1//===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8///
9/// \file
10/// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory
11/// region and handles ifunc resolver case, when necessary.
12///
13//===----------------------------------------------------------------------===//
14
15#include "hwasan_dynamic_shadow.h"
16
17#include <elf.h>
18#include <link.h>
19
20#include "hwasan.h"
21#include "hwasan_mapping.h"
22#include "hwasan_thread_list.h"
23#include "sanitizer_common/sanitizer_common.h"
24#include "sanitizer_common/sanitizer_posix.h"
25
26// The code in this file needs to run in an unrelocated binary. It should not
27// access any external symbol, including its own non-hidden globals.
28
29#if SANITIZER_ANDROID
30extern "C" {
31
32INTERFACE_ATTRIBUTE void __hwasan_shadow();
33decltype(__hwasan_shadow)* __hwasan_premap_shadow();
34
35}  // extern "C"
36
37namespace __hwasan {
38
39// Conservative upper limit.
40static uptr PremapShadowSize() {
41  return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale,
42                   GetMmapGranularity());
43}
44
45static uptr PremapShadow() {
46  return MapDynamicShadow(PremapShadowSize(), kShadowScale,
47                          kShadowBaseAlignment, kHighMemEnd);
48}
49
50static bool IsPremapShadowAvailable() {
51  const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow);
52  const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow);
53  // shadow == resolver is how Android KitKat and older handles ifunc.
54  // shadow == 0 just in case.
55  return shadow != 0 && shadow != resolver;
56}
57
58static uptr FindPremappedShadowStart(uptr shadow_size_bytes) {
59  const uptr granularity = GetMmapGranularity();
60  const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow);
61  const uptr premap_shadow_size = PremapShadowSize();
62  const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity);
63
64  // We may have mapped too much. Release extra memory.
65  UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size);
66  return shadow_start;
67}
68
69}  // namespace __hwasan
70
71extern "C" {
72
73decltype(__hwasan_shadow)* __hwasan_premap_shadow() {
74  // The resolver might be called multiple times. Map the shadow just once.
75  static __sanitizer::uptr shadow = 0;
76  if (!shadow)
77    shadow = __hwasan::PremapShadow();
78  return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow);
79}
80
81// __hwasan_shadow is a "function" that has the same address as the first byte
82// of the shadow mapping.
83INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow")))
84void __hwasan_shadow();
85
86extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[],
87    __rela_iplt_end[];
88
89}  // extern "C"
90
91namespace __hwasan {
92
93void InitShadowGOT() {
94  // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This
95  // needs to be done before other ifunc resolvers (which are handled by libc)
96  // because a resolver might read __hwasan_shadow.
97  typedef ElfW(Addr) (*ifunc_resolver_t)(void);
98  for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) {
99    ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset);
100    ElfW(Addr) resolver = r->r_addend;
101    if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) {
102      *offset = reinterpret_cast<ifunc_resolver_t>(resolver)();
103      break;
104    }
105  }
106}
107
108uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
109  if (IsPremapShadowAvailable())
110    return FindPremappedShadowStart(shadow_size_bytes);
111  return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,
112                          kHighMemEnd);
113}
114
115}  // namespace __hwasan
116
117#elif SANITIZER_FUCHSIA
118
119namespace __hwasan {
120
121void InitShadowGOT() {}
122
123}  // namespace __hwasan
124
125#else
126namespace __hwasan {
127
128void InitShadowGOT() {}
129
130uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
131#  if defined(HWASAN_ALIASING_MODE)
132  constexpr uptr kAliasSize = 1ULL << kAddressTagShift;
133  constexpr uptr kNumAliases = 1ULL << kTagBits;
134  return MapDynamicShadowAndAliases(shadow_size_bytes, kAliasSize, kNumAliases,
135                                    RingBufferSize());
136#  endif
137  return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,
138                          kHighMemEnd);
139}
140
141}  // namespace __hwasan
142
143#endif  // SANITIZER_ANDROID
144