1//===-- asan_fuchsia.cpp -------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===---------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11// Fuchsia-specific details.
12//===---------------------------------------------------------------------===//
13
14#include "sanitizer_common/sanitizer_fuchsia.h"
15#if SANITIZER_FUCHSIA
16
17#include "asan_interceptors.h"
18#include "asan_internal.h"
19#include "asan_stack.h"
20#include "asan_thread.h"
21
22#include <limits.h>
23#include <zircon/sanitizer.h>
24#include <zircon/syscalls.h>
25#include <zircon/threads.h>
26
27namespace __asan {
28
29// The system already set up the shadow memory for us.
30// __sanitizer::GetMaxUserVirtualAddress has already been called by
31// AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp).
32// Just do some additional sanity checks here.
33void InitializeShadowMemory() {
34  if (Verbosity())
35    PrintAddressSpaceLayout();
36
37  // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.
38  __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
39  DCHECK(kLowShadowBeg != kDefaultShadowSentinel);
40  __asan_shadow_memory_dynamic_address = kLowShadowBeg;
41
42  CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
43  CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);
44  CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);
45  CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base);
46  CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1);
47  CHECK_EQ(kLowShadowEnd, 0);
48  CHECK_EQ(kLowShadowBeg, 0);
49}
50
51void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
52  UNIMPLEMENTED();
53}
54
55void AsanCheckDynamicRTPrereqs() {}
56void AsanCheckIncompatibleRT() {}
57void InitializeAsanInterceptors() {}
58
59void *AsanDoesNotSupportStaticLinkage() { return nullptr; }
60
61void InitializePlatformExceptionHandlers() {}
62void AsanOnDeadlySignal(int signo, void *siginfo, void *context) {
63  UNIMPLEMENTED();
64}
65
66bool PlatformUnpoisonStacks() {
67  // The current sp might not point to the default stack. This
68  // could be because we are in a crash stack from fuzzing for example.
69  // Unpoison the default stack and the current stack page.
70  AsanThread *curr_thread = GetCurrentThread();
71  CHECK(curr_thread != nullptr);
72  uptr top = curr_thread->stack_top();
73  uptr bottom = curr_thread->stack_bottom();
74  // The default stack grows from top to bottom. (bottom < top).
75
76  uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0));
77  if (local_stack >= bottom && local_stack <= top) {
78    // The current stack is the default stack.
79    // We only need to unpoison from where we are using until the end.
80    bottom = RoundDownTo(local_stack, GetPageSize());
81    UnpoisonStack(bottom, top, "default");
82  } else {
83    // The current stack is not the default stack.
84    // Unpoison the entire default stack and the current stack page.
85    UnpoisonStack(bottom, top, "default");
86    bottom = RoundDownTo(local_stack, GetPageSize());
87    top = bottom + GetPageSize();
88    UnpoisonStack(bottom, top, "unknown");
89    return true;
90  }
91
92  return false;
93}
94
95// We can use a plain thread_local variable for TSD.
96static thread_local void *per_thread;
97
98void *AsanTSDGet() { return per_thread; }
99
100void AsanTSDSet(void *tsd) { per_thread = tsd; }
101
102// There's no initialization needed, and the passed-in destructor
103// will never be called.  Instead, our own thread destruction hook
104// (below) will call AsanThread::TSDDtor directly.
105void AsanTSDInit(void (*destructor)(void *tsd)) {
106  DCHECK(destructor == &PlatformTSDDtor);
107}
108
109void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); }
110
111static inline size_t AsanThreadMmapSize() {
112  return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size());
113}
114
115struct AsanThread::InitOptions {
116  uptr stack_bottom, stack_size;
117};
118
119// Shared setup between thread creation and startup for the initial thread.
120static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid,
121                                    uptr user_id, bool detached,
122                                    const char *name) {
123  // In lieu of AsanThread::Create.
124  AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__);
125
126  AsanThreadContext::CreateThreadContextArgs args = {thread, stack};
127  u32 tid =
128      asanThreadRegistry().CreateThread(user_id, detached, parent_tid, &args);
129  asanThreadRegistry().SetThreadName(tid, name);
130
131  return thread;
132}
133
134// This gets the same arguments passed to Init by CreateAsanThread, above.
135// We're in the creator thread before the new thread is actually started,
136// but its stack address range is already known.  We don't bother tracking
137// the static TLS address range because the system itself already uses an
138// ASan-aware allocator for that.
139void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) {
140  DCHECK_NE(GetCurrentThread(), this);
141  DCHECK_NE(GetCurrentThread(), nullptr);
142  CHECK_NE(options->stack_bottom, 0);
143  CHECK_NE(options->stack_size, 0);
144  stack_bottom_ = options->stack_bottom;
145  stack_top_ = options->stack_bottom + options->stack_size;
146}
147
148// Called by __asan::AsanInitInternal (asan_rtl.c).
149AsanThread *CreateMainThread() {
150  thrd_t self = thrd_current();
151  char name[ZX_MAX_NAME_LEN];
152  CHECK_NE(__sanitizer::MainThreadStackBase, 0);
153  CHECK_GT(__sanitizer::MainThreadStackSize, 0);
154  AsanThread *t = CreateAsanThread(
155      nullptr, 0, reinterpret_cast<uptr>(self), true,
156      _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name,
157                              sizeof(name)) == ZX_OK
158          ? name
159          : nullptr);
160  // We need to set the current thread before calling AsanThread::Init() below,
161  // since it reads the thread ID.
162  SetCurrentThread(t);
163  DCHECK_EQ(t->tid(), 0);
164
165  const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase,
166                                           __sanitizer::MainThreadStackSize};
167  t->Init(&options);
168
169  return t;
170}
171
172// This is called before each thread creation is attempted.  So, in
173// its first call, the calling thread is the initial and sole thread.
174static void *BeforeThreadCreateHook(uptr user_id, bool detached,
175                                    const char *name, uptr stack_bottom,
176                                    uptr stack_size) {
177  EnsureMainThreadIDIsCorrect();
178  // Strict init-order checking is thread-hostile.
179  if (flags()->strict_init_order)
180    StopInitOrderChecking();
181
182  GET_STACK_TRACE_THREAD;
183  u32 parent_tid = GetCurrentTidOrInvalid();
184
185  AsanThread *thread =
186      CreateAsanThread(&stack, parent_tid, user_id, detached, name);
187
188  // On other systems, AsanThread::Init() is called from the new
189  // thread itself.  But on Fuchsia we already know the stack address
190  // range beforehand, so we can do most of the setup right now.
191  const AsanThread::InitOptions options = {stack_bottom, stack_size};
192  thread->Init(&options);
193  return thread;
194}
195
196// This is called after creating a new thread (in the creating thread),
197// with the pointer returned by BeforeThreadCreateHook (above).
198static void ThreadCreateHook(void *hook, bool aborted) {
199  AsanThread *thread = static_cast<AsanThread *>(hook);
200  if (!aborted) {
201    // The thread was created successfully.
202    // ThreadStartHook is already running in the new thread.
203  } else {
204    // The thread wasn't created after all.
205    // Clean up everything we set up in BeforeThreadCreateHook.
206    asanThreadRegistry().FinishThread(thread->tid());
207    UnmapOrDie(thread, AsanThreadMmapSize());
208  }
209}
210
211// This is called in the newly-created thread before it runs anything else,
212// with the pointer returned by BeforeThreadCreateHook (above).
213// cf. asan_interceptors.cpp:asan_thread_start
214static void ThreadStartHook(void *hook, uptr os_id) {
215  AsanThread *thread = static_cast<AsanThread *>(hook);
216  SetCurrentThread(thread);
217
218  // In lieu of AsanThread::ThreadStart.
219  asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular,
220                                   nullptr);
221}
222
223// Each thread runs this just before it exits,
224// with the pointer returned by BeforeThreadCreateHook (above).
225// All per-thread destructors have already been called.
226static void ThreadExitHook(void *hook, uptr os_id) {
227  AsanThread::TSDDtor(per_thread);
228}
229
230bool HandleDlopenInit() {
231  // Not supported on this platform.
232  static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
233                "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
234  return false;
235}
236
237void FlushUnneededASanShadowMemory(uptr p, uptr size) {
238  __sanitizer_fill_shadow(p, size, 0, 0);
239}
240
241}  // namespace __asan
242
243// These are declared (in extern "C") by <zircon/sanitizer.h>.
244// The system runtime will call our definitions directly.
245
246void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
247                                            const char *name, void *stack_base,
248                                            size_t stack_size) {
249  return __asan::BeforeThreadCreateHook(
250      reinterpret_cast<uptr>(thread), detached, name,
251      reinterpret_cast<uptr>(stack_base), stack_size);
252}
253
254void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) {
255  __asan::ThreadCreateHook(hook, error != thrd_success);
256}
257
258void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
259  __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self));
260}
261
262void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {
263  __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self));
264}
265
266#endif  // SANITIZER_FUCHSIA
267