shadowcallstack: Make runtime tests compatible with aarch64.

[pcc]

Summary

This at least appears to work if I manually compile the tests and
run them on an Android aarch64 device, but I'm not set up to run lit
on Android.

Depends on D45239

[pcc]

• Only aarch64 has the custom entry point

[pcc]

• Add boilerplate that allows the tests to pass on Android

[eugenis]

compiler-rt/test/shadowcallstack/CMakeLists.txt

2

MSAN?

12–13

HWASAN?

[pcc]

• Fix copy-pasteos

[eugenis]

compiler-rt/test/shadowcallstack/libc_support.h

32

use NR_MMAP?

compiler-rt/test/shadowcallstack/minimal_runtime.h

28

Why do you need anything above this line to not use libc? Why does it matter if they clobber x18 before it is set? It looks like scs_mmap_anon, for example, could be just libc mmap.

[pcc]

compiler-rt/test/shadowcallstack/minimal_runtime.h

28

Hmm, I think you're right. I will check whether that works.

I guess my only concern would be that these functions could somehow depend on having used the regular libc entry point, but it's hard to see how that could happen in practice.

That said, it occurred to me that we can avoid defining our own entry point just by defining main in this function and having it initialize the SCS and call an scs_main function which would be provided by the test. That would also work on x86 so we could avoid having two code paths. What do you think?

[eugenis]

compiler-rt/test/shadowcallstack/minimal_runtime.h

28

Sounds great.

[pcc]

• Use more libc, and define a custom main instead of a custom entry point

[vlad.tsyrklevich]

compiler-rt/test/shadowcallstack/libc_support.h

25

Attribute also belongs on the definition below

compiler-rt/test/shadowcallstack/minimal_runtime.h

55

Not sure I follow, if scs_main corrupted the RA don't we want to allow it to crash to satisfy the test? print_and_exit() also calls exit() directly so it shouldn't be required in that case.

[pcc]

compiler-rt/test/shadowcallstack/libc_support.h

25

Probably doesn't matter much in this case because we won't be inlining fputs. But I guess there's no harm in doing it.

compiler-rt/test/shadowcallstack/minimal_runtime.h

55

For aarch64 we don't crash on an RA mismatch, we just return to the address on the SCS. That means that when testing SCS + iterations=12 scs_main will return to main even though the RA on the stack is corrupted. Then when main, a non-SCS function, returns it will read the RA from the corrupted stack and return to it. We need to prevent that from happening because we want to simulate the behaviour when the entire system is built with SCS.

[vlad.tsyrklevich]

compiler-rt/test/shadowcallstack/minimal_runtime.h

55

Ah, that makes sense.

compiler-rt/test/shadowcallstack/CMakeLists.txt

 set(SHADOWCALLSTACK_LIT_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR})
 set(SHADOWCALLSTACK_LIT_BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR})
 
 set(SHADOWCALLSTACK_TEST_DEPS ${SANITIZER_COMMON_LIT_TEST_DEPS})
 
 configure_lit_site_cfg(
   ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.in
   ${CMAKE_CURRENT_BINARY_DIR}/lit.site.cfg
   )
 
 add_lit_testsuite(check-shadowcallstack "Running the ShadowCallStack tests"
-  ${CMAKE_CURRENT_BINARY_DIR})
+  ${CMAKE_CURRENT_BINARY_DIR}
+  DEPENDS ${SANITIZER_COMMON_LIT_TEST_DEPS})
 set_target_properties(check-shadowcallstack PROPERTIES FOLDER "Compiler-RT Misc")

compiler-rt/test/shadowcallstack/init.c

 // RUN: %clang_scs -D INCLUDE_RUNTIME %s -o %t
 // RUN: %run %t
 
 // RUN: %clang_scs %s -o %t
 // RUN: not --crash %run %t
 
 // Basic smoke test for the runtime
 
+#include "libc_support.h"
+
 #ifdef INCLUDE_RUNTIME
 #include "minimal_runtime.h"
+#elif defined(__aarch64__)
+int main(void);
+void __shadowcallstack_start() { scs_exit(main()); }
 #endif
 
-int main(int argc, char **argv) {
-  printf("In main.\n");
+int main(void) {
+  scs_fputs_stdout("In main.\n");
   return 0;
 }

compiler-rt/test/shadowcallstack/libc_support.h

+// This header provides replacements for certain libc functions. It is necessary
+// in order to safely run the tests on aarch64, because the system libc might
+// not have been compiled with -ffixed-x18.
+
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+#ifdef __aarch64__
+
+size_t scs_strlen(const char *p) {
+  size_t retval = 0;
+  while (*p++)
+    retval++;
+  return retval;
+}
+
+// This function is called before the SCS is allocated, so it cannot use the
+// SCS.
+__attribute__((no_sanitize("shadow-call-stack"))) void *scs_mmap_anon(
+    size_t size) {
+  void *retval;
+  __asm__ __volatile__(
+      "mov x0, xzr\n"
+      "mov x1, %0\n"
+      "orr w2, wzr, #0x3\n"  // PROT_READ | PROT_WRITE
+      "mov w3, #0x22\n"      // MAP_PRIVATE | MAP_ANONYMOUS
+      "mov w4, #0xffffffff\n"
+      "mov x5, xzr\n"
+      "mov x8, #222\n"  // mmap
+      "svc #0\n"
+      "mov %0, x0\n"
+      : "=r"(retval)
+      : "r"(size)
+      : "x0", "x1", "x2", "x3", "x4", "x5", "x8");
+  return retval;
+}
+
+// We mark all of these functions as noinline to make sure that their callers do
+// not become leaf functions as a result of inlining. This is because we want to
+// make sure that we generate the correct code for non-leaf functions.
+
+__attribute__((noinline)) void scs_abort(void) {
+  __asm__ __volatile__(
+      "mov x8, #172\n"  // getpid
+      "svc #0\n"
+      "mov x1, #6\n"    // SIGABRT
+      "mov x8, #129\n"  // kill
+      "svc #0\n");
+}
+
+__attribute__((noinline)) void scs_fputs_stdout(const char *p) {
+  __asm__ __volatile__(
+      "mov x0, #1\n"  // stdout
+      "mov x1, %0\n"
+      "mov x2, %1\n"
+      "mov x8, #64\n"  // write
+      "svc #0\n" ::"r"(p),
+      "r"(scs_strlen(p))
+      : "x0", "x1", "x2", "x8");
+}
+
+__attribute__((noinline)) void scs_exit(int exit_code) {
+  __asm__ __volatile__(
+      "mov x0, %0\n"
+      "mov x8, #93\n"  // exit
+      "svc #0\n" ::"r"((size_t)exit_code)
+      : "x0", "x8");
+}
+
+#else
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <sys/types.h>
+#include <signal.h>
+
+__attribute__((no_sanitize("shadow-call-stack"))) void *scs_mmap_anon(
+    size_t size) {
+  return mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS,
+              -1, 0);
+}
+
+void scs_abort(void) {
+  abort();
+}
+
+void scs_fputs_stdout(const char *p) {
+  fputs(p, stdout);
+}
+
+void scs_exit(int exit_code) {
+  exit(exit_code);
+}
+
+#endif

compiler-rt/test/shadowcallstack/lit.cfg

 # -*- Python -*-
 
 import os
 
 # Setup config name.
 config.name = 'ShadowCallStack'
 
 # Setup source root.
 config.test_source_root = os.path.dirname(__file__)
 
 # Test suffixes.
 config.suffixes = ['.c', '.cc', '.cpp', '.m', '.mm', '.ll', '.test']
 
 # Add clang substitutions.
 config.substitutions.append( ("%clang_noscs ", config.clang + " -O0 -fno-sanitize=shadow-call-stack ") )
-config.substitutions.append( ("%clang_scs ", config.clang + " -O0 -fsanitize=shadow-call-stack ") )
 
-if config.host_os not in ['Linux'] or config.target_arch != 'x86_64':
+arch_cflags = ""
+if config.target_arch == 'aarch64':
+  arch_cflags = "-ffixed-x18 -ffreestanding -nostdlib -Wl,-e,__shadowcallstack_start "
+config.substitutions.append( ("%clang_scs ", config.clang + " -O0 -fsanitize=shadow-call-stack " + arch_cflags) )
+
+if config.host_os not in ['Linux'] or config.target_arch not in ['x86_64', 'aarch64']:
    config.unsupported = True

compiler-rt/test/shadowcallstack/minimal_runtime.h

 // A shadow call stack runtime is not yet included with compiler-rt, provide a
-// minimal runtime to allocate a shadow call stack and assign %gs to point at
-// it.
+// minimal runtime to allocate a shadow call stack and assign an
+// architecture-specific register to point at it.
 
 #pragma once
 
+#ifdef __x86_64__
 #include <asm/prctl.h>
+#endif
 #include <stdlib.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 
+#include "libc_support.h"
+
 int arch_prctl(int code, void *addr);
 
 __attribute__((no_sanitize("shadow-call-stack")))
 static void __shadowcallstack_init() {
-  void *stack = mmap(NULL, 8192, PROT_READ | PROT_WRITE,
-                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+  void *stack = scs_mmap_anon(8192);
   if (stack == MAP_FAILED)
-    abort();
+    scs_abort();
 
+#if defined(__x86_64__)
   if (arch_prctl(ARCH_SET_GS, stack))
-    abort();
+    scs_abort();
+#elif defined(__aarch64__)
+  __asm__ __volatile__("mov x18, %0" ::"r"(stack));
+#else
+#error Unsupported platform
+#endif
 }
 
+
+#ifdef __aarch64__
+
+int main(void);
+
+// On aarch64 we avoid linking the system libc because it might not have been
+// compiled with -ffixed-x18. This replacement entry point does all we need.
+__attribute__((no_sanitize("shadow-call-stack")))
+void __shadowcallstack_start() {
+  __shadowcallstack_init();
+  scs_exit(main());
+}
+
+#else
+
 __attribute__((section(".preinit_array"), used))
     void (*__shadowcallstack_preinit)(void) = __shadowcallstack_init;
+
+#endif

compiler-rt/test/shadowcallstack/overflow-aarch64.c

+// See overflow.c for a description.
+
+// REQUIRES: aarch64-target-arch
+// RUN: %clang_scs %S/overflow.c -o %t -DITERATIONS=12
+// RUN: %run %t | FileCheck %S/overflow.c

compiler-rt/test/shadowcallstack/overflow-x86_64.c

+// See overflow.c for a description.
+
+// REQUIRES: x86_64-target-arch
+// RUN: %clang_scs %S/overflow.c -o %t -DITERATIONS=12
+// RUN: not --crash %run %t

compiler-rt/test/shadowcallstack/overflow.c

-// RUN: %clang_noscs %s -o %t
-// RUN: %run %t 3 | FileCheck %s
-// RUN: %run %t 12 | FileCheck -check-prefix=OVERFLOW_SUCCESS %s
-
-// RUN: %clang_scs %s -o %t
-// RUN: %run %t 3 | FileCheck %s
-// RUN: not --crash %run %t 12
-
 // Test that a stack overflow fails as expected
 
+// RUN: %clang_noscs %s -o %t -DITERATIONS=3
+// RUN: %run %t | FileCheck %s
+// RUN: %clang_noscs %s -o %t -DITERATIONS=12
+// RUN: %run %t | FileCheck -check-prefix=OVERFLOW_SUCCESS %s
+
+// RUN: %clang_scs %s -o %t -DITERATIONS=3
+// RUN: %run %t | FileCheck %s
+
+// The behavioral check for SCS + overflow lives in the tests overflow-x86_64.c
+// and overflow-aarch64.c. This is because the expected behavior is different
+// between the two platforms. On x86_64 we crash because the comparison between
+// the shadow call stack and the regular stack fails. On aarch64 there is no
+// comparison, we just load the return address from the shadow call stack. So we
+// just expect not to see the output from print_and_exit.
+
 #include <stdio.h>
 #include <stdlib.h>
 
 #include "minimal_runtime.h"
 
 void print_and_exit(void) {
 // CHECK-NOT: Stack overflow successful.
 // OVERFLOW_SUCCESS: Stack overflow successful.
-  printf("Stack overflow successful.\n");
-  exit(0);
+  scs_fputs_stdout("Stack overflow successful.\n");
+  scs_exit(0);
 }
 
-int main(int argc, char **argv)
+int main(void)
 {
-  if (argc != 2)
-    exit(1);
-
   void *addrs[4];
-  const int iterations = atoi(argv[1]);
-  for (int i = 0; i < iterations; i++)
+  for (int i = 0; i < ITERATIONS; i++)
     addrs[i] = &print_and_exit;
 
-  printf("Returning.\n");
+  scs_fputs_stdout("Returning.\n");
 
   return 0;
 }