1//===-- hwasan_fuchsia.cpp --------------------------------------*- C++ -*-===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8/// 9/// \file 10/// This file is a part of HWAddressSanitizer and contains Fuchsia-specific 11/// code. 12/// 13//===----------------------------------------------------------------------===// 14 15#include "sanitizer_common/sanitizer_fuchsia.h" 16#if SANITIZER_FUCHSIA 17 18#include <zircon/features.h> 19#include <zircon/syscalls.h> 20 21#include "hwasan.h" 22#include "hwasan_interface_internal.h" 23#include "hwasan_report.h" 24#include "hwasan_thread.h" 25#include "hwasan_thread_list.h" 26 27// This TLS variable contains the location of the stack ring buffer and can be 28// used to always find the hwasan thread object associated with the current 29// running thread. 30[[gnu::tls_model("initial-exec")]] 31SANITIZER_INTERFACE_ATTRIBUTE 32THREADLOCAL uptr __hwasan_tls; 33 34namespace __hwasan { 35 36bool InitShadow() { 37 __sanitizer::InitShadowBounds(); 38 CHECK_NE(__sanitizer::ShadowBounds.shadow_limit, 0); 39 40 // These variables are used by MemIsShadow for asserting we have a correct 41 // shadow address. On Fuchsia, we only have one region of shadow, so the 42 // bounds of Low shadow can be zero while High shadow represents the true 43 // bounds. Note that these are inclusive ranges. 44 kLowShadowStart = 0; 45 kLowShadowEnd = 0; 46 kHighShadowStart = __sanitizer::ShadowBounds.shadow_base; 47 kHighShadowEnd = __sanitizer::ShadowBounds.shadow_limit - 1; 48 49 return true; 50} 51 52bool MemIsApp(uptr p) { 53 CHECK(GetTagFromPointer(p) == 0); 54 return __sanitizer::ShadowBounds.shadow_limit <= p && 55 p <= (__sanitizer::ShadowBounds.memory_limit - 1); 56} 57 58// These are known parameters passed to the hwasan runtime on thread creation. 59struct Thread::InitState { 60 uptr stack_bottom, stack_top; 61}; 62 63static void FinishThreadInitialization(Thread *thread); 64 65void InitThreads() { 66 // This is the minimal alignment needed for the storage where hwasan threads 67 // and their stack ring buffers are placed. This alignment is necessary so the 68 // stack ring buffer can perform a simple calculation to get the next element 69 // in the RB. The instructions for this calculation are emitted by the 70 // compiler. (Full explanation in hwasan_thread_list.h.) 71 uptr alloc_size = UINT64_C(1) << kShadowBaseAlignment; 72 uptr thread_start = reinterpret_cast<uptr>( 73 MmapAlignedOrDieOnFatalError(alloc_size, alloc_size, __func__)); 74 75 InitThreadList(thread_start, alloc_size); 76 77 // Create the hwasan thread object for the current (main) thread. Stack info 78 // for this thread is known from information passed via 79 // __sanitizer_startup_hook. 80 const Thread::InitState state = { 81 .stack_bottom = __sanitizer::MainThreadStackBase, 82 .stack_top = 83 __sanitizer::MainThreadStackBase + __sanitizer::MainThreadStackSize, 84 }; 85 FinishThreadInitialization(hwasanThreadList().CreateCurrentThread(&state)); 86} 87 88uptr *GetCurrentThreadLongPtr() { return &__hwasan_tls; } 89 90// This is called from the parent thread before the new thread is created. Here 91// we can propagate known info like the stack bounds to Thread::Init before 92// jumping into the thread. We cannot initialize the stack ring buffer yet since 93// we have not entered the new thread. 94static void *BeforeThreadCreateHook(uptr user_id, bool detached, 95 const char *name, uptr stack_bottom, 96 uptr stack_size) { 97 const Thread::InitState state = { 98 .stack_bottom = stack_bottom, 99 .stack_top = stack_bottom + stack_size, 100 }; 101 return hwasanThreadList().CreateCurrentThread(&state); 102} 103 104// This sets the stack top and bottom according to the InitState passed to 105// CreateCurrentThread above. 106void Thread::InitStackAndTls(const InitState *state) { 107 CHECK_NE(state->stack_bottom, 0); 108 CHECK_NE(state->stack_top, 0); 109 stack_bottom_ = state->stack_bottom; 110 stack_top_ = state->stack_top; 111 tls_end_ = tls_begin_ = 0; 112} 113 114// This is called after creating a new thread with the pointer returned by 115// BeforeThreadCreateHook. We are still in the creating thread and should check 116// if it was actually created correctly. 117static void ThreadCreateHook(void *hook, bool aborted) { 118 Thread *thread = static_cast<Thread *>(hook); 119 if (!aborted) { 120 // The thread was created successfully. 121 // ThreadStartHook can already be running in the new thread. 122 } else { 123 // The thread wasn't created after all. 124 // Clean up everything we set up in BeforeThreadCreateHook. 125 atomic_signal_fence(memory_order_seq_cst); 126 hwasanThreadList().ReleaseThread(thread); 127 } 128} 129 130// This is called in the newly-created thread before it runs anything else, 131// with the pointer returned by BeforeThreadCreateHook (above). Here we can 132// setup the stack ring buffer. 133static void ThreadStartHook(void *hook, thrd_t self) { 134 Thread *thread = static_cast<Thread *>(hook); 135 FinishThreadInitialization(thread); 136 thread->EnsureRandomStateInited(); 137} 138 139// This is the function that sets up the stack ring buffer and enables us to use 140// GetCurrentThread. This function should only be called while IN the thread 141// that we want to create the hwasan thread object for so __hwasan_tls can be 142// properly referenced. 143static void FinishThreadInitialization(Thread *thread) { 144 CHECK_NE(thread, nullptr); 145 146 // The ring buffer is located immediately before the thread object. 147 uptr stack_buffer_size = hwasanThreadList().GetRingBufferSize(); 148 uptr stack_buffer_start = reinterpret_cast<uptr>(thread) - stack_buffer_size; 149 thread->InitStackRingBuffer(stack_buffer_start, stack_buffer_size); 150} 151 152static void ThreadExitHook(void *hook, thrd_t self) { 153 Thread *thread = static_cast<Thread *>(hook); 154 atomic_signal_fence(memory_order_seq_cst); 155 hwasanThreadList().ReleaseThread(thread); 156} 157 158uptr TagMemoryAligned(uptr p, uptr size, tag_t tag) { 159 CHECK(IsAligned(p, kShadowAlignment)); 160 CHECK(IsAligned(size, kShadowAlignment)); 161 __sanitizer_fill_shadow(p, size, tag, 162 common_flags()->clear_shadow_mmap_threshold); 163 return AddTagToPointer(p, tag); 164} 165 166// Not implemented because Fuchsia does not use signal handlers. 167void HwasanOnDeadlySignal(int signo, void *info, void *context) {} 168 169// Not implemented because Fuchsia does not use interceptors. 170void InitializeInterceptors() {} 171 172// Not implemented because this is only relevant for Android. 173void AndroidTestTlsSlot() {} 174 175// TSD was normally used on linux as a means of calling the hwasan thread exit 176// handler passed to pthread_key_create. This is not needed on Fuchsia because 177// we will be using __sanitizer_thread_exit_hook. 178void HwasanTSDInit() {} 179void HwasanTSDThreadInit() {} 180 181// On linux, this just would call `atexit(HwasanAtExit)`. The functions in 182// HwasanAtExit are unimplemented for Fuchsia and effectively no-ops, so this 183// function is unneeded. 184void InstallAtExitHandler() {} 185 186void HwasanInstallAtForkHandler() {} 187 188void InstallAtExitCheckLeaks() {} 189 190void InitializeOsSupport() { 191#ifdef __aarch64__ 192 uint32_t features = 0; 193 CHECK_EQ(zx_system_get_features(ZX_FEATURE_KIND_ADDRESS_TAGGING, &features), 194 ZX_OK); 195 if (!(features & ZX_ARM64_FEATURE_ADDRESS_TAGGING_TBI) && 196 flags()->fail_without_syscall_abi) { 197 Printf( 198 "FATAL: HWAddressSanitizer requires " 199 "ZX_ARM64_FEATURE_ADDRESS_TAGGING_TBI.\n"); 200 Die(); 201 } 202#endif 203} 204 205} // namespace __hwasan 206 207namespace __lsan { 208 209bool UseExitcodeOnLeak() { return __hwasan::flags()->halt_on_error; } 210 211} // namespace __lsan 212 213extern "C" { 214 215void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached, 216 const char *name, void *stack_base, 217 size_t stack_size) { 218 return __hwasan::BeforeThreadCreateHook( 219 reinterpret_cast<uptr>(thread), detached, name, 220 reinterpret_cast<uptr>(stack_base), stack_size); 221} 222 223void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) { 224 __hwasan::ThreadCreateHook(hook, error != thrd_success); 225} 226 227void __sanitizer_thread_start_hook(void *hook, thrd_t self) { 228 __hwasan::ThreadStartHook(hook, reinterpret_cast<uptr>(self)); 229} 230 231void __sanitizer_thread_exit_hook(void *hook, thrd_t self) { 232 __hwasan::ThreadExitHook(hook, self); 233} 234 235void __sanitizer_module_loaded(const struct dl_phdr_info *info, size_t) { 236 __hwasan_library_loaded(info->dlpi_addr, info->dlpi_phdr, info->dlpi_phnum); 237} 238 239} // extern "C" 240 241#endif // SANITIZER_FUCHSIA 242