Page MenuHomePhabricator

[lldb][AArch64] Add "memory tag read" command

Authored by DavidSpickett on Feb 23 2021, 6:36 AM.



This new command looks much like "memory read"
and mirrors its basic behaviour.

(lldb) memory tag read new_buf_ptr new_buf_ptr+32
Logical tag: 0x9
Allocation tags:
[0x900fffff7ffa000, 0x900fffff7ffa010): 0x9
[0x900fffff7ffa010, 0x900fffff7ffa020): 0x0

Important proprties:

  • The end address is optional and defaults to reading 1 tag if ommitted
  • It is an error to try to read tags if the architecture or process doesn't support it, or if the range asked for is not tagged.
  • It is an error to read an inverted range (end < begin) (logical tags are removed for this check so you can pass tagged addresses here)
  • The range will be expanded to fit the tagging granule, so you can get more tags than simply (end-begin)/granule size. Whatever you get back will always cover the original range.

Diff Detail

Event Timeline

DavidSpickett created this revision.Feb 23 2021, 6:36 AM
DavidSpickett requested review of this revision.Feb 23 2021, 6:36 AM
Herald added a project: Restricted Project. · View Herald TranscriptFeb 23 2021, 6:36 AM

This command is described in the RFC under the name "mtag showatag" ( The change of naming was suggested in feedback and I think it does fit better with the other commands so I went with it.

The output is very basic and could certainly be compacted but this is just the initial implementation.

We could also have this command highlight matches/mismatches. This would reduce (maybe remove) the need for a "memory tag check" command. I think that would be better done as a follow up if so.

DavidSpickett added inline comments.Feb 23 2021, 6:44 AM
47 for descriptions of these functions.

I probably need to add some more comments here for the unfamiliar.

  • Add some comments to explain the intrinsics used.

Update after changing previous patch.

omjavaid accepted this revision.Mar 3 2021, 3:13 AM
This revision is now accepted and ready to land.Mar 3 2021, 3:13 AM
  • RemoveNonAddressBits over RemoveLogicalTag
  • Set bits 63-60 of test file pointers to check we remove the top byte now.
  • Update after changing earlier revisions
  • Read page size only once in the test file
DavidSpickett added a comment.EditedMar 15 2021, 9:20 AM

I still have one known (though rare) limitation to this command. That is, if you try to read across two neighbouring MTE regions it will fail because it thinks that the whole range isn't tagged. When it is, it's just split over two regions.

This would require you to manage to mmap them next to each other. So I'm looking for a way to do this so it can be tested.

Expand test to check that we can read tags for a range that spans
two mappings. This covers updated code in GetMemoryTagManager.

Refactor the test file a bit to account for the extra mmap.

I've tested the mmap sequence on my x86 box which has ASLR enabled
and on Qemu. I always get the ordering we want for the test.
I can't cite anything to say it should always work but I didn't
find any feature that goes out of its way to change the ordering
of mmap allocations.

  • Rebase onto main

Rebase onto main.

Rebase onto earlier patches.

Rebase. Remove result.SetStatus(eReturnStatusFailed) which
is now implicitly done when you add an error.

This revision was landed with ongoing or failed builds.Jun 24 2021, 9:35 AM
This revision was automatically updated to reflect the committed changes.