1 //===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 ///
9 /// \file
10 /// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory
11 /// region and handles ifunc resolver case, when necessary.
12 ///
13 //===----------------------------------------------------------------------===//
14 
15 #include "hwasan_dynamic_shadow.h"
16 
17 #include <elf.h>
18 #include <link.h>
19 
20 #include "hwasan.h"
21 #include "hwasan_mapping.h"
22 #include "hwasan_thread_list.h"
23 #include "sanitizer_common/sanitizer_common.h"
24 #include "sanitizer_common/sanitizer_posix.h"
25 
26 // The code in this file needs to run in an unrelocated binary. It should not
27 // access any external symbol, including its own non-hidden globals.
28 
29 #if SANITIZER_ANDROID
30 extern "C" {
31 
32 INTERFACE_ATTRIBUTE void __hwasan_shadow();
33 decltype(__hwasan_shadow)* __hwasan_premap_shadow();
34 
35 }  // extern "C"
36 
37 namespace __hwasan {
38 
39 // Conservative upper limit.
40 static uptr PremapShadowSize() {
41   return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale,
42                    GetMmapGranularity());
43 }
44 
45 static uptr PremapShadow() {
46   return MapDynamicShadow(PremapShadowSize(), kShadowScale,
47                           kShadowBaseAlignment, kHighMemEnd);
48 }
49 
50 static bool IsPremapShadowAvailable() {
51   const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow);
52   const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow);
53   // shadow == resolver is how Android KitKat and older handles ifunc.
54   // shadow == 0 just in case.
55   return shadow != 0 && shadow != resolver;
56 }
57 
58 static uptr FindPremappedShadowStart(uptr shadow_size_bytes) {
59   const uptr granularity = GetMmapGranularity();
60   const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow);
61   const uptr premap_shadow_size = PremapShadowSize();
62   const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity);
63 
64   // We may have mapped too much. Release extra memory.
65   UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size);
66   return shadow_start;
67 }
68 
69 }  // namespace __hwasan
70 
71 extern "C" {
72 
73 decltype(__hwasan_shadow)* __hwasan_premap_shadow() {
74   // The resolver might be called multiple times. Map the shadow just once.
75   static __sanitizer::uptr shadow = 0;
76   if (!shadow)
77     shadow = __hwasan::PremapShadow();
78   return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow);
79 }
80 
81 // __hwasan_shadow is a "function" that has the same address as the first byte
82 // of the shadow mapping.
83 INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow")))
84 void __hwasan_shadow();
85 
86 extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[],
87     __rela_iplt_end[];
88 
89 }  // extern "C"
90 
91 namespace __hwasan {
92 
93 void InitShadowGOT() {
94   // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This
95   // needs to be done before other ifunc resolvers (which are handled by libc)
96   // because a resolver might read __hwasan_shadow.
97   typedef ElfW(Addr) (*ifunc_resolver_t)(void);
98   for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) {
99     ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset);
100     ElfW(Addr) resolver = r->r_addend;
101     if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) {
102       *offset = reinterpret_cast<ifunc_resolver_t>(resolver)();
103       break;
104     }
105   }
106 }
107 
108 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
109   if (IsPremapShadowAvailable())
110     return FindPremappedShadowStart(shadow_size_bytes);
111   return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,
112                           kHighMemEnd);
113 }
114 
115 }  // namespace __hwasan
116 
117 #elif SANITIZER_FUCHSIA
118 
119 namespace __hwasan {
120 
121 void InitShadowGOT() {}
122 
123 }  // namespace __hwasan
124 
125 #else
126 namespace __hwasan {
127 
128 void InitShadowGOT() {}
129 
130 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
131 #  if defined(HWASAN_ALIASING_MODE)
132   constexpr uptr kAliasSize = 1ULL << kAddressTagShift;
133   constexpr uptr kNumAliases = 1ULL << kTagBits;
134   return MapDynamicShadowAndAliases(shadow_size_bytes, kAliasSize, kNumAliases,
135                                     RingBufferSize());
136 #  endif
137   return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,
138                           kHighMemEnd);
139 }
140 
141 }  // namespace __hwasan
142 
143 #endif  // SANITIZER_ANDROID
144