Author: yln
Date: Tue Jul 9 09:49:43 2019
New Revision: 365513
URL: http://llvm.org/viewvc/llvm-project?rev=365513&view=rev
Log:
[TSan] Improve handling of stack pointer mangling in {set,long}jmp, pt.8
Refine longjmp key management. For Linux, re-implement key retrieval in
C (instead of assembly). Removal of `InitializeGuardPtr` and a final
round of cleanups will be done in the next commit.
Reviewed By: dvyukov
Differential Revision: https://reviews.llvm.org/D64092
Modified:
compiler-rt/trunk/lib/tsan/rtl/tsan_platform_linux.cc
compiler-rt/trunk/lib/tsan/rtl/tsan_platform_mac.cc
Modified: compiler-rt/trunk/lib/tsan/rtl/tsan_platform_linux.cc
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/tsan/rtl/tsan_platform_linux.cc?rev=365513&r1=365512&r2=365513&view=diff
==============================================================================
--- compiler-rt/trunk/lib/tsan/rtl/tsan_platform_linux.cc (original)
+++ compiler-rt/trunk/lib/tsan/rtl/tsan_platform_linux.cc Tue Jul 9 09:49:43 2019
@@ -68,12 +68,17 @@ void *__libc_stack_end = 0;
#endif
#if SANITIZER_LINUX && defined(__aarch64__)
-void InitializeGuardPtr() __attribute__((visibility("hidden")));
+__tsan::uptr InitializeGuardPtr() __attribute__((visibility("hidden")));
extern "C" __tsan::uptr _tsan_pointer_chk_guard;
#endif
namespace __tsan {
+#if SANITIZER_LINUX && defined(__aarch64__)
+static void InitializeLongjmpXorKey();
+static uptr longjmp_xor_key;
+#endif
+
#ifdef TSAN_RUNTIME_VMA
// Runtime detected VMA size.
uptr vmaSize;
@@ -285,7 +290,25 @@ void InitializePlatform() {
reexec = true;
}
// Initialize the guard pointer used in {sig}{set,long}jump.
- InitializeGuardPtr();
+ longjmp_xor_key = InitializeGuardPtr();
+ uptr old_value = longjmp_xor_key;
+ InitializeLongjmpXorKey();
+ CHECK_EQ(longjmp_xor_key, old_value);
+ // If the above check fails for you, please contact me (jlettner at apple.com)
+ // and let me know the values of the two differing keys. Please also set a
+ // breakpoint on `InitializeGuardPtr` and `InitializeLongjmpXorKey` and tell
+ // me the stack pointer (SP) values that go into the XOR operation (where we
+ // derive the key):
+ //
+ // InitializeLongjmpXorKey:
+ // uptr sp = (uptr)__builtin_frame_address(0);
+ //
+ // InitializeGuardPtr (in tsan_rtl_aarch64.S):
+ // mov x0, sp
+ // ...
+ // eor x0, x0, x1
+ //
+ // Then feel free to comment out the call to `InitializeLongjmpXorKey`.
#endif
if (reexec)
ReExec();
@@ -353,9 +376,7 @@ static uptr UnmangleLongJmpSp(uptr mangl
# endif
#elif defined(__aarch64__)
# if SANITIZER_LINUX
- // TODO(yln): fix this
- // return mangled_sp ^ _tsan_pointer_chk_guard;
- return mangled_sp;
+ return mangled_sp ^ longjmp_xor_key;
# else
return mangled_sp;
# endif
@@ -394,6 +415,25 @@ uptr ExtractLongJmpSp(uptr *env) {
return UnmangleLongJmpSp(mangled_sp);
}
+#if SANITIZER_LINUX && defined(__aarch64__)
+// GLIBC mangles the function pointers in jmp_buf (used in {set,long}*jmp
+// functions) by XORing them with a random key. For AArch64 it is a global
+// variable rather than a TCB one (as for x86_64/powerpc). We obtain the key by
+// issuing a setjmp and XORing the SP pointer values to derive the key.
+static void InitializeLongjmpXorKey() {
+ // 1. Call REAL(setjmp), which stores the mangled SP in env.
+ jump_buf env;
+ REAL(setjmp)(env);
+
+ // 2. Retrieve mangled/vanilla SP.
+ uptr mangled_sp = ((uptr *)&env)[LONG_JMP_SP_ENV_SLOT];
+ uptr sp = (uptr)__builtin_frame_address(0);
+
+ // 3. xor SPs to obtain key.
+ longjmp_xor_key = mangled_sp ^ sp;
+}
+#endif
+
void ImitateTlsWrite(ThreadState *thr, uptr tls_addr, uptr tls_size) {
// Check that the thr object is in tls;
const uptr thr_beg = (uptr)thr;
Modified: compiler-rt/trunk/lib/tsan/rtl/tsan_platform_mac.cc
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/tsan/rtl/tsan_platform_mac.cc?rev=365513&r1=365512&r2=365513&view=diff
==============================================================================
--- compiler-rt/trunk/lib/tsan/rtl/tsan_platform_mac.cc (original)
+++ compiler-rt/trunk/lib/tsan/rtl/tsan_platform_mac.cc Tue Jul 9 09:49:43 2019
@@ -238,8 +238,7 @@ void InitializePlatformEarly() {
#endif
}
-static const uptr kPthreadSetjmpXorKeySlot = 0x7;
-extern "C" uptr __tsan_darwin_setjmp_xor_key = 0;
+static uptr longjmp_xor_key = 0;
void InitializePlatform() {
DisableCoreDumperIfNecessary();
@@ -254,8 +253,9 @@ void InitializePlatform() {
#endif
if (GetMacosVersion() >= MACOS_VERSION_MOJAVE) {
- __tsan_darwin_setjmp_xor_key =
- (uptr)pthread_getspecific(kPthreadSetjmpXorKeySlot);
+ // Libsystem currently uses a process-global key; this might change.
+ const unsigned kTLSLongjmpXorKeySlot = 0x7;
+ longjmp_xor_key = (uptr)pthread_getspecific(kTLSLongjmpXorKeySlot);
}
}
@@ -268,7 +268,8 @@ void InitializePlatform() {
uptr ExtractLongJmpSp(uptr *env) {
uptr mangled_sp = env[LONG_JMP_SP_ENV_SLOT];
- return mangled_sp ^ __tsan_darwin_setjmp_xor_key;
+ uptr sp = mangled_sp ^ longjmp_xor_key;
+ return sp;
}
#if !SANITIZER_GO