[HWASan] Mention x86_64 aliasing mode in design doc.

[morehouse]

• Format fork() as code.

[eugenis]

LGTM

clang/docs/HardwareAssistedAddressSanitizerDesign.rst

279

This statement seems a bit too strong. Maybe say something along these lines: none of the existing 32-bit platforms provide a practical way to put tag bits in the pointer, and the address space constraints make it hard to do anyway, so hwasan does not support 32-bit at the moment.

[morehouse]

• Expand on lack of 32 bit support.

clang/docs/HardwareAssistedAddressSanitizerDesign.rst

 :doc:`AddressSanitizer`
 tags every 8 bytes of the application memory with a 1 byte tag (using *shadow memory*),
 uses *redzones* to find buffer-overflows and
 *quarantine* to find use-after-free.
 The redzones, the quarantine, and, to a less extent, the shadow, are the
 sources of AddressSanitizer's memory overhead.
 See the `AddressSanitizer paper`_ for details.
 
-AArch64 has the `Address Tagging`_ (or top-byte-ignore, TBI), a hardware feature that allows
-software to use 8 most significant bits of a 64-bit pointer as
+AArch64 has `Address Tagging`_ (or top-byte-ignore, TBI), a hardware feature that allows
+software to use the 8 most significant bits of a 64-bit pointer as
 a tag. HWASAN uses `Address Tagging`_
 to implement a memory safety tool, similar to :doc:`AddressSanitizer`,
 but with smaller memory overhead and slightly different (mostly better)
 accuracy guarantees.
 
+Intel's `Linear Address Masking`_ (LAM) also provides address tagging for
+x86_64, though it is not widely available in hardware yet.  For x86_64, HWASAN
+has a limited implementation using page aliasing instead.
+
 Algorithm
 =========
 * Every heap/stack/global memory object is forcibly aligned by `TG` bytes
   (`TG` is e.g. 16 or 64). We call `TG` the **tagging granularity**.
 * For every such object a random `TS`-bit tag `T` is chosen (`TS`, or tag size, is e.g. 4 or 8)
 * The pointer to the object is tagged with `T`.
 * The memory for the object is also tagged with `T` (using a `TG=>1` shadow memory)
 * Every load and store is instrumented to read the memory tag and compare it

 Supported architectures
 =======================
 HWASAN relies on `Address Tagging`_ which is only available on AArch64.
 For other 64-bit architectures it is possible to remove the address tags
 before every load and store by compiler instrumentation, but this variant
 will have limited deployability since not all of the code is
 typically instrumented.
 
-The HWASAN's approach is not applicable to 32-bit architectures.
+On x86_64, HWASAN utilizes page aliasing to place tags in userspace address
+bits.  Currently only heap tagging is supported.  The page aliases rely on
+shared memory, which will cause heap memory to be shared between processes if
+the application calls fork().  Therefore x86_64 is really only safe for
+applications that do not fork.
+
+HWASAN's approach is not applicable to 32-bit architectures.
 
 
 Related Work
 ============
 * `SPARC ADI`_ implements a similar tool mostly in hardware.
 * `Effective and Efficient Memory Protection Using Dynamic Tainting`_ discusses
   similar approaches ("lock & key").
 * `Watchdog`_ discussed a heavier, but still somewhat similar
   "lock & key" approach.
 * *TODO: add more "related work" links. Suggestions are welcome.*
 
 
 .. _Watchdog: https://www.cis.upenn.edu/acg/papers/isca12_watchdog.pdf
 .. _Effective and Efficient Memory Protection Using Dynamic Tainting: https://www.cc.gatech.edu/~orso/papers/clause.doudalis.orso.prvulovic.pdf
 .. _SPARC ADI: https://lazytyped.blogspot.com/2017/09/getting-started-with-adi.html
 .. _AddressSanitizer paper: https://www.usenix.org/system/files/conference/atc12/atc12-final39.pdf
 .. _Address Tagging: http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.den0024a/ch12s05s01.html
-
+.. _Linear Address Masking: https://software.intel.com/content/www/us/en/develop/download/intel-architecture-instruction-set-extensions-programming-reference.html