学会黑科技，一招搞定 iOS 14.2 的 libffi crash

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"苹果升级 14.2，全球 iOS 遭了秧。libffi 在 iOS14.2 上发生了 crash, 我司的许多 App 深受困扰，有许多基础库都是用了 libffi。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/ff\/ffb365e13b7e5fbe0409a94b1c586752.jpeg","alt":"图片","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"经过定位，发现是 vmremap 导致的 code sign error。我们通过使用静态 trampoline 的方式让 libffi 不需要使用 vmremap，解决了这个问题。这里就介绍一下相关的实现原理。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"libffi 是什么"}]},{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"高层语言的编译器生成遵循某些约定的代码。这些公约部分是单独汇编工作所必需的。“调用约定”本质上是编译器对函数入口处将在哪里找到函数参数的假设的一组假设。“调用约定”还指定函数的返回值在哪里找到。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"一些程序在编译时可能不知道要传递给函数的参数。例如，在运行时，解释器可能会被告知用于调用给定函数的参数的数量和类型。Libffi 可用于此类程序，以提供从解释器程序到编译代码的桥梁。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"libffi 库为各种调用约定提供了一个便携式、高级的编程接口。这允许程序员在运行时调用调用接口描述指定的任何函数。"}]}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"ffi 的使用"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"简单的找了一个使用 ffi 的库看一下他的调用接口"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":"text"},"content":[{"type":"text","text":"ffi_type *returnType = st_ffiTypeWithType(self.signature.returnType);\nNSAssert(returnType, @\"can't find a ffi_type of %@\", self.signature.returnType);\n\nNSUInteger argumentCount = self->_argsCount;\n_args = malloc(sizeof(ffi_type *) * argumentCount) ;\n\nfor (int i = 0; i < argumentCount; i++) {\n ffi_type* current_ffi_type = st_ffiTypeWithType(self.signature.argumentTypes[i]);\n NSAssert(current_ffi_type, @\"can't find a ffi_type of %@\", self.signature.argumentTypes[i]);\n _args[i] = current_ffi_type;\n}\n\n\/\/ 创建 ffi 跳板用到的 closure\n_closure = ffi_closure_alloc(sizeof(ffi_closure), (void **)&xxx_func_ptr);\n\n\/\/ 创建 cif，调用函数用到的参数和返回值的类型信息， 之后在调用时会结合call convention 处理参数和返回值\nif(ffi_prep_cif(&_cif, FFI_DEFAULT_ABI, (unsigned int)argumentCount, returnType, _args) == FFI_OK) {\n\n \/\/ closure 写入 跳板数据页\n if (ffi_prep_closure_loc(_closure, &_cif, _st_ffi_function, (__bridge void *)(self), xxx_func_ptr) != FFI_OK) {\n NSAssert(NO, @\"genarate IMP failed\");\n }\n} else {\n NSAssert(NO, @\"\");\n}"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"看完这段代码，大概能理解 ffi 的操作。"}]},{"type":"numberedlist","attrs":{"start":null,"normalizeStart":1},"content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":1,"align":null,"origin":null},"content":[{"type":"text","text":"提供给外界一个指针(指向 trampoline entry)"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":2,"align":null,"origin":null},"content":[{"type":"text","text":"创建一个 closure, 将调用相关的参数返回值信息放到 closure 里"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":3,"align":null,"origin":null},"content":[{"type":"text","text":"将 closure 写入到 trampoline 对应的 trampoline data entry 处"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"之后我们调用 trampoline entry func ptr 时，"}]},{"type":"numberedlist","attrs":{"start":null,"normalizeStart":1},"content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":1,"align":null,"origin":null},"content":[{"type":"text","text":"会找到 写入到 trampoline 对应的 trampoline data entry 处的 closure 数据"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":2,"align":null,"origin":null},"content":[{"type":"text","text":"根据 closure 提供的调用参数和返回值信息，结合调用约定，操作寄存器和栈，写入参数 进行函数调用，获取返回值。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"那 ffi 是怎么找到 trampoline 对应的 trampoline data entry 处的 closure 数据 呢？"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"我们从 ffi 分配 trampoline 开始说起："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":"text"},"content":[{"type":"text","text":"static ffi_trampoline_table *\nffi_remap_trampoline_table_alloc (void)\n{\n.....\n \/* Allocate two pages -- a config page and a placeholder page *\/\n config_page = 0x0;\n kt = vm_allocate (mach_task_self (), &config_page, PAGE_MAX_SIZE * 2,\n VM_FLAGS_ANYWHERE);\n if (kt != KERN_SUCCESS)\n return NULL;\n\n \/* Allocate two pages -- a config page and a placeholder page *\/\n \/\/bdffc_closure_trampoline_table_page\n\n \/* Remap the trampoline table on top of the placeholder page *\/\n trampoline_page = config_page + PAGE_MAX_SIZE;\n trampoline_page_template = (vm_address_t)&ffi_closure_remap_trampoline_table_page;\n#ifdef __arm__\n \/* bdffc_closure_trampoline_table_page can be thumb-biased on some ARM archs *\/\n trampoline_page_template &= ~1UL;\n#endif\n kt = vm_remap (mach_task_self (), &trampoline_page, PAGE_MAX_SIZE, 0x0,\n VM_FLAGS_OVERWRITE, mach_task_self (), trampoline_page_template,\n FALSE, &cur_prot, &max_prot, VM_INHERIT_SHARE);\n if (kt != KERN_SUCCESS)\n {\n vm_deallocate (mach_task_self (), config_page, PAGE_MAX_SIZE * 2);\n return NULL;\n }\n\n\n \/* We have valid trampoline and config pages *\/\n table = calloc (1, sizeof (ffi_trampoline_table));\n table->free_count = FFI_REMAP_TRAMPOLINE_COUNT\/2;\n table->config_page = config_page;\n table->trampoline_page = trampoline_page;\n\n......\n return table;\n}"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"首先 ffi 在创建 trampoline 时，会分配两个连续的 page"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"trampoline page 会 remap 到我们事先在代码中汇编写的 ffi_closure_remap_trampoline_table_page。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"其结构如图所示："}]},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/d1\/d166916814f762230b4626512361114a.png","alt":"图片","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"当我们 "},{"type":"codeinline","content":[{"type":"text","text":"ffi_prep_closure_loc(_closure, &_cif, _st_ffi_function, (__bridge void *)(self), entry1))"}]},{"type":"text","text":" 写入 closure 数据时， 会写入到 entry1 对应的 closuer1。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":"text"},"content":[{"type":"text","text":"ffi_status\nffi_prep_closure_loc (ffi_closure *closure,\n ffi_cif* cif,\n void (*fun)(ffi_cif*,void*,void**,void*),\n void *user_data,\n void *codeloc)\n{\n......\n if (cif->flags & AARCH64_FLAG_ARG_V)\n start = ffi_closure_SYSV_V; \/\/ ffi 对 closure的处理函数\n else\n start = ffi_closure_SYSV;\n\n void **config = (void**)((uint8_t *)codeloc - PAGE_MAX_SIZE);\n config[0] = closure;\n config[1] = start;\n......\n}\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"这是怎么对应到的呢? closure1 和 entry1 距离其所属 Page 的 offset 是一致的，通过 offset，成功建立 trampoline entry 和 trampoline closure 的对应关系。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"现在我们知道这个关系，我们通过代码看一下到底在程序运行的时候 是怎么找到 closure 的。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"这四条指令是我们 trampoline entry 的代码实现，就是 ffi 返回的 xxx_func_ptr"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":null},"content":[{"type":"text","text":"adr x16, -PAGE_MAX_SIZE\nldp x17, x16, [x16]\nbr x16\nnop"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通过 .rept 我们创建 PAGE_MAX_SIZE \/ FFI_TRAMPOLINE_SIZE 个跳板，刚好一个页的大小"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":null},"content":[{"type":"text","text":"# 动态remap的 page\n.align PAGE_MAX_SHIFT\nCNAME(ffi_closure_remap_trampoline_table_page):\n.rept PAGE_MAX_SIZE \/ FFI_TRAMPOLINE_SIZE\n # 这是我们的 trampoline entry, 就是ffi生成的函数指针\n adr x16, -PAGE_MAX_SIZE \/\/ 将pc地址减去PAGE_MAX_SIZE, 找到 trampoine data entry\n ldp x17, x16, [x16] \/\/ 加载我们写入的 closure, start 到 x17, x16\n br x16 \/\/ 跳转到 start 函数\n nop \/* each entry in the trampoline config page is 2*sizeof(void*) so the trampoline itself cannot be smaller that 16 bytes *\/\n.endr"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通过 pc 地址减去 PAGE_MAX_SIZE 就找到对应的 trampoline data entry 了。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"静态跳板的实现"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"由于代码段和数据段在不同的内存区域。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"我们此时不能通过 像 vmremap 一样分配两个连续的 PAGE，在寻找 trampoline data entry 只是简单的-PAGE_MAX_SIZE 找到对应关系，需要稍微麻烦点的处理。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"主要是通过 adrp 找到"},{"type":"codeinline","content":[{"type":"text","text":"_ffi_static_trampoline_data_page1"}]},{"type":"text","text":" 和 "},{"type":"codeinline","content":[{"type":"text","text":"_ffi_static_trampoline_page1"}]},{"type":"text","text":"的起始地址，用 pc-"},{"type":"codeinline","content":[{"type":"text","text":"_ffi_static_trampoline_page1"}]},{"type":"text","text":"的起始地址计算 offset，找到 trampoline data entry。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":"text"},"content":[{"type":"text","text":"# 静态分配的page\n#ifdef __MACH__\n#include \n\n.align 14\n.data\n.global _ffi_static_trampoline_data_page1\n_ffi_static_trampoline_data_page1:\n .space PAGE_MAX_SIZE*5\n.align PAGE_MAX_SHIFT\n.text\nCNAME(_ffi_static_trampoline_page1):\n\n_ffi_local_forwarding_bridge:\nadrp x17, ffi_closure_static_trampoline_table_page_start@PAGE;\/\/ text page\nsub x16, x16, x17;\/\/ offset\nadrp x17, _ffi_static_trampoline_data_page1@PAGE;\/\/ data page\nadd x16, x16, x17;\/\/ data address\nldp x17, x16, [x16];\/\/ x17 closure x16 start\nbr x16\nnop\nnop\n.align PAGE_MAX_SHIFT\nCNAME(ffi_closure_static_trampoline_table_page):\n\n#这个label 用来adrp@PAGE 计算 trampoline 到 trampoline page的offset\n#留了5个用来调试。\n# 我们static trampoline 两条指令就够了，这里使用4个，和remap的保持一致\nffi_closure_static_trampoline_table_page_start:\nadr x16, #0\nb _ffi_local_forwarding_bridge\nnop\nnop\n\nadr x16, #0\nb _ffi_local_forwarding_bridge\nnop\nnop\n\nadr x16, #0\nb _ffi_local_forwarding_bridge\nnop\nnop\n\nadr x16, #0\nb _ffi_local_forwarding_bridge\nnop\nnop\n\nadr x16, #0\nb _ffi_local_forwarding_bridge\nnop\nnop\n\n\/\/ 5 * 4\n.rept (PAGE_MAX_SIZE*5-5*4) \/ FFI_TRAMPOLINE_SIZE\nadr x16, #0\nb _ffi_local_forwarding_bridge\nnop\nnop\n.endr\n\n.globl CNAME(ffi_closure_static_trampoline_table_page)\nFFI_HIDDEN(CNAME(ffi_closure_static_trampoline_table_page))\n#ifdef __ELF__\n .type CNAME(ffi_closure_static_trampoline_table_page), #function\n .size CNAME(ffi_closure_static_trampoline_table_page), . - CNAME(ffi_closure_static_trampoline_table_page)\n#endif\n#endif"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"本文转载自：字节跳动技术团队（ID：BytedanceTechBlog）"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"原文链接："},{"type":"link","attrs":{"href":"https:\/\/mp.weixin.qq.com\/s\/XLqcCfcNhpCA8Tg6LknBCQ","title":"xxx","type":null},"content":[{"type":"text","text":"学会黑科技，一招搞定 iOS 14.2 的 libffi crash"}]}]}]}