1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * * Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in
12 * the documentation and/or other materials provided with the
13 * distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #pragma once
30
31 #include <stddef.h>
32 #include <sys/auxv.h>
33 #include <sys/mman.h>
34 #include <sys/prctl.h>
35
36 #include "page.h"
37
38 // Note: Most PR_MTE_* constants come from the upstream kernel. This tag mask
39 // allows for the hardware to provision any nonzero tag. Zero tags are reserved
40 // for scudo to use for the chunk headers in order to prevent linear heap
41 // overflow/underflow.
42 #define PR_MTE_TAG_SET_NONZERO (0xfffeUL << PR_MTE_TAG_SHIFT)
43
mte_supported()44 inline bool mte_supported() {
45 #if defined(__aarch64__)
46 static bool supported = getauxval(AT_HWCAP2) & HWCAP2_MTE;
47 #else
48 static bool supported = false;
49 #endif
50 return supported;
51 }
52
mte_enabled()53 static inline bool mte_enabled() {
54 #ifdef __aarch64__
55 int level = prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0);
56 return level >= 0 && (level & PR_TAGGED_ADDR_ENABLE) &&
57 (level & PR_MTE_TCF_MASK) != PR_MTE_TCF_NONE;
58 #else
59 return false;
60 #endif
61 }
62
get_tagged_address(const void * ptr)63 inline void* get_tagged_address(const void* ptr) {
64 #if defined(__aarch64__)
65 if (mte_supported()) {
66 __asm__ __volatile__(".arch_extension mte; ldg %0, [%0]" : "+r"(ptr));
67 }
68 #endif // aarch64
69 return const_cast<void*>(ptr);
70 }
71
72 // Inserts a random tag tag to `ptr`, using any of the set lower 16 bits in
73 // `mask` to exclude the corresponding tag from being generated. Note: This does
74 // not tag memory. This generates a pointer to be used with set_memory_tag.
75 inline void* insert_random_tag(const void* ptr, __attribute__((unused)) uint64_t mask = 0) {
76 #if defined(__aarch64__)
77 if (mte_supported() && ptr) {
78 __asm__ __volatile__(".arch_extension mte; irg %0, %0, %1" : "+r"(ptr) : "r"(mask));
79 }
80 #endif // aarch64
81 return const_cast<void*>(ptr);
82 }
83
84 // Stores the address tag in `ptr` to memory, at `ptr`.
set_memory_tag(void * ptr)85 inline void set_memory_tag(__attribute__((unused)) void* ptr) {
86 #if defined(__aarch64__)
87 if (mte_supported()) {
88 __asm__ __volatile__(".arch_extension mte; stg %0, [%0]" : "+r"(ptr));
89 }
90 #endif // aarch64
91 }
92
93 #ifdef __aarch64__
94 class ScopedDisableMTE {
95 size_t prev_tco_;
96
97 public:
ScopedDisableMTE()98 ScopedDisableMTE() {
99 if (mte_supported()) {
100 __asm__ __volatile__(".arch_extension mte; mrs %0, tco; msr tco, #1" : "=r"(prev_tco_));
101 }
102 }
103
~ScopedDisableMTE()104 ~ScopedDisableMTE() {
105 if (mte_supported()) {
106 __asm__ __volatile__(".arch_extension mte; msr tco, %0" : : "r"(prev_tco_));
107 }
108 }
109 };
110
111 // N.B. that this is NOT the pagesize, but 4096. This is hardcoded in the codegen.
112 // See
113 // https://github.com/search?q=repo%3Allvm/llvm-project%20AArch64StackTagging%3A%3AinsertBaseTaggedPointer&type=code
114 constexpr size_t kStackMteRingbufferSizeMultiplier = 4096;
115
stack_mte_ringbuffer_size(uintptr_t size_cls)116 inline size_t stack_mte_ringbuffer_size(uintptr_t size_cls) {
117 return kStackMteRingbufferSizeMultiplier * (1 << size_cls);
118 }
119
stack_mte_ringbuffer_size_from_pointer(uintptr_t ptr)120 inline size_t stack_mte_ringbuffer_size_from_pointer(uintptr_t ptr) {
121 // The size in the top byte is not the size_cls, but the number of "pages" (not OS pages, but
122 // kStackMteRingbufferSizeMultiplier).
123 return kStackMteRingbufferSizeMultiplier * (ptr >> 56ULL);
124 }
125
stack_mte_ringbuffer_size_add_to_pointer(uintptr_t ptr,uintptr_t size_cls)126 inline uintptr_t stack_mte_ringbuffer_size_add_to_pointer(uintptr_t ptr, uintptr_t size_cls) {
127 return ptr | ((1ULL << size_cls) << 56ULL);
128 }
129
stack_mte_free_ringbuffer(uintptr_t stack_mte_tls)130 inline void stack_mte_free_ringbuffer(uintptr_t stack_mte_tls) {
131 size_t size = stack_mte_ringbuffer_size_from_pointer(stack_mte_tls);
132 void* ptr = reinterpret_cast<void*>(stack_mte_tls & ((1ULL << 56ULL) - 1ULL));
133 munmap(ptr, size);
134 }
135
stack_mte_ringbuffer_allocate(size_t n,const char * name)136 inline void* stack_mte_ringbuffer_allocate(size_t n, const char* name) {
137 if (n > 7) return nullptr;
138 // Allocation needs to be aligned to 2*size to make the fancy code-gen work.
139 // So we allocate 3*size - pagesz bytes, which will always contain size bytes
140 // aligned to 2*size, and unmap the unneeded part.
141 // See
142 // https://github.com/search?q=repo%3Allvm/llvm-project%20AArch64StackTagging%3A%3AinsertBaseTaggedPointer&type=code
143 //
144 // In the worst case, we get an allocation that is one page past the properly
145 // aligned address, in which case we have to unmap the previous
146 // 2*size - pagesz bytes. In that case, we still have size properly aligned
147 // bytes left.
148 size_t size = stack_mte_ringbuffer_size(n);
149 size_t pgsize = page_size();
150
151 size_t alloc_size = __BIONIC_ALIGN(3 * size - pgsize, pgsize);
152 void* allocation_ptr =
153 mmap(nullptr, alloc_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
154 if (allocation_ptr == MAP_FAILED)
155 return nullptr;
156 uintptr_t allocation = reinterpret_cast<uintptr_t>(allocation_ptr);
157
158 size_t alignment = 2 * size;
159 uintptr_t aligned_allocation = __BIONIC_ALIGN(allocation, alignment);
160 if (allocation != aligned_allocation) {
161 munmap(reinterpret_cast<void*>(allocation), aligned_allocation - allocation);
162 }
163 if (aligned_allocation + size != allocation + alloc_size) {
164 munmap(reinterpret_cast<void*>(aligned_allocation + size),
165 (allocation + alloc_size) - (aligned_allocation + size));
166 }
167
168 if (name) {
169 prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, reinterpret_cast<void*>(aligned_allocation), size, name);
170 }
171
172 // We store the size in the top byte of the pointer (which is ignored)
173 return reinterpret_cast<void*>(stack_mte_ringbuffer_size_add_to_pointer(aligned_allocation, n));
174 }
175 #else
176 struct ScopedDisableMTE {
177 // Silence unused variable warnings in non-aarch64 builds.
ScopedDisableMTEScopedDisableMTE178 ScopedDisableMTE() {}
179 };
180 #endif
181