Revision: 9572
Author: [email protected]
Date: Mon Oct 10 07:17:42 2011
Log: Add hinting to improve ASLR for macos (all allocations) and linux
(newly added allocation types).
TEST=N/A
BUG=1749
Review URL: http://codereview.chromium.org/8115014
Patch from Cris Neckar <[email protected]>.
http://code.google.com/p/v8/source/detail?r=9572
Modified:
/branches/bleeding_edge/src/platform-linux.cc
/branches/bleeding_edge/src/platform-macos.cc
/branches/bleeding_edge/src/platform-posix.cc
/branches/bleeding_edge/src/platform.h
=======================================
--- /branches/bleeding_edge/src/platform-linux.cc Thu Sep 29 05:23:05 2011
+++ /branches/bleeding_edge/src/platform-linux.cc Mon Oct 10 07:17:42 2011
@@ -78,33 +78,6 @@
static Mutex* limit_mutex = NULL;
-static void* GetRandomMmapAddr() {
- Isolate* isolate = Isolate::UncheckedCurrent();
- // Note that the current isolate isn't set up in a call path via
- // CpuFeatures::Probe. We don't care about randomization in this case
because
- // the code page is immediately freed.
- if (isolate != NULL) {
-#ifdef V8_TARGET_ARCH_X64
- uint64_t rnd1 = V8::RandomPrivate(isolate);
- uint64_t rnd2 = V8::RandomPrivate(isolate);
- uint64_t raw_addr = (rnd1 << 32) ^ rnd2;
- // Currently available CPUs have 48 bits of virtual addressing.
Truncate
- // the hint address to 46 bits to give the kernel a fighting chance of
- // fulfilling our placement request.
- raw_addr &= V8_UINT64_C(0x3ffffffff000);
-#else
- uint32_t raw_addr = V8::RandomPrivate(isolate);
- // The range 0x20000000 - 0x60000000 is relatively unpopulated across a
- // variety of ASLR modes (PAE kernel, NX compat mode, etc).
- raw_addr &= 0x3ffff000;
- raw_addr += 0x20000000;
-#endif
- return reinterpret_cast<void*>(raw_addr);
- }
- return NULL;
-}
-
-
void OS::Setup() {
// Seed the random number generator. We preserve microsecond resolution.
uint64_t seed = Ticks() ^ (getpid() << 16);
@@ -386,7 +359,7 @@
bool is_executable) {
const size_t msize = RoundUp(requested, AllocateAlignment());
int prot = PROT_READ | PROT_WRITE | (is_executable ? PROT_EXEC : 0);
- void* addr = GetRandomMmapAddr();
+ void* addr = OS::GetRandomMmapAddr();
void* mbase = mmap(addr, msize, prot, MAP_PRIVATE | MAP_ANONYMOUS, -1,
0);
if (mbase == MAP_FAILED) {
LOG(i::Isolate::Current(),
@@ -456,7 +429,12 @@
int size = ftell(file);
void* memory =
- mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, fileno(file), 0);
+ mmap(OS::GetRandomMmapAddr(),
+ size,
+ PROT_READ | PROT_WRITE,
+ MAP_SHARED,
+ fileno(file),
+ 0);
return new PosixMemoryMappedFile(file, memory, size);
}
@@ -471,7 +449,12 @@
return NULL;
}
void* memory =
- mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, fileno(file), 0);
+ mmap(OS::GetRandomMmapAddr(),
+ size,
+ PROT_READ | PROT_WRITE,
+ MAP_SHARED,
+ fileno(file),
+ 0);
return new PosixMemoryMappedFile(file, memory, size);
}
@@ -556,8 +539,12 @@
// kernel log.
int size = sysconf(_SC_PAGESIZE);
FILE* f = fopen(kGCFakeMmap, "w+");
- void* addr = mmap(NULL, size, PROT_READ | PROT_EXEC, MAP_PRIVATE,
- fileno(f), 0);
+ void* addr = mmap(OS::GetRandomMmapAddr(),
+ size,
+ PROT_READ | PROT_EXEC,
+ MAP_PRIVATE,
+ fileno(f),
+ 0);
ASSERT(addr != MAP_FAILED);
OS::Free(addr, size);
fclose(f);
@@ -614,7 +601,7 @@
ASSERT(IsAligned(alignment,
static_cast<intptr_t>(OS::AllocateAlignment())));
size_t request_size = RoundUp(size + alignment,
static_cast<intptr_t>(OS::AllocateAlignment()));
- void* reservation = mmap(GetRandomMmapAddr(),
+ void* reservation = mmap(OS::GetRandomMmapAddr(),
request_size,
PROT_NONE,
MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE,
@@ -680,7 +667,7 @@
void* VirtualMemory::ReserveRegion(size_t size) {
- void* result = mmap(GetRandomMmapAddr(),
+ void* result = mmap(OS::GetRandomMmapAddr(),
size,
PROT_NONE,
MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE,
=======================================
--- /branches/bleeding_edge/src/platform-macos.cc Thu Sep 29 05:23:05 2011
+++ /branches/bleeding_edge/src/platform-macos.cc Mon Oct 10 07:17:42 2011
@@ -94,12 +94,8 @@
void OS::Setup() {
- // Seed the random number generator.
- // Convert the current time to a 64-bit integer first, before converting
it
- // to an unsigned. Going directly will cause an overflow and the seed to
be
- // set to all ones. The seed will be identical for different instances
that
- // call this setup code within the same millisecond.
- uint64_t seed = static_cast<uint64_t>(TimeCurrentMillis());
+ // Seed the random number generator. We preserve microsecond resolution.
+ uint64_t seed = Ticks() ^ (getpid() << 16);
srandom(static_cast<unsigned int>(seed));
limit_mutex = CreateMutex();
}
@@ -148,9 +144,12 @@
bool is_executable) {
const size_t msize = RoundUp(requested, getpagesize());
int prot = PROT_READ | PROT_WRITE | (is_executable ? PROT_EXEC : 0);
- void* mbase = mmap(NULL, msize, prot,
+ void* mbase = mmap(OS::GetRandomMmapAddr(),
+ msize,
+ prot,
MAP_PRIVATE | MAP_ANON,
- kMmapFd, kMmapFdOffset);
+ kMmapFd,
+ kMmapFdOffset);
if (mbase == MAP_FAILED) {
LOG(Isolate::Current(), StringEvent("OS::Allocate", "mmap failed"));
return NULL;
@@ -207,7 +206,12 @@
int size = ftell(file);
void* memory =
- mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, fileno(file), 0);
+ mmap(OS::GetRandomMmapAddr(),
+ size,
+ PROT_READ | PROT_WRITE,
+ MAP_SHARED,
+ fileno(file),
+ 0);
return new PosixMemoryMappedFile(file, memory, size);
}
@@ -222,7 +226,12 @@
return NULL;
}
void* memory =
- mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, fileno(file), 0);
+ mmap(OS::GetRandomMmapAddr(),
+ size,
+ PROT_READ | PROT_WRITE,
+ MAP_SHARED,
+ fileno(file),
+ 0);
return new PosixMemoryMappedFile(file, memory, size);
}
@@ -346,7 +355,7 @@
ASSERT(IsAligned(alignment,
static_cast<intptr_t>(OS::AllocateAlignment())));
size_t request_size = RoundUp(size + alignment,
static_cast<intptr_t>(OS::AllocateAlignment()));
- void* reservation = mmap(NULL,
+ void* reservation = mmap(OS::GetRandomMmapAddr(),
request_size,
PROT_NONE,
MAP_PRIVATE | MAP_ANON | MAP_NORESERVE,
@@ -397,7 +406,7 @@
void* VirtualMemory::ReserveRegion(size_t size) {
- void* result = mmap(NULL,
+ void* result = mmap(OS::GetRandomMmapAddr(),
size,
PROT_NONE,
MAP_PRIVATE | MAP_ANON | MAP_NORESERVE,
=======================================
--- /branches/bleeding_edge/src/platform-posix.cc Tue Aug 2 09:16:32 2011
+++ /branches/bleeding_edge/src/platform-posix.cc Mon Oct 10 07:17:42 2011
@@ -84,6 +84,34 @@
#endif // __CYGWIN__
+void* OS::GetRandomMmapAddr() {
+ Isolate* isolate = Isolate::UncheckedCurrent();
+ // Note that the current isolate isn't set up in a call path via
+ // CpuFeatures::Probe. We don't care about randomization in this case
because
+ // the code page is immediately freed.
+ if (isolate != NULL) {
+#ifdef V8_TARGET_ARCH_X64
+ uint64_t rnd1 = V8::RandomPrivate(isolate);
+ uint64_t rnd2 = V8::RandomPrivate(isolate);
+ uint64_t raw_addr = (rnd1 << 32) ^ rnd2;
+ // Currently available CPUs have 48 bits of virtual addressing.
Truncate
+ // the hint address to 46 bits to give the kernel a fighting chance of
+ // fulfilling our placement request.
+ raw_addr &= V8_UINT64_C(0x3ffffffff000);
+#else
+ uint32_t raw_addr = V8::RandomPrivate(isolate);
+ // The range 0x20000000 - 0x60000000 is relatively unpopulated across a
+ // variety of ASLR modes (PAE kernel, NX compat mode, etc) and on macos
+ // 10.6 and 10.7.
+ raw_addr &= 0x3ffff000;
+ raw_addr += 0x20000000;
+#endif
+ return reinterpret_cast<void*>(raw_addr);
+ }
+ return NULL;
+}
+
+
//
----------------------------------------------------------------------------
// Math functions
=======================================
--- /branches/bleeding_edge/src/platform.h Thu Sep 29 05:23:05 2011
+++ /branches/bleeding_edge/src/platform.h Mon Oct 10 07:17:42 2011
@@ -178,6 +178,9 @@
// Assign memory as a guard page so that access will cause an exception.
static void Guard(void* address, const size_t size);
+ // Generate a random address to be used for hinting mmap().
+ static void* GetRandomMmapAddr();
+
// Get the Alignment guaranteed by Allocate().
static size_t AllocateAlignment();
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
