1//===-- asan_fuchsia.cpp -------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===---------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11// Fuchsia-specific details.
12//===---------------------------------------------------------------------===//
13
14#include "sanitizer_common/sanitizer_fuchsia.h"
15#if SANITIZER_FUCHSIA
16
17#include <limits.h>
18#include <zircon/sanitizer.h>
19#include <zircon/syscalls.h>
20#include <zircon/threads.h>
21
22# include "asan_interceptors.h"
23# include "asan_internal.h"
24# include "asan_stack.h"
25# include "asan_thread.h"
26# include "lsan/lsan_common.h"
27
28namespace __sanitizer {
29// ASan doesn't need to do anything else special in the startup hook.
30void EarlySanitizerInit() {}
31} // namespace __sanitizer
32
33namespace __asan {
34
35// The system already set up the shadow memory for us.
36// __sanitizer::GetMaxUserVirtualAddress has already been called by
37// AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp).
38// Just do some additional sanity checks here.
39void InitializeShadowMemory() {
40 if (Verbosity())
41 PrintAddressSpaceLayout();
42
43 // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.
44 __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
45 DCHECK(kLowShadowBeg != kDefaultShadowSentinel);
46 __asan_shadow_memory_dynamic_address = kLowShadowBeg;
47
48 CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
49 CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);
50 CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);
51 CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base);
52 CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1);
53 CHECK_EQ(kLowShadowEnd, 0);
54 CHECK_EQ(kLowShadowBeg, 0);
55}
56
57void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
58 UNIMPLEMENTED();
59}
60
61void AsanCheckDynamicRTPrereqs() {}
62void AsanCheckIncompatibleRT() {}
63void InitializeAsanInterceptors() {}
64
65void InitializePlatformExceptionHandlers() {}
66void AsanOnDeadlySignal(int signo, void *siginfo, void *context) {
67 UNIMPLEMENTED();
68}
69
70bool PlatformUnpoisonStacks() {
71 // The current sp might not point to the default stack. This
72 // could be because we are in a crash stack from fuzzing for example.
73 // Unpoison the default stack and the current stack page.
74 AsanThread *curr_thread = GetCurrentThread();
75 CHECK(curr_thread != nullptr);
76 uptr top = curr_thread->stack_top();
77 uptr bottom = curr_thread->stack_bottom();
78 // The default stack grows from top to bottom. (bottom < top).
79
80 uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0));
81 if (local_stack >= bottom && local_stack <= top) {
82 // The current stack is the default stack.
83 // We only need to unpoison from where we are using until the end.
84 bottom = RoundDownTo(local_stack, GetPageSize());
85 UnpoisonStack(bottom, top, "default");
86 } else {
87 // The current stack is not the default stack.
88 // Unpoison the entire default stack and the current stack page.
89 UnpoisonStack(bottom, top, "default");
90 bottom = RoundDownTo(local_stack, GetPageSize());
91 top = bottom + GetPageSize();
92 UnpoisonStack(bottom, top, "unknown");
93 return true;
94 }
95
96 return false;
97}
98
99// We can use a plain thread_local variable for TSD.
100static thread_local void *per_thread;
101
102void *AsanTSDGet() { return per_thread; }
103
104void AsanTSDSet(void *tsd) { per_thread = tsd; }
105
106// There's no initialization needed, and the passed-in destructor
107// will never be called. Instead, our own thread destruction hook
108// (below) will call AsanThread::TSDDtor directly.
109void AsanTSDInit(void (*destructor)(void *tsd)) {
110 DCHECK(destructor == &PlatformTSDDtor);
111}
112
113void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); }
114
115static inline size_t AsanThreadMmapSize() {
116 return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size());
117}
118
119struct AsanThread::InitOptions {
120 uptr stack_bottom, stack_size;
121};
122
123// Shared setup between thread creation and startup for the initial thread.
124static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid,
125 bool detached, const char *name) {
126 // In lieu of AsanThread::Create.
127 AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__);
128
129 u32 tid = asanThreadRegistry().CreateThread(0, detached, parent_tid, thread);
130 asanThreadRegistry().SetThreadName(tid, name);
131
132 return thread;
133}
134
135// This gets the same arguments passed to Init by CreateAsanThread, above.
136// We're in the creator thread before the new thread is actually started,
137// but its stack address range is already known. We don't bother tracking
138// the static TLS address range because the system itself already uses an
139// ASan-aware allocator for that.
140void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) {
141 DCHECK_NE(GetCurrentThread(), this);
142 DCHECK_NE(GetCurrentThread(), nullptr);
143 CHECK_NE(options->stack_bottom, 0);
144 CHECK_NE(options->stack_size, 0);
145 stack_bottom_ = options->stack_bottom;
146 stack_top_ = options->stack_bottom + options->stack_size;
147}
148
149// Called by __asan::AsanInitInternal (asan_rtl.c).
150AsanThread *CreateMainThread() {
151 thrd_t self = thrd_current();
152 char name[ZX_MAX_NAME_LEN];
153 CHECK_NE(__sanitizer::MainThreadStackBase, 0);
154 CHECK_GT(__sanitizer::MainThreadStackSize, 0);
155 AsanThread *t = CreateAsanThread(
156 nullptr, 0, true,
157 _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name,
158 sizeof(name)) == ZX_OK
159 ? name
160 : nullptr);
161 // We need to set the current thread before calling AsanThread::Init() below,
162 // since it reads the thread ID.
163 SetCurrentThread(t);
164 DCHECK_EQ(t->tid(), 0);
165
166 const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase,
167 __sanitizer::MainThreadStackSize};
168 t->Init(&options);
169
170 return t;
171}
172
173// This is called before each thread creation is attempted. So, in
174// its first call, the calling thread is the initial and sole thread.
175static void *BeforeThreadCreateHook(uptr user_id, bool detached,
176 const char *name, uptr stack_bottom,
177 uptr stack_size) {
178 EnsureMainThreadIDIsCorrect();
179 // Strict init-order checking is thread-hostile.
180 if (flags()->strict_init_order)
181 StopInitOrderChecking();
182
183 GET_STACK_TRACE_THREAD;
184 u32 parent_tid = GetCurrentTidOrInvalid();
185
186 AsanThread *thread = CreateAsanThread(&stack, parent_tid, detached, name);
187
188 // On other systems, AsanThread::Init() is called from the new
189 // thread itself. But on Fuchsia we already know the stack address
190 // range beforehand, so we can do most of the setup right now.
191 const AsanThread::InitOptions options = {stack_bottom, stack_size};
192 thread->Init(&options);
193 return thread;
194}
195
196// This is called after creating a new thread (in the creating thread),
197// with the pointer returned by BeforeThreadCreateHook (above).
198static void ThreadCreateHook(void *hook, bool aborted) {
199 AsanThread *thread = static_cast<AsanThread *>(hook);
200 if (!aborted) {
201 // The thread was created successfully.
202 // ThreadStartHook is already running in the new thread.
203 } else {
204 // The thread wasn't created after all.
205 // Clean up everything we set up in BeforeThreadCreateHook.
206 asanThreadRegistry().FinishThread(thread->tid());
207 UnmapOrDie(thread, AsanThreadMmapSize());
208 }
209}
210
211// This is called in the newly-created thread before it runs anything else,
212// with the pointer returned by BeforeThreadCreateHook (above).
213// cf. asan_interceptors.cpp:asan_thread_start
214static void ThreadStartHook(void *hook, uptr os_id) {
215 AsanThread *thread = static_cast<AsanThread *>(hook);
216 SetCurrentThread(thread);
217
218 // In lieu of AsanThread::ThreadStart.
219 asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular,
220 nullptr);
221}
222
223// Each thread runs this just before it exits,
224// with the pointer returned by BeforeThreadCreateHook (above).
225// All per-thread destructors have already been called.
226static void ThreadExitHook(void *hook, uptr os_id) {
227 AsanThread::TSDDtor(per_thread);
228}
229
230bool HandleDlopenInit() {
231 // Not supported on this platform.
232 static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
233 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
234 return false;
235}
236
237void FlushUnneededASanShadowMemory(uptr p, uptr size) {
238 __sanitizer_fill_shadow(p, size, 0, 0);
239}
240
241// On Fuchsia, leak detection is done by a special hook after atexit hooks.
242// So this doesn't install any atexit hook like on other platforms.
243void InstallAtExitCheckLeaks() {}
244
245void InstallAtForkHandler() {}
246
247} // namespace __asan
248
249namespace __lsan {
250
251bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; }
252
253} // namespace __lsan
254
255// These are declared (in extern "C") by <zircon/sanitizer.h>.
256// The system runtime will call our definitions directly.
257
258void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
259 const char *name, void *stack_base,
260 size_t stack_size) {
261 return __asan::BeforeThreadCreateHook(
262 reinterpret_cast<uptr>(thread), detached, name,
263 reinterpret_cast<uptr>(stack_base), stack_size);
264}
265
266void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) {
267 __asan::ThreadCreateHook(hook, error != thrd_success);
268}
269
270void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
271 __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self));
272}
273
274void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {
275 __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self));
276}
277
278#endif // SANITIZER_FUCHSIA
279