1 //===-- hwasan.h ------------------------------------------------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file is a part of HWAddressSanitizer.
10 //
11 // Private Hwasan header.
12 //===----------------------------------------------------------------------===//
13 
14 #ifndef HWASAN_H
15 #define HWASAN_H
16 
17 #include "hwasan_flags.h"
18 #include "hwasan_interface_internal.h"
19 #include "hwasan_mapping.h"
20 #include "sanitizer_common/sanitizer_common.h"
21 #include "sanitizer_common/sanitizer_flags.h"
22 #include "sanitizer_common/sanitizer_internal_defs.h"
23 #include "sanitizer_common/sanitizer_stacktrace.h"
24 #include "ubsan/ubsan_platform.h"
25 
26 #ifndef HWASAN_CONTAINS_UBSAN
27 # define HWASAN_CONTAINS_UBSAN CAN_SANITIZE_UB
28 #endif
29 
30 #ifndef HWASAN_WITH_INTERCEPTORS
31 #define HWASAN_WITH_INTERCEPTORS 0
32 #endif
33 
34 #ifndef HWASAN_REPLACE_OPERATORS_NEW_AND_DELETE
35 #define HWASAN_REPLACE_OPERATORS_NEW_AND_DELETE HWASAN_WITH_INTERCEPTORS
36 #endif
37 
38 typedef u8 tag_t;
39 
40 #if defined(HWASAN_ALIASING_MODE)
41 #  if !defined(__x86_64__)
42 #    error Aliasing mode is only supported on x86_64
43 #  endif
44 // Tags are done in middle bits using userspace aliasing.
45 constexpr unsigned kAddressTagShift = 39;
46 constexpr unsigned kTagBits = 3;
47 
48 // The alias region is placed next to the shadow so the upper bits of all
49 // taggable addresses matches the upper bits of the shadow base.  This shift
50 // value determines which upper bits must match.  It has a floor of 44 since the
51 // shadow is always 8TB.
52 // TODO(morehouse): In alias mode we can shrink the shadow and use a
53 // simpler/faster shadow calculation.
54 constexpr unsigned kTaggableRegionCheckShift =
55     __sanitizer::Max(kAddressTagShift + kTagBits + 1U, 44U);
56 #elif defined(__x86_64__)
57 // Tags are done in upper bits using Intel LAM.
58 constexpr unsigned kAddressTagShift = 57;
59 constexpr unsigned kTagBits = 6;
60 #else
61 // TBI (Top Byte Ignore) feature of AArch64: bits [63:56] are ignored in address
62 // translation and can be used to store a tag.
63 constexpr unsigned kAddressTagShift = 56;
64 constexpr unsigned kTagBits = 8;
65 #endif  // defined(HWASAN_ALIASING_MODE)
66 
67 // Mask for extracting tag bits from the lower 8 bits.
68 constexpr uptr kTagMask = (1UL << kTagBits) - 1;
69 
70 // Mask for extracting tag bits from full pointers.
71 constexpr uptr kAddressTagMask = kTagMask << kAddressTagShift;
72 
73 // Minimal alignment of the shadow base address. Determines the space available
74 // for threads and stack histories. This is an ABI constant.
75 const unsigned kShadowBaseAlignment = 32;
76 
77 const unsigned kRecordAddrBaseTagShift = 3;
78 const unsigned kRecordFPShift = 48;
79 const unsigned kRecordFPLShift = 4;
80 const unsigned kRecordFPModulus = 1 << (64 - kRecordFPShift + kRecordFPLShift);
81 
82 static inline bool InTaggableRegion(uptr addr) {
83 #if defined(HWASAN_ALIASING_MODE)
84   // Aliases are mapped next to shadow so that the upper bits match the shadow
85   // base.
86   return (addr >> kTaggableRegionCheckShift) ==
87          (__hwasan::GetShadowOffset() >> kTaggableRegionCheckShift);
88 #endif
89   return true;
90 }
91 
92 static inline tag_t GetTagFromPointer(uptr p) {
93   return InTaggableRegion(p) ? ((p >> kAddressTagShift) & kTagMask) : 0;
94 }
95 
96 static inline uptr UntagAddr(uptr tagged_addr) {
97   return InTaggableRegion(tagged_addr) ? (tagged_addr & ~kAddressTagMask)
98                                        : tagged_addr;
99 }
100 
101 static inline void *UntagPtr(const void *tagged_ptr) {
102   return reinterpret_cast<void *>(
103       UntagAddr(reinterpret_cast<uptr>(tagged_ptr)));
104 }
105 
106 static inline uptr AddTagToPointer(uptr p, tag_t tag) {
107   return InTaggableRegion(p)
108              ? ((p & ~kAddressTagMask) | ((uptr)tag << kAddressTagShift))
109              : p;
110 }
111 
112 namespace __hwasan {
113 
114 extern int hwasan_inited;
115 extern bool hwasan_init_is_running;
116 extern int hwasan_report_count;
117 
118 bool InitShadow();
119 void InitializeOsSupport();
120 void InitThreads();
121 void InitializeInterceptors();
122 
123 void HwasanAllocatorInit();
124 void HwasanAllocatorLock();
125 void HwasanAllocatorUnlock();
126 
127 void *hwasan_malloc(uptr size, StackTrace *stack);
128 void *hwasan_calloc(uptr nmemb, uptr size, StackTrace *stack);
129 void *hwasan_realloc(void *ptr, uptr size, StackTrace *stack);
130 void *hwasan_reallocarray(void *ptr, uptr nmemb, uptr size, StackTrace *stack);
131 void *hwasan_valloc(uptr size, StackTrace *stack);
132 void *hwasan_pvalloc(uptr size, StackTrace *stack);
133 void *hwasan_aligned_alloc(uptr alignment, uptr size, StackTrace *stack);
134 void *hwasan_memalign(uptr alignment, uptr size, StackTrace *stack);
135 int hwasan_posix_memalign(void **memptr, uptr alignment, uptr size,
136                         StackTrace *stack);
137 void hwasan_free(void *ptr, StackTrace *stack);
138 
139 void InstallAtExitHandler();
140 
141 #define GET_MALLOC_STACK_TRACE                                            \
142   BufferedStackTrace stack;                                               \
143   if (hwasan_inited)                                                      \
144     stack.Unwind(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME(),         \
145                  nullptr, common_flags()->fast_unwind_on_malloc,          \
146                  common_flags()->malloc_context_size)
147 
148 #define GET_FATAL_STACK_TRACE_PC_BP(pc, bp)              \
149   BufferedStackTrace stack;                              \
150   if (hwasan_inited)                                     \
151     stack.Unwind(pc, bp, nullptr, common_flags()->fast_unwind_on_fatal)
152 
153 void HwasanTSDInit();
154 void HwasanTSDThreadInit();
155 void HwasanAtExit();
156 
157 void HwasanOnDeadlySignal(int signo, void *info, void *context);
158 
159 void HwasanInstallAtForkHandler();
160 
161 void InstallAtExitCheckLeaks();
162 
163 void UpdateMemoryUsage();
164 
165 void AppendToErrorMessageBuffer(const char *buffer);
166 
167 void AndroidTestTlsSlot();
168 
169 // This is a compiler-generated struct that can be shared between hwasan
170 // implementations.
171 struct AccessInfo {
172   uptr addr;
173   uptr size;
174   bool is_store;
175   bool is_load;
176   bool recover;
177 };
178 
179 // Given access info and frame information, unwind the stack and report the tag
180 // mismatch.
181 void HandleTagMismatch(AccessInfo ai, uptr pc, uptr frame, void *uc,
182                        uptr *registers_frame = nullptr);
183 
184 // This dispatches to HandleTagMismatch but sets up the AccessInfo, program
185 // counter, and frame pointer.
186 void HwasanTagMismatch(uptr addr, uptr pc, uptr frame, uptr access_info,
187                        uptr *registers_frame, size_t outsize);
188 
189 }  // namespace __hwasan
190 
191 #if HWASAN_WITH_INTERCEPTORS
192 // For both bionic and glibc __sigset_t is an unsigned long.
193 typedef unsigned long __hw_sigset_t;
194 // Setjmp and longjmp implementations are platform specific, and hence the
195 // interception code is platform specific too.
196 #  if defined(__aarch64__)
197 constexpr size_t kHwRegisterBufSize = 22;
198 #  elif defined(__x86_64__)
199 constexpr size_t kHwRegisterBufSize = 8;
200 #  elif SANITIZER_RISCV64
201 // saving PC, 12 int regs, sp, 12 fp regs
202 #    ifndef __riscv_float_abi_soft
203 constexpr size_t kHwRegisterBufSize = 1 + 12 + 1 + 12;
204 #    else
205 constexpr size_t kHwRegisterBufSize = 1 + 12 + 1;
206 #    endif
207 #  endif
208 typedef unsigned long long __hw_register_buf[kHwRegisterBufSize];
209 struct __hw_jmp_buf_struct {
210   // NOTE: The machine-dependent definition of `__sigsetjmp'
211   // assume that a `__hw_jmp_buf' begins with a `__hw_register_buf' and that
212   // `__mask_was_saved' follows it.  Do not move these members or add others
213   // before it.
214   //
215   // We add a __magic field to our struct to catch cases where libc's setjmp
216   // populated the jmp_buf instead of our interceptor.
217   __hw_register_buf __jmpbuf; // Calling environment.
218   unsigned __mask_was_saved : 1;  // Saved the signal mask?
219   unsigned __magic : 31;      // Used to distinguish __hw_jmp_buf from jmp_buf.
220   __hw_sigset_t __saved_mask; // Saved signal mask.
221 };
222 typedef struct __hw_jmp_buf_struct __hw_jmp_buf[1];
223 typedef struct __hw_jmp_buf_struct __hw_sigjmp_buf[1];
224 constexpr unsigned kHwJmpBufMagic = 0x248ACE77;
225 #endif  // HWASAN_WITH_INTERCEPTORS
226 
227 #define ENSURE_HWASAN_INITED()      \
228   do {                              \
229     CHECK(!hwasan_init_is_running); \
230     if (!hwasan_inited) {           \
231       __hwasan_init();              \
232     }                               \
233   } while (0)
234 
235 #endif  // HWASAN_H
236