1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
|
#include "sanitizer_common/sanitizer_asm.h"
.type __tsan_pointer_chk_guard, %object
.size __tsan_pointer_chk_guard, 8
__tsan_pointer_chk_guard:
.zero 8
.section .text
// GLIBC mangles the function pointers in jmp_buf (used in {set,long}*jmp
// functions) by XORing them with a random guard pointer. For AArch64 it is a
// global variable rather than a TCB one (as for x86_64/powerpc) and althought
// its value is exported by the loader, it lies within a private GLIBC
// namespace (meaning it should be only used by GLIBC itself and the ABI is
// not stable). So InitializeGuardPtr obtains the pointer guard value by
// issuing a setjmp and checking the resulting pointers values against the
// original ones.
.hidden _Z18InitializeGuardPtrv
.global _Z18InitializeGuardPtrv
.type _Z18InitializeGuardPtrv, @function
_Z18InitializeGuardPtrv:
CFI_STARTPROC
// Allocates a jmp_buf for the setjmp call.
stp x29, x30, [sp, -336]!
CFI_DEF_CFA_OFFSET (336)
CFI_OFFSET (29, -336)
CFI_OFFSET (30, -328)
add x29, sp, 0
CFI_DEF_CFA_REGISTER (29)
add x0, x29, 24
// Call libc setjmp that mangle the stack pointer value
adrp x1, :got:_ZN14__interception12real__setjmpE
ldr x1, [x1, #:got_lo12:_ZN14__interception12real__setjmpE]
ldr x1, [x1]
blr x1
// glibc setjmp mangles both the frame pointer (FP, pc+4 on blr) and the
// stack pointer (SP). FP will be placed on ((uintptr*)jmp_buf)[11] and
// SP at ((uintptr*)jmp_buf)[13].
// The mangle operation is just 'value' xor 'pointer guard value' and
// if we know the original value (SP) and the expected one, we can derive
// the guard pointer value.
mov x0, sp
// Loads the mangled SP pointer.
ldr x1, [x29, 128]
eor x0, x0, x1
adrp x2, __tsan_pointer_chk_guard
str x0, [x2, #:lo12:__tsan_pointer_chk_guard]
ldp x29, x30, [sp], 336
CFI_RESTORE (30)
CFI_RESTORE (19)
CFI_DEF_CFA (31, 0)
ret
CFI_ENDPROC
.size _Z18InitializeGuardPtrv, .-_Z18InitializeGuardPtrv
.hidden __tsan_setjmp
.comm _ZN14__interception11real_setjmpE,8,8
.type setjmp, @function
setjmp:
CFI_STARTPROC
// save env parameters for function call
stp x29, x30, [sp, -32]!
CFI_DEF_CFA_OFFSET (32)
CFI_OFFSET (29, -32)
CFI_OFFSET (30, -24)
// Adjust the SP for previous frame
add x29, sp, 0
CFI_DEF_CFA_REGISTER (29)
// Save jmp_buf
str x19, [sp, 16]
CFI_OFFSET (19, -16)
mov x19, x0
// SP pointer mangling (see glibc setjmp)
adrp x2, __tsan_pointer_chk_guard
ldr x2, [x2, #:lo12:__tsan_pointer_chk_guard]
add x0, x29, 32
eor x1, x2, x0
// call tsan interceptor
bl __tsan_setjmp
// restore env parameter
mov x0, x19
ldr x19, [sp, 16]
ldp x29, x30, [sp], 32
CFI_RESTORE (30)
CFI_RESTORE (19)
CFI_DEF_CFA (31, 0)
// tail jump to libc setjmp
adrp x1, :got:_ZN14__interception11real_setjmpE
ldr x1, [x1, #:got_lo12:_ZN14__interception11real_setjmpE]
ldr x1, [x1]
br x1
CFI_ENDPROC
.size setjmp, .-setjmp
.comm _ZN14__interception12real__setjmpE,8,8
.globl _setjmp
.type _setjmp, @function
_setjmp:
CFI_STARTPROC
// save env parameters for function call
stp x29, x30, [sp, -32]!
CFI_DEF_CFA_OFFSET (32)
CFI_OFFSET (29, -32)
CFI_OFFSET (30, -24)
// Adjust the SP for previous frame
add x29, sp, 0
CFI_DEF_CFA_REGISTER (29)
// Save jmp_buf
str x19, [sp, 16]
CFI_OFFSET (19, -16)
mov x19, x0
// SP pointer mangling (see glibc setjmp)
adrp x2, __tsan_pointer_chk_guard
ldr x2, [x2, #:lo12:__tsan_pointer_chk_guard]
add x0, x29, 32
eor x1, x2, x0
// call tsan interceptor
bl __tsan_setjmp
// Restore jmp_buf parameter
mov x0, x19
ldr x19, [sp, 16]
ldp x29, x30, [sp], 32
CFI_RESTORE (30)
CFI_RESTORE (19)
CFI_DEF_CFA (31, 0)
// tail jump to libc setjmp
adrp x1, :got:_ZN14__interception12real__setjmpE
ldr x1, [x1, #:got_lo12:_ZN14__interception12real__setjmpE]
ldr x1, [x1]
br x1
CFI_ENDPROC
.size _setjmp, .-_setjmp
.comm _ZN14__interception14real_sigsetjmpE,8,8
.globl sigsetjmp
.type sigsetjmp, @function
sigsetjmp:
CFI_STARTPROC
// save env parameters for function call
stp x29, x30, [sp, -32]!
CFI_DEF_CFA_OFFSET (32)
CFI_OFFSET (29, -32)
CFI_OFFSET (30, -24)
// Adjust the SP for previous frame
add x29, sp, 0
CFI_DEF_CFA_REGISTER (29)
// Save jmp_buf and savesigs
stp x19, x20, [sp, 16]
CFI_OFFSET (19, -16)
CFI_OFFSET (20, -8)
mov w20, w1
mov x19, x0
// SP pointer mangling (see glibc setjmp)
adrp x2, __tsan_pointer_chk_guard
ldr x2, [x2, #:lo12:__tsan_pointer_chk_guard]
add x0, x29, 32
eor x1, x2, x0
// call tsan interceptor
bl __tsan_setjmp
// restore env parameter
mov w1, w20
mov x0, x19
ldp x19, x20, [sp, 16]
ldp x29, x30, [sp], 32
CFI_RESTORE (30)
CFI_RESTORE (29)
CFI_RESTORE (19)
CFI_RESTORE (20)
CFI_DEF_CFA (31, 0)
// tail jump to libc sigsetjmp
adrp x2, :got:_ZN14__interception14real_sigsetjmpE
ldr x2, [x2, #:got_lo12:_ZN14__interception14real_sigsetjmpE]
ldr x2, [x2]
br x2
CFI_ENDPROC
.size sigsetjmp, .-sigsetjmp
.comm _ZN14__interception16real___sigsetjmpE,8,8
.globl __sigsetjmp
.type __sigsetjmp, @function
__sigsetjmp:
CFI_STARTPROC
// save env parameters for function call
stp x29, x30, [sp, -32]!
CFI_DEF_CFA_OFFSET (32)
CFI_OFFSET (29, -32)
CFI_OFFSET (30, -24)
// Adjust the SP for previous frame
add x29, sp, 0
CFI_DEF_CFA_REGISTER (29)
// Save jmp_buf and savesigs
stp x19, x20, [sp, 16]
CFI_OFFSET (19, -16)
CFI_OFFSET (20, -8)
mov w20, w1
mov x19, x0
// SP pointer mangling (see glibc setjmp)
adrp x2, __tsan_pointer_chk_guard
ldr x2, [x2, #:lo12:__tsan_pointer_chk_guard]
add x0, x29, 32
eor x1, x2, x0
// call tsan interceptor
bl __tsan_setjmp
mov w1, w20
mov x0, x19
ldp x19, x20, [sp, 16]
ldp x29, x30, [sp], 32
CFI_RESTORE (30)
CFI_RESTORE (29)
CFI_RESTORE (19)
CFI_RESTORE (20)
CFI_DEF_CFA (31, 0)
// tail jump to libc __sigsetjmp
adrp x2, :got:_ZN14__interception16real___sigsetjmpE
ldr x2, [x2, #:got_lo12:_ZN14__interception16real___sigsetjmpE]
ldr x2, [x2]
br x2
CFI_ENDPROC
.size __sigsetjmp, .-__sigsetjmp
#if defined(__linux__)
/* We do not need executable stack. */
.section .note.GNU-stack,"",@progbits
#endif
|
