1 //===-- hwasan_dynamic_shadow.cc --------------------------------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 ///
10 /// \file
11 /// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory
12 /// region and handles ifunc resolver case, when necessary.
13 ///
14 //===----------------------------------------------------------------------===//
15
16 #include "hwasan.h"
17 #include "hwasan_dynamic_shadow.h"
18 #include "hwasan_mapping.h"
19 #include "sanitizer_common/sanitizer_common.h"
20 #include "sanitizer_common/sanitizer_posix.h"
21
22 // The code in this file needs to run in an unrelocated binary. It should not
23 // access any external symbol, including its own non-hidden globals.
24
25 namespace __hwasan {
26
UnmapFromTo(uptr from,uptr to)27 static void UnmapFromTo(uptr from, uptr to) {
28 if (to == from)
29 return;
30 CHECK(to >= from);
31 uptr res = internal_munmap(reinterpret_cast<void *>(from), to - from);
32 if (UNLIKELY(internal_iserror(res))) {
33 Report("ERROR: %s failed to unmap 0x%zx (%zd) bytes at address %p\n",
34 SanitizerToolName, to - from, to - from, from);
35 CHECK("unable to unmap" && 0);
36 }
37 }
38
39 // Returns an address aligned to kShadowBaseAlignment, such that
40 // 2**kShadowBaseAlingment on the left and shadow_size_bytes bytes on the right
41 // of it are mapped no access.
MapDynamicShadow(uptr shadow_size_bytes)42 static uptr MapDynamicShadow(uptr shadow_size_bytes) {
43 const uptr granularity = GetMmapGranularity();
44 const uptr min_alignment = granularity << kShadowScale;
45 const uptr alignment = 1ULL << kShadowBaseAlignment;
46 CHECK_GE(alignment, min_alignment);
47
48 const uptr left_padding = 1ULL << kShadowBaseAlignment;
49 const uptr shadow_size =
50 RoundUpTo(shadow_size_bytes, granularity);
51 const uptr map_size = shadow_size + left_padding + alignment;
52
53 const uptr map_start = (uptr)MmapNoAccess(map_size);
54 CHECK_NE(map_start, ~(uptr)0);
55
56 const uptr shadow_start = RoundUpTo(map_start + left_padding, alignment);
57
58 UnmapFromTo(map_start, shadow_start - left_padding);
59 UnmapFromTo(shadow_start + shadow_size, map_start + map_size);
60
61 return shadow_start;
62 }
63
64 } // namespace __hwasan
65
66 #if SANITIZER_ANDROID
67 extern "C" {
68
69 INTERFACE_ATTRIBUTE void __hwasan_shadow();
70 decltype(__hwasan_shadow)* __hwasan_premap_shadow();
71
72 } // extern "C"
73
74 namespace __hwasan {
75
76 // Conservative upper limit.
PremapShadowSize()77 static uptr PremapShadowSize() {
78 return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale,
79 GetMmapGranularity());
80 }
81
PremapShadow()82 static uptr PremapShadow() {
83 return MapDynamicShadow(PremapShadowSize());
84 }
85
IsPremapShadowAvailable()86 static bool IsPremapShadowAvailable() {
87 const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow);
88 const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow);
89 // shadow == resolver is how Android KitKat and older handles ifunc.
90 // shadow == 0 just in case.
91 return shadow != 0 && shadow != resolver;
92 }
93
FindPremappedShadowStart(uptr shadow_size_bytes)94 static uptr FindPremappedShadowStart(uptr shadow_size_bytes) {
95 const uptr granularity = GetMmapGranularity();
96 const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow);
97 const uptr premap_shadow_size = PremapShadowSize();
98 const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity);
99
100 // We may have mapped too much. Release extra memory.
101 UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size);
102 return shadow_start;
103 }
104
105 } // namespace __hwasan
106
107 extern "C" {
108
__hwasan_premap_shadow()109 decltype(__hwasan_shadow)* __hwasan_premap_shadow() {
110 // The resolver might be called multiple times. Map the shadow just once.
111 static __sanitizer::uptr shadow = 0;
112 if (!shadow)
113 shadow = __hwasan::PremapShadow();
114 return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow);
115 }
116
117 // __hwasan_shadow is a "function" that has the same address as the first byte
118 // of the shadow mapping.
119 INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow")))
120 void __hwasan_shadow();
121
122 } // extern "C"
123
124 namespace __hwasan {
125
FindDynamicShadowStart(uptr shadow_size_bytes)126 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
127 if (IsPremapShadowAvailable())
128 return FindPremappedShadowStart(shadow_size_bytes);
129 return MapDynamicShadow(shadow_size_bytes);
130 }
131
132 } // namespace __hwasan
133 #else
134 namespace __hwasan {
135
FindDynamicShadowStart(uptr shadow_size_bytes)136 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
137 return MapDynamicShadow(shadow_size_bytes);
138 }
139
140 } // namespace __hwasan
141 #
142 #endif // SANITIZER_ANDROID
143