1//===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8///
9/// \file
10/// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory
11/// region and handles ifunc resolver case, when necessary.
12///
13//===----------------------------------------------------------------------===//
14
15#include "hwasan.h"
16#include "hwasan_dynamic_shadow.h"
17#include "hwasan_mapping.h"
18#include "sanitizer_common/sanitizer_common.h"
19#include "sanitizer_common/sanitizer_posix.h"
20
21#include <elf.h>
22#include <link.h>
23
24// The code in this file needs to run in an unrelocated binary. It should not
25// access any external symbol, including its own non-hidden globals.
26
27namespace __hwasan {
28
29static void UnmapFromTo(uptr from, uptr to) {
30  if (to == from)
31    return;
32  CHECK(to >= from);
33  uptr res = internal_munmap(reinterpret_cast<void *>(from), to - from);
34  if (UNLIKELY(internal_iserror(res))) {
35    Report("ERROR: %s failed to unmap 0x%zx (%zd) bytes at address %p\n",
36           SanitizerToolName, to - from, to - from, from);
37    CHECK("unable to unmap" && 0);
38  }
39}
40
41// Returns an address aligned to kShadowBaseAlignment, such that
42// 2**kShadowBaseAlingment on the left and shadow_size_bytes bytes on the right
43// of it are mapped no access.
44static uptr MapDynamicShadow(uptr shadow_size_bytes) {
45  const uptr granularity = GetMmapGranularity();
46  const uptr min_alignment = granularity << kShadowScale;
47  const uptr alignment = 1ULL << kShadowBaseAlignment;
48  CHECK_GE(alignment, min_alignment);
49
50  const uptr left_padding = 1ULL << kShadowBaseAlignment;
51  const uptr shadow_size =
52      RoundUpTo(shadow_size_bytes, granularity);
53  const uptr map_size = shadow_size + left_padding + alignment;
54
55  const uptr map_start = (uptr)MmapNoAccess(map_size);
56  CHECK_NE(map_start, ~(uptr)0);
57
58  const uptr shadow_start = RoundUpTo(map_start + left_padding, alignment);
59
60  UnmapFromTo(map_start, shadow_start - left_padding);
61  UnmapFromTo(shadow_start + shadow_size, map_start + map_size);
62
63  return shadow_start;
64}
65
66}  // namespace __hwasan
67
68#if SANITIZER_ANDROID
69extern "C" {
70
71INTERFACE_ATTRIBUTE void __hwasan_shadow();
72decltype(__hwasan_shadow)* __hwasan_premap_shadow();
73
74}  // extern "C"
75
76namespace __hwasan {
77
78// Conservative upper limit.
79static uptr PremapShadowSize() {
80  return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale,
81                   GetMmapGranularity());
82}
83
84static uptr PremapShadow() {
85  return MapDynamicShadow(PremapShadowSize());
86}
87
88static bool IsPremapShadowAvailable() {
89  const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow);
90  const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow);
91  // shadow == resolver is how Android KitKat and older handles ifunc.
92  // shadow == 0 just in case.
93  return shadow != 0 && shadow != resolver;
94}
95
96static uptr FindPremappedShadowStart(uptr shadow_size_bytes) {
97  const uptr granularity = GetMmapGranularity();
98  const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow);
99  const uptr premap_shadow_size = PremapShadowSize();
100  const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity);
101
102  // We may have mapped too much. Release extra memory.
103  UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size);
104  return shadow_start;
105}
106
107}  // namespace __hwasan
108
109extern "C" {
110
111decltype(__hwasan_shadow)* __hwasan_premap_shadow() {
112  // The resolver might be called multiple times. Map the shadow just once.
113  static __sanitizer::uptr shadow = 0;
114  if (!shadow)
115    shadow = __hwasan::PremapShadow();
116  return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow);
117}
118
119// __hwasan_shadow is a "function" that has the same address as the first byte
120// of the shadow mapping.
121INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow")))
122void __hwasan_shadow();
123
124extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[],
125    __rela_iplt_end[];
126
127}  // extern "C"
128
129namespace __hwasan {
130
131void InitShadowGOT() {
132  // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This
133  // needs to be done before other ifunc resolvers (which are handled by libc)
134  // because a resolver might read __hwasan_shadow.
135  typedef ElfW(Addr) (*ifunc_resolver_t)(void);
136  for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) {
137    ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset);
138    ElfW(Addr) resolver = r->r_addend;
139    if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) {
140      *offset = reinterpret_cast<ifunc_resolver_t>(resolver)();
141      break;
142    }
143  }
144}
145
146uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
147  if (IsPremapShadowAvailable())
148    return FindPremappedShadowStart(shadow_size_bytes);
149  return MapDynamicShadow(shadow_size_bytes);
150}
151
152}  // namespace __hwasan
153#else
154namespace __hwasan {
155
156void InitShadowGOT() {}
157
158uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
159  return MapDynamicShadow(shadow_size_bytes);
160}
161
162}  // namespace __hwasan
163
164#endif  // SANITIZER_ANDROID
165