libhwasan initialisation include kernel syscall ABI relaxation

[mmalcomson]

Summary

Until now AArch64 development has been on patched kernels that have an always
on relaxed syscall ABI where tagged pointers are accepted.
The patches that have gone into the mainline kernel rely on each process opting
in to this relaxed ABI.

This commit adds code to choose that ABI into __hwasan_init.

The idea has already been agreed with one of the hwasan developers
(http://lists.llvm.org/pipermail/llvm-dev/2019-September/135328.html).

The patch ignores failures of EINVAL for Android, since there are older versions of the Android kernel that don't require this prctl or even have the relevant values. Avoiding EINVAL will let the library run on them.

I've tested this on an AArch64 VM running a kernel that requires this
prctl, having compiled both with clang and gcc.

[eugenis]

Thank you!
The patches have been merged to the android common kernel just a few days ago, 4.14 and 4.19:
https://android.googlesource.com/kernel/common/+/690c4ca8a5715644370384672f24d95b042db74a

Pixel kernels in Q have an early version of the patch set without the prctl (i.e. the feature is always enabled). Future releases will require a prctl.
So please do a prctl on Android anyway, but ignore EINVAL.

[mmalcomson]

Run prctl syscall for Android, but ignore EINVAL failures.

NOTE: I don't believe this distinguishes between running on a kernel with with the tagged address ABI unconditional or running on a newer kernel or on a kernel with sysctl abi.tagged_addr_disabled=1 (https://android.googlesource.com/kernel/common/+/690c4ca8a5715644370384672f24d95b042db74a/Documentation/arm64/tagged-address-abi.rst)

I doubt this will be much of a concern -- there was already a requirement of having the correct Android kernel for things to work -- but am mentioning it for posterity.

[eugenis]

In D68794#1705862, @mmalcomson wrote:

Run prctl syscall for Android, but ignore EINVAL failures.

NOTE: I don't believe this distinguishes between running on a kernel with with the tagged address ABI unconditional or running on a newer kernel or on a kernel with sysctl abi.tagged_addr_disabled=1 (https://android.googlesource.com/kernel/common/+/690c4ca8a5715644370384672f24d95b042db74a/Documentation/arm64/tagged-address-abi.rst)

This is a good point. It appears that PR_GET_TAGGED_ADDR_CTRL works even when abi.tagged_addr_disabled=1, we can use it to tell these two cases apart, but there is not a lot we could do with that information.

A real test would be invoking a random syscall with a tagged pointer, ex. uname(). I don't think we need to go that far, but leaving it up to you.

compiler-rt/lib/hwasan/hwasan.cpp

359

Please move it to InitInstrumentation to handle __hwasan_init_static, too.

compiler-rt/lib/hwasan/hwasan_linux.cpp

158

This needs to be internal_prctl because prctl implementation in libc can be built with hwasan.

[mmalcomson]

In D68794#1706679, @eugenis wrote:

In D68794#1705862, @mmalcomson wrote:

Run prctl syscall for Android, but ignore EINVAL failures.

NOTE: I don't believe this distinguishes between running on a kernel with with the tagged address ABI unconditional or running on a newer kernel or on a kernel with sysctl abi.tagged_addr_disabled=1 (https://android.googlesource.com/kernel/common/+/690c4ca8a5715644370384672f24d95b042db74a/Documentation/arm64/tagged-address-abi.rst)

This is a good point. It appears that PR_GET_TAGGED_ADDR_CTRL works even when abi.tagged_addr_disabled=1, we can use it to tell these two cases apart

Ah! So it does!
I'd apparently not updated my kernel since this was added -- thanks for the catch!

I've used that to add a slightly nicer error message and implemented the suggested changes.

[eugenis]

LGTM
Thank you!
Do you want me to submit this change for you?

[mmalcomson]

In D68794#1710151, @eugenis wrote:

LGTM
Thank you!
Do you want me to submit this change for you?

Yes, thanks! That would be great!

[eugenis]

Add (uptr) cast to -1 to silence "comparison of integers of different signs" warning.
Apply clang-format.

compiler-rt/lib/hwasan/hwasan.h

 namespace __hwasan {
 
 extern int hwasan_inited;
 extern bool hwasan_init_is_running;
 extern int hwasan_report_count;
 
 bool ProtectRange(uptr beg, uptr end);
 bool InitShadow();
+void InitPrctl();
 void InitThreads();
 void MadviseShadow();
 char *GetProcSelfMaps();
 void InitializeInterceptors();
 
 void HwasanAllocatorInit();
 void HwasanAllocatorThreadFinish();
 

compiler-rt/lib/hwasan/hwasan.cpp

dl_iterate_phdr(
       },
       nullptr);
 }
 
 // Prepare to run instrumented code on the main thread.
 static void InitInstrumentation() {
   if (hwasan_instrumentation_inited) return;
 
+  InitPrctl();
+
   if (!InitShadow()) {
     Printf("FATAL: HWAddressSanitizer cannot mmap the shadow memory.\n");
     DumpProcessMap();
     Die();
   }
 
   InitThreads();
   hwasanThreadList().CreateCurrentThread();

 }
 
 void __hwasan_init() {
   CHECK(!hwasan_init_is_running);
   if (hwasan_inited) return;
   hwasan_init_is_running = 1;
   SanitizerToolName = "HWAddressSanitizer";
 
   InitTlsSize();
 
   CacheBinaryName();
   InitializeFlags();
 
   // Install tool-specific callbacks in sanitizer_common.
   SetCheckFailedCallback(HWAsanCheckFailed);
 
   __sanitizer_set_report_path(common_flags()->log_path);

compiler-rt/lib/hwasan/hwasan_linux.cpp

 #include <pthread.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/resource.h>
 #include <sys/time.h>
 #include <unistd.h>
 #include <unwind.h>
+#include <sys/prctl.h>
+#include <errno.h>
 
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_procmaps.h"
 
 // Configurations of HWASAN_WITH_INTERCEPTORS and SANITIZER_ANDROID.
 //
 // HWASAN_WITH_INTERCEPTORS=OFF, SANITIZER_ANDROID=OFF
 //   Not currently tested.
static uptr GetHighMemEnd() {
   return max_address;
 }
 
 static void InitializeShadowBaseAddress(uptr shadow_size_bytes) {
   __hwasan_shadow_memory_dynamic_address =
       FindDynamicShadowStart(shadow_size_bytes);
 }
 
+void InitPrctl() {
+#define PR_SET_TAGGED_ADDR_CTRL 55
+#define PR_GET_TAGGED_ADDR_CTRL 56
+#define PR_TAGGED_ADDR_ENABLE (1UL << 0)
+  // Check we're running on a kernel that can use the tagged address ABI.
+  if (internal_prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0) == (uptr)-1 &&
+      errno == EINVAL) {
+#if SANITIZER_ANDROID
+    // Some older Android kernels have the tagged pointer ABI on
+    // unconditionally, and hence don't have the tagged-addr prctl while still
+    // allow the ABI.
+    // If targeting Android and the prctl is not around we assume this is the
+    // case.
+    return;
+#else
+    Printf(
+        "FATAL: "
+        "HWAddressSanitizer requires a kernel with tagged address ABI.\n");
+    Die();
+#endif
+  }
+
+  // Turn on the tagged address ABI.
+  if (internal_prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0) ==
+          (uptr)-1 ||
+      !internal_prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0)) {
+    Printf(
+        "FATAL: HWAddressSanitizer failed to enable tagged address syscall "
+        "ABI.\nSuggest check `sysctl abi.tagged_addr_disabled` "
+        "configuration.\n");
+    Die();
+  }
+#undef PR_SET_TAGGED_ADDR_CTRL
+#undef PR_GET_TAGGED_ADDR_CTRL
+#undef PR_TAGGED_ADDR_ENABLE
+}
+
 bool InitShadow() {
   // Define the entire memory range.
   kHighMemEnd = GetHighMemEnd();
 
   // Determine shadow memory base offset.
   InitializeShadowBaseAddress(MemToShadowSize(kHighMemEnd));
 
   // Place the low memory first.