1//===-- sanitizer_procmaps_mac.cc -----------------------------------------===//
2//
3// This file is distributed under the University of Illinois Open Source
4// License. See LICENSE.TXT for details.
5//
6//===----------------------------------------------------------------------===//
7//
8// Information about the process mappings (Mac-specific parts).
9//===----------------------------------------------------------------------===//
10
11#include "sanitizer_platform.h"
12#if SANITIZER_MAC
13#include "sanitizer_common.h"
14#include "sanitizer_placement_new.h"
15#include "sanitizer_procmaps.h"
16
17#include <mach-o/dyld.h>
18#include <mach-o/loader.h>
19#include <mach/mach.h>
20
21// These are not available in older macOS SDKs.
22#ifndef CPU_SUBTYPE_X86_64_H
23#define CPU_SUBTYPE_X86_64_H  ((cpu_subtype_t)8)   /* Haswell */
24#endif
25#ifndef CPU_SUBTYPE_ARM_V7S
26#define CPU_SUBTYPE_ARM_V7S   ((cpu_subtype_t)11)  /* Swift */
27#endif
28#ifndef CPU_SUBTYPE_ARM_V7K
29#define CPU_SUBTYPE_ARM_V7K   ((cpu_subtype_t)12)
30#endif
31#ifndef CPU_TYPE_ARM64
32#define CPU_TYPE_ARM64        (CPU_TYPE_ARM | CPU_ARCH_ABI64)
33#endif
34
35namespace __sanitizer {
36
37// Contains information used to iterate through sections.
38struct MemoryMappedSegmentData {
39  char name[kMaxSegName];
40  uptr nsects;
41  const char *current_load_cmd_addr;
42  u32 lc_type;
43  uptr base_virt_addr;
44  uptr addr_mask;
45};
46
47template <typename Section>
48static void NextSectionLoad(LoadedModule *module, MemoryMappedSegmentData *data,
49                            bool isWritable) {
50  const Section *sc = (const Section *)data->current_load_cmd_addr;
51  data->current_load_cmd_addr += sizeof(Section);
52
53  uptr sec_start = (sc->addr & data->addr_mask) + data->base_virt_addr;
54  uptr sec_end = sec_start + sc->size;
55  module->addAddressRange(sec_start, sec_end, /*executable=*/false, isWritable,
56                          sc->sectname);
57}
58
59void MemoryMappedSegment::AddAddressRanges(LoadedModule *module) {
60  // Don't iterate over sections when the caller hasn't set up the
61  // data pointer, when there are no sections, or when the segment
62  // is executable. Avoid iterating over executable sections because
63  // it will confuse libignore, and because the extra granularity
64  // of information is not needed by any sanitizers.
65  if (!data_ || !data_->nsects || IsExecutable()) {
66    module->addAddressRange(start, end, IsExecutable(), IsWritable(),
67                            data_ ? data_->name : nullptr);
68    return;
69  }
70
71  do {
72    if (data_->lc_type == LC_SEGMENT) {
73      NextSectionLoad<struct section>(module, data_, IsWritable());
74#ifdef MH_MAGIC_64
75    } else if (data_->lc_type == LC_SEGMENT_64) {
76      NextSectionLoad<struct section_64>(module, data_, IsWritable());
77#endif
78    }
79  } while (--data_->nsects);
80}
81
82MemoryMappingLayout::MemoryMappingLayout(bool cache_enabled) {
83  Reset();
84}
85
86MemoryMappingLayout::~MemoryMappingLayout() {
87}
88
89// More information about Mach-O headers can be found in mach-o/loader.h
90// Each Mach-O image has a header (mach_header or mach_header_64) starting with
91// a magic number, and a list of linker load commands directly following the
92// header.
93// A load command is at least two 32-bit words: the command type and the
94// command size in bytes. We're interested only in segment load commands
95// (LC_SEGMENT and LC_SEGMENT_64), which tell that a part of the file is mapped
96// into the task's address space.
97// The |vmaddr|, |vmsize| and |fileoff| fields of segment_command or
98// segment_command_64 correspond to the memory address, memory size and the
99// file offset of the current memory segment.
100// Because these fields are taken from the images as is, one needs to add
101// _dyld_get_image_vmaddr_slide() to get the actual addresses at runtime.
102
103void MemoryMappingLayout::Reset() {
104  // Count down from the top.
105  // TODO(glider): as per man 3 dyld, iterating over the headers with
106  // _dyld_image_count is thread-unsafe. We need to register callbacks for
107  // adding and removing images which will invalidate the MemoryMappingLayout
108  // state.
109  data_.current_image = _dyld_image_count();
110  data_.current_load_cmd_count = -1;
111  data_.current_load_cmd_addr = 0;
112  data_.current_magic = 0;
113  data_.current_filetype = 0;
114  data_.current_arch = kModuleArchUnknown;
115  internal_memset(data_.current_uuid, 0, kModuleUUIDSize);
116}
117
118// The dyld load address should be unchanged throughout process execution,
119// and it is expensive to compute once many libraries have been loaded,
120// so cache it here and do not reset.
121static mach_header *dyld_hdr = 0;
122static const char kDyldPath[] = "/usr/lib/dyld";
123static const int kDyldImageIdx = -1;
124
125// static
126void MemoryMappingLayout::CacheMemoryMappings() {
127  // No-op on Mac for now.
128}
129
130void MemoryMappingLayout::LoadFromCache() {
131  // No-op on Mac for now.
132}
133
134// _dyld_get_image_header() and related APIs don't report dyld itself.
135// We work around this by manually recursing through the memory map
136// until we hit a Mach header matching dyld instead. These recurse
137// calls are expensive, but the first memory map generation occurs
138// early in the process, when dyld is one of the only images loaded,
139// so it will be hit after only a few iterations.
140static mach_header *get_dyld_image_header() {
141  unsigned depth = 1;
142  vm_size_t size = 0;
143  vm_address_t address = 0;
144  kern_return_t err = KERN_SUCCESS;
145  mach_msg_type_number_t count = VM_REGION_SUBMAP_INFO_COUNT_64;
146
147  while (true) {
148    struct vm_region_submap_info_64 info;
149    err = vm_region_recurse_64(mach_task_self(), &address, &size, &depth,
150                               (vm_region_info_t)&info, &count);
151    if (err != KERN_SUCCESS) return nullptr;
152
153    if (size >= sizeof(mach_header) && info.protection & kProtectionRead) {
154      mach_header *hdr = (mach_header *)address;
155      if ((hdr->magic == MH_MAGIC || hdr->magic == MH_MAGIC_64) &&
156          hdr->filetype == MH_DYLINKER) {
157        return hdr;
158      }
159    }
160    address += size;
161  }
162}
163
164const mach_header *get_dyld_hdr() {
165  if (!dyld_hdr) dyld_hdr = get_dyld_image_header();
166
167  return dyld_hdr;
168}
169
170// Next and NextSegmentLoad were inspired by base/sysinfo.cc in
171// Google Perftools, https://github.com/gperftools/gperftools.
172
173// NextSegmentLoad scans the current image for the next segment load command
174// and returns the start and end addresses and file offset of the corresponding
175// segment.
176// Note that the segment addresses are not necessarily sorted.
177template <u32 kLCSegment, typename SegmentCommand>
178static bool NextSegmentLoad(MemoryMappedSegment *segment,
179MemoryMappedSegmentData *seg_data, MemoryMappingLayoutData &layout_data) {
180  const char *lc = layout_data.current_load_cmd_addr;
181  layout_data.current_load_cmd_addr += ((const load_command *)lc)->cmdsize;
182  if (((const load_command *)lc)->cmd == kLCSegment) {
183    const SegmentCommand* sc = (const SegmentCommand *)lc;
184    uptr base_virt_addr, addr_mask;
185    if (layout_data.current_image == kDyldImageIdx) {
186      base_virt_addr = (uptr)get_dyld_hdr();
187      // vmaddr is masked with 0xfffff because on macOS versions < 10.12,
188      // it contains an absolute address rather than an offset for dyld.
189      // To make matters even more complicated, this absolute address
190      // isn't actually the absolute segment address, but the offset portion
191      // of the address is accurate when combined with the dyld base address,
192      // and the mask will give just this offset.
193      addr_mask = 0xfffff;
194    } else {
195      base_virt_addr =
196          (uptr)_dyld_get_image_vmaddr_slide(layout_data.current_image);
197      addr_mask = ~0;
198    }
199
200    segment->start = (sc->vmaddr & addr_mask) + base_virt_addr;
201    segment->end = segment->start + sc->vmsize;
202    // Most callers don't need section information, so only fill this struct
203    // when required.
204    if (seg_data) {
205      seg_data->nsects = sc->nsects;
206      seg_data->current_load_cmd_addr =
207          (const char *)lc + sizeof(SegmentCommand);
208      seg_data->lc_type = kLCSegment;
209      seg_data->base_virt_addr = base_virt_addr;
210      seg_data->addr_mask = addr_mask;
211      internal_strncpy(seg_data->name, sc->segname,
212                       ARRAY_SIZE(seg_data->name));
213    }
214
215    // Return the initial protection.
216    segment->protection = sc->initprot;
217    segment->offset = (layout_data.current_filetype ==
218                       /*MH_EXECUTE*/ 0x2)
219                          ? sc->vmaddr
220                          : sc->fileoff;
221    if (segment->filename) {
222      const char *src = (layout_data.current_image == kDyldImageIdx)
223                            ? kDyldPath
224                            : _dyld_get_image_name(layout_data.current_image);
225      internal_strncpy(segment->filename, src, segment->filename_size);
226    }
227    segment->arch = layout_data.current_arch;
228    internal_memcpy(segment->uuid, layout_data.current_uuid, kModuleUUIDSize);
229    return true;
230  }
231  return false;
232}
233
234ModuleArch ModuleArchFromCpuType(cpu_type_t cputype, cpu_subtype_t cpusubtype) {
235  cpusubtype = cpusubtype & ~CPU_SUBTYPE_MASK;
236  switch (cputype) {
237    case CPU_TYPE_I386:
238      return kModuleArchI386;
239    case CPU_TYPE_X86_64:
240      if (cpusubtype == CPU_SUBTYPE_X86_64_ALL) return kModuleArchX86_64;
241      if (cpusubtype == CPU_SUBTYPE_X86_64_H) return kModuleArchX86_64H;
242      CHECK(0 && "Invalid subtype of x86_64");
243      return kModuleArchUnknown;
244    case CPU_TYPE_ARM:
245      if (cpusubtype == CPU_SUBTYPE_ARM_V6) return kModuleArchARMV6;
246      if (cpusubtype == CPU_SUBTYPE_ARM_V7) return kModuleArchARMV7;
247      if (cpusubtype == CPU_SUBTYPE_ARM_V7S) return kModuleArchARMV7S;
248      if (cpusubtype == CPU_SUBTYPE_ARM_V7K) return kModuleArchARMV7K;
249      CHECK(0 && "Invalid subtype of ARM");
250      return kModuleArchUnknown;
251    case CPU_TYPE_ARM64:
252      return kModuleArchARM64;
253    default:
254      CHECK(0 && "Invalid CPU type");
255      return kModuleArchUnknown;
256  }
257}
258
259static const load_command *NextCommand(const load_command *lc) {
260  return (const load_command *)((const char *)lc + lc->cmdsize);
261}
262
263static void FindUUID(const load_command *first_lc, u8 *uuid_output) {
264  for (const load_command *lc = first_lc; lc->cmd != 0; lc = NextCommand(lc)) {
265    if (lc->cmd != LC_UUID) continue;
266
267    const uuid_command *uuid_lc = (const uuid_command *)lc;
268    const uint8_t *uuid = &uuid_lc->uuid[0];
269    internal_memcpy(uuid_output, uuid, kModuleUUIDSize);
270    return;
271  }
272}
273
274static bool IsModuleInstrumented(const load_command *first_lc) {
275  for (const load_command *lc = first_lc; lc->cmd != 0; lc = NextCommand(lc)) {
276    if (lc->cmd != LC_LOAD_DYLIB) continue;
277
278    const dylib_command *dylib_lc = (const dylib_command *)lc;
279    uint32_t dylib_name_offset = dylib_lc->dylib.name.offset;
280    const char *dylib_name = ((const char *)dylib_lc) + dylib_name_offset;
281    dylib_name = StripModuleName(dylib_name);
282    if (dylib_name != 0 && (internal_strstr(dylib_name, "libclang_rt."))) {
283      return true;
284    }
285  }
286  return false;
287}
288
289bool MemoryMappingLayout::Next(MemoryMappedSegment *segment) {
290  for (; data_.current_image >= kDyldImageIdx; data_.current_image--) {
291    const mach_header *hdr = (data_.current_image == kDyldImageIdx)
292                                 ? get_dyld_hdr()
293                                 : _dyld_get_image_header(data_.current_image);
294    if (!hdr) continue;
295    if (data_.current_load_cmd_count < 0) {
296      // Set up for this image;
297      data_.current_load_cmd_count = hdr->ncmds;
298      data_.current_magic = hdr->magic;
299      data_.current_filetype = hdr->filetype;
300      data_.current_arch = ModuleArchFromCpuType(hdr->cputype, hdr->cpusubtype);
301      switch (data_.current_magic) {
302#ifdef MH_MAGIC_64
303        case MH_MAGIC_64: {
304          data_.current_load_cmd_addr =
305              (const char *)hdr + sizeof(mach_header_64);
306          break;
307        }
308#endif
309        case MH_MAGIC: {
310          data_.current_load_cmd_addr = (const char *)hdr + sizeof(mach_header);
311          break;
312        }
313        default: {
314          continue;
315        }
316      }
317      FindUUID((const load_command *)data_.current_load_cmd_addr,
318               data_.current_uuid);
319      data_.current_instrumented = IsModuleInstrumented(
320          (const load_command *)data_.current_load_cmd_addr);
321    }
322
323    for (; data_.current_load_cmd_count >= 0; data_.current_load_cmd_count--) {
324      switch (data_.current_magic) {
325        // data_.current_magic may be only one of MH_MAGIC, MH_MAGIC_64.
326#ifdef MH_MAGIC_64
327        case MH_MAGIC_64: {
328          if (NextSegmentLoad<LC_SEGMENT_64, struct segment_command_64>(
329          segment, segment->data_, data_))
330            return true;
331          break;
332        }
333#endif
334        case MH_MAGIC: {
335          if (NextSegmentLoad<LC_SEGMENT, struct segment_command>(
336          segment, segment->data_, data_))
337            return true;
338          break;
339        }
340      }
341    }
342    // If we get here, no more load_cmd's in this image talk about
343    // segments.  Go on to the next image.
344  }
345  return false;
346}
347
348void MemoryMappingLayout::DumpListOfModules(
349    InternalMmapVectorNoCtor<LoadedModule> *modules) {
350  Reset();
351  InternalScopedString module_name(kMaxPathLength);
352  MemoryMappedSegment segment(module_name.data(), kMaxPathLength);
353  MemoryMappedSegmentData data;
354  segment.data_ = &data;
355  while (Next(&segment)) {
356    if (segment.filename[0] == '\0') continue;
357    LoadedModule *cur_module = nullptr;
358    if (!modules->empty() &&
359        0 == internal_strcmp(segment.filename, modules->back().full_name())) {
360      cur_module = &modules->back();
361    } else {
362      modules->push_back(LoadedModule());
363      cur_module = &modules->back();
364      cur_module->set(segment.filename, segment.start, segment.arch,
365                      segment.uuid, data_.current_instrumented);
366    }
367    segment.AddAddressRanges(cur_module);
368  }
369}
370
371}  // namespace __sanitizer
372
373#endif  // SANITIZER_MAC
374