OLD | NEW |
| (Empty) |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "wtf/AddressSpaceRandomization.h" | |
6 | |
7 #include "wtf/PageAllocator.h" | |
8 #include "wtf/SpinLock.h" | |
9 | |
10 #if OS(WIN) | |
11 #include <windows.h> | |
12 #else | |
13 #include <sys/time.h> | |
14 #include <unistd.h> | |
15 #endif | |
16 | |
17 namespace WTF { | |
18 | |
19 namespace { | |
20 | |
21 // This is the same PRNG as used by tcmalloc for mapping address randomness; | |
22 // see http://burtleburtle.net/bob/rand/smallprng.html | |
23 struct ranctx { | |
24 SpinLock lock; | |
25 bool initialized; | |
26 uint32_t a; | |
27 uint32_t b; | |
28 uint32_t c; | |
29 uint32_t d; | |
30 }; | |
31 | |
32 #define rot(x, k) (((x) << (k)) | ((x) >> (32 - (k)))) | |
33 | |
34 uint32_t ranvalInternal(ranctx* x) | |
35 { | |
36 uint32_t e = x->a - rot(x->b, 27); | |
37 x->a = x->b ^ rot(x->c, 17); | |
38 x->b = x->c + x->d; | |
39 x->c = x->d + e; | |
40 x->d = e + x->a; | |
41 return x->d; | |
42 } | |
43 | |
44 #undef rot | |
45 | |
46 uint32_t ranval(ranctx* x) | |
47 { | |
48 SpinLock::Guard guard(x->lock); | |
49 if (UNLIKELY(!x->initialized)) { | |
50 x->initialized = true; | |
51 char c; | |
52 uint32_t seed = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(&c)); | |
53 uint32_t pid; | |
54 uint32_t usec; | |
55 #if OS(WIN) | |
56 pid = GetCurrentProcessId(); | |
57 SYSTEMTIME st; | |
58 GetSystemTime(&st); | |
59 usec = static_cast<uint32_t>(st.wMilliseconds * 1000); | |
60 #else | |
61 pid = static_cast<uint32_t>(getpid()); | |
62 struct timeval tv; | |
63 gettimeofday(&tv, 0); | |
64 usec = static_cast<uint32_t>(tv.tv_usec); | |
65 #endif | |
66 seed ^= pid; | |
67 seed ^= usec; | |
68 x->a = 0xf1ea5eed; | |
69 x->b = x->c = x->d = seed; | |
70 for (int i = 0; i < 20; ++i) { | |
71 (void) ranvalInternal(x); | |
72 } | |
73 } | |
74 uint32_t ret = ranvalInternal(x); | |
75 return ret; | |
76 } | |
77 | |
78 static struct ranctx s_ranctx; | |
79 | |
80 } // namespace | |
81 | |
82 // Calculates a random preferred mapping address. In calculating an | |
83 // address, we balance good ASLR against not fragmenting the address | |
84 // space too badly. | |
85 void* getRandomPageBase() | |
86 { | |
87 uintptr_t random; | |
88 random = static_cast<uintptr_t>(ranval(&s_ranctx)); | |
89 #if CPU(X86_64) | |
90 random <<= 32UL; | |
91 random |= static_cast<uintptr_t>(ranval(&s_ranctx)); | |
92 // This address mask gives a low liklihood of address space collisions. | |
93 // We handle the situation gracefully if there is a collision. | |
94 #if OS(WIN) | |
95 // 64-bit Windows has a bizarrely small 8TB user address space. | |
96 // Allocates in the 1-5TB region. | |
97 // TODO(cevans): I think Win 8.1 has 47-bits like Linux. | |
98 random &= 0x3ffffffffffUL; | |
99 random += 0x10000000000UL; | |
100 #elif defined(MEMORY_TOOL_REPLACES_ALLOCATOR) | |
101 // This range is copied from the TSan source, but works for all tools. | |
102 random &= 0x007fffffffffUL; | |
103 random += 0x7e8000000000UL; | |
104 #else | |
105 // Linux and OS X support the full 47-bit user space of x64 processors. | |
106 random &= 0x3fffffffffffUL; | |
107 #endif | |
108 #elif CPU(ARM64) | |
109 // ARM64 on Linux has 39-bit user space. | |
110 random &= 0x3fffffffffUL; | |
111 random += 0x1000000000UL; | |
112 #else // !CPU(X86_64) && !CPU(ARM64) | |
113 #if OS(WIN) | |
114 // On win32 host systems the randomization plus huge alignment causes | |
115 // excessive fragmentation. Plus most of these systems lack ASLR, so the | |
116 // randomization isn't buying anything. In that case we just skip it. | |
117 // TODO(jschuh): Just dump the randomization when HE-ASLR is present. | |
118 static BOOL isWow64 = -1; | |
119 if (isWow64 == -1 && !IsWow64Process(GetCurrentProcess(), &isWow64)) | |
120 isWow64 = FALSE; | |
121 if (!isWow64) | |
122 return nullptr; | |
123 #endif // OS(WIN) | |
124 // This is a good range on Windows, Linux and Mac. | |
125 // Allocates in the 0.5-1.5GB region. | |
126 random &= 0x3fffffff; | |
127 random += 0x20000000; | |
128 #endif // CPU(X86_64) | |
129 random &= kPageAllocationGranularityBaseMask; | |
130 return reinterpret_cast<void*>(random); | |
131 } | |
132 | |
133 } // namespace WTF | |
OLD | NEW |