Regenerate LC_CODE_SIGNATURE during llvm-objcopy operations

[nuriamari]

Summary

Context:

This is a second attempt at introducing signature regeneration to llvm-objcopy. In this diff: https://reviews.llvm.org/D109840, a script was introduced to test
the validity of a code signature. In this diff: https://reviews.llvm.org/D109803 (now reverted), an effort was made to extract the signature generation behavior out of LLD into a common location for use in llvm-objcopy. In this diff: https://reviews.llvm.org/D109972 it was decided that there was no appropriate common location and that a small amount of duplication to bring signature generation to llvm-objcopy would be better. This diff introduces this duplication.

Summary

Prior to this change, if a LC_CODE_SIGNATURE load command
was included in the binary passed to llvm-objcopy, the command and
associated section were simply copied and included verbatim in the
new binary. If rest of the binary was modified at all, this results
in an invalid Mach-O file. This change regenerates the signature
rather than copying it.

The code_signature_lc.test test was modified to include the yaml
representation of a small signed MachO executable in order to
effectively test the signature generation.

[nuriamari]

Rename CodeSignatureSectionInfo struct

[alexander-shaposhnikov]

I've added some in-line comments, but the high level approach looks reasonable to me, thanks for working on this!

llvm/tools/llvm-objcopy/MachO/MachOLayoutBuilder.cpp

289

nit: maybe drop "Section" from the name ?, i.e. CodeSignatureSection -> CodeSignature, CodeSignatureSectionSize -> CodeSignatueSize (it's a bit shorter + it's not a section per se).

llvm/tools/llvm-objcopy/MachO/MachOWriter.cpp

482

1/ just in case - what happens if there is no __TEXT in the binary - what does codesign do in this case - does it still create something or bail out ?
2/ is there any other place where getSegmentFileOffset / getSegmentFileSize are used ?
(if no - then probably it'd be better not to store them and just calculate here or have a helper function or method that returns them) (they also can change during some binary transformations e.g. adding / removing load commands) (this might not be observable on small tests because of the alignment)

llvm/tools/llvm-objcopy/MachO/Object.h

317–318

maybe it'd be better to make it a part of MachOLayoutBuilder ?
(since it appears to be used only there)

[nuriamari]

Remove "Section" in variable names, move CodeSignature to MachOLayoutBuilder, move text segment helpers

[nuriamari]

llvm/tools/llvm-objcopy/MachO/MachOWriter.cpp

482

1/ Behaviour is the same as far as I can tell, checks for __TEXT segment here and if the segment isn't found, creates an "empty" OutputSegment, which has fileoff and filesize values of 0.

2/ No other usages, I will move the helpers here. I don't think getting stale values is an issue since the calls are made after the MachOLayoutBuilder updates the values.

llvm/tools/llvm-objcopy/MachO/Object.h

317–318

It is also used in the MachOWriter, but I suppose the Writer can reach into the LayoutBuilder for that information.

[tschuett]

The symlink creates a dependency from LLVM to lld, while lld depends on LLVM ^^

[nuriamari]

In D111164#3048090, @tschuett wrote:

The symlink creates a dependency from LLVM to lld, while lld depends on LLVM ^^

Would creating the symlink in the reverse direction be acceptable?

[drodriguez]

llvm/tools/llvm-objcopy/MachO/Object.h

317–318

@alexander-shaposhnikov: Can we talk again about this? It feels as if the rest of the LinkData blobs have their information hold in this Object struct. Most of them are simply the data itself, but for other things, like IndirectSymbolTable, it seems that they are defined here, and used in the MachOReader, the MachOLayoutBuilder and the MachOWriter. In the case of the LC_CODE_SIGNATURE, we don't have any use in MachOReader because the information is discarded, but it seems to me that this is the correct place. Additionally, to be usage from MachOWriter and MachOLayoutBuilder, it needs to end up as a public instance variable in MachOLayoutBuilder, making it the first public instance variable of that class.

In any case, it is a minimal thing, and I don't need it to be changed. I just wanted to point out the similarities with the code here.

[tschuett]

In D111164#3048336, @nuriamari wrote:

In D111164#3048090, @tschuett wrote:

The symlink creates a dependency from LLVM to lld, while lld depends on LLVM ^^

Would creating the symlink in the reverse direction be acceptable?

That sounds better. I don't know how happy Windows is about symlinks. I have the feeling that you will accept a bit of code duplication. How about two copies?

[alexander-shaposhnikov]

llvm/tools/llvm-objcopy/MachO/Object.h

317–318

the pipeline looks like this: parse the input (the output is Object) -> apply various transformations (to Object) -> write the final output (including the calculations of the new layout). Therefore, storing "offsets" in Object doesn't appear to be right, another indication why it's not right - they are not used (and should not be used (because they can be invalidated by some transformations as I pointed out in another comment)) before emitting the new object file.

[alexander-shaposhnikov]

llvm/tools/llvm-objcopy/MachO/Object.h

317–318

regarding public instance - unless I'm missing something this won't happen.
Currently these values are calculated in MachOLayoutBuilder::layoutTail, it's perfectly fine for layoutTail to have a write access a member of the same class. External customers can use a getter that returns a const ref.

[alexander-shaposhnikov]

llvm/tools/llvm-objcopy/MachO/Object.h

101

looks like in the latest revision this file has not been updated

[drodriguez]

llvm/tools/llvm-objcopy/MachO/Object.h

317–318

Understood. Thanks for explaining the concepts behind the code flow. This blob size and contents depending on the previous content is a little bit of a problem (specially the total size), and specially the size needed to be included in the __LINKEDIT information calculated during the layout.

[nuriamari]

Copy test script, remove getSegment* declarations, add const ref getter

[alexander-shaposhnikov]

llvm/tools/llvm-objcopy/MachO/Object.h

302–308

would be good to move this struct declaration too (into MachOLayoutBuilder.h)

[alexander-shaposhnikov]

Just in case - do we have a test (for the new functionality) where the index of LC_SEGMENT* and the offset of __TEXT are modified ? (to ensure that the signature is calculated correctly in this case)

[drodriguez]

In D111164#3052652, @alexander-shaposhnikov wrote:

Just in case - do we have a test (for the new functionality) where the index of LC_SEGMENT* and the offset of __TEXT are modified ? (to ensure that the signature is calculated correctly in this case)

With the previous version of the code I remember checking if llvm-strip was generating the right thing and it did work (which was very nice to see). Is that something like what you asking? Do you have some existing test in mind that we can use as a starting point?

[alexander-shaposhnikov]

adding / removing load commands (e.g. rpath) can trigger such changes (but beware the alignment + the order of load commands matters) so the test needs to be specifically designed for these purposes

(I would use llvm-objdump or llvm-readobj to verify that the offset of __TEXT has changed etc)

P.S. btw - you probably want to update TextSegmentCommandIndex inside updateLoadCommandIndexes(..) and such a test would catch it, alternatively, it can be calculated where it's actually used (and the field can be dropped)

[nuriamari]

In D111164#3052797, @alexander-shaposhnikov wrote:

adding / removing load commands (e.g. rpath) can trigger such changes (but beware the alignment + the order of load commands matters) so the test needs to be specifically designed for these purposes

(I would use llvm-objdump or llvm-readobj to verify that the offset of __TEXT has changed etc)

P.S. btw - you probably want to update TextSegmentCommandIndex inside updateLoadCommandIndexes(..) and such a test would catch it, alternatively, it can be calculated where it's actually used (and the field can be dropped)

Hi Alexander,

Thanks for your feedback, sorry I've been a little inactive the last few days. I have moved the CodeSignatureInfo struct and I will add a new test like you are suggesting. I am little busy with other work at the moment, but I will try to get to it later this week.

[drodriguez]

In D111164#3052797, @alexander-shaposhnikov wrote:

adding / removing load commands (e.g. rpath) can trigger such changes (but beware the alignment + the order of load commands matters) so the test needs to be specifically designed for these purposes

(I would use llvm-objdump or llvm-readobj to verify that the offset of __TEXT has changed etc)

P.S. btw - you probably want to update TextSegmentCommandIndex inside updateLoadCommandIndexes(..) and such a test would catch it, alternatively, it can be calculated where it's actually used (and the field can be dropped)

OK. We have been looking at what you were pointing out in this comment, and we want to run the plan by you (and anyone else reading), so we don't detour very far.

• Fix updateLoadCommandIndex(...) to handle both the new TextSegmentCommandIndex and also CodeSignatureCommandIndex (this is an error introduced before Nuri touched anything, but since we are fixing things, we better fix both).
• Write a test that tries to exercise that code:
  • Create a binary with yaml2obj having a LC_CODE_SIGNATURE to start triggering all the new code.
  • Execute something like llvm-install-name-tool -prepend_rpath foo/bar. Analyze that the resulting binary has the right signature. Also check that the text segment has a new offset.
  • Execute something like llvm-install-name-tool -remove_rpath foo/bar that removes the previously prepended rpath. Do the same checks as above.

Do you think that would be enough? Were you thinking in something different?

[alexander-shaposhnikov]

Yeah, sounds reasonable to me, just to be clear I'd like to point out that the input binary is kinda important, it should trigger these new code paths in a meaningful way (the mentioned above offsets / load command indices should change)

[nuriamari]

Update updateLoadCommandIndexes to include TextSegment/CodeSignature commands, add test inserting load command shifting load commands around

[nuriamari]

I expanded updateLoadCommandIndexes to update the CodeSignatureCommandIndex and TextSegmentCommandIndex values. In the new test, I check that the text segment size and offset values included in the code signature header are accurate. I also added asserts to make sure TextSegmentCommandIndex does in fact point to the correct load command, and not just another segment load command with identical size and offset. I was unable to get the text segment offset to change (it remains at 0 even after inserting more commands), but I think this is expected and so long as TextSegmentCommandIndex is accurate, the rest should also be accurate.

[alexander-shaposhnikov]

LG (i took a look at the code, but didn't closely review the tests)

llvm/tools/llvm-objcopy/MachO/Object.cpp

32

constexpr

[thevinster]

llvm/test/tools/llvm-objcopy/MachO/code_signature_lc_update.test

70

Just wondering here, from inspection, shouldn't this be 280? To match the lines indicating CHECK-ORIGINAL?

[nuriamari]

Constexpr C strings

llvm/test/tools/llvm-objcopy/MachO/code_signature_lc_update.test

70

Not necessarily since I don't think the increase to 320 is entirely a result of the new RPATH command. The datasize can often change the first time llvm-objcopy is run on a binary, even without any changes. You can see an example in code_signature_lc.test file, the datasize also inflates. I think this is just a consequence of llvm-objcopy slightly changing binaries produced by other tools. Once llvm-objcopy is run on the binary once, no changes are observed on a further runs.

[drodriguez]

llvm/test/tools/llvm-objcopy/MachO/code_signature_lc.test

27–35

We are aware that one of these seems not to work with macOS sed. We are looking into how to fix. If somebody feels this need to be reverted, please do.

[alexander-shaposhnikov]

llvm/test/tools/llvm-objcopy/MachO/code_signature_lc.test

16

just in case - wouldn't FileCheck %s --check-prefix=CHECK-COPY <%t.copy.yaml work ? (get rid of cat)

27–35

fwiw, if one day this test breaks it might be hard to debug (especially on windows), perhaps, another approach would be to replace RUN: diff
with a more granular check, e.g. it doesn't need to check all the parts of the binary

[drodriguez]

Created D112583 with a possible fix. My macOS does not fail the same as in CI, and I don't have a 10.15 machine at hand to actually check.

The change for cat is also there.

[uabelho]

Hi,

It looks like

LLVM :: tools/llvm-objcopy/MachO/universal-object.test

starts failing with this patch when the compiler is built with ubsan:
http://lab.llvm.org:8011/#/builders/5/builds/13703

[eugenis]

In D111164#3093454, @uabelho wrote:

Hi,

It looks like

LLVM :: tools/llvm-objcopy/MachO/universal-object.test

starts failing with this patch when the compiler is built with ubsan:
http://lab.llvm.org:8011/#/builders/5/builds/13703

Has been failing for several days, too.

[drodriguez]

@uabelho: Thanks for pointing it out. I think I found a possible solution. It seems to me that llvm-objcopy might store data unaligned temporarily, and we did not realize.

@eugenis: Can you clarify what you mean? From my testing and the stack trace it seems to have been introduced by this change. It might have been failing in some other way that I am not aware, but after fixing the problem, it seems that the UBSan runtime error goes away.

[drodriguez]

Fix in https://reviews.llvm.org/D112744

[uabelho]

In D111164#3094389, @drodriguez wrote:

Fix in https://reviews.llvm.org/D112744

Thanks!

[thakis]

cctools's strip only resigns after stripping if the signature was linker-generated (i.e. MachO::CS_ADHOC | MachO::CS_LINKER_SIGNED are set), and otherwise emits a warning:

% cat hello.cc
#include <stdio.h>
int main() { printf("hello\n"); }
% clang hello.cc && codesign --sign - a.out && strip a.out
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/strip: warning: changes being made to the file will invalidate the code signature in: /Users/thakis/src/llvm-project/a.out
% ./a.out
zsh: killed     ./a.out. # because signature is now wrong

This makes some sense: If a binary was explicitly signed, the explicit signature will be wrong.

On the other hand, if we re-sign, the binary can at least run, so I'm not sure if we should fully adopt cctools's behavior. But maybe we should emit a warning if we re-sign a binary that doesn't have a linker-generated signature?

[drodriguez]

In my tests with cctools I do not think I ever used a externally signed binary. I was more worried about adhoc signed binaries from the toolchain itself. I do not think adding a warning will influence our usage, so if that compatibility with cctools is needed, I will be happy to review and approve those changes.

lld/MachO/SyntheticSections.h

public:
   }
   bool isNeeded() const override;
   void writeTo(uint8_t *buf) const override;
 };
 
 // The code signature comes at the very end of the linked output file.
 class CodeSignatureSection final : public LinkEditSection {
 public:
+  // NOTE: These values are duplicated in llvm-objcopy's MachO/Object.h file
+  // and any changes here, should be repeated there.
   static constexpr uint8_t blockSizeShift = 12;
   static constexpr size_t blockSize = (1 << blockSizeShift); // 4 KiB
   static constexpr size_t hashSize = 256 / 8;
   static constexpr size_t blobHeadersSize = llvm::alignTo<8>(
       sizeof(llvm::MachO::CS_SuperBlob) + sizeof(llvm::MachO::CS_BlobIndex));
   static constexpr uint32_t fixedHeadersSize =
       blobHeadersSize + sizeof(llvm::MachO::CS_CodeDirectory);
 

lld/MachO/SyntheticSections.cpp

 CodeSignatureSection::CodeSignatureSection()
     : LinkEditSection(segment_names::linkEdit, section_names::codeSignature) {
   align = 16; // required by libstuff
   // FIXME: Consider using finalOutput instead of outputFile.
   fileName = config->outputFile;
   size_t slashIndex = fileName.rfind("/");
   if (slashIndex != std::string::npos)
     fileName = fileName.drop_front(slashIndex + 1);
+
+  // NOTE: Any changes to these calculations should be repeated
+  // in llvm-objcopy's MachOLayoutBuilder::layoutTail.
   allHeadersSize = alignTo<16>(fixedHeadersSize + fileName.size() + 1);
   fileNamePad = allHeadersSize - fixedHeadersSize - fileName.size();
 }
 
 uint32_t CodeSignatureSection::getBlockCount() const {
   return (fileOff + blockSize - 1) / blockSize;
 }
 
 uint64_t CodeSignatureSection::getRawSize() const {
   return allHeadersSize + getBlockCount() * hashSize;
 }
 
 void CodeSignatureSection::writeHashes(uint8_t *buf) const {
+  // NOTE: Changes to this functionality should be repeated in llvm-objcopy's
+  // MachOWriter::writeSignatureData.
   uint8_t *code = buf;
   uint8_t *codeEnd = buf + fileOff;
   uint8_t *hashes = codeEnd + allHeadersSize;
   while (code < codeEnd) {
     StringRef block(reinterpret_cast<char *>(code),
                     std::min(codeEnd - code, static_cast<ssize_t>(blockSize)));
     SHA256 hasher;
     hasher.update(block);
#if defined(__APPLE__)
   // sign or the signature header+hashes.  The fix is to invalidate
   // all cached data associated with the output file, thus discarding
   // the bogus prematurely-cached signature.
   msync(buf, fileOff + getSize(), MS_INVALIDATE);
 #endif
 }
 
 void CodeSignatureSection::writeTo(uint8_t *buf) const {
+  // NOTE: Changes to this functionality should be repeated in llvm-objcopy's
+  // MachOWriter::writeSignatureData.
   uint32_t signatureSize = static_cast<uint32_t>(getSize());
   auto *superBlob = reinterpret_cast<CS_SuperBlob *>(buf);
   write32be(&superBlob->magic, CSMAGIC_EMBEDDED_SIGNATURE);
   write32be(&superBlob->length, signatureSize);
   write32be(&superBlob->count, 1);
   auto *blobIndex = reinterpret_cast<CS_BlobIndex *>(&superBlob[1]);
   write32be(&blobIndex->type, CSSLOT_CODEDIRECTORY);
   write32be(&blobIndex->offset, blobHeadersSize);

llvm/test/tools/llvm-objcopy/MachO/Inputs/code-signature-check.py

+"""Checks the validity of MachO binary signatures
+
+MachO binaries sometimes include a LC_CODE_SIGNATURE load command
+and corresponding section in the __LINKEDIT segment that together
+work to "sign" the binary. This script is used to check the validity
+of this signature.
+
+Usage:
+    ./code-signature-check.py my_binary 800 300 0 800
+
+Arguments:
+   binary - The MachO binary to be tested
+   offset - The offset from the start of the binary to where the code signature section begins
+   size - The size of the code signature section in the binary
+   code_offset - The point in the binary to begin hashing
+   code_size - The length starting from code_offset to hash
+"""
+
+import argparse
+import collections
+import hashlib
+import itertools
+import struct
+import sys
+import typing
+
+class CodeDirectoryVersion:
+    SUPPORTSSCATTER = 0x20100
+    SUPPORTSTEAMID = 0x20200
+    SUPPORTSCODELIMIT64 = 0x20300
+    SUPPORTSEXECSEG = 0x20400
+
+class CodeDirectory:
+    @staticmethod
+    def make(buf: memoryview) -> typing.Union['CodeDirectoryBase', 'CodeDirectoryV20100', 'CodeDirectoryV20200', 'CodeDirectoryV20300', 'CodeDirectoryV20400']:
+        _magic, _length, version = struct.unpack_from(">III", buf, 0)
+        subtype = {
+            CodeDirectoryVersion.SUPPORTSSCATTER: CodeDirectoryV20100,
+            CodeDirectoryVersion.SUPPORTSTEAMID: CodeDirectoryV20200,
+            CodeDirectoryVersion.SUPPORTSCODELIMIT64: CodeDirectoryV20300,
+            CodeDirectoryVersion.SUPPORTSEXECSEG: CodeDirectoryV20400,
+        }.get(version, CodeDirectoryBase)
+
+        return subtype._make(struct.unpack_from(subtype._format(), buf, 0))
+
+class CodeDirectoryBase(typing.NamedTuple):
+    magic: int
+    length: int
+    version: int
+    flags: int
+    hashOffset: int
+    identOffset: int
+    nSpecialSlots: int
+    nCodeSlots: int
+    codeLimit: int
+    hashSize: int
+    hashType: int
+    platform: int
+    pageSize: int
+    spare2: int
+
+    @staticmethod
+    def _format() -> str:
+        return ">IIIIIIIIIBBBBI"
+
+class CodeDirectoryV20100(typing.NamedTuple):
+    magic: int
+    length: int
+    version: int
+    flags: int
+    hashOffset: int
+    identOffset: int
+    nSpecialSlots: int
+    nCodeSlots: int
+    codeLimit: int
+    hashSize: int
+    hashType: int
+    platform: int
+    pageSize: int
+    spare2: int
+
+    scatterOffset: int
+
+    @staticmethod
+    def _format() -> str:
+        return CodeDirectoryBase._format() + "I"
+
+class CodeDirectoryV20200(typing.NamedTuple):
+    magic: int
+    length: int
+    version: int
+    flags: int
+    hashOffset: int
+    identOffset: int
+    nSpecialSlots: int
+    nCodeSlots: int
+    codeLimit: int
+    hashSize: int
+    hashType: int
+    platform: int
+    pageSize: int
+    spare2: int
+
+    scatterOffset: int
+
+    teamOffset: int
+
+    @staticmethod
+    def _format() -> str:
+        return CodeDirectoryV20100._format() + "I"
+
+class CodeDirectoryV20300(typing.NamedTuple):
+    magic: int
+    length: int
+    version: int
+    flags: int
+    hashOffset: int
+    identOffset: int
+    nSpecialSlots: int
+    nCodeSlots: int
+    codeLimit: int
+    hashSize: int
+    hashType: int
+    platform: int
+    pageSize: int
+    spare2: int
+
+    scatterOffset: int
+
+    teamOffset: int
+
+    spare3: int
+    codeLimit64: int
+
+    @staticmethod
+    def _format() -> str:
+        return CodeDirectoryV20200._format() + "IQ"
+
+class CodeDirectoryV20400(typing.NamedTuple):
+    magic: int
+    length: int
+    version: int
+    flags: int
+    hashOffset: int
+    identOffset: int
+    nSpecialSlots: int
+    nCodeSlots: int
+    codeLimit: int
+    hashSize: int
+    hashType: int
+    platform: int
+    pageSize: int
+    spare2: int
+
+    scatterOffset: int
+
+    teamOffset: int
+
+    spare3: int
+    codeLimit64: int
+
+    execSegBase: int
+    execSegLimit: int
+    execSegFlags: int
+
+    @staticmethod
+    def _format() -> str:
+        return CodeDirectoryV20300._format() + "QQQ"
+
+class CodeDirectoryBlobIndex(typing.NamedTuple):
+    type_: int
+    offset: int
+
+    @staticmethod
+    def make(buf: memoryview) -> 'CodeDirectoryBlobIndex':
+        return CodeDirectoryBlobIndex._make(struct.unpack_from(CodeDirectoryBlobIndex.__format(), buf, 0))
+
+    @staticmethod
+    def bytesize() -> int:
+        return struct.calcsize(CodeDirectoryBlobIndex.__format())
+
+    @staticmethod
+    def __format() -> str:
+        return ">II"
+
+class CodeDirectorySuperBlob(typing.NamedTuple):
+    magic: int
+    length: int
+    count: int
+    blob_indices: typing.List[CodeDirectoryBlobIndex]
+
+    @staticmethod
+    def make(buf: memoryview) -> 'CodeDirectorySuperBlob':
+        super_blob_layout = ">III"
+        super_blob = struct.unpack_from(super_blob_layout, buf, 0)
+
+        offset = struct.calcsize(super_blob_layout)
+        blob_indices = []
+        for idx in range(super_blob[2]):
+            blob_indices.append(CodeDirectoryBlobIndex.make(buf[offset:]))
+            offset += CodeDirectoryBlobIndex.bytesize()
+
+        return CodeDirectorySuperBlob(*super_blob, blob_indices)
+
+def unpack_null_terminated_string(buf: memoryview) -> str:
+    b = bytes(itertools.takewhile(lambda b: b != 0, buf))
+    return b.decode()
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('binary', type=argparse.FileType('rb'), help='The file to analyze')
+    parser.add_argument('offset', type=int, help='Offset to start of Code Directory data')
+    parser.add_argument('size', type=int, help='Size of Code Directory data')
+    parser.add_argument('code_offset', type=int, help='Offset to start of code pages to hash')
+    parser.add_argument('code_size', type=int, help='Size of the code pages to hash')
+
+    args = parser.parse_args()
+
+    args.binary.seek(args.offset)
+    super_blob_bytes = args.binary.read(args.size)
+    super_blob_mem = memoryview(super_blob_bytes)
+
+    super_blob = CodeDirectorySuperBlob.make(super_blob_mem)
+    print(super_blob)
+
+    for blob_index in super_blob.blob_indices:
+        code_directory_offset = blob_index.offset
+        code_directory = CodeDirectory.make(super_blob_mem[code_directory_offset:])
+        print(code_directory)
+
+        ident_offset = code_directory_offset + code_directory.identOffset
+        print("Code Directory ID: " + unpack_null_terminated_string(super_blob_mem[ident_offset:]))
+
+        code_offset = args.code_offset
+        code_end = code_offset + args.code_size
+        page_size = 1 << code_directory.pageSize
+        args.binary.seek(code_offset)
+
+        hashes_offset = code_directory_offset + code_directory.hashOffset
+        for idx in range(code_directory.nCodeSlots):
+            hash_bytes = bytes(super_blob_mem[hashes_offset:hashes_offset+code_directory.hashSize])
+            hashes_offset += code_directory.hashSize
+
+            hasher = hashlib.sha256()
+            read_size = min(page_size, code_end - code_offset)
+            hasher.update(args.binary.read(read_size))
+            calculated_hash_bytes = hasher.digest()
+            code_offset += read_size
+
+            print("%s <> %s" % (hash_bytes.hex(), calculated_hash_bytes.hex()))
+
+            if hash_bytes != calculated_hash_bytes:
+                sys.exit(-1)
+
+
+if __name__ == '__main__':
+    main()

llvm/test/tools/llvm-objcopy/MachO/code_signature_lc.test

 # RUN: yaml2obj %s -o %t
 
 ## Verify that the input file is valid and contains the expected load command.
-# RUN: llvm-objdump --private-headers %t | FileCheck %s
+# RUN: llvm-objdump --private-headers %t | FileCheck %s --check-prefix=CHECK-ORIGINAL
 
-# CHECK:      cmd LC_CODE_SIGNATURE
-# CHECK-NEXT: cmdsize 16
-# CHECK-NEXT: dataoff 128
-# CHECK-NEXT: datasize 16
+# CHECK-ORIGINAL:      cmd LC_CODE_SIGNATURE
+# CHECK-ORIGINAL-NEXT: cmdsize 16
+# CHECK-ORIGINAL-NEXT: dataoff 16544
+# CHECK-ORIGINAL-NEXT: datasize 280
 
 # RUN: llvm-objcopy %t %t.copy
-# RUN: cmp %t %t.copy
+# RUN: obj2yaml %t > %t.yaml
+# RUN: obj2yaml %t.copy > %t.copy.yaml
+
+## Verify that the copy still includes the load command
+# RUN: cat %t.copy.yaml | FileCheck %s --check-prefix=CHECK-COPY
+# CHECK-COPY:      - cmd:             LC_CODE_SIGNATURE
+# CHECK-COPY-NEXT:   cmdsize:         16
+# CHECK-COPY-NEXT:   dataoff:         16544
+# CHECK-COPY-NEXT:   datasize:        304
+
+## Remove information changed by regeneration of load command:
+## - __LINKEDIT segment filesize may change
+## - LC_CODE_SIGNATURE command dataoff and datasize may change
+## - __LINKEDIT data locations may change
+
+# RUN: sed -e '/__LINKEDIT/,+4d' \
+# RUN:     -e '/LC_CODE_SIGNATURE/,+3d' \ 
+# RUN:     -e '/n_strx/d' \ 
+# RUN:     -e '/dyld_stub_binder/d' %t.yaml > %t.clean.yaml
+
+# RUN: sed -e '/__LINKEDIT/,+4d' \
+# RUN:     -e '/LC_CODE_SIGNATURE/,+3d' \ 
+# RUN:     -e '/n_strx/d' \ 
+# RUN:     -e '/dyld_stub_binder/d' %t.copy.yaml > %t.copy.clean.yaml
+
+## Verify the remainder of the object file remains unchanged
+# RUN: diff %t.clean.yaml %t.copy.clean.yaml
+
+## Verify the new signature is valid
+# RUN: %python %p/Inputs/code-signature-check.py %t.copy 16544 304 0 16544
 
 --- !mach-o
 FileHeader:
   magic:           0xFEEDFACF
-  cputype:         0x01000007
-  cpusubtype:      0x80000003
-  filetype:        0x00000002
-  ncmds:           2
-  sizeofcmds:      88
-  flags:           0x00218085
-  reserved:        0x00000000
+  cputype:         0x1000007
+  cpusubtype:      0x3
+  filetype:        0x2
+  ncmds:           15
+  sizeofcmds:      760
+  flags:           0x200085
+  reserved:        0x0
 LoadCommands:
   - cmd:             LC_SEGMENT_64
     cmdsize:         72
+    segname:         __PAGEZERO
+    vmaddr:          0
+    vmsize:          4294967296
+    fileoff:         0
+    filesize:        0
+    maxprot:         0
+    initprot:        0
+    nsects:          0
+    flags:           0
+  - cmd:             LC_SEGMENT_64
+    cmdsize:         232
+    segname:         __TEXT
+    vmaddr:          4294967296
+    vmsize:          16384
+    fileoff:         0
+    filesize:        16384
+    maxprot:         5
+    initprot:        5
+    nsects:          2
+    flags:           0
+    Sections:
+      - sectname:        __text
+        segname:         __TEXT
+        addr:            0x100003FA0
+        size:            15
+        offset:          0x3FA0
+        align:           4
+        reloff:          0x0
+        nreloc:          0
+        flags:           0x80000400
+        reserved1:       0x0
+        reserved2:       0x0
+        reserved3:       0x0
+        content:         554889E531C0C745FC000000005DC3
+      - sectname:        __unwind_info
+        segname:         __TEXT
+        addr:            0x100003FB0
+        size:            72
+        offset:          0x3FB0
+        align:           2
+        reloff:          0x0
+        nreloc:          0
+        flags:           0x0
+        reserved1:       0x0
+        reserved2:       0x0
+        reserved3:       0x0
+        content:         010000001C000000000000001C000000000000001C00000002000000A03F00003400000034000000B03F00000000000034000000030000000C000100100001000000000000000001
+  - cmd:             LC_SEGMENT_64
+    cmdsize:         72
     segname:         __LINKEDIT
-    vmaddr:          4294979584
-    vmsize:          4096
-    fileoff:         120
-    filesize:        24
-    maxprot:         7
+    vmaddr:          4294983680
+    vmsize:          16384
+    fileoff:         16384
+    filesize:        440
+    maxprot:         1
     initprot:        1
     nsects:          0
     flags:           0
+  - cmd:             LC_DYLD_INFO_ONLY
+    cmdsize:         48
+    rebase_off:      0
+    rebase_size:     0
+    bind_off:        0
+    bind_size:       0
+    weak_bind_off:   0
+    weak_bind_size:  0
+    lazy_bind_off:   0
+    lazy_bind_size:  0
+    export_off:      16384
+    export_size:     48
+  - cmd:             LC_SYMTAB
+    cmdsize:         24
+    symoff:          16440
+    nsyms:           3
+    stroff:          16488
+    strsize:         48
+  - cmd:             LC_DYSYMTAB
+    cmdsize:         80
+    ilocalsym:       0
+    nlocalsym:       0
+    iextdefsym:      0
+    nextdefsym:      2
+    iundefsym:       2
+    nundefsym:       1
+    tocoff:          0
+    ntoc:            0
+    modtaboff:       0
+    nmodtab:         0
+    extrefsymoff:    0
+    nextrefsyms:     0
+    indirectsymoff:  0
+    nindirectsyms:   0
+    extreloff:       0
+    nextrel:         0
+    locreloff:       0
+    nlocrel:         0
+  - cmd:             LC_LOAD_DYLINKER
+    cmdsize:         32
+    name:            12
+    Content:         '/usr/lib/dyld'
+    ZeroPadBytes:    7
+  - cmd:             LC_UUID
+    cmdsize:         24
+    uuid:            42759668-1CBA-3094-8E2D-F01E1A66E815
+  - cmd:             LC_BUILD_VERSION
+    cmdsize:         32
+    platform:        1
+    minos:           720896
+    sdk:             721664
+    ntools:          1
+    Tools:
+      - tool:            3
+        version:         42600704
+  - cmd:             LC_SOURCE_VERSION
+    cmdsize:         16
+    version:         0
+  - cmd:             LC_MAIN
+    cmdsize:         24
+    entryoff:        16288
+    stacksize:       0
+  - cmd:             LC_LOAD_DYLIB
+    cmdsize:         56
+    dylib:
+      name:            24
+      timestamp:       2
+      current_version: 84698117
+      compatibility_version: 65536
+    Content:         '/usr/lib/libSystem.B.dylib'
+    ZeroPadBytes:    6
+  - cmd:             LC_FUNCTION_STARTS
+    cmdsize:         16
+    dataoff:         16432
+    datasize:        8
+  - cmd:             LC_DATA_IN_CODE
+    cmdsize:         16
+    dataoff:         16440
+    datasize:        0
   - cmd:             LC_CODE_SIGNATURE
     cmdsize:         16
-    dataoff:         128
-    datasize:        16
+    dataoff:         16544
+    datasize:        280
+LinkEditData:
+  ExportTrie:
+    TerminalSize:    0
+    NodeOffset:      0
+    Name:            ''
+    Flags:           0x0
+    Address:         0x0
+    Other:           0x0
+    ImportName:      ''
+    Children:
+      - TerminalSize:    0
+        NodeOffset:      5
+        Name:            _
+        Flags:           0x0
+        Address:         0x0
+        Other:           0x0
+        ImportName:      ''
+        Children:
+          - TerminalSize:    2
+            NodeOffset:      33
+            Name:            _mh_execute_header
+            Flags:           0x0
+            Address:         0x0
+            Other:           0x0
+            ImportName:      ''
+          - TerminalSize:    3
+            NodeOffset:      37
+            Name:            main
+            Flags:           0x0
+            Address:         0x3FA0
+            Other:           0x0
+            ImportName:      ''
+  NameList:
+    - n_strx:          2
+      n_type:          0xF
+      n_sect:          1
+      n_desc:          16
+      n_value:         4294967296
+    - n_strx:          22
+      n_type:          0xF
+      n_sect:          1
+      n_desc:          0
+      n_value:         4294983584
+    - n_strx:          28
+      n_type:          0x1
+      n_sect:          0
+      n_desc:          256
+      n_value:         0
+  StringTable:
+    - ' '
+    - __mh_execute_header
+    - _main
+    - dyld_stub_binder
+    - ''
+    - ''
+    - ''
 ...

llvm/test/tools/llvm-objcopy/MachO/code_signature_lc_update.test

+# RUN: yaml2obj %s -o %t
+
+# RUN: llvm-objdump --private-headers %t | FileCheck %s --check-prefix=CHECK-ORIGINAL
+
+## Check offset, size and index of text segment command
+# CHECK-ORIGINAL:      Load command 1
+# CHECK-ORIGINAL-NEXT  cmdsize
+# CHECK-ORIGINAL-NEXT  segname __TEXT
+# CHECK-ORIGINAL-NEXT  vmaddr
+# CHECK-ORIGINAL-NEXT  vmsize
+# CHECK-ORIGINAL-NEXT  fileoff 0
+# CHECK-ORIGINAL-NEXT  filesize 16384
+
+## Check offset and index of code signature command
+# CHECK-ORIGINAL:      Load command 14
+# CHECK-ORIGINAL-NEXT: cmd LC_CODE_SIGNATURE
+# CHECK-ORIGINAL-NEXT: cmdsize 16
+# CHECK-ORIGINAL-NEXT: dataoff 16544
+# CHECK-ORIGINAL-NEXT: datasize 280
+
+# RUN: llvm-install-name-tool -prepend_rpath abcd %t
+
+# RUN: llvm-objdump --private-headers %t | FileCheck %s --check-prefix=CHECK-PREPEND
+## Verify that the binary contains the new RPATH command, as the first command
+# CHECK-PREPEND:         Load command 0
+# CHECK-PREPEND-NEXT:    cmd LC_RPATH
+# CHECK-PREPEND-NEXT:    cmdsize
+# CHECK-PREPEND-NEXT:    path abcd
+
+## Verify the text segment command index increased by 1
+# CHECK-PREPEND:      Load command 2
+# CHECK-PREPEND-NEXT  cmdsize
+# CHECK-PREPEND-NEXT  segname __TEXT
+# CHECK-PREPEND-NEXT  vmaddr
+# CHECK-PREPEND-NEXT  vmsize
+# CHECK-PREPEND-NEXT  fileoff 0
+# CHECK-PREPEND-NEXT  filesize 16384
+
+## Verify the code signature command index increased by 1
+# CHECK-PREPEND:        Load command 15
+# CHECK-PREPEND-NEXT:   cmd LC_CODE_SIGNATURE
+# CHECK-PREPEND-NEXT:   cmdsize 16
+# CHECK-PREPEND-NEXT:   dataoff 16544
+# CHECK-PREPEND-NEXT:   datasize 320
+
+## Verify the new signature is valid
+# RUN: %python %p/Inputs/code-signature-check.py %t 16544 320 0 16544 | FileCheck %s --check-prefix=CHECK-TEXT-SEGMENT
+## Verify the text segment offset and text segment size values included in the signature header are accurate
+# CHECK-TEXT-SEGMENT: execSegBase=0, execSegLimit=16384
+
+# RUN: llvm-install-name-tool -delete_rpath abcd %t
+
+# RUN: llvm-objdump --private-headers %t | FileCheck %s --check-prefix=CHECK-REMOVE
+
+## Verify text segment command index returned to orignal
+# CHECK-REMOVE:      Load command 1
+# CHECK-REMOVE-NEXT  cmdsize
+# CHECK-REMOVE-NEXT  segname __TEXT
+# CHECK-REMOVE-NEXT  vmaddr
+# CHECK-REMOVE-NEXT  vmsize
+# CHECK-REMOVE-NEXT  fileoff 0
+# CHECK-REMOVE-NEXT  filesize 16384
+
+## Verify text segment command index returned to original
+# CHECK-REMOVE:      Load command 14
+# CHECK-REMOVE-NEXT: cmd LC_CODE_SIGNATURE
+# CHECK-REMOVE-NEXT: cmdsize 16
+# CHECK-REMOVE-NEXT: dataoff 16544
+# CHECK-REMOVE-NEXT: datasize 320
+
+## Verify the new signature is valid and text segment values are accurate
+# RUN: %python %p/Inputs/code-signature-check.py %t 16544 320 0 16544 | FileCheck %s --check-prefix=CHECK-TEXT-SEGMENT
+
+--- !mach-o
+FileHeader:
+  magic:           0xFEEDFACF
+  cputype:         0x1000007
+  cpusubtype:      0x3
+  filetype:        0x2
+  ncmds:           15
+  sizeofcmds:      760
+  flags:           0x200085
+  reserved:        0x0
+LoadCommands:
+  - cmd:             LC_SEGMENT_64
+    cmdsize:         72
+    segname:         __PAGEZERO
+    vmaddr:          0
+    vmsize:          4294967296
+    fileoff:         0
+    filesize:        0
+    maxprot:         0
+    initprot:        0
+    nsects:          0
+    flags:           0
+  - cmd:             LC_SEGMENT_64
+    cmdsize:         232
+    segname:         __TEXT
+    vmaddr:          4294967296
+    vmsize:          16384
+    fileoff:         0
+    filesize:        16384
+    maxprot:         5
+    initprot:        5
+    nsects:          2
+    flags:           0
+    Sections:
+      - sectname:        __text
+        segname:         __TEXT
+        addr:            0x100003FA0
+        size:            15
+        offset:          0x3FA0
+        align:           4
+        reloff:          0x0
+        nreloc:          0
+        flags:           0x80000400
+        reserved1:       0x0
+        reserved2:       0x0
+        reserved3:       0x0
+        content:         554889E531C0C745FC000000005DC3
+      - sectname:        __unwind_info
+        segname:         __TEXT
+        addr:            0x100003FB0
+        size:            72
+        offset:          0x3FB0
+        align:           2
+        reloff:          0x0
+        nreloc:          0
+        flags:           0x0
+        reserved1:       0x0
+        reserved2:       0x0
+        reserved3:       0x0
+        content:         010000001C000000000000001C000000000000001C00000002000000A03F00003400000034000000B03F00000000000034000000030000000C000100100001000000000000000001
+  - cmd:             LC_SEGMENT_64
+    cmdsize:         72
+    segname:         __LINKEDIT
+    vmaddr:          4294983680
+    vmsize:          16384
+    fileoff:         16384
+    filesize:        440
+    maxprot:         1
+    initprot:        1
+    nsects:          0
+    flags:           0
+  - cmd:             LC_DYLD_INFO_ONLY
+    cmdsize:         48
+    rebase_off:      0
+    rebase_size:     0
+    bind_off:        0
+    bind_size:       0
+    weak_bind_off:   0
+    weak_bind_size:  0
+    lazy_bind_off:   0
+    lazy_bind_size:  0
+    export_off:      16384
+    export_size:     48
+  - cmd:             LC_SYMTAB
+    cmdsize:         24
+    symoff:          16440
+    nsyms:           3
+    stroff:          16488
+    strsize:         48
+  - cmd:             LC_DYSYMTAB
+    cmdsize:         80
+    ilocalsym:       0
+    nlocalsym:       0
+    iextdefsym:      0
+    nextdefsym:      2
+    iundefsym:       2
+    nundefsym:       1
+    tocoff:          0
+    ntoc:            0
+    modtaboff:       0
+    nmodtab:         0
+    extrefsymoff:    0
+    nextrefsyms:     0
+    indirectsymoff:  0
+    nindirectsyms:   0
+    extreloff:       0
+    nextrel:         0
+    locreloff:       0
+    nlocrel:         0
+  - cmd:             LC_LOAD_DYLINKER
+    cmdsize:         32
+    name:            12
+    Content:         '/usr/lib/dyld'
+    ZeroPadBytes:    7
+  - cmd:             LC_UUID
+    cmdsize:         24
+    uuid:            42759668-1CBA-3094-8E2D-F01E1A66E815
+  - cmd:             LC_BUILD_VERSION
+    cmdsize:         32
+    platform:        1
+    minos:           720896
+    sdk:             721664
+    ntools:          1
+    Tools:
+      - tool:            3
+        version:         42600704
+  - cmd:             LC_SOURCE_VERSION
+    cmdsize:         16
+    version:         0
+  - cmd:             LC_MAIN
+    cmdsize:         24
+    entryoff:        16288
+    stacksize:       0
+  - cmd:             LC_LOAD_DYLIB
+    cmdsize:         56
+    dylib:
+      name:            24
+      timestamp:       2
+      current_version: 84698117
+      compatibility_version: 65536
+    Content:         '/usr/lib/libSystem.B.dylib'
+    ZeroPadBytes:    6
+  - cmd:             LC_FUNCTION_STARTS
+    cmdsize:         16
+    dataoff:         16432
+    datasize:        8
+  - cmd:             LC_DATA_IN_CODE
+    cmdsize:         16
+    dataoff:         16440
+    datasize:        0
+  - cmd:             LC_CODE_SIGNATURE
+    cmdsize:         16
+    dataoff:         16544
+    datasize:        280
+LinkEditData:
+  ExportTrie:
+    TerminalSize:    0
+    NodeOffset:      0
+    Name:            ''
+    Flags:           0x0
+    Address:         0x0
+    Other:           0x0
+    ImportName:      ''
+    Children:
+      - TerminalSize:    0
+        NodeOffset:      5
+        Name:            _
+        Flags:           0x0
+        Address:         0x0
+        Other:           0x0
+        ImportName:      ''
+        Children:
+          - TerminalSize:    2
+            NodeOffset:      33
+            Name:            _mh_execute_header
+            Flags:           0x0
+            Address:         0x0
+            Other:           0x0
+            ImportName:      ''
+          - TerminalSize:    3
+            NodeOffset:      37
+            Name:            main
+            Flags:           0x0
+            Address:         0x3FA0
+            Other:           0x0
+            ImportName:      ''
+  NameList:
+    - n_strx:          2
+      n_type:          0xF
+      n_sect:          1
+      n_desc:          16
+      n_value:         4294967296
+    - n_strx:          22
+      n_type:          0xF
+      n_sect:          1
+      n_desc:          0
+      n_value:         4294983584
+    - n_strx:          28
+      n_type:          0x1
+      n_sect:          0
+      n_desc:          256
+      n_value:         0
+  StringTable:
+    - ' '
+    - __mh_execute_header
+    - _main
+    - dyld_stub_binder
+    - ''
+    - ''
+    - ''
+...

llvm/tools/llvm-objcopy/MachO/MachOLayoutBuilder.h

 
 #include "MachOObjcopy.h"
 #include "Object.h"
 
 namespace llvm {
 namespace objcopy {
 namespace macho {
 
+/// When MachO binaries include a LC_CODE_SIGNATURE load command,
+/// the __LINKEDIT data segment will include a section corresponding
+/// to the LC_CODE_SIGNATURE load command. This section serves as a signature
+/// for the binary. Included in the CodeSignature section is a header followed
+/// by a hash of the binary. If present, the CodeSignature section is the
+/// last component of the binary.
+struct CodeSignatureInfo {
+  // NOTE: These values are to be kept in sync with those in
+  // LLD's CodeSignatureSection class.
+
+  static constexpr uint32_t Align = 16;
+  static constexpr uint8_t BlockSizeShift = 12;
+  // The binary is read in blocks of the following size.
+  static constexpr size_t BlockSize = (1 << BlockSizeShift); // 4 KiB
+  // For each block, a SHA256 hash (256 bits, 32 bytes) is written to
+  // the CodeSignature section.
+  static constexpr size_t HashSize = 256 / 8;
+  static constexpr size_t BlobHeadersSize = llvm::alignTo<8>(
+      sizeof(llvm::MachO::CS_SuperBlob) + sizeof(llvm::MachO::CS_BlobIndex));
+  // The size of the entire header depends upon the filename the binary is being
+  // written to, but the rest of the header is fixed in size.
+  static constexpr uint32_t FixedHeadersSize =
+      BlobHeadersSize + sizeof(llvm::MachO::CS_CodeDirectory);
+
+  // The offset relative to the start of the binary where
+  // the CodeSignature section should begin.
+  uint32_t StartOffset;
+  // The size of the entire header, output file name size included.
+  uint32_t AllHeadersSize;
+  // The number of blocks required to hash the binary.
+  uint32_t BlockCount;
+  StringRef OutputFileName;
+  // The size of the entire CodeSignature section, including both the header and
+  // hashes.
+  uint32_t Size;
+};
+
 class MachOLayoutBuilder {
   Object &O;
   bool Is64Bit;
+  StringRef OutputFileName;
   uint64_t PageSize;
+  CodeSignatureInfo CodeSignature;
 
   // Points to the __LINKEDIT segment if it exists.
   MachO::macho_load_command *LinkEditLoadCommand = nullptr;
   StringTableBuilder StrTableBuilder;
 
   uint32_t computeSizeOfCmds() const;
   void constructStringTable();
   void updateSymbolIndexes();
   void updateDySymTab(MachO::macho_load_command &MLC);
   uint64_t layoutSegments();
   uint64_t layoutRelocations(uint64_t Offset);
   Error layoutTail(uint64_t Offset);
 
   static StringTableBuilder::Kind getStringTableBuilderKind(const Object &O,
                                                             bool Is64Bit);
 
 public:
-  MachOLayoutBuilder(Object &O, bool Is64Bit, uint64_t PageSize)
-      : O(O), Is64Bit(Is64Bit), PageSize(PageSize),
+  MachOLayoutBuilder(Object &O, bool Is64Bit, StringRef OutputFileName,
+                     uint64_t PageSize)
+      : O(O), Is64Bit(Is64Bit), OutputFileName(OutputFileName),
+        PageSize(PageSize),
         StrTableBuilder(getStringTableBuilderKind(O, Is64Bit)) {}
 
   // Recomputes and updates fields in the given object such as file offsets.
   Error layout();
 
   StringTableBuilder &getStringTableBuilder() { return StrTableBuilder; }
+
+  const CodeSignatureInfo &getCodeSignature() { return CodeSignature; }
 };
 
 } // end namespace macho
 } // end namespace objcopy
 } // end namespace llvm
 
 #endif // LLVM_OBJCOPY_MACHO_MACHOLAYOUTBUILDER_H

llvm/tools/llvm-objcopy/MachO/MachOLayoutBuilder.cpp

uint64_t StartOfSymbols =
       StartOfLinkerOptimizationHint + O.LinkerOptimizationHint.Data.size();
   uint64_t StartOfIndirectSymbols =
       StartOfSymbols + NListSize * O.SymTable.Symbols.size();
   uint64_t StartOfSymbolStrings =
       StartOfIndirectSymbols +
       sizeof(uint32_t) * O.IndirectSymTable.Symbols.size();
   uint64_t StartOfCodeSignature =
       StartOfSymbolStrings + StrTableBuilder.getSize();
-  if (O.CodeSignatureCommandIndex)
+  uint32_t CodeSignatureSize = 0;
+  if (O.CodeSignatureCommandIndex) {
     StartOfCodeSignature = alignTo(StartOfCodeSignature, 16);
+
+    // Note: These calculations are to be kept in sync with the same
+    // calculations performed in LLD's CodeSignatureSection.
+    const uint32_t AllHeadersSize =
+        alignTo(CodeSignature.FixedHeadersSize + OutputFileName.size() + 1,
+                CodeSignature.Align);
+    const uint32_t BlockCount =
+        (StartOfCodeSignature + CodeSignature.BlockSize - 1) /
+        CodeSignature.BlockSize;
+    const uint32_t Size =
+        alignTo(AllHeadersSize + BlockCount * CodeSignature.HashSize,
+                CodeSignature.Align);
+
+    CodeSignature.StartOffset = StartOfCodeSignature;
+    CodeSignature.AllHeadersSize = AllHeadersSize;
+    CodeSignature.BlockCount = BlockCount;
+    CodeSignature.OutputFileName = OutputFileName;
+    CodeSignature.Size = Size;
+    CodeSignatureSize = Size;
+  }
   uint64_t LinkEditSize =
-      (StartOfCodeSignature + O.CodeSignature.Data.size()) - StartOfLinkEdit;
+      StartOfCodeSignature + CodeSignatureSize - StartOfLinkEdit;
 
   // Now we have determined the layout of the contents of the __LINKEDIT
   // segment. Update its load command.
   if (LinkEditLoadCommand) {
     MachO::macho_load_command *MLC = LinkEditLoadCommand;
     switch (LinkEditLoadCommand->load_command_data.cmd) {
     case MachO::LC_SEGMENT:
       MLC->segment_command_data.cmdsize = sizeof(MachO::segment_command);
Error MachOLayoutBuilder::layoutTail(uint64_t Offset) {
   }
 
   for (LoadCommand &LC : O.LoadCommands) {
     auto &MLC = LC.MachOLoadCommand;
     auto cmd = MLC.load_command_data.cmd;
     switch (cmd) {
     case MachO::LC_CODE_SIGNATURE:
       MLC.linkedit_data_command_data.dataoff = StartOfCodeSignature;
-      MLC.linkedit_data_command_data.datasize = O.CodeSignature.Data.size();
+      MLC.linkedit_data_command_data.datasize = CodeSignatureSize;
       break;
     case MachO::LC_SYMTAB:
       MLC.symtab_command_data.symoff = StartOfSymbols;
       MLC.symtab_command_data.nsyms = O.SymTable.Symbols.size();
       MLC.symtab_command_data.stroff = StartOfSymbolStrings;
       MLC.symtab_command_data.strsize = StrTableBuilder.getSize();
       break;
     case MachO::LC_DYSYMTAB: {

llvm/tools/llvm-objcopy/MachO/MachOObjcopy.cpp

 #include "MultiFormatConfig.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/Object/ArchiveWriter.h"
 #include "llvm/Object/MachOUniversal.h"
 #include "llvm/Object/MachOUniversalWriter.h"
 #include "llvm/Support/Errc.h"
 #include "llvm/Support/Error.h"
 #include "llvm/Support/FileOutputBuffer.h"
+#include "llvm/Support/Path.h"
 #include "llvm/Support/SmallVectorMemoryBuffer.h"
 
 using namespace llvm;
 using namespace llvm::objcopy;
 using namespace llvm::objcopy::macho;
 using namespace llvm::object;
 
 using SectionPred = std::function<bool(const std::unique_ptr<Section> &Sec)>;
Error objcopy::macho::executeObjcopyOnBinary(const CommonConfig &Config,
   case Triple::ArchType::aarch64:
   case Triple::ArchType::aarch64_32:
     PageSize = 16384;
     break;
   default:
     PageSize = 4096;
   }
 
-  MachOWriter Writer(**O, In.is64Bit(), In.isLittleEndian(), PageSize, Out);
+  MachOWriter Writer(**O, In.is64Bit(), In.isLittleEndian(),
+                     sys::path::filename(Config.OutputFilename), PageSize, Out);
   if (auto E = Writer.finalize())
     return E;
   return Writer.write();
 }
 
 Error objcopy::macho::executeObjcopyOnMachOUniversalBinary(
     const MultiFormatConfig &Config, const MachOUniversalBinary &In,
     raw_ostream &Out) {

llvm/tools/llvm-objcopy/MachO/MachOReader.cpp

assert(S.NReloc == S.Relocations.size() &&
            "Incorrect number of relocations");
   }
   return std::move(Sections);
 }
 
 Error MachOReader::readLoadCommands(Object &O) const {
   // For MachO sections indices start from 1.
   uint32_t NextSectionIndex = 1;
+  static constexpr char TextSegmentName[] = "__TEXT";
   for (auto LoadCmd : MachOObj.load_commands()) {
     LoadCommand LC;
     switch (LoadCmd.C.cmd) {
     case MachO::LC_CODE_SIGNATURE:
       O.CodeSignatureCommandIndex = O.LoadCommands.size();
       break;
     case MachO::LC_SEGMENT:
+      if (StringRef(
+              reinterpret_cast<MachO::segment_command const *>(LoadCmd.Ptr)
+                  ->segname) == TextSegmentName)
+        O.TextSegmentCommandIndex = O.LoadCommands.size();
+
       if (Expected<std::vector<std::unique_ptr<Section>>> Sections =
               extractSections<MachO::section, MachO::segment_command>(
                   LoadCmd, MachOObj, NextSectionIndex))
         LC.Sections = std::move(*Sections);
       else
         return Sections.takeError();
       break;
     case MachO::LC_SEGMENT_64:
+      if (StringRef(
+              reinterpret_cast<MachO::segment_command_64 const *>(LoadCmd.Ptr)
+                  ->segname) == TextSegmentName)
+        O.TextSegmentCommandIndex = O.LoadCommands.size();
+
       if (Expected<std::vector<std::unique_ptr<Section>>> Sections =
               extractSections<MachO::section_64, MachO::segment_command_64>(
                   LoadCmd, MachOObj, NextSectionIndex))
         LC.Sections = std::move(*Sections);
       else
         return Sections.takeError();
       break;
     case MachO::LC_SYMTAB:
void MachOReader::readLinkData(Object &O, Optional<size_t> LCIndex,
   if (!LCIndex)
     return;
   const MachO::linkedit_data_command &LC =
       O.LoadCommands[*LCIndex].MachOLoadCommand.linkedit_data_command_data;
   LD.Data =
       arrayRefFromStringRef(MachOObj.getData().substr(LC.dataoff, LC.datasize));
 }
 
-void MachOReader::readCodeSignature(Object &O) const {
-  return readLinkData(O, O.CodeSignatureCommandIndex, O.CodeSignature);
-}
-
 void MachOReader::readDataInCodeData(Object &O) const {
   return readLinkData(O, O.DataInCodeCommandIndex, O.DataInCode);
 }
 
 void MachOReader::readLinkerOptimizationHint(Object &O) const {
   return readLinkData(O, O.LinkerOptimizationHintCommandIndex,
                       O.LinkerOptimizationHint);
 }
if (Error E = readLoadCommands(*Obj))
     return std::move(E);
   readSymbolTable(*Obj);
   setSymbolInRelocationInfo(*Obj);
   readRebaseInfo(*Obj);
   readBindInfo(*Obj);
   readWeakBindInfo(*Obj);
   readLazyBindInfo(*Obj);
   readExportInfo(*Obj);
-  readCodeSignature(*Obj);
   readDataInCodeData(*Obj);
   readLinkerOptimizationHint(*Obj);
   readFunctionStartsData(*Obj);
   readIndirectSymbolTable(*Obj);
   readSwiftVersion(*Obj);
   return std::move(Obj);
 }

llvm/tools/llvm-objcopy/MachO/MachOWriter.h

class MachOWriter {
   void writeLinkData(Optional<size_t> LCIndex, const LinkData &LD);
   void writeCodeSignatureData();
   void writeDataInCodeData();
   void writeLinkerOptimizationHint();
   void writeFunctionStartsData();
   void writeTail();
 
 public:
-  MachOWriter(Object &O, bool Is64Bit, bool IsLittleEndian, uint64_t PageSize,
-              raw_ostream &Out)
+  MachOWriter(Object &O, bool Is64Bit, bool IsLittleEndian,
+              StringRef OutputFileName, uint64_t PageSize, raw_ostream &Out)
       : O(O), Is64Bit(Is64Bit), IsLittleEndian(IsLittleEndian),
-        PageSize(PageSize), Out(Out), LayoutBuilder(O, Is64Bit, PageSize) {}
+        PageSize(PageSize), Out(Out),
+        LayoutBuilder(O, Is64Bit, OutputFileName, PageSize) {}
 
   size_t totalSize() const;
   Error finalize();
   Error write();
 };
 
 } // end namespace macho
 } // end namespace objcopy
 } // end namespace llvm

llvm/tools/llvm-objcopy/MachO/MachOWriter.cpp

 //===- MachOWriter.cpp ------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "MachOWriter.h"
 #include "MachOLayoutBuilder.h"
 #include "Object.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/BinaryFormat/MachO.h"
 #include "llvm/Object/MachO.h"
 #include "llvm/Support/Errc.h"
 #include "llvm/Support/ErrorHandling.h"
+#include "llvm/Support/SHA256.h"
 #include <memory>
 
+#if defined(__APPLE__)
+#include <sys/mman.h>
+#endif
+
 using namespace llvm;
 using namespace llvm::objcopy::macho;
+using namespace llvm::support::endian;
 
 size_t MachOWriter::headerSize() const {
   return Is64Bit ? sizeof(MachO::mach_header_64) : sizeof(MachO::mach_header);
 }
 
 size_t MachOWriter::loadCommandsSize() const { return O.Header.SizeOfCmds; }
 
 size_t MachOWriter::symTableSize() const {
void MachOWriter::writeLinkData(Optional<size_t> LCIndex, const LinkData &LD) {
   const MachO::linkedit_data_command &LinkEditDataCommand =
       O.LoadCommands[*LCIndex].MachOLoadCommand.linkedit_data_command_data;
   char *Out = (char *)Buf->getBufferStart() + LinkEditDataCommand.dataoff;
   assert((LinkEditDataCommand.datasize == LD.Data.size()) &&
          "Incorrect data size");
   memcpy(Out, LD.Data.data(), LD.Data.size());
 }
 
+static uint64_t
+getSegmentFileOffset(const LoadCommand &TextSegmentLoadCommand) {
+  const MachO::macho_load_command &MLC =
+      TextSegmentLoadCommand.MachOLoadCommand;
+  switch (MLC.load_command_data.cmd) {
+  case MachO::LC_SEGMENT:
+    return MLC.segment_command_data.fileoff;
+  case MachO::LC_SEGMENT_64:
+    return MLC.segment_command_64_data.fileoff;
+  default:
+    return 0;
+  }
+}
+
+static uint64_t getSegmentFileSize(const LoadCommand &TextSegmentLoadCommand) {
+  const MachO::macho_load_command &MLC =
+      TextSegmentLoadCommand.MachOLoadCommand;
+  switch (MLC.load_command_data.cmd) {
+  case MachO::LC_SEGMENT:
+    return MLC.segment_command_data.filesize;
+  case MachO::LC_SEGMENT_64:
+    return MLC.segment_command_64_data.filesize;
+  default:
+    return 0;
+  }
+}
+
 void MachOWriter::writeCodeSignatureData() {
-  return writeLinkData(O.CodeSignatureCommandIndex, O.CodeSignature);
+  // NOTE: This CodeSignature section behaviour must be kept in sync with that
+  // performed in LLD's CodeSignatureSection::write /
+  // CodeSignatureSection::writeHashes. Furthermore, this call must occur only
+  // after the rest of the binary has already been written to the buffer. This
+  // is because the buffer is read from to perform the necessary hashing.
+
+  // The CodeSignature section is the last section in the MachO binary and
+  // contains a hash of all content in the binary before it. Since llvm-objcopy
+  // has likely modified the target binary, the hash must be regenerated
+  // entirely. To generate this hash, we must read from the start of the binary
+  // (HashReadStart) to just before the start of the CodeSignature section
+  // (HashReadEnd).
+
+  const CodeSignatureInfo &CodeSignature = LayoutBuilder.getCodeSignature();
+
+  uint8_t *BufferStart = reinterpret_cast<uint8_t *>(Buf->getBufferStart());
+  uint8_t *HashReadStart = BufferStart;
+  uint8_t *HashReadEnd = BufferStart + CodeSignature.StartOffset;
+
+  // The CodeSignature section begins with a header, after which the hashes
+  // of each page of the binary are written.
+  uint8_t *HashWriteStart = HashReadEnd + CodeSignature.AllHeadersSize;
+
+  uint32_t TextSegmentFileOff = 0;
+  uint32_t TextSegmentFileSize = 0;
+  if (O.TextSegmentCommandIndex) {
+    const LoadCommand &TextSegmentLoadCommand =
+        O.LoadCommands[*O.TextSegmentCommandIndex];
+    assert(TextSegmentLoadCommand.MachOLoadCommand.load_command_data.cmd ==
+               MachO::LC_SEGMENT ||
+           TextSegmentLoadCommand.MachOLoadCommand.load_command_data.cmd ==
+               MachO::LC_SEGMENT_64);
+    assert(StringRef(TextSegmentLoadCommand.MachOLoadCommand
+                         .segment_command_data.segname) == "__TEXT");
+    TextSegmentFileOff = getSegmentFileOffset(TextSegmentLoadCommand);
+    TextSegmentFileSize = getSegmentFileSize(TextSegmentLoadCommand);
+  }
+
+  const uint32_t FileNamePad = CodeSignature.AllHeadersSize -
+                               CodeSignature.FixedHeadersSize -
+                               CodeSignature.OutputFileName.size();
+
+  // Write code section header.
+  auto *SuperBlob = reinterpret_cast<MachO::CS_SuperBlob *>(HashReadEnd);
+  write32be(&SuperBlob->magic, MachO::CSMAGIC_EMBEDDED_SIGNATURE);
+  write32be(&SuperBlob->length, CodeSignature.Size);
+  write32be(&SuperBlob->count, 1);
+  auto *BlobIndex = reinterpret_cast<MachO::CS_BlobIndex *>(&SuperBlob[1]);
+  write32be(&BlobIndex->type, MachO::CSSLOT_CODEDIRECTORY);
+  write32be(&BlobIndex->offset, CodeSignature.BlobHeadersSize);
+  auto *CodeDirectory = reinterpret_cast<MachO::CS_CodeDirectory *>(
+      HashReadEnd + CodeSignature.BlobHeadersSize);
+  write32be(&CodeDirectory->magic, MachO::CSMAGIC_CODEDIRECTORY);
+  write32be(&CodeDirectory->length,
+            CodeSignature.Size - CodeSignature.BlobHeadersSize);
+  write32be(&CodeDirectory->version, MachO::CS_SUPPORTSEXECSEG);
+  write32be(&CodeDirectory->flags, MachO::CS_ADHOC | MachO::CS_LINKER_SIGNED);
+  write32be(&CodeDirectory->hashOffset,
+            sizeof(MachO::CS_CodeDirectory) +
+                CodeSignature.OutputFileName.size() + FileNamePad);
+  write32be(&CodeDirectory->identOffset, sizeof(MachO::CS_CodeDirectory));
+  CodeDirectory->nSpecialSlots = 0;
+  write32be(&CodeDirectory->nCodeSlots, CodeSignature.BlockCount);
+  write32be(&CodeDirectory->codeLimit, CodeSignature.StartOffset);
+  CodeDirectory->hashSize = static_cast<uint8_t>(CodeSignature.HashSize);
+  CodeDirectory->hashType = MachO::kSecCodeSignatureHashSHA256;
+  CodeDirectory->platform = 0;
+  CodeDirectory->pageSize = CodeSignature.BlockSizeShift;
+  CodeDirectory->spare2 = 0;
+  CodeDirectory->scatterOffset = 0;
+  CodeDirectory->teamOffset = 0;
+  CodeDirectory->spare3 = 0;
+  CodeDirectory->codeLimit64 = 0;
+  write64be(&CodeDirectory->execSegBase, TextSegmentFileOff);
+  write64be(&CodeDirectory->execSegLimit, TextSegmentFileSize);
+  write64be(&CodeDirectory->execSegFlags, O.Header.FileType == MachO::MH_EXECUTE
+                                              ? MachO::CS_EXECSEG_MAIN_BINARY
+                                              : 0);
+
+  auto *Id = reinterpret_cast<char *>(&CodeDirectory[1]);
+  memcpy(Id, CodeSignature.OutputFileName.begin(),
+         CodeSignature.OutputFileName.size());
+  memset(Id + CodeSignature.OutputFileName.size(), 0, FileNamePad);
+
+  // Write the hashes.
+  uint8_t *CurrHashReadPosition = HashReadStart;
+  uint8_t *CurrHashWritePosition = HashWriteStart;
+  while (CurrHashReadPosition < HashReadEnd) {
+    StringRef Block(reinterpret_cast<char *>(CurrHashReadPosition),
+                    std::min(HashReadEnd - CurrHashReadPosition,
+                             static_cast<ssize_t>(CodeSignature.BlockSize)));
+    SHA256 Hasher;
+    Hasher.update(Block);
+    StringRef Hash = Hasher.final();
+    assert(Hash.size() == CodeSignature.HashSize);
+    memcpy(CurrHashWritePosition, Hash.data(), CodeSignature.HashSize);
+    CurrHashReadPosition += CodeSignature.BlockSize;
+    CurrHashWritePosition += CodeSignature.HashSize;
+  }
+#if defined(__APPLE__)
+  // This is macOS-specific work-around and makes no sense for any
+  // other host OS. See https://openradar.appspot.com/FB8914231
+  //
+  // The macOS kernel maintains a signature-verification cache to
+  // quickly validate applications at time of execve(2).  The trouble
+  // is that for the kernel creates the cache entry at the time of the
+  // mmap(2) call, before we have a chance to write either the code to
+  // sign or the signature header+hashes.  The fix is to invalidate
+  // all cached data associated with the output file, thus discarding
+  // the bogus prematurely-cached signature.
+  msync(BufferStart, CodeSignature.StartOffset + CodeSignature.Size,
+        MS_INVALIDATE);
+#endif
 }
 
 void MachOWriter::writeDataInCodeData() {
   return writeLinkData(O.DataInCodeCommandIndex, O.DataInCode);
 }
 
 void MachOWriter::writeLinkerOptimizationHint() {
   return writeLinkData(O.LinkerOptimizationHintCommandIndex,

llvm/tools/llvm-objcopy/MachO/Object.h

struct LoadCommand {
   std::vector<uint8_t> Payload;
 
   // Some load commands can contain (inside the payload) an array of sections,
   // though the contents of the sections are stored separately. The struct
   // Section describes only sections' metadata and where to find the
   // corresponding content inside the binary.
   std::vector<std::unique_ptr<Section>> Sections;
 
   // Returns the segment name if the load command is a segment command.
   Optional<StringRef> getSegmentName() const;
 
   // Returns the segment vm address if the load command is a segment command.
   Optional<uint64_t> getSegmentVMAddr() const;
 };
 
 // A symbol information. Fields which starts with "n_" are same as them in the
 // nlist.

 struct ExportInfo {
   ArrayRef<uint8_t> Trie;
 };
 
 struct LinkData {
   ArrayRef<uint8_t> Data;
 };
 
 struct Object {
   MachHeader Header;
   std::vector<LoadCommand> LoadCommands;
 
   SymbolTable SymTable;
   StringTable StrTable;
 
   RebaseInfo Rebases;
   BindInfo Binds;
   WeakBindInfo WeakBinds;
   LazyBindInfo LazyBinds;
   ExportInfo Exports;
   IndirectSymbolTable IndirectSymTable;
   LinkData DataInCode;
   LinkData LinkerOptimizationHint;
   LinkData FunctionStarts;
-  LinkData CodeSignature;
 
   Optional<uint32_t> SwiftVersion;
 
   /// The index of LC_CODE_SIGNATURE load command if present.
   Optional<size_t> CodeSignatureCommandIndex;
   /// The index of LC_SYMTAB load command if present.
   Optional<size_t> SymTabCommandIndex;
   /// The index of LC_DYLD_INFO or LC_DYLD_INFO_ONLY load command if present.
   Optional<size_t> DyLdInfoCommandIndex;
   /// The index LC_DYSYMTAB load comamnd if present.
   Optional<size_t> DySymTabCommandIndex;
   /// The index LC_DATA_IN_CODE load comamnd if present.
   Optional<size_t> DataInCodeCommandIndex;
   /// The index of LC_LINKER_OPTIMIZATIN_HINT load comamnd if present.
   Optional<size_t> LinkerOptimizationHintCommandIndex;
   /// The index LC_FUNCTION_STARTS load comamnd if present.
   Optional<size_t> FunctionStartsCommandIndex;
+  /// The index of the LC_SEGMENT or LC_SEGMENT_64 load command
+  /// corresponding to the __TEXT segment.
+  Optional<size_t> TextSegmentCommandIndex;
 
   BumpPtrAllocator Alloc;
   StringSaver NewSectionsContents;
 
   Object() : NewSectionsContents(Alloc) {}
 
   Error
   removeSections(function_ref<bool(const std::unique_ptr<Section> &)> ToRemove);

llvm/tools/llvm-objcopy/MachO/Object.cpp

 }
 
 void SymbolTable::removeSymbols(
     function_ref<bool(const std::unique_ptr<SymbolEntry> &)> ToRemove) {
   llvm::erase_if(Symbols, ToRemove);
 }
 
 void Object::updateLoadCommandIndexes() {
+  static constexpr char TextSegmentName[] = "__TEXT";
   // Update indices of special load commands
   for (size_t Index = 0, Size = LoadCommands.size(); Index < Size; ++Index) {
     LoadCommand &LC = LoadCommands[Index];
     switch (LC.MachOLoadCommand.load_command_data.cmd) {
+    case MachO::LC_CODE_SIGNATURE:
+      CodeSignatureCommandIndex = Index;
+      break;
+    case MachO::LC_SEGMENT:
+      if (StringRef(LC.MachOLoadCommand.segment_command_data.segname) ==
+          TextSegmentName)
+        TextSegmentCommandIndex = Index;
+      break;
+    case MachO::LC_SEGMENT_64:
+      if (StringRef(LC.MachOLoadCommand.segment_command_64_data.segname) ==
+          TextSegmentName)
+        TextSegmentCommandIndex = Index;
+      break;
     case MachO::LC_SYMTAB:
       SymTabCommandIndex = Index;
       break;
     case MachO::LC_DYSYMTAB:
       DySymTabCommandIndex = Index;
       break;
     case MachO::LC_DYLD_INFO:
     case MachO::LC_DYLD_INFO_ONLY: