[RISC-V][HWASAN] Add runtime support for HWASAN for RISC-V

[smd]

Summary

[4/9] patch series to port HWASAN for riscv64

Depends On D131341

[smd]

Updating the patch

[vitalybuka]

compiler-rt/lib/hwasan/hwasan.h

170

Could you please to move HwasanTagMismatch change into a separate patch as it's slightly affects all platforms

[smd]

Addressing comments

[smd]

compiler-rt/lib/hwasan/hwasan.h

170

Fixed, thanks.

[vitalybuka]

LGTM, from sanitizers, but consider adding as blocking reviewer someone with RISCV expertise

[luismarques]

compiler-rt/lib/hwasan/hwasan_checks.h

44

using a register asm variable like in the aarch64 code would avoid the move instruction.

73–74

Ditto.

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

140–165

Nit: \n instead of ;?

[luismarques]

compiler-rt/lib/hwasan/hwasan_checks.h

78

I guess it won't really matter in this case but the n constraint should be an I constraint, to constraint it to a signed 12-bit immediate fit for the addiw.

[smd]

Addressing comments

[smd]

compiler-rt/lib/hwasan/hwasan_checks.h

44

Fixed, thanks.

73–74

Fixed, thanks

78

Fixed, thanks

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

140–165

Personally I'd go with ; since it's used in every other inline asm. Do you have objections?
Thanks

[luismarques]

I didn't notice any other issues but I have no experience with HWASan. Thanks!

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

140–165

No objection.

compiler-rt/lib/hwasan/hwasan.h

 
 // Given access info and frame information, unwind the stack and report the tag
 // mismatch.
 void HandleTagMismatch(AccessInfo ai, uptr pc, uptr frame, void *uc,
                        uptr *registers_frame = nullptr);
 
 // This dispatches to HandleTagMismatch but sets up the AccessInfo, program
 // counter, and frame pointer.
-void HwasanTagMismatch(uptr addr, uptr access_info, uptr *registers_frame,
-                       size_t outsize);
+void HwasanTagMismatch(uptr addr, uptr pc, uptr frame, uptr access_info,
+                       uptr *registers_frame, size_t outsize);
 
 }  // namespace __hwasan
 
 #if HWASAN_WITH_INTERCEPTORS
 // For both bionic and glibc __sigset_t is an unsigned long.
 typedef unsigned long __hw_sigset_t;
 // Setjmp and longjmp implementations are platform specific, and hence the
 // interception code is platform specific too.
 #  if defined(__aarch64__)
 constexpr size_t kHwRegisterBufSize = 22;
 #  elif defined(__x86_64__)
 constexpr size_t kHwRegisterBufSize = 8;
+#  elif SANITIZER_RISCV64
+// saving PC, 12 int regs, sp, 12 fp regs
+#    ifndef __riscv_float_abi_soft
+constexpr size_t kHwRegisterBufSize = 1 + 12 + 1 + 12;
+#    else
+constexpr size_t kHwRegisterBufSize = 1 + 12 + 1;
+#    endif
 #  endif
 typedef unsigned long long __hw_register_buf[kHwRegisterBufSize];
 struct __hw_jmp_buf_struct {
   // NOTE: The machine-dependent definition of `__sigsetjmp'
   // assume that a `__hw_jmp_buf' begins with a `__hw_register_buf' and that
   // `__mask_was_saved' follows it.  Do not move these members or add others
   // before it.
   //

compiler-rt/lib/hwasan/hwasan.cpp

if (registers_frame && stack->trace && stack->size > 0) {
     stack->size--;
   }
 
   bool fatal = flags()->halt_on_error || !ai.recover;
   ReportTagMismatch(stack, ai.addr, ai.size, ai.is_store, fatal,
                     registers_frame);
 }
 
-void HwasanTagMismatch(uptr addr, uptr access_info, uptr *registers_frame,
-                       size_t outsize) {
+void HwasanTagMismatch(uptr addr, uptr pc, uptr frame, uptr access_info,
+                       uptr *registers_frame, size_t outsize) {
   __hwasan::AccessInfo ai;
   ai.is_store = access_info & 0x10;
   ai.is_load = !ai.is_store;
   ai.recover = access_info & 0x20;
   ai.addr = addr;
   if ((access_info & 0xf) == 0xf)
     ai.size = outsize;
   else
     ai.size = 1 << (access_info & 0xf);
 
-  HandleTagMismatch(ai, (uptr)__builtin_return_address(0),
-                    (uptr)__builtin_frame_address(0), nullptr, registers_frame);
+  HandleTagMismatch(ai, pc, frame, nullptr, registers_frame);
 }
 
 Thread *GetCurrentThread() {
   uptr *ThreadLongPtr = GetCurrentThreadLongPtr();
   if (UNLIKELY(*ThreadLongPtr == 0))
     return nullptr;
   auto *R = (StackAllocationsRingBuffer *)ThreadLongPtr;
   return hwasanThreadList().GetThreadByBufferAddress((uptr)R->Next());
void __sanitizer_print_stack_trace() {
   GET_FATAL_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME());
   stack.Print();
 }
 
 // Entry point for interoperability between __hwasan_tag_mismatch (ASM) and the
 // rest of the mismatch handling code (C++).
 void __hwasan_tag_mismatch4(uptr addr, uptr access_info, uptr *registers_frame,
                             size_t outsize) {
-  __hwasan::HwasanTagMismatch(addr, access_info, registers_frame, outsize);
+  __hwasan::HwasanTagMismatch(addr, (uptr)__builtin_return_address(0),
+                              (uptr)__builtin_frame_address(0), access_info,
+                              registers_frame, outsize);
 }
 
 } // extern "C"

compiler-rt/lib/hwasan/hwasan_allocator.h

 #include "hwasan_poisoning.h"
 #include "sanitizer_common/sanitizer_allocator.h"
 #include "sanitizer_common/sanitizer_allocator_checks.h"
 #include "sanitizer_common/sanitizer_allocator_interface.h"
 #include "sanitizer_common/sanitizer_allocator_report.h"
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_ring_buffer.h"
 
-#if !defined(__aarch64__) && !defined(__x86_64__)
-#error Unsupported platform
+#if !defined(__aarch64__) && !defined(__x86_64__) && !(SANITIZER_RISCV64)
+#  error Unsupported platform
 #endif
 
 namespace __hwasan {
 
 struct Metadata {
   u32 requested_size_low;
   u32 requested_size_high : 31;
   u32 right_aligned : 1;

compiler-rt/lib/hwasan/hwasan_checks.h

#elif defined(__x86_64__)
   // total. The pointer is passed via rdi.
   // 0x40 is added as a safeguard, to help distinguish our trap from others and
   // to avoid 0 offsets in the command (otherwise it'll be reduced to a
   // different nop command, the three bytes one).
   asm volatile(
       "int3\n"
       "nopl %c0(%%rax)\n" ::"n"(0x40 + X),
       "D"(p));
+#elif SANITIZER_RISCV64
+  // Put pointer into x10
+  // addiw contains immediate of 0x40 + X, where 0x40 is magic number and X
+  // encodes access size
+  asm volatile(
+      "mv x10, %0\n"
+      "ebreak\n"
+      "addiw x0, x0, %1\n"
+      :
+      : "r"(p), "n"(0x40 + X)
+      : "memory", "x10");
 #else
   // FIXME: not always sigill.
   __builtin_trap();
 #endif
   // __builtin_unreachable();
 }
 
 // Version with access size which is not power of 2
 template <unsigned X>
 __attribute__((always_inline)) static void SigTrap(uptr p, uptr size) {
 #if defined(__aarch64__)
   register uptr x0 asm("x0") = p;
   register uptr x1 asm("x1") = size;
   asm("brk %2\n\t" ::"r"(x0), "r"(x1), "n"(0x900 + X));
 #elif defined(__x86_64__)
   // Size is stored in rsi.
   asm volatile(
       "int3\n"
       "nopl %c0(%%rax)\n" ::"n"(0x40 + X),
       "D"(p), "S"(size));
+#elif SANITIZER_RISCV64
+  // Put access size into x11
+  asm volatile(
+      "mv x10, %0\n"
+      "mv x11, %1\n"
+      "ebreak\n"
+      "addiw x0, x0, %2\n"
+      :
+      : "r"(p), "r"(size), "n"(0x40 + X)
+      : "memory", "x10", "x11");
 #else
   __builtin_trap();
 #endif
   // __builtin_unreachable();
 }
 
 __attribute__((always_inline, nodebug)) static bool PossiblyShortTagMatches(
     tag_t mem_tag, uptr ptr, uptr sz) {
   tag_t ptr_tag = GetTagFromPointer(ptr);
   if (ptr_tag == mem_tag)
     return true;
   if (mem_tag >= kShadowAlignment)
     return false;
   if ((ptr & (kShadowAlignment - 1)) + sz > mem_tag)
     return false;
-#ifndef __aarch64__
+#if !defined(__aarch64__) && !(SANITIZER_RISCV64)
   ptr = UntagAddr(ptr);
 #endif
   return *(u8 *)(ptr | (kShadowAlignment - 1)) == ptr_tag;
 }
 
 enum class ErrorAction { Abort, Recover };
 enum class AccessType { Load, Store };
 

compiler-rt/lib/hwasan/hwasan_exceptions.cpp

__hwasan_personality_wrapper(int version, _Unwind_Action actions,
   //
   // Here we assume that the frame record appears after any locals. This is not
   // required by AAPCS but is a requirement for HWASAN instrumented functions.
   if ((actions & _UA_CLEANUP_PHASE) && rc == _URC_CONTINUE_UNWIND) {
 #if defined(__x86_64__)
     uptr fp = get_gr(context, 6); // rbp
 #elif defined(__aarch64__)
     uptr fp = get_gr(context, 29); // x29
+#elif SANITIZER_RISCV64
+    uptr fp = get_gr(context, 8);  // x8
 #else
 #error Unsupported architecture
 #endif
     uptr sp = get_cfa(context);
     TagMemory(sp, fp - sp, 0);
   }
 
   return rc;
 }

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

 }
 
 static void __attribute__((always_inline))
 InternalLongjmp(__hw_register_buf env, int retval) {
 #    if defined(__aarch64__)
   constexpr size_t kSpIndex = 13;
 #    elif defined(__x86_64__)
   constexpr size_t kSpIndex = 6;
+#    elif SANITIZER_RISCV64
+  constexpr size_t kSpIndex = 13;
 #    endif
 
   // Clear all memory tags on the stack between here and where we're going.
   unsigned long long stack_pointer = env[kSpIndex];
   // The stack pointer should never be tagged, so we don't need to clear the
   // tag for this function call.
   __hwasan_handle_longjmp((void *)stack_pointer);
 
asm volatile(
       "mov (6*8)(%0),%%rsp;"
       "mov (7*8)(%0),%%rdx;"
       // Return 1 if retval is 0.
       "mov $1,%%rax;"
       "test %1,%1;"
       "cmovnz %1,%%rax;"
       "jmp *%%rdx;" ::"r"(env_address),
       "r"(retval_tmp));
+#    elif SANITIZER_RISCV64
+  register long int retval_tmp asm("x11") = retval;
+  register void *env_address asm("x10") = &env[0];
+  // Currently only common case for fp registers is supported:
+  // no rv64if or lp64f
+#      if (__riscv_flen == 32) || defined(__riscv_float_abi_single)
+#        error "Unsupported case"
+#      endif
+  asm volatile(
+      "ld     ra,   0<<3(%0);"
+      "ld     s0,   1<<3(%0);"
+      "ld     s1,   2<<3(%0);"
+      "ld     s2,   3<<3(%0);"
+      "ld     s3,   4<<3(%0);"
+      "ld     s4,   5<<3(%0);"
+      "ld     s5,   6<<3(%0);"
+      "ld     s6,   7<<3(%0);"
+      "ld     s7,   8<<3(%0);"
+      "ld     s8,   9<<3(%0);"
+      "ld     s9,   10<<3(%0);"
+      "ld     s10,  11<<3(%0);"
+      "ld     s11,  12<<3(%0);"
+#      ifndef __riscv_float_abi_soft
+      "fld    fs0,  14<<3(%0);"
+      "fld    fs1,  15<<3(%0);"
+      "fld    fs2,  16<<3(%0);"
+      "fld    fs3,  17<<3(%0);"
+      "fld    fs4,  18<<3(%0);"
+      "fld    fs5,  19<<3(%0);"
+      "fld    fs6,  20<<3(%0);"
+      "fld    fs7,  21<<3(%0);"
+      "fld    fs8,  22<<3(%0);"
+      "fld    fs9,  23<<3(%0);"
+      "fld    fs10, 24<<3(%0);"
+      "fld    fs11, 25<<3(%0);"
+#      endif
+      "ld     a4, 13<<3(%0);"
+      "mv     sp, a4;"
+      // Return the value requested to return through arguments.
+      // This should be in x11 given what we requested above.
+      "seqz   a0, %1;"
+      "add    a0, a0, %1;"
+      "ret;"
+      : "+r"(env_address)
+      : "r"(retval_tmp));
 #    endif
 }
 
 INTERCEPTOR(void, siglongjmp, __hw_sigjmp_buf env, int val) {
   if (env[0].__magic != kHwJmpBufMagic) {
     Printf(
         "WARNING: Unexpected bad jmp_buf. Either setjmp was not called or "
         "there is a bug in HWASan.\n");

compiler-rt/lib/hwasan/hwasan_linux.cpp

#  elif defined(__x86_64__)
   const bool recover = code & 0x20;
   const uptr addr = uc->uc_mcontext.gregs[REG_RDI];
   const unsigned size_log = code & 0xf;
   if (size_log > 4 && size_log != 0xf)
     return AccessInfo{};  // Not ours.
   const uptr size =
       size_log == 0xf ? uc->uc_mcontext.gregs[REG_RSI] : 1U << size_log;
 
+#  elif SANITIZER_RISCV64
+  // Access type is encoded in the instruction following EBREAK as
+  // ADDI x0, x0, [0x40 + 0xXY]. For Y == 0xF, access size is stored in
+  // X11 register. Access address is always in X10 register.
+  uptr pc = (uptr)uc->uc_mcontext.__gregs[REG_PC];
+  uint8_t byte1 = *((u8 *)(pc + 0));
+  uint8_t byte2 = *((u8 *)(pc + 1));
+  uint8_t byte3 = *((u8 *)(pc + 2));
+  uint8_t byte4 = *((u8 *)(pc + 3));
+  uint32_t ebreak = (byte1 | (byte2 << 8) | (byte3 << 16) | (byte4 << 24));
+  bool isFaultShort = false;
+  bool isEbreak = (ebreak == 0x100073);
+  bool isShortEbreak = false;
+#    if defined(__riscv_compressed)
+  isFaultShort = ((ebreak & 0x3) != 0x3);
+  isShortEbreak = ((ebreak & 0xffff) == 0x9002);
+#    endif
+  // faulted insn is not ebreak, not our case
+  if (!(isEbreak || isShortEbreak))
+    return AccessInfo{};
+  // advance pc to point after ebreak and reconstruct addi instruction
+  pc += isFaultShort ? 2 : 4;
+  byte1 = *((u8 *)(pc + 0));
+  byte2 = *((u8 *)(pc + 1));
+  byte3 = *((u8 *)(pc + 2));
+  byte4 = *((u8 *)(pc + 3));
+  // reconstruct instruction
+  uint32_t instr = (byte1 | (byte2 << 8) | (byte3 << 16) | (byte4 << 24));
+  // check if this is really 32 bit instruction
+  // code is encoded in top 12 bits, since instruction is supposed to be with
+  // imm
+  const unsigned code = (instr >> 20) & 0xffff;
+  const uptr addr = uc->uc_mcontext.__gregs[10];
+  const bool is_store = code & 0x10;
+  const bool recover = code & 0x20;
+  const unsigned size_log = code & 0xf;
+  if (size_log > 4 && size_log != 0xf)
+    return AccessInfo{};  // Not our case
+  const uptr size =
+      size_log == 0xf ? uc->uc_mcontext.__gregs[11] : 1U << size_log;
+
 #  else
 #    error Unsupported architecture
 #  endif
 
   return AccessInfo{addr, size, is_store, !is_store, recover};
 }
 
 static bool HwasanOnSIGTRAP(int signo, siginfo_t *info, ucontext_t *uc) {
   AccessInfo ai = GetAccessInfo(info, uc);
   if (!ai.is_store && !ai.is_load)
     return false;
 
   SignalContext sig{info, uc};
   HandleTagMismatch(ai, StackTrace::GetNextInstructionPc(sig.pc), sig.bp, uc);
 
 #  if defined(__aarch64__)
   uc->uc_mcontext.pc += 4;
 #  elif defined(__x86_64__)
+#  elif SANITIZER_RISCV64
+  // pc points to EBREAK which is 2 bytes long
+  uint8_t *exception_source = (uint8_t *)(uc->uc_mcontext.__gregs[REG_PC]);
+  uint8_t byte1 = (uint8_t)(*(exception_source + 0));
+  uint8_t byte2 = (uint8_t)(*(exception_source + 1));
+  uint8_t byte3 = (uint8_t)(*(exception_source + 2));
+  uint8_t byte4 = (uint8_t)(*(exception_source + 3));
+  uint32_t faulted = (byte1 | (byte2 << 8) | (byte3 << 16) | (byte4 << 24));
+  bool isFaultShort = false;
+#    if defined(__riscv_compressed)
+  isFaultShort = ((faulted & 0x3) != 0x3);
+#    endif
+  uc->uc_mcontext.__gregs[REG_PC] += isFaultShort ? 2 : 4;
 #  else
 #    error Unsupported architecture
 #  endif
   return true;
 }
 
 static void OnStackUnwind(const SignalContext &sig, const void *,
                           BufferedStackTrace *stack) {

compiler-rt/lib/hwasan/hwasan_report.cpp

void ReportTagMismatch(StackTrace *stack, uptr tagged_addr, uptr access_size,
 
   if (registers_frame)
     ReportRegisters(registers_frame, pc);
 
   ReportErrorSummary(bug_type, stack);
 }
 
 // See the frame breakdown defined in __hwasan_tag_mismatch (from
-// hwasan_tag_mismatch_aarch64.S).
+// hwasan_tag_mismatch_{aarch64,riscv64}.S).
 void ReportRegisters(uptr *frame, uptr pc) {
   Printf("Registers where the failure occurred (pc %p):\n", pc);
 
   // We explicitly print a single line (4 registers/line) each iteration to
   // reduce the amount of logcat error messages printed. Each Printf() will
   // result in a new logcat line, irrespective of whether a newline is present,
   // and so we wish to reduce the number of Printf() calls we have to make.
+#if defined(__aarch64__)
   Printf("    x0  %016llx  x1  %016llx  x2  %016llx  x3  %016llx\n",
        frame[0], frame[1], frame[2], frame[3]);
+#elif SANITIZER_RISCV64
+  Printf("    sp  %016llx  x1  %016llx  x2  %016llx  x3  %016llx\n",
+         reinterpret_cast<u8 *>(frame) + 256, frame[1], frame[2], frame[3]);
+#endif
   Printf("    x4  %016llx  x5  %016llx  x6  %016llx  x7  %016llx\n",
        frame[4], frame[5], frame[6], frame[7]);
   Printf("    x8  %016llx  x9  %016llx  x10 %016llx  x11 %016llx\n",
        frame[8], frame[9], frame[10], frame[11]);
   Printf("    x12 %016llx  x13 %016llx  x14 %016llx  x15 %016llx\n",
        frame[12], frame[13], frame[14], frame[15]);
   Printf("    x16 %016llx  x17 %016llx  x18 %016llx  x19 %016llx\n",
        frame[16], frame[17], frame[18], frame[19]);
   Printf("    x20 %016llx  x21 %016llx  x22 %016llx  x23 %016llx\n",
        frame[20], frame[21], frame[22], frame[23]);
   Printf("    x24 %016llx  x25 %016llx  x26 %016llx  x27 %016llx\n",
        frame[24], frame[25], frame[26], frame[27]);
   // hwasan_check* reduces the stack pointer by 256, then __hwasan_tag_mismatch
   // passes it to this function.
+#if defined(__aarch64__)
   Printf("    x28 %016llx  x29 %016llx  x30 %016llx   sp %016llx\n", frame[28],
          frame[29], frame[30], reinterpret_cast<u8 *>(frame) + 256);
+#elif SANITIZER_RISCV64
+  Printf("    x28 %016llx  x29 %016llx  x30 %016llx  x31 %016llx\n", frame[28],
+         frame[29], frame[30], frame[31]);
+#else
+#endif
 }
 
 }  // namespace __hwasan
 
 void __hwasan_set_error_report_callback(void (*callback)(const char *)) {
   __hwasan::ScopedReport::SetErrorReportCallback(callback);
 }