1//===-- asan_fuchsia.cpp -------------------------------------------------===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===---------------------------------------------------------------------===// 8// 9// This file is a part of AddressSanitizer, an address sanity checker. 10// 11// Fuchsia-specific details. 12//===---------------------------------------------------------------------===// 13 14#include "sanitizer_common/sanitizer_fuchsia.h" 15#if SANITIZER_FUCHSIA 16 17#include "asan_interceptors.h" 18#include "asan_internal.h" 19#include "asan_stack.h" 20#include "asan_thread.h" 21 22#include <limits.h> 23#include <zircon/sanitizer.h> 24#include <zircon/syscalls.h> 25#include <zircon/threads.h> 26 27namespace __asan { 28 29// The system already set up the shadow memory for us. 30// __sanitizer::GetMaxUserVirtualAddress has already been called by 31// AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp). 32// Just do some additional sanity checks here. 33void InitializeShadowMemory() { 34 if (Verbosity()) 35 PrintAddressSpaceLayout(); 36 37 // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address. 38 __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel; 39 DCHECK(kLowShadowBeg != kDefaultShadowSentinel); 40 __asan_shadow_memory_dynamic_address = kLowShadowBeg; 41 42 CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1); 43 CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1); 44 CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit); 45 CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base); 46 CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1); 47 CHECK_EQ(kLowShadowEnd, 0); 48 CHECK_EQ(kLowShadowBeg, 0); 49} 50 51void AsanApplyToGlobals(globals_op_fptr op, const void *needle) { 52 UNIMPLEMENTED(); 53} 54 55void AsanCheckDynamicRTPrereqs() {} 56void AsanCheckIncompatibleRT() {} 57void InitializeAsanInterceptors() {} 58 59void *AsanDoesNotSupportStaticLinkage() { return nullptr; } 60 61void InitializePlatformExceptionHandlers() {} 62void AsanOnDeadlySignal(int signo, void *siginfo, void *context) { 63 UNIMPLEMENTED(); 64} 65 66bool PlatformUnpoisonStacks() { 67 // The current sp might not point to the default stack. This 68 // could be because we are in a crash stack from fuzzing for example. 69 // Unpoison the default stack and the current stack page. 70 AsanThread *curr_thread = GetCurrentThread(); 71 CHECK(curr_thread != nullptr); 72 uptr top = curr_thread->stack_top(); 73 uptr bottom = curr_thread->stack_bottom(); 74 // The default stack grows from top to bottom. (bottom < top). 75 76 uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0)); 77 if (local_stack >= bottom && local_stack <= top) { 78 // The current stack is the default stack. 79 // We only need to unpoison from where we are using until the end. 80 bottom = RoundDownTo(local_stack, GetPageSize()); 81 UnpoisonStack(bottom, top, "default"); 82 } else { 83 // The current stack is not the default stack. 84 // Unpoison the entire default stack and the current stack page. 85 UnpoisonStack(bottom, top, "default"); 86 bottom = RoundDownTo(local_stack, GetPageSize()); 87 top = bottom + GetPageSize(); 88 UnpoisonStack(bottom, top, "unknown"); 89 return true; 90 } 91 92 return false; 93} 94 95// We can use a plain thread_local variable for TSD. 96static thread_local void *per_thread; 97 98void *AsanTSDGet() { return per_thread; } 99 100void AsanTSDSet(void *tsd) { per_thread = tsd; } 101 102// There's no initialization needed, and the passed-in destructor 103// will never be called. Instead, our own thread destruction hook 104// (below) will call AsanThread::TSDDtor directly. 105void AsanTSDInit(void (*destructor)(void *tsd)) { 106 DCHECK(destructor == &PlatformTSDDtor); 107} 108 109void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); } 110 111static inline size_t AsanThreadMmapSize() { 112 return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size()); 113} 114 115struct AsanThread::InitOptions { 116 uptr stack_bottom, stack_size; 117}; 118 119// Shared setup between thread creation and startup for the initial thread. 120static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid, 121 uptr user_id, bool detached, 122 const char *name) { 123 // In lieu of AsanThread::Create. 124 AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__); 125 126 AsanThreadContext::CreateThreadContextArgs args = {thread, stack}; 127 u32 tid = 128 asanThreadRegistry().CreateThread(user_id, detached, parent_tid, &args); 129 asanThreadRegistry().SetThreadName(tid, name); 130 131 return thread; 132} 133 134// This gets the same arguments passed to Init by CreateAsanThread, above. 135// We're in the creator thread before the new thread is actually started, 136// but its stack address range is already known. We don't bother tracking 137// the static TLS address range because the system itself already uses an 138// ASan-aware allocator for that. 139void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) { 140 DCHECK_NE(GetCurrentThread(), this); 141 DCHECK_NE(GetCurrentThread(), nullptr); 142 CHECK_NE(options->stack_bottom, 0); 143 CHECK_NE(options->stack_size, 0); 144 stack_bottom_ = options->stack_bottom; 145 stack_top_ = options->stack_bottom + options->stack_size; 146} 147 148// Called by __asan::AsanInitInternal (asan_rtl.c). 149AsanThread *CreateMainThread() { 150 thrd_t self = thrd_current(); 151 char name[ZX_MAX_NAME_LEN]; 152 CHECK_NE(__sanitizer::MainThreadStackBase, 0); 153 CHECK_GT(__sanitizer::MainThreadStackSize, 0); 154 AsanThread *t = CreateAsanThread( 155 nullptr, 0, reinterpret_cast<uptr>(self), true, 156 _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name, 157 sizeof(name)) == ZX_OK 158 ? name 159 : nullptr); 160 // We need to set the current thread before calling AsanThread::Init() below, 161 // since it reads the thread ID. 162 SetCurrentThread(t); 163 DCHECK_EQ(t->tid(), 0); 164 165 const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase, 166 __sanitizer::MainThreadStackSize}; 167 t->Init(&options); 168 169 return t; 170} 171 172// This is called before each thread creation is attempted. So, in 173// its first call, the calling thread is the initial and sole thread. 174static void *BeforeThreadCreateHook(uptr user_id, bool detached, 175 const char *name, uptr stack_bottom, 176 uptr stack_size) { 177 EnsureMainThreadIDIsCorrect(); 178 // Strict init-order checking is thread-hostile. 179 if (flags()->strict_init_order) 180 StopInitOrderChecking(); 181 182 GET_STACK_TRACE_THREAD; 183 u32 parent_tid = GetCurrentTidOrInvalid(); 184 185 AsanThread *thread = 186 CreateAsanThread(&stack, parent_tid, user_id, detached, name); 187 188 // On other systems, AsanThread::Init() is called from the new 189 // thread itself. But on Fuchsia we already know the stack address 190 // range beforehand, so we can do most of the setup right now. 191 const AsanThread::InitOptions options = {stack_bottom, stack_size}; 192 thread->Init(&options); 193 return thread; 194} 195 196// This is called after creating a new thread (in the creating thread), 197// with the pointer returned by BeforeThreadCreateHook (above). 198static void ThreadCreateHook(void *hook, bool aborted) { 199 AsanThread *thread = static_cast<AsanThread *>(hook); 200 if (!aborted) { 201 // The thread was created successfully. 202 // ThreadStartHook is already running in the new thread. 203 } else { 204 // The thread wasn't created after all. 205 // Clean up everything we set up in BeforeThreadCreateHook. 206 asanThreadRegistry().FinishThread(thread->tid()); 207 UnmapOrDie(thread, AsanThreadMmapSize()); 208 } 209} 210 211// This is called in the newly-created thread before it runs anything else, 212// with the pointer returned by BeforeThreadCreateHook (above). 213// cf. asan_interceptors.cpp:asan_thread_start 214static void ThreadStartHook(void *hook, uptr os_id) { 215 AsanThread *thread = static_cast<AsanThread *>(hook); 216 SetCurrentThread(thread); 217 218 // In lieu of AsanThread::ThreadStart. 219 asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular, 220 nullptr); 221} 222 223// Each thread runs this just before it exits, 224// with the pointer returned by BeforeThreadCreateHook (above). 225// All per-thread destructors have already been called. 226static void ThreadExitHook(void *hook, uptr os_id) { 227 AsanThread::TSDDtor(per_thread); 228} 229 230bool HandleDlopenInit() { 231 // Not supported on this platform. 232 static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN, 233 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false"); 234 return false; 235} 236 237void FlushUnneededASanShadowMemory(uptr p, uptr size) { 238 __sanitizer_fill_shadow(p, size, 0, 0); 239} 240 241} // namespace __asan 242 243// These are declared (in extern "C") by <zircon/sanitizer.h>. 244// The system runtime will call our definitions directly. 245 246void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached, 247 const char *name, void *stack_base, 248 size_t stack_size) { 249 return __asan::BeforeThreadCreateHook( 250 reinterpret_cast<uptr>(thread), detached, name, 251 reinterpret_cast<uptr>(stack_base), stack_size); 252} 253 254void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) { 255 __asan::ThreadCreateHook(hook, error != thrd_success); 256} 257 258void __sanitizer_thread_start_hook(void *hook, thrd_t self) { 259 __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self)); 260} 261 262void __sanitizer_thread_exit_hook(void *hook, thrd_t self) { 263 __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self)); 264} 265 266#endif // SANITIZER_FUCHSIA 267