149 lines · cpp
1//===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8///9/// \file10/// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory11/// region and handles ifunc resolver case, when necessary.12///13//===----------------------------------------------------------------------===//14 15#include "hwasan_dynamic_shadow.h"16 17#include <elf.h>18#include <link.h>19 20#include "hwasan.h"21#include "hwasan_mapping.h"22#include "hwasan_thread_list.h"23#include "sanitizer_common/sanitizer_common.h"24#include "sanitizer_common/sanitizer_posix.h"25 26// The code in this file needs to run in an unrelocated binary. It should not27// access any external symbol, including its own non-hidden globals.28 29#if SANITIZER_ANDROID30extern "C" {31 32INTERFACE_ATTRIBUTE void __hwasan_shadow();33decltype(__hwasan_shadow)* __hwasan_premap_shadow();34 35} // extern "C"36 37namespace __hwasan {38 39// We cannot call anything in libc here (see comment above), so we need to40// assume the biggest allowed page size.41// Android max page size is defined as 16k here:42// https://android.googlesource.com/platform/bionic/+/main/libc/platform/bionic/page.h#4143static constexpr uptr kMaxGranularity = 16384;44 45// Conservative upper limit.46static uptr PremapShadowSize() {47 return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale, kMaxGranularity);48}49 50static uptr PremapShadow() {51 return MapDynamicShadow(PremapShadowSize(), kShadowScale,52 kShadowBaseAlignment, kHighMemEnd, kMaxGranularity);53}54 55static bool IsPremapShadowAvailable() {56 const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow);57 const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow);58 // shadow == resolver is how Android KitKat and older handles ifunc.59 // shadow == 0 just in case.60 return shadow != 0 && shadow != resolver;61}62 63static uptr FindPremappedShadowStart(uptr shadow_size_bytes) {64 const uptr granularity = kMaxGranularity;65 const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow);66 const uptr premap_shadow_size = PremapShadowSize();67 const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity);68 69 // We may have mapped too much. Release extra memory.70 UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size);71 return shadow_start;72}73 74} // namespace __hwasan75 76extern "C" {77 78decltype(__hwasan_shadow)* __hwasan_premap_shadow() {79 // The resolver might be called multiple times. Map the shadow just once.80 static __sanitizer::uptr shadow = 0;81 if (!shadow)82 shadow = __hwasan::PremapShadow();83 return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow);84}85 86// __hwasan_shadow is a "function" that has the same address as the first byte87// of the shadow mapping.88INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow")))89void __hwasan_shadow();90 91extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[],92 __rela_iplt_end[];93 94} // extern "C"95 96namespace __hwasan {97 98void InitShadowGOT() {99 // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This100 // needs to be done before other ifunc resolvers (which are handled by libc)101 // because a resolver might read __hwasan_shadow.102 typedef ElfW(Addr) (*ifunc_resolver_t)(void);103 for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) {104 ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset);105 ElfW(Addr) resolver = r->r_addend;106 if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) {107 *offset = reinterpret_cast<ifunc_resolver_t>(resolver)();108 break;109 }110 }111}112 113uptr FindDynamicShadowStart(uptr shadow_size_bytes) {114 if (IsPremapShadowAvailable())115 return FindPremappedShadowStart(shadow_size_bytes);116 return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,117 kHighMemEnd, kMaxGranularity);118}119 120} // namespace __hwasan121 122#elif SANITIZER_FUCHSIA123 124namespace __hwasan {125 126void InitShadowGOT() {}127 128} // namespace __hwasan129 130#else131namespace __hwasan {132 133void InitShadowGOT() {}134 135uptr FindDynamicShadowStart(uptr shadow_size_bytes) {136# if defined(HWASAN_ALIASING_MODE)137 constexpr uptr kAliasSize = 1ULL << kAddressTagShift;138 constexpr uptr kNumAliases = 1ULL << kTagBits;139 return MapDynamicShadowAndAliases(shadow_size_bytes, kAliasSize, kNumAliases,140 RingBufferSize());141# endif142 return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,143 kHighMemEnd, GetMmapGranularity());144}145 146} // namespace __hwasan147 148#endif // SANITIZER_ANDROID149