1//===-- asan_fuchsia.cpp -------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===---------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11// Fuchsia-specific details.
12//===---------------------------------------------------------------------===//
13
14#include "sanitizer_common/sanitizer_fuchsia.h"
15#if SANITIZER_FUCHSIA
16
17#include <limits.h>
18#include <zircon/sanitizer.h>
19#include <zircon/syscalls.h>
20#include <zircon/threads.h>
21
22# include "asan_interceptors.h"
23# include "asan_internal.h"
24# include "asan_stack.h"
25# include "asan_thread.h"
26# include "lsan/lsan_common.h"
27
28namespace __asan {
29
30// The system already set up the shadow memory for us.
31// __sanitizer::GetMaxUserVirtualAddress has already been called by
32// AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp).
33// Just do some additional sanity checks here.
34void InitializeShadowMemory() {
35 if (Verbosity())
36 PrintAddressSpaceLayout();
37
38 // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.
39 __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
40 DCHECK(kLowShadowBeg != kDefaultShadowSentinel);
41 __asan_shadow_memory_dynamic_address = kLowShadowBeg;
42
43 CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
44 CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);
45 CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);
46 CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base);
47 CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1);
48 CHECK_EQ(kLowShadowEnd, 0);
49 CHECK_EQ(kLowShadowBeg, 0);
50}
51
52void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
53 UNIMPLEMENTED();
54}
55
56void AsanCheckDynamicRTPrereqs() {}
57void AsanCheckIncompatibleRT() {}
58void InitializeAsanInterceptors() {}
59
60void InitializePlatformExceptionHandlers() {}
61void AsanOnDeadlySignal(int signo, void *siginfo, void *context) {
62 UNIMPLEMENTED();
63}
64
65bool PlatformUnpoisonStacks() {
66 // The current sp might not point to the default stack. This
67 // could be because we are in a crash stack from fuzzing for example.
68 // Unpoison the default stack and the current stack page.
69 AsanThread *curr_thread = GetCurrentThread();
70 CHECK(curr_thread != nullptr);
71 uptr top = curr_thread->stack_top();
72 uptr bottom = curr_thread->stack_bottom();
73 // The default stack grows from top to bottom. (bottom < top).
74
75 uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0));
76 if (local_stack >= bottom && local_stack <= top) {
77 // The current stack is the default stack.
78 // We only need to unpoison from where we are using until the end.
79 bottom = RoundDownTo(local_stack, GetPageSize());
80 UnpoisonStack(bottom, top, "default");
81 } else {
82 // The current stack is not the default stack.
83 // Unpoison the entire default stack and the current stack page.
84 UnpoisonStack(bottom, top, "default");
85 bottom = RoundDownTo(local_stack, GetPageSize());
86 top = bottom + GetPageSize();
87 UnpoisonStack(bottom, top, "unknown");
88 return true;
89 }
90
91 return false;
92}
93
94// We can use a plain thread_local variable for TSD.
95static thread_local void *per_thread;
96
97void *AsanTSDGet() { return per_thread; }
98
99void AsanTSDSet(void *tsd) { per_thread = tsd; }
100
101// There's no initialization needed, and the passed-in destructor
102// will never be called. Instead, our own thread destruction hook
103// (below) will call AsanThread::TSDDtor directly.
104void AsanTSDInit(void (*destructor)(void *tsd)) {
105 DCHECK(destructor == &PlatformTSDDtor);
106}
107
108void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); }
109
110static inline size_t AsanThreadMmapSize() {
111 return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size());
112}
113
114struct AsanThread::InitOptions {
115 uptr stack_bottom, stack_size;
116};
117
118// Shared setup between thread creation and startup for the initial thread.
119static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid,
120 bool detached, const char *name) {
121 // In lieu of AsanThread::Create.
122 AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__);
123
124 AsanThreadContext::CreateThreadContextArgs args = {thread, stack};
125 u32 tid = asanThreadRegistry().CreateThread(0, detached, parent_tid, &args);
126 asanThreadRegistry().SetThreadName(tid, name);
127
128 return thread;
129}
130
131// This gets the same arguments passed to Init by CreateAsanThread, above.
132// We're in the creator thread before the new thread is actually started,
133// but its stack address range is already known. We don't bother tracking
134// the static TLS address range because the system itself already uses an
135// ASan-aware allocator for that.
136void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) {
137 DCHECK_NE(GetCurrentThread(), this);
138 DCHECK_NE(GetCurrentThread(), nullptr);
139 CHECK_NE(options->stack_bottom, 0);
140 CHECK_NE(options->stack_size, 0);
141 stack_bottom_ = options->stack_bottom;
142 stack_top_ = options->stack_bottom + options->stack_size;
143}
144
145// Called by __asan::AsanInitInternal (asan_rtl.c).
146AsanThread *CreateMainThread() {
147 thrd_t self = thrd_current();
148 char name[ZX_MAX_NAME_LEN];
149 CHECK_NE(__sanitizer::MainThreadStackBase, 0);
150 CHECK_GT(__sanitizer::MainThreadStackSize, 0);
151 AsanThread *t = CreateAsanThread(
152 nullptr, 0, true,
153 _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name,
154 sizeof(name)) == ZX_OK
155 ? name
156 : nullptr);
157 // We need to set the current thread before calling AsanThread::Init() below,
158 // since it reads the thread ID.
159 SetCurrentThread(t);
160 DCHECK_EQ(t->tid(), 0);
161
162 const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase,
163 __sanitizer::MainThreadStackSize};
164 t->Init(&options);
165
166 return t;
167}
168
169// This is called before each thread creation is attempted. So, in
170// its first call, the calling thread is the initial and sole thread.
171static void *BeforeThreadCreateHook(uptr user_id, bool detached,
172 const char *name, uptr stack_bottom,
173 uptr stack_size) {
174 EnsureMainThreadIDIsCorrect();
175 // Strict init-order checking is thread-hostile.
176 if (flags()->strict_init_order)
177 StopInitOrderChecking();
178
179 GET_STACK_TRACE_THREAD;
180 u32 parent_tid = GetCurrentTidOrInvalid();
181
182 AsanThread *thread = CreateAsanThread(&stack, parent_tid, detached, name);
183
184 // On other systems, AsanThread::Init() is called from the new
185 // thread itself. But on Fuchsia we already know the stack address
186 // range beforehand, so we can do most of the setup right now.
187 const AsanThread::InitOptions options = {stack_bottom, stack_size};
188 thread->Init(&options);
189 return thread;
190}
191
192// This is called after creating a new thread (in the creating thread),
193// with the pointer returned by BeforeThreadCreateHook (above).
194static void ThreadCreateHook(void *hook, bool aborted) {
195 AsanThread *thread = static_cast<AsanThread *>(hook);
196 if (!aborted) {
197 // The thread was created successfully.
198 // ThreadStartHook is already running in the new thread.
199 } else {
200 // The thread wasn't created after all.
201 // Clean up everything we set up in BeforeThreadCreateHook.
202 asanThreadRegistry().FinishThread(thread->tid());
203 UnmapOrDie(thread, AsanThreadMmapSize());
204 }
205}
206
207// This is called in the newly-created thread before it runs anything else,
208// with the pointer returned by BeforeThreadCreateHook (above).
209// cf. asan_interceptors.cpp:asan_thread_start
210static void ThreadStartHook(void *hook, uptr os_id) {
211 AsanThread *thread = static_cast<AsanThread *>(hook);
212 SetCurrentThread(thread);
213
214 // In lieu of AsanThread::ThreadStart.
215 asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular,
216 nullptr);
217}
218
219// Each thread runs this just before it exits,
220// with the pointer returned by BeforeThreadCreateHook (above).
221// All per-thread destructors have already been called.
222static void ThreadExitHook(void *hook, uptr os_id) {
223 AsanThread::TSDDtor(per_thread);
224}
225
226bool HandleDlopenInit() {
227 // Not supported on this platform.
228 static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
229 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
230 return false;
231}
232
233void FlushUnneededASanShadowMemory(uptr p, uptr size) {
234 __sanitizer_fill_shadow(p, size, 0, 0);
235}
236
237// On Fuchsia, leak detection is done by a special hook after atexit hooks.
238// So this doesn't install any atexit hook like on other platforms.
239void InstallAtExitCheckLeaks() {}
240
241void InstallAtForkHandler() {}
242
243} // namespace __asan
244
245namespace __lsan {
246
247bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; }
248
249} // namespace __lsan
250
251// These are declared (in extern "C") by <zircon/sanitizer.h>.
252// The system runtime will call our definitions directly.
253
254void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
255 const char *name, void *stack_base,
256 size_t stack_size) {
257 return __asan::BeforeThreadCreateHook(
258 reinterpret_cast<uptr>(thread), detached, name,
259 reinterpret_cast<uptr>(stack_base), stack_size);
260}
261
262void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) {
263 __asan::ThreadCreateHook(hook, error != thrd_success);
264}
265
266void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
267 __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self));
268}
269
270void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {
271 __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self));
272}
273
274#endif // SANITIZER_FUCHSIA
275

source code of compiler-rt/lib/asan/asan_fuchsia.cpp