/* Derived from Valgrind sources, coregrind/m_debuginfo/readmacho.c.
GPL 2+ therefore.
Can be compiled as either a 32- or 64-bit program (doesn't matter).
*/
/* What does this program do? In short it postprocesses tool
executables on MacOSX, after linking using /usr/bin/ld.
This is to deal with two separate and entirely unrelated problems.
Problem (1) is a bug in the linker in Xcode 4.0.0. Problem (2) is
much newer and concerns linking 64-bit tool executables for
Yosemite (10.10).
--- Problem (1) ------------------------------------------------
This is a bug in the linker on Xcode 4.0.0 and Xcode 4.0.1. Xcode
versions prior to 4.0.0 are unaffected.
The tracking bug is https://bugs.kde.org/show_bug.cgi?id=267997
The bug causes 64-bit tool executables to segfault at startup,
because:
Comparing the MachO load commands vs a (working) tool executable
that was created by Xcode 3.2.x, it appears that the new linker has
partially ignored the build system's request to place the tool
executable's stack at a non standard location. The build system
tells the linker "-stack_addr 0x134000000 -stack_size 0x800000".
With the Xcode 3.2 linker those flags produce two results:
(1) A load command to allocate the stack at the said location:
Load command 3
cmd LC_SEGMENT_64
cmdsize 72
segname __UNIXSTACK
vmaddr 0x0000000133800000
vmsize 0x0000000000800000
fileoff 2285568
filesize 0
maxprot 0x00000007
initprot 0x00000003
nsects 0
flags 0x0
(2) A request (in LC_UNIXTHREAD) to set %rsp to the correct value
at process startup, 0x134000000.
With Xcode 4.0.1, (1) is missing but (2) is still present. The
tool executable therefore starts up with %rsp pointing to unmapped
memory and faults almost instantly.
The workaround implemented by this program is documented in comment
8 of bug 267997, viz:
One really sick workaround is to observe that the executables
contain a redundant MachO load command:
Load command 2
cmd LC_SEGMENT_64
cmdsize 72
segname __LINKEDIT
vmaddr 0x0000000138dea000
vmsize 0x00000000000ad000
fileoff 2658304
filesize 705632
maxprot 0x00000007
initprot 0x00000001
nsects 0
flags 0x0
The described section presumably contains information intended for
the dynamic linker, but is irrelevant because this is a statically
linked executable. Hence it might be possible to postprocess the
executables after linking, to overwrite this entry with the
information that would have been in the missing __UNIXSTACK entry.
I tried this by hand (with a binary editor) earlier and got
something that worked.
--- Problem (2) ------------------------------------------------
On MacOSX 10.10 (Yosemite), the kernel requires all valid
executables to have a __PAGEZERO section with SVMA of zero and size
of at least one page. However, our tool executables have a
__PAGEZERO section with SVMA set to the requested Valgrind load
address (typically 0x1'3800'0000). And the kernel won't start
those. So we take the opportunity to "fix" this by setting the
SVMA to zero. Seems to work and have no obvious bad side effects.
*/
#define DEBUGPRINTING 0
#include <assert.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <unistd.h>
#include <fcntl.h>
#undef PLAT_x86_darwin
#undef PLAT_amd64_darwin
#if defined(__APPLE__) && defined(__i386__)
# define PLAT_x86_darwin 1
#elif defined(__APPLE__) && defined(__x86_64__)
# define PLAT_amd64_darwin 1
#else
# error "Can't be compiled on this platform"
#endif
#include <mach-o/loader.h>
#include <mach-o/nlist.h>
#include <mach-o/fat.h>
#include <mach/i386/thread_status.h>
/* Get hold of DARWIN_VERS, and check it has a sane value. */
#include "config.h"
#if DARWIN_VERS != DARWIN_10_5 && DARWIN_VERS != DARWIN_10_6 \
&& DARWIN_VERS != DARWIN_10_7 && DARWIN_VERS != DARWIN_10_8 \
&& DARWIN_VERS != DARWIN_10_9 && DARWIN_VERS != DARWIN_10_10 \
&& DARWIN_VERS != DARWIN_10_11 && DARWIN_VERS != DARWIN_10_12
# error "Unknown DARWIN_VERS value. This file only compiles on Darwin."
#endif
typedef unsigned char UChar;
typedef signed char Char;
typedef char HChar; /* signfulness depends on host */
typedef unsigned int UInt;
typedef signed int Int;
typedef unsigned char Bool;
#define True ((Bool)1)
#define False ((Bool)0)
typedef unsigned long UWord;
typedef UWord SizeT;
typedef UWord Addr;
typedef unsigned long long int ULong;
typedef signed long long int Long;
__attribute__((noreturn))
void fail ( HChar* msg )
{
fprintf(stderr, "fixup_macho_loadcmds: fail: %s\n", msg);
exit(1);
}
/*------------------------------------------------------------*/
/*--- ---*/
/*--- Mach-O file mapping/unmapping helpers ---*/
/*--- ---*/
/*------------------------------------------------------------*/
typedef
struct {
/* These two describe the entire mapped-in ("primary") image,
fat headers, kitchen sink, whatnot: the entire file. The
image is mapped into img[0 .. img_szB-1]. */
UChar* img;
SizeT img_szB;
/* These two describe the Mach-O object of interest, which is
presumably somewhere inside the primary image.
map_image_aboard() below, which generates this info, will
carefully check that the macho_ fields denote a section of
memory that falls entirely inside img[0 .. img_szB-1]. */
UChar* macho_img;
SizeT macho_img_szB;
}
ImageInfo;
Bool is_macho_object_file( const void* buf, SizeT szB )
{
/* (JRS: the Mach-O headers might not be in this mapped data,
because we only mapped a page for this initial check,
or at least not very much, and what's at the start of the file
is in general a so-called fat header. The Mach-O object we're
interested in could be arbitrarily far along the image, and so
we can't assume its header will fall within this page.) */
/* But we can say that either it's a fat object, in which case it
begins with a fat header, or it's unadorned Mach-O, in which
case it starts with a normal header. At least do what checks we
can to establish whether or not we're looking at something
sane. */
const struct fat_header* fh_be = buf;
const struct mach_header_64* mh = buf;
assert(buf);
if (szB < sizeof(struct fat_header))
return False;
if (ntohl(fh_be->magic) == FAT_MAGIC)
return True;
if (szB < sizeof(struct mach_header_64))
return False;
if (mh->magic == MH_MAGIC_64)
return True;
return False;
}
/* Unmap an image mapped in by map_image_aboard. */
static void unmap_image ( /*MOD*/ImageInfo* ii )
{
Int r;
assert(ii->img);
assert(ii->img_szB > 0);
r = munmap( ii->img, ii->img_szB );
/* Do we care if this fails? I suppose so; it would indicate
some fairly serious snafu with the mapping of the file. */
assert( !r );
memset(ii, 0, sizeof(*ii));
}
/* Map a given fat or thin object aboard, find the thin part if
necessary, do some checks, and write details of both the fat and
thin parts into *ii. Returns 32 (and leaves the file unmapped) if
the thin part is a 32 bit file. Returns 64 if it's a 64 bit file.
Does not return on failure. Guarantees to return pointers to a
valid(ish) Mach-O image if it succeeds. */
static Int map_image_aboard ( /*OUT*/ImageInfo* ii, HChar* filename )
{
memset(ii, 0, sizeof(*ii));
/* First off, try to map the thing in. */
{ SizeT size;
Int r, fd;
struct stat stat_buf;
r = stat(filename, &stat_buf);
if (r)
fail("Can't stat image (to determine its size)?!");
size = stat_buf.st_size;
fd = open(filename, O_RDWR, 0);
if (fd == -1)
fail("Can't open image for possible modification!");
if (DEBUGPRINTING)
printf("size %lu fd %d\n", size, fd);
void* v = mmap ( NULL, size, PROT_READ|PROT_WRITE,
MAP_FILE|MAP_SHARED, fd, 0 );
if (v == MAP_FAILED) {
perror("mmap failed");
fail("Can't mmap image for possible modification!");
}
close(fd);
ii->img = (UChar*)v;
ii->img_szB = size;
}
/* Now it's mapped in and we have .img and .img_szB set. Look for
the embedded Mach-O object. If not findable, unmap and fail. */
{ struct fat_header* fh_be;
struct fat_header fh;
struct mach_header_64* mh;
// Assume initially that we have a thin image, and update
// these if it turns out to be fat.
ii->macho_img = ii->img;
ii->macho_img_szB = ii->img_szB;
// Check for fat header.
if (ii->img_szB < sizeof(struct fat_header))
fail("Invalid Mach-O file (0 too small).");
// Fat header is always BIG-ENDIAN
fh_be = (struct fat_header *)ii->img;
fh.magic = ntohl(fh_be->magic);
fh.nfat_arch = ntohl(fh_be->nfat_arch);
if (fh.magic == FAT_MAGIC) {
// Look for a good architecture.
struct fat_arch *arch_be;
struct fat_arch arch;
Int f;
if (ii->img_szB < sizeof(struct fat_header)
+ fh.nfat_arch * sizeof(struct fat_arch))
fail("Invalid Mach-O file (1 too small).");
for (f = 0, arch_be = (struct fat_arch *)(fh_be+1);
f < fh.nfat_arch;
f++, arch_be++) {
Int cputype;
# if defined(PLAT_x86_darwin)
cputype = CPU_TYPE_X86;
# elif defined(PLAT_amd64_darwin)
cputype = CPU_TYPE_X86_64;
# else
# error "unknown architecture"
# endif
arch.cputype = ntohl(arch_be->cputype);
arch.cpusubtype = ntohl(arch_be->cpusubtype);
arch.offset = ntohl(arch_be->offset);
arch.size = ntohl(arch_be->size);
if (arch.cputype == cputype) {
if (ii->img_szB < arch.offset + arch.size)
fail("Invalid Mach-O file (2 too small).");
ii->macho_img = ii->img + arch.offset;
ii->macho_img_szB = arch.size;
break;
}
}
if (f == fh.nfat_arch)
fail("No acceptable architecture found in fat file.");
}
/* Sanity check what we found. */
/* assured by logic above */
assert(ii->img_szB >= sizeof(struct fat_header));
if (ii->macho_img_szB < sizeof(struct mach_header_64))
fail("Invalid Mach-O file (3 too small).");
if (ii->macho_img_szB > ii->img_szB)
fail("Invalid Mach-O file (thin bigger than fat).");
if (ii->macho_img >= ii->img
&& ii->macho_img + ii->macho_img_szB <= ii->img + ii->img_szB) {
/* thin entirely within fat, as expected */
} else {
fail("Invalid Mach-O file (thin not inside fat).");
}
mh = (struct mach_header_64 *)ii->macho_img;
if (mh->magic == MH_MAGIC) {
assert(ii->img);
assert(ii->macho_img);
assert(ii->img_szB > 0);
assert(ii->macho_img_szB > 0);
assert(ii->macho_img >= ii->img);
assert(ii->macho_img + ii->macho_img_szB <= ii->img + ii->img_szB);
return 32;
}
if (mh->magic != MH_MAGIC_64)
fail("Invalid Mach-O file (bad magic).");
if (ii->macho_img_szB < sizeof(struct mach_header_64) + mh->sizeofcmds)
fail("Invalid Mach-O file (4 too small).");
}
assert(ii->img);
assert(ii->macho_img);
assert(ii->img_szB > 0);
assert(ii->macho_img_szB > 0);
assert(ii->macho_img >= ii->img);
assert(ii->macho_img + ii->macho_img_szB <= ii->img + ii->img_szB);
return 64;
}
/*------------------------------------------------------------*/
/*--- ---*/
/*--- Mach-O top-level processing ---*/
/*--- ---*/
/*------------------------------------------------------------*/
void modify_macho_loadcmds ( HChar* filename,
ULong expected_stack_start,
ULong expected_stack_size )
{
ImageInfo ii;
memset(&ii, 0, sizeof(ii));
Int size = map_image_aboard( &ii, filename );
if (size == 32) {
fprintf(stderr, "fixup_macho_loadcmds: Is 32-bit MachO file;"
" no modifications needed.\n");
goto out;
}
assert(size == 64);
assert(ii.macho_img != NULL && ii.macho_img_szB > 0);
/* Poke around in the Mach-O header, to find some important
stuff.
* the location of the __UNIXSTACK load command, if any
* the location of the __LINKEDIT load command, if any
* the initial RSP value as stated in the LC_UNIXTHREAD
*/
/* The collected data */
ULong init_rsp = 0;
Bool have_rsp = False;
struct segment_command_64* seg__unixstack = NULL;
struct segment_command_64* seg__linkedit = NULL;
struct segment_command_64* seg__pagezero = NULL;
/* Loop over the load commands and fill in the above 4 variables. */
{ struct mach_header_64 *mh = (struct mach_header_64 *)ii.macho_img;
struct load_command *cmd;
Int c;
for (c = 0, cmd = (struct load_command *)(mh+1);
c < mh->ncmds;
c++, cmd = (struct load_command *)(cmd->cmdsize
+ (unsigned long)cmd)) {
if (DEBUGPRINTING)
printf("load cmd: offset %4lu size %3d kind %2d = ",
(unsigned long)((UChar*)cmd - (UChar*)ii.macho_img),
cmd->cmdsize, cmd->cmd);
switch (cmd->cmd) {
case LC_SEGMENT_64:
if (DEBUGPRINTING)
printf("LC_SEGMENT_64");
break;
case LC_SYMTAB:
if (DEBUGPRINTING)
printf("LC_SYMTAB");
break;
case LC_DYSYMTAB:
if (DEBUGPRINTING)
printf("LC_DYSYMTAB");
break;
case LC_UUID:
if (DEBUGPRINTING)
printf("LC_UUID");
break;
case LC_UNIXTHREAD:
if (DEBUGPRINTING)
printf("LC_UNIXTHREAD");
break;
default:
if (DEBUGPRINTING)
printf("???");
fail("unexpected load command in Mach header");
break;
}
if (DEBUGPRINTING)
printf("\n");
/* Note what the stated initial RSP value is, so we can
check it is as expected. */
if (cmd->cmd == LC_UNIXTHREAD) {
struct thread_command* tcmd = (struct thread_command*)cmd;
UInt* w32s = (UInt*)( (UChar*)tcmd + sizeof(*tcmd) );
if (DEBUGPRINTING)
printf("UnixThread: flavor %u = ", w32s[0]);
if (w32s[0] == x86_THREAD_STATE64 && !have_rsp) {
if (DEBUGPRINTING)
printf("x86_THREAD_STATE64\n");
x86_thread_state64_t* state64
= (x86_thread_state64_t*)(&w32s[2]);
have_rsp = True;
init_rsp = state64->__rsp;
if (DEBUGPRINTING)
printf("rsp = 0x%llx\n", init_rsp);
} else {
if (DEBUGPRINTING)
printf("???");
}
if (DEBUGPRINTING)
printf("\n");
}
if (cmd->cmd == LC_SEGMENT_64) {
struct segment_command_64 *seg = (struct segment_command_64 *)cmd;
if (0 == strcmp(seg->segname, "__LINKEDIT"))
seg__linkedit = seg;
if (0 == strcmp(seg->segname, "__UNIXSTACK"))
seg__unixstack = seg;
if (0 == strcmp(seg->segname, "__PAGEZERO"))
seg__pagezero = seg;
}
}
}
/*
Actions are then as follows:
* (always) check the RSP value is as expected, and abort if not
* if there's a UNIXSTACK load command, check it is as expected.
If not abort, if yes, do nothing more.
* (so there's no UNIXSTACK load command). if there's a LINKEDIT
load command, check if it is minimally usable (has 0 for
nsects and flags). If yes, convert it to a UNIXSTACK load
command. If there is none, or is unusable, then we're out of
options and have to abort.
*/
if (!have_rsp)
fail("Can't find / check initial RSP setting");
if (init_rsp != expected_stack_start + expected_stack_size)
fail("Initial RSP value not as expected");
fprintf(stderr, "fixup_macho_loadcmds: "
"initial RSP is as expected (0x%llx)\n",
expected_stack_start + expected_stack_size );
if (seg__unixstack) {
struct segment_command_64 *seg = seg__unixstack;
if (seg->vmaddr != expected_stack_start)
fail("has __UNIXSTACK, but wrong ::vmaddr");
if (seg->vmsize != expected_stack_size)
fail("has __UNIXSTACK, but wrong ::vmsize");
if (seg->maxprot != 7)
fail("has __UNIXSTACK, but wrong ::maxprot (should be 7)");
if (seg->initprot != 3)
fail("has __UNIXSTACK, but wrong ::initprot (should be 3)");
if (seg->nsects != 0)
fail("has __UNIXSTACK, but wrong ::nsects (should be 0)");
if (seg->flags != 0)
fail("has __UNIXSTACK, but wrong ::flags (should be 0)");
/* looks ok */
fprintf(stderr, "fixup_macho_loadcmds: "
"acceptable __UNIXSTACK present; no modifications.\n" );
goto maybe_mash_pagezero;
}
if (seg__linkedit) {
struct segment_command_64 *seg = seg__linkedit;
if (seg->nsects != 0)
fail("has __LINKEDIT, but wrong ::nsects (should be 0)");
if (seg->flags != 0)
fail("has __LINKEDIT, but wrong ::flags (should be 0)");
fprintf(stderr, "fixup_macho_loadcmds: "
"no __UNIXSTACK present.\n" );
fprintf(stderr, "fixup_macho_loadcmds: "
"converting __LINKEDIT to __UNIXSTACK.\n" );
strcpy(seg->segname, "__UNIXSTACK");
seg->vmaddr = expected_stack_start;
seg->vmsize = expected_stack_size;
seg->fileoff = 0;
seg->filesize = 0;
seg->maxprot = 7;
seg->initprot = 3;
/* success */
goto maybe_mash_pagezero;
}
/* out of options */
fail("no __UNIXSTACK found and no usable __LINKEDIT found; "
"out of options.");
/* NOTREACHED */
maybe_mash_pagezero:
/* Deal with Problem (2) as documented above. */
# if DARWIN_VERS >= DARWIN_10_10
assert(size == 64);
if (!seg__pagezero) {
fail("Can't find __PAGEZERO to modify; can't continue.");
}
fprintf(stderr, "fixup_macho_loadcmds: "
"changing __PAGEZERO.vmaddr from %p to 0x0.\n",
(void*)seg__pagezero->vmaddr);
seg__pagezero->vmaddr = 0;
# endif
out:
if (ii.img)
unmap_image(&ii);
}
static Bool is_plausible_tool_exe_name ( HChar* nm )
{
HChar* p;
if (!nm)
return False;
// Does it end with this string?
p = strstr(nm, "-x86-darwin");
if (p && 0 == strcmp(p, "-x86-darwin"))
return True;
p = strstr(nm, "-amd64-darwin");
if (p && 0 == strcmp(p, "-amd64-darwin"))
return True;
return False;
}
int main ( int argc, char** argv )
{
Int r;
ULong req_stack_addr = 0;
ULong req_stack_size = 0;
if (argc != 4)
fail("args: -stack_addr-arg -stack_size-arg "
"name-of-tool-executable-to-modify");
r= sscanf(argv[1], "0x%llx", &req_stack_addr);
if (r != 1) fail("invalid stack_addr arg");
r= sscanf(argv[2], "0x%llx", &req_stack_size);
if (r != 1) fail("invalid stack_size arg");
fprintf(stderr, "fixup_macho_loadcmds: "
"requested stack_addr (top) 0x%llx, "
"stack_size 0x%llx\n", req_stack_addr, req_stack_size );
if (!is_plausible_tool_exe_name(argv[3]))
fail("implausible tool exe name -- not of the form *-{x86,amd64}-darwin");
fprintf(stderr, "fixup_macho_loadcmds: examining tool exe: %s\n",
argv[3] );
modify_macho_loadcmds( argv[3], req_stack_addr - req_stack_size,
req_stack_size );
return 0;
}
/*
cmd LC_SEGMENT_64
cmdsize 72
segname __LINKEDIT
vmaddr 0x0000000138dea000
vmsize 0x00000000000ad000
fileoff 2658304
filesize 705632
maxprot 0x00000007
initprot 0x00000001
nsects 0
flags 0x0
*/
/*
cmd LC_SEGMENT_64
cmdsize 72
segname __UNIXSTACK
vmaddr 0x0000000133800000
vmsize 0x0000000000800000
fileoff 2498560
filesize 0
maxprot 0x00000007
initprot 0x00000003
nsects 0
flags 0x0
*/