[MSan][RISCV] Add RISCV64 support for MSan

[luismarques]

Summary

RISCV64 support for ASan and LSan has been merged. This patch adds further support for MSan. There are no known issues (besides those indicated by the test changes).

[luismarques]

• Add VarArg handling.
• Adjust tests.

[MaskRay]

compiler-rt/test/msan/mmap.cpp

30

(__riscv_xlen == 64) -> __riscv_xlen == 64

69

ditto

compiler-rt/test/msan/mmap_below_shadow.cpp

36

ditto

compiler-rt/test/msan/param_tls_limit.cpp

23

If you expect riscv32 will fail as well, use riscv

[luismarques]

Address review feedback (thanks @MaskRay!).

[luismarques]

Optimize address mappings.

[alexfanqi]

Just want to kindly ask, does this patch get stuck on anything? It would be really nice to have msan support for riscv.

compiler-rt/cmake/config-ix.cmake

 endif()
 
 set(ALL_GWP_ASAN_SUPPORTED_ARCH ${X86} ${X86_64})
 if(APPLE)
   set(ALL_LSAN_SUPPORTED_ARCH ${X86} ${X86_64} ${MIPS64} ${ARM64})
 else()
   set(ALL_LSAN_SUPPORTED_ARCH ${X86} ${X86_64} ${MIPS64} ${ARM64} ${ARM32} ${PPC64} ${S390X} ${RISCV64})
 endif()
-set(ALL_MSAN_SUPPORTED_ARCH ${X86_64} ${MIPS64} ${ARM64} ${PPC64} ${S390X})
+set(ALL_MSAN_SUPPORTED_ARCH ${X86_64} ${MIPS64} ${ARM64} ${PPC64} ${S390X} ${RISCV64})
 set(ALL_HWASAN_SUPPORTED_ARCH ${X86_64} ${ARM64})
 set(ALL_MEMPROF_SUPPORTED_ARCH ${X86_64})
 set(ALL_PROFILE_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64} ${PPC32} ${PPC64}
     ${MIPS32} ${MIPS64} ${S390X} ${SPARC} ${SPARCV9})
 set(ALL_TSAN_SUPPORTED_ARCH ${X86_64} ${MIPS64} ${ARM64} ${PPC64})
 set(ALL_UBSAN_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64} ${RISCV64}
     ${MIPS32} ${MIPS64} ${PPC64} ${S390X} ${SPARC} ${SPARCV9})
 set(ALL_SAFESTACK_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM64} ${MIPS32} ${MIPS64})

compiler-rt/lib/msan/msan.h

const MappingDesc kMemoryLayout[] = {
     {0x0FFA000000000ULL, 0x0FFAF00000000ULL, MappingDesc::INVALID, "invalid"},
     {0x0FFAF00000000ULL, 0x0FFB000000000ULL, MappingDesc::ORIGIN, "origin-15"},
     {0x0FFB000000000ULL, 0x0FFFF00000000ULL, MappingDesc::INVALID, "invalid"},
     {0x0FFFF00000000ULL, 0x1000000000000ULL, MappingDesc::APP, "app-15"},
 };
 # define MEM_TO_SHADOW(mem) ((uptr)mem ^ 0x6000000000ULL)
 # define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x1000000000ULL)
 
+#elif SANITIZER_LINUX && SANITIZER_RISCV64
+
+// RISCV64 mapping:
+// - 0x0000000000-0x0200000000: Program own segments
+// - 0x2a00000000-0x3000000000: PIE program segments
+// - 0x3a00000000-0x4000000000: libraries segments.
+const MappingDesc kMemoryLayout[] = {
+    {0x000000000000ULL, 0x000200000000ULL, MappingDesc::APP, "app-1"},
+    {0x000200000000ULL, 0x000a00000000ULL, MappingDesc::INVALID, "invalid"},
+    {0x000a00000000ULL, 0x001000000000ULL, MappingDesc::SHADOW, "shadow-3"},
+    {0x001000000000ULL, 0x001600000000ULL, MappingDesc::ORIGIN, "origin-3"},
+    {0x001600000000ULL, 0x001a00000000ULL, MappingDesc::INVALID, "invalid"},
+    {0x001a00000000ULL, 0x002000000000ULL, MappingDesc::SHADOW, "shadow-2"},
+    {0x002000000000ULL, 0x002600000000ULL, MappingDesc::ORIGIN, "origin-2"},
+    {0x002600000000ULL, 0x002a00000000ULL, MappingDesc::INVALID, "invalid"},
+    {0x002a00000000ULL, 0x003000000000ULL, MappingDesc::APP, "app-2"},
+    {0x003000000000ULL, 0x003200000000ULL, MappingDesc::SHADOW, "shadow-1"},
+    {0x003200000000ULL, 0x003600000000ULL, MappingDesc::INVALID, "invalid"},
+    {0x003600000000ULL, 0x003800000000ULL, MappingDesc::ORIGIN, "origin-1"},
+    {0x003800000000ULL, 0x003a00000000ULL, MappingDesc::INVALID, "invalid"},
+    {0x003a00000000ULL, 0x004000000000ULL, MappingDesc::APP, "app-3"},
+};
+
+#define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x3000000000ULL)
+#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x0600000000ULL)
+
 #elif SANITIZER_LINUX && SANITIZER_PPC64
 const MappingDesc kMemoryLayout[] = {
     {0x000000000000ULL, 0x000200000000ULL, MappingDesc::APP, "low memory"},
     {0x000200000000ULL, 0x080000000000ULL, MappingDesc::INVALID, "invalid"},
     {0x080000000000ULL, 0x180200000000ULL, MappingDesc::SHADOW, "shadow"},
     {0x180200000000ULL, 0x1C0000000000ULL, MappingDesc::INVALID, "invalid"},
     {0x1C0000000000ULL, 0x2C0200000000ULL, MappingDesc::ORIGIN, "origin"},
     {0x2C0200000000ULL, 0x300000000000ULL, MappingDesc::INVALID, "invalid"},

compiler-rt/lib/msan/msan_allocator.cpp

struct AP32 {
   static const uptr kMetadataSize = sizeof(Metadata);
   typedef __sanitizer::CompactSizeClassMap SizeClassMap;
   static const uptr kRegionSizeLog = 20;
   using AddressSpaceView = LocalAddressSpaceView;
   typedef MsanMapUnmapCallback MapUnmapCallback;
   static const uptr kFlags = 0;
 };
 typedef SizeClassAllocator32<AP32> PrimaryAllocator;
+#elif SANITIZER_RISCV64
+static const uptr kMaxAllowedMallocSize = 2UL << 30;
+
+struct AP32 {
+  static const uptr kSpaceBeg = 0;
+  static const u64 kSpaceSize = SANITIZER_MMAP_RANGE_SIZE;
+  static const uptr kMetadataSize = sizeof(Metadata);
+  typedef __sanitizer::CompactSizeClassMap SizeClassMap;
+  static const uptr kRegionSizeLog = 20;
+  using AddressSpaceView = LocalAddressSpaceView;
+  typedef MsanMapUnmapCallback MapUnmapCallback;
+  static const uptr kFlags = 0;
+};
+typedef SizeClassAllocator32<AP32> PrimaryAllocator;
 #endif
 typedef CombinedAllocator<PrimaryAllocator> Allocator;
 typedef Allocator::AllocatorCache AllocatorCache;
 
 static Allocator allocator;
 static AllocatorCache fallback_allocator_cache;
 static StaticSpinMutex fallback_mutex;
 

compiler-rt/test/msan/allocator_mapping.cpp

 // Test that a module constructor can not map memory over the MSan heap
 // (without MAP_FIXED, of course). Current implementation ensures this by
 // mapping the heap early, in __msan_init.
 //
 // RUN: %clangxx_msan -O0 %s -o %t_1
 // RUN: %clangxx_msan -O0 -DHEAP_ADDRESS=$(%run %t_1) %s -o %t_2 && %run %t_2
 //
 // This test only makes sense for the 64-bit allocator. The 32-bit allocator
 // does not have a fixed mapping. Exclude platforms that use the 32-bit
 // allocator.
-// UNSUPPORTED: target-is-mips64,target-is-mips64el,aarch64
+// UNSUPPORTED: target-is-mips64,target-is-mips64el,aarch64,riscv64
 
 #include <assert.h>
 #include <stdio.h>
 #include <sys/mman.h>
 #include <stdlib.h>
 
 #ifdef HEAP_ADDRESS
 struct A {

compiler-rt/test/msan/mmap.cpp

#elif defined(__mips64)
   return (addr >= 0x0000000000ULL && addr <= 0x0200000000ULL) ||
          (addr >= 0xa200000000ULL && addr <= 0xc000000000ULL) ||
          addr >= 0xe200000000ULL;
 #elif defined(__powerpc64__)
   return addr < 0x000100000000ULL || addr >= 0x300000000000ULL;
 #elif defined(__s390x__)
   return addr < 0x040000000000ULL ||
          (addr >= 0x440000000000ULL && addr < 0x500000000000);
+#elif defined(__riscv) && __riscv_xlen == 64
+  return (addr < 0x000200000000ULL) ||
+         (addr >= 0x002a00000000ULL && addr < 0x003000000000ULL) ||
+         (addr >= 0x003a00000000ULL && addr < 0x004000000000ULL);
 #elif defined(__aarch64__)
 
   struct AddrMapping {
     uintptr_t start;
     uintptr_t end;
   } mappings[] = {
     {0x05000000000ULL, 0x06000000000ULL},
     {0x07000000000ULL, 0x08000000000ULL},
#elif defined(__aarch64__)
   return false;
 #endif
 }
 
 int main() {
   // Large enough to quickly exhaust the entire address space.
 #if defined(__mips64) || defined(__aarch64__)
   const size_t kMapSize = 0x100000000ULL;
+#elif defined(__riscv) && __riscv_xlen == 64
+  const size_t kMapSize = 0x80000000ULL;
 #else
   const size_t kMapSize = 0x1000000000ULL;
 #endif
   int success_count = 0;
   int flags = MAP_PRIVATE | MAP_ANONYMOUS;
 #if defined(MAP_NORESERVE)
   flags |= MAP_NORESERVE;
 #endif

compiler-rt/test/msan/mmap_below_shadow.cpp

#elif defined (__powerpc64__)
   uintptr_t hint = 0x2f0000000000ULL;
   const uintptr_t app_start = 0x300000000000ULL;
 #elif defined(__s390x__)
   uintptr_t hint = 0x07f000000000ULL;
   const uintptr_t app_start = 0x020000000000ULL;
 #elif defined (__aarch64__)
   uintptr_t hint = 0x4f0000000ULL;
   const uintptr_t app_start = 0x7000000000ULL;
+#elif defined(__riscv) && __riscv_xlen == 64
+  uintptr_t hint = 0x000900000000ULL;
+  const uintptr_t app_start = 0x000000000000ULL;
 #endif
   uintptr_t p = (uintptr_t)mmap(
       (void *)hint, 4096, PROT_WRITE,
       MAP_PRIVATE | MAP_ANONYMOUS | (FIXED ? MAP_FIXED : 0), -1, 0);
   if (FIXED)
     assert(p == (uintptr_t)-1 && errno == EINVAL);
   else
     assert(p >= app_start);
   return 0;
 }

compiler-rt/test/msan/param_tls_limit.cpp

 // ParamTLS has limited size. Everything that does not fit is considered fully
 // initialized.
 
 // RUN: %clangxx_msan -O0 %s -o %t && %run %t
 // RUN: %clangxx_msan -fsanitize-memory-track-origins -O0 %s -o %t && %run %t
 // RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -O0 %s -o %t && %run %t
 //
 // AArch64 fails with:
 // void f801(S<801>): Assertion `__msan_test_shadow(&s, sizeof(s)) == -1' failed
 // XFAIL: aarch64
+//
 // When passing huge structs by value, SystemZ uses pointers, therefore this
 // test in its present form is unfortunately not applicable.
 // ABI says: "A struct or union of any other size <snip>. Replace such an
 // argument by a pointer to the object, or to a copy where necessary to enforce
 // call-by-value semantics."
 // XFAIL: s390x
+//
+// RISC-V fails because struct parameters aren't annotated with `byval` by
+// Clang. The structs are passed by reference and don't trigger the overflow
+// required for the test scenarios. An equivalent test with a large number of
+// parameters passes but is extremely verbose.
+// XFAIL: riscv
 
 #include <sanitizer/msan_interface.h>
 #include <assert.h>
 
 // This test assumes that ParamTLS size is 800 bytes.
 
 // This test passes poisoned values through function argument list.
 // In case of overflow, argument is unpoisoned.

compiler-rt/test/msan/strlen_of_shadow.cpp

 #elif defined(__powerpc64__)
 #define LINEARIZE_MEM(mem) \
   (((uintptr_t)(mem) & ~0x200000000000ULL) ^ 0x100000000000ULL)
   return (char *)(LINEARIZE_MEM(p) + 0x080000000000ULL);
 #elif defined(__s390x__)
   return (char *)(((uintptr_t)p & ~0xC00000000000ULL) + 0x080000000000ULL);
 #elif defined(__aarch64__)
   return (char *)((uintptr_t)p ^ 0x6000000000ULL);
+#elif defined(__riscv) && __riscv_xlen == 64
+  return (char *)((uintptr_t)p ^ 0x3000000000ULL);
 #endif
 }
 
 int main(void) {
   const char *s = "abcdef";
   assert(strlen(s) == 6);
   assert(strlen(mem_to_shadow(s)) == 0);
 
   char *t = new char[42];
   t[41] = 0;
   assert(strlen(mem_to_shadow(t)) == 41);
   return 0;
 }

compiler-rt/test/msan/vararg.cpp

 // RUN: FileCheck %s --check-prefixes=CHECK,CHECK-ORIGIN < %t.out
 
 // RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -O3 %s -o %t && \
 // RUN:     not %run %t overflow >%t.out 2>&1
 // RUN: FileCheck %s --check-prefixes=CHECK,CHECK-ORIGIN < %t.out
 
 // Check that shadow and origin are passed through va_args.
 
-// Copying origins on AArch64, MIPS and PowerPC isn't supported yet.
+// Copying origins on AArch64, MIPS, PowerPC and RISC-V isn't supported yet.
 // XFAIL: aarch64
 // XFAIL: mips
 // XFAIL: powerpc64
+// XFAIL: riscv64
 
 #include <stdarg.h>
 #include <string.h>
 
 __attribute__((noinline))
 int sum(int n, ...) {
   va_list args;
   int i, sum = 0, arg;

llvm/lib/Transforms/Instrumentation/MemorySanitizer.cpp

 // aarch64 Linux
 static const MemoryMapParams Linux_AArch64_MemoryMapParams = {
   0,               // AndMask (not used)
   0x06000000000,   // XorMask
   0,               // ShadowBase (not used)
   0x01000000000,   // OriginBase
 };
 
+// riscv64 Linux
+static const MemoryMapParams Linux_RISCV64_MemoryMapParams = {
+    0,             // AndMask (not used)
+    0x03000000000, // XorMask
+    0,             // ShadowBase (not used)
+    0x00600000000, // OriginBase
+};
+
 // i386 FreeBSD
 static const MemoryMapParams FreeBSD_I386_MemoryMapParams = {
   0x000180000000,  // AndMask
   0x000040000000,  // XorMask
   0x000020000000,  // ShadowBase
   0x000700000000,  // OriginBase
 };
 
static const PlatformMemoryMapParams Linux_S390_MemoryMapParams = {
     &Linux_S390X_MemoryMapParams,
 };
 
 static const PlatformMemoryMapParams Linux_ARM_MemoryMapParams = {
   nullptr,
   &Linux_AArch64_MemoryMapParams,
 };
 
+static const PlatformMemoryMapParams Linux_RISCV_MemoryMapParams = {
+    nullptr,
+    &Linux_RISCV64_MemoryMapParams,
+};
+
 static const PlatformMemoryMapParams FreeBSD_X86_MemoryMapParams = {
   &FreeBSD_I386_MemoryMapParams,
   &FreeBSD_X86_64_MemoryMapParams,
 };
 
 static const PlatformMemoryMapParams NetBSD_X86_MemoryMapParams = {
   nullptr,
   &NetBSD_X86_64_MemoryMapParams,
public:
   bool sanitizeFunction(Function &F, TargetLibraryInfo &TLI);
 
 private:
   friend struct MemorySanitizerVisitor;
   friend struct VarArgAMD64Helper;
   friend struct VarArgMIPS64Helper;
   friend struct VarArgAArch64Helper;
   friend struct VarArgPowerPC64Helper;
+  friend struct VarArgRISCV64Helper;
   friend struct VarArgSystemZHelper;
 
   void initializeModule(Module &M);
   void initializeCallbacks(Module &M);
   void createKernelApi(Module &M);
   void createUserspaceApi(Module &M);
 
   /// True if we're compiling the Linux kernel.
switch (TargetTriple.getOS()) {
             break;
           case Triple::systemz:
             MapParams = Linux_S390_MemoryMapParams.bits64;
             break;
           case Triple::aarch64:
           case Triple::aarch64_be:
             MapParams = Linux_ARM_MemoryMapParams.bits64;
             break;
+          case Triple::riscv64:
+            MapParams = Linux_RISCV_MemoryMapParams.bits64;
+            break;
           default:
             report_fatal_error("unsupported architecture");
         }
         break;
       default:
         report_fatal_error("unsupported operating system");
     }
   }
for (size_t VaStartNo = 0, VaStartNum = VAStartInstrumentationList.size();
       IRBuilder<> IRB(OrigInst->getNextNode());
       Value *VAListTag = OrigInst->getArgOperand(0);
       copyRegSaveArea(IRB, VAListTag);
       copyOverflowArea(IRB, VAListTag);
     }
   }
 };
 
+struct VarArgRISCV64Helper : public VarArgHelper {
+  Function &F;
+  MemorySanitizer &MS;
+  MemorySanitizerVisitor &MSV;
+  Value *VAArgTLSCopy = nullptr;
+  Value *VAArgSize = nullptr;
+  static constexpr int XSize = 8; // XLEN in bytes.
+  static constexpr int NumArgRegs = 8;
+
+  SmallVector<CallInst *, 16> VAStartInstrumentationList;
+
+  VarArgRISCV64Helper(Function &F, MemorySanitizer &MS,
+                      MemorySanitizerVisitor &MSV)
+      : F(F), MS(MS), MSV(MSV) {}
+
+  void visitCallBase(CallBase &CB, IRBuilder<> &IRB) override {
+    const DataLayout &DL = F.getParent()->getDataLayout();
+    unsigned NumParams = CB.getFunctionType()->getNumParams();
+    unsigned VAArgOffset = 0;
+    unsigned VAArgSkew = 0;
+    int ArgRegister = 0;
+    bool IsSkewed = false;
+
+    // Depending on the fixed params, VAArgOffset zero may point to an address
+    // that is either (2*XLEN)-aligned or just XLEN-aligned. In other words, it
+    // may be XLEN-skewed. We need to account for that when computing the
+    // alignment of the varargs. So, we first compute the skew (in bytes)
+    // introduced by the fixed params.
+    for (auto ArgIt = CB.arg_begin(), End = CB.arg_begin() + NumParams;
+         ArgIt != End; ++ArgIt) {
+      Value *A = *ArgIt;
+      Align ArgAlign = DL.getABITypeAlign(A->getType());
+      uint64_t ArgSize = DL.getTypeAllocSize(A->getType());
+      assert(ArgSize <= 2 * XSize && "Unexpected argument size");
+      if (ArgSize == 2 * XSize) {
+        if (ArgRegister == NumArgRegs - 1)
+          IsSkewed = true;
+        else if (ArgRegister >= NumArgRegs && ArgAlign >= Align(2 * XSize))
+          IsSkewed = false;
+      } else {
+        IsSkewed = !IsSkewed;
+      }
+      ArgRegister += alignTo(ArgSize, XSize) / XSize;
+    }
+    if (IsSkewed)
+      VAArgSkew = XSize;
+    for (auto ArgIt = CB.arg_begin() + NumParams, End = CB.arg_end();
+         ArgIt != End; ++ArgIt) {
+      Value *A = *ArgIt;
+      uint64_t ArgSize = DL.getTypeAllocSize(A->getType());
+      assert(ArgSize <= 2 * XSize && "Unexpected argument size");
+      Align ArgAlign = DL.getABITypeAlign(A->getType());
+      if (ArgAlign < Align(XSize))
+        ArgAlign = Align(XSize);
+      VAArgOffset = alignTo(VAArgOffset, ArgAlign, VAArgSkew);
+      Value *Base =
+          getShadowPtrForVAArgument(A->getType(), IRB, VAArgOffset, ArgSize);
+      VAArgOffset += alignTo(ArgSize, XSize);
+      IRB.CreateAlignedStore(MSV.getShadow(A), Base, kShadowTLSAlignment);
+    }
+    Constant *TotalVAArgSize = ConstantInt::get(IRB.getInt64Ty(), VAArgOffset);
+    // Here using VAArgOverflowSizeTLS as VAArgSizeTLS to avoid creation of
+    // a new class member i.e. it is the total size of all VarArgs.
+    IRB.CreateStore(TotalVAArgSize, MS.VAArgOverflowSizeTLS);
+  }
+
+  /// Compute the shadow address for a given va_arg.
+  Value *getShadowPtrForVAArgument(Type *Ty, IRBuilder<> &IRB,
+                                   unsigned ArgOffset, unsigned ArgSize) {
+    // Make sure we don't overflow __msan_va_arg_tls.
+    if (ArgOffset + ArgSize > kParamTLSSize)
+      return nullptr;
+    Value *Base = IRB.CreatePointerCast(MS.VAArgTLS, MS.IntptrTy);
+    Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
+    return IRB.CreateIntToPtr(Base, PointerType::get(MSV.getShadowTy(Ty), 0),
+                              "_msarg");
+  }
+
+  void visitVAStartInst(VAStartInst &I) override {
+    IRBuilder<> IRB(&I);
+    VAStartInstrumentationList.push_back(&I);
+    Value *VAListTag = I.getArgOperand(0);
+    Value *ShadowPtr, *OriginPtr;
+    const Align Alignment = Align(XSize);
+    std::tie(ShadowPtr, OriginPtr) = MSV.getShadowOriginPtr(
+        VAListTag, IRB, IRB.getInt8Ty(), Alignment, /*isStore*/ true);
+    IRB.CreateMemSet(ShadowPtr, Constant::getNullValue(IRB.getInt8Ty()),
+                     /* size */ XSize, Alignment, false);
+  }
+
+  void visitVACopyInst(VACopyInst &I) override {
+    IRBuilder<> IRB(&I);
+    VAStartInstrumentationList.push_back(&I);
+    Value *VAListTag = I.getArgOperand(0);
+    Value *ShadowPtr, *OriginPtr;
+    const Align Alignment = Align(XSize);
+    std::tie(ShadowPtr, OriginPtr) = MSV.getShadowOriginPtr(
+        VAListTag, IRB, IRB.getInt8Ty(), Alignment, /*isStore*/ true);
+    IRB.CreateMemSet(ShadowPtr, Constant::getNullValue(IRB.getInt8Ty()),
+                     /* size */ XSize, Alignment, false);
+  }
+
+  void finalizeInstrumentation() override {
+    assert(!VAArgSize && !VAArgTLSCopy &&
+           "finalizeInstrumentation called twice");
+    IRBuilder<> IRB(MSV.FnPrologueEnd);
+    VAArgSize = IRB.CreateLoad(IRB.getInt64Ty(), MS.VAArgOverflowSizeTLS);
+    Value *CopySize =
+        IRB.CreateAdd(ConstantInt::get(MS.IntptrTy, 0), VAArgSize);
+
+    if (!VAStartInstrumentationList.empty()) {
+      // If there is a va_start in this function, make a backup copy of
+      // va_arg_tls somewhere in the function entry block.
+      VAArgTLSCopy = IRB.CreateAlloca(Type::getInt8Ty(*MS.C), CopySize);
+      IRB.CreateMemCpy(VAArgTLSCopy, Align(XSize), MS.VAArgTLS, Align(XSize),
+                       CopySize);
+    }
+
+    // Instrument va_start.
+    // Copy va_list shadow from the backup copy of the TLS contents.
+    for (size_t I = 0, N = VAStartInstrumentationList.size(); I < N; I++) {
+      CallInst *OrigInst = VAStartInstrumentationList[I];
+      IRBuilder<> IRB(OrigInst->getNextNode());
+      Value *VAListTag = OrigInst->getArgOperand(0);
+      Type *RegSaveAreaPtrTy = Type::getInt64PtrTy(*MS.C);
+      Value *RegSaveAreaPtrPtr =
+          IRB.CreateIntToPtr(IRB.CreatePtrToInt(VAListTag, MS.IntptrTy),
+                             PointerType::get(RegSaveAreaPtrTy, 0));
+      Value *RegSaveAreaPtr =
+          IRB.CreateLoad(RegSaveAreaPtrTy, RegSaveAreaPtrPtr);
+      Value *RegSaveAreaShadowPtr, *RegSaveAreaOriginPtr;
+      const Align Alignment = Align(XSize);
+      std::tie(RegSaveAreaShadowPtr, RegSaveAreaOriginPtr) =
+          MSV.getShadowOriginPtr(RegSaveAreaPtr, IRB, IRB.getInt8Ty(),
+                                 Alignment, /*isStore*/ true);
+      IRB.CreateMemCpy(RegSaveAreaShadowPtr, Alignment, VAArgTLSCopy, Alignment,
+                       CopySize);
+    }
+  }
+};
+
 /// A no-op implementation of VarArgHelper.
 struct VarArgNoOpHelper : public VarArgHelper {
   VarArgNoOpHelper(Function &F, MemorySanitizer &MS,
                    MemorySanitizerVisitor &MSV) {}
 
   void visitCallBase(CallBase &CB, IRBuilder<> &IRB) override {}
 
   void visitVAStartInst(VAStartInst &I) override {}
if (TargetTriple.getArch() == Triple::x86_64)
     return new VarArgAMD64Helper(Func, Msan, Visitor);
   else if (TargetTriple.isMIPS64())
     return new VarArgMIPS64Helper(Func, Msan, Visitor);
   else if (TargetTriple.getArch() == Triple::aarch64)
     return new VarArgAArch64Helper(Func, Msan, Visitor);
   else if (TargetTriple.getArch() == Triple::ppc64 ||
            TargetTriple.getArch() == Triple::ppc64le)
     return new VarArgPowerPC64Helper(Func, Msan, Visitor);
+  else if (TargetTriple.getArch() == Triple::riscv64)
+    return new VarArgRISCV64Helper(Func, Msan, Visitor);
   else if (TargetTriple.getArch() == Triple::systemz)
     return new VarArgSystemZHelper(Func, Msan, Visitor);
   else
     return new VarArgNoOpHelper(Func, Msan, Visitor);
 }
 
 bool MemorySanitizer::sanitizeFunction(Function &F, TargetLibraryInfo &TLI) {
   if (!CompileKernel && F.getName() == kMsanModuleCtorName)