1 //===-- sanitizer_mac.cpp -------------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is shared between various sanitizers' runtime libraries and 10 // implements OSX-specific functions. 11 //===----------------------------------------------------------------------===// 12 13 #include "sanitizer_platform.h" 14 #if SANITIZER_APPLE 15 # include "interception/interception.h" 16 # include "sanitizer_mac.h" 17 18 // Use 64-bit inodes in file operations. ASan does not support OS X 10.5, so 19 // the clients will most certainly use 64-bit ones as well. 20 # ifndef _DARWIN_USE_64_BIT_INODE 21 # define _DARWIN_USE_64_BIT_INODE 1 22 # endif 23 # include <stdio.h> 24 25 # include "sanitizer_common.h" 26 # include "sanitizer_file.h" 27 # include "sanitizer_flags.h" 28 # include "sanitizer_interface_internal.h" 29 # include "sanitizer_internal_defs.h" 30 # include "sanitizer_libc.h" 31 # include "sanitizer_platform_limits_posix.h" 32 # include "sanitizer_procmaps.h" 33 # include "sanitizer_ptrauth.h" 34 35 # if !SANITIZER_IOS 36 # include <crt_externs.h> // for _NSGetEnviron 37 # else 38 extern char **environ; 39 # endif 40 41 # if defined(__has_include) && __has_include(<os/trace.h>) 42 # define SANITIZER_OS_TRACE 1 43 # include <os/trace.h> 44 # else 45 # define SANITIZER_OS_TRACE 0 46 # endif 47 48 // Integrate with CrashReporter library if available 49 # if defined(__has_include) && __has_include(<CrashReporterClient.h>) 50 # define HAVE_CRASHREPORTERCLIENT_H 1 51 # include <CrashReporterClient.h> 52 # else 53 # define HAVE_CRASHREPORTERCLIENT_H 0 54 # endif 55 56 # if !SANITIZER_IOS 57 # include <crt_externs.h> // for _NSGetArgv and _NSGetEnviron 58 # else 59 extern "C" { 60 extern char ***_NSGetArgv(void); 61 } 62 # endif 63 64 # include <asl.h> 65 # include <dlfcn.h> // for dladdr() 66 # include <errno.h> 67 # include <fcntl.h> 68 # include <libkern/OSAtomic.h> 69 # include <mach-o/dyld.h> 70 # include <mach/mach.h> 71 # include <mach/mach_time.h> 72 # include <mach/vm_statistics.h> 73 # include <malloc/malloc.h> 74 # include <os/log.h> 75 # include <pthread.h> 76 # include <pthread/introspection.h> 77 # include <sched.h> 78 # include <signal.h> 79 # include <spawn.h> 80 # include <stdlib.h> 81 # include <sys/ioctl.h> 82 # include <sys/mman.h> 83 # include <sys/resource.h> 84 # include <sys/stat.h> 85 # include <sys/sysctl.h> 86 # include <sys/types.h> 87 # include <sys/wait.h> 88 # include <unistd.h> 89 # include <util.h> 90 91 // From <crt_externs.h>, but we don't have that file on iOS. 92 extern "C" { 93 extern char ***_NSGetArgv(void); 94 extern char ***_NSGetEnviron(void); 95 } 96 97 // From <mach/mach_vm.h>, but we don't have that file on iOS. 98 extern "C" { 99 extern kern_return_t mach_vm_region_recurse( 100 vm_map_t target_task, 101 mach_vm_address_t *address, 102 mach_vm_size_t *size, 103 natural_t *nesting_depth, 104 vm_region_recurse_info_t info, 105 mach_msg_type_number_t *infoCnt); 106 } 107 108 namespace __sanitizer { 109 110 #include "sanitizer_syscall_generic.inc" 111 112 // Direct syscalls, don't call libmalloc hooks (but not available on 10.6). 113 extern "C" void *__mmap(void *addr, size_t len, int prot, int flags, int fildes, 114 off_t off) SANITIZER_WEAK_ATTRIBUTE; 115 extern "C" int __munmap(void *, size_t) SANITIZER_WEAK_ATTRIBUTE; 116 117 // ---------------------- sanitizer_libc.h 118 119 // From <mach/vm_statistics.h>, but not on older OSs. 120 #ifndef VM_MEMORY_SANITIZER 121 #define VM_MEMORY_SANITIZER 99 122 #endif 123 124 // XNU on Darwin provides a mmap flag that optimizes allocation/deallocation of 125 // giant memory regions (i.e. shadow memory regions). 126 #define kXnuFastMmapFd 0x4 127 static size_t kXnuFastMmapThreshold = 2 << 30; // 2 GB 128 static bool use_xnu_fast_mmap = false; 129 130 uptr internal_mmap(void *addr, size_t length, int prot, int flags, 131 int fd, u64 offset) { 132 if (fd == -1) { 133 fd = VM_MAKE_TAG(VM_MEMORY_SANITIZER); 134 if (length >= kXnuFastMmapThreshold) { 135 if (use_xnu_fast_mmap) fd |= kXnuFastMmapFd; 136 } 137 } 138 if (&__mmap) return (uptr)__mmap(addr, length, prot, flags, fd, offset); 139 return (uptr)mmap(addr, length, prot, flags, fd, offset); 140 } 141 142 uptr internal_munmap(void *addr, uptr length) { 143 if (&__munmap) return __munmap(addr, length); 144 return munmap(addr, length); 145 } 146 147 uptr internal_mremap(void *old_address, uptr old_size, uptr new_size, int flags, 148 void *new_address) { 149 CHECK(false && "internal_mremap is unimplemented on Mac"); 150 return 0; 151 } 152 153 int internal_mprotect(void *addr, uptr length, int prot) { 154 return mprotect(addr, length, prot); 155 } 156 157 int internal_madvise(uptr addr, uptr length, int advice) { 158 return madvise((void *)addr, length, advice); 159 } 160 161 uptr internal_close(fd_t fd) { 162 return close(fd); 163 } 164 165 uptr internal_open(const char *filename, int flags) { 166 return open(filename, flags); 167 } 168 169 uptr internal_open(const char *filename, int flags, u32 mode) { 170 return open(filename, flags, mode); 171 } 172 173 uptr internal_read(fd_t fd, void *buf, uptr count) { 174 return read(fd, buf, count); 175 } 176 177 uptr internal_write(fd_t fd, const void *buf, uptr count) { 178 return write(fd, buf, count); 179 } 180 181 uptr internal_stat(const char *path, void *buf) { 182 return stat(path, (struct stat *)buf); 183 } 184 185 uptr internal_lstat(const char *path, void *buf) { 186 return lstat(path, (struct stat *)buf); 187 } 188 189 uptr internal_fstat(fd_t fd, void *buf) { 190 return fstat(fd, (struct stat *)buf); 191 } 192 193 uptr internal_filesize(fd_t fd) { 194 struct stat st; 195 if (internal_fstat(fd, &st)) 196 return -1; 197 return (uptr)st.st_size; 198 } 199 200 uptr internal_dup(int oldfd) { 201 return dup(oldfd); 202 } 203 204 uptr internal_dup2(int oldfd, int newfd) { 205 return dup2(oldfd, newfd); 206 } 207 208 uptr internal_readlink(const char *path, char *buf, uptr bufsize) { 209 return readlink(path, buf, bufsize); 210 } 211 212 uptr internal_unlink(const char *path) { 213 return unlink(path); 214 } 215 216 uptr internal_sched_yield() { 217 return sched_yield(); 218 } 219 220 void internal__exit(int exitcode) { 221 _exit(exitcode); 222 } 223 224 void internal_usleep(u64 useconds) { usleep(useconds); } 225 226 uptr internal_getpid() { 227 return getpid(); 228 } 229 230 int internal_dlinfo(void *handle, int request, void *p) { 231 UNIMPLEMENTED(); 232 } 233 234 int internal_sigaction(int signum, const void *act, void *oldact) { 235 return sigaction(signum, 236 (const struct sigaction *)act, (struct sigaction *)oldact); 237 } 238 239 void internal_sigfillset(__sanitizer_sigset_t *set) { sigfillset(set); } 240 241 uptr internal_sigprocmask(int how, __sanitizer_sigset_t *set, 242 __sanitizer_sigset_t *oldset) { 243 // Don't use sigprocmask here, because it affects all threads. 244 return pthread_sigmask(how, set, oldset); 245 } 246 247 // Doesn't call pthread_atfork() handlers (but not available on 10.6). 248 extern "C" pid_t __fork(void) SANITIZER_WEAK_ATTRIBUTE; 249 250 int internal_fork() { 251 if (&__fork) 252 return __fork(); 253 return fork(); 254 } 255 256 int internal_sysctl(const int *name, unsigned int namelen, void *oldp, 257 uptr *oldlenp, const void *newp, uptr newlen) { 258 return sysctl(const_cast<int *>(name), namelen, oldp, (size_t *)oldlenp, 259 const_cast<void *>(newp), (size_t)newlen); 260 } 261 262 int internal_sysctlbyname(const char *sname, void *oldp, uptr *oldlenp, 263 const void *newp, uptr newlen) { 264 return sysctlbyname(sname, oldp, (size_t *)oldlenp, const_cast<void *>(newp), 265 (size_t)newlen); 266 } 267 268 static fd_t internal_spawn_impl(const char *argv[], const char *envp[], 269 pid_t *pid) { 270 fd_t primary_fd = kInvalidFd; 271 fd_t secondary_fd = kInvalidFd; 272 273 auto fd_closer = at_scope_exit([&] { 274 internal_close(primary_fd); 275 internal_close(secondary_fd); 276 }); 277 278 // We need a new pseudoterminal to avoid buffering problems. The 'atos' tool 279 // in particular detects when it's talking to a pipe and forgets to flush the 280 // output stream after sending a response. 281 primary_fd = posix_openpt(O_RDWR); 282 if (primary_fd == kInvalidFd) 283 return kInvalidFd; 284 285 int res = grantpt(primary_fd) || unlockpt(primary_fd); 286 if (res != 0) return kInvalidFd; 287 288 // Use TIOCPTYGNAME instead of ptsname() to avoid threading problems. 289 char secondary_pty_name[128]; 290 res = ioctl(primary_fd, TIOCPTYGNAME, secondary_pty_name); 291 if (res == -1) return kInvalidFd; 292 293 secondary_fd = internal_open(secondary_pty_name, O_RDWR); 294 if (secondary_fd == kInvalidFd) 295 return kInvalidFd; 296 297 // File descriptor actions 298 posix_spawn_file_actions_t acts; 299 res = posix_spawn_file_actions_init(&acts); 300 if (res != 0) return kInvalidFd; 301 302 auto acts_cleanup = at_scope_exit([&] { 303 posix_spawn_file_actions_destroy(&acts); 304 }); 305 306 res = posix_spawn_file_actions_adddup2(&acts, secondary_fd, STDIN_FILENO) || 307 posix_spawn_file_actions_adddup2(&acts, secondary_fd, STDOUT_FILENO) || 308 posix_spawn_file_actions_addclose(&acts, secondary_fd); 309 if (res != 0) return kInvalidFd; 310 311 // Spawn attributes 312 posix_spawnattr_t attrs; 313 res = posix_spawnattr_init(&attrs); 314 if (res != 0) return kInvalidFd; 315 316 auto attrs_cleanup = at_scope_exit([&] { 317 posix_spawnattr_destroy(&attrs); 318 }); 319 320 // In the spawned process, close all file descriptors that are not explicitly 321 // described by the file actions object. This is Darwin-specific extension. 322 res = posix_spawnattr_setflags(&attrs, POSIX_SPAWN_CLOEXEC_DEFAULT); 323 if (res != 0) return kInvalidFd; 324 325 // posix_spawn 326 char **argv_casted = const_cast<char **>(argv); 327 char **envp_casted = const_cast<char **>(envp); 328 res = posix_spawn(pid, argv[0], &acts, &attrs, argv_casted, envp_casted); 329 if (res != 0) return kInvalidFd; 330 331 // Disable echo in the new terminal, disable CR. 332 struct termios termflags; 333 tcgetattr(primary_fd, &termflags); 334 termflags.c_oflag &= ~ONLCR; 335 termflags.c_lflag &= ~ECHO; 336 tcsetattr(primary_fd, TCSANOW, &termflags); 337 338 // On success, do not close primary_fd on scope exit. 339 fd_t fd = primary_fd; 340 primary_fd = kInvalidFd; 341 342 return fd; 343 } 344 345 fd_t internal_spawn(const char *argv[], const char *envp[], pid_t *pid) { 346 // The client program may close its stdin and/or stdout and/or stderr thus 347 // allowing open/posix_openpt to reuse file descriptors 0, 1 or 2. In this 348 // case the communication is broken if either the parent or the child tries to 349 // close or duplicate these descriptors. We temporarily reserve these 350 // descriptors here to prevent this. 351 fd_t low_fds[3]; 352 size_t count = 0; 353 354 for (; count < 3; count++) { 355 low_fds[count] = posix_openpt(O_RDWR); 356 if (low_fds[count] >= STDERR_FILENO) 357 break; 358 } 359 360 fd_t fd = internal_spawn_impl(argv, envp, pid); 361 362 for (; count > 0; count--) { 363 internal_close(low_fds[count]); 364 } 365 366 return fd; 367 } 368 369 uptr internal_rename(const char *oldpath, const char *newpath) { 370 return rename(oldpath, newpath); 371 } 372 373 uptr internal_ftruncate(fd_t fd, uptr size) { 374 return ftruncate(fd, size); 375 } 376 377 uptr internal_execve(const char *filename, char *const argv[], 378 char *const envp[]) { 379 return execve(filename, argv, envp); 380 } 381 382 uptr internal_waitpid(int pid, int *status, int options) { 383 return waitpid(pid, status, options); 384 } 385 386 // ----------------- sanitizer_common.h 387 bool FileExists(const char *filename) { 388 if (ShouldMockFailureToOpen(filename)) 389 return false; 390 struct stat st; 391 if (stat(filename, &st)) 392 return false; 393 // Sanity check: filename is a regular file. 394 return S_ISREG(st.st_mode); 395 } 396 397 bool DirExists(const char *path) { 398 struct stat st; 399 if (stat(path, &st)) 400 return false; 401 return S_ISDIR(st.st_mode); 402 } 403 404 tid_t GetTid() { 405 tid_t tid; 406 pthread_threadid_np(nullptr, &tid); 407 return tid; 408 } 409 410 void GetThreadStackTopAndBottom(bool at_initialization, uptr *stack_top, 411 uptr *stack_bottom) { 412 CHECK(stack_top); 413 CHECK(stack_bottom); 414 uptr stacksize = pthread_get_stacksize_np(pthread_self()); 415 // pthread_get_stacksize_np() returns an incorrect stack size for the main 416 // thread on Mavericks. See 417 // https://github.com/google/sanitizers/issues/261 418 if ((GetMacosAlignedVersion() >= MacosVersion(10, 9)) && at_initialization && 419 stacksize == (1 << 19)) { 420 struct rlimit rl; 421 CHECK_EQ(getrlimit(RLIMIT_STACK, &rl), 0); 422 // Most often rl.rlim_cur will be the desired 8M. 423 if (rl.rlim_cur < kMaxThreadStackSize) { 424 stacksize = rl.rlim_cur; 425 } else { 426 stacksize = kMaxThreadStackSize; 427 } 428 } 429 void *stackaddr = pthread_get_stackaddr_np(pthread_self()); 430 *stack_top = (uptr)stackaddr; 431 *stack_bottom = *stack_top - stacksize; 432 } 433 434 char **GetEnviron() { 435 #if !SANITIZER_IOS 436 char ***env_ptr = _NSGetEnviron(); 437 if (!env_ptr) { 438 Report("_NSGetEnviron() returned NULL. Please make sure __asan_init() is " 439 "called after libSystem_initializer().\n"); 440 CHECK(env_ptr); 441 } 442 char **environ = *env_ptr; 443 #endif 444 CHECK(environ); 445 return environ; 446 } 447 448 const char *GetEnv(const char *name) { 449 char **env = GetEnviron(); 450 uptr name_len = internal_strlen(name); 451 while (*env != 0) { 452 uptr len = internal_strlen(*env); 453 if (len > name_len) { 454 const char *p = *env; 455 if (!internal_memcmp(p, name, name_len) && 456 p[name_len] == '=') { // Match. 457 return *env + name_len + 1; // String starting after =. 458 } 459 } 460 env++; 461 } 462 return 0; 463 } 464 465 uptr ReadBinaryName(/*out*/char *buf, uptr buf_len) { 466 CHECK_LE(kMaxPathLength, buf_len); 467 468 // On OS X the executable path is saved to the stack by dyld. Reading it 469 // from there is much faster than calling dladdr, especially for large 470 // binaries with symbols. 471 InternalMmapVector<char> exe_path(kMaxPathLength); 472 uint32_t size = exe_path.size(); 473 if (_NSGetExecutablePath(exe_path.data(), &size) == 0 && 474 realpath(exe_path.data(), buf) != 0) { 475 return internal_strlen(buf); 476 } 477 return 0; 478 } 479 480 uptr ReadLongProcessName(/*out*/char *buf, uptr buf_len) { 481 return ReadBinaryName(buf, buf_len); 482 } 483 484 void ReExec() { 485 UNIMPLEMENTED(); 486 } 487 488 void CheckASLR() { 489 // Do nothing 490 } 491 492 void CheckMPROTECT() { 493 // Do nothing 494 } 495 496 uptr GetPageSize() { 497 return sysconf(_SC_PAGESIZE); 498 } 499 500 extern "C" unsigned malloc_num_zones; 501 extern "C" malloc_zone_t **malloc_zones; 502 malloc_zone_t sanitizer_zone; 503 504 // We need to make sure that sanitizer_zone is registered as malloc_zones[0]. If 505 // libmalloc tries to set up a different zone as malloc_zones[0], it will call 506 // mprotect(malloc_zones, ..., PROT_READ). This interceptor will catch that and 507 // make sure we are still the first (default) zone. 508 void MprotectMallocZones(void *addr, int prot) { 509 if (addr == malloc_zones && prot == PROT_READ) { 510 if (malloc_num_zones > 1 && malloc_zones[0] != &sanitizer_zone) { 511 for (unsigned i = 1; i < malloc_num_zones; i++) { 512 if (malloc_zones[i] == &sanitizer_zone) { 513 // Swap malloc_zones[0] and malloc_zones[i]. 514 malloc_zones[i] = malloc_zones[0]; 515 malloc_zones[0] = &sanitizer_zone; 516 break; 517 } 518 } 519 } 520 } 521 } 522 523 void FutexWait(atomic_uint32_t *p, u32 cmp) { 524 // FIXME: implement actual blocking. 525 sched_yield(); 526 } 527 528 void FutexWake(atomic_uint32_t *p, u32 count) {} 529 530 u64 NanoTime() { 531 timeval tv; 532 internal_memset(&tv, 0, sizeof(tv)); 533 gettimeofday(&tv, 0); 534 return (u64)tv.tv_sec * 1000*1000*1000 + tv.tv_usec * 1000; 535 } 536 537 // This needs to be called during initialization to avoid being racy. 538 u64 MonotonicNanoTime() { 539 static mach_timebase_info_data_t timebase_info; 540 if (timebase_info.denom == 0) mach_timebase_info(&timebase_info); 541 return (mach_absolute_time() * timebase_info.numer) / timebase_info.denom; 542 } 543 544 uptr GetTlsSize() { 545 return 0; 546 } 547 548 uptr TlsBaseAddr() { 549 uptr segbase = 0; 550 #if defined(__x86_64__) 551 asm("movq %%gs:0,%0" : "=r"(segbase)); 552 #elif defined(__i386__) 553 asm("movl %%gs:0,%0" : "=r"(segbase)); 554 #elif defined(__aarch64__) 555 asm("mrs %x0, tpidrro_el0" : "=r"(segbase)); 556 segbase &= 0x07ul; // clearing lower bits, cpu id stored there 557 #endif 558 return segbase; 559 } 560 561 // The size of the tls on darwin does not appear to be well documented, 562 // however the vm memory map suggests that it is 1024 uptrs in size, 563 // with a size of 0x2000 bytes on x86_64 and 0x1000 bytes on i386. 564 uptr TlsSize() { 565 #if defined(__x86_64__) || defined(__i386__) 566 return 1024 * sizeof(uptr); 567 #else 568 return 0; 569 #endif 570 } 571 572 void GetThreadStackAndTls(bool main, uptr *stk_begin, uptr *stk_end, 573 uptr *tls_begin, uptr *tls_end) { 574 # if !SANITIZER_GO 575 GetThreadStackTopAndBottom(main, stk_end, stk_begin); 576 *tls_begin = TlsBaseAddr(); 577 *tls_end = *tls_begin + TlsSize(); 578 # else 579 *stk_begin = 0; 580 *stk_end = 0; 581 *tls_begin = 0; 582 *tls_end = 0; 583 # endif 584 } 585 586 void ListOfModules::init() { 587 clearOrInit(); 588 MemoryMappingLayout memory_mapping(false); 589 memory_mapping.DumpListOfModules(&modules_); 590 } 591 592 void ListOfModules::fallbackInit() { clear(); } 593 594 static HandleSignalMode GetHandleSignalModeImpl(int signum) { 595 switch (signum) { 596 case SIGABRT: 597 return common_flags()->handle_abort; 598 case SIGILL: 599 return common_flags()->handle_sigill; 600 case SIGTRAP: 601 return common_flags()->handle_sigtrap; 602 case SIGFPE: 603 return common_flags()->handle_sigfpe; 604 case SIGSEGV: 605 return common_flags()->handle_segv; 606 case SIGBUS: 607 return common_flags()->handle_sigbus; 608 } 609 return kHandleSignalNo; 610 } 611 612 HandleSignalMode GetHandleSignalMode(int signum) { 613 // Handling fatal signals on watchOS and tvOS devices is disallowed. 614 if ((SANITIZER_WATCHOS || SANITIZER_TVOS) && !(SANITIZER_IOSSIM)) 615 return kHandleSignalNo; 616 HandleSignalMode result = GetHandleSignalModeImpl(signum); 617 if (result == kHandleSignalYes && !common_flags()->allow_user_segv_handler) 618 return kHandleSignalExclusive; 619 return result; 620 } 621 622 // Offset example: 623 // XNU 17 -- macOS 10.13 -- iOS 11 -- tvOS 11 -- watchOS 4 624 constexpr u16 GetOSMajorKernelOffset() { 625 if (TARGET_OS_OSX) return 4; 626 if (TARGET_OS_IOS || TARGET_OS_TV) return 6; 627 if (TARGET_OS_WATCH) return 13; 628 } 629 630 using VersStr = char[64]; 631 632 static uptr ApproximateOSVersionViaKernelVersion(VersStr vers) { 633 u16 kernel_major = GetDarwinKernelVersion().major; 634 u16 offset = GetOSMajorKernelOffset(); 635 CHECK_GE(kernel_major, offset); 636 u16 os_major = kernel_major - offset; 637 638 const char *format = "%d.0"; 639 if (TARGET_OS_OSX) { 640 if (os_major >= 16) { // macOS 11+ 641 os_major -= 5; 642 } else { // macOS 10.15 and below 643 format = "10.%d"; 644 } 645 } 646 return internal_snprintf(vers, sizeof(VersStr), format, os_major); 647 } 648 649 static void GetOSVersion(VersStr vers) { 650 uptr len = sizeof(VersStr); 651 if (SANITIZER_IOSSIM) { 652 const char *vers_env = GetEnv("SIMULATOR_RUNTIME_VERSION"); 653 if (!vers_env) { 654 Report("ERROR: Running in simulator but SIMULATOR_RUNTIME_VERSION env " 655 "var is not set.\n"); 656 Die(); 657 } 658 len = internal_strlcpy(vers, vers_env, len); 659 } else { 660 int res = 661 internal_sysctlbyname("kern.osproductversion", vers, &len, nullptr, 0); 662 663 // XNU 17 (macOS 10.13) and below do not provide the sysctl 664 // `kern.osproductversion` entry (res != 0). 665 bool no_os_version = res != 0; 666 667 // For launchd, sanitizer initialization runs before sysctl is setup 668 // (res == 0 && len != strlen(vers), vers is not a valid version). However, 669 // the kernel version `kern.osrelease` is available. 670 bool launchd = (res == 0 && internal_strlen(vers) < 3); 671 if (launchd) CHECK_EQ(internal_getpid(), 1); 672 673 if (no_os_version || launchd) { 674 len = ApproximateOSVersionViaKernelVersion(vers); 675 } 676 } 677 CHECK_LT(len, sizeof(VersStr)); 678 } 679 680 void ParseVersion(const char *vers, u16 *major, u16 *minor) { 681 // Format: <major>.<minor>[.<patch>]\0 682 CHECK_GE(internal_strlen(vers), 3); 683 const char *p = vers; 684 *major = internal_simple_strtoll(p, &p, /*base=*/10); 685 CHECK_EQ(*p, '.'); 686 p += 1; 687 *minor = internal_simple_strtoll(p, &p, /*base=*/10); 688 } 689 690 // Aligned versions example: 691 // macOS 10.15 -- iOS 13 -- tvOS 13 -- watchOS 6 692 static void MapToMacos(u16 *major, u16 *minor) { 693 if (TARGET_OS_OSX) 694 return; 695 696 if (TARGET_OS_IOS || TARGET_OS_TV) 697 *major += 2; 698 else if (TARGET_OS_WATCH) 699 *major += 9; 700 else 701 UNREACHABLE("unsupported platform"); 702 703 if (*major >= 16) { // macOS 11+ 704 *major -= 5; 705 } else { // macOS 10.15 and below 706 *minor = *major; 707 *major = 10; 708 } 709 } 710 711 static MacosVersion GetMacosAlignedVersionInternal() { 712 VersStr vers = {}; 713 GetOSVersion(vers); 714 715 u16 major, minor; 716 ParseVersion(vers, &major, &minor); 717 MapToMacos(&major, &minor); 718 719 return MacosVersion(major, minor); 720 } 721 722 static_assert(sizeof(MacosVersion) == sizeof(atomic_uint32_t::Type), 723 "MacosVersion cache size"); 724 static atomic_uint32_t cached_macos_version; 725 726 MacosVersion GetMacosAlignedVersion() { 727 atomic_uint32_t::Type result = 728 atomic_load(&cached_macos_version, memory_order_acquire); 729 if (!result) { 730 MacosVersion version = GetMacosAlignedVersionInternal(); 731 result = *reinterpret_cast<atomic_uint32_t::Type *>(&version); 732 atomic_store(&cached_macos_version, result, memory_order_release); 733 } 734 return *reinterpret_cast<MacosVersion *>(&result); 735 } 736 737 DarwinKernelVersion GetDarwinKernelVersion() { 738 VersStr vers = {}; 739 uptr len = sizeof(VersStr); 740 int res = internal_sysctlbyname("kern.osrelease", vers, &len, nullptr, 0); 741 CHECK_EQ(res, 0); 742 CHECK_LT(len, sizeof(VersStr)); 743 744 u16 major, minor; 745 ParseVersion(vers, &major, &minor); 746 747 return DarwinKernelVersion(major, minor); 748 } 749 750 uptr GetRSS() { 751 struct task_basic_info info; 752 unsigned count = TASK_BASIC_INFO_COUNT; 753 kern_return_t result = 754 task_info(mach_task_self(), TASK_BASIC_INFO, (task_info_t)&info, &count); 755 if (UNLIKELY(result != KERN_SUCCESS)) { 756 Report("Cannot get task info. Error: %d\n", result); 757 Die(); 758 } 759 return info.resident_size; 760 } 761 762 void *internal_start_thread(void *(*func)(void *arg), void *arg) { 763 // Start the thread with signals blocked, otherwise it can steal user signals. 764 __sanitizer_sigset_t set, old; 765 internal_sigfillset(&set); 766 internal_sigprocmask(SIG_SETMASK, &set, &old); 767 pthread_t th; 768 pthread_create(&th, 0, func, arg); 769 internal_sigprocmask(SIG_SETMASK, &old, 0); 770 return th; 771 } 772 773 void internal_join_thread(void *th) { pthread_join((pthread_t)th, 0); } 774 775 #if !SANITIZER_GO 776 static Mutex syslog_lock; 777 # endif 778 779 void WriteOneLineToSyslog(const char *s) { 780 #if !SANITIZER_GO 781 syslog_lock.CheckLocked(); 782 if (GetMacosAlignedVersion() >= MacosVersion(10, 12)) { 783 os_log_error(OS_LOG_DEFAULT, "%{public}s", s); 784 } else { 785 #pragma clang diagnostic push 786 // as_log is deprecated. 787 #pragma clang diagnostic ignored "-Wdeprecated-declarations" 788 asl_log(nullptr, nullptr, ASL_LEVEL_ERR, "%s", s); 789 #pragma clang diagnostic pop 790 } 791 #endif 792 } 793 794 // buffer to store crash report application information 795 static char crashreporter_info_buff[__sanitizer::kErrorMessageBufferSize] = {}; 796 static Mutex crashreporter_info_mutex; 797 798 extern "C" { 799 800 #if HAVE_CRASHREPORTERCLIENT_H 801 // Available in CRASHREPORTER_ANNOTATIONS_VERSION 5+ 802 # ifdef CRASHREPORTER_ANNOTATIONS_INITIALIZER 803 CRASHREPORTER_ANNOTATIONS_INITIALIZER() 804 # else 805 // Support for older CrashRerporter annotiations 806 CRASH_REPORTER_CLIENT_HIDDEN 807 struct crashreporter_annotations_t gCRAnnotations 808 __attribute__((section("__DATA," CRASHREPORTER_ANNOTATIONS_SECTION))) = { 809 CRASHREPORTER_ANNOTATIONS_VERSION, 810 0, 811 0, 812 0, 813 0, 814 0, 815 0, 816 # if CRASHREPORTER_ANNOTATIONS_VERSION > 4 817 0, 818 # endif 819 }; 820 # endif 821 # else 822 // Revert to previous crash reporter API if client header is not available 823 static const char *__crashreporter_info__ __attribute__((__used__)) = 824 &crashreporter_info_buff[0]; 825 asm(".desc ___crashreporter_info__, 0x10"); 826 #endif // HAVE_CRASHREPORTERCLIENT_H 827 828 } // extern "C" 829 830 static void CRAppendCrashLogMessage(const char *msg) { 831 Lock l(&crashreporter_info_mutex); 832 internal_strlcat(crashreporter_info_buff, msg, 833 sizeof(crashreporter_info_buff)); 834 #if HAVE_CRASHREPORTERCLIENT_H 835 (void)CRSetCrashLogMessage(crashreporter_info_buff); 836 #endif 837 } 838 839 void LogMessageOnPrintf(const char *str) { 840 // Log all printf output to CrashLog. 841 if (common_flags()->abort_on_error) 842 CRAppendCrashLogMessage(str); 843 } 844 845 void LogFullErrorReport(const char *buffer) { 846 #if !SANITIZER_GO 847 // Log with os_trace. This will make it into the crash log. 848 #if SANITIZER_OS_TRACE 849 #pragma clang diagnostic push 850 // os_trace is deprecated. 851 #pragma clang diagnostic ignored "-Wdeprecated-declarations" 852 if (GetMacosAlignedVersion() >= MacosVersion(10, 10)) { 853 // os_trace requires the message (format parameter) to be a string literal. 854 if (internal_strncmp(SanitizerToolName, "AddressSanitizer", 855 sizeof("AddressSanitizer") - 1) == 0) 856 os_trace("Address Sanitizer reported a failure."); 857 else if (internal_strncmp(SanitizerToolName, "UndefinedBehaviorSanitizer", 858 sizeof("UndefinedBehaviorSanitizer") - 1) == 0) 859 os_trace("Undefined Behavior Sanitizer reported a failure."); 860 else if (internal_strncmp(SanitizerToolName, "ThreadSanitizer", 861 sizeof("ThreadSanitizer") - 1) == 0) 862 os_trace("Thread Sanitizer reported a failure."); 863 else 864 os_trace("Sanitizer tool reported a failure."); 865 866 if (common_flags()->log_to_syslog) 867 os_trace("Consult syslog for more information."); 868 } 869 #pragma clang diagnostic pop 870 #endif 871 872 // Log to syslog. 873 // The logging on OS X may call pthread_create so we need the threading 874 // environment to be fully initialized. Also, this should never be called when 875 // holding the thread registry lock since that may result in a deadlock. If 876 // the reporting thread holds the thread registry mutex, and asl_log waits 877 // for GCD to dispatch a new thread, the process will deadlock, because the 878 // pthread_create wrapper needs to acquire the lock as well. 879 Lock l(&syslog_lock); 880 if (common_flags()->log_to_syslog) 881 WriteToSyslog(buffer); 882 883 // The report is added to CrashLog as part of logging all of Printf output. 884 #endif 885 } 886 887 SignalContext::WriteFlag SignalContext::GetWriteFlag() const { 888 #if defined(__x86_64__) || defined(__i386__) 889 ucontext_t *ucontext = static_cast<ucontext_t*>(context); 890 return ucontext->uc_mcontext->__es.__err & 2 /*T_PF_WRITE*/ ? Write : Read; 891 #elif defined(__arm64__) 892 ucontext_t *ucontext = static_cast<ucontext_t*>(context); 893 return ucontext->uc_mcontext->__es.__esr & 0x40 /*ISS_DA_WNR*/ ? Write : Read; 894 #else 895 return Unknown; 896 #endif 897 } 898 899 bool SignalContext::IsTrueFaultingAddress() const { 900 auto si = static_cast<const siginfo_t *>(siginfo); 901 // "Real" SIGSEGV codes (e.g., SEGV_MAPERR, SEGV_MAPERR) are non-zero. 902 return si->si_signo == SIGSEGV && si->si_code != 0; 903 } 904 905 #if defined(__aarch64__) && defined(arm_thread_state64_get_sp) 906 #define AARCH64_GET_REG(r) \ 907 (uptr)ptrauth_strip( \ 908 (void *)arm_thread_state64_get_##r(ucontext->uc_mcontext->__ss), 0) 909 #else 910 #define AARCH64_GET_REG(r) (uptr)ucontext->uc_mcontext->__ss.__##r 911 #endif 912 913 static void GetPcSpBp(void *context, uptr *pc, uptr *sp, uptr *bp) { 914 ucontext_t *ucontext = (ucontext_t*)context; 915 # if defined(__aarch64__) 916 *pc = AARCH64_GET_REG(pc); 917 *bp = AARCH64_GET_REG(fp); 918 *sp = AARCH64_GET_REG(sp); 919 # elif defined(__x86_64__) 920 *pc = ucontext->uc_mcontext->__ss.__rip; 921 *bp = ucontext->uc_mcontext->__ss.__rbp; 922 *sp = ucontext->uc_mcontext->__ss.__rsp; 923 # elif defined(__arm__) 924 *pc = ucontext->uc_mcontext->__ss.__pc; 925 *bp = ucontext->uc_mcontext->__ss.__r[7]; 926 *sp = ucontext->uc_mcontext->__ss.__sp; 927 # elif defined(__i386__) 928 *pc = ucontext->uc_mcontext->__ss.__eip; 929 *bp = ucontext->uc_mcontext->__ss.__ebp; 930 *sp = ucontext->uc_mcontext->__ss.__esp; 931 # else 932 # error "Unknown architecture" 933 # endif 934 } 935 936 void SignalContext::InitPcSpBp() { 937 addr = (uptr)ptrauth_strip((void *)addr, 0); 938 GetPcSpBp(context, &pc, &sp, &bp); 939 } 940 941 // ASan/TSan use mmap in a way that creates “deallocation gaps” which triggers 942 // EXC_GUARD exceptions on macOS 10.15+ (XNU 19.0+). 943 static void DisableMmapExcGuardExceptions() { 944 using task_exc_guard_behavior_t = uint32_t; 945 using task_set_exc_guard_behavior_t = 946 kern_return_t(task_t task, task_exc_guard_behavior_t behavior); 947 auto *set_behavior = (task_set_exc_guard_behavior_t *)dlsym( 948 RTLD_DEFAULT, "task_set_exc_guard_behavior"); 949 if (set_behavior == nullptr) return; 950 const task_exc_guard_behavior_t task_exc_guard_none = 0; 951 set_behavior(mach_task_self(), task_exc_guard_none); 952 } 953 954 static void VerifyInterceptorsWorking(); 955 static void StripEnv(); 956 957 void InitializePlatformEarly() { 958 // Only use xnu_fast_mmap when on x86_64 and the kernel supports it. 959 use_xnu_fast_mmap = 960 #if defined(__x86_64__) 961 GetDarwinKernelVersion() >= DarwinKernelVersion(17, 5); 962 #else 963 false; 964 #endif 965 if (GetDarwinKernelVersion() >= DarwinKernelVersion(19, 0)) 966 DisableMmapExcGuardExceptions(); 967 968 # if !SANITIZER_GO 969 MonotonicNanoTime(); // Call to initialize mach_timebase_info 970 VerifyInterceptorsWorking(); 971 StripEnv(); 972 # endif 973 } 974 975 #if !SANITIZER_GO 976 static const char kDyldInsertLibraries[] = "DYLD_INSERT_LIBRARIES"; 977 LowLevelAllocator allocator_for_env; 978 979 static bool ShouldCheckInterceptors() { 980 // Restrict "interceptors working?" check 981 const char *sanitizer_names[] = {"AddressSanitizer", "ThreadSanitizer", 982 "RealtimeSanitizer"}; 983 size_t count = sizeof(sanitizer_names) / sizeof(sanitizer_names[0]); 984 for (size_t i = 0; i < count; i++) { 985 if (internal_strcmp(sanitizer_names[i], SanitizerToolName) == 0) 986 return true; 987 } 988 return false; 989 } 990 991 static void VerifyInterceptorsWorking() { 992 if (!common_flags()->verify_interceptors || !ShouldCheckInterceptors()) 993 return; 994 995 // Verify that interceptors really work. We'll use dlsym to locate 996 // "puts", if interceptors are working, it should really point to 997 // "wrap_puts" within our own dylib. 998 Dl_info info_puts, info_runtime; 999 RAW_CHECK(dladdr(dlsym(RTLD_DEFAULT, "puts"), &info_puts)); 1000 RAW_CHECK(dladdr((void *)&VerifyInterceptorsWorking, &info_runtime)); 1001 if (internal_strcmp(info_puts.dli_fname, info_runtime.dli_fname) != 0) { 1002 Report( 1003 "ERROR: Interceptors are not working. This may be because %s is " 1004 "loaded too late (e.g. via dlopen). Please launch the executable " 1005 "with:\n%s=%s\n", 1006 SanitizerToolName, kDyldInsertLibraries, info_runtime.dli_fname); 1007 RAW_CHECK("interceptors not installed" && 0); 1008 } 1009 } 1010 1011 // Change the value of the env var |name|, leaking the original value. 1012 // If |name_value| is NULL, the variable is deleted from the environment, 1013 // otherwise the corresponding "NAME=value" string is replaced with 1014 // |name_value|. 1015 static void LeakyResetEnv(const char *name, const char *name_value) { 1016 char **env = GetEnviron(); 1017 uptr name_len = internal_strlen(name); 1018 while (*env != 0) { 1019 uptr len = internal_strlen(*env); 1020 if (len > name_len) { 1021 const char *p = *env; 1022 if (!internal_memcmp(p, name, name_len) && p[name_len] == '=') { 1023 // Match. 1024 if (name_value) { 1025 // Replace the old value with the new one. 1026 *env = const_cast<char*>(name_value); 1027 } else { 1028 // Shift the subsequent pointers back. 1029 char **del = env; 1030 do { 1031 del[0] = del[1]; 1032 } while (*del++); 1033 } 1034 } 1035 } 1036 env++; 1037 } 1038 } 1039 1040 static void StripEnv() { 1041 if (!common_flags()->strip_env) 1042 return; 1043 1044 char *dyld_insert_libraries = 1045 const_cast<char *>(GetEnv(kDyldInsertLibraries)); 1046 if (!dyld_insert_libraries) 1047 return; 1048 1049 Dl_info info; 1050 RAW_CHECK(dladdr((void *)&StripEnv, &info)); 1051 const char *dylib_name = StripModuleName(info.dli_fname); 1052 bool lib_is_in_env = internal_strstr(dyld_insert_libraries, dylib_name); 1053 if (!lib_is_in_env) 1054 return; 1055 1056 // DYLD_INSERT_LIBRARIES is set and contains the runtime library. Let's remove 1057 // the dylib from the environment variable, because interceptors are installed 1058 // and we don't want our children to inherit the variable. 1059 1060 uptr old_env_len = internal_strlen(dyld_insert_libraries); 1061 uptr dylib_name_len = internal_strlen(dylib_name); 1062 uptr env_name_len = internal_strlen(kDyldInsertLibraries); 1063 // Allocate memory to hold the previous env var name, its value, the '=' 1064 // sign and the '\0' char. 1065 char *new_env = (char*)allocator_for_env.Allocate( 1066 old_env_len + 2 + env_name_len); 1067 RAW_CHECK(new_env); 1068 internal_memset(new_env, '\0', old_env_len + 2 + env_name_len); 1069 internal_strncpy(new_env, kDyldInsertLibraries, env_name_len); 1070 new_env[env_name_len] = '='; 1071 char *new_env_pos = new_env + env_name_len + 1; 1072 1073 // Iterate over colon-separated pieces of |dyld_insert_libraries|. 1074 char *piece_start = dyld_insert_libraries; 1075 char *piece_end = NULL; 1076 char *old_env_end = dyld_insert_libraries + old_env_len; 1077 do { 1078 if (piece_start[0] == ':') piece_start++; 1079 piece_end = internal_strchr(piece_start, ':'); 1080 if (!piece_end) piece_end = dyld_insert_libraries + old_env_len; 1081 if ((uptr)(piece_start - dyld_insert_libraries) > old_env_len) break; 1082 uptr piece_len = piece_end - piece_start; 1083 1084 char *filename_start = 1085 (char *)internal_memrchr(piece_start, '/', piece_len); 1086 uptr filename_len = piece_len; 1087 if (filename_start) { 1088 filename_start += 1; 1089 filename_len = piece_len - (filename_start - piece_start); 1090 } else { 1091 filename_start = piece_start; 1092 } 1093 1094 // If the current piece isn't the runtime library name, 1095 // append it to new_env. 1096 if ((dylib_name_len != filename_len) || 1097 (internal_memcmp(filename_start, dylib_name, dylib_name_len) != 0)) { 1098 if (new_env_pos != new_env + env_name_len + 1) { 1099 new_env_pos[0] = ':'; 1100 new_env_pos++; 1101 } 1102 internal_strncpy(new_env_pos, piece_start, piece_len); 1103 new_env_pos += piece_len; 1104 } 1105 // Move on to the next piece. 1106 piece_start = piece_end; 1107 } while (piece_start < old_env_end); 1108 1109 // Can't use setenv() here, because it requires the allocator to be 1110 // initialized. 1111 // FIXME: instead of filtering DYLD_INSERT_LIBRARIES here, do it in 1112 // a separate function called after InitializeAllocator(). 1113 if (new_env_pos == new_env + env_name_len + 1) new_env = NULL; 1114 LeakyResetEnv(kDyldInsertLibraries, new_env); 1115 } 1116 #endif // SANITIZER_GO 1117 1118 char **GetArgv() { 1119 return *_NSGetArgv(); 1120 } 1121 1122 #if SANITIZER_IOS && !SANITIZER_IOSSIM 1123 // The task_vm_info struct is normally provided by the macOS SDK, but we need 1124 // fields only available in 10.12+. Declare the struct manually to be able to 1125 // build against older SDKs. 1126 struct __sanitizer_task_vm_info { 1127 mach_vm_size_t virtual_size; 1128 integer_t region_count; 1129 integer_t page_size; 1130 mach_vm_size_t resident_size; 1131 mach_vm_size_t resident_size_peak; 1132 mach_vm_size_t device; 1133 mach_vm_size_t device_peak; 1134 mach_vm_size_t internal; 1135 mach_vm_size_t internal_peak; 1136 mach_vm_size_t external; 1137 mach_vm_size_t external_peak; 1138 mach_vm_size_t reusable; 1139 mach_vm_size_t reusable_peak; 1140 mach_vm_size_t purgeable_volatile_pmap; 1141 mach_vm_size_t purgeable_volatile_resident; 1142 mach_vm_size_t purgeable_volatile_virtual; 1143 mach_vm_size_t compressed; 1144 mach_vm_size_t compressed_peak; 1145 mach_vm_size_t compressed_lifetime; 1146 mach_vm_size_t phys_footprint; 1147 mach_vm_address_t min_address; 1148 mach_vm_address_t max_address; 1149 }; 1150 #define __SANITIZER_TASK_VM_INFO_COUNT ((mach_msg_type_number_t) \ 1151 (sizeof(__sanitizer_task_vm_info) / sizeof(natural_t))) 1152 1153 static uptr GetTaskInfoMaxAddress() { 1154 __sanitizer_task_vm_info vm_info = {} /* zero initialize */; 1155 mach_msg_type_number_t count = __SANITIZER_TASK_VM_INFO_COUNT; 1156 int err = task_info(mach_task_self(), TASK_VM_INFO, (int *)&vm_info, &count); 1157 return err ? 0 : vm_info.max_address; 1158 } 1159 1160 uptr GetMaxUserVirtualAddress() { 1161 static uptr max_vm = GetTaskInfoMaxAddress(); 1162 if (max_vm != 0) { 1163 const uptr ret_value = max_vm - 1; 1164 CHECK_LE(ret_value, SANITIZER_MMAP_RANGE_SIZE); 1165 return ret_value; 1166 } 1167 1168 // xnu cannot provide vm address limit 1169 # if SANITIZER_WORDSIZE == 32 1170 constexpr uptr fallback_max_vm = 0xffe00000 - 1; 1171 # else 1172 constexpr uptr fallback_max_vm = 0x200000000 - 1; 1173 # endif 1174 static_assert(fallback_max_vm <= SANITIZER_MMAP_RANGE_SIZE, 1175 "Max virtual address must be less than mmap range size."); 1176 return fallback_max_vm; 1177 } 1178 1179 #else // !SANITIZER_IOS 1180 1181 uptr GetMaxUserVirtualAddress() { 1182 # if SANITIZER_WORDSIZE == 64 1183 constexpr uptr max_vm = (1ULL << 47) - 1; // 0x00007fffffffffffUL; 1184 # else // SANITIZER_WORDSIZE == 32 1185 static_assert(SANITIZER_WORDSIZE == 32, "Wrong wordsize"); 1186 constexpr uptr max_vm = (1ULL << 32) - 1; // 0xffffffff; 1187 # endif 1188 static_assert(max_vm <= SANITIZER_MMAP_RANGE_SIZE, 1189 "Max virtual address must be less than mmap range size."); 1190 return max_vm; 1191 } 1192 #endif 1193 1194 uptr GetMaxVirtualAddress() { 1195 return GetMaxUserVirtualAddress(); 1196 } 1197 1198 uptr MapDynamicShadow(uptr shadow_size_bytes, uptr shadow_scale, 1199 uptr min_shadow_base_alignment, uptr &high_mem_end, 1200 uptr granularity) { 1201 const uptr alignment = 1202 Max<uptr>(granularity << shadow_scale, 1ULL << min_shadow_base_alignment); 1203 const uptr left_padding = 1204 Max<uptr>(granularity, 1ULL << min_shadow_base_alignment); 1205 1206 uptr space_size = shadow_size_bytes + left_padding; 1207 1208 uptr largest_gap_found = 0; 1209 uptr max_occupied_addr = 0; 1210 VReport(2, "FindDynamicShadowStart, space_size = %p\n", (void *)space_size); 1211 uptr shadow_start = 1212 FindAvailableMemoryRange(space_size, alignment, granularity, 1213 &largest_gap_found, &max_occupied_addr); 1214 // If the shadow doesn't fit, restrict the address space to make it fit. 1215 if (shadow_start == 0) { 1216 VReport( 1217 2, 1218 "Shadow doesn't fit, largest_gap_found = %p, max_occupied_addr = %p\n", 1219 (void *)largest_gap_found, (void *)max_occupied_addr); 1220 uptr new_max_vm = RoundDownTo(largest_gap_found << shadow_scale, alignment); 1221 if (new_max_vm < max_occupied_addr) { 1222 Report("Unable to find a memory range for dynamic shadow.\n"); 1223 Report( 1224 "space_size = %p, largest_gap_found = %p, max_occupied_addr = %p, " 1225 "new_max_vm = %p\n", 1226 (void *)space_size, (void *)largest_gap_found, 1227 (void *)max_occupied_addr, (void *)new_max_vm); 1228 CHECK(0 && "cannot place shadow"); 1229 } 1230 RestrictMemoryToMaxAddress(new_max_vm); 1231 high_mem_end = new_max_vm - 1; 1232 space_size = (high_mem_end >> shadow_scale) + left_padding; 1233 VReport(2, "FindDynamicShadowStart, space_size = %p\n", (void *)space_size); 1234 shadow_start = FindAvailableMemoryRange(space_size, alignment, granularity, 1235 nullptr, nullptr); 1236 if (shadow_start == 0) { 1237 Report("Unable to find a memory range after restricting VM.\n"); 1238 CHECK(0 && "cannot place shadow after restricting vm"); 1239 } 1240 } 1241 CHECK_NE((uptr)0, shadow_start); 1242 CHECK(IsAligned(shadow_start, alignment)); 1243 return shadow_start; 1244 } 1245 1246 uptr MapDynamicShadowAndAliases(uptr shadow_size, uptr alias_size, 1247 uptr num_aliases, uptr ring_buffer_size) { 1248 CHECK(false && "HWASan aliasing is unimplemented on Mac"); 1249 return 0; 1250 } 1251 1252 uptr FindAvailableMemoryRange(uptr size, uptr alignment, uptr left_padding, 1253 uptr *largest_gap_found, 1254 uptr *max_occupied_addr) { 1255 typedef vm_region_submap_short_info_data_64_t RegionInfo; 1256 enum { kRegionInfoSize = VM_REGION_SUBMAP_SHORT_INFO_COUNT_64 }; 1257 // Start searching for available memory region past PAGEZERO, which is 1258 // 4KB on 32-bit and 4GB on 64-bit. 1259 mach_vm_address_t start_address = 1260 (SANITIZER_WORDSIZE == 32) ? 0x000000001000 : 0x000100000000; 1261 1262 const mach_vm_address_t max_vm_address = GetMaxVirtualAddress() + 1; 1263 mach_vm_address_t address = start_address; 1264 mach_vm_address_t free_begin = start_address; 1265 kern_return_t kr = KERN_SUCCESS; 1266 if (largest_gap_found) *largest_gap_found = 0; 1267 if (max_occupied_addr) *max_occupied_addr = 0; 1268 while (kr == KERN_SUCCESS) { 1269 mach_vm_size_t vmsize = 0; 1270 natural_t depth = 0; 1271 RegionInfo vminfo; 1272 mach_msg_type_number_t count = kRegionInfoSize; 1273 kr = mach_vm_region_recurse(mach_task_self(), &address, &vmsize, &depth, 1274 (vm_region_info_t)&vminfo, &count); 1275 if (kr == KERN_INVALID_ADDRESS) { 1276 // No more regions beyond "address", consider the gap at the end of VM. 1277 address = max_vm_address; 1278 vmsize = 0; 1279 } else { 1280 if (max_occupied_addr) *max_occupied_addr = address + vmsize; 1281 } 1282 if (free_begin != address) { 1283 // We found a free region [free_begin..address-1]. 1284 uptr gap_start = RoundUpTo((uptr)free_begin + left_padding, alignment); 1285 uptr gap_end = RoundDownTo((uptr)Min(address, max_vm_address), alignment); 1286 uptr gap_size = gap_end > gap_start ? gap_end - gap_start : 0; 1287 if (size < gap_size) { 1288 return gap_start; 1289 } 1290 1291 if (largest_gap_found && *largest_gap_found < gap_size) { 1292 *largest_gap_found = gap_size; 1293 } 1294 } 1295 // Move to the next region. 1296 address += vmsize; 1297 free_begin = address; 1298 } 1299 1300 // We looked at all free regions and could not find one large enough. 1301 return 0; 1302 } 1303 1304 // FIXME implement on this platform. 1305 void GetMemoryProfile(fill_profile_f cb, uptr *stats) {} 1306 1307 void SignalContext::DumpAllRegisters(void *context) { 1308 Report("Register values:\n"); 1309 1310 ucontext_t *ucontext = (ucontext_t*)context; 1311 # define DUMPREG64(r) \ 1312 Printf("%s = 0x%016llx ", #r, ucontext->uc_mcontext->__ss.__ ## r); 1313 # define DUMPREGA64(r) \ 1314 Printf(" %s = 0x%016lx ", #r, AARCH64_GET_REG(r)); 1315 # define DUMPREG32(r) \ 1316 Printf("%s = 0x%08x ", #r, ucontext->uc_mcontext->__ss.__ ## r); 1317 # define DUMPREG_(r) Printf(" "); DUMPREG(r); 1318 # define DUMPREG__(r) Printf(" "); DUMPREG(r); 1319 # define DUMPREG___(r) Printf(" "); DUMPREG(r); 1320 1321 # if defined(__x86_64__) 1322 # define DUMPREG(r) DUMPREG64(r) 1323 DUMPREG(rax); DUMPREG(rbx); DUMPREG(rcx); DUMPREG(rdx); Printf("\n"); 1324 DUMPREG(rdi); DUMPREG(rsi); DUMPREG(rbp); DUMPREG(rsp); Printf("\n"); 1325 DUMPREG_(r8); DUMPREG_(r9); DUMPREG(r10); DUMPREG(r11); Printf("\n"); 1326 DUMPREG(r12); DUMPREG(r13); DUMPREG(r14); DUMPREG(r15); Printf("\n"); 1327 # elif defined(__i386__) 1328 # define DUMPREG(r) DUMPREG32(r) 1329 DUMPREG(eax); DUMPREG(ebx); DUMPREG(ecx); DUMPREG(edx); Printf("\n"); 1330 DUMPREG(edi); DUMPREG(esi); DUMPREG(ebp); DUMPREG(esp); Printf("\n"); 1331 # elif defined(__aarch64__) 1332 # define DUMPREG(r) DUMPREG64(r) 1333 DUMPREG_(x[0]); DUMPREG_(x[1]); DUMPREG_(x[2]); DUMPREG_(x[3]); Printf("\n"); 1334 DUMPREG_(x[4]); DUMPREG_(x[5]); DUMPREG_(x[6]); DUMPREG_(x[7]); Printf("\n"); 1335 DUMPREG_(x[8]); DUMPREG_(x[9]); DUMPREG(x[10]); DUMPREG(x[11]); Printf("\n"); 1336 DUMPREG(x[12]); DUMPREG(x[13]); DUMPREG(x[14]); DUMPREG(x[15]); Printf("\n"); 1337 DUMPREG(x[16]); DUMPREG(x[17]); DUMPREG(x[18]); DUMPREG(x[19]); Printf("\n"); 1338 DUMPREG(x[20]); DUMPREG(x[21]); DUMPREG(x[22]); DUMPREG(x[23]); Printf("\n"); 1339 DUMPREG(x[24]); DUMPREG(x[25]); DUMPREG(x[26]); DUMPREG(x[27]); Printf("\n"); 1340 DUMPREG(x[28]); DUMPREGA64(fp); DUMPREGA64(lr); DUMPREGA64(sp); Printf("\n"); 1341 # elif defined(__arm__) 1342 # define DUMPREG(r) DUMPREG32(r) 1343 DUMPREG_(r[0]); DUMPREG_(r[1]); DUMPREG_(r[2]); DUMPREG_(r[3]); Printf("\n"); 1344 DUMPREG_(r[4]); DUMPREG_(r[5]); DUMPREG_(r[6]); DUMPREG_(r[7]); Printf("\n"); 1345 DUMPREG_(r[8]); DUMPREG_(r[9]); DUMPREG(r[10]); DUMPREG(r[11]); Printf("\n"); 1346 DUMPREG(r[12]); DUMPREG___(sp); DUMPREG___(lr); DUMPREG___(pc); Printf("\n"); 1347 # else 1348 # error "Unknown architecture" 1349 # endif 1350 1351 # undef DUMPREG64 1352 # undef DUMPREG32 1353 # undef DUMPREG_ 1354 # undef DUMPREG__ 1355 # undef DUMPREG___ 1356 # undef DUMPREG 1357 } 1358 1359 static inline bool CompareBaseAddress(const LoadedModule &a, 1360 const LoadedModule &b) { 1361 return a.base_address() < b.base_address(); 1362 } 1363 1364 void FormatUUID(char *out, uptr size, const u8 *uuid) { 1365 internal_snprintf(out, size, 1366 "<%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-" 1367 "%02X%02X%02X%02X%02X%02X>", 1368 uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5], 1369 uuid[6], uuid[7], uuid[8], uuid[9], uuid[10], uuid[11], 1370 uuid[12], uuid[13], uuid[14], uuid[15]); 1371 } 1372 1373 void DumpProcessMap() { 1374 Printf("Process module map:\n"); 1375 MemoryMappingLayout memory_mapping(false); 1376 InternalMmapVector<LoadedModule> modules; 1377 modules.reserve(128); 1378 memory_mapping.DumpListOfModules(&modules); 1379 Sort(modules.data(), modules.size(), CompareBaseAddress); 1380 for (uptr i = 0; i < modules.size(); ++i) { 1381 char uuid_str[128]; 1382 FormatUUID(uuid_str, sizeof(uuid_str), modules[i].uuid()); 1383 Printf("%p-%p %s (%s) %s\n", (void *)modules[i].base_address(), 1384 (void *)modules[i].max_address(), modules[i].full_name(), 1385 ModuleArchToString(modules[i].arch()), uuid_str); 1386 } 1387 Printf("End of module map.\n"); 1388 } 1389 1390 void CheckNoDeepBind(const char *filename, int flag) { 1391 // Do nothing. 1392 } 1393 1394 bool GetRandom(void *buffer, uptr length, bool blocking) { 1395 if (!buffer || !length || length > 256) 1396 return false; 1397 // arc4random never fails. 1398 REAL(arc4random_buf)(buffer, length); 1399 return true; 1400 } 1401 1402 u32 GetNumberOfCPUs() { 1403 return (u32)sysconf(_SC_NPROCESSORS_ONLN); 1404 } 1405 1406 void InitializePlatformCommonFlags(CommonFlags *cf) {} 1407 1408 // Pthread introspection hook 1409 // 1410 // * GCD worker threads are created without a call to pthread_create(), but we 1411 // still need to register these threads (with ThreadCreate/Start()). 1412 // * We use the "pthread introspection hook" below to observe the creation of 1413 // such threads. 1414 // * GCD worker threads don't have parent threads and the CREATE event is 1415 // delivered in the context of the thread itself. CREATE events for regular 1416 // threads, are delivered on the parent. We use this to tell apart which 1417 // threads are GCD workers with `thread == pthread_self()`. 1418 // 1419 static pthread_introspection_hook_t prev_pthread_introspection_hook; 1420 static ThreadEventCallbacks thread_event_callbacks; 1421 1422 static void sanitizer_pthread_introspection_hook(unsigned int event, 1423 pthread_t thread, void *addr, 1424 size_t size) { 1425 // create -> start -> terminate -> destroy 1426 // * create/destroy are usually (not guaranteed) delivered on the parent and 1427 // track resource allocation/reclamation 1428 // * start/terminate are guaranteed to be delivered in the context of the 1429 // thread and give hooks into "just after (before) thread starts (stops) 1430 // executing" 1431 DCHECK(event >= PTHREAD_INTROSPECTION_THREAD_CREATE && 1432 event <= PTHREAD_INTROSPECTION_THREAD_DESTROY); 1433 1434 if (event == PTHREAD_INTROSPECTION_THREAD_CREATE) { 1435 bool gcd_worker = (thread == pthread_self()); 1436 if (thread_event_callbacks.create) 1437 thread_event_callbacks.create((uptr)thread, gcd_worker); 1438 } else if (event == PTHREAD_INTROSPECTION_THREAD_START) { 1439 CHECK_EQ(thread, pthread_self()); 1440 if (thread_event_callbacks.start) 1441 thread_event_callbacks.start((uptr)thread); 1442 } 1443 1444 if (prev_pthread_introspection_hook) 1445 prev_pthread_introspection_hook(event, thread, addr, size); 1446 1447 if (event == PTHREAD_INTROSPECTION_THREAD_TERMINATE) { 1448 CHECK_EQ(thread, pthread_self()); 1449 if (thread_event_callbacks.terminate) 1450 thread_event_callbacks.terminate((uptr)thread); 1451 } else if (event == PTHREAD_INTROSPECTION_THREAD_DESTROY) { 1452 if (thread_event_callbacks.destroy) 1453 thread_event_callbacks.destroy((uptr)thread); 1454 } 1455 } 1456 1457 void InstallPthreadIntrospectionHook(const ThreadEventCallbacks &callbacks) { 1458 thread_event_callbacks = callbacks; 1459 prev_pthread_introspection_hook = 1460 pthread_introspection_hook_install(&sanitizer_pthread_introspection_hook); 1461 } 1462 1463 } // namespace __sanitizer 1464 1465 #endif // SANITIZER_APPLE 1466