memory - lldb - 如何读取线程内存区域的权限？

Question

Apple 表示，在 ARM64 Mac 上，内存区域可以具有线程的写入或执行权限。有人如何找出 lldb 中线程的内存区域的当前权限？我尝试过“内存区域”，但返回 rwx。我正在开发一个可以在我的 M1 Mac 上运行的即时编译器。为了进行测试，我对即时编译器进行了小型模拟。

#include <cstdio>
#include <sys/mman.h>
#include <pthread.h>
#include <libkern/OSCacheControl.h>
#include <stdlib.h>

int main(int argc, const char * argv[]) {
    
    size_t size = 1024 * 1024 * 640;
    int prot = PROT_READ | PROT_WRITE | PROT_EXEC;
    int flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_JIT;
    int fd = -1;
    int offset = 0;
    unsigned *addr = 0;

    // allocate a mmap'ed region of memory
    addr = (unsigned *)mmap(0, size, prot, flags, fd, offset);
    if (addr == MAP_FAILED){
        printf("failure detected\n");
        exit(-1);
    }
    
    pthread_jit_write_protect_np(0);
    
    // Write instructions to the memory
    addr[0] = 0xd2800005;  // mov x5, #0x0
    addr[1] = 0x910004a5;  // add x5, x5, #0x1
    addr[2] = 0x17ffffff;  // b <address>
    
    pthread_jit_write_protect_np(1);
    sys_icache_invalidate(addr, size);
    
    // Execute the code
    int(*f)() = (int (*)()) addr;
    (*f)();
    
    return 0;
}

一旦汇编指令开始通过 (*f)() 调用执行，我就可以在 Xcode 中暂停执行并输入

memory region {address of instructions}

进入调试器。由于某种原因它不断返回“rwx”。我使用的是正确的命令还是这可能是 lldb 的错误？

Answer 1

我发现问题的答案是读取一个名为 S3_6_c15_c1_5 的未记录的 Apple 寄存器。

此代码从寄存器读取原始值:

// Returns the S3_6_c15_c1_5 register's value
uint64_t read_S3_6_c15_c1_5_register(void)
{
    uint64_t v;
    __asm__ __volatile__("isb sy\n"
                         "mrs %0, S3_6_c15_c1_5\n"
                         : "=r"(v)::"memory");
    return v;
}

此代码告诉您线程的当前模式是什么:

// Returns the mode for a thread.
// Returns "Executable" or "Writable".
// Remember to free() the value returned by this function.
char *get_thread_mode()
{
    uint64_t value = read_S3_6_c15_c1_5_register();
    char *return_value = (char *) malloc(50);
    switch(value)
    {
        case 0x2010000030300000:
            sprintf(return_value, "Writable");
            break;
            
        case 0x2010000030100000:
            sprintf(return_value, "Executable");
            break;
            
        default:
            sprintf(return_value, "Unknown state: %llx", value);
    }
    return return_value;
}

这是一个小测试程序，用于演示这两个功能:

int main(int argc, char *argv[]) {
    pthread_jit_write_protect_np(1);
    printf("Thread's mode: %s\n", get_thread_mode());
    // The mode is Executable
    
    pthread_jit_write_protect_np(0);
    printf("Thread's mode: %s\n", get_thread_mode());
    // The mode is Writable
    
    return 0;
}