1 //===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 /// 9 /// \file 10 /// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory 11 /// region and handles ifunc resolver case, when necessary. 12 /// 13 //===----------------------------------------------------------------------===// 14 15 #include "hwasan_dynamic_shadow.h" 16 17 #include <elf.h> 18 #include <link.h> 19 20 #include "hwasan.h" 21 #include "hwasan_mapping.h" 22 #include "hwasan_thread_list.h" 23 #include "sanitizer_common/sanitizer_common.h" 24 #include "sanitizer_common/sanitizer_posix.h" 25 26 // The code in this file needs to run in an unrelocated binary. It should not 27 // access any external symbol, including its own non-hidden globals. 28 29 #if SANITIZER_ANDROID 30 extern "C" { 31 32 INTERFACE_ATTRIBUTE void __hwasan_shadow(); 33 decltype(__hwasan_shadow)* __hwasan_premap_shadow(); 34 35 } // extern "C" 36 37 namespace __hwasan { 38 39 // We cannot call anything in libc here (see comment above), so we need to 40 // assume the biggest allowed page size. 41 // Android max page size is defined as 16k here: 42 // https://android.googlesource.com/platform/bionic/+/main/libc/platform/bionic/page.h#41 43 static constexpr uptr kMaxGranularity = 16384; 44 45 // Conservative upper limit. 46 static uptr PremapShadowSize() { 47 return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale, kMaxGranularity); 48 } 49 50 static uptr PremapShadow() { 51 return MapDynamicShadow(PremapShadowSize(), kShadowScale, 52 kShadowBaseAlignment, kHighMemEnd, kMaxGranularity); 53 } 54 55 static bool IsPremapShadowAvailable() { 56 const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow); 57 const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow); 58 // shadow == resolver is how Android KitKat and older handles ifunc. 59 // shadow == 0 just in case. 60 return shadow != 0 && shadow != resolver; 61 } 62 63 static uptr FindPremappedShadowStart(uptr shadow_size_bytes) { 64 const uptr granularity = kMaxGranularity; 65 const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow); 66 const uptr premap_shadow_size = PremapShadowSize(); 67 const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity); 68 69 // We may have mapped too much. Release extra memory. 70 UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size); 71 return shadow_start; 72 } 73 74 } // namespace __hwasan 75 76 extern "C" { 77 78 decltype(__hwasan_shadow)* __hwasan_premap_shadow() { 79 // The resolver might be called multiple times. Map the shadow just once. 80 static __sanitizer::uptr shadow = 0; 81 if (!shadow) 82 shadow = __hwasan::PremapShadow(); 83 return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow); 84 } 85 86 // __hwasan_shadow is a "function" that has the same address as the first byte 87 // of the shadow mapping. 88 INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow"))) 89 void __hwasan_shadow(); 90 91 extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[], 92 __rela_iplt_end[]; 93 94 } // extern "C" 95 96 namespace __hwasan { 97 98 void InitShadowGOT() { 99 // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This 100 // needs to be done before other ifunc resolvers (which are handled by libc) 101 // because a resolver might read __hwasan_shadow. 102 typedef ElfW(Addr) (*ifunc_resolver_t)(void); 103 for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) { 104 ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset); 105 ElfW(Addr) resolver = r->r_addend; 106 if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) { 107 *offset = reinterpret_cast<ifunc_resolver_t>(resolver)(); 108 break; 109 } 110 } 111 } 112 113 uptr FindDynamicShadowStart(uptr shadow_size_bytes) { 114 if (IsPremapShadowAvailable()) 115 return FindPremappedShadowStart(shadow_size_bytes); 116 return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment, 117 kHighMemEnd, kMaxGranularity); 118 } 119 120 } // namespace __hwasan 121 122 #elif SANITIZER_FUCHSIA 123 124 namespace __hwasan { 125 126 void InitShadowGOT() {} 127 128 } // namespace __hwasan 129 130 #else 131 namespace __hwasan { 132 133 void InitShadowGOT() {} 134 135 uptr FindDynamicShadowStart(uptr shadow_size_bytes) { 136 # if defined(HWASAN_ALIASING_MODE) 137 constexpr uptr kAliasSize = 1ULL << kAddressTagShift; 138 constexpr uptr kNumAliases = 1ULL << kTagBits; 139 return MapDynamicShadowAndAliases(shadow_size_bytes, kAliasSize, kNumAliases, 140 RingBufferSize()); 141 # endif 142 return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment, 143 kHighMemEnd, GetMmapGranularity()); 144 } 145 146 } // namespace __hwasan 147 148 #endif // SANITIZER_ANDROID 149