[sanitizer][LoongArch] Port address sanitizer to LoongArch

[xry111]

Summary

Depends on D129371.

It survived all GCC ASan tests.

Changes are trivial and mostly "borrowed" RISC-V logics, except that a different SHADOW_OFFSET is used.

[xry111]

compiler-rt/lib/asan/asan_mapping.h

117

47-bit VMA (16-KB pages with 3-level page table) is the default of Linux Kconfig for LoongArch. Is there any way to support other VMA sizes alongside 47-bit?

[xry111]

Remove unnecessary brackets.

[SixWeining]

Add @XiaodongLoong who ever ported compiler-rt to LoongArch on LLVM8 in the old world where the VMA is 40-bit. Thanks.

compiler-rt/lib/asan/asan_mapping.h

117

Is the VMA 47-bit or 48-bit? I remember that it’s 48. Maybe I’m wrong?

[xry111]

compiler-rt/lib/asan/asan_mapping.h

117

The default is 47-bit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/loongarch/Kconfig#n187

It can be configured to 36, 39, 42, 48, or 55 if desired. But AFAIK 48 and 55 are not suitable for desktop distributions because Firefox does not support any VMA size >= 48.

[xry111]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors_vfork_loongarch64.inc.S

27

Shall this be la.global or la.local? I'm not sure about the precise definition of "global" or "local" symbols in the context of LoongArch assembly. And we don't have a manual explaining LoongArch pseudo assembly operations yet...

[xry111]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors_vfork_loongarch64.inc.S

27

My experiment shows it seems depending on if the symbol is DSO local (__attribute__((visibility("hidden")))). For __interception::real_vfork it's DSO local so la.local is better.

A new revision incoming...

[xry111]

Mark __interceptor::real_vfork with ASM_HIDDEN and use la.local for it.

Add %plt for COMMON_INTERCEPTOR_HANDLE_VFORK because it's not DSO local and the linker warns about using calling it w/o PLT.

[xen0n]

LGTM besides two extremely minor nits.

compiler-rt/lib/asan/asan_interceptors_vfork.S

10

The list seems to be alphabetized. Insert it before the riscv64 line?

compiler-rt/lib/sanitizer_common/sanitizer_stacktrace.cpp

124

Similarly, put loongarch before riscv? Although there are only 2 cases at present, future arches (if any) will likely fall into this category too.

[xry111]

Keep lexicographic order

[SixWeining]

Could you share some detail about how to build and test llvm's sanitizer with GCC's testcase? Thanks. Previouly in llvm8 we only test it with clang itself.

compiler-rt/lib/asan/asan_mapping.h

117

Yes. It is 47-bit. The sum of Kernel and User is 48-bit.

[xry111]

In D129418#3641748, @SixWeining wrote:

Could you share some detail about how to build and test llvm's sanitizer with GCC's testcase? Thanks. Previouly in llvm8 we only test it with clang itself.

I've rebased and applied the two diffs for GCC. And for ASan, define TARGET_ASAN_SHADOW_OFFSET to return the shadow offset (1 << 46).

The changes are available at https://github.com/xry111/gcc/tree/me/loongarch-sanitizer-test.

Build it with /path/to/gcc/configure --prefix=/home/xry111/gcc-trunk --disable-multilib --with-system-zlib --enable-libsanitizer --disable-bootstrap, then make. --enable-libsanitizer is necessary because libsanitizer is not enabled by default by GCC building system for LoongArch target. --disable-bootstrap saves some time, but if the system compiler is affected by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106096 you'll need --enable-bootstrap.

Run UBSan tests with make check-gcc RUNTESTFLAGS=ubsan.exp.

Run ASan tests with make check-gcc RUNTESTFLAGS=asan.exp.

[xry111]

Use full diff

[SixWeining]

In D129418#3642075, @xry111 wrote:

In D129418#3641748, @SixWeining wrote:

Could you share some detail about how to build and test llvm's sanitizer with GCC's testcase? Thanks. Previouly in llvm8 we only test it with clang itself.

I've rebased and applied the two diffs for GCC. And for ASan, define TARGET_ASAN_SHADOW_OFFSET to return the shadow offset (1 << 46).

The changes are available at https://github.com/xry111/gcc/tree/me/loongarch-sanitizer-test.

Build it with /path/to/gcc/configure --prefix=/home/xry111/gcc-trunk --disable-multilib --with-system-zlib --enable-libsanitizer --disable-bootstrap, then make. --enable-libsanitizer is necessary because libsanitizer is not enabled by default by GCC building system for LoongArch target. --disable-bootstrap saves some time, but if the system compiler is affected by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106096 you'll need --enable-bootstrap.

Run UBSan tests with make check-gcc RUNTESTFLAGS=ubsan.exp.

Run ASan tests with make check-gcc RUNTESTFLAGS=asan.exp.

LGTM. Thanks.

Seems that currently we can only check the changes by GCC because LoongArch hasn’t been supported by clang.

Not sure whether this change could land. What do others think?

compiler-rt/lib/asan/asan_mapping.h

117

I’m not sure is there any way to support other VMA sizes alongside 47-bit. But I think other architectures may have the same problem as LoongArch.

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors_vfork_loongarch64.inc.S

2

Seems “defined(loongarch) && ” can be removed.

[xry111]

Seems that currently we can only check the changes by GCC because LoongArch hasn’t been supported by clang.

Not sure whether this change could land. What do others think?

+vitalybuka for this question.

[xry111]

run git-clang-format

[MaskRay]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors_vfork_loongarch64.inc.S

9

Does this need to use a common symbol? Consider a regular .type ..., @object in .bss

[xry111]

Define __interception::real_vfork as a normal bss object, instead of common symbol.

[xry111]

Remove unnecessary check for __loongarch__ before __loongarch_lp64.

[xry111]

I don't have write access to rG, if you think these two changes are OK please commit it.

[SixWeining]

LGTM.
As noted in D129371, I think this can land after nits fixed. Thanks.

compiler-rt/lib/sanitizer_common/sanitizer_stacktrace.cpp

124

Nit: uncessary indent.

compiler-rt/cmake/Modules/AllSupportedArchDefs.cmake

if(APPLE)
   set(ARM32 armv7 armv7s armv7k)
   set(X86_64 x86_64 x86_64h)
 endif()
 
 set(ALL_SANITIZER_COMMON_SUPPORTED_ARCH ${X86} ${X86_64} ${PPC64} ${RISCV64}
     ${ARM32} ${ARM64} ${MIPS32} ${MIPS64} ${S390X} ${SPARC} ${SPARCV9}
     ${HEXAGON} ${LOONGARCH64})
 set(ALL_ASAN_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64} ${RISCV64}
-    ${MIPS32} ${MIPS64} ${PPC64} ${S390X} ${SPARC} ${SPARCV9} ${HEXAGON})
+    ${MIPS32} ${MIPS64} ${PPC64} ${S390X} ${SPARC} ${SPARCV9} ${HEXAGON}
+    ${LOONGARCH64})
 set(ALL_DFSAN_SUPPORTED_ARCH ${X86_64} ${MIPS64} ${ARM64})
 
 if(ANDROID)
   set(OS_NAME "Android")
 else()
   set(OS_NAME "${CMAKE_SYSTEM_NAME}")
 endif()
 

compiler-rt/lib/asan/asan_interceptors_vfork.S

 #include "sanitizer_common/sanitizer_asm.h"
 
 #if defined(__linux__)
 #define COMMON_INTERCEPTOR_SPILL_AREA __asan_extra_spill_area
 #define COMMON_INTERCEPTOR_HANDLE_VFORK __asan_handle_vfork
 #include "sanitizer_common/sanitizer_common_interceptors_vfork_aarch64.inc.S"
 #include "sanitizer_common/sanitizer_common_interceptors_vfork_arm.inc.S"
 #include "sanitizer_common/sanitizer_common_interceptors_vfork_i386.inc.S"
+#include "sanitizer_common/sanitizer_common_interceptors_vfork_loongarch64.inc.S"
 #include "sanitizer_common/sanitizer_common_interceptors_vfork_riscv64.inc.S"
 #include "sanitizer_common/sanitizer_common_interceptors_vfork_x86_64.inc.S"
 #endif
 
 NO_EXEC_STACK_DIRECTIVE

compiler-rt/lib/asan/asan_mapping.h

 //
 // Default Linux/SPARC64 (52-bit VMA) mapping:
 // || `[0x8000000000000, 0xfffffffffffff]` || HighMem    ||
 // || `[0x1080000000000, 0x207ffffffffff]` || HighShadow ||
 // || `[0x0090000000000, 0x107ffffffffff]` || ShadowGap  ||
 // || `[0x0080000000000, 0x008ffffffffff]` || LowShadow  ||
 // || `[0x0000000000000, 0x007ffffffffff]` || LowMem     ||
 //
+// Default Linux/LoongArch64 (47-bit VMA) mapping:
+// || `[0x500000000000, 0x7fffffffffff]` || HighMem    ||
+// || `[0x4a0000000000, 0x4fffffffffff]` || HighShadow ||
+// || `[0x480000000000, 0x49ffffffffff]` || ShadowGap  ||
+// || `[0x400000000000, 0x47ffffffffff]` || LowShadow  ||
+// || `[0x000000000000, 0x3fffffffffff]` || LowMem     ||
+//
 // Shadow mapping on FreeBSD/x86-64 with SHADOW_OFFSET == 0x400000000000:
 // || `[0x500000000000, 0x7fffffffffff]` || HighMem    ||
 // || `[0x4a0000000000, 0x4fffffffffff]` || HighShadow ||
 // || `[0x480000000000, 0x49ffffffffff]` || ShadowGap  ||
 // || `[0x400000000000, 0x47ffffffffff]` || LowShadow  ||
 // || `[0x000000000000, 0x3fffffffffff]` || LowMem     ||
 //
 // Shadow mapping on FreeBSD/i386 with SHADOW_OFFSET == 0x40000000:

 #  elif SANITIZER_NETBSD
 #    define ASAN_SHADOW_OFFSET_CONST 0x0000400000000000
 #  elif SANITIZER_APPLE
 #    define ASAN_SHADOW_OFFSET_CONST 0x0000100000000000
 #  elif defined(__mips64)
 #    define ASAN_SHADOW_OFFSET_CONST 0x0000002000000000
 #  elif defined(__sparc__)
 #    define ASAN_SHADOW_OFFSET_CONST 0x0000080000000000
+#  elif SANITIZER_LOONGARCH64
+#    define ASAN_SHADOW_OFFSET_CONST 0x0000400000000000
 #  elif SANITIZER_WINDOWS64
 #    define ASAN_SHADOW_OFFSET_DYNAMIC
 #  else
 #    if ASAN_SHADOW_SCALE != 3
 #      error "Value below is based on shadow scale = 3."
 #      error "Original formula was: 0x7FFFFFFF & (~0xFFFULL << SHADOW_SCALE)."
 #    endif
 #    define ASAN_SHADOW_OFFSET_CONST 0x000000007fff8000

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors_vfork_loongarch64.inc.S

+#if defined(__loongarch_lp64) && defined(__linux__)
+
+#include "sanitizer_common/sanitizer_asm.h"
+
+ASM_HIDDEN(COMMON_INTERCEPTOR_SPILL_AREA)
+ASM_HIDDEN(_ZN14__interception10real_vforkE)
+
+.bss
+.type _ZN14__interception10real_vforkE, @object
+.size _ZN14__interception10real_vforkE, 8
+_ZN14__interception10real_vforkE:
+        .zero     8
+
+.text
+.globl ASM_WRAPPER_NAME(vfork)
+ASM_TYPE_FUNCTION(ASM_WRAPPER_NAME(vfork))
+ASM_WRAPPER_NAME(vfork):
+        // Save ra in the off-stack spill area.
+        // allocate space on stack
+        addi.d    $sp, $sp, -16
+        // store $ra value
+        st.d      $ra, $sp, 8
+        bl        COMMON_INTERCEPTOR_SPILL_AREA
+        // restore previous values from stack
+        ld.d      $ra, $sp, 8
+        // adjust stack
+        addi.d    $sp, $sp, 16
+        // store $ra by $a0
+        st.d      $ra, $a0, 0
+
+        // Call real vfork. This may return twice. User code that runs between the first and the second return
+        // may clobber the stack frame of the interceptor; that's why it does not have a frame.
+        la.local  $a0, _ZN14__interception10real_vforkE
+        ld.d      $a0, $a0, 0
+        jirl      $ra, $a0, 0
+
+        // adjust stack
+        addi.d    $sp, $sp, -16
+        // store $a0 by adjusted stack
+        st.d      $a0, $sp, 8
+        // jump to exit label if $a0 is 0
+        beqz      $a0, .L_exit
+
+        // $a0 != 0 => parent process. Clear stack shadow.
+        // put old $sp to $a0
+        addi.d    $a0, $sp, 16
+        bl        %plt(COMMON_INTERCEPTOR_HANDLE_VFORK)
+
+.L_exit:
+        // Restore $ra
+        bl        COMMON_INTERCEPTOR_SPILL_AREA
+        ld.d      $ra, $a0, 0
+        // load value by stack
+        ld.d      $a0, $sp, 8
+        // adjust stack
+        addi.d    $sp, $sp, 16
+        jr        $ra
+ASM_SIZE(vfork)
+
+.weak vfork
+.set vfork, ASM_WRAPPER_NAME(vfork)
+
+#endif

compiler-rt/lib/sanitizer_common/sanitizer_stacktrace.cpp

#ifdef __powerpc__
     // back chain to find the caller frame before extracting it.
     uhwptr *caller_frame = (uhwptr*)frame[0];
     if (!IsValidFrame((uptr)caller_frame, stack_top, bottom) ||
         !IsAligned((uptr)caller_frame, sizeof(uhwptr)))
       break;
     uhwptr pc1 = caller_frame[2];
 #elif defined(__s390__)
     uhwptr pc1 = frame[14];
-#elif defined(__riscv)
+#elif defined(__loongarch__) || defined(__riscv)
     // frame[-1] contains the return address
     uhwptr pc1 = frame[-1];
 #else
     uhwptr pc1 = STRIP_PAC_PC((void *)frame[1]);
 #endif
     // Let's assume that any pointer in the 0th page (i.e. <0x1000 on i386 and
     // x86_64) is invalid and stop unwinding here.  If we're adding support for
     // a platform where this isn't true, we need to reconsider this check.
     if (pc1 < kPageSize)
       break;
     if (pc1 != pc) {
       trace_buffer[size++] = (uptr) pc1;
     }
     bottom = (uptr)frame;
-#if defined(__riscv)
+#if defined(__loongarch__) || defined(__riscv)
     // frame[-2] contain fp of the previous frame
     uptr new_bp = (uptr)frame[-2];
 #else
     uptr new_bp = (uptr)frame[0];
 #endif
     frame = GetCanonicFrame(new_bp, stack_top, bottom);
   }
 }