
+  // We are expecting
+  // qMemTags:<hex address>,<hex length>:<hex type>
+
+  // Address
+  packet.SetFilePos(strlen("qMemTags:"));
+  const char *current_char = packet.Peek();
+  if (!current_char || *current_char == ',')
+    return SendIllFormedResponse(packet, "Missing address in qMemTags packet");
+  const lldb::addr_t addr = packet.GetHexMaxU64(/*little_endian=*/false, 0);
+
+  // Length
+  char previous_char = packet.GetChar();
+  current_char = packet.Peek();
+  // If we don't have a separator or the length field is empty
+  if (previous_char != ',' || (current_char && *current_char == ':'))
+    return SendIllFormedResponse(packet,
+                                 "Invalid addr,length pair in qMemTags packet");
+
+  if (packet.GetBytesLeft() < 1)
+    return SendIllFormedResponse(
+        packet, "Too short qMemtags: packet (looking for length)");
+  const size_t length = packet.GetHexMaxU64(/*little_endian=*/false, 0);
+
+  // Type
+  const char *invalid_type_err = "Invalid type field in qMemTags: packet";
+  if (packet.GetBytesLeft() < 1 || packet.GetChar() != ':')
+    return SendIllFormedResponse(packet, invalid_type_err);
+
+  int32_t type =
+      packet.GetS32(std::numeric_limits<int32_t>::max(), /*base=*/16);
+  if (type == std::numeric_limits<int32_t>::max() ||
+      // To catch inputs like "123aardvark" that will parse but clearly aren't
+      // valid in this case.
+      packet.GetBytesLeft()) {
+    return SendIllFormedResponse(packet, invalid_type_err);
+  }
+
+  StreamGDBRemote response;
+  std::vector<uint8_t> tags;
+  Status error = m_current_process->ReadMemoryTags(type, addr, length, tags);
+  if (error.Fail())
+    return SendErrorResponse(1);
+
+  // This m is here in case we want to support multi part replies in the future.
+  // In the same manner as qfThreadInfo/qsThreadInfo.
+  response.PutChar('m');
+  response.PutBytesAsRawHex8(tags.data(), tags.size());
+  return SendPacketNoLock(response.GetString());
+}
+
 void GDBRemoteCommunicationServerLLGS::MaybeCloseInferiorTerminalConnection() {
   Log *log(GetLogIfAnyCategoriesSet(LIBLLDB_LOG_PROCESS));
 
   // Tell the stdio connection to shut down.
   if (m_stdio_communication.IsConnected()) {
     auto connection = m_stdio_communication.GetConnection();
     if (connection) {
       Status error;

lldb/source/Utility/StringExtractorGDBRemote.cpp

case 'q':
 
     case 'M':
       if (PACKET_STARTS_WITH("qMemoryRegionInfo:"))
         return eServerPacketType_qMemoryRegionInfo;
       if (PACKET_MATCHES("qMemoryRegionInfo"))
         return eServerPacketType_qMemoryRegionInfoSupported;
       if (PACKET_STARTS_WITH("qModuleInfo:"))
         return eServerPacketType_qModuleInfo;
+      if (PACKET_STARTS_WITH("qMemTags:"))
+        return eServerPacketType_qMemTags;
       break;
 
     case 'P':
       if (PACKET_STARTS_WITH("qProcessInfoPID:"))
         return eServerPacketType_qProcessInfoPID;
       if (PACKET_STARTS_WITH("qPlatform_shell:"))
         return eServerPacketType_qPlatform_shell;
       if (PACKET_STARTS_WITH("qPlatform_mkdir:"))

lldb/test/API/tools/lldb-server/memory-tagging/Makefile

+C_SOURCES := main.c
+CFLAGS_EXTRAS := -march=armv8.5-a+memtag
+
+include Makefile.rules

lldb/test/API/tools/lldb-server/memory-tagging/TestGdbRemoteMemoryTagging.py

+import gdbremote_testcase
+from lldbsuite.test.decorators import *
+from lldbsuite.test.lldbtest import *
+from lldbsuite.test import lldbutil
+
+class TestGdbRemoteMemoryTagging(gdbremote_testcase.GdbRemoteTestCaseBase):
+
+    mydir = TestBase.compute_mydir(__file__)
+
+    def check_qmemtags_response(self, body, expected):
+        self.test_sequence.add_log_lines(["read packet: $qMemTags:{}#00".format(body),
+                                          "send packet: ${}#00".format(expected),
+                                          ],
+                                         True)
+        self.expect_gdbremote_sequence()
+
+    @skipUnlessArch("aarch64")
+    @skipUnlessPlatform(["linux"])
+    @skipUnlessAArch64MTELinuxCompiler
+    def test_qmemtags_packets(self):
+        """ Test that qMemTags packets are parsed correctly and/or rejected. """
+
+        self.build()
+        self.set_inferior_startup_launch()
+        procs = self.prep_debug_monitor_and_inferior()
+
+        # Run the process
+        self.test_sequence.add_log_lines(
+            [
+                # Start running after initial stop
+                "read packet: $c#63",
+    # Match the address of the MTE page
+                {"type": "output_match",
+                 "regex": self.maybe_strict_output_regex(r"buffer: (.+) page_size: (.+)\r\n"),
+                 "capture": {1: "buffer", 2: "page_size"}},
+                # Now stop the inferior
+                "read packet: {}".format(chr(3)),
+                # And wait for the stop notification
+                {"direction": "send", "regex": r"^\$T[0-9a-fA-F]{2}thread:[0-9a-fA-F]+;"}],
+            True)
+
+        # Run the packet stream
+        context = self.expect_gdbremote_sequence()
+        self.assertIsNotNone(context)
+
+        buf_address = context.get("buffer")
+        self.assertIsNotNone(buf_address)
+        page_size = context.get("page_size")
+        self.assertIsNotNone(page_size)
+
+        # nil means we couldn't set up a tagged page because the
+        # target doesn't support it.
+        if buf_address == "(nil)":
+            self.skipTest("Target must support MTE.")
+
+        buf_address = int(buf_address, 16)
+        page_size = int(page_size, 16)
+
+        # In the tests below E03 means the packet wasn't formed correctly
+        # and E01 means it was but we had some other error acting upon it.
+
+        # Sanity check that address is correct
+        self.check_qmemtags_response("{:x},20:1".format(buf_address), "m0001")
+
+        # Invalid packets
+
+        # No content
+        self.check_qmemtags_response("", "E03")
+        # Only address
+        self.check_qmemtags_response("{:x}".format(buf_address), "E03")
+        # Only address and length
+        self.check_qmemtags_response("{:x},20".format(buf_address), "E03")
+        # Empty address
+        self.check_qmemtags_response(",20:1", "E03")
+        # Invalid addresses
+        self.check_qmemtags_response("aardvark,20:1", "E03")
+        self.check_qmemtags_response("-100,20:1", "E03")
+        self.check_qmemtags_response("cafe?,20:1", "E03")
+        # Empty length
+        self.check_qmemtags_response("{:x},:1".format(buf_address), "E03")
+        # Invalid lengths
+        self.check_qmemtags_response("{:x},food:1".format(buf_address), "E03")
+        self.check_qmemtags_response("{:x},-1:1".format(buf_address), "E03")
+        self.check_qmemtags_response("{:x},12??:1".format(buf_address), "E03")
+        # Empty type
+        self.check_qmemtags_response("{:x},10:".format(buf_address), "E03")
+        # Types we don't support
+        self.check_qmemtags_response("{:x},10:FF".format(buf_address), "E01")
+        # (even if the length of the read is zero)
+        self.check_qmemtags_response("{:x},0:FF".format(buf_address), "E01")
+        self.check_qmemtags_response("{:x},10:-1".format(buf_address), "E01")
+        self.check_qmemtags_response("{:x},10:+20".format(buf_address), "E01")
+        # Invalid type format
+        self.check_qmemtags_response("{:x},10:cat".format(buf_address), "E03")
+        self.check_qmemtags_response("{:x},10:?11".format(buf_address), "E03")
+
+        # Valid packets
+
+        # Reading nothing is allowed
+        self.check_qmemtags_response("{:x},0:1".format(buf_address), "m")
+        # A range that's already aligned
+        self.check_qmemtags_response("{:x},20:1".format(buf_address), "m0001")
+        # lldb-server should re-align the range
+        # Here we read from 1/2 way through a granule, into the next. Expands to 2 granules
+        self.check_qmemtags_response("{:x},10:1".format(buf_address+64-8), "m0304")
+        # Read up to the end of an MTE page.
+        # We know that the last tag should be 0xF since page size will always be a
+        # multiple of 256 bytes, which is 16 granules and we have 16 tags to use.
+        self.check_qmemtags_response("{:x},10:1".format(buf_address+page_size-16), "m0f")
+        # Here we read off of the end of the MTE range so ptrace gives us one tag,
+        # then fails on the second call. To lldb-server this means the response
+        # should just be an error, not a partial read.
+        self.check_qmemtags_response("{:x},20:1".format(buf_address+page_size-16), "E01")
+        # Note that we do not test reading over a page boundary within the same
+        # mapping. That logic is handled in the kernel itself so it's just a single
+        # ptrace call for lldb-server.

lldb/test/API/tools/lldb-server/memory-tagging/main.c

+#include <arm_acle.h>
+#include <asm/hwcap.h>
+#include <linux/mman.h>
+#include <stdio.h>
+#include <sys/auxv.h>
+#include <sys/mman.h>
+#include <sys/prctl.h>
+#include <unistd.h>
+
+int print_result(char *ptr) {
+  // Page size allows the test to try reading off of the end of the page
+  printf("buffer: %p page_size: 0x%x\n", ptr, sysconf(_SC_PAGESIZE));
+
+  // Exit after some time, so we don't leave a zombie process
+  // if the test framework lost track of us.
+  sleep(60);
+  return 0;
+}
+
+int main(int argc, char const *argv[]) {
+  if (prctl(PR_SET_TAGGED_ADDR_CTRL,
+            PR_TAGGED_ADDR_ENABLE | PR_MTE_TCF_SYNC |
+                // Allow all tags to be generated by the addg
+                // instruction __arm_mte_increment_tag produces.
+                (0xffff << PR_MTE_TAG_SHIFT),
+            0, 0, 0)) {
+    return print_result(NULL);
+  }
+
+  size_t page_size = sysconf(_SC_PAGESIZE);
+  char *buf = mmap(0, page_size, PROT_READ | PROT_WRITE | PROT_MTE,
+                   MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+  if (buf == MAP_FAILED)
+    return print_result(NULL);
+
+  // Set incrementing tags until end of the page
+  char *tagged_ptr = buf;
+  // This intrinsic treats the addresses as if they were untagged
+  while (__arm_mte_ptrdiff(tagged_ptr, buf) < page_size) {
+    // This sets the allocation tag
+    __arm_mte_set_tag(tagged_ptr);
+    // Set the tag of the next granule (hence +16) to the next
+    // tag value. Returns a new pointer with the new logical tag.
+    // Tag values wrap at 0xF so it'll cycle.
+    tagged_ptr = __arm_mte_increment_tag(tagged_ptr + 16, 1);
+  }
+
+  // lldb-server should be removing the top byte from addresses passed
+  // to ptrace. So put some random bits in there.
+  // ptrace expects you to remove them but it can still succeed if you
+  // don't. So this isn't proof that we're removing them, it's just a
+  // smoke test in case something didn't account for them.
+  buf = (char *)((size_t)buf | ((size_t)0xAA << 56));
+  return print_result(buf);
+}