[safestack] Add runtime support for MPX-based hardening

[mlemay-intel]

Summary

This patch adds support for the separate stack segment feature on 64-bit
platforms with Intel MPX support. It initializes MPX and allocates safe stacks
at high addresses so that BNDCU instructions inserted by the compiler can block
stray writes to safe stacks.

[kcc]

Michael ,
Please excuse me if I missed some email thread on llvm-dev describing at the high level what you are doing with MPX.
If there was no such thread I encourage you to start one.

I am personally extremely skeptical about anything related to MPX
(see https://github.com/google/sanitizers/wiki/AddressSanitizerIntelMemoryProtectionExtensions and the more recent and detailed intel-mpx.github.io).
Now, from a quick glance it looks like you are using the MPX instructions for something else,
but it deserves a discussion before we look at the patches.

[mlemay-intel]

In D29657#669919, @kcc wrote:

Michael ,
Please excuse me if I missed some email thread on llvm-dev describing at the high level what you are doing with MPX.
If there was no such thread I encourage you to start one.

I am personally extremely skeptical about anything related to MPX
(see https://github.com/google/sanitizers/wiki/AddressSanitizerIntelMemoryProtectionExtensions and the more recent and detailed intel-mpx.github.io).
Now, from a quick glance it looks like you are using the MPX instructions for something else,
but it deserves a discussion before we look at the patches.

Hi Kostya,

You haven't missed anything; I'm in the middle of writing the llvm-dev post now. :) Thanks for your feedback. Very briefly, I'm using MPX to enforce something analogous to a coarse-grained segment limit rather than fine-grained per-object bounds.

[mlemay-intel]

• Reserve space during runtime library initialization for safe stacks to be allocated later. This helps to prevent ordinary data from being allocated at addresses that could lead to bound check violations.
• Protect the variable that records the address of the most recent safe stack by moving it above the bound.
• Add MprotectReadWrite to sanitizer_posix.cc.

lib/safestack/CMakeLists.txt

 add_compiler_rt_component(safestack)
+add_compiler_rt_component(safestacksepseg)
 
 set(SAFESTACK_SOURCES safestack.cc)
+set(SAFESTACKMPX_SOURCES safestackmpx.cc)
 
 include_directories(..)
 
 set(SAFESTACK_CFLAGS ${SANITIZER_COMMON_CFLAGS})
+# CPUID will be used to check for XSAVEC support at runtime
+set(SAFESTACKMPX_CFLAGS ${SANITIZER_COMMON_CFLAGS} -mxsavec)
 
 if(APPLE)
   # Build universal binary on APPLE.
   add_compiler_rt_runtime(clang_rt.safestack
     STATIC
     OS osx
     ARCHS ${SAFESTACK_SUPPORTED_ARCH}
     SOURCES ${SAFESTACK_SOURCES}
add_compiler_rt_runtime(clang_rt.safestack
       ARCHS ${arch}
       SOURCES ${SAFESTACK_SOURCES}
               $<TARGET_OBJECTS:RTInterception.${arch}>
               $<TARGET_OBJECTS:RTSanitizerCommon.${arch}>
               $<TARGET_OBJECTS:RTSanitizerCommonNoLibc.${arch}>
       CFLAGS ${SAFESTACK_CFLAGS}
       PARENT_TARGET safestack)
   endforeach()
+  add_compiler_rt_runtime(clang_rt.safestacksepseg
+    STATIC
+    ARCHS x86_64
+    SOURCES ${SAFESTACKMPX_SOURCES}
+    CFLAGS ${SAFESTACKMPX_CFLAGS}
+    PARENT_TARGET safestacksepseg)
 endif()

lib/safestack/safestack.cc

struct tinfo {
   void *(*start_routine)(void *);
   void *start_routine_arg;
 
   void *unsafe_stack_start;
   size_t unsafe_stack_size;
   size_t unsafe_stack_guard;
 };
 
+__attribute__((weak))
+void __safestack_sepseg_thread_start() {}
+
 /// Wrap the thread function in order to deallocate the unsafe stack when the
 /// thread terminates by returning from its main function.
 static void *thread_start(void *arg) {
   struct tinfo *tinfo = (struct tinfo *)arg;
 
   void *(*start_routine)(void *) = tinfo->start_routine;
   void *start_routine_arg = tinfo->start_routine_arg;
 
static void thread_cleanup_handler(void *_iter) {
   if (iter < PTHREAD_DESTRUCTOR_ITERATIONS) {
     pthread_setspecific(thread_cleanup_key, (void *)(iter + 1));
   } else {
     // This is the last iteration
     unsafe_stack_free();
   }
 }
 
+// The SafeStack separate segment library overrides this to modify the
+// attributes.
+__attribute__((weak))
+void __safestack_sepseg_pthread_create(const pthread_attr_t **attr,
+                                       pthread_attr_t *tmpattr,
+                                       size_t size, size_t guard) {}
+
 /// Intercept thread creation operation to allocate and setup the unsafe stack
 INTERCEPTOR(int, pthread_create, pthread_t *thread,
             const pthread_attr_t *attr,
             void *(*start_routine)(void*), void *arg) {
 
   size_t size = 0;
   size_t guard = 0;
 
INTERCEPTOR(int, pthread_create, pthread_t *thread,
   struct tinfo *tinfo =
       (struct tinfo *)(((char *)addr) + size - sizeof(struct tinfo));
   tinfo->start_routine = start_routine;
   tinfo->start_routine_arg = arg;
   tinfo->unsafe_stack_start = addr;
   tinfo->unsafe_stack_size = size;
   tinfo->unsafe_stack_guard = guard;
 
-  return REAL(pthread_create)(thread, attr, thread_start, tinfo);
+  pthread_attr_t tmpattr;
+  __safestack_sepseg_pthread_create(&attr, &tmpattr, size, guard);
+
+  int result = REAL(pthread_create)(thread, attr, thread_start, tinfo);
+
+  if (attr == &tmpattr)
+    CHECK_EQ(pthread_attr_destroy(&tmpattr), 0);
+
+  return result;
 }
 
+__attribute__((weak))
+void __safestack_sepseg_init(unsigned pageSize) {}
+
 extern "C" __attribute__((visibility("default")))
 #if !SANITIZER_CAN_USE_PREINIT_ARRAY
 // On ELF platforms, the constructor is invoked using .preinit_array (see below)
 __attribute__((constructor(0)))
 #endif
 void __safestack_init() {
   // Determine the stack size for the main thread.
   size_t size = kDefaultUnsafeStackSize;
void __safestack_init() {
   unsafe_stack_setup(addr, size, guard);
   pageSize = sysconf(_SC_PAGESIZE);
 
   // Initialize pthread interceptors for thread allocation
   INTERCEPT_FUNCTION(pthread_create);
 
   // Setup the cleanup handler
   pthread_key_create(&thread_cleanup_key, thread_cleanup_handler);
+
+  __safestack_sepseg_init(pageSize);
 }
 
 #if SANITIZER_CAN_USE_PREINIT_ARRAY
 // On ELF platforms, run safestack initialization before any other constructors.
 // On other platforms we use the constructor attribute to arrange to run our
 // initialization early.
 extern "C" {
 __attribute__((section(".preinit_array"),

lib/safestack/safestackmpx.cc

+//===-- safestackmpx.cc ---------------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file implements the runtime support for safe stack hardening based on
+// Intel MPX. The runtime initializes MPX and manages allocation of the safe
+// stack for each pthread created during program execution.
+//
+//===----------------------------------------------------------------------===//
+
+
+#include <pthread.h>
+#include <stdint.h>
+#include <string.h>
+#include <x86intrin.h>
+
+#include "sanitizer_common/sanitizer_common.h"
+#include "sanitizer_common/sanitizer_mutex.h"
+
+// Cap on amount of virtual address space that can be used beneath initial stack
+// to allocate new safe stacks before they protrude beneath the bound that is
+// checked by the instrumented code.
+#define SAFE_STACK_CAPACITY 0x10000000
+
+using namespace __sanitizer;
+
+// FIXME: Free safe stack when thread is destroyed.
+
+#define PAGE_SIZE 4096
+
+// Set to true to indicate that MPX is available.  Aligned to fill a whole page,
+// since that page will be marked read-only to prevent an adversary from
+// modifying this to disable the hardening.
+struct ro_settings {
+  bool enabled;
+} __attribute__((aligned(PAGE_SIZE)));
+static ro_settings locked_settings = { false };
+
+static uptr mpx_get_bnd0_ub() {
+  uptr bnd0[2];
+  __asm__ __volatile__("bndmov %%bnd0, %0" : "=m"(bnd0));
+  return ~bnd0[1];
+}
+
+static void mpx_set_bnd0_ub(uptr ub) {
+  __asm__ __volatile__("bndmk %0, %%bnd0" :: "m"(*(char *)ub));
+}
+
+static uptr safe_stack_last_alloc;
+static StaticSpinMutex safe_stack_last_alloc_mutex;
+
+static inline void *safe_stack_alloc(size_t size, size_t guard) {
+  safe_stack_last_alloc_mutex.Lock();
+  CHECK_GE(size + guard, size);
+  uptr req_addr = safe_stack_last_alloc - (size + guard);
+  // It is necessary to check that the address of the new stack is not below the
+  // bound that is checked by the instrumented code.  Otherwise, an adversary
+  // may be able to modify safe_stack_last_alloc to cause safe stacks to be
+  // allocated in vulnerable locations.  However, this check can also be
+  // triggered by a program creating a large number of threads or a large stack.
+  // An alternative approach to avoid that limitation could be to store
+  // safe_stack_last_alloc above the bound checked by the instrumented code.
+  // This could help to prevent adversaries from forcing safe stacks to be
+  // allocated at vulnerable locations while still allowing the program to keep
+  // running even when its safe stacks protrude below the bound.  Of course, the
+  // protruding portions of the safe stacks would be vulnerable.
+  // Another alternative could be to treat the MPX bounds registers as per-
+  // program state rather than per-thread state.  BND0 could then be adjusted
+  // downwards as necessary when new safe stacks are allocated.
+  CHECK_GE(req_addr, mpx_get_bnd0_ub());
+  safe_stack_last_alloc = req_addr;
+  safe_stack_last_alloc_mutex.Unlock();
+  void *addr = MmapFixedOrDie(req_addr, size + guard);
+  MprotectNoAccess((uptr)addr, (uptr)guard);
+  return (char *)addr + guard;
+}
+
+void __safestack_sepseg_pthread_create(const pthread_attr_t **attr,
+                                       pthread_attr_t *tmpattr,
+                                       size_t size, size_t guard) {
+  if (!locked_settings.enabled)
+    return;
+
+  void *safe_stack_addr = safe_stack_alloc(size, guard);
+  CHECK_EQ(pthread_attr_init(tmpattr), 0);
+  // FIXME: If attr is non-null, copy other settings into tmpattr.
+  CHECK_EQ(pthread_attr_setstack(tmpattr, safe_stack_addr, size), 0);
+  *attr = tmpattr;
+}
+
+void __safestack_sepseg_init(unsigned pageSize) {
+  // This file implements the runtime support for protecting safe stacks against
+  // stray writes using MPX. The runtime initializes MPX, intercepts the creation
+  // of new safe stacks to place them at high addresses, and configures the BND0
+  // register to have an upper bound below all safe stacks.
+
+  unsigned cpuid_res;
+  __asm__ __volatile__("cpuid" : "=b"(cpuid_res) : "a"(7), "c"(0) : "rdx");
+  if (((cpuid_res >> 14) & 1) != 1)
+    // No MPX support
+    return;
+  __asm__ __volatile__("cpuid" : "=a"(cpuid_res) : "a"(0xD), "c"(0) : "rbx", "rdx");
+  if (((cpuid_res >> 3) & 3) != 3)
+    // Insufficient MPX support
+    return;
+  __asm__ __volatile__("cpuid" : "=a"(cpuid_res) : "a"(0xD), "c"(1) : "rbx", "rdx");
+  if (((cpuid_res >> 1) & 1) != 1)
+    // No XSAVEC support
+    return;
+
+  struct {
+    char pad[512];
+    uint64_t xstate_bv;
+    uint64_t xcomp_bv;
+    char pad1[48];
+    struct {
+      uint64_t en : 1;
+      uint64_t bprv : 1;
+      uint64_t : 10;
+      uint64_t tblbase : 52;
+    } bndcfgu;
+    uint64_t bndstatus;
+  } xsave_area __attribute__((aligned(64)));
+
+  memset(&xsave_area, 0, sizeof(xsave_area));
+  xsave_area.bndcfgu.en = 1;
+  xsave_area.bndcfgu.bprv = 1;
+  xsave_area.xcomp_bv = 0x8000000000000010ull;
+  xsave_area.xstate_bv = 0x10;
+  _xrstor(&xsave_area, 1 << 4);
+
+  pthread_attr_t attr;
+  void *safe_stack = nullptr;
+  size_t size = 0;
+
+  CHECK_EQ(pthread_getattr_np(pthread_self(), &attr), 0);
+  CHECK_EQ(pthread_attr_getstack(&attr, &safe_stack, &size), 0);
+  CHECK_EQ(pthread_attr_destroy(&attr), 0);
+
+  // This assumes that a single page is used as the guard:
+  safe_stack_last_alloc = (uptr)safe_stack - pageSize;
+
+  mpx_set_bnd0_ub((uptr)safe_stack - SAFE_STACK_CAPACITY);
+
+  locked_settings.enabled = true;
+  CHECK_EQ(MprotectReadOnly((uptr)&locked_settings, PAGE_SIZE), true);
+}