[WIP][clang][Fuchsia] Support HWASan for Fuchsia

[leonardchan]

Summary

This tracks all the compiler/llvm changes needed for building Fuchsia with the HWASan variant.

[pcc]

How does Zircon handle tagged addresses in syscalls? Are they handled equivalently to Linux's tagged address ABI?

[leonardchan]

Locally I'm able to build and run the bringup.arm64 config (that is launch the shell and run some commands).

[leonardchan]

In D91466#2395297, @pcc wrote:

How does Zircon handle tagged addresses in syscalls? Are they handled equivalently to Linux's tagged address ABI?

Woops, accidentally let this slide. I'm guessing you saw this in the Fuchsia patch, but I believe we haven't made a final decision yet on how syscalls will handle tagged pointers.

[phosek]

clang/lib/Driver/ToolChains/Fuchsia.cpp

100–101 ↗

(On Diff #317118)

Nit: can you move this above TSan so it's alphabetically sorted?

222 ↗

(On Diff #317118)

222–229 ↗

(On Diff #317118)

Can you move this above relative-vtables so we keep all sanitizers together?

225 ↗

(On Diff #317118)

compiler-rt/lib/hwasan/hwasan_fuchsia.cpp

123–125

I don't think this applies to Fuchsia.

compiler-rt/lib/hwasan/hwasan_poisoning.cpp

22

It might be better to move this function to a per-platform file rather than conditionally compiling the entire body.

[phosek]

@leonardchan would it be possible to break up this patch into multiple changes:

• Clang driver
• Cache file
• hwasan_new_delete.cpp
• HWAddressSanitizer.cpp
• sanitizer_platform_limits_fuchsia.h
• sanitizer_symbolizer_markup.cpp
• the rest

[leonardchan]

Rebase against submitted changes.

[leonardchan]

Rebased.

[leonardchan]

compiler-rt/lib/hwasan/hwasan_dynamic_shadow.cpp

122

Add comment. Fuchsia never uses dynamic shadow, which is what this sets up in the Linux implementation.

From linux implemenation:

// Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This
// needs to be done before other ifunc resolvers (which are handled by libc)
// because a resolver might read __hwasan_shadow.

compiler-rt/lib/hwasan/hwasan_fuchsia.cpp

47–52

Compare hwasan thread tracking implementation with asan + fuchsia implementation. HWASan uses different sanitizer machinery.

54

This can be replaced with a zircon-equivalent check that checks if TBI is enabled. This function is Linux-specific.

TODO: File a bug that tracks this once the TBI stuff is addressed.

61

See equivalent for other asan+lsan implementations. We use fuchsia sanitizer hooks instead of atexit. __sanitizer_exit_hook is what's used.

65–75

Don't define these. Move this logic into the hooks.

Ask why these are in the public header when we already have the thread hooks.

106–112

This is compiler-defined and should be abstracted out. Shouldn't have duplicate definitions.

106–131

This could probably be shared code with the Linux implementation. Move out of hwasan.

147–148

Ideally, the checks on these uninitialized globals should not be called.

[leonardchan]

Update to some feedback from first round of reviews. Minor refactoring of code that can be shared between the linux and fuchsia implementations. Still need to discuss refactoring the hwasan threads implementation.

clang/cmake/caches/Fuchsia-stage2.cmake

foreach(target x86_64;aarch64)
     set(RUNTIMES_${target}-unknown-fuchsia+relative-vtables+asan+noexcept_LIBCXXABI_ENABLE_EXCEPTIONS OFF CACHE BOOL "")
     set(RUNTIMES_${target}-unknown-fuchsia+relative-vtables+asan+noexcept_LIBCXX_ENABLE_EXCEPTIONS OFF CACHE BOOL "")
     set(RUNTIMES_${target}-unknown-fuchsia+relative-vtables+asan+noexcept_CMAKE_CXX_FLAGS "${RUNTIMES_${target}-unknown-fuchsia+relative-vtables+asan+noexcept_CMAKE_CXX_FLAGS} -Xclang -fexperimental-relative-c++-abi-vtables" CACHE STRING "")
 
     # Use .build-id link.
     list(APPEND RUNTIME_BUILD_ID_LINK "${target}-unknown-fuchsia")
   endforeach()
 
-  set(LLVM_RUNTIME_MULTILIBS "asan;noexcept;asan+noexcept;relative-vtables;relative-vtables+noexcept;relative-vtables+asan;relative-vtables+asan+noexcept" CACHE STRING "")
+  # HWAsan
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan_LLVM_BUILD_COMPILER_RT OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan_LLVM_USE_SANITIZER "HWAddress" CACHE STRING "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan_LIBCXXABI_ENABLE_NEW_DELETE_DEFINITIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan_LIBCXX_ENABLE_NEW_DELETE_DEFINITIONS OFF CACHE BOOL "")
+
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan_LLVM_BUILD_COMPILER_RT OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan_LLVM_USE_SANITIZER "HWAddress" CACHE STRING "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan_LIBCXXABI_ENABLE_NEW_DELETE_DEFINITIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan_LIBCXX_ENABLE_NEW_DELETE_DEFINITIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan_CMAKE_CXX_FLAGS "${RUNTIMES_${target}-unknown-fuchsia+relative-vtables+hwasan_CMAKE_CXX_FLAGS} -Xclang -fexperimental-relative-c++-abi-vtables" CACHE STRING "")
+
+  # HWASan+noexcept
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan+noexcept_LLVM_BUILD_COMPILER_RT OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan+noexcept_LLVM_USE_SANITIZER "HWAddress" CACHE STRING "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan+noexcept_LIBCXXABI_ENABLE_NEW_DELETE_DEFINITIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan+noexcept_LIBCXX_ENABLE_NEW_DELETE_DEFINITIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan+noexcept_LIBCXXABI_ENABLE_EXCEPTIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+hwasan+noexcept_LIBCXX_ENABLE_EXCEPTIONS OFF CACHE BOOL "")
+
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan+noexcept_LLVM_BUILD_COMPILER_RT OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan+noexcept_LLVM_USE_SANITIZER "HWAddress" CACHE STRING "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan+noexcept_LIBCXXABI_ENABLE_NEW_DELETE_DEFINITIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan+noexcept_LIBCXX_ENABLE_NEW_DELETE_DEFINITIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan+noexcept_LIBCXXABI_ENABLE_EXCEPTIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan+noexcept_LIBCXX_ENABLE_EXCEPTIONS OFF CACHE BOOL "")
+  set(RUNTIMES_aarch64-unknown-fuchsia+relative-vtables+hwasan+noexcept_CMAKE_CXX_FLAGS "${RUNTIMES_${target}-unknown-fuchsia+relative-vtables+hwasan+noexcept_CMAKE_CXX_FLAGS} -Xclang -fexperimental-relative-c++-abi-vtables" CACHE STRING "")
+
+  set(LLVM_RUNTIME_MULTILIBS
+      "asan;noexcept;asan+noexcept;relative-vtables;relative-vtables+noexcept;relative-vtables+asan;relative-vtables+asan+noexcept;hwasan;hwasan+noexcept;relative-vtables+hwasan;relative-vtables+hwasan+noexcept" CACHE STRING "")
+
   set(LLVM_RUNTIME_MULTILIB_asan_TARGETS "x86_64-unknown-fuchsia;aarch64-unknown-fuchsia" CACHE STRING "")
   set(LLVM_RUNTIME_MULTILIB_noexcept_TARGETS "x86_64-unknown-fuchsia;aarch64-unknown-fuchsia" CACHE STRING "")
   set(LLVM_RUNTIME_MULTILIB_asan+noexcept_TARGETS "x86_64-unknown-fuchsia;aarch64-unknown-fuchsia" CACHE STRING "")
   set(LLVM_RUNTIME_MULTILIB_relative-vtables_TARGETS "x86_64-unknown-fuchsia;aarch64-unknown-fuchsia" CACHE STRING "")
   set(LLVM_RUNTIME_MULTILIB_relative-vtables+noexcept_TARGETS "x86_64-unknown-fuchsia;aarch64-unknown-fuchsia" CACHE STRING "")
   set(LLVM_RUNTIME_MULTILIB_relative-vtables+asan_TARGETS "x86_64-unknown-fuchsia;aarch64-unknown-fuchsia" CACHE STRING "")
   set(LLVM_RUNTIME_MULTILIB_relative-vtables+asan+noexcept_TARGETS "x86_64-unknown-fuchsia;aarch64-unknown-fuchsia" CACHE STRING "")
+  set(LLVM_RUNTIME_MULTILIB_hwasan_TARGETS "aarch64-unknown-fuchsia" CACHE STRING "")
+  set(LLVM_RUNTIME_MULTILIB_hwasan+noexcept_TARGETS "aarch64-unknown-fuchsia" CACHE STRING "")
+  set(LLVM_RUNTIME_MULTILIB_relative-vtables+hwasan_TARGETS "aarch64-unknown-fuchsia" CACHE STRING "")
+  set(LLVM_RUNTIME_MULTILIB_relative-vtables+hwasan+noexcept_TARGETS "aarch64-unknown-fuchsia" CACHE STRING "")
 endif()
 
 set(LLVM_BUILTIN_TARGETS "${BUILTIN_TARGETS}" CACHE STRING "")
 set(LLVM_RUNTIME_TARGETS "${RUNTIME_TARGETS}" CACHE STRING "")
 
 # Setup toolchain.
 set(LLVM_INSTALL_TOOLCHAIN_ONLY ON CACHE BOOL "")
 set(LLVM_TOOLCHAIN_TOOLS

compiler-rt/cmake/config-ix.cmake

 if (COMPILER_RT_HAS_SANITIZER_COMMON AND MSAN_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Linux|FreeBSD|NetBSD")
   set(COMPILER_RT_HAS_MSAN TRUE)
 else()
   set(COMPILER_RT_HAS_MSAN FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND HWASAN_SUPPORTED_ARCH AND
-    OS_NAME MATCHES "Linux|Android")
+    OS_NAME MATCHES "Linux|Android|Fuchsia")
   set(COMPILER_RT_HAS_HWASAN TRUE)
 else()
   set(COMPILER_RT_HAS_HWASAN FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND MEMPROF_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Linux")
   set(COMPILER_RT_HAS_MEMPROF TRUE)

compiler-rt/lib/hwasan/CMakeLists.txt

 include_directories(..)
 
 # Runtime library sources and build flags.
 set(HWASAN_RTL_SOURCES
   hwasan.cpp
   hwasan_allocator.cpp
   hwasan_dynamic_shadow.cpp
   hwasan_exceptions.cpp
+  hwasan_fuchsia.cpp
   hwasan_globals.cpp
   hwasan_interceptors.cpp
   hwasan_interceptors_vfork.S
   hwasan_linux.cpp
   hwasan_memintrinsics.cpp
   hwasan_poisoning.cpp
   hwasan_report.cpp
   hwasan_setjmp.S
set(HWASAN_RTL_HEADERS
   hwasan_mapping.h
   hwasan_poisoning.h
   hwasan_report.h
   hwasan_thread.h
   hwasan_thread_list.h
   )
 
 set(HWASAN_DEFINITIONS)
+if (NOT FUCHSIA)
   append_list_if(COMPILER_RT_HWASAN_WITH_INTERCEPTORS HWASAN_WITH_INTERCEPTORS=1 HWASAN_DEFINITIONS)
+else()
+  list(APPEND HWASAN_DEFINITIONS HWASAN_REPLACE_OPERATORS_NEW_AND_DELETE=1)
+endif()
 
 set(HWASAN_RTL_CFLAGS ${SANITIZER_COMMON_CFLAGS})
 append_rtti_flag(OFF HWASAN_RTL_CFLAGS)
 append_list_if(COMPILER_RT_HAS_FPIC_FLAG -fPIC HWASAN_RTL_CFLAGS)
 # Prevent clang from generating libc calls.
 append_list_if(COMPILER_RT_HAS_FFREESTANDING_FLAG -ffreestanding HWASAN_RTL_CFLAGS)
 
 set(HWASAN_DYNAMIC_LINK_FLAGS ${SANITIZER_COMMON_LINK_FLAGS})

compiler-rt/lib/hwasan/hwasan.h

 #define PRINT_CURRENT_STACK_CHECK() \
   {                                 \
     GET_FATAL_STACK_TRACE_HERE;     \
     stack.Print();                  \
   }
 
 void HwasanTSDInit();
 void HwasanTSDThreadInit();
+void HwasanAtExit(void);
 
 void HwasanOnDeadlySignal(int signo, void *info, void *context);
 
 void UpdateMemoryUsage();
 
 void AppendToErrorMessageBuffer(const char *buffer);
 
 void AndroidTestTlsSlot();
 
+// This is a compiler-generated struct that can be shared between hwasan
+// implementations.
+struct AccessInfo {
+  uptr addr;
+  uptr size;
+  bool is_store;
+  bool is_load;
+  bool recover;
+};
+
+void HandleTagMismatch(AccessInfo ai, uptr pc, uptr frame,
+                       void *uc, uptr *registers_frame = nullptr);
+void HwasanTagMismatch(uptr addr, uptr access_info,
+                       uptr *registers_frame, size_t outsize);
+
 }  // namespace __hwasan
 
 #define HWASAN_MALLOC_HOOK(ptr, size)       \
   do {                                    \
     if (&__sanitizer_malloc_hook) {       \
       __sanitizer_malloc_hook(ptr, size); \
     }                                     \
     RunMallocHooks(ptr, size);            \

compiler-rt/lib/hwasan/hwasan.cpp

void UpdateMemoryUsage() {
   HwasanFormatMemoryUsage(s);
   internal_strncpy(memory_usage_buffer, s.data(), kMemoryUsageBufferSize - 1);
   memory_usage_buffer[kMemoryUsageBufferSize - 1] = '\0';
 }
 #else
 void UpdateMemoryUsage() {}
 #endif
 
+void HwasanAtExit(void) {
+  if (common_flags()->print_module_map)
+    DumpProcessMap();
+  if (flags()->print_stats && (flags()->atexit || hwasan_report_count > 0))
+    ReportStats();
+  if (hwasan_report_count > 0) {
+    // ReportAtExitStatistics();
+    if (common_flags()->exitcode)
+      internal__exit(common_flags()->exitcode);
+  }
+}
+
+void HandleTagMismatch(AccessInfo ai, uptr pc, uptr frame,
+                       void *uc, uptr *registers_frame) {
+  InternalMmapVector<BufferedStackTrace> stack_buffer(1);
+  BufferedStackTrace *stack = stack_buffer.data();
+  stack->Reset();
+  stack->Unwind(pc, frame, uc, common_flags()->fast_unwind_on_fatal);
+
+  // The second stack frame contains the failure __hwasan_check function, as
+  // we have a stack frame for the registers saved in __hwasan_tag_mismatch that
+  // we wish to ignore. This (currently) only occurs on AArch64, as x64
+  // implementations use SIGTRAP to implement the failure, and thus do not go
+  // through the stack saver.
+  if (registers_frame && stack->trace && stack->size > 0) {
+    stack->trace++;
+    stack->size--;
+  }
+
+  bool fatal = flags()->halt_on_error || !ai.recover;
+  ReportTagMismatch(stack, ai.addr, ai.size, ai.is_store, fatal,
+                    registers_frame);
+}
+
+void HwasanTagMismatch(uptr addr, uptr access_info,
+                       uptr *registers_frame, size_t outsize) {
+  AccessInfo ai;
+  ai.is_store = access_info & 0x10;
+  ai.is_load = !ai.is_store;
+  ai.recover = access_info & 0x20;
+  ai.addr = addr;
+  if ((access_info & 0xf) == 0xf)
+    ai.size = outsize;
+  else
+    ai.size = 1 << (access_info & 0xf);
+
+  HandleTagMismatch(ai, (uptr)__builtin_return_address(0),
+                    (uptr)__builtin_frame_address(0), nullptr,
+                    registers_frame);
+  __builtin_unreachable();
+}
+
 } // namespace __hwasan
 
 using namespace __hwasan;
 
 void __sanitizer::BufferedStackTrace::UnwindImpl(
     uptr pc, uptr bp, void *context, bool request_fast, u32 max_depth) {
   Thread *t = GetCurrentThread();
   if (!t) {

compiler-rt/lib/hwasan/hwasan_dynamic_shadow.cpp

 
 #include <elf.h>
 #include <link.h>
 
 #include "hwasan.h"
 #include "hwasan_mapping.h"
 #include "hwasan_thread_list.h"
 #include "sanitizer_common/sanitizer_common.h"
+#if SANITIZER_POSIX
 #include "sanitizer_common/sanitizer_posix.h"
+#endif
 
 // The code in this file needs to run in an unrelocated binary. It should not
 // access any external symbol, including its own non-hidden globals.
 
 #if SANITIZER_ANDROID
 extern "C" {
 
 INTERFACE_ATTRIBUTE void __hwasan_shadow();

 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
   if (IsPremapShadowAvailable())
     return FindPremappedShadowStart(shadow_size_bytes);
   return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,
                           kHighMemEnd);
 }
 
 }  // namespace __hwasan
+#elif SANITIZER_FUCHSIA
+
+namespace __hwasan {
+
+void InitShadowGOT() {}
+
+}  // namespace __hwasan
+
 #else
 namespace __hwasan {
 
 void InitShadowGOT() {}
 
 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
 #if defined(__x86_64__)
   constexpr uptr kAliasSize = 1ULL << kAddressTagShift;

compiler-rt/lib/hwasan/hwasan_fuchsia.cpp

+//===-- hwasan_fuchsia.cpp --------------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+///
+/// \file
+/// This file is a part of HWAddressSanitizer and contains Fuchsia-specific
+/// code.
+///
+//===----------------------------------------------------------------------===//
+
+#include "sanitizer_common/sanitizer_fuchsia.h"
+#if SANITIZER_FUCHSIA
+
+#include "hwasan.h"
+#include "hwasan_interface_internal.h"
+#include "hwasan_thread.h"
+#include "hwasan_report.h"
+#include "hwasan_thread_list.h"
+
+SANITIZER_INTERFACE_ATTRIBUTE
+THREADLOCAL uptr __hwasan_tls;
+
+namespace __hwasan {
+
+uptr kHighMemEnd;
+uptr kHighMemBeg;
+uptr kAliasRegionStart = 0;  // Always 0 on non-x86.
+
+bool InitShadow() {
+  __hwasan_shadow_memory_dynamic_address = 0;
+
+  // This initializes __sanitizer::ShadowBounds.
+  kHighMemEnd = GetMaxUserVirtualAddress();
+  kHighMemBeg = __sanitizer::ShadowBounds.shadow_limit;
+
+  CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);
+  CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);
+  CHECK_NE(kHighMemBeg, 0);
+
+  return true;
+}
+
+void InitThreads() {
+  uptr alloc_size = UINT64_C(1) << kShadowBaseAlignment;
+  uptr thread_start = reinterpret_cast<uptr>(
+      MmapAlignedOrDieOnFatalError(alloc_size, alloc_size, __func__));
+  InitThreadList(thread_start, thread_start + alloc_size);
+}
+
+void InitPrctl() {}
+
+bool MemIsApp(uptr p) {
+  CHECK(GetTagFromPointer(p) == 0);
+  return kHighMemBeg <= p && p <= kHighMemEnd;
+}
+
+void InstallAtExitHandler() {}
+
+// ---------------------- TSD ---------------- {{{
+
+extern "C" {
+void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
+  hwasanThreadList().CreateCurrentThread()->InitRandomState();
+}
+
+void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {
+  Thread *t = GetCurrentThread();
+  // Make sure that signal handler can not see a stale current thread pointer.
+  atomic_signal_fence(memory_order_seq_cst);
+  if (t)
+    hwasanThreadList().ReleaseThread(t);
+}
+
+void __sanitizer_exit() {
+  __hwasan::HwasanAtExit();
+}
+}  // extern "C"
+
+void HwasanTSDInit() {}
+void HwasanTSDThreadInit() {}
+
+static THREADLOCAL uptr __hwasan_tls;
+
+uptr *GetCurrentThreadLongPtr() {
+  return &__hwasan_tls;
+}
+
+void AndroidTestTlsSlot() {}
+
+Thread *GetCurrentThread() {
+  uptr *ThreadLongPtr = GetCurrentThreadLongPtr();
+  if (UNLIKELY(*ThreadLongPtr == 0))
+    return nullptr;
+  auto *R = (StackAllocationsRingBuffer *)ThreadLongPtr;
+  return hwasanThreadList().GetThreadByBufferAddress((uptr)R->Next());
+}
+
+// Entry point stub for interoperability between __hwasan_tag_mismatch (ASM) and
+// the rest of the mismatch handling code (C++).
+extern "C" void __hwasan_tag_mismatch4(uptr addr, uptr access_info,
+                                       uptr *registers_frame, size_t outsize) {
+  __hwasan::HwasanTagMismatch(addr, access_info, registers_frame, outsize);
+}
+
+static void OnStackUnwind(const SignalContext &sig, const void *,
+                          BufferedStackTrace *stack) {
+  stack->Unwind(StackTrace::GetNextInstructionPc(sig.pc), sig.bp, sig.context,
+                common_flags()->fast_unwind_on_fatal);
+}
+
+// TODO: Do we need this?
+void HwasanOnDeadlySignal(int signo, void *info, void *context) {}
+
+}  // namespace __hwasan
+
+#endif  // SANITIZER_FUCHSIA

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

 
 #include "interception/interception.h"
 #include "hwasan.h"
 #include "hwasan_allocator.h"
 #include "hwasan_mapping.h"
 #include "hwasan_thread.h"
 #include "hwasan_poisoning.h"
 #include "hwasan_report.h"
+#include "sanitizer_common/sanitizer_platform_limits_fuchsia.h"
 #include "sanitizer_common/sanitizer_platform_limits_posix.h"
 #include "sanitizer_common/sanitizer_allocator.h"
 #include "sanitizer_common/sanitizer_allocator_interface.h"
 #include "sanitizer_common/sanitizer_allocator_internal.h"
 #include "sanitizer_common/sanitizer_atomic.h"
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_errno.h"
 #include "sanitizer_common/sanitizer_stackdepot.h"

 INTERCEPTOR(void, longjmp, __hw_jmp_buf env, int val) {
   InternalLongjmp(env[0].__jmpbuf, val);
 }
 #undef SIG_BLOCK
 #undef SIG_SETMASK
 
 #endif // HWASAN_WITH_INTERCEPTORS && __aarch64__
 
+#if HWASAN_WITH_INTERCEPTORS
 static void BeforeFork() {
   StackDepotLockAll();
 }
 
 static void AfterFork() {
   StackDepotUnlockAll();
 }
 
 INTERCEPTOR(int, fork, void) {
   ENSURE_HWASAN_INITED();
   BeforeFork();
   int pid = REAL(fork)();
   AfterFork();
   return pid;
 }
+#endif  // HWASAN_WITH_INTERCEPTORS
 
 namespace __hwasan {
 
 int OnExit() {
   // FIXME: ask frontend whether we need to return failure.
   return 0;
 }
 
 } // namespace __hwasan
 
 namespace __hwasan {
 
 void InitializeInterceptors() {
   static int inited = 0;
   CHECK_EQ(inited, 0);
 
+#if HWASAN_WITH_INTERCEPTORS
   INTERCEPT_FUNCTION(fork);
 
-#if HWASAN_WITH_INTERCEPTORS
 #if defined(__linux__)
   INTERCEPT_FUNCTION(vfork);
 #endif  // __linux__
   INTERCEPT_FUNCTION(pthread_create);
 #endif
 
   inited = 1;
 }
 } // namespace __hwasan

compiler-rt/lib/hwasan/hwasan_interface_internal.h

 //
 // Private Hwasan interface header.
 //===----------------------------------------------------------------------===//
 
 #ifndef HWASAN_INTERFACE_INTERNAL_H
 #define HWASAN_INTERFACE_INTERNAL_H
 
 #include "sanitizer_common/sanitizer_internal_defs.h"
+#include "sanitizer_common/sanitizer_platform_limits_fuchsia.h"
 #include "sanitizer_common/sanitizer_platform_limits_posix.h"
 #include <link.h>
 
 extern "C" {
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void __hwasan_init_static();
 

compiler-rt/lib/hwasan/hwasan_linux.cpp

 
 bool MemIsApp(uptr p) {
 #if !defined(__x86_64__)  // Memory outside the alias range has non-zero tags.
   CHECK(GetTagFromPointer(p) == 0);
 #endif
   return p >= kHighMemStart || (p >= kLowMemStart && p <= kLowMemEnd);
 }
 
-static void HwasanAtExit(void) {
-  if (common_flags()->print_module_map)
-    DumpProcessMap();
-  if (flags()->print_stats && (flags()->atexit || hwasan_report_count > 0))
-    ReportStats();
-  if (hwasan_report_count > 0) {
-    // ReportAtExitStatistics();
-    if (common_flags()->exitcode)
-      internal__exit(common_flags()->exitcode);
-  }
-}
-
 void InstallAtExitHandler() {
   atexit(HwasanAtExit);
 }
 
 // ---------------------- TSD ---------------- {{{1
 
 extern "C" void __hwasan_thread_enter() {
   hwasanThreadList().CreateCurrentThread()->InitRandomState();

 Thread *GetCurrentThread() {
   uptr *ThreadLongPtr = GetCurrentThreadLongPtr();
   if (UNLIKELY(*ThreadLongPtr == 0))
     return nullptr;
   auto *R = (StackAllocationsRingBuffer *)ThreadLongPtr;
   return hwasanThreadList().GetThreadByBufferAddress((uptr)R->Next());
 }
 
-struct AccessInfo {
-  uptr addr;
-  uptr size;
-  bool is_store;
-  bool is_load;
-  bool recover;
-};
-
 static AccessInfo GetAccessInfo(siginfo_t *info, ucontext_t *uc) {
   // Access type is passed in a platform dependent way (see below) and encoded
   // as 0xXY, where X&1 is 1 for store, 0 for load, and X&2 is 1 if the error is
   // recoverable. Valid values of Y are 0 to 4, which are interpreted as
   // log2(access_size), and 0xF, which means that access size is passed via
   // platform dependent register (see below).
 #if defined(__aarch64__)
   // Access type is encoded in BRK immediate as 0x900 + 0xXY. For Y == 0xF,

 
 #else
 # error Unsupported architecture
 #endif
 
   return AccessInfo{addr, size, is_store, !is_store, recover};
 }
 
-static void HandleTagMismatch(AccessInfo ai, uptr pc, uptr frame,
-                              ucontext_t *uc, uptr *registers_frame = nullptr) {
-  InternalMmapVector<BufferedStackTrace> stack_buffer(1);
-  BufferedStackTrace *stack = stack_buffer.data();
-  stack->Reset();
-  stack->Unwind(pc, frame, uc, common_flags()->fast_unwind_on_fatal);
-
-  // The second stack frame contains the failure __hwasan_check function, as
-  // we have a stack frame for the registers saved in __hwasan_tag_mismatch that
-  // we wish to ignore. This (currently) only occurs on AArch64, as x64
-  // implementations use SIGTRAP to implement the failure, and thus do not go
-  // through the stack saver.
-  if (registers_frame && stack->trace && stack->size > 0) {
-    stack->trace++;
-    stack->size--;
-  }
-
-  bool fatal = flags()->halt_on_error || !ai.recover;
-  ReportTagMismatch(stack, ai.addr, ai.size, ai.is_store, fatal,
-                    registers_frame);
-}
-
 static bool HwasanOnSIGTRAP(int signo, siginfo_t *info, ucontext_t *uc) {
   AccessInfo ai = GetAccessInfo(info, uc);
   if (!ai.is_store && !ai.is_load)
     return false;
 
   SignalContext sig{info, uc};
   HandleTagMismatch(ai, StackTrace::GetNextInstructionPc(sig.pc), sig.bp, uc);
 

 
 
 } // namespace __hwasan
 
 // Entry point for interoperability between __hwasan_tag_mismatch (ASM) and the
 // rest of the mismatch handling code (C++).
 void __hwasan_tag_mismatch4(uptr addr, uptr access_info, uptr *registers_frame,
                             size_t outsize) {
-  __hwasan::AccessInfo ai;
-  ai.is_store = access_info & 0x10;
-  ai.is_load = !ai.is_store;
-  ai.recover = access_info & 0x20;
-  ai.addr = addr;
-  if ((access_info & 0xf) == 0xf)
-    ai.size = outsize;
-  else
-    ai.size = 1 << (access_info & 0xf);
-
-  __hwasan::HandleTagMismatch(ai, (uptr)__builtin_return_address(0),
-                              (uptr)__builtin_frame_address(0), nullptr,
-                              registers_frame);
-  __builtin_unreachable();
+  __hwasan::HwasanTagMismatch(addr, access_info, registers_frame, outsize);
 }
 
 #endif // SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD

compiler-rt/lib/hwasan/hwasan_poisoning.cpp

 
 #include "hwasan_mapping.h"
 #include "interception/interception.h"
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_linux.h"
 
 namespace __hwasan {
 
 uptr TagMemoryAligned(uptr p, uptr size, tag_t tag) {
   CHECK(IsAligned(p, kShadowAlignment));
   CHECK(IsAligned(size, kShadowAlignment));
+#if SANITIZER_FUCHSIA
+  __sanitizer_fill_shadow(p, size, tag,
+                          common_flags()->clear_shadow_mmap_threshold);
+#else
   uptr shadow_start = MemToShadow(p);
   uptr shadow_size = MemToShadowSize(size);
 
   uptr page_size = GetPageSizeCached();
   uptr page_start = RoundUpTo(shadow_start, page_size);
   uptr page_end = RoundDownTo(shadow_start + shadow_size, page_size);
   uptr threshold = common_flags()->clear_shadow_mmap_threshold;
   if (SANITIZER_LINUX &&
       UNLIKELY(page_end >= page_start + threshold && tag == 0)) {
     internal_memset((void *)shadow_start, tag, page_start - shadow_start);
     internal_memset((void *)page_end, tag,
                     shadow_start + shadow_size - page_end);
     // For an anonymous private mapping MADV_DONTNEED will return a zero page on
     // Linux.
     ReleaseMemoryPagesToOSAndZeroFill(page_start, page_end);
   } else {
     internal_memset((void *)shadow_start, tag, shadow_size);
   }
+#endif
   return AddTagToPointer(p, tag);
 }
 
 uptr TagMemory(uptr p, uptr size, tag_t tag) {
   uptr start = RoundDownTo(p, kShadowAlignment);
   uptr end = RoundUpTo(p + size, kShadowAlignment);
   return TagMemoryAligned(start, end - start, tag);
 }
 
 }  // namespace __hwasan

compiler-rt/lib/hwasan/hwasan_thread.cpp

void Thread::Init(uptr stack_buffer_start, uptr stack_buffer_size) {
   stack_allocations_ = new (ThreadLong)
       StackAllocationsRingBuffer((void *)stack_buffer_start, stack_buffer_size);
   // Check that it worked.
   CHECK_EQ(GetCurrentThread(), this);
 
   // ScopedTaggingDisable needs GetCurrentThread to be set up.
   ScopedTaggingDisabler disabler;
 
+#if !SANITIZER_FUCHSIA
   uptr tls_size;
   uptr stack_size;
   GetThreadStackAndTls(IsMainThread(), &stack_bottom_, &stack_size, &tls_begin_,
                        &tls_size);
   stack_top_ = stack_bottom_ + stack_size;
   tls_end_ = tls_begin_ + tls_size;
+#else
+  __sanitizer::GetThreadStackTopAndBottom(true, &stack_top_,
+                                          &stack_bottom_);
+  tls_end_ = tls_begin_ = 0;
+#endif
 
   if (stack_bottom_) {
     int local;
     CHECK(AddrIsInStack((uptr)&local));
     CHECK(MemIsApp(stack_bottom_));
     CHECK(MemIsApp(stack_top_ - 1));
   }
 

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_fuchsia.h

+//===-- sanitizer_platform_limits_fuchsia.h -------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Sanitizer common code.
+//
+// Sizes and layouts of platform-specific Fuchsia data structures.
+//===----------------------------------------------------------------------===//
+
+#ifndef SANITIZER_PLATFORM_LIMITS_FUCHSIA_H
+#define SANITIZER_PLATFORM_LIMITS_FUCHSIA_H
+
+#if SANITIZER_FUCHSIA
+
+namespace __sanitizer {
+struct __sanitizer_struct_mallinfo {};
+}  // namespace __sanitizer
+
+#endif  // SANITIZER_FUCHSIA
+
+#endif

compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_markup.cpp

 // once in UBSan to say "in module ..." in a message that also
 // includes an address in the module, so post-processing can already
 // pretty-print that so as to indicate the module.
 bool Symbolizer::GetModuleNameAndOffsetForPC(uptr pc, const char **module_name,
                                              uptr *module_address) {
   return false;
 }
 
+// This is mainly used by hwasan for online symbolization. This isn't needed
+// since hwasan can always just dump stack frames for offline symbolization.
+bool Symbolizer::SymbolizeFrame(uptr addr, FrameInfo *info) { return false; }
+
 // This is used in some places for suppression checking, which we
 // don't really support for Fuchsia.  It's also used in UBSan to
 // identify a PC location to a function name, so we always fill in
 // the function member with a string containing markup around the PC
 // value.
 // TODO(mcgrathr): Under SANITIZER_GO, it's currently used by TSan
 // to render stack frames, but that should be changed to use
 // RenderStackFrame.