| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "wtf/AddressSpaceRandomization.h" | 5 #include "wtf/AddressSpaceRandomization.h" |
| 6 | 6 |
| 7 #include "wtf/PageAllocator.h" | 7 #include "wtf/PageAllocator.h" |
| 8 #include "wtf/SpinLock.h" | 8 #include "wtf/SpinLock.h" |
| 9 | 9 |
| 10 #if OS(WIN) | 10 #if OS(WIN) |
| 11 #include <windows.h> | 11 #include <windows.h> |
| 12 #else | 12 #else |
| 13 #include <sys/time.h> | 13 #include <sys/time.h> |
| 14 #include <unistd.h> | 14 #include <unistd.h> |
| 15 #endif | 15 #endif |
| 16 | 16 |
| 17 namespace WTF { | 17 namespace WTF { |
| 18 | 18 |
| 19 namespace { | 19 namespace { |
| 20 | 20 |
| 21 // This is the same PRNG as used by tcmalloc for mapping address randomness; | 21 // This is the same PRNG as used by tcmalloc for mapping address randomness; |
| 22 // see http://burtleburtle.net/bob/rand/smallprng.html | 22 // see http://burtleburtle.net/bob/rand/smallprng.html |
| 23 struct ranctx { | 23 struct ranctx { |
| 24 SpinLock lock; | 24 SpinLock lock; |
| 25 bool initialized; | 25 bool initialized; |
| 26 uint32_t a; | 26 uint32_t a; |
| 27 uint32_t b; | 27 uint32_t b; |
| 28 uint32_t c; | 28 uint32_t c; |
| 29 uint32_t d; | 29 uint32_t d; |
| 30 }; | 30 }; |
| 31 | 31 |
| 32 #define rot(x, k) (((x) << (k)) | ((x) >> (32 - (k)))) | 32 #define rot(x, k) (((x) << (k)) | ((x) >> (32 - (k)))) |
| 33 | 33 |
| 34 uint32_t ranvalInternal(ranctx* x) | 34 uint32_t ranvalInternal(ranctx* x) { |
| 35 { | 35 uint32_t e = x->a - rot(x->b, 27); |
| 36 uint32_t e = x->a - rot(x->b, 27); | 36 x->a = x->b ^ rot(x->c, 17); |
| 37 x->a = x->b ^ rot(x->c, 17); | 37 x->b = x->c + x->d; |
| 38 x->b = x->c + x->d; | 38 x->c = x->d + e; |
| 39 x->c = x->d + e; | 39 x->d = e + x->a; |
| 40 x->d = e + x->a; | 40 return x->d; |
| 41 return x->d; | |
| 42 } | 41 } |
| 43 | 42 |
| 44 #undef rot | 43 #undef rot |
| 45 | 44 |
| 46 uint32_t ranval(ranctx* x) | 45 uint32_t ranval(ranctx* x) { |
| 47 { | 46 SpinLock::Guard guard(x->lock); |
| 48 SpinLock::Guard guard(x->lock); | 47 if (UNLIKELY(!x->initialized)) { |
| 49 if (UNLIKELY(!x->initialized)) { | 48 x->initialized = true; |
| 50 x->initialized = true; | 49 char c; |
| 51 char c; | 50 uint32_t seed = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(&c)); |
| 52 uint32_t seed = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(&c)); | 51 uint32_t pid; |
| 53 uint32_t pid; | 52 uint32_t usec; |
| 54 uint32_t usec; | |
| 55 #if OS(WIN) | 53 #if OS(WIN) |
| 56 pid = GetCurrentProcessId(); | 54 pid = GetCurrentProcessId(); |
| 57 SYSTEMTIME st; | 55 SYSTEMTIME st; |
| 58 GetSystemTime(&st); | 56 GetSystemTime(&st); |
| 59 usec = static_cast<uint32_t>(st.wMilliseconds * 1000); | 57 usec = static_cast<uint32_t>(st.wMilliseconds * 1000); |
| 60 #else | 58 #else |
| 61 pid = static_cast<uint32_t>(getpid()); | 59 pid = static_cast<uint32_t>(getpid()); |
| 62 struct timeval tv; | 60 struct timeval tv; |
| 63 gettimeofday(&tv, 0); | 61 gettimeofday(&tv, 0); |
| 64 usec = static_cast<uint32_t>(tv.tv_usec); | 62 usec = static_cast<uint32_t>(tv.tv_usec); |
| 65 #endif | 63 #endif |
| 66 seed ^= pid; | 64 seed ^= pid; |
| 67 seed ^= usec; | 65 seed ^= usec; |
| 68 x->a = 0xf1ea5eed; | 66 x->a = 0xf1ea5eed; |
| 69 x->b = x->c = x->d = seed; | 67 x->b = x->c = x->d = seed; |
| 70 for (int i = 0; i < 20; ++i) { | 68 for (int i = 0; i < 20; ++i) { |
| 71 (void) ranvalInternal(x); | 69 (void)ranvalInternal(x); |
| 72 } | |
| 73 } | 70 } |
| 74 uint32_t ret = ranvalInternal(x); | 71 } |
| 75 return ret; | 72 uint32_t ret = ranvalInternal(x); |
| 73 return ret; |
| 76 } | 74 } |
| 77 | 75 |
| 78 static struct ranctx s_ranctx; | 76 static struct ranctx s_ranctx; |
| 79 | |
| 80 } | 77 } |
| 81 | 78 |
| 82 // Calculates a random preferred mapping address. In calculating an | 79 // Calculates a random preferred mapping address. In calculating an |
| 83 // address, we balance good ASLR against not fragmenting the address | 80 // address, we balance good ASLR against not fragmenting the address |
| 84 // space too badly. | 81 // space too badly. |
| 85 void* getRandomPageBase() | 82 void* getRandomPageBase() { |
| 86 { | 83 uintptr_t random; |
| 87 uintptr_t random; | 84 random = static_cast<uintptr_t>(ranval(&s_ranctx)); |
| 88 random = static_cast<uintptr_t>(ranval(&s_ranctx)); | |
| 89 #if CPU(X86_64) | 85 #if CPU(X86_64) |
| 90 random <<= 32UL; | 86 random <<= 32UL; |
| 91 random |= static_cast<uintptr_t>(ranval(&s_ranctx)); | 87 random |= static_cast<uintptr_t>(ranval(&s_ranctx)); |
| 92 // This address mask gives a low liklihood of address space collisions. | 88 // This address mask gives a low liklihood of address space collisions. |
| 93 // We handle the situation gracefully if there is a collision. | 89 // We handle the situation gracefully if there is a collision. |
| 94 #if OS(WIN) | 90 #if OS(WIN) |
| 95 // 64-bit Windows has a bizarrely small 8TB user address space. | 91 // 64-bit Windows has a bizarrely small 8TB user address space. |
| 96 // Allocates in the 1-5TB region. | 92 // Allocates in the 1-5TB region. |
| 97 // TODO(cevans): I think Win 8.1 has 47-bits like Linux. | 93 // TODO(cevans): I think Win 8.1 has 47-bits like Linux. |
| 98 random &= 0x3ffffffffffUL; | 94 random &= 0x3ffffffffffUL; |
| 99 random += 0x10000000000UL; | 95 random += 0x10000000000UL; |
| 100 #elif defined(MEMORY_TOOL_REPLACES_ALLOCATOR) | 96 #elif defined(MEMORY_TOOL_REPLACES_ALLOCATOR) |
| 101 // This range is copied from the TSan source, but works for all tools. | 97 // This range is copied from the TSan source, but works for all tools. |
| 102 random &= 0x007fffffffffUL; | 98 random &= 0x007fffffffffUL; |
| 103 random += 0x7e8000000000UL; | 99 random += 0x7e8000000000UL; |
| 104 #else | 100 #else |
| 105 // Linux and OS X support the full 47-bit user space of x64 processors. | 101 // Linux and OS X support the full 47-bit user space of x64 processors. |
| 106 random &= 0x3fffffffffffUL; | 102 random &= 0x3fffffffffffUL; |
| 107 #endif | 103 #endif |
| 108 #elif CPU(ARM64) | 104 #elif CPU(ARM64) |
| 109 // ARM64 on Linux has 39-bit user space. | 105 // ARM64 on Linux has 39-bit user space. |
| 110 random &= 0x3fffffffffUL; | 106 random &= 0x3fffffffffUL; |
| 111 random += 0x1000000000UL; | 107 random += 0x1000000000UL; |
| 112 #else // !CPU(X86_64) && !CPU(ARM64) | 108 #else // !CPU(X86_64) && !CPU(ARM64) |
| 113 #if OS(WIN) | 109 #if OS(WIN) |
| 114 // On win32 host systems the randomization plus huge alignment causes | 110 // On win32 host systems the randomization plus huge alignment causes |
| 115 // excessive fragmentation. Plus most of these systems lack ASLR, so the | 111 // excessive fragmentation. Plus most of these systems lack ASLR, so the |
| 116 // randomization isn't buying anything. In that case we just skip it. | 112 // randomization isn't buying anything. In that case we just skip it. |
| 117 // TODO(jschuh): Just dump the randomization when HE-ASLR is present. | 113 // TODO(jschuh): Just dump the randomization when HE-ASLR is present. |
| 118 static BOOL isWow64 = -1; | 114 static BOOL isWow64 = -1; |
| 119 if (isWow64 == -1 && !IsWow64Process(GetCurrentProcess(), &isWow64)) | 115 if (isWow64 == -1 && !IsWow64Process(GetCurrentProcess(), &isWow64)) |
| 120 isWow64 = FALSE; | 116 isWow64 = FALSE; |
| 121 if (!isWow64) | 117 if (!isWow64) |
| 122 return nullptr; | 118 return nullptr; |
| 123 #endif // OS(WIN) | 119 #endif // OS(WIN) |
| 124 // This is a good range on Windows, Linux and Mac. | 120 // This is a good range on Windows, Linux and Mac. |
| 125 // Allocates in the 0.5-1.5GB region. | 121 // Allocates in the 0.5-1.5GB region. |
| 126 random &= 0x3fffffff; | 122 random &= 0x3fffffff; |
| 127 random += 0x20000000; | 123 random += 0x20000000; |
| 128 #endif // CPU(X86_64) | 124 #endif // CPU(X86_64) |
| 129 random &= kPageAllocationGranularityBaseMask; | 125 random &= kPageAllocationGranularityBaseMask; |
| 130 return reinterpret_cast<void*>(random); | 126 return reinterpret_cast<void*>(random); |
| 131 } | 127 } |
| 132 | |
| 133 } | 128 } |
| OLD | NEW |