hwasan_fuchsia.cpp revision 1.1.1.1
1//===-- hwasan_fuchsia.cpp --------------------------------------*- C++ -*-===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8/// 9/// \file 10/// This file is a part of HWAddressSanitizer and contains Fuchsia-specific 11/// code. 12/// 13//===----------------------------------------------------------------------===// 14 15#include "sanitizer_common/sanitizer_fuchsia.h" 16#if SANITIZER_FUCHSIA 17 18#include "hwasan.h" 19#include "hwasan_interface_internal.h" 20#include "hwasan_report.h" 21#include "hwasan_thread.h" 22#include "hwasan_thread_list.h" 23 24// This TLS variable contains the location of the stack ring buffer and can be 25// used to always find the hwasan thread object associated with the current 26// running thread. 27[[gnu::tls_model("initial-exec")]] 28SANITIZER_INTERFACE_ATTRIBUTE 29THREADLOCAL uptr __hwasan_tls; 30 31namespace __hwasan { 32 33bool InitShadow() { 34 __sanitizer::InitShadowBounds(); 35 CHECK_NE(__sanitizer::ShadowBounds.shadow_limit, 0); 36 37 // These variables are used by MemIsShadow for asserting we have a correct 38 // shadow address. On Fuchsia, we only have one region of shadow, so the 39 // bounds of Low shadow can be zero while High shadow represents the true 40 // bounds. Note that these are inclusive ranges. 41 kLowShadowStart = 0; 42 kLowShadowEnd = 0; 43 kHighShadowStart = __sanitizer::ShadowBounds.shadow_base; 44 kHighShadowEnd = __sanitizer::ShadowBounds.shadow_limit - 1; 45 46 return true; 47} 48 49bool MemIsApp(uptr p) { 50 CHECK(GetTagFromPointer(p) == 0); 51 return __sanitizer::ShadowBounds.shadow_limit <= p && 52 p <= (__sanitizer::ShadowBounds.memory_limit - 1); 53} 54 55// These are known parameters passed to the hwasan runtime on thread creation. 56struct Thread::InitState { 57 uptr stack_bottom, stack_top; 58}; 59 60static void FinishThreadInitialization(Thread *thread); 61 62void InitThreads() { 63 // This is the minimal alignment needed for the storage where hwasan threads 64 // and their stack ring buffers are placed. This alignment is necessary so the 65 // stack ring buffer can perform a simple calculation to get the next element 66 // in the RB. The instructions for this calculation are emitted by the 67 // compiler. (Full explanation in hwasan_thread_list.h.) 68 uptr alloc_size = UINT64_C(1) << kShadowBaseAlignment; 69 uptr thread_start = reinterpret_cast<uptr>( 70 MmapAlignedOrDieOnFatalError(alloc_size, alloc_size, __func__)); 71 72 InitThreadList(thread_start, alloc_size); 73 74 // Create the hwasan thread object for the current (main) thread. Stack info 75 // for this thread is known from information passed via 76 // __sanitizer_startup_hook. 77 const Thread::InitState state = { 78 .stack_bottom = __sanitizer::MainThreadStackBase, 79 .stack_top = 80 __sanitizer::MainThreadStackBase + __sanitizer::MainThreadStackSize, 81 }; 82 FinishThreadInitialization(hwasanThreadList().CreateCurrentThread(&state)); 83} 84 85uptr *GetCurrentThreadLongPtr() { return &__hwasan_tls; } 86 87// This is called from the parent thread before the new thread is created. Here 88// we can propagate known info like the stack bounds to Thread::Init before 89// jumping into the thread. We cannot initialize the stack ring buffer yet since 90// we have not entered the new thread. 91static void *BeforeThreadCreateHook(uptr user_id, bool detached, 92 const char *name, uptr stack_bottom, 93 uptr stack_size) { 94 const Thread::InitState state = { 95 .stack_bottom = stack_bottom, 96 .stack_top = stack_bottom + stack_size, 97 }; 98 return hwasanThreadList().CreateCurrentThread(&state); 99} 100 101// This sets the stack top and bottom according to the InitState passed to 102// CreateCurrentThread above. 103void Thread::InitStackAndTls(const InitState *state) { 104 CHECK_NE(state->stack_bottom, 0); 105 CHECK_NE(state->stack_top, 0); 106 stack_bottom_ = state->stack_bottom; 107 stack_top_ = state->stack_top; 108 tls_end_ = tls_begin_ = 0; 109} 110 111// This is called after creating a new thread with the pointer returned by 112// BeforeThreadCreateHook. We are still in the creating thread and should check 113// if it was actually created correctly. 114static void ThreadCreateHook(void *hook, bool aborted) { 115 Thread *thread = static_cast<Thread *>(hook); 116 if (!aborted) { 117 // The thread was created successfully. 118 // ThreadStartHook can already be running in the new thread. 119 } else { 120 // The thread wasn't created after all. 121 // Clean up everything we set up in BeforeThreadCreateHook. 122 atomic_signal_fence(memory_order_seq_cst); 123 hwasanThreadList().ReleaseThread(thread); 124 } 125} 126 127// This is called in the newly-created thread before it runs anything else, 128// with the pointer returned by BeforeThreadCreateHook (above). Here we can 129// setup the stack ring buffer. 130static void ThreadStartHook(void *hook, thrd_t self) { 131 Thread *thread = static_cast<Thread *>(hook); 132 FinishThreadInitialization(thread); 133 thread->EnsureRandomStateInited(); 134} 135 136// This is the function that sets up the stack ring buffer and enables us to use 137// GetCurrentThread. This function should only be called while IN the thread 138// that we want to create the hwasan thread object for so __hwasan_tls can be 139// properly referenced. 140static void FinishThreadInitialization(Thread *thread) { 141 CHECK_NE(thread, nullptr); 142 143 // The ring buffer is located immediately before the thread object. 144 uptr stack_buffer_size = hwasanThreadList().GetRingBufferSize(); 145 uptr stack_buffer_start = reinterpret_cast<uptr>(thread) - stack_buffer_size; 146 thread->InitStackRingBuffer(stack_buffer_start, stack_buffer_size); 147} 148 149static void ThreadExitHook(void *hook, thrd_t self) { 150 Thread *thread = static_cast<Thread *>(hook); 151 atomic_signal_fence(memory_order_seq_cst); 152 hwasanThreadList().ReleaseThread(thread); 153} 154 155uptr TagMemoryAligned(uptr p, uptr size, tag_t tag) { 156 CHECK(IsAligned(p, kShadowAlignment)); 157 CHECK(IsAligned(size, kShadowAlignment)); 158 __sanitizer_fill_shadow(p, size, tag, 159 common_flags()->clear_shadow_mmap_threshold); 160 return AddTagToPointer(p, tag); 161} 162 163// Not implemented because Fuchsia does not use signal handlers. 164void HwasanOnDeadlySignal(int signo, void *info, void *context) {} 165 166// Not implemented because Fuchsia does not use interceptors. 167void InitializeInterceptors() {} 168 169// Not implemented because this is only relevant for Android. 170void AndroidTestTlsSlot() {} 171 172// TSD was normally used on linux as a means of calling the hwasan thread exit 173// handler passed to pthread_key_create. This is not needed on Fuchsia because 174// we will be using __sanitizer_thread_exit_hook. 175void HwasanTSDInit() {} 176void HwasanTSDThreadInit() {} 177 178// On linux, this just would call `atexit(HwasanAtExit)`. The functions in 179// HwasanAtExit are unimplemented for Fuchsia and effectively no-ops, so this 180// function is unneeded. 181void InstallAtExitHandler() {} 182 183void HwasanInstallAtForkHandler() {} 184 185// TODO(fxbug.dev/81499): Once we finalize the tagged pointer ABI in zircon, we should come back 186// here and implement the appropriate check that TBI is enabled. 187void InitializeOsSupport() {} 188 189} // namespace __hwasan 190 191extern "C" { 192 193void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached, 194 const char *name, void *stack_base, 195 size_t stack_size) { 196 return __hwasan::BeforeThreadCreateHook( 197 reinterpret_cast<uptr>(thread), detached, name, 198 reinterpret_cast<uptr>(stack_base), stack_size); 199} 200 201void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) { 202 __hwasan::ThreadCreateHook(hook, error != thrd_success); 203} 204 205void __sanitizer_thread_start_hook(void *hook, thrd_t self) { 206 __hwasan::ThreadStartHook(hook, reinterpret_cast<uptr>(self)); 207} 208 209void __sanitizer_thread_exit_hook(void *hook, thrd_t self) { 210 __hwasan::ThreadExitHook(hook, self); 211} 212 213} // extern "C" 214 215#endif // SANITIZER_FUCHSIA 216