third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "config.h"
   6 #include "wtf/AddressSpaceRandomization.h"
   7
   8 #include "wtf/PageAllocator.h"
   9 #include "wtf/SpinLock.h"
  10
  11 #if OS(WIN)
  12 #include <windows.h>
  13 #else
  14 #include <sys/time.h>
  15 #include <unistd.h>
  16 #endif
  17
  18 namespace WTF {
  19
  20 namespace {
  21
  22 // This is the same PRNG as used by tcmalloc for mapping address randomness;
  23 // see http://burtleburtle.net/bob/rand/smallprng.html
  24 struct ranctx {
  25     int lock;
  26     bool initialized;
  27     uint32_t a;
  28     uint32_t b;
  29     uint32_t c;
  30     uint32_t d;
  31 };
  32
  33 #define rot(x, k) (((x) << (k)) | ((x) >> (32 - (k))))
  34
  35 uint32_t ranvalInternal(ranctx* x)
  36 {
  37     uint32_t e = x->a - rot(x->b, 27);
  38     x->a = x->b ^ rot(x->c, 17);
  39     x->b = x->c + x->d;
  40     x->c = x->d + e;
  41     x->d = e + x->a;
  42     return x->d;
  43 }
  44
  45 #undef rot
  46
  47 uint32_t ranval(ranctx* x)
  48 {
  49     spinLockLock(&x->lock);
  50     if (UNLIKELY(!x->initialized)) {
  51         x->initialized = true;
  52         char c;
  53         uint32_t seed = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(&c));
  54         uint32_t pid;
  55         uint32_t usec;
  56 #if OS(WIN)
  57         pid = GetCurrentProcessId();
  58         SYSTEMTIME st;
  59         GetSystemTime(&st);
  60         usec = static_cast<uint32_t>(st.wMilliseconds * 1000);
  61 #else
  62         pid = static_cast<uint32_t>(getpid());
  63         struct timeval tv;
  64         gettimeofday(&tv, 0);
  65         usec = static_cast<uint32_t>(tv.tv_usec);
  66 #endif
  67         seed ^= pid;
  68         seed ^= usec;
  69         x->a = 0xf1ea5eed;
  70         x->b = x->c = x->d = seed;
  71         for (int i = 0; i < 20; ++i) {
  72             (void) ranvalInternal(x);
  73         }
  74     }
  75     uint32_t ret = ranvalInternal(x);
  76     spinLockUnlock(&x->lock);
  77     return ret;
  78 }
  79
  80 static struct ranctx s_ranctx;
  81
  82 }
  83
  84 // Calculates a random preferred mapping address. In calculating an
  85 // address, we balance good ASLR against not fragmenting the address
  86 // space too badly.
  87 void* getRandomPageBase()
  88 {
  89     uintptr_t random;
  90     random = static_cast<uintptr_t>(ranval(&s_ranctx));
  91 #if CPU(X86_64)
  92     random <<= 32UL;
  93     random |= static_cast<uintptr_t>(ranval(&s_ranctx));
  94     // This address mask gives a low liklihood of address space collisions.
  95     // We handle the situation gracefully if there is a collision.
  96 #if OS(WIN)
  97     // 64-bit Windows has a bizarrely small 8TB user address space.
  98     // Allocates in the 1-5TB region.
  99     // TODO(cevans): I think Win 8.1 has 47-bits like Linux.
 100     random &= 0x3ffffffffffUL;
 101     random += 0x10000000000UL;
 102 #else
 103     // Linux and OS X support the full 47-bit user space of x64 processors.
 104     random &= 0x3fffffffffffUL;
 105 #endif
 106 #elif CPU(ARM64)
 107     // ARM64 on Linux has 39-bit user space.
 108     random &= 0x3fffffffffUL;
 109     random += 0x1000000000UL;
 110 #else // !CPU(X86_64) && !CPU(ARM64)
 111     // This is a good range on Windows, Linux and Mac.
 112     // Allocates in the 0.5-1.5GB region.
 113     random &= 0x3fffffff;
 114     random += 0x20000000;
 115 #endif // CPU(X86_64)
 116     random &= kPageAllocationGranularityBaseMask;
 117     return reinterpret_cast<void*>(random);
 118 }
 119
 120 }