1 //===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 ///
9 /// \file
10 /// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory
11 /// region and handles ifunc resolver case, when necessary.
12 ///
13 //===----------------------------------------------------------------------===//
14
15 #include "hwasan_dynamic_shadow.h"
16
17 #include <elf.h>
18 #include <link.h>
19
20 #include "hwasan.h"
21 #include "hwasan_mapping.h"
22 #include "hwasan_thread_list.h"
23 #include "sanitizer_common/sanitizer_common.h"
24 #include "sanitizer_common/sanitizer_posix.h"
25
26 // The code in this file needs to run in an unrelocated binary. It should not
27 // access any external symbol, including its own non-hidden globals.
28
29 #if SANITIZER_ANDROID
30 extern "C" {
31
32 INTERFACE_ATTRIBUTE void __hwasan_shadow();
33 decltype(__hwasan_shadow)* __hwasan_premap_shadow();
34
35 } // extern "C"
36
37 namespace __hwasan {
38
39 // We cannot call anything in libc here (see comment above), so we need to
40 // assume the biggest allowed page size.
41 // Android max page size is defined as 16k here:
42 // https://android.googlesource.com/platform/bionic/+/main/libc/platform/bionic/page.h#41
43 static constexpr uptr kMaxGranularity = 16384;
44
45 // Conservative upper limit.
PremapShadowSize()46 static uptr PremapShadowSize() {
47 return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale, kMaxGranularity);
48 }
49
PremapShadow()50 static uptr PremapShadow() {
51 return MapDynamicShadow(PremapShadowSize(), kShadowScale,
52 kShadowBaseAlignment, kHighMemEnd, kMaxGranularity);
53 }
54
IsPremapShadowAvailable()55 static bool IsPremapShadowAvailable() {
56 const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow);
57 const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow);
58 // shadow == resolver is how Android KitKat and older handles ifunc.
59 // shadow == 0 just in case.
60 return shadow != 0 && shadow != resolver;
61 }
62
FindPremappedShadowStart(uptr shadow_size_bytes)63 static uptr FindPremappedShadowStart(uptr shadow_size_bytes) {
64 const uptr granularity = kMaxGranularity;
65 const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow);
66 const uptr premap_shadow_size = PremapShadowSize();
67 const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity);
68
69 // We may have mapped too much. Release extra memory.
70 UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size);
71 return shadow_start;
72 }
73
74 } // namespace __hwasan
75
76 extern "C" {
77
__hwasan_premap_shadow()78 decltype(__hwasan_shadow)* __hwasan_premap_shadow() {
79 // The resolver might be called multiple times. Map the shadow just once.
80 static __sanitizer::uptr shadow = 0;
81 if (!shadow)
82 shadow = __hwasan::PremapShadow();
83 return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow);
84 }
85
86 // __hwasan_shadow is a "function" that has the same address as the first byte
87 // of the shadow mapping.
88 INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow")))
89 void __hwasan_shadow();
90
91 extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[],
92 __rela_iplt_end[];
93
94 } // extern "C"
95
96 namespace __hwasan {
97
InitShadowGOT()98 void InitShadowGOT() {
99 // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This
100 // needs to be done before other ifunc resolvers (which are handled by libc)
101 // because a resolver might read __hwasan_shadow.
102 typedef ElfW(Addr) (*ifunc_resolver_t)(void);
103 for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) {
104 ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset);
105 ElfW(Addr) resolver = r->r_addend;
106 if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) {
107 *offset = reinterpret_cast<ifunc_resolver_t>(resolver)();
108 break;
109 }
110 }
111 }
112
FindDynamicShadowStart(uptr shadow_size_bytes)113 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
114 if (IsPremapShadowAvailable())
115 return FindPremappedShadowStart(shadow_size_bytes);
116 return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,
117 kHighMemEnd, kMaxGranularity);
118 }
119
120 } // namespace __hwasan
121
122 #elif SANITIZER_FUCHSIA
123
124 namespace __hwasan {
125
InitShadowGOT()126 void InitShadowGOT() {}
127
128 } // namespace __hwasan
129
130 #else
131 namespace __hwasan {
132
InitShadowGOT()133 void InitShadowGOT() {}
134
FindDynamicShadowStart(uptr shadow_size_bytes)135 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
136 # if defined(HWASAN_ALIASING_MODE)
137 constexpr uptr kAliasSize = 1ULL << kAddressTagShift;
138 constexpr uptr kNumAliases = 1ULL << kTagBits;
139 return MapDynamicShadowAndAliases(shadow_size_bytes, kAliasSize, kNumAliases,
140 RingBufferSize());
141 # endif
142 return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,
143 kHighMemEnd, GetMmapGranularity());
144 }
145
146 } // namespace __hwasan
147
148 #endif // SANITIZER_ANDROID
149