1//===-- asan_fuchsia.cpp -------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===---------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11// Fuchsia-specific details.
12//===---------------------------------------------------------------------===//
13
14#include "sanitizer_common/sanitizer_fuchsia.h"
15#if SANITIZER_FUCHSIA
16
17#include <limits.h>
18#include <zircon/sanitizer.h>
19#include <zircon/syscalls.h>
20#include <zircon/threads.h>
21
22#  include "asan_interceptors.h"
23#  include "asan_internal.h"
24#  include "asan_stack.h"
25#  include "asan_thread.h"
26#  include "lsan/lsan_common.h"
27
28namespace __asan {
29
30// The system already set up the shadow memory for us.
31// __sanitizer::GetMaxUserVirtualAddress has already been called by
32// AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp).
33// Just do some additional sanity checks here.
34void InitializeShadowMemory() {
35  if (Verbosity())
36    PrintAddressSpaceLayout();
37
38  // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.
39  __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
40  DCHECK(kLowShadowBeg != kDefaultShadowSentinel);
41  __asan_shadow_memory_dynamic_address = kLowShadowBeg;
42
43  CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
44  CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);
45  CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);
46  CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base);
47  CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1);
48  CHECK_EQ(kLowShadowEnd, 0);
49  CHECK_EQ(kLowShadowBeg, 0);
50}
51
52void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
53  UNIMPLEMENTED();
54}
55
56void AsanCheckDynamicRTPrereqs() {}
57void AsanCheckIncompatibleRT() {}
58void InitializeAsanInterceptors() {}
59
60void *AsanDoesNotSupportStaticLinkage() { return nullptr; }
61
62void InitializePlatformExceptionHandlers() {}
63void AsanOnDeadlySignal(int signo, void *siginfo, void *context) {
64  UNIMPLEMENTED();
65}
66
67bool PlatformUnpoisonStacks() {
68  // The current sp might not point to the default stack. This
69  // could be because we are in a crash stack from fuzzing for example.
70  // Unpoison the default stack and the current stack page.
71  AsanThread *curr_thread = GetCurrentThread();
72  CHECK(curr_thread != nullptr);
73  uptr top = curr_thread->stack_top();
74  uptr bottom = curr_thread->stack_bottom();
75  // The default stack grows from top to bottom. (bottom < top).
76
77  uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0));
78  if (local_stack >= bottom && local_stack <= top) {
79    // The current stack is the default stack.
80    // We only need to unpoison from where we are using until the end.
81    bottom = RoundDownTo(local_stack, GetPageSize());
82    UnpoisonStack(bottom, top, "default");
83  } else {
84    // The current stack is not the default stack.
85    // Unpoison the entire default stack and the current stack page.
86    UnpoisonStack(bottom, top, "default");
87    bottom = RoundDownTo(local_stack, GetPageSize());
88    top = bottom + GetPageSize();
89    UnpoisonStack(bottom, top, "unknown");
90    return true;
91  }
92
93  return false;
94}
95
96// We can use a plain thread_local variable for TSD.
97static thread_local void *per_thread;
98
99void *AsanTSDGet() { return per_thread; }
100
101void AsanTSDSet(void *tsd) { per_thread = tsd; }
102
103// There's no initialization needed, and the passed-in destructor
104// will never be called.  Instead, our own thread destruction hook
105// (below) will call AsanThread::TSDDtor directly.
106void AsanTSDInit(void (*destructor)(void *tsd)) {
107  DCHECK(destructor == &PlatformTSDDtor);
108}
109
110void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); }
111
112static inline size_t AsanThreadMmapSize() {
113  return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size());
114}
115
116struct AsanThread::InitOptions {
117  uptr stack_bottom, stack_size;
118};
119
120// Shared setup between thread creation and startup for the initial thread.
121static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid,
122                                    bool detached, const char *name) {
123  // In lieu of AsanThread::Create.
124  AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__);
125
126  AsanThreadContext::CreateThreadContextArgs args = {thread, stack};
127  u32 tid = asanThreadRegistry().CreateThread(0, detached, parent_tid, &args);
128  asanThreadRegistry().SetThreadName(tid, name);
129
130  return thread;
131}
132
133// This gets the same arguments passed to Init by CreateAsanThread, above.
134// We're in the creator thread before the new thread is actually started,
135// but its stack address range is already known.  We don't bother tracking
136// the static TLS address range because the system itself already uses an
137// ASan-aware allocator for that.
138void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) {
139  DCHECK_NE(GetCurrentThread(), this);
140  DCHECK_NE(GetCurrentThread(), nullptr);
141  CHECK_NE(options->stack_bottom, 0);
142  CHECK_NE(options->stack_size, 0);
143  stack_bottom_ = options->stack_bottom;
144  stack_top_ = options->stack_bottom + options->stack_size;
145}
146
147// Called by __asan::AsanInitInternal (asan_rtl.c).
148AsanThread *CreateMainThread() {
149  thrd_t self = thrd_current();
150  char name[ZX_MAX_NAME_LEN];
151  CHECK_NE(__sanitizer::MainThreadStackBase, 0);
152  CHECK_GT(__sanitizer::MainThreadStackSize, 0);
153  AsanThread *t = CreateAsanThread(
154      nullptr, 0, true,
155      _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name,
156                              sizeof(name)) == ZX_OK
157          ? name
158          : nullptr);
159  // We need to set the current thread before calling AsanThread::Init() below,
160  // since it reads the thread ID.
161  SetCurrentThread(t);
162  DCHECK_EQ(t->tid(), 0);
163
164  const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase,
165                                           __sanitizer::MainThreadStackSize};
166  t->Init(&options);
167
168  return t;
169}
170
171// This is called before each thread creation is attempted.  So, in
172// its first call, the calling thread is the initial and sole thread.
173static void *BeforeThreadCreateHook(uptr user_id, bool detached,
174                                    const char *name, uptr stack_bottom,
175                                    uptr stack_size) {
176  EnsureMainThreadIDIsCorrect();
177  // Strict init-order checking is thread-hostile.
178  if (flags()->strict_init_order)
179    StopInitOrderChecking();
180
181  GET_STACK_TRACE_THREAD;
182  u32 parent_tid = GetCurrentTidOrInvalid();
183
184  AsanThread *thread = CreateAsanThread(&stack, parent_tid, detached, name);
185
186  // On other systems, AsanThread::Init() is called from the new
187  // thread itself.  But on Fuchsia we already know the stack address
188  // range beforehand, so we can do most of the setup right now.
189  const AsanThread::InitOptions options = {stack_bottom, stack_size};
190  thread->Init(&options);
191  return thread;
192}
193
194// This is called after creating a new thread (in the creating thread),
195// with the pointer returned by BeforeThreadCreateHook (above).
196static void ThreadCreateHook(void *hook, bool aborted) {
197  AsanThread *thread = static_cast<AsanThread *>(hook);
198  if (!aborted) {
199    // The thread was created successfully.
200    // ThreadStartHook is already running in the new thread.
201  } else {
202    // The thread wasn't created after all.
203    // Clean up everything we set up in BeforeThreadCreateHook.
204    asanThreadRegistry().FinishThread(thread->tid());
205    UnmapOrDie(thread, AsanThreadMmapSize());
206  }
207}
208
209// This is called in the newly-created thread before it runs anything else,
210// with the pointer returned by BeforeThreadCreateHook (above).
211// cf. asan_interceptors.cpp:asan_thread_start
212static void ThreadStartHook(void *hook, uptr os_id) {
213  AsanThread *thread = static_cast<AsanThread *>(hook);
214  SetCurrentThread(thread);
215
216  // In lieu of AsanThread::ThreadStart.
217  asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular,
218                                   nullptr);
219}
220
221// Each thread runs this just before it exits,
222// with the pointer returned by BeforeThreadCreateHook (above).
223// All per-thread destructors have already been called.
224static void ThreadExitHook(void *hook, uptr os_id) {
225  AsanThread::TSDDtor(per_thread);
226}
227
228bool HandleDlopenInit() {
229  // Not supported on this platform.
230  static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
231                "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
232  return false;
233}
234
235void FlushUnneededASanShadowMemory(uptr p, uptr size) {
236  __sanitizer_fill_shadow(p, size, 0, 0);
237}
238
239// On Fuchsia, leak detection is done by a special hook after atexit hooks.
240// So this doesn't install any atexit hook like on other platforms.
241void InstallAtExitCheckLeaks() {}
242
243}  // namespace __asan
244
245namespace __lsan {
246
247bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; }
248
249}  // namespace __lsan
250
251// These are declared (in extern "C") by <zircon/sanitizer.h>.
252// The system runtime will call our definitions directly.
253
254void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
255                                            const char *name, void *stack_base,
256                                            size_t stack_size) {
257  return __asan::BeforeThreadCreateHook(
258      reinterpret_cast<uptr>(thread), detached, name,
259      reinterpret_cast<uptr>(stack_base), stack_size);
260}
261
262void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) {
263  __asan::ThreadCreateHook(hook, error != thrd_success);
264}
265
266void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
267  __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self));
268}
269
270void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {
271  __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self));
272}
273
274#endif  // SANITIZER_FUCHSIA
275