1 //===-- hwasan.cc ---------------------------------------------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file is a part of HWAddressSanitizer.
12 // HWAddressSanitizer runtime.
13 //===----------------------------------------------------------------------===//
16 #include "hwasan_mapping.h"
17 #include "hwasan_poisoning.h"
18 #include "hwasan_report.h"
19 #include "hwasan_thread.h"
20 #include "sanitizer_common/sanitizer_atomic.h"
21 #include "sanitizer_common/sanitizer_common.h"
22 #include "sanitizer_common/sanitizer_flags.h"
23 #include "sanitizer_common/sanitizer_flag_parser.h"
24 #include "sanitizer_common/sanitizer_libc.h"
25 #include "sanitizer_common/sanitizer_procmaps.h"
26 #include "sanitizer_common/sanitizer_stacktrace.h"
27 #include "sanitizer_common/sanitizer_symbolizer.h"
28 #include "sanitizer_common/sanitizer_stackdepot.h"
29 #include "ubsan/ubsan_flags.h"
30 #include "ubsan/ubsan_init.h"
32 // ACHTUNG! No system header includes in this file.
34 using namespace __sanitizer;
38 void EnterSymbolizer() {
39 HwasanThread *t = GetCurrentThread();
43 void ExitSymbolizer() {
44 HwasanThread *t = GetCurrentThread();
48 bool IsInSymbolizer() {
49 HwasanThread *t = GetCurrentThread();
50 return t && t->InSymbolizer();
53 static Flags hwasan_flags;
59 int hwasan_inited = 0;
60 bool hwasan_init_is_running;
62 int hwasan_report_count = 0;
64 void Flags::SetDefaults() {
65 #define HWASAN_FLAG(Type, Name, DefaultValue, Description) Name = DefaultValue;
66 #include "hwasan_flags.inc"
70 static void RegisterHwasanFlags(FlagParser *parser, Flags *f) {
71 #define HWASAN_FLAG(Type, Name, DefaultValue, Description) \
72 RegisterFlag(parser, #Name, Description, &f->Name);
73 #include "hwasan_flags.inc"
77 static void InitializeFlags() {
78 SetCommonFlagsDefaults();
81 cf.CopyFrom(*common_flags());
82 cf.external_symbolizer_path = GetEnv("HWASAN_SYMBOLIZER_PATH");
83 cf.malloc_context_size = 20;
84 cf.handle_ioctl = true;
85 // FIXME: test and enable.
86 cf.check_printf = false;
87 cf.intercept_tls_get_addr = true;
89 cf.handle_sigtrap = kHandleSignalExclusive;
90 OverrideCommonFlags(cf);
97 RegisterHwasanFlags(&parser, f);
98 RegisterCommonFlags(&parser);
100 #if HWASAN_CONTAINS_UBSAN
101 __ubsan::Flags *uf = __ubsan::flags();
104 FlagParser ubsan_parser;
105 __ubsan::RegisterUbsanFlags(&ubsan_parser, uf);
106 RegisterCommonFlags(&ubsan_parser);
109 // Override from user-specified string.
110 if (__hwasan_default_options)
111 parser.ParseString(__hwasan_default_options());
112 #if HWASAN_CONTAINS_UBSAN
113 const char *ubsan_default_options = __ubsan::MaybeCallUbsanDefaultOptions();
114 ubsan_parser.ParseString(ubsan_default_options);
117 const char *hwasan_options = GetEnv("HWASAN_OPTIONS");
118 parser.ParseString(hwasan_options);
119 #if HWASAN_CONTAINS_UBSAN
120 ubsan_parser.ParseString(GetEnv("UBSAN_OPTIONS"));
122 VPrintf(1, "HWASAN_OPTIONS: %s\n", hwasan_options ? hwasan_options : "<empty>");
124 InitializeCommonFlags();
126 if (Verbosity()) ReportUnrecognizedFlags();
128 if (common_flags()->help) parser.PrintFlagDescriptions();
131 void GetStackTrace(BufferedStackTrace *stack, uptr max_s, uptr pc, uptr bp,
132 void *context, bool request_fast_unwind) {
133 HwasanThread *t = GetCurrentThread();
134 if (!t || !StackTrace::WillUseFastUnwind(request_fast_unwind)) {
135 // Block reports from our interceptors during _Unwind_Backtrace.
136 SymbolizerScope sym_scope;
137 return stack->Unwind(max_s, pc, bp, context, 0, 0, request_fast_unwind);
139 stack->Unwind(max_s, pc, bp, context, t->stack_top(), t->stack_bottom(),
140 request_fast_unwind);
143 void PrintWarning(uptr pc, uptr bp) {
144 GET_FATAL_STACK_TRACE_PC_BP(pc, bp);
145 ReportInvalidAccess(&stack, 0);
148 static void HWAsanCheckFailed(const char *file, int line, const char *cond,
150 Report("HWAddressSanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n", file,
151 line, cond, (uptr)v1, (uptr)v2);
152 PRINT_CURRENT_STACK_CHECK();
156 } // namespace __hwasan
160 using namespace __hwasan;
162 uptr __hwasan_shadow_memory_dynamic_address; // Global interface symbol.
164 void __hwasan_init() {
165 CHECK(!hwasan_init_is_running);
166 if (hwasan_inited) return;
167 hwasan_init_is_running = 1;
168 SanitizerToolName = "HWAddressSanitizer";
175 // Install tool-specific callbacks in sanitizer_common.
176 SetCheckFailedCallback(HWAsanCheckFailed);
178 __sanitizer_set_report_path(common_flags()->log_path);
180 DisableCoreDumperIfNecessary();
182 Printf("FATAL: HWAddressSanitizer cannot mmap the shadow memory.\n");
183 if (HWASAN_FIXED_MAPPING) {
184 Printf("FATAL: Make sure to compile with -fPIE and to link with -pie.\n");
185 Printf("FATAL: Disabling ASLR is known to cause this error.\n");
186 Printf("FATAL: If running under GDB, try "
187 "'set disable-randomization off'.\n");
193 InitializeInterceptors();
194 InstallDeadlySignalHandlers(HwasanOnDeadlySignal);
195 InstallAtExitHandler(); // Needs __cxa_atexit interceptor.
197 Symbolizer::GetOrInit()->AddHooks(EnterSymbolizer, ExitSymbolizer);
199 InitializeCoverage(common_flags()->coverage, common_flags()->coverage_dir);
201 HwasanTSDInit(HwasanTSDDtor);
203 HwasanAllocatorInit();
205 HwasanThread *main_thread = HwasanThread::Create(nullptr, nullptr);
206 SetCurrentThread(main_thread);
207 main_thread->ThreadStart();
209 #if HWASAN_CONTAINS_UBSAN
210 __ubsan::InitAsPlugin();
213 VPrintf(1, "HWAddressSanitizer init done\n");
215 hwasan_init_is_running = 0;
219 void __hwasan_print_shadow(const void *x, uptr size) {
221 Printf("FIXME: __hwasan_print_shadow unimplemented\n");
224 sptr __hwasan_test_shadow(const void *p, uptr sz) {
227 tag_t ptr_tag = GetTagFromPointer((uptr)p);
230 uptr ptr_raw = GetAddressFromPointer((uptr)p);
231 uptr shadow_first = MEM_TO_SHADOW(ptr_raw);
232 uptr shadow_last = MEM_TO_SHADOW(ptr_raw + sz - 1);
233 for (uptr s = shadow_first; s <= shadow_last; ++s)
234 if (*(tag_t*)s != ptr_tag)
235 return SHADOW_TO_MEM(s) - ptr_raw;
239 u16 __sanitizer_unaligned_load16(const uu16 *p) {
242 u32 __sanitizer_unaligned_load32(const uu32 *p) {
245 u64 __sanitizer_unaligned_load64(const uu64 *p) {
248 void __sanitizer_unaligned_store16(uu16 *p, u16 x) {
251 void __sanitizer_unaligned_store32(uu32 *p, u32 x) {
254 void __sanitizer_unaligned_store64(uu64 *p, u64 x) {
259 __attribute__((always_inline))
260 static void SigTrap(uptr p) {
261 #if defined(__aarch64__)
263 // 0x900 is added to do not interfere with the kernel use of lower values of
265 // FIXME: Add a constraint to put the pointer into x0, the same as x86 branch.
266 asm("brk %0\n\t" ::"n"(0x900 + X));
267 #elif defined(__x86_64__)
268 // INT3 + NOP DWORD ptr [EAX + X] to pass X to our signal handler, 5 bytes
269 // total. The pointer is passed via rdi.
270 // 0x40 is added as a safeguard, to help distinguish our trap from others and
271 // to avoid 0 offsets in the command (otherwise it'll be reduced to a
272 // different nop command, the three bytes one).
276 :: "n"(0x40 + X), "D"(p));
278 // FIXME: not always sigill.
281 // __builtin_unreachable();
284 enum class ErrorAction { Abort, Recover };
285 enum class AccessType { Load, Store };
287 template <ErrorAction EA, AccessType AT, unsigned LogSize>
288 __attribute__((always_inline, nodebug)) static void CheckAddress(uptr p) {
289 tag_t ptr_tag = GetTagFromPointer(p);
290 uptr ptr_raw = p & ~kAddressTagMask;
291 tag_t mem_tag = *(tag_t *)MEM_TO_SHADOW(ptr_raw);
292 if (UNLIKELY(ptr_tag != mem_tag)) {
293 SigTrap<0x20 * (EA == ErrorAction::Recover) +
294 0x10 * (AT == AccessType::Store) + LogSize>(p);
295 if (EA == ErrorAction::Abort) __builtin_unreachable();
299 template <ErrorAction EA, AccessType AT>
300 __attribute__((always_inline, nodebug)) static void CheckAddressSized(uptr p,
303 tag_t ptr_tag = GetTagFromPointer(p);
304 uptr ptr_raw = p & ~kAddressTagMask;
305 tag_t *shadow_first = (tag_t *)MEM_TO_SHADOW(ptr_raw);
306 tag_t *shadow_last = (tag_t *)MEM_TO_SHADOW(ptr_raw + sz - 1);
307 for (tag_t *t = shadow_first; t <= shadow_last; ++t)
308 if (UNLIKELY(ptr_tag != *t)) {
309 SigTrap<0x20 * (EA == ErrorAction::Recover) +
310 0x10 * (AT == AccessType::Store) + 0xf>(p);
311 if (EA == ErrorAction::Abort) __builtin_unreachable();
315 void __hwasan_loadN(uptr p, uptr sz) {
316 CheckAddressSized<ErrorAction::Abort, AccessType::Load>(p, sz);
318 void __hwasan_load1(uptr p) {
319 CheckAddress<ErrorAction::Abort, AccessType::Load, 0>(p);
321 void __hwasan_load2(uptr p) {
322 CheckAddress<ErrorAction::Abort, AccessType::Load, 1>(p);
324 void __hwasan_load4(uptr p) {
325 CheckAddress<ErrorAction::Abort, AccessType::Load, 2>(p);
327 void __hwasan_load8(uptr p) {
328 CheckAddress<ErrorAction::Abort, AccessType::Load, 3>(p);
330 void __hwasan_load16(uptr p) {
331 CheckAddress<ErrorAction::Abort, AccessType::Load, 4>(p);
334 void __hwasan_loadN_noabort(uptr p, uptr sz) {
335 CheckAddressSized<ErrorAction::Recover, AccessType::Load>(p, sz);
337 void __hwasan_load1_noabort(uptr p) {
338 CheckAddress<ErrorAction::Recover, AccessType::Load, 0>(p);
340 void __hwasan_load2_noabort(uptr p) {
341 CheckAddress<ErrorAction::Recover, AccessType::Load, 1>(p);
343 void __hwasan_load4_noabort(uptr p) {
344 CheckAddress<ErrorAction::Recover, AccessType::Load, 2>(p);
346 void __hwasan_load8_noabort(uptr p) {
347 CheckAddress<ErrorAction::Recover, AccessType::Load, 3>(p);
349 void __hwasan_load16_noabort(uptr p) {
350 CheckAddress<ErrorAction::Recover, AccessType::Load, 4>(p);
353 void __hwasan_storeN(uptr p, uptr sz) {
354 CheckAddressSized<ErrorAction::Abort, AccessType::Store>(p, sz);
356 void __hwasan_store1(uptr p) {
357 CheckAddress<ErrorAction::Abort, AccessType::Store, 0>(p);
359 void __hwasan_store2(uptr p) {
360 CheckAddress<ErrorAction::Abort, AccessType::Store, 1>(p);
362 void __hwasan_store4(uptr p) {
363 CheckAddress<ErrorAction::Abort, AccessType::Store, 2>(p);
365 void __hwasan_store8(uptr p) {
366 CheckAddress<ErrorAction::Abort, AccessType::Store, 3>(p);
368 void __hwasan_store16(uptr p) {
369 CheckAddress<ErrorAction::Abort, AccessType::Store, 4>(p);
372 void __hwasan_storeN_noabort(uptr p, uptr sz) {
373 CheckAddressSized<ErrorAction::Recover, AccessType::Store>(p, sz);
375 void __hwasan_store1_noabort(uptr p) {
376 CheckAddress<ErrorAction::Recover, AccessType::Store, 0>(p);
378 void __hwasan_store2_noabort(uptr p) {
379 CheckAddress<ErrorAction::Recover, AccessType::Store, 1>(p);
381 void __hwasan_store4_noabort(uptr p) {
382 CheckAddress<ErrorAction::Recover, AccessType::Store, 2>(p);
384 void __hwasan_store8_noabort(uptr p) {
385 CheckAddress<ErrorAction::Recover, AccessType::Store, 3>(p);
387 void __hwasan_store16_noabort(uptr p) {
388 CheckAddress<ErrorAction::Recover, AccessType::Store, 4>(p);
391 void __hwasan_tag_memory(uptr p, u8 tag, uptr sz) {
392 TagMemoryAligned(p, sz, tag);
395 static const u8 kFallbackTag = 0xBB;
397 u8 __hwasan_generate_tag() {
398 HwasanThread *t = GetCurrentThread();
399 if (!t) return kFallbackTag;
400 return t->GenerateRandomTag();
403 #if !SANITIZER_SUPPORTS_WEAK_HOOKS
405 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
406 const char* __hwasan_default_options() { return ""; }
411 SANITIZER_INTERFACE_ATTRIBUTE
412 void __sanitizer_print_stack_trace() {
413 GET_FATAL_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME());