[MSAN][MIPS] Changed memory mapping to support pie executable.

[eugenis]

lgtm

lib/msan/msan.h

46

Is that for a non-PIE executable? So, the new mapping requires PIE?

[slthakur]

lib/msan/msan.h

46

Yes, this is for non-PIE executable. And the new mapping requires PIE executable.

[eugenis]

This LGTM, but you may want to try and fit both PIE and non-PIE in one mapping the way it's done for Linux x86_64.
Should be possible as long as you can narrow one of these down to carve space for shadow/origin region of the non-PIE app mapping space:
- 0xa000000000-0xc000000000: PIE program segments
- 0xe000000000-0xffffffffff: libraries segments.

[slthakur]

Addressed review comment

[eugenis]

How about this:
MEM_TO_SHADOW = x ^ 0x800...
SHADOW_TO_ORIGIN = x + 0x200...
and
0x0000000000-0x0200000000: Program own segments
0xa200000000-0xc000000000: PIE program segments
0xe200000000-0xffffffffff: libraries segments.

That's about 2x more address space, and I don't see any overlaps.

[slthakur]

Changed Memory mapping as per suggestion

[slthakur]

Committed in rL278793

lib/msan/msan.h

enum Type {
     INVALID, APP, SHADOW, ORIGIN
   } type;
   const char *name;
 };
 
 
 #if SANITIZER_LINUX && defined(__mips64)
 
-// Everything is above 0x00e000000000.
+// MIPS64 maps:
+// - 0x0000000000-0x0200000000: Program own segments
+// - 0xa200000000-0xc000000000: PIE program segments
+// - 0xe200000000-0xffffffffff: libraries segments.
 const MappingDesc kMemoryLayout[] = {
-    {0x000000000000ULL, 0x00a000000000ULL, MappingDesc::INVALID, "invalid"},
-    {0x00a000000000ULL, 0x00c000000000ULL, MappingDesc::SHADOW, "shadow"},
-    {0x00c000000000ULL, 0x00e000000000ULL, MappingDesc::ORIGIN, "origin"},
-    {0x00e000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app"}};
+    {0x000000000000ULL, 0x000200000000ULL, MappingDesc::APP, "app-1"},
+    {0x000200000000ULL, 0x002200000000ULL, MappingDesc::INVALID, "invalid"},
+    {0x002200000000ULL, 0x004000000000ULL, MappingDesc::SHADOW, "shadow-2"},
+    {0x004000000000ULL, 0x004200000000ULL, MappingDesc::INVALID, "invalid"},
+    {0x004200000000ULL, 0x006000000000ULL, MappingDesc::ORIGIN, "origin-2"},
+    {0x006000000000ULL, 0x006200000000ULL, MappingDesc::INVALID, "invalid"},
+    {0x006200000000ULL, 0x008000000000ULL, MappingDesc::SHADOW, "shadow-3"},
+    {0x008000000000ULL, 0x008200000000ULL, MappingDesc::SHADOW, "shadow-1"},
+    {0x008200000000ULL, 0x00a000000000ULL, MappingDesc::ORIGIN, "origin-3"},
+    {0x00a000000000ULL, 0x00a200000000ULL, MappingDesc::ORIGIN, "origin-1"},
+    {0x00a200000000ULL, 0x00c000000000ULL, MappingDesc::APP, "app-2"},
+    {0x00c000000000ULL, 0x00e200000000ULL, MappingDesc::INVALID, "invalid"},
+    {0x00e200000000ULL, 0x00ffffffffffULL, MappingDesc::APP, "app-3"}};
 
-#define MEM_TO_SHADOW(mem) (((uptr)(mem)) & ~0x4000000000ULL)
-#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x002000000000)
+#define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x8000000000ULL)
+#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x2000000000ULL)
 
 #elif SANITIZER_LINUX && defined(__aarch64__)
 
 // The mapping describes both 39-bits and 42-bits.  AArch64 maps:
 // - 0x00000000000-0x00010000000: 39/42-bits program own segments
 // - 0x05500000000-0x05600000000: 39-bits PIE program segments
 // - 0x07f80000000-0x07fffffffff: 39-bits libraries segments
 // - 0x2aa00000000-0x2ab00000000: 42-bits PIE program segments

test/msan/mmap.cc

bool AddrIsApp(void *p) {
   uintptr_t addr = (uintptr_t)p;
 #if defined(__FreeBSD__) && defined(__x86_64__)
   return addr < 0x010000000000ULL || addr >= 0x600000000000ULL;
 #elif defined(__x86_64__)
   return (addr >= 0x000000000000ULL && addr < 0x010000000000ULL) ||
          (addr >= 0x510000000000ULL && addr < 0x600000000000ULL) ||
          (addr >= 0x700000000000ULL && addr < 0x800000000000ULL);
 #elif defined(__mips64)
-  return addr >= 0x00e000000000ULL;
+  return (addr >= 0x0000000000ULL && addr <= 0x0200000000ULL) ||
+         (addr >= 0xa200000000ULL && addr <= 0xc000000000ULL) ||
+         addr >= 0xe200000000ULL;
 #elif defined(__powerpc64__)
   return addr < 0x000100000000ULL || addr >= 0x300000000000ULL;
 #elif defined(__aarch64__)
 
   struct AddrMapping {
     uintptr_t start;
     uintptr_t end;
   } mappings[] = {

test/msan/strlen_of_shadow.cc

 // RUN: %clangxx_msan -O0 %s -o %t && %run %t
 
 // Check that strlen() and similar intercepted functions can be called on shadow
 // memory.
 
 #include <assert.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include "test.h"
 
 const char *mem_to_shadow(const char *p) {
 #if defined(__x86_64__)
   return (char *)((uintptr_t)p ^ 0x500000000000ULL);
 #elif defined (__mips64)
-  return (char *)((uintptr_t)p & ~0x4000000000ULL);
+  return (char *)((uintptr_t)p ^ 0x8000000000ULL);
 #elif defined(__powerpc64__)
 #define LINEARIZE_MEM(mem) \
   (((uintptr_t)(mem) & ~0x200000000000ULL) ^ 0x100000000000ULL)
   return (char *)(LINEARIZE_MEM(p) + 0x080000000000ULL);
 #elif defined(__aarch64__)
   return (char *)((uintptr_t)p ^ 0x6000000000ULL);
 #endif
 }