xref: /freebsd/contrib/llvm-project/compiler-rt/lib/asan/asan_mapping.h (revision 924226fba12cc9a228c73b956e1b7fa24c60b055)
1 //===-- asan_mapping.h ------------------------------------------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file is a part of AddressSanitizer, an address sanity checker.
10 //
11 // Defines ASan memory mapping.
12 //===----------------------------------------------------------------------===//
13 #ifndef ASAN_MAPPING_H
14 #define ASAN_MAPPING_H
15 
16 #include "sanitizer_common/sanitizer_platform.h"
17 
18 // The full explanation of the memory mapping could be found here:
19 // https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm
20 //
21 // Typical shadow mapping on Linux/x86_64 with SHADOW_OFFSET == 0x00007fff8000:
22 // || `[0x10007fff8000, 0x7fffffffffff]` || HighMem    ||
23 // || `[0x02008fff7000, 0x10007fff7fff]` || HighShadow ||
24 // || `[0x00008fff7000, 0x02008fff6fff]` || ShadowGap  ||
25 // || `[0x00007fff8000, 0x00008fff6fff]` || LowShadow  ||
26 // || `[0x000000000000, 0x00007fff7fff]` || LowMem     ||
27 //
28 // When SHADOW_OFFSET is zero (-pie):
29 // || `[0x100000000000, 0x7fffffffffff]` || HighMem    ||
30 // || `[0x020000000000, 0x0fffffffffff]` || HighShadow ||
31 // || `[0x000000040000, 0x01ffffffffff]` || ShadowGap  ||
32 //
33 // Special case when something is already mapped between
34 // 0x003000000000 and 0x005000000000 (e.g. when prelink is installed):
35 // || `[0x10007fff8000, 0x7fffffffffff]` || HighMem    ||
36 // || `[0x02008fff7000, 0x10007fff7fff]` || HighShadow ||
37 // || `[0x005000000000, 0x02008fff6fff]` || ShadowGap3 ||
38 // || `[0x003000000000, 0x004fffffffff]` || MidMem     ||
39 // || `[0x000a7fff8000, 0x002fffffffff]` || ShadowGap2 ||
40 // || `[0x00067fff8000, 0x000a7fff7fff]` || MidShadow  ||
41 // || `[0x00008fff7000, 0x00067fff7fff]` || ShadowGap  ||
42 // || `[0x00007fff8000, 0x00008fff6fff]` || LowShadow  ||
43 // || `[0x000000000000, 0x00007fff7fff]` || LowMem     ||
44 //
45 // Default Linux/i386 mapping on x86_64 machine:
46 // || `[0x40000000, 0xffffffff]` || HighMem    ||
47 // || `[0x28000000, 0x3fffffff]` || HighShadow ||
48 // || `[0x24000000, 0x27ffffff]` || ShadowGap  ||
49 // || `[0x20000000, 0x23ffffff]` || LowShadow  ||
50 // || `[0x00000000, 0x1fffffff]` || LowMem     ||
51 //
52 // Default Linux/i386 mapping on i386 machine
53 // (addresses starting with 0xc0000000 are reserved
54 // for kernel and thus not sanitized):
55 // || `[0x38000000, 0xbfffffff]` || HighMem    ||
56 // || `[0x27000000, 0x37ffffff]` || HighShadow ||
57 // || `[0x24000000, 0x26ffffff]` || ShadowGap  ||
58 // || `[0x20000000, 0x23ffffff]` || LowShadow  ||
59 // || `[0x00000000, 0x1fffffff]` || LowMem     ||
60 //
61 // Default Linux/MIPS32 mapping:
62 // || `[0x2aaa0000, 0xffffffff]` || HighMem    ||
63 // || `[0x0fff4000, 0x2aa9ffff]` || HighShadow ||
64 // || `[0x0bff4000, 0x0fff3fff]` || ShadowGap  ||
65 // || `[0x0aaa0000, 0x0bff3fff]` || LowShadow  ||
66 // || `[0x00000000, 0x0aa9ffff]` || LowMem     ||
67 //
68 // Default Linux/MIPS64 mapping:
69 // || `[0x4000000000, 0xffffffffff]` || HighMem    ||
70 // || `[0x2800000000, 0x3fffffffff]` || HighShadow ||
71 // || `[0x2400000000, 0x27ffffffff]` || ShadowGap  ||
72 // || `[0x2000000000, 0x23ffffffff]` || LowShadow  ||
73 // || `[0x0000000000, 0x1fffffffff]` || LowMem     ||
74 //
75 // Default Linux/RISCV64 Sv39 mapping:
76 // || `[0x1555550000, 0x3fffffffff]` || HighMem    ||
77 // || `[0x0fffffa000, 0x1555555fff]` || HighShadow ||
78 // || `[0x0effffa000, 0x0fffff9fff]` || ShadowGap  ||
79 // || `[0x0d55550000, 0x0effff9fff]` || LowShadow  ||
80 // || `[0x0000000000, 0x0d5554ffff]` || LowMem     ||
81 //
82 // Default Linux/AArch64 (39-bit VMA) mapping:
83 // || `[0x2000000000, 0x7fffffffff]` || highmem    ||
84 // || `[0x1400000000, 0x1fffffffff]` || highshadow ||
85 // || `[0x1200000000, 0x13ffffffff]` || shadowgap  ||
86 // || `[0x1000000000, 0x11ffffffff]` || lowshadow  ||
87 // || `[0x0000000000, 0x0fffffffff]` || lowmem     ||
88 //
89 // Default Linux/AArch64 (42-bit VMA) mapping:
90 // || `[0x10000000000, 0x3ffffffffff]` || highmem    ||
91 // || `[0x0a000000000, 0x0ffffffffff]` || highshadow ||
92 // || `[0x09000000000, 0x09fffffffff]` || shadowgap  ||
93 // || `[0x08000000000, 0x08fffffffff]` || lowshadow  ||
94 // || `[0x00000000000, 0x07fffffffff]` || lowmem     ||
95 //
96 // Default Linux/S390 mapping:
97 // || `[0x30000000, 0x7fffffff]` || HighMem    ||
98 // || `[0x26000000, 0x2fffffff]` || HighShadow ||
99 // || `[0x24000000, 0x25ffffff]` || ShadowGap  ||
100 // || `[0x20000000, 0x23ffffff]` || LowShadow  ||
101 // || `[0x00000000, 0x1fffffff]` || LowMem     ||
102 //
103 // Default Linux/SystemZ mapping:
104 // || `[0x14000000000000, 0x1fffffffffffff]` || HighMem    ||
105 // || `[0x12800000000000, 0x13ffffffffffff]` || HighShadow ||
106 // || `[0x12000000000000, 0x127fffffffffff]` || ShadowGap  ||
107 // || `[0x10000000000000, 0x11ffffffffffff]` || LowShadow  ||
108 // || `[0x00000000000000, 0x0fffffffffffff]` || LowMem     ||
109 //
110 // Default Linux/SPARC64 (52-bit VMA) mapping:
111 // || `[0x8000000000000, 0xfffffffffffff]` || HighMem    ||
112 // || `[0x1080000000000, 0x207ffffffffff]` || HighShadow ||
113 // || `[0x0090000000000, 0x107ffffffffff]` || ShadowGap  ||
114 // || `[0x0080000000000, 0x008ffffffffff]` || LowShadow  ||
115 // || `[0x0000000000000, 0x007ffffffffff]` || LowMem     ||
116 //
117 // Shadow mapping on FreeBSD/x86-64 with SHADOW_OFFSET == 0x400000000000:
118 // || `[0x500000000000, 0x7fffffffffff]` || HighMem    ||
119 // || `[0x4a0000000000, 0x4fffffffffff]` || HighShadow ||
120 // || `[0x480000000000, 0x49ffffffffff]` || ShadowGap  ||
121 // || `[0x400000000000, 0x47ffffffffff]` || LowShadow  ||
122 // || `[0x000000000000, 0x3fffffffffff]` || LowMem     ||
123 //
124 // Shadow mapping on FreeBSD/i386 with SHADOW_OFFSET == 0x40000000:
125 // || `[0x60000000, 0xffffffff]` || HighMem    ||
126 // || `[0x4c000000, 0x5fffffff]` || HighShadow ||
127 // || `[0x48000000, 0x4bffffff]` || ShadowGap  ||
128 // || `[0x40000000, 0x47ffffff]` || LowShadow  ||
129 // || `[0x00000000, 0x3fffffff]` || LowMem     ||
130 //
131 // Shadow mapping on NetBSD/x86-64 with SHADOW_OFFSET == 0x400000000000:
132 // || `[0x4feffffffe01, 0x7f7ffffff000]` || HighMem    ||
133 // || `[0x49fdffffffc0, 0x4feffffffe00]` || HighShadow ||
134 // || `[0x480000000000, 0x49fdffffffbf]` || ShadowGap  ||
135 // || `[0x400000000000, 0x47ffffffffff]` || LowShadow  ||
136 // || `[0x000000000000, 0x3fffffffffff]` || LowMem     ||
137 //
138 // Shadow mapping on NetBSD/i386 with SHADOW_OFFSET == 0x40000000:
139 // || `[0x60000000, 0xfffff000]` || HighMem    ||
140 // || `[0x4c000000, 0x5fffffff]` || HighShadow ||
141 // || `[0x48000000, 0x4bffffff]` || ShadowGap  ||
142 // || `[0x40000000, 0x47ffffff]` || LowShadow  ||
143 // || `[0x00000000, 0x3fffffff]` || LowMem     ||
144 //
145 // Default Windows/i386 mapping:
146 // (the exact location of HighShadow/HighMem may vary depending
147 //  on WoW64, /LARGEADDRESSAWARE, etc).
148 // || `[0x50000000, 0xffffffff]` || HighMem    ||
149 // || `[0x3a000000, 0x4fffffff]` || HighShadow ||
150 // || `[0x36000000, 0x39ffffff]` || ShadowGap  ||
151 // || `[0x30000000, 0x35ffffff]` || LowShadow  ||
152 // || `[0x00000000, 0x2fffffff]` || LowMem     ||
153 
154 #define ASAN_SHADOW_SCALE 3
155 
156 #if SANITIZER_FUCHSIA
157 #  define ASAN_SHADOW_OFFSET_CONST (0)
158 #elif SANITIZER_WORDSIZE == 32
159 #  if SANITIZER_ANDROID
160 #    define ASAN_SHADOW_OFFSET_DYNAMIC
161 #  elif defined(__mips__)
162 #    define ASAN_SHADOW_OFFSET_CONST 0x0aaa0000
163 #  elif SANITIZER_FREEBSD
164 #    define ASAN_SHADOW_OFFSET_CONST 0x40000000
165 #  elif SANITIZER_NETBSD
166 #    define ASAN_SHADOW_OFFSET_CONST 0x40000000
167 #  elif SANITIZER_WINDOWS
168 #    define ASAN_SHADOW_OFFSET_CONST 0x30000000
169 #  elif SANITIZER_IOS
170 #    define ASAN_SHADOW_OFFSET_DYNAMIC
171 #  else
172 #    define ASAN_SHADOW_OFFSET_CONST 0x20000000
173 #  endif
174 #else
175 #  if SANITIZER_IOS
176 #    define ASAN_SHADOW_OFFSET_DYNAMIC
177 #  elif SANITIZER_MAC && defined(__aarch64__)
178 #    define ASAN_SHADOW_OFFSET_DYNAMIC
179 #  elif SANITIZER_RISCV64
180 #    define ASAN_SHADOW_OFFSET_CONST 0x0000000d55550000
181 #  elif defined(__aarch64__)
182 #    define ASAN_SHADOW_OFFSET_CONST 0x0000001000000000
183 #  elif defined(__powerpc64__)
184 #    define ASAN_SHADOW_OFFSET_CONST 0x0000100000000000
185 #  elif defined(__s390x__)
186 #    define ASAN_SHADOW_OFFSET_CONST 0x0010000000000000
187 #  elif SANITIZER_FREEBSD
188 #    define ASAN_SHADOW_OFFSET_CONST 0x0000400000000000
189 #  elif SANITIZER_NETBSD
190 #    define ASAN_SHADOW_OFFSET_CONST 0x0000400000000000
191 #  elif SANITIZER_MAC
192 #    define ASAN_SHADOW_OFFSET_CONST 0x0000100000000000
193 #  elif defined(__mips64)
194 #    define ASAN_SHADOW_OFFSET_CONST 0x0000002000000000
195 #  elif defined(__sparc__)
196 #    define ASAN_SHADOW_OFFSET_CONST 0x0000080000000000
197 #  elif SANITIZER_WINDOWS64
198 #    define ASAN_SHADOW_OFFSET_DYNAMIC
199 #  else
200 #    if ASAN_SHADOW_SCALE != 3
201 #      error "Value below is based on shadow scale = 3."
202 #      error "Original formula was: 0x7FFFFFFF & (~0xFFFULL << SHADOW_SCALE)."
203 #    endif
204 #    define ASAN_SHADOW_OFFSET_CONST 0x000000007fff8000
205 #  endif
206 #endif
207 
208 #if defined(__cplusplus)
209 #  include "asan_internal.h"
210 
211 static const u64 kDefaultShadowSentinel = ~(uptr)0;
212 
213 #  if defined(ASAN_SHADOW_OFFSET_CONST)
214 static const u64 kConstShadowOffset = ASAN_SHADOW_OFFSET_CONST;
215 #    define ASAN_SHADOW_OFFSET kConstShadowOffset
216 #  elif defined(ASAN_SHADOW_OFFSET_DYNAMIC)
217 #    define ASAN_SHADOW_OFFSET __asan_shadow_memory_dynamic_address
218 #  else
219 #    error "ASAN_SHADOW_OFFSET can't be determined."
220 #  endif
221 
222 #  if SANITIZER_ANDROID && defined(__arm__)
223 #    define ASAN_PREMAP_SHADOW 1
224 #  else
225 #    define ASAN_PREMAP_SHADOW 0
226 #  endif
227 
228 #  define ASAN_SHADOW_GRANULARITY (1ULL << ASAN_SHADOW_SCALE)
229 
230 #  define DO_ASAN_MAPPING_PROFILE 0  // Set to 1 to profile the functions below.
231 
232 #  if DO_ASAN_MAPPING_PROFILE
233 #    define PROFILE_ASAN_MAPPING() AsanMappingProfile[__LINE__]++;
234 #  else
235 #    define PROFILE_ASAN_MAPPING()
236 #  endif
237 
238 // If 1, all shadow boundaries are constants.
239 // Don't set to 1 other than for testing.
240 #  define ASAN_FIXED_MAPPING 0
241 
242 namespace __asan {
243 
244 extern uptr AsanMappingProfile[];
245 
246 #  if ASAN_FIXED_MAPPING
247 // Fixed mapping for 64-bit Linux. Mostly used for performance comparison
248 // with non-fixed mapping. As of r175253 (Feb 2013) the performance
249 // difference between fixed and non-fixed mapping is below the noise level.
250 static uptr kHighMemEnd = 0x7fffffffffffULL;
251 static uptr kMidMemBeg = 0x3000000000ULL;
252 static uptr kMidMemEnd = 0x4fffffffffULL;
253 #  else
254 extern uptr kHighMemEnd, kMidMemBeg, kMidMemEnd;  // Initialized in __asan_init.
255 #  endif
256 
257 }  // namespace __asan
258 
259 #  if defined(__sparc__) && SANITIZER_WORDSIZE == 64
260 #    include "asan_mapping_sparc64.h"
261 #  else
262 #    define MEM_TO_SHADOW(mem) \
263       (((mem) >> ASAN_SHADOW_SCALE) + (ASAN_SHADOW_OFFSET))
264 
265 #    define kLowMemBeg 0
266 #    define kLowMemEnd (ASAN_SHADOW_OFFSET ? ASAN_SHADOW_OFFSET - 1 : 0)
267 
268 #    define kLowShadowBeg ASAN_SHADOW_OFFSET
269 #    define kLowShadowEnd MEM_TO_SHADOW(kLowMemEnd)
270 
271 #    define kHighMemBeg (MEM_TO_SHADOW(kHighMemEnd) + 1)
272 
273 #    define kHighShadowBeg MEM_TO_SHADOW(kHighMemBeg)
274 #    define kHighShadowEnd MEM_TO_SHADOW(kHighMemEnd)
275 
276 #    define kMidShadowBeg MEM_TO_SHADOW(kMidMemBeg)
277 #    define kMidShadowEnd MEM_TO_SHADOW(kMidMemEnd)
278 
279 // With the zero shadow base we can not actually map pages starting from 0.
280 // This constant is somewhat arbitrary.
281 #    define kZeroBaseShadowStart 0
282 #    define kZeroBaseMaxShadowStart (1 << 18)
283 
284 #    define kShadowGapBeg \
285       (kLowShadowEnd ? kLowShadowEnd + 1 : kZeroBaseShadowStart)
286 #    define kShadowGapEnd ((kMidMemBeg ? kMidShadowBeg : kHighShadowBeg) - 1)
287 
288 #    define kShadowGap2Beg (kMidMemBeg ? kMidShadowEnd + 1 : 0)
289 #    define kShadowGap2End (kMidMemBeg ? kMidMemBeg - 1 : 0)
290 
291 #    define kShadowGap3Beg (kMidMemBeg ? kMidMemEnd + 1 : 0)
292 #    define kShadowGap3End (kMidMemBeg ? kHighShadowBeg - 1 : 0)
293 
294 namespace __asan {
295 
296 static inline bool AddrIsInLowMem(uptr a) {
297   PROFILE_ASAN_MAPPING();
298   return a <= kLowMemEnd;
299 }
300 
301 static inline bool AddrIsInLowShadow(uptr a) {
302   PROFILE_ASAN_MAPPING();
303   return a >= kLowShadowBeg && a <= kLowShadowEnd;
304 }
305 
306 static inline bool AddrIsInMidMem(uptr a) {
307   PROFILE_ASAN_MAPPING();
308   return kMidMemBeg && a >= kMidMemBeg && a <= kMidMemEnd;
309 }
310 
311 static inline bool AddrIsInMidShadow(uptr a) {
312   PROFILE_ASAN_MAPPING();
313   return kMidMemBeg && a >= kMidShadowBeg && a <= kMidShadowEnd;
314 }
315 
316 static inline bool AddrIsInHighMem(uptr a) {
317   PROFILE_ASAN_MAPPING();
318   return kHighMemBeg && a >= kHighMemBeg && a <= kHighMemEnd;
319 }
320 
321 static inline bool AddrIsInHighShadow(uptr a) {
322   PROFILE_ASAN_MAPPING();
323   return kHighMemBeg && a >= kHighShadowBeg && a <= kHighShadowEnd;
324 }
325 
326 static inline bool AddrIsInShadowGap(uptr a) {
327   PROFILE_ASAN_MAPPING();
328   if (kMidMemBeg) {
329     if (a <= kShadowGapEnd)
330       return ASAN_SHADOW_OFFSET == 0 || a >= kShadowGapBeg;
331     return (a >= kShadowGap2Beg && a <= kShadowGap2End) ||
332            (a >= kShadowGap3Beg && a <= kShadowGap3End);
333   }
334   // In zero-based shadow mode we treat addresses near zero as addresses
335   // in shadow gap as well.
336   if (ASAN_SHADOW_OFFSET == 0)
337     return a <= kShadowGapEnd;
338   return a >= kShadowGapBeg && a <= kShadowGapEnd;
339 }
340 
341 }  // namespace __asan
342 
343 #  endif
344 
345 namespace __asan {
346 
347 static inline uptr MemToShadowSize(uptr size) {
348   return size >> ASAN_SHADOW_SCALE;
349 }
350 
351 static inline bool AddrIsInMem(uptr a) {
352   PROFILE_ASAN_MAPPING();
353   return AddrIsInLowMem(a) || AddrIsInMidMem(a) || AddrIsInHighMem(a) ||
354          (flags()->protect_shadow_gap == 0 && AddrIsInShadowGap(a));
355 }
356 
357 static inline uptr MemToShadow(uptr p) {
358   PROFILE_ASAN_MAPPING();
359   CHECK(AddrIsInMem(p));
360   return MEM_TO_SHADOW(p);
361 }
362 
363 static inline bool AddrIsInShadow(uptr a) {
364   PROFILE_ASAN_MAPPING();
365   return AddrIsInLowShadow(a) || AddrIsInMidShadow(a) || AddrIsInHighShadow(a);
366 }
367 
368 static inline bool AddrIsAlignedByGranularity(uptr a) {
369   PROFILE_ASAN_MAPPING();
370   return (a & (ASAN_SHADOW_GRANULARITY - 1)) == 0;
371 }
372 
373 static inline bool AddressIsPoisoned(uptr a) {
374   PROFILE_ASAN_MAPPING();
375   const uptr kAccessSize = 1;
376   u8 *shadow_address = (u8 *)MEM_TO_SHADOW(a);
377   s8 shadow_value = *shadow_address;
378   if (shadow_value) {
379     u8 last_accessed_byte =
380         (a & (ASAN_SHADOW_GRANULARITY - 1)) + kAccessSize - 1;
381     return (last_accessed_byte >= shadow_value);
382   }
383   return false;
384 }
385 
386 // Must be after all calls to PROFILE_ASAN_MAPPING().
387 static const uptr kAsanMappingProfileSize = __LINE__;
388 
389 }  // namespace __asan
390 
391 #endif  // __cplusplus
392 
393 #endif  // ASAN_MAPPING_H
394