[lldb][AArch64] Add MTE memory tag reading to lldb

[DavidSpickett]

Summary

This adds GDB client support for the qMemTags packet
which reads memory tags. Following the design
which was recently committed to GDB.

https://sourceware.org/gdb/current/onlinedocs/gdb/General-Query-Packets.html#General-Query-Packets
(look for qMemTags)

lldb commands will use the new Process methods
GetMemoryTagManager and ReadMemoryTags.

The former takes a range and checks that:

• The current process architecture has an architecture plugin
• That plugin provides a MemoryTagManager
• That the range of memory requested lies in a tagged range (it will expand it to granules for you)

If all that was true you get a MemoryTagManager you
can give to ReadMemoryTags.

This two step process is done to allow commands to get the
tag manager without having to read tags as well. For example
you might just want to remove a logical tag, or error early
if a range with tagged addresses is inverted.

Note that getting a MemoryTagManager doesn't mean that the process
or a specific memory range is tagged. Those are seperate checks.
Having a tag manager just means this architecture *could* have
a tagging feature enabled.

An architecture plugin has been added for AArch64 which
will return a MemoryTagManagerAArch64MTE, which was added in a
previous patch.

[DavidSpickett]

Couple of things I wanted to highlight for review.

I've put the tag handler on the architecture plugin, but it could also go on process directly like trace does. I figured tagging extensions are a per arch thing so it made logical sense, but code wise it does add some complexity.

The command's output is very simple and verbose, it could definitely do some things like not showing repeated tags:

(lldb) memory tag read new_buf_ptr new_buf_ptr+<n>
Logical tag: 0x9
Allocation tags:
[0x900fffff7ffa000, 0x900fffff7ffa010): 0x9
<... 9 repeats...>
[<>, <>): 0x0

Or combine runs into the same row,

(lldb) memory tag read new_buf_ptr new_buf_ptr+<n>
Logical tag: 0x9
Allocation tags:
[0x900fffff7ffa000, 0x900fffff7ffa000+<n>): 0x9

So each row is not always 1 granule.

That could be added later as a flag --compact or make that the default and have a flag to be verbose. The command as is does the job well enough for small reads.

The original RFC suggested a separate commands to read the logical tag only, but having written "tag read" and "tag check" I don't think there's a need. That's why "tag read" shows logical and allocation in its output.

[omjavaid]

For anyone reviewing this:

Orignal RFC with all the required documentation insight into Arm Memory Tagging Extension can be found here:

https://lists.llvm.org/pipermail/lldb-dev/2020-August/016402.html

@DavidSpickett this calls for some documentation update in a future patch to have some MTE/Tags read/write commands related information to go into lldb.llvm.org as well may be here https://lldb.llvm.org/use/map.html

[omjavaid]

This patch also looks quite good. Some minor nits inline and also move gdb* changes into a single patch with both client and server side code.

lldb/include/lldb/Target/Process.h

1717

Can you explain this line a bit? What i understood we dont include start and end address in tag range. right?

1740

I guess you meant to say read tags for?

2814

By remote you mean gdb-remote process? This probably will be generic routine used by other platforms.
in context of lldb we dont have remote rather platforms where gdb-remote is a type of platform.

2838

I guess if there are no restrictions by specs then we should rethink use of int32_t for type may be uint32_t if possible.

lldb/packages/Python/lldbsuite/test/lldbtest.py

1272 ↗

(On Diff #319792)

This change look good and can be committed outside this patch.

1272 ↗

(On Diff #319792)

This change looks fine commit it separately.

lldb/source/Target/Process.cpp

6073

'arch' may be nullptr so call to GetMemoryTagHandler is not safe.

6100

Can there be multiple 'granules' defined for an implementation ? if not this func may be renamed (AlignToGranule) to reflect that

lldb/test/API/linux/aarch64/mte_tag_read/main.c

44 ↗

(On Diff #319792)

May be add a line or two of comment about mte intrinsics for any future readers of these test code.

[DavidSpickett]

This patch also looks quite good. Some minor nits inline and also move gdb* changes into a single patch with both client and server side code.

Cool, I wasn't sure how to split while keeping it readable but that sounds good.

lldb/include/lldb/Target/Process.h

1717

Does the description of end_addr answer your question?

GetMemoryTagHandler(10, 21) would check a range from 10-20.

2838

GDB is using a signed int, though we don't have need for negative numbers at this time. I'll cite the GDB design for this.

We could say well, for the moment it might as well be unsigned but I don't want to introduce a situation where in future we mix client/servers and lldb falls over on a "-".

lldb/packages/Python/lldbsuite/test/lldbtest.py

1272 ↗

(On Diff #319792)

Yeah your registers patch does the same thing so depending on timing I might end up using that.

lldb/source/Target/Process.cpp

6073

Sure, that's why I check it first with the arch ?. Happy to refactor if it could be clearer.

I should say that some of this boilerplate looking for the tag handler is subject to change once I've written more commands. It's repetitive now but later I should be able to refactor with the context of how all the commands use it.

6100

MTE only has one granule size, Sparc ADI uses cache lines so I assume theirs is just the cache line size.

If I read "align to granule" singular I think it's align to a single granule, probably up. Since this aligns up and down granules plural made more sense to me.

That said, it's never going to shrink the range, so ExpandToGranule would be more descriptive.

[DavidSpickett]

Split into smaller changes. Tag read command is now a further change.

[omjavaid]

I guess we also need LLDB API interface for reading/writing memory tags. So that we can do something like process.ReadMemoryTags() from python. Do you plan on adding it in a later patch?

[DavidSpickett]

In D95602#2593980, @omjavaid wrote:

I guess we also need LLDB API interface for reading/writing memory tags. So that we can do something like process.ReadMemoryTags() from python. Do you plan on adding it in a later patch?

Yes but I had forgotten about it so thanks for the reminder. I want to get the read/write commands done first so I had a better idea of what details you'd want access to. Plus, would we want to extend the existing memory API or have an additional call to get tags. (the latter most likely)

[omjavaid]

lldb/source/Plugins/Architecture/AArch64/ArchitectureAArch64.cpp

37

Do you think we should consider aarch64_32 as AArch64 architecture? aarch64_32 AFAIK is used where 64bit kernel is running and 32bit executable. Does MTE also apply on 32 bit executables running on 64bit kernel.

[DavidSpickett]

lldb/source/Plugins/Architecture/AArch64/ArchitectureAArch64.cpp

37

For MTE no but the rest of lldb considers it AArch64 for things like breakpoints, instruction emulation etc.

Though this Arch plugin only does MTE, in general they can control stepping behavior, things like that. So it makes sense to count it.

Plus for MTE we have to lookup the memory region via the kernel too. So if you were on aarch64_32 and you couldn't allocate MTE anyway, the debugger wouldn't be able to do anything.

[DavidSpickett]

• Use RemoveNonAddressBits instead of RemoveLogicalTag

Note that the tests don't have any changes because the GDB client layer doesn't have any requirement to remove tags. Only the commands
need to do that.

The parts of this that use RemoveNonAddressBits will be
tested in the "memory tag read" patch.

[DavidSpickett]

Update after changing parent

[DavidSpickett]

Account for a ranges being split across multiple mappings
that are next to each other.
(tested in the tag read command patch)

[DavidSpickett]

lldb/include/lldb/Target/Process.h

2814

I forgot to say, I changed this to "process", I think that's ok.

[DavidSpickett]

Correct typo in function comment. "to read tags for"

[DavidSpickett]

• Use PRIx64 to properly print 64 bit addresses in invalid range error message.

[DavidSpickett]

lldb/source/Target/Process.cpp

6070

While writing "memory tag write" I realised it saves some effort if you return the manager and the checked range here. However it's way more useful for tag write so I'll leave this as is for now unless you really want to see it in this change.

[DavidSpickett]

@omjavaid Any more comments on this?

lldb/include/lldb/Core/Architecture.h

110

I also had the thought that we could just return instances of MemoryTagManager, however we rely on virtual functions for the implementation. (incredibly obvious once you try it, but would have been nice to remove a bunch of pointer indirection)

[DavidSpickett]

• Rebase onto main

Also, GDB support has landed so https://sourceware.org/gdb/current/onlinedocs/gdb/General-Query-Packets.html#General-Query-Packets has the packet formats now.

[DavidSpickett]

Rebase onto main.

[DavidSpickett]

Rebase

[DavidSpickett]

Rebase, fix use of SendPacketAndWaitForResponse.

[pcc]

lldb/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp

635

[DavidSpickett]

Rebase, fix up SendPacketAndWaitForResponse use.

[DavidSpickett]

Rebase

[DavidSpickett]

Rebase, now ready to land.

[fhahn]

It looks like this is breaking building LLDB on Green Dragon: https://smooshbase.apple.com/ci/job/am_github_build_tester/63476/console

please take a look and consider reverting if it takes longer to fix the issue

[teemperor]

In D95602#2839419, @fhahn wrote:

It looks like this is breaking building LLDB on Green Dragon: https://smooshbase.apple.com/ci/job/am_github_build_tester/63476/console

please take a look and consider reverting if it takes longer to fix the issue

I think that's the correct public CI that shows the failure: https://green.lab.llvm.org/green/view/LLDB/job/lldb-cmake/33057/console

/Users/buildslave/jenkins/workspace/lldb-cmake/llvm-project/lldb/source/Target/Process.cpp:6098:44: error: no viable conversion from 'Range<[...], lldb::addr_t>' to 'Range<[...], size_t>'
  tag_range = tag_manager->ExpandToGranule(tag_range);
                                           ^~~~~~~~~
/Users/buildslave/jenkins/workspace/lldb-cmake/llvm-project/lldb/include/lldb/Utility/RangeMap.h:29:42: note: candidate constructor (the implicit copy constructor) not viable: no known conversion from 'MemoryRegionInfo::RangeType' (aka 'Range<unsigned long long, unsigned long long>') to 'const lldb_private::Range<unsigned long long, unsigned long> &' for 1st argument
template <typename B, typename S> struct Range {
                                         ^
/Users/buildslave/jenkins/workspace/lldb-cmake/llvm-project/lldb/include/lldb/Utility/RangeMap.h:29:42: note: candidate constructor (the implicit move constructor) not viable: no known conversion from 'MemoryRegionInfo::RangeType' (aka 'Range<unsigned long long, unsigned long long>') to 'lldb_private::Range<unsigned long long, unsigned long> &&' for 1st argument
/Users/buildslave/jenkins/workspace/lldb-cmake/llvm-project/lldb/include/lldb/Target/MemoryTagManager.h:58:45: note: passing argument to parameter 'range' here
  virtual TagRange ExpandToGranule(TagRange range) const = 0;
                                            ^
/Users/buildslave/jenkins/workspace/lldb-cmake/llvm-project/lldb/source/Target/Process.cpp:6098:13: error: no viable overloaded '='
  tag_range = tag_manager->ExpandToGranule(tag_range);
  ~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Users/buildslave/jenkins/workspace/lldb-cmake/llvm-project/lldb/include/lldb/Utility/RangeMap.h:29:42: note: candidate function (the implicit copy assignment operator) not viable: no known conversion from 'Range<[...], size_t>' to 'const Range<[...], unsigned long long>' for 1st argument
template <typename B, typename S> struct Range {
                                         ^
/Users/buildslave/jenkins/workspace/lldb-cmake/llvm-project/lldb/include/lldb/Utility/RangeMap.h:29:42: note: candidate function (the implicit move assignment operator) not viable: no known conversion from 'Range<[...], size_t>' to 'Range<[...], unsigned long long>' for 1st argument
2 errors generated.

[fhahn]

In D95602#2839421, @teemperor wrote:

In D95602#2839419, @fhahn wrote:

I think that's the correct public CI that shows the failure: https://green.lab.llvm.org/green/view/LLDB/job/lldb-cmake/33057/console

This is the correct link, thanks!

[DavidSpickett]

This was fixed by Omair in https://reviews.llvm.org/rG9ca0171a9ffdef5fdb1511d197a3fd72490362de.

lldb/include/lldb/Core/Architecture.h

 //===-- Architecture.h ------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLDB_CORE_ARCHITECTURE_H
 #define LLDB_CORE_ARCHITECTURE_H
 
 #include "lldb/Core/PluginInterface.h"
+#include "lldb/Target/MemoryTagManager.h"
 
 namespace lldb_private {
 
 class Architecture : public PluginInterface {
 public:
   /// This is currently intended to handle cases where a
   /// program stops at an instruction that won't get executed and it
   /// allows the stop reason, like "breakpoint hit", to be replaced
public:
   // check if for any reason there is a better address than this to put a
   // breakpoint on. If there is then return that address. For MIPS, if
   // instruction at addr is a delay slot instruction then this method will find
   // the address of its previous instruction and return that address.
   virtual lldb::addr_t GetBreakableLoadAddress(lldb::addr_t addr,
                                                Target &target) const {
     return addr;
   }
+
+  // Returns a pointer to an object that can manage memory tags for this
+  // Architecture E.g. masking out tags, unpacking tag streams etc. Returns
+  // nullptr if the architecture does not have a memory tagging extension.
+  //
+  // The return pointer being valid does not mean that the current process has
+  // memory tagging enabled, just that a tagging technology exists for this
+  // architecture.
+  virtual const MemoryTagManager *GetMemoryTagManager() const {
+    return nullptr;
+  }
 };
 
 } // namespace lldb_private
 
 #endif // LLDB_CORE_ARCHITECTURE_H

lldb/include/lldb/Target/Process.h

 //===-- Process.h -----------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLDB_TARGET_PROCESS_H
 #define LLDB_TARGET_PROCESS_H
 
 #include "lldb/Host/Config.h"
 
 #include <limits.h>
 
 #include <chrono>
 #include <list>
 #include <memory>
 #include <mutex>
 #include <string>
 #include <unordered_set>
 #include <vector>
 
 #include "lldb/Breakpoint/BreakpointSiteList.h"
 #include "lldb/Core/Communication.h"
 #include "lldb/Core/LoadedModuleInfoList.h"
 #include "lldb/Core/PluginInterface.h"
 #include "lldb/Core/ThreadSafeValue.h"
 #include "lldb/Core/UserSettingsController.h"
 #include "lldb/Host/HostThread.h"
 #include "lldb/Host/ProcessLaunchInfo.h"
 #include "lldb/Host/ProcessRunLock.h"
 #include "lldb/Symbol/ObjectFile.h"
 #include "lldb/Target/ExecutionContextScope.h"
 #include "lldb/Target/InstrumentationRuntime.h"
 #include "lldb/Target/Memory.h"
+#include "lldb/Target/MemoryTagManager.h"
 #include "lldb/Target/QueueList.h"
 #include "lldb/Target/ThreadList.h"
 #include "lldb/Target/ThreadPlanStack.h"
 #include "lldb/Target/Trace.h"
 #include "lldb/Utility/ArchSpec.h"
 #include "lldb/Utility/Broadcaster.h"
 #include "lldb/Utility/Event.h"
 #include "lldb/Utility/Listener.h"
/// \see Process::Notifications
   ///
   /// \return
   ///     The address of the allocated buffer in the process, or
   ///     LLDB_INVALID_ADDRESS if the allocation failed.
 
   lldb::addr_t CallocateMemory(size_t size, uint32_t permissions,
                                Status &error);
 
+  /// If the address range given is in a memory tagged range and this
+  /// architecture and process supports memory tagging, return a tag
+  /// manager that can be used to maniupulate those memory tags.
+  /// Tags present in the addresses given are ignored.
+  ///
+  /// \param[in] addr
+  ///     Start of memory range.
+  ///
+  /// \param[in] end_addr
+  ///     End of the memory range. Where end is one beyond the last byte to be
+  ///     included.
+  ///
+  /// \return
+  ///     Either a valid pointer to a tag manager or an error describing why one
+  ///     could not be provided.
+  llvm::Expected<const MemoryTagManager *>
+  GetMemoryTagManager(lldb::addr_t addr, lldb::addr_t end_addr);
+
+  /// Expands the range addr to addr+len to align with granule boundaries and
+  /// then calls DoReadMemoryTags to do the target specific operations.
+  /// Tags are returned unpacked so can be used without conversion.
+  ///
+  /// \param[in] tag_manager
+  ///     The tag manager to get memory tagging information from.
+  ///
+  /// \param[in] addr
+  ///     Start of memory range to read tags for.
+  ///
+  /// \param[in] len
+  ///     Length of memory range to read tags for (in bytes).
+  ///
+  /// \return
+  ///     Either the unpacked tags or an error describing a failure to read
+  ///     or unpack them.
+  llvm::Expected<std::vector<lldb::addr_t>>
+  ReadMemoryTags(const MemoryTagManager *tag_manager, lldb::addr_t addr,
+                 size_t len);
+
   /// Resolve dynamically loaded indirect functions.
   ///
   /// \param[in] address
   ///     The load address of the indirect function to resolve.
   ///
   /// \param[out] error
   ///     An error value in case the resolve fails.
   ///
protected:
   ///                                   const StructuredData::ObjectSP
   ///                                   &object_sp)
   ///
   /// \return
   ///     True if the structured data was routed to a plugin; otherwise,
   ///     false.
   bool RouteAsyncStructuredData(const StructuredData::ObjectSP object_sp);
 
   /// Check whether the process supports memory tagging.
   ///
   /// \return
   ///     true if the process supports memory tagging,
   ///     false otherwise.
   virtual bool SupportsMemoryTagging() { return false; }
 
+  /// Does the final operation to read memory tags. E.g. sending a GDB packet.
+  /// It assumes that ReadMemoryTags has checked that memory tagging is enabled
+  /// and has expanded the memory range as needed.
+  ///
+  /// \param[in] addr
+  ///    Start of address range to read memory tags for.
+  ///
+  /// \param[in] len
+  ///    Length of the memory range to read tags for (in bytes).
+  ///
+  /// \param[in] type
+  ///    Type of tags to read (get this from a MemoryTagManager)
+  ///
+  /// \return
+  ///     The packed tag data received from the remote or an error
+  ///     if the read failed.
+  virtual llvm::Expected<std::vector<uint8_t>>
+  DoReadMemoryTags(lldb::addr_t addr, size_t len, int32_t type) {
+    return llvm::createStringError(llvm::inconvertibleErrorCode(),
+                                   "%s does not support reading memory tags",
+                                   GetPluginName().GetCString());
+  }
+
   // Type definitions
   typedef std::map<lldb::LanguageType, lldb::LanguageRuntimeSP>
       LanguageRuntimeCollection;
   typedef std::unordered_set<const void *> WarningsPointerSet;
   typedef std::map<uint64_t, WarningsPointerSet> WarningsCollection;
 
   struct PreResumeCallbackAndBaton {
     bool (*callback)(void *);

lldb/source/Plugins/Architecture/AArch64/ArchitectureAArch64.h

+//===-- ArchitectureAArch64.h -----------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLDB_SOURCE_PLUGINS_ARCHITECTURE_AARCH64_ARCHITECTUREAARCH64_H
+#define LLDB_SOURCE_PLUGINS_ARCHITECTURE_AARCH64_ARCHITECTUREAARCH64_H
+
+#include "Plugins/Process/Utility/MemoryTagManagerAArch64MTE.h"
+#include "lldb/Core/Architecture.h"
+
+namespace lldb_private {
+
+class ArchitectureAArch64 : public Architecture {
+public:
+  static ConstString GetPluginNameStatic();
+  static void Initialize();
+  static void Terminate();
+
+  ConstString GetPluginName() override;
+  uint32_t GetPluginVersion() override;
+
+  void OverrideStopInfo(Thread &thread) const override{};
+
+  const MemoryTagManager *GetMemoryTagManager() const override {
+    return &m_memory_tag_manager;
+  }
+
+private:
+  static std::unique_ptr<Architecture> Create(const ArchSpec &arch);
+  ArchitectureAArch64() = default;
+  MemoryTagManagerAArch64MTE m_memory_tag_manager;
+};
+
+} // namespace lldb_private
+
+#endif // LLDB_SOURCE_PLUGINS_ARCHITECTURE_AARCH64_ARCHITECTUREAARCH64_H

lldb/source/Plugins/Architecture/AArch64/ArchitectureAArch64.cpp

+//===-- ArchitectureAArch64.cpp -------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "Plugins/Architecture/AArch64/ArchitectureAArch64.h"
+#include "lldb/Core/PluginManager.h"
+#include "lldb/Utility/ArchSpec.h"
+
+using namespace lldb_private;
+using namespace lldb;
+
+LLDB_PLUGIN_DEFINE(ArchitectureAArch64)
+
+ConstString ArchitectureAArch64::GetPluginNameStatic() {
+  return ConstString("aarch64");
+}
+
+void ArchitectureAArch64::Initialize() {
+  PluginManager::RegisterPlugin(GetPluginNameStatic(),
+                                "AArch64-specific algorithms",
+                                &ArchitectureAArch64::Create);
+}
+
+void ArchitectureAArch64::Terminate() {
+  PluginManager::UnregisterPlugin(&ArchitectureAArch64::Create);
+}
+
+std::unique_ptr<Architecture>
+ArchitectureAArch64::Create(const ArchSpec &arch) {
+  auto machine = arch.GetMachine();
+  if (machine != llvm::Triple::aarch64 && machine != llvm::Triple::aarch64_be &&
+      machine != llvm::Triple::aarch64_32) {
+    return nullptr;
+  }
+  return std::unique_ptr<Architecture>(new ArchitectureAArch64());
+}
+
+ConstString ArchitectureAArch64::GetPluginName() {
+  return GetPluginNameStatic();
+}
+uint32_t ArchitectureAArch64::GetPluginVersion() { return 1; }

lldb/source/Plugins/Architecture/AArch64/CMakeLists.txt

+add_lldb_library(lldbPluginArchitectureAArch64 PLUGIN
+  ArchitectureAArch64.cpp
+
+  LINK_LIBS
+    lldbPluginProcessUtility
+    lldbCore
+    lldbTarget
+    lldbUtility
+  LINK_COMPONENTS
+    Support
+  )

lldb/source/Plugins/Architecture/CMakeLists.txt

 add_subdirectory(Arm)
 add_subdirectory(Mips)
 add_subdirectory(PPC64)
+add_subdirectory(AArch64)

lldb/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.h

 //===-- GDBRemoteCommunicationClient.h --------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
public:
   bool GetThreadExtendedInfoSupported();
 
   bool GetLoadedDynamicLibrariesInfosSupported();
 
   bool GetSharedCacheInfoSupported();
 
   bool GetMemoryTaggingSupported();
 
+  lldb::DataBufferSP ReadMemoryTags(lldb::addr_t addr, size_t len,
+                                    int32_t type);
+
   /// Use qOffsets to query the offset used when relocating the target
   /// executable. If successful, the returned structure will contain at least
   /// one value in the offsets field.
   llvm::Optional<QOffsets> GetQOffsets();
 
   bool GetModuleInfo(const FileSpec &module_file_spec,
                      const ArchSpec &arch_spec, ModuleSpec &module_spec);
 

lldb/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp

 //===-- GDBRemoteCommunicationClient.cpp ----------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 

 
 bool GDBRemoteCommunicationClient::GetMemoryTaggingSupported() {
   if (m_supports_memory_tagging == eLazyBoolCalculate) {
     GetRemoteQSupported();
   }
   return m_supports_memory_tagging == eLazyBoolYes;
 }
 
+DataBufferSP GDBRemoteCommunicationClient::ReadMemoryTags(lldb::addr_t addr,
+                                                          size_t len,
+                                                          int32_t type) {
+  StreamString packet;
+  packet.Printf("qMemTags:%lx,%lx:%x", addr, len, type);
+  StringExtractorGDBRemote response;
+
+  Log *log = ProcessGDBRemoteLog::GetLogIfAnyCategoryIsSet(GDBR_LOG_MEMORY);
+
+  if (SendPacketAndWaitForResponse(packet.GetString(), response, false) !=
+          PacketResult::Success ||
+      !response.IsNormalResponse()) {
+    LLDB_LOGF(log, "GDBRemoteCommunicationClient::%s: qMemTags packet failed",
+              __FUNCTION__);
+    return nullptr;
+  }
+
+  // We are expecting
+  // m<hex encoded bytes>
+
+  if (response.GetChar() != 'm') {
+    LLDB_LOGF(log,
+              "GDBRemoteCommunicationClient::%s: qMemTags response did not "
+              "begin with \"m\"",
+              __FUNCTION__);
+    return nullptr;
+  }
+
+  size_t expected_bytes = response.GetBytesLeft() / 2;
+  DataBufferSP buffer_sp(new DataBufferHeap(expected_bytes, 0));
+  size_t got_bytes = response.GetHexBytesAvail(buffer_sp->GetData());
+  // Check both because in some situations chars are consumed even
+  // if the decoding fails.
+  if (response.GetBytesLeft() || (expected_bytes != got_bytes)) {
+    LLDB_LOGF(
+        log,
+        "GDBRemoteCommunicationClient::%s: Invalid data in qMemTags response",
+        __FUNCTION__);
+    return nullptr;
+  }
+
+  return buffer_sp;
+}
+
 bool GDBRemoteCommunicationClient::GetxPacketSupported() {
   if (m_supports_x == eLazyBoolCalculate) {
     StringExtractorGDBRemote response;
     m_supports_x = eLazyBoolNo;
     char packet[256];
     snprintf(packet, sizeof(packet), "x0,0");
     if (SendPacketAndWaitForResponse(packet, response, false) ==
         PacketResult::Success) {

lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.h

 //===-- ProcessGDBRemote.h --------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLDB_SOURCE_PLUGINS_PROCESS_GDB_REMOTE_PROCESSGDBREMOTE_H
 #define LLDB_SOURCE_PLUGINS_PROCESS_GDB_REMOTE_PROCESSGDBREMOTE_H
 
 #include <atomic>
 #include <map>
 #include <mutex>
 #include <string>
 #include <vector>
 
 #include "lldb/Core/LoadedModuleInfoList.h"
 #include "lldb/Core/ModuleSpec.h"
 #include "lldb/Core/ThreadSafeValue.h"
 #include "lldb/Host/HostThread.h"
 #include "lldb/Target/Process.h"
 #include "lldb/Target/Thread.h"
 #include "lldb/Utility/ArchSpec.h"
 #include "lldb/Utility/Broadcaster.h"
 #include "lldb/Utility/ConstString.h"
protected:
   Status UpdateAutomaticSignalFiltering() override;
 
   Status FlashErase(lldb::addr_t addr, size_t size);
 
   Status FlashDone();
 
   bool HasErased(FlashRange range);
 
+  llvm::Expected<std::vector<uint8_t>>
+  DoReadMemoryTags(lldb::addr_t addr, size_t len, int32_t type) override;
+
 private:
   // For ProcessGDBRemote only
   std::string m_partial_profile_data;
   std::map<uint64_t, uint32_t> m_thread_id_to_used_usec_map;
   uint64_t m_last_signals_version = 0;
 
   static bool NewThreadNotifyBreakpointHit(void *baton,
                                            StoppointCallbackContext *context,

lldb/source/Plugins/Process/gdb-remote/ProcessGDBRemote.cpp

 //===-- ProcessGDBRemote.cpp ----------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "lldb/Host/Config.h"
 
 #include <errno.h>
 #include <stdlib.h>
 #if LLDB_ENABLE_POSIX
 #include <netinet/in.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <unistd.h>
size_t ProcessGDBRemote::DoReadMemory(addr_t addr, void *buf, size_t size,
   }
   return 0;
 }
 
 bool ProcessGDBRemote::SupportsMemoryTagging() {
   return m_gdb_comm.GetMemoryTaggingSupported();
 }
 
+llvm::Expected<std::vector<uint8_t>>
+ProcessGDBRemote::DoReadMemoryTags(lldb::addr_t addr, size_t len,
+                                   int32_t type) {
+  // By this point ReadMemoryTags has validated that tagging is enabled
+  // for this target/process/address.
+  DataBufferSP buffer_sp = m_gdb_comm.ReadMemoryTags(addr, len, type);
+  if (!buffer_sp) {
+    return llvm::createStringError(llvm::inconvertibleErrorCode(),
+                                   "Error reading memory tags from remote");
+  }
+
+  // Return the raw tag data
+  llvm::ArrayRef<uint8_t> tag_data = buffer_sp->GetData();
+  std::vector<uint8_t> got;
+  got.reserve(tag_data.size());
+  std::copy(tag_data.begin(), tag_data.end(), std::back_inserter(got));
+  return got;
+}
+
 Status ProcessGDBRemote::WriteObjectFile(
     std::vector<ObjectFile::LoadableData> entries) {
   Status error;
   // Sort the entries by address because some writes, like those to flash
   // memory, must happen in order of increasing address.
   std::stable_sort(
       std::begin(entries), std::end(entries),
       [](const ObjectFile::LoadableData a, const ObjectFile::LoadableData b) {

lldb/source/Target/Process.cpp

 //===-- Process.cpp -------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include <atomic>
 #include <memory>
 #include <mutex>
 
 #include "llvm/Support/ScopedPrinter.h"
 #include "llvm/Support/Threading.h"
 
 #include "lldb/Breakpoint/BreakpointLocation.h"
 #include "lldb/Breakpoint/StoppointCallbackContext.h"
 #include "lldb/Core/Debugger.h"
 #include "lldb/Core/Module.h"
 #include "lldb/Core/ModuleSpec.h"
 #include "lldb/Core/PluginManager.h"
 #include "lldb/Core/StreamFile.h"
 #include "lldb/Expression/DiagnosticManager.h"
 #include "lldb/Expression/DynamicCheckerFunctions.h"
if (frame) {
         }
         return true;
       }
     }
   }
 
   return false;
 }
+
+llvm::Expected<const MemoryTagManager *>
+Process::GetMemoryTagManager(lldb::addr_t addr, lldb::addr_t end_addr) {
+  Architecture *arch = GetTarget().GetArchitecturePlugin();
+  const MemoryTagManager *tag_manager =
+      arch ? arch->GetMemoryTagManager() : nullptr;
+  if (!arch || !tag_manager) {
+    return llvm::createStringError(
+        llvm::inconvertibleErrorCode(),
+        "This architecture does not support memory tagging",
+        GetPluginName().GetCString());
+  }
+
+  if (!SupportsMemoryTagging()) {
+    return llvm::createStringError(llvm::inconvertibleErrorCode(),
+                                   "Process does not support memory tagging");
+  }
+
+  ptrdiff_t len = tag_manager->AddressDiff(end_addr, addr);
+  if (len <= 0) {
+    return llvm::createStringError(
+        llvm::inconvertibleErrorCode(),
+        "End address (0x%" PRIx64
+        ") must be greater than the start address (0x%" PRIx64 ")",
+        end_addr, addr);
+  }
+
+  // Region lookup is not address size aware so mask the address
+  MemoryRegionInfo::RangeType tag_range(tag_manager->RemoveNonAddressBits(addr),
+                                        len);
+  tag_range = tag_manager->ExpandToGranule(tag_range);
+
+  // Make a copy so we can use the original range in errors
+  MemoryRegionInfo::RangeType remaining_range(tag_range);
+
+  // While we haven't found a matching memory region for some of the range
+  while (remaining_range.IsValid()) {
+    MemoryRegionInfo region;
+    Status status = GetMemoryRegionInfo(remaining_range.GetRangeBase(), region);
+
+    if (status.Fail() || region.GetMemoryTagged() != MemoryRegionInfo::eYes) {
+      return llvm::createStringError(
+          llvm::inconvertibleErrorCode(),
+          "Address range 0x%lx:0x%lx is not in a memory tagged region",
+          tag_range.GetRangeBase(), tag_range.GetRangeEnd());
+    }
+
+    if (region.GetRange().GetRangeEnd() >= remaining_range.GetRangeEnd()) {
+      // We've found a region for the whole range or the last piece of a range
+      remaining_range.SetByteSize(0);
+    } else {
+      // We've found some part of the range, look for the rest
+      remaining_range.SetRangeBase(region.GetRange().GetRangeEnd());
+    }
+  }
+
+  return tag_manager;
+}
+
+llvm::Expected<std::vector<lldb::addr_t>>
+Process::ReadMemoryTags(const MemoryTagManager *tag_manager, lldb::addr_t addr,
+                        size_t len) {
+  if (!tag_manager) {
+    return llvm::createStringError(
+        llvm::inconvertibleErrorCode(),
+        "A memory tag manager is required for reading memory tags.");
+  }
+
+  MemoryTagManager::TagRange range(tag_manager->RemoveNonAddressBits(addr),
+                                   len);
+  range = tag_manager->ExpandToGranule(range);
+
+  llvm::Expected<std::vector<uint8_t>> tag_data =
+      DoReadMemoryTags(range.GetRangeBase(), range.GetByteSize(),
+                       tag_manager->GetAllocationTagType());
+  if (!tag_data)
+    return tag_data.takeError();
+
+  return tag_manager->UnpackTags(*tag_data, range.GetByteSize() /
+                                                tag_manager->GetGranuleSize());
+}

lldb/unittests/Process/gdb-remote/GDBRemoteCommunicationClientTest.cpp

 //===-- GDBRemoteCommunicationClientTest.cpp ------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 #include "Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.h"
 #include "GDBRemoteTestUtils.h"
 #include "lldb/Core/ModuleSpec.h"
 #include "lldb/Host/XML.h"
 #include "lldb/Target/MemoryRegionInfo.h"
 #include "lldb/Utility/DataBuffer.h"
 #include "lldb/Utility/StructuredData.h"
 #include "lldb/Utility/TraceOptions.h"
 #include "lldb/lldb-enumerations.h"
TEST_F(GDBRemoteCommunicationClientTest, GetQOffsets) {
   EXPECT_EQ(llvm::None, GetQOffsets("Text=bogus"));
   EXPECT_EQ(llvm::None, GetQOffsets("Text=1234"));
   EXPECT_EQ(llvm::None, GetQOffsets("Text=1234;Data=1234;"));
   EXPECT_EQ(llvm::None, GetQOffsets("Text=1234;Data=1234;Bss=1234;"));
   EXPECT_EQ(llvm::None, GetQOffsets("TEXTSEG=1234"));
   EXPECT_EQ(llvm::None, GetQOffsets("TextSeg=0x1234"));
   EXPECT_EQ(llvm::None, GetQOffsets("TextSeg=12345678123456789"));
 }
+
+static void
+check_qmemtags(TestClient &client, MockServer &server, size_t read_len,
+               const char *packet, llvm::StringRef response,
+               llvm::Optional<std::vector<uint8_t>> expected_tag_data) {
+  const auto &ReadMemoryTags = [&](size_t len, const char *packet,
+                                   llvm::StringRef response) {
+    std::future<DataBufferSP> result = std::async(std::launch::async, [&] {
+      return client.ReadMemoryTags(0xDEF0, read_len, 1);
+    });
+
+    HandlePacket(server, packet, response);
+    return result.get();
+  };
+
+  auto result = ReadMemoryTags(0, packet, response);
+  if (expected_tag_data) {
+    ASSERT_TRUE(result);
+    llvm::ArrayRef<uint8_t> expected(*expected_tag_data);
+    llvm::ArrayRef<uint8_t> got = result->GetData();
+    ASSERT_THAT(expected, testing::ContainerEq(got));
+  } else {
+    ASSERT_FALSE(result);
+  }
+}
+
+TEST_F(GDBRemoteCommunicationClientTest, ReadMemoryTags) {
+  // Zero length reads are valid
+  check_qmemtags(client, server, 0, "qMemTags:def0,0:1", "m",
+                 std::vector<uint8_t>{});
+
+  // The client layer does not check the length of the received data.
+  // All we need is the "m" and for the decode to use all of the chars
+  check_qmemtags(client, server, 32, "qMemTags:def0,20:1", "m09",
+                 std::vector<uint8_t>{0x9});
+
+  // Zero length response is fine as long as the "m" is present
+  check_qmemtags(client, server, 0, "qMemTags:def0,0:1", "m",
+                 std::vector<uint8_t>{});
+
+  // Normal responses
+  check_qmemtags(client, server, 16, "qMemTags:def0,10:1", "m66",
+                 std::vector<uint8_t>{0x66});
+  check_qmemtags(client, server, 32, "qMemTags:def0,20:1", "m0102",
+                 std::vector<uint8_t>{0x1, 0x2});
+
+  // Empty response is an error
+  check_qmemtags(client, server, 17, "qMemTags:def0,11:1", "", llvm::None);
+  // Usual error response
+  check_qmemtags(client, server, 17, "qMemTags:def0,11:1", "E01", llvm::None);
+  // Leading m missing
+  check_qmemtags(client, server, 17, "qMemTags:def0,11:1", "01", llvm::None);
+  // Anything other than m is an error
+  check_qmemtags(client, server, 17, "qMemTags:def0,11:1", "z01", llvm::None);
+  // Decoding tag data doesn't use all the chars in the packet
+  check_qmemtags(client, server, 32, "qMemTags:def0,20:1", "m09zz", llvm::None);
+  // Data that is not hex bytes
+  check_qmemtags(client, server, 32, "qMemTags:def0,20:1", "mhello",
+                 llvm::None);
+  // Data is not a complete hex char
+  check_qmemtags(client, server, 32, "qMemTags:def0,20:1", "m9", llvm::None);
+  // Data has a trailing hex char
+  check_qmemtags(client, server, 32, "qMemTags:def0,20:1", "m01020",
+                 llvm::None);
+}