Merge pull request #217 from struct/mte_support

Add ARM MTE Support - May be broken

Author: struct

.github/workflows/testsuite.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        version: [11, 12, 13, 14, 15]
+        version: [12, 13, 14, 15]
     steps:
       - uses: actions/checkout@v4
       - run: |

Makefile

@@ -194,6 +194,9 @@ ISO_DTOR_CLEANUP = -DISO_DTOR_CLEANUP=0
 ## UAF_PTR_PAGE is enabled for better crash handling
 SIGNAL_HANDLER = -DSIGNAL_HANDLER=0
 
+## Enable AARCH64 / ARMv8.5a Memory Tagging Extension support
+#ARM_MTE = -DARM_MTE=1 -march=armv8.5-a+memtag
+
 ## If you know your target will have an ARMv8.1-A or newer and
 ## supports Top Byte Ignore (TBI) then you want to enable this.
 ## (Currently unused)
@@ -280,6 +283,23 @@ LTO =
 HUGE_PAGES =
 endif
 
+ifneq ($(ARM_MTE), )
+ifneq ($(UNAME), Linux)
+$(error "ARM MTE is only supported on Linux / Android")
+endif
+
+ifneq ($(DISABLE_CANARY), -DDISABLE_CANARY=1)
+$(error "Disable canaries before continuing")
+endif
+
+ifneq ($(MEMORY_TAGGING), -DMEMORY_TAGGING=0)
+$(error "Disable software tagging before continuing")
+endif
+
+CC = clang-12
+CXX = clang++-12
+endif
+
 HOOKS = $(MALLOC_HOOK)
 OPTIMIZE = -O2 -fstrict-aliasing -Wstrict-aliasing
 COMMON_CFLAGS = -Wall -Iinclude/ $(THREAD_SUPPORT) $(PRE_POPULATE_PAGES) $(STARTUP_MEM_USAGE)
@@ -295,7 +315,7 @@ CFLAGS += $(COMMON_CFLAGS) $(DISABLE_CANARY) $(BUILD_ERROR_FLAGS) $(HOOKS) $(HEA
 	$(ABORT_NO_ENTROPY) $(ISO_DTOR_CLEANUP) $(RANDOMIZE_FREELIST) $(USE_SPINLOCK) $(HUGE_PAGES) $(USE_MLOCK) \
 	$(MEMORY_TAGGING) $(STRONG_SIZE_ISOLATION) $(MEMSET_SANITY) $(AUTO_CTOR_DTOR) $(SIGNAL_HANDLER) \
 	$(BIG_ZONE_META_DATA_GUARD) $(BIG_ZONE_GUARD) $(PROTECT_UNUSED_BIG_ZONE) $(MASK_PTRS) $(SANITIZE_CHUNKS) $(FUZZ_MODE) \
-	$(PERM_FREE_REALLOC)
+	$(PERM_FREE_REALLOC) $(ARM_MTE)
 CXXFLAGS = $(COMMON_CFLAGS) -DCPP_SUPPORT=1 -std=$(STDCXX) $(SANITIZER_SUPPORT) $(HOOKS)
 
 EXE_CFLAGS = -fPIE
@@ -385,7 +405,19 @@ tests: clean library_debug_unit_tests
 	$(CC) $(CFLAGS) $(EXE_CFLAGS) $(DEBUG_LOG_FLAGS) $(GDB_FLAGS) $(OS_FLAGS) tests/pool_test.c $(ISO_ALLOC_PRINTF_SRC) -o $(BUILD_DIR)/pool_test $(LDFLAGS)
 	utils/run_tests.sh
 
+mte_test: clean
+	@echo "make mte_test"
+	$(CC) $(CFLAGS) $(C_SRCS) $(DEBUG_LOG_FLAGS) $(GDB_FLAGS) $(EXE_CFLAGS) $(OS_FLAGS) tests/tests.c -o $(BUILD_DIR)/tests
+	$(CC) $(CFLAGS) $(C_SRCS) $(DEBUG_LOG_FLAGS) $(GDB_FLAGS) $(EXE_CFLAGS) $(OS_FLAGS) tests/interfaces_test.c -o $(BUILD_DIR)/interfaces_test
+	$(CC) $(CFLAGS) $(C_SRCS) $(DEBUG_LOG_FLAGS) $(GDB_FLAGS) $(EXE_CFLAGS) $(OS_FLAGS) tests/heap_overflow.c -o $(BUILD_DIR)/heap_overflow
+	$(CC) $(CFLAGS) $(C_SRCS) $(DEBUG_LOG_FLAGS) $(GDB_FLAGS) $(EXE_CFLAGS) $(OS_FLAGS) tests/double_free.c -o $(BUILD_DIR)/double_free
+	qemu-aarch64-static -cpu max build/tests
+	qemu-aarch64-static -cpu max build/interfaces_test
+	qemu-aarch64-static -cpu max build/heap_overflow
+	qemu-aarch64-static -cpu max build/double_free
+
 tagging_tests: clean cpp_library_debug
+	@echo "make tagging_tests"
 	$(CC) $(CFLAGS) $(EXE_CFLAGS) $(DEBUG_LOG_FLAGS) $(GDB_FLAGS) $(OS_FLAGS) tests/tagged_ptr_test.c $(ISO_ALLOC_PRINTF_SRC) -o $(BUILD_DIR)/tagged_ptr_test $(LDFLAGS)
 	$(CC) $(CFLAGS) $(EXE_CFLAGS) $(DEBUG_LOG_FLAGS) $(GDB_FLAGS) $(OS_FLAGS) tests/uaf_tag_ptr_test.c $(ISO_ALLOC_PRINTF_SRC) -o $(BUILD_DIR)/uaf_tag_ptr_test $(LDFLAGS)
 	$(CC) $(CFLAGS) $(EXE_CFLAGS) $(DEBUG_LOG_FLAGS) $(GDB_FLAGS) $(OS_FLAGS) tests/bad_tag_ptr_test.c $(ISO_ALLOC_PRINTF_SRC) -o $(BUILD_DIR)/bad_tag_ptr_test $(LDFLAGS)

README.md

@@ -86,6 +86,7 @@ When enabled, the `CPU_PIN` feature will restrict allocations from a given zone
 * `PROTECT_FREE_BIG_ZONES` Marks big zones on the free list as `PROT_NONE` when not in use
 * `BIG_ZONE_META_DATA_GUARD` Enables guard pages for big zone meta data
 * `BIG_ZONE_GUARD` Enables guard pages for big zone user pages
+* `ARM_MTE` Enables support for the ARM v8.5a Memory Tagging Extension
 
 ## Building
 
@@ -125,10 +126,12 @@ The Makefile targets are very simple:
 
 ## Android
 
-To build Android libraries for x86_64 and ARM64 architectures just `cd` into the `android/jni` directory and run `ndk-build`.
+To build Android libraries for the ARM64 architecture just `cd` into the `android/jni` directory and run `ndk-build`.
 
 For those of you on an M1 based Mac you can still build IsoAlloc with the following command:
 `arch -x86_64 /bin/bash -c $ANDROID_NDK_HOME/build/ndk-build`
+or
+`~/Library/Android/sdk/ndk/26.1.10909125/ndk-build`
 
 ## Linking With C++
 

android/jni/Android.mk

@@ -14,12 +14,13 @@ LOCAL_CFLAGS := -DTHREAD_SUPPORT=1 -pthread									\
 	-DPROTECT_FREE_BIG_ZONES=0 -DMASK_PTRS=1 -DSIGNAL_HANDLER=0				\
 	-DUSE_MLOCK=1 -DNO_ZERO_ALLOCATIONS=1 -DABORT_ON_NULL=0					\
 	-DABORT_NO_ENTROPY=1 -DMEMCPY_SANITY=0 -DMEMSET_SANITY=0				\
-	-DSTRONG_SIZE_ISOLATION=0 -DISO_DTOR_CLEANUP=0
+	-DSTRONG_SIZE_ISOLATION=0 -DISO_DTOR_CLEANUP=0 -DARM_MTE=1 				\
+	-march=armv8.5-a+memtag
 
 LOCAL_SRC_FILES := ../../src/iso_alloc.c ../../src/iso_alloc_printf.c ../../src/iso_alloc_random.c				\
 				   ../../src/iso_alloc_search.c ../../src/iso_alloc_interfaces.c ../../src/iso_alloc_profiler.c	\
 				   ../../src/iso_alloc_sanity.c ../../src/iso_alloc_util.c ../../src/malloc_hook.c 				\
-				   ../../src/libc_hook.c ../../src/iso_alloc_mem_tags.c
+				   ../../src/libc_hook.c ../../src/iso_alloc_mem_tags.c ../../src/iso_alloc_mte.c
 
 LOCAL_C_INCLUDES := ../../include/
 

android/jni/Application.mk

@@ -1,2 +1,2 @@
-APP_ABI := arm64-v8a x86_64
+APP_ABI := arm64-v8a
 APP_PLATFORM := android-28

include/iso_alloc_ds.h

@@ -152,6 +152,9 @@ typedef struct {
     int32_t big_zone_free_count;
     int32_t big_zone_used_count;
     uint16_t zones_used;
+#if ARM_MTE
+    bool arm_mte_enabled;
+#endif
 } __attribute__((aligned(sizeof(int64_t)))) iso_alloc_root;
 
 typedef struct {

include/iso_alloc_internal.h

@@ -368,7 +368,7 @@ INTERNAL_HIDDEN iso_alloc_zone_t *find_suitable_zone(size_t size);
 INTERNAL_HIDDEN iso_alloc_zone_t *iso_new_zone(size_t size, bool internal);
 INTERNAL_HIDDEN iso_alloc_zone_t *_iso_new_zone(size_t size, bool internal, int32_t index);
 INTERNAL_HIDDEN iso_alloc_zone_t *iso_find_zone_bitmap_range(const void *p);
-INTERNAL_HIDDEN iso_alloc_zone_t *iso_find_zone_range(const void *p);
+INTERNAL_HIDDEN iso_alloc_zone_t *iso_find_zone_range(void *p);
 INTERNAL_HIDDEN iso_alloc_zone_t *search_chunk_lookup_table(const void *p);
 INTERNAL_HIDDEN bit_slot_t iso_scan_zone_free_slot_slow(iso_alloc_zone_t *zone);
 INTERNAL_HIDDEN bit_slot_t iso_scan_zone_free_slot(iso_alloc_zone_t *zone);
@@ -416,6 +416,16 @@ INTERNAL_HIDDEN int64_t check_canary_no_abort(iso_alloc_zone_t *zone, const void
 INTERNAL_HIDDEN void _iso_alloc_initialize(void);
 INTERNAL_HIDDEN void _iso_alloc_destroy(void);
 
+#if ARM_MTE
+INLINE void *iso_mte_untag_ptr(void *p);
+INLINE uint8_t iso_mte_extract_tag(void *p);
+INLINE bool iso_is_mte_supported(void);
+INLINE void *iso_mte_set_tag_range(void *p, size_t size);
+INLINE void *iso_mte_create_tag(void *p, uint64_t exclusion_mask);
+INLINE void iso_mte_set_tag(void *p);
+INLINE void *iso_mte_get_tag(void *p);
+#endif
+
 #if SIGNAL_HANDLER
 INTERNAL_HIDDEN void handle_signal(int sig, siginfo_t *si, void *ctx);
 #endif

include/iso_alloc_util.h

@@ -25,7 +25,9 @@ INTERNAL_HIDDEN void *create_guard_page(void *p);
 INTERNAL_HIDDEN INLINE void darwin_reuse(void *p, size_t size);
 INTERNAL_HIDDEN void unmap_guarded_pages(void *p, size_t size);
 INTERNAL_HIDDEN ASSUME_ALIGNED void *mmap_guarded_rw_pages(size_t size, bool populate, const char *name);
+INTERNAL_HIDDEN ASSUME_ALIGNED void *mmap_guarded_rw_mte_pages(size_t size, bool populate, const char *name);
 INTERNAL_HIDDEN ASSUME_ALIGNED void *mmap_rw_pages(size_t size, bool populate, const char *name);
+INTERNAL_HIDDEN ASSUME_ALIGNED void *mmap_rw_mte_pages(size_t size, bool populate, const char *name);
 INTERNAL_HIDDEN ASSUME_ALIGNED void *mmap_pages(size_t size, bool populate, const char *name, int32_t prot);
 INTERNAL_HIDDEN void mprotect_pages(void *p, size_t size, int32_t protection);
 INTERNAL_HIDDEN int32_t name_mapping(void *p, size_t sz, const char *name);

include/os/android.h

@@ -4,6 +4,7 @@
 #pragma once
 
 #include <sys/prctl.h>
+#include <sys/auxv.h>
 
 /* This magic number is usually defined by Android Bionic:
  * https://android.googlesource.com/platform/bionic/+/263325d/libc/include/sys/prctl.h#42 */
@@ -14,3 +15,34 @@
 #ifndef PR_SET_VMA_ANON_NAME
 #define PR_SET_VMA_ANON_NAME 0
 #endif
+
+#if (__clang_major__ >= 12 && defined(__aarch64__) && !defined(__ILP32__)) && ARM_MTE == 1
+/* TODO: these belong in an aarch specific header */
+#ifndef PROT_MTE
+#define PROT_MTE 0x20
+#endif
+#ifndef PR_SET_TAGGED_ADDR_CTRL
+#define PR_SET_TAGGED_ADDR_CTRL 54
+#endif
+#ifndef PR_GET_TAGGED_ADDR_CTRL
+#define PR_GET_TAGGED_ADDR_CTRL 56
+#endif
+#ifndef PR_TAGGED_ADDR_ENABLE
+#define PR_TAGGED_ADDR_ENABLE (1UL << 0)
+#endif
+#ifndef PR_MTE_TCF_SHIFT
+#define PR_MTE_TCF_SHIFT 1
+#endif
+#ifndef PR_MTE_TAG_SHIFT
+#define PR_MTE_TAG_SHIFT 3
+#endif
+#ifndef PR_MTE_TCF_NONE
+#define PR_MTE_TCF_NONE (0UL << PR_MTE_TCF_SHIFT)
+#endif
+#ifndef PR_MTE_TCF_SYNC
+#define PR_MTE_TCF_SYNC (1UL << PR_MTE_TCF_SHIFT)
+#endif
+#ifndef PR_MTE_TCF_MASK
+#define PR_MTE_TCF_MASK (3UL << PR_MTE_TCF_SHIFT)
+#endif
+#endif

include/os/linux.h

@@ -4,6 +4,7 @@
 #pragma once
 
 #include <sys/prctl.h>
+#include <sys/auxv.h>
 #include <byteswap.h>
 /* Get linux kernel version */
 #include <linux/version.h>
@@ -29,3 +30,34 @@
 #endif
 
 #define ENVIRON environ
+
+#if (__clang_major__ >= 12 && defined(__aarch64__) && !defined(__ILP32__)) && ARM_MTE == 1
+/* TODO: these belong in an aarch specific header */
+#ifndef PROT_MTE
+#define PROT_MTE 0x20
+#endif
+#ifndef PR_SET_TAGGED_ADDR_CTRL
+#define PR_SET_TAGGED_ADDR_CTRL 54
+#endif
+#ifndef PR_GET_TAGGED_ADDR_CTRL
+#define PR_GET_TAGGED_ADDR_CTRL 56
+#endif
+#ifndef PR_TAGGED_ADDR_ENABLE
+#define PR_TAGGED_ADDR_ENABLE (1UL << 0)
+#endif
+#ifndef PR_MTE_TCF_SHIFT
+#define PR_MTE_TCF_SHIFT 1
+#endif
+#ifndef PR_MTE_TAG_SHIFT
+#define PR_MTE_TAG_SHIFT 3
+#endif
+#ifndef PR_MTE_TCF_NONE
+#define PR_MTE_TCF_NONE (0UL << PR_MTE_TCF_SHIFT)
+#endif
+#ifndef PR_MTE_TCF_SYNC
+#define PR_MTE_TCF_SYNC (1UL << PR_MTE_TCF_SHIFT)
+#endif
+#ifndef PR_MTE_TCF_MASK
+#define PR_MTE_TCF_MASK (3UL << PR_MTE_TCF_SHIFT)
+#endif
+#endif