[TSan] Improve handling of stack pointer mangling in {set,long}jmp, pt.1

[yln]

Summary

TSan needs to infer which calls to setjmp/longjmp are corresponding
pairs. My understanding is, that we can't simply use the jmp_buf
address, since this buffer is just a plain data structure storing the
environment (registers) with no additional semantics, i.e., it can be
copied around and is still expected to work. So we use the stack pointer
(SP) instead.

The setjmp interceptor stores some metadata, which is then consumed in
the corresponding call to longjmp. We use the SP as an "index" (stable
identifier) into the metadata table. So far so good.

However, when mangling is used, the setjmp interceptor observes the
UNmangled SP, but the longjmp interceptor only knows the mangled value
for SP. To still correlate corresponding pairs of calls, TSan currently
derives the mangled representation in setjmp and uses it as the stable
identifer, so that longjmp can do it's lookup.

Currently, this works since "mangling" simply means XOR with a secret
value. However, in the future we want to use operations that do not
allow us to easily go from unmangled -> mangled (pointer
authentication). Going from mangled -> unmangled should still be
possible (for pointer authentication it means zeroing a few bits).

This patch is part 1 of changing set/longjmp interceptors to use the
unmangled SP for metadata lookup. Instead of deriving the mangled SP in
setjmp, we will derive the unmangled SP in longjmp. Since this change
involves difficult-to-test code, it will be done in (at least) 2 parts:
This patch only replicates the existing behavior and checks that the
newly computed value for SP matches with what we have been doing so far.
This should help me to fix issues on architectures I cannot test
directly. I tested this patch on x86-64 (Linux/Darwin) and arm64
(Darwin).

This patch will also address an orthogonal issue: there is a lot of code
duplication in the assembly files, because the
void __tsan_setjmp(uptr sp, uptr mangled_sp) already demands the
mangled SP. This means that the code for computing the mangled SP is
duplicated at every call site (in assembly).

[dvyukov]

JmpBufGarbageCollect uses <= on sp values to detect bufs that are no longer active. But as far as I understand we still will able to do this, right?

It can make sense to combine the first part of LongJmp that extracts sp from context with UnmangleLongJmpSp in future changes, because they have effectively the same set of checks on OS/arch. E.g. GetSPFromContext that will both extract and demangle it.

[yln]

@dvyukov: I finally have a chance to continue working on this. I hope you are still onboard?
I plan to land this and let the bots (all the different architectures) churn on it over the weekend.

My next patch will be switching over the lookup to use the SP instead of the mangled SP, followed by some cleanup that is enabled by this.
I will make sure to put you as a reviewer for all of those.

In D60981#1475319, @dvyukov wrote:

JmpBufGarbageCollect uses <= on sp values to detect bufs that are no longer active. But as far as I understand we still will able to do this, right?

Yes.

It can make sense to combine the first part of LongJmp that extracts sp from context with UnmangleLongJmpSp in future changes, because they have effectively the same set of checks on OS/arch. E.g. GetSPFromContext that will both extract and demangle it.

I will do a round of cleanups and that sounds like a good candidate!

[dvyukov]

@dvyukov: I finally have a chance to continue working on this. I hope you are still onboard?

To the degree I will find time to review changes...

It seems I already approved this, so as long as there are no significant changes I guess that approval still holds.

compiler-rt/lib/tsan/rtl/tsan_interceptors.cc

 # ifdef __aarch64__
   uptr mangled_sp = env[13];
 # elif defined(__mips64)
   uptr mangled_sp = env[1];
 # else
   uptr mangled_sp = env[6];
 # endif
 #endif
+  uptr sp = UnmangleLongJmpSp(mangled_sp);
   // Find the saved buf by mangled_sp.
   for (uptr i = 0; i < thr->jmp_bufs.Size(); i++) {
     JmpBuf *buf = &thr->jmp_bufs[i];
     if (buf->mangled_sp == mangled_sp) {
+      CHECK_EQ(buf->sp, sp);
+      // TODO(yln): Lookup via sp, remove mangled_sp from struct.
       CHECK_GE(thr->shadow_stack_pos, buf->shadow_stack_pos);
       // Unwind the stack.
       while (thr->shadow_stack_pos > buf->shadow_stack_pos)
         FuncExit(thr);
       ThreadSignalContext *sctx = SigCtx(thr);
       if (sctx) {
         sctx->int_signal_send = buf->int_signal_send;
         atomic_store(&sctx->in_blocking_func, buf->in_blocking_func,

compiler-rt/lib/tsan/rtl/tsan_platform.h

 void InitializePlatform();
 void InitializePlatformEarly();
 void CheckAndProtect();
 void InitializeShadowMemoryPlatform();
 void FlushShadowMemory();
 void WriteMemoryProfile(char *buf, uptr buf_size, uptr nthread, uptr nlive);
 int ExtractResolvFDs(void *state, int *fds, int nfd);
 int ExtractRecvmsgFDs(void *msg, int *fds, int nfd);
+uptr UnmangleLongJmpSp(uptr mangled_sp);
 void ImitateTlsWrite(ThreadState *thr, uptr tls_addr, uptr tls_size);
 
 int call_pthread_cancel_with_cleanup(int(*fn)(void *c, void *m,
     void *abstime), void *c, void *m, void *abstime,
     void(*cleanup)(void *arg), void *arg);
 
 void DestroyThreadState();
 
 }  // namespace __tsan
 
 #endif  // TSAN_PLATFORM_H

compiler-rt/lib/tsan/rtl/tsan_platform_linux.cc

 
 #if SANITIZER_FREEBSD
 extern "C" void *__libc_stack_end;
 void *__libc_stack_end = 0;
 #endif
 
 #if SANITIZER_LINUX && defined(__aarch64__)
 void InitializeGuardPtr() __attribute__((visibility("hidden")));
+extern "C" uptr _tsan_pointer_chk_guard;
 #endif
 
 namespace __tsan {
 
 #ifdef TSAN_RUNTIME_VMA
 // Runtime detected VMA size.
 uptr vmaSize;
 #endif
for (int i = 0; i < n; i++) {
       fds[res++] = ((int*)CMSG_DATA(cmsg))[i];
       if (res == nfd)
         return res;
     }
   }
   return res;
 }
 
+// Reverse operation of libc stack pointer mangling
+uptr UnmangleLongJmpSp(uptr mangled_sp) {
+#if defined(__x86_64__)
+#if SANITIZER_FREEBSD || SANITIZER_NETBSD
+  return mangled_sp;
+#else  // Linux
+  // Reverse of:
+  //   xor  %fs:0x30, %rsi
+  //   rol  $0x11, %rsi
+  uptr sp;
+  asm("ror  $0x11,     %0 \n"
+      "xor  %%fs:0x30, %0 \n"
+      : "=r" (sp)
+      : "0" (mangled_sp));
+  return sp;
+#endif
+#elif defined(__aarch64__)
+  return mangled_sp ^ _tsan_pointer_chk_guard;
+#elif defined(__powerpc64__)
+  // Reverse of:
+  //  ld   r4, -28696(r13)
+  //  xor  r4, r3, r4
+  uptr xor_guard;
+  asm("ld  %0, -28696(%%r13) \n" : "=r" (xor_guard));
+  return mangled_sp ^ xor_guard;
+#elif defined(__mips__)
+  return mangled_sp;
+#else
+  #error "Unknown platform"
+#endif
+}
+
 void ImitateTlsWrite(ThreadState *thr, uptr tls_addr, uptr tls_size) {
   // Check that the thr object is in tls;
   const uptr thr_beg = (uptr)thr;
   const uptr thr_end = (uptr)thr + sizeof(*thr);
   CHECK_GE(thr_beg, tls_addr);
   CHECK_LE(thr_beg, tls_addr + tls_size);
   CHECK_GE(thr_end, tls_addr);
   CHECK_LE(thr_end, tls_addr + tls_size);

compiler-rt/lib/tsan/rtl/tsan_platform_mac.cc

 #endif
 
   if (GetMacosVersion() >= MACOS_VERSION_MOJAVE) {
     __tsan_darwin_setjmp_xor_key =
         (uptr)pthread_getspecific(kPthreadSetjmpXorKeySlot);
   }
 }
 
+uptr UnmangleLongJmpSp(uptr mangled_sp) {
+  return mangled_sp ^ __tsan_darwin_setjmp_xor_key;
+}
+
 #if !SANITIZER_GO
 void ImitateTlsWrite(ThreadState *thr, uptr tls_addr, uptr tls_size) {
   // The pointer to the ThreadState object is stored in the shadow memory
   // of the tls.
   uptr tls_end = tls_addr + tls_size;
   ThreadState **thr_state_loc = cur_thread_location();
   if (thr_state_loc == nullptr) {
     MemoryRangeImitateWrite(thr, /*pc=*/2, tls_addr, tls_size);