1//===-- hwasan_checks.h -----------------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of HWAddressSanitizer.
10//
11//===----------------------------------------------------------------------===//
12
13#ifndef HWASAN_CHECKS_H
14#define HWASAN_CHECKS_H
15
16#include "hwasan_allocator.h"
17#include "hwasan_mapping.h"
18#include "sanitizer_common/sanitizer_common.h"
19
20namespace __hwasan {
21template <unsigned X>
22__attribute__((always_inline)) static void SigTrap(uptr p) {
23#if defined(__aarch64__)
24  (void)p;
25  // 0x900 is added to do not interfere with the kernel use of lower values of
26  // brk immediate.
27  register uptr x0 asm("x0") = p;
28  asm("brk %1\n\t" ::"r"(x0), "n"(0x900 + X));
29#elif defined(__x86_64__)
30  // INT3 + NOP DWORD ptr [EAX + X] to pass X to our signal handler, 5 bytes
31  // total. The pointer is passed via rdi.
32  // 0x40 is added as a safeguard, to help distinguish our trap from others and
33  // to avoid 0 offsets in the command (otherwise it'll be reduced to a
34  // different nop command, the three bytes one).
35  asm volatile(
36      "int3\n"
37      "nopl %c0(%%rax)\n" ::"n"(0x40 + X),
38      "D"(p));
39#else
40  // FIXME: not always sigill.
41  __builtin_trap();
42#endif
43  // __builtin_unreachable();
44}
45
46// Version with access size which is not power of 2
47template <unsigned X>
48__attribute__((always_inline)) static void SigTrap(uptr p, uptr size) {
49#if defined(__aarch64__)
50  register uptr x0 asm("x0") = p;
51  register uptr x1 asm("x1") = size;
52  asm("brk %2\n\t" ::"r"(x0), "r"(x1), "n"(0x900 + X));
53#elif defined(__x86_64__)
54  // Size is stored in rsi.
55  asm volatile(
56      "int3\n"
57      "nopl %c0(%%rax)\n" ::"n"(0x40 + X),
58      "D"(p), "S"(size));
59#else
60  __builtin_trap();
61#endif
62  // __builtin_unreachable();
63}
64
65__attribute__((always_inline, nodebug)) static bool PossiblyShortTagMatches(
66    tag_t mem_tag, uptr ptr, uptr sz) {
67  tag_t ptr_tag = GetTagFromPointer(ptr);
68  if (ptr_tag == mem_tag)
69    return true;
70  if (mem_tag >= kShadowAlignment)
71    return false;
72  if ((ptr & (kShadowAlignment - 1)) + sz > mem_tag)
73    return false;
74#ifndef __aarch64__
75  ptr = UntagAddr(ptr);
76#endif
77  return *(u8 *)(ptr | (kShadowAlignment - 1)) == ptr_tag;
78}
79
80enum class ErrorAction { Abort, Recover };
81enum class AccessType { Load, Store };
82
83template <ErrorAction EA, AccessType AT, unsigned LogSize>
84__attribute__((always_inline, nodebug)) static void CheckAddress(uptr p) {
85  if (!InTaggableRegion(p))
86    return;
87  uptr ptr_raw = p & ~kAddressTagMask;
88  tag_t mem_tag = *(tag_t *)MemToShadow(ptr_raw);
89  if (UNLIKELY(!PossiblyShortTagMatches(mem_tag, p, 1 << LogSize))) {
90    SigTrap<0x20 * (EA == ErrorAction::Recover) +
91            0x10 * (AT == AccessType::Store) + LogSize>(p);
92    if (EA == ErrorAction::Abort)
93      __builtin_unreachable();
94  }
95}
96
97template <ErrorAction EA, AccessType AT>
98__attribute__((always_inline, nodebug)) static void CheckAddressSized(uptr p,
99                                                                      uptr sz) {
100  if (sz == 0 || !InTaggableRegion(p))
101    return;
102  tag_t ptr_tag = GetTagFromPointer(p);
103  uptr ptr_raw = p & ~kAddressTagMask;
104  tag_t *shadow_first = (tag_t *)MemToShadow(ptr_raw);
105  tag_t *shadow_last = (tag_t *)MemToShadow(ptr_raw + sz);
106  for (tag_t *t = shadow_first; t < shadow_last; ++t)
107    if (UNLIKELY(ptr_tag != *t)) {
108      SigTrap<0x20 * (EA == ErrorAction::Recover) +
109              0x10 * (AT == AccessType::Store) + 0xf>(p, sz);
110      if (EA == ErrorAction::Abort)
111        __builtin_unreachable();
112    }
113  uptr end = p + sz;
114  uptr tail_sz = end & 0xf;
115  if (UNLIKELY(tail_sz != 0 &&
116               !PossiblyShortTagMatches(
117                   *shadow_last, end & ~(kShadowAlignment - 1), tail_sz))) {
118    SigTrap<0x20 * (EA == ErrorAction::Recover) +
119            0x10 * (AT == AccessType::Store) + 0xf>(p, sz);
120    if (EA == ErrorAction::Abort)
121      __builtin_unreachable();
122  }
123}
124
125}  // end namespace __hwasan
126
127#endif  // HWASAN_CHECKS_H
128