1 //===-- esan_shadow.h -------------------------------------------*- C++ -*-===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file is a part of EfficiencySanitizer, a family of performance tuners.
12 // Shadow memory mappings for the esan run-time.
13 //===----------------------------------------------------------------------===//
19 #include <sanitizer_common/sanitizer_platform.h>
21 #if SANITIZER_WORDSIZE != 64
22 #error Only 64-bit is supported
27 struct ApplicationRegion {
30 bool ShadowMergedWithPrev;
33 #if SANITIZER_LINUX && defined(__x86_64__)
36 // Application memory falls into these 5 regions (ignoring the corner case
37 // of PIE with a non-zero PT_LOAD base):
39 // [0x00000000'00000000, 0x00000100'00000000) non-PIE + heap
40 // [0x00005500'00000000, 0x00005700'00000000) PIE
41 // [0x00007e00'00000000, 0x00007fff'ff600000) libraries + stack, part 1
42 // [0x00007fff'ff601000, 0x00008000'00000000) libraries + stack, part 2
43 // [0xffffffff'ff600000, 0xffffffff'ff601000) vsyscall
45 // Although we can ignore the vsyscall for the most part as there are few data
46 // references there (other sanitizers ignore it), we enforce a gap inside the
47 // library region to distinguish the vsyscall's shadow, considering this gap to
48 // be an invalid app region.
49 // We disallow application memory outside of those 5 regions.
50 // Our regions assume that the stack rlimit is less than a terabyte (otherwise
51 // the Linux kernel's default mmap region drops below 0x7e00'), which we enforce
52 // at init time (we can support larger and unlimited sizes for shadow
53 // scaledowns, but it is difficult for 1:1 mappings).
55 // Our shadow memory is scaled from a 1:1 mapping and supports a scale
56 // specified at library initialization time that can be any power-of-2
57 // scaledown (1x, 2x, 4x, 8x, 16x, etc.).
59 // We model our shadow memory after Umbra, a library used by the Dr. Memory
60 // tool: https://github.com/DynamoRIO/drmemory/blob/master/umbra/umbra_x64.c.
61 // We use Umbra's scheme as it was designed to support different
62 // offsets, it supports two different shadow mappings (which we may want to
63 // use for future tools), and it ensures that the shadow of a shadow will
64 // not overlap either shadow memory or application memory.
66 // This formula translates from application memory to shadow memory:
68 // shadow(app) = ((app & 0x00000fff'ffffffff) + offset) >> scale
70 // Where the offset for 1:1 is 0x00001300'00000000. For other scales, the
71 // offset is shifted left by the scale, except for scales of 1 and 2 where
72 // it must be tweaked in order to pass the double-shadow test
73 // (see the "shadow(shadow)" comments below):
74 // scale == 0: 0x00001300'000000000
75 // scale == 1: 0x00002200'000000000
76 // scale == 2: 0x00004400'000000000
77 // scale >= 3: (0x00001300'000000000 << scale)
79 // Do not pass in the open-ended end value to the formula as it will fail.
81 // The resulting shadow memory regions for a 0 scaling are:
83 // [0x00001300'00000000, 0x00001400'00000000)
84 // [0x00001800'00000000, 0x00001a00'00000000)
85 // [0x00002100'00000000, 0x000022ff'ff600000)
86 // [0x000022ff'ff601000, 0x00002300'00000000)
87 // [0x000022ff'ff600000, 0x000022ff'ff601000]
89 // We also want to ensure that a wild access by the application into the shadow
90 // regions will not corrupt our own shadow memory. shadow(shadow) ends up
91 // disjoint from shadow(app):
93 // [0x00001600'00000000, 0x00001700'00000000)
94 // [0x00001b00'00000000, 0x00001d00'00000000)
95 // [0x00001400'00000000, 0x000015ff'ff600000]
96 // [0x000015ff'ff601000, 0x00001600'00000000]
97 // [0x000015ff'ff600000, 0x000015ff'ff601000]
99 static const struct ApplicationRegion AppRegions[] = {
100 {0x0000000000000000ull, 0x0000010000000000u, false},
101 {0x0000550000000000u, 0x0000570000000000u, false},
102 // We make one shadow mapping to hold the shadow regions for all 3 of these
103 // app regions, as the mappings interleave, and the gap between the 3rd and
104 // 4th scales down below a page.
105 {0x00007e0000000000u, 0x00007fffff600000u, false},
106 {0x00007fffff601000u, 0x0000800000000000u, true},
107 {0xffffffffff600000u, 0xffffffffff601000u, true},
110 #elif SANITIZER_LINUX && SANITIZER_MIPS64
112 // Application memory falls into these 3 regions
114 // [0x00000001'00000000, 0x00000002'00000000) non-PIE + heap
115 // [0x000000aa'00000000, 0x000000ab'00000000) PIE
116 // [0x000000ff'00000000, 0x000000ff'ffffffff) libraries + stack
118 // This formula translates from application memory to shadow memory:
120 // shadow(app) = ((app & 0x00000f'ffffffff) + offset) >> scale
122 // Where the offset for 1:1 is 0x000013'00000000. For other scales, the
123 // offset is shifted left by the scale, except for scales of 1 and 2 where
124 // it must be tweaked in order to pass the double-shadow test
125 // (see the "shadow(shadow)" comments below):
126 // scale == 0: 0x000013'00000000
127 // scale == 1: 0x000022'00000000
128 // scale == 2: 0x000044'00000000
129 // scale >= 3: (0x000013'00000000 << scale)
131 // The resulting shadow memory regions for a 0 scaling are:
133 // [0x00000014'00000000, 0x00000015'00000000)
134 // [0x0000001d'00000000, 0x0000001e'00000000)
135 // [0x00000022'00000000, 0x00000022'ffffffff)
137 // We also want to ensure that a wild access by the application into the shadow
138 // regions will not corrupt our own shadow memory. shadow(shadow) ends up
139 // disjoint from shadow(app):
141 // [0x00000017'00000000, 0x00000018'00000000)
142 // [0x00000020'00000000, 0x00000021'00000000)
143 // [0x00000015'00000000, 0x00000015'ffffffff]
145 static const struct ApplicationRegion AppRegions[] = {
146 {0x0100000000u, 0x0200000000u, false},
147 {0xaa00000000u, 0xab00000000u, false},
148 {0xff00000000u, 0xffffffffffu, false},
152 #error Platform not supported
155 static const u32 NumAppRegions = sizeof(AppRegions)/sizeof(AppRegions[0]);
157 // See the comment above: we do not currently support a stack size rlimit
158 // equal to or larger than 1TB.
159 static const uptr MaxStackSize = (1ULL << 40) - 4096;
161 class ShadowMapping {
164 // The scale and offset vary by tool.
168 // TODO(sagar.thakur): Try to hardcode the mask as done in the compiler
169 // instrumentation to reduce the runtime cost of appToShadow.
170 struct ShadowMemoryMask40 {
171 static const uptr Mask = 0x0000000fffffffffu;
174 struct ShadowMemoryMask47 {
175 static const uptr Mask = 0x00000fffffffffffu;
178 void initialize(uptr ShadowScale) {
180 const uptr OffsetArray40[3] = {
186 const uptr OffsetArray47[3] = {
196 Offset = OffsetArray40[Scale];
198 Offset = OffsetArray40[0] << Scale;
203 Offset = OffsetArray47[Scale];
205 Offset = OffsetArray47[0] << Scale;
209 Printf("ERROR: %d-bit virtual memory address size not supported\n", VmaSize);
215 extern ShadowMapping Mapping;
217 static inline bool getAppRegion(u32 i, uptr *Start, uptr *End) {
218 if (i >= NumAppRegions)
220 *Start = AppRegions[i].Start;
221 *End = AppRegions[i].End;
226 bool isAppMem(uptr Mem) {
227 for (u32 i = 0; i < NumAppRegions; ++i) {
228 if (Mem >= AppRegions[i].Start && Mem < AppRegions[i].End)
234 template<typename Params>
235 uptr appToShadowImpl(uptr App) {
236 return (((App & Params::Mask) + Mapping.Offset) >> Mapping.Scale);
240 uptr appToShadow(uptr App) {
242 case 40: return appToShadowImpl<ShadowMapping::ShadowMemoryMask40>(App);
243 case 47: return appToShadowImpl<ShadowMapping::ShadowMemoryMask47>(App);
245 Printf("ERROR: %d-bit virtual memory address size not supported\n", VmaSize);
251 static inline bool getShadowRegion(u32 i, uptr *Start, uptr *End) {
252 if (i >= NumAppRegions)
254 u32 UnmergedShadowCount = 0;
256 for (AppIdx = 0; AppIdx < NumAppRegions; ++AppIdx) {
257 if (!AppRegions[AppIdx].ShadowMergedWithPrev) {
258 if (UnmergedShadowCount == i)
260 UnmergedShadowCount++;
263 if (AppIdx >= NumAppRegions || UnmergedShadowCount != i)
265 *Start = appToShadow(AppRegions[AppIdx].Start);
266 // The formula fails for the end itself.
267 *End = appToShadow(AppRegions[AppIdx].End - 1) + 1;
268 // Merge with adjacent shadow regions:
269 for (++AppIdx; AppIdx < NumAppRegions; ++AppIdx) {
270 if (!AppRegions[AppIdx].ShadowMergedWithPrev)
272 *Start = Min(*Start, appToShadow(AppRegions[AppIdx].Start));
273 *End = Max(*End, appToShadow(AppRegions[AppIdx].End - 1) + 1);
279 bool isShadowMem(uptr Mem) {
280 // We assume this is not used on any critical performance path and so there's
281 // no need to hardcode the mapping results.
282 for (uptr i = 0; i < NumAppRegions; ++i) {
283 if (Mem >= appToShadow(AppRegions[i].Start) &&
284 Mem < appToShadow(AppRegions[i].End - 1) + 1)
290 } // namespace __esan
292 #endif /* ESAN_SHADOW_H */