1//===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8/// 9/// \file 10/// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory 11/// region and handles ifunc resolver case, when necessary. 12/// 13//===----------------------------------------------------------------------===// 14 15#include "hwasan_dynamic_shadow.h" 16 17#include <elf.h> 18#include <link.h> 19 20#include "hwasan.h" 21#include "hwasan_mapping.h" 22#include "hwasan_thread_list.h" 23#include "sanitizer_common/sanitizer_common.h" 24#include "sanitizer_common/sanitizer_posix.h" 25 26// The code in this file needs to run in an unrelocated binary. It should not 27// access any external symbol, including its own non-hidden globals. 28 29#if SANITIZER_ANDROID 30extern "C" { 31 32INTERFACE_ATTRIBUTE void __hwasan_shadow(); 33decltype(__hwasan_shadow)* __hwasan_premap_shadow(); 34 35} // extern "C" 36 37namespace __hwasan { 38 39// Conservative upper limit. 40static uptr PremapShadowSize() { 41 return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale, 42 GetMmapGranularity()); 43} 44 45static uptr PremapShadow() { 46 return MapDynamicShadow(PremapShadowSize(), kShadowScale, 47 kShadowBaseAlignment, kHighMemEnd); 48} 49 50static bool IsPremapShadowAvailable() { 51 const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow); 52 const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow); 53 // shadow == resolver is how Android KitKat and older handles ifunc. 54 // shadow == 0 just in case. 55 return shadow != 0 && shadow != resolver; 56} 57 58static uptr FindPremappedShadowStart(uptr shadow_size_bytes) { 59 const uptr granularity = GetMmapGranularity(); 60 const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow); 61 const uptr premap_shadow_size = PremapShadowSize(); 62 const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity); 63 64 // We may have mapped too much. Release extra memory. 65 UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size); 66 return shadow_start; 67} 68 69} // namespace __hwasan 70 71extern "C" { 72 73decltype(__hwasan_shadow)* __hwasan_premap_shadow() { 74 // The resolver might be called multiple times. Map the shadow just once. 75 static __sanitizer::uptr shadow = 0; 76 if (!shadow) 77 shadow = __hwasan::PremapShadow(); 78 return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow); 79} 80 81// __hwasan_shadow is a "function" that has the same address as the first byte 82// of the shadow mapping. 83INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow"))) 84void __hwasan_shadow(); 85 86extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[], 87 __rela_iplt_end[]; 88 89} // extern "C" 90 91namespace __hwasan { 92 93void InitShadowGOT() { 94 // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This 95 // needs to be done before other ifunc resolvers (which are handled by libc) 96 // because a resolver might read __hwasan_shadow. 97 typedef ElfW(Addr) (*ifunc_resolver_t)(void); 98 for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) { 99 ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset); 100 ElfW(Addr) resolver = r->r_addend; 101 if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) { 102 *offset = reinterpret_cast<ifunc_resolver_t>(resolver)(); 103 break; 104 } 105 } 106} 107 108uptr FindDynamicShadowStart(uptr shadow_size_bytes) { 109 if (IsPremapShadowAvailable()) 110 return FindPremappedShadowStart(shadow_size_bytes); 111 return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment, 112 kHighMemEnd); 113} 114 115} // namespace __hwasan 116 117#elif SANITIZER_FUCHSIA 118 119namespace __hwasan { 120 121void InitShadowGOT() {} 122 123} // namespace __hwasan 124 125#else 126namespace __hwasan { 127 128void InitShadowGOT() {} 129 130uptr FindDynamicShadowStart(uptr shadow_size_bytes) { 131# if defined(HWASAN_ALIASING_MODE) 132 constexpr uptr kAliasSize = 1ULL << kAddressTagShift; 133 constexpr uptr kNumAliases = 1ULL << kTagBits; 134 return MapDynamicShadowAndAliases(shadow_size_bytes, kAliasSize, kNumAliases, 135 RingBufferSize()); 136# endif 137 return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment, 138 kHighMemEnd); 139} 140 141} // namespace __hwasan 142 143#endif // SANITIZER_ANDROID 144