]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/mach_loader.c
projects / apple / xnu.git / blob
? search:


123339d3aacc15abbaaee7853b490d76f7fd51d3
[apple/xnu.git] / bsd / kern / mach_loader.c
1 /*
2 * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (C) 1988, 1989, NeXT, Inc.
30 *
31 * File: kern/mach_loader.c
32 * Author: Avadis Tevanian, Jr.
33 *
34 * Mach object file loader (kernel version, for now).
35 *
36 * 21-Jul-88 Avadis Tevanian, Jr. (avie) at NeXT
37 * Started.
38 */
39
40 #include <sys/param.h>
41 #include <sys/vnode_internal.h>
42 #include <sys/uio.h>
43 #include <sys/namei.h>
44 #include <sys/proc_internal.h>
45 #include <sys/kauth.h>
46 #include <sys/stat.h>
47 #include <sys/malloc.h>
48 #include <sys/mount_internal.h>
49 #include <sys/fcntl.h>
50 #include <sys/ubc_internal.h>
51 #include <sys/imgact.h>
52
53 #include <mach/mach_types.h>
54 #include <mach/vm_map.h> /* vm_allocate() */
55 #include <mach/mach_vm.h> /* mach_vm_allocate() */
56 #include <mach/vm_statistics.h>
57 #include <mach/task.h>
58 #include <mach/thread_act.h>
59
60 #include <machine/vmparam.h>
61 #include <machine/exec.h>
62
63 #include <kern/kern_types.h>
64 #include <kern/cpu_number.h>
65 #include <kern/mach_loader.h>
66 #include <kern/kalloc.h>
67 #include <kern/task.h>
68 #include <kern/thread.h>
69 #include <kern/page_decrypt.h>
70
71 #include <mach-o/fat.h>
72 #include <mach-o/loader.h>
73
74 #include <vm/pmap.h>
75 #include <vm/vm_map.h>
76 #include <vm/vm_kern.h>
77 #include <vm/vm_pager.h>
78 #include <vm/vnode_pager.h>
79 #include <vm/vm_protos.h>
80
81 /*
82 * XXX vm/pmap.h should not treat these prototypes as MACH_KERNEL_PRIVATE
83 * when KERNEL is defined.
84 */
85 extern pmap_t pmap_create(vm_map_size_t size, boolean_t is_64bit);
86 extern void pmap_switch(pmap_t);
87
88 /*
89 * XXX kern/thread.h should not treat these prototypes as MACH_KERNEL_PRIVATE
90 * when KERNEL is defined.
91 */
92 extern kern_return_t thread_setstatus(thread_t thread, int flavor,
93 thread_state_t tstate,
94 mach_msg_type_number_t count);
95
96 extern kern_return_t thread_state_initialize(thread_t thread);
97
98
99 /* XXX should have prototypes in a shared header file */
100 extern int get_map_nentries(vm_map_t);
101 extern kern_return_t thread_userstack(thread_t, int, thread_state_t,
102 unsigned int, mach_vm_offset_t *, int *);
103 extern kern_return_t thread_entrypoint(thread_t, int, thread_state_t,
104 unsigned int, mach_vm_offset_t *);
105
106 extern kern_return_t memory_object_signed(memory_object_control_t control,
107 boolean_t is_signed);
108
109 /* An empty load_result_t */
110 static load_result_t load_result_null = {
111 .mach_header = MACH_VM_MIN_ADDRESS,
112 .entry_point = MACH_VM_MIN_ADDRESS,
113 .user_stack = MACH_VM_MIN_ADDRESS,
114 .thread_count = 0,
115 .unixproc = 0,
116 .dynlinker = 0,
117 .customstack = 0,
118 .csflags = 0
119 };
120
121 /*
122 * Prototypes of static functions.
123 */
124 static load_return_t
125 parse_machfile(
126 struct vnode *vp,
127 vm_map_t map,
128 thread_t thread,
129 struct mach_header *header,
130 off_t file_offset,
131 off_t macho_size,
132 int depth,
133 load_result_t *result
134 );
135
136 static load_return_t
137 load_segment(
138 struct segment_command *scp,
139 void * pager,
140 off_t pager_offset,
141 off_t macho_size,
142 off_t end_of_file,
143 vm_map_t map,
144 load_result_t *result
145 );
146
147 static load_return_t
148 load_segment_64(
149 struct segment_command_64 *scp64,
150 void *pager,
151 off_t pager_offset,
152 off_t macho_size,
153 off_t end_of_file,
154 vm_map_t map,
155 load_result_t *result
156 );
157
158 int load_code_signature(
159 struct linkedit_data_command *lcp,
160 struct vnode *vp,
161 off_t macho_offset,
162 off_t macho_size,
163 cpu_type_t cputype,
164 load_result_t *result);
165
166 #if CONFIG_CODE_DECRYPTION
167 static load_return_t
168 set_code_unprotect(
169 struct encryption_info_command *lcp,
170 caddr_t addr,
171 vm_map_t map,
172 struct vnode *vp);
173 #endif
174
175 static load_return_t
176 load_unixthread(
177 struct thread_command *tcp,
178 thread_t thread,
179 load_result_t *result
180 );
181
182 static load_return_t
183 load_thread(
184 struct thread_command *tcp,
185 thread_t thread,
186 load_result_t *result
187 );
188
189 static load_return_t
190 load_threadstate(
191 thread_t thread,
192 unsigned long *ts,
193 unsigned long total_size
194 );
195
196 static load_return_t
197 load_threadstack(
198 thread_t thread,
199 unsigned long *ts,
200 unsigned long total_size,
201 user_addr_t *user_stack,
202 int *customstack
203 );
204
205 static load_return_t
206 load_threadentry(
207 thread_t thread,
208 unsigned long *ts,
209 unsigned long total_size,
210 mach_vm_offset_t *entry_point
211 );
212
213 static load_return_t
214 load_dylinker(
215 struct dylinker_command *lcp,
216 integer_t archbits,
217 vm_map_t map,
218 thread_t thread,
219 int depth,
220 load_result_t *result,
221 boolean_t is_64bit
222 );
223
224 static load_return_t
225 get_macho_vnode(
226 char *path,
227 integer_t archbits,
228 struct mach_header *mach_header,
229 off_t *file_offset,
230 off_t *macho_size,
231 struct vnode **vpp
232 );
233
234 load_return_t
235 load_machfile(
236 struct image_params *imgp,
237 struct mach_header *header,
238 thread_t thread,
239 vm_map_t new_map,
240 load_result_t *result
241 )
242 {
243 struct vnode *vp = imgp->ip_vp;
244 off_t file_offset = imgp->ip_arch_offset;
245 off_t macho_size = imgp->ip_arch_size;
246
247 pmap_t pmap = 0; /* protected by create_map */
248 vm_map_t map;
249 vm_map_t old_map;
250 load_result_t myresult;
251 load_return_t lret;
252 boolean_t create_map = TRUE;
253
254 if (new_map != VM_MAP_NULL) {
255 create_map = FALSE;
256 }
257
258 if (create_map) {
259 old_map = current_map();
260 pmap = pmap_create((vm_map_size_t) 0, (imgp->ip_flags & IMGPF_IS_64BIT));
261 map = vm_map_create(pmap,
262 0,
263 vm_compute_max_offset((imgp->ip_flags & IMGPF_IS_64BIT)),
264 TRUE);
265 } else
266 map = new_map;
267
268 if ( (header->flags & MH_ALLOW_STACK_EXECUTION) )
269 vm_map_disable_NX(map);
270
271 if (!result)
272 result = &myresult;
273
274 *result = load_result_null;
275
276 lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
277 0, result);
278
279 if (lret != LOAD_SUCCESS) {
280 if (create_map) {
281 vm_map_deallocate(map); /* will lose pmap reference too */
282 }
283 return(lret);
284 }
285
286 /*
287 * For 64-bit users, check for presence of a 4GB page zero
288 * which will enable the kernel to share the user's address space
289 * and hence avoid TLB flushes on kernel entry/exit
290 */
291 if ((imgp->ip_flags & IMGPF_IS_64BIT) &&
292 vm_map_has_4GB_pagezero(map))
293 vm_map_set_4GB_pagezero(map);
294
295 /*
296 * Commit to new map. First make sure that the current
297 * users of the task get done with it, and that we clean
298 * up the old contents of IPC and memory. The task is
299 * guaranteed to be single threaded upon return (us).
300 *
301 * Swap the new map for the old, which consumes our new map
302 * reference but each leaves us responsible for the old_map reference.
303 * That lets us get off the pmap associated with it, and
304 * then we can release it.
305 */
306
307 if (create_map) {
308 task_halt(current_task());
309
310 old_map = swap_task_map(current_task(), map);
311 vm_map_clear_4GB_pagezero(old_map);
312 pmap_switch(pmap); /* Make sure we are using the new pmap */
313 vm_map_deallocate(old_map);
314 }
315 return(LOAD_SUCCESS);
316 }
317
318 /*
319 * The file size of a mach-o file is limited to 32 bits; this is because
320 * this is the limit on the kalloc() of enough bytes for a mach_header and
321 * the contents of its sizeofcmds, which is currently constrained to 32
322 * bits in the file format itself. We read into the kernel buffer the
323 * commands section, and then parse it in order to parse the mach-o file
324 * format load_command segment(s). We are only interested in a subset of
325 * the total set of possible commands.
326 */
327 static
328 load_return_t
329 parse_machfile(
330 struct vnode *vp,
331 vm_map_t map,
332 thread_t thread,
333 struct mach_header *header,
334 off_t file_offset,
335 off_t macho_size,
336 int depth,
337 load_result_t *result
338 )
339 {
340 uint32_t ncmds;
341 struct load_command *lcp;
342 struct dylinker_command *dlp = 0;
343 integer_t dlarchbits = 0;
344 void * pager;
345 load_return_t ret = LOAD_SUCCESS;
346 caddr_t addr;
347 void * kl_addr;
348 vm_size_t size,kl_size;
349 size_t offset;
350 size_t oldoffset; /* for overflow check */
351 int pass;
352 proc_t p = current_proc(); /* XXXX */
353 int error;
354 int resid=0;
355 task_t task;
356 size_t mach_header_sz = sizeof(struct mach_header);
357 boolean_t abi64;
358 boolean_t got_code_signatures = FALSE;
359
360 if (header->magic == MH_MAGIC_64 ||
361 header->magic == MH_CIGAM_64) {
362 mach_header_sz = sizeof(struct mach_header_64);
363 }
364
365 /*
366 * Break infinite recursion
367 */
368 if (depth > 6) {
369 return(LOAD_FAILURE);
370 }
371
372 task = (task_t)get_threadtask(thread);
373
374 depth++;
375
376 /*
377 * Check to see if right machine type.
378 */
379 if (((cpu_type_t)(header->cputype & ~CPU_ARCH_MASK) != cpu_type()) ||
380 !grade_binary(header->cputype,
381 header->cpusubtype & ~CPU_SUBTYPE_MASK))
382 return(LOAD_BADARCH);
383
384 abi64 = ((header->cputype & CPU_ARCH_ABI64) == CPU_ARCH_ABI64);
385
386 switch (header->filetype) {
387
388 case MH_OBJECT:
389 case MH_EXECUTE:
390 case MH_PRELOAD:
391 if (depth != 1) {
392 return (LOAD_FAILURE);
393 }
394 break;
395
396 case MH_FVMLIB:
397 case MH_DYLIB:
398 if (depth == 1) {
399 return (LOAD_FAILURE);
400 }
401 break;
402
403 case MH_DYLINKER:
404 if (depth != 2) {
405 return (LOAD_FAILURE);
406 }
407 break;
408
409 default:
410 return (LOAD_FAILURE);
411 }
412
413 /*
414 * Get the pager for the file.
415 */
416 pager = (void *) ubc_getpager(vp);
417
418 /*
419 * Map portion that must be accessible directly into
420 * kernel's map.
421 */
422 if ((mach_header_sz + header->sizeofcmds) > macho_size)
423 return(LOAD_BADMACHO);
424
425 /*
426 * Round size of Mach-O commands up to page boundry.
427 */
428 size = round_page(mach_header_sz + header->sizeofcmds);
429 if (size <= 0)
430 return(LOAD_BADMACHO);
431
432 /*
433 * Map the load commands into kernel memory.
434 */
435 addr = 0;
436 kl_size = size;
437 kl_addr = kalloc(size);
438 addr = (caddr_t)kl_addr;
439 if (addr == NULL)
440 return(LOAD_NOSPACE);
441
442 error = vn_rdwr(UIO_READ, vp, addr, size, file_offset,
443 UIO_SYSSPACE32, 0, kauth_cred_get(), &resid, p);
444 if (error) {
445 if (kl_addr )
446 kfree(kl_addr, kl_size);
447 return(LOAD_IOERROR);
448 }
449
450 /*
451 * Scan through the commands, processing each one as necessary.
452 */
453 for (pass = 1; pass <= 2; pass++) {
454 /*
455 * Loop through each of the load_commands indicated by the
456 * Mach-O header; if an absurd value is provided, we just
457 * run off the end of the reserved section by incrementing
458 * the offset too far, so we are implicitly fail-safe.
459 */
460 offset = mach_header_sz;
461 ncmds = header->ncmds;
462 while (ncmds--) {
463 /*
464 * Get a pointer to the command.
465 */
466 lcp = (struct load_command *)(addr + offset);
467 oldoffset = offset;
468 offset += lcp->cmdsize;
469
470 /*
471 * Perform prevalidation of the struct load_command
472 * before we attempt to use its contents. Invalid
473 * values are ones which result in an overflow, or
474 * which can not possibly be valid commands, or which
475 * straddle or exist past the reserved section at the
476 * start of the image.
477 */
478 if (oldoffset > offset ||
479 lcp->cmdsize < sizeof(struct load_command) ||
480 offset > header->sizeofcmds + mach_header_sz) {
481 ret = LOAD_BADMACHO;
482 break;
483 }
484
485 /*
486 * Act on struct load_command's for which kernel
487 * intervention is required.
488 */
489 switch(lcp->cmd) {
490 case LC_SEGMENT_64:
491 if (pass != 1)
492 break;
493 ret = load_segment_64(
494 (struct segment_command_64 *)lcp,
495 pager,
496 file_offset,
497 macho_size,
498 ubc_getsize(vp),
499 map,
500 result);
501 break;
502 case LC_SEGMENT:
503 if (pass != 1)
504 break;
505 ret = load_segment(
506 (struct segment_command *) lcp,
507 pager,
508 file_offset,
509 macho_size,
510 ubc_getsize(vp),
511 map,
512 result);
513 break;
514 case LC_THREAD:
515 if (pass != 2)
516 break;
517 ret = load_thread((struct thread_command *)lcp,
518 thread,
519 result);
520 break;
521 case LC_UNIXTHREAD:
522 if (pass != 2)
523 break;
524 ret = load_unixthread(
525 (struct thread_command *) lcp,
526 thread,
527 result);
528 break;
529 case LC_LOAD_DYLINKER:
530 if (pass != 2)
531 break;
532 if ((depth == 1) && (dlp == 0)) {
533 dlp = (struct dylinker_command *)lcp;
534 dlarchbits = (header->cputype & CPU_ARCH_MASK);
535 } else {
536 ret = LOAD_FAILURE;
537 }
538 break;
539 case LC_CODE_SIGNATURE:
540 /* CODE SIGNING */
541 if (pass != 2)
542 break;
543 /* pager -> uip ->
544 load signatures & store in uip
545 set VM object "signed_pages"
546 */
547 ret = load_code_signature(
548 (struct linkedit_data_command *) lcp,
549 vp,
550 file_offset,
551 macho_size,
552 header->cputype,
553 (depth == 1) ? result : NULL);
554 if (ret != LOAD_SUCCESS) {
555 printf("proc %d: load code signature error %d "
556 "for file \"%s\"\n",
557 p->p_pid, ret, vp->v_name);
558 ret = LOAD_SUCCESS; /* ignore error */
559 } else {
560 got_code_signatures = TRUE;
561 }
562 break;
563 #if CONFIG_CODE_DECRYPTION
564 case LC_ENCRYPTION_INFO:
565 if (pass != 2)
566 break;
567 ret = set_code_unprotect(
568 (struct encryption_info_command *) lcp,
569 addr, map, vp);
570 if (ret != LOAD_SUCCESS) {
571 printf("proc %d: set unprotect error %d "
572 "for file \"%s\"\n",
573 p->p_pid, ret, vp->v_name);
574 ret = LOAD_SUCCESS; /* ignore error */
575 }
576 break;
577 #endif
578 default:
579 /* Other commands are ignored by the kernel */
580 ret = LOAD_SUCCESS;
581 break;
582 }
583 if (ret != LOAD_SUCCESS)
584 break;
585 }
586 if (ret != LOAD_SUCCESS)
587 break;
588 }
589 if (ret == LOAD_SUCCESS) {
590 if (! got_code_signatures) {
591 struct cs_blob *blob;
592 /* no embedded signatures: look for detached ones */
593 blob = ubc_cs_blob_get(vp, -1, file_offset);
594 if (blob != NULL) {
595 /* get flags to be applied to the process */
596 result->csflags |= blob->csb_flags;
597 }
598 }
599
600 if (dlp != 0)
601 ret = load_dylinker(dlp, dlarchbits, map, thread, depth, result, abi64);
602
603 if(depth == 1) {
604 if (result->thread_count == 0) {
605 ret = LOAD_FAILURE;
606 } else if ( abi64 ) {
607 #ifdef __ppc__
608 /* Map in 64-bit commpage */
609 /* LP64todo - make this clean */
610 /*
611 * PPC51: ppc64 is limited to 51-bit addresses.
612 * Memory above that limit is handled specially
613 * at the pmap level.
614 */
615 pmap_map_sharedpage(current_task(), get_map_pmap(map));
616 #endif /* __ppc__ */
617 }
618 }
619 }
620
621 if (kl_addr )
622 kfree(kl_addr, kl_size);
623
624 return(ret);
625 }
626
627 #if CONFIG_CODE_DECRYPTION
628
629 #define APPLE_UNPROTECTED_HEADER_SIZE (3 * PAGE_SIZE_64)
630
631 static load_return_t
632 unprotect_segment_64(
633 uint64_t file_off,
634 uint64_t file_size,
635 vm_map_t map,
636 vm_map_offset_t map_addr,
637 vm_map_size_t map_size)
638 {
639 kern_return_t kr;
640
641 /*
642 * The first APPLE_UNPROTECTED_HEADER_SIZE bytes (from offset 0 of
643 * this part of a Universal binary) are not protected...
644 * The rest needs to be "transformed".
645 */
646 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE &&
647 file_off + file_size <= APPLE_UNPROTECTED_HEADER_SIZE) {
648 /* it's all unprotected, nothing to do... */
649 kr = KERN_SUCCESS;
650 } else {
651 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE) {
652 /*
653 * We start mapping in the unprotected area.
654 * Skip the unprotected part...
655 */
656 vm_map_offset_t delta;
657
658 delta = APPLE_UNPROTECTED_HEADER_SIZE;
659 delta -= file_off;
660 map_addr += delta;
661 map_size -= delta;
662 }
663 /* ... transform the rest of the mapping. */
664 struct pager_crypt_info crypt_info;
665 crypt_info.page_decrypt = dsmos_page_transform;
666 crypt_info.crypt_ops = NULL;
667 crypt_info.crypt_end = NULL;
668 kr = vm_map_apple_protected(map,
669 map_addr,
670 map_addr + map_size,
671 &crypt_info);
672 }
673
674 if (kr != KERN_SUCCESS) {
675 return LOAD_FAILURE;
676 }
677 return LOAD_SUCCESS;
678 }
679 #else /* CONFIG_CODE_DECRYPTION */
680 #define unprotect_segment_64(file_off, file_size, map, map_addr, map_size) \
681 LOAD_SUCCESS
682 #endif /* CONFIG_CODE_DECRYPTION */
683
684 static
685 load_return_t
686 load_segment(
687 struct segment_command *scp,
688 void * pager,
689 off_t pager_offset,
690 off_t macho_size,
691 __unused off_t end_of_file,
692 vm_map_t map,
693 load_result_t *result
694 )
695 {
696 kern_return_t ret;
697 vm_offset_t map_addr, map_offset;
698 vm_size_t map_size, seg_size, delta_size;
699 vm_prot_t initprot;
700 vm_prot_t maxprot;
701
702 /*
703 * Make sure what we get from the file is really ours (as specified
704 * by macho_size).
705 */
706 if (scp->fileoff + scp->filesize > macho_size)
707 return (LOAD_BADMACHO);
708 /*
709 * Make sure the segment is page-aligned in the file.
710 */
711 if ((scp->fileoff & PAGE_MASK) != 0)
712 return LOAD_BADMACHO;
713
714 seg_size = round_page(scp->vmsize);
715 if (seg_size == 0)
716 return(KERN_SUCCESS);
717
718 /*
719 * Round sizes to page size.
720 */
721 map_size = round_page(scp->filesize);
722 map_addr = trunc_page(scp->vmaddr);
723
724 #if 0 /* XXX (4596982) this interferes with Rosetta */
725 if (map_addr == 0 &&
726 map_size == 0 &&
727 seg_size != 0 &&
728 (scp->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
729 (scp->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
730 /*
731 * This is a "page zero" segment: it starts at address 0,
732 * is not mapped from the binary file and is not accessible.
733 * User-space should never be able to access that memory, so
734 * make it completely off limits by raising the VM map's
735 * minimum offset.
736 */
737 ret = vm_map_raise_min_offset(map, (vm_map_offset_t) seg_size);
738 if (ret != KERN_SUCCESS) {
739 return LOAD_FAILURE;
740 }
741 return LOAD_SUCCESS;
742 }
743 #endif
744
745 map_offset = pager_offset + scp->fileoff;
746
747 if (map_size > 0) {
748 initprot = (scp->initprot) & VM_PROT_ALL;
749 maxprot = (scp->maxprot) & VM_PROT_ALL;
750 /*
751 * Map a copy of the file into the address space.
752 */
753 ret = vm_map(map,
754 &map_addr, map_size, (vm_offset_t)0,
755 VM_FLAGS_FIXED, pager, map_offset, TRUE,
756 initprot, maxprot,
757 VM_INHERIT_DEFAULT);
758 if (ret != KERN_SUCCESS)
759 return(LOAD_NOSPACE);
760
761 /*
762 * If the file didn't end on a page boundary,
763 * we need to zero the leftover.
764 */
765 delta_size = map_size - scp->filesize;
766 #if FIXME
767 if (delta_size > 0) {
768 vm_offset_t tmp;
769
770 ret = vm_allocate(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE);
771 if (ret != KERN_SUCCESS)
772 return(LOAD_RESOURCE);
773
774 if (copyout(tmp, map_addr + scp->filesize,
775 delta_size)) {
776 (void) vm_deallocate(
777 kernel_map, tmp, delta_size);
778 return(LOAD_FAILURE);
779 }
780
781 (void) vm_deallocate(kernel_map, tmp, delta_size);
782 }
783 #endif /* FIXME */
784 }
785
786 /*
787 * If the virtual size of the segment is greater
788 * than the size from the file, we need to allocate
789 * zero fill memory for the rest.
790 */
791 delta_size = seg_size - map_size;
792 if (delta_size > 0) {
793 vm_offset_t tmp = map_addr + map_size;
794
795 ret = vm_map(map, &tmp, delta_size, 0, VM_FLAGS_FIXED,
796 NULL, 0, FALSE,
797 scp->initprot, scp->maxprot,
798 VM_INHERIT_DEFAULT);
799 if (ret != KERN_SUCCESS)
800 return(LOAD_NOSPACE);
801 }
802
803 if ( (scp->fileoff == 0) && (scp->filesize != 0) )
804 result->mach_header = map_addr;
805
806 if (scp->flags & SG_PROTECTED_VERSION_1) {
807 ret = unprotect_segment_64((uint64_t) scp->fileoff,
808 (uint64_t) scp->filesize,
809 map,
810 (vm_map_offset_t) map_addr,
811 (vm_map_size_t) map_size);
812 } else {
813 ret = LOAD_SUCCESS;
814 }
815
816 return ret;
817 }
818
819 static
820 load_return_t
821 load_segment_64(
822 struct segment_command_64 *scp64,
823 void * pager,
824 off_t pager_offset,
825 off_t macho_size,
826 __unused off_t end_of_file,
827 vm_map_t map,
828 load_result_t *result
829 )
830 {
831 kern_return_t ret;
832 mach_vm_offset_t map_addr, map_offset;
833 mach_vm_size_t map_size, seg_size, delta_size;
834 vm_prot_t initprot;
835 vm_prot_t maxprot;
836
837 /*
838 * Make sure what we get from the file is really ours (as specified
839 * by macho_size).
840 */
841 if (scp64->fileoff + scp64->filesize > (uint64_t)macho_size)
842 return (LOAD_BADMACHO);
843 /*
844 * Make sure the segment is page-aligned in the file.
845 */
846 if ((scp64->fileoff & PAGE_MASK_64) != 0)
847 return LOAD_BADMACHO;
848
849 seg_size = round_page_64(scp64->vmsize);
850 if (seg_size == 0)
851 return(KERN_SUCCESS);
852
853 /*
854 * Round sizes to page size.
855 */
856 map_size = round_page_64(scp64->filesize); /* limited to 32 bits */
857 map_addr = round_page_64(scp64->vmaddr);
858
859 if (map_addr == 0 &&
860 map_size == 0 &&
861 seg_size != 0 &&
862 (scp64->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
863 (scp64->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
864 /*
865 * This is a "page zero" segment: it starts at address 0,
866 * is not mapped from the binary file and is not accessible.
867 * User-space should never be able to access that memory, so
868 * make it completely off limits by raising the VM map's
869 * minimum offset.
870 */
871 ret = vm_map_raise_min_offset(map, seg_size);
872 if (ret != KERN_SUCCESS) {
873 return LOAD_FAILURE;
874 }
875 return LOAD_SUCCESS;
876 }
877
878 map_offset = pager_offset + scp64->fileoff; /* limited to 32 bits */
879
880 if (map_size > 0) {
881 initprot = (scp64->initprot) & VM_PROT_ALL;
882 maxprot = (scp64->maxprot) & VM_PROT_ALL;
883 /*
884 * Map a copy of the file into the address space.
885 */
886 ret = mach_vm_map(map,
887 &map_addr, map_size, (mach_vm_offset_t)0,
888 VM_FLAGS_FIXED, pager, map_offset, TRUE,
889 initprot, maxprot,
890 VM_INHERIT_DEFAULT);
891 if (ret != KERN_SUCCESS)
892 return(LOAD_NOSPACE);
893
894 /*
895 * If the file didn't end on a page boundary,
896 * we need to zero the leftover.
897 */
898 delta_size = map_size - scp64->filesize;
899 #if FIXME
900 if (delta_size > 0) {
901 mach_vm_offset_t tmp;
902
903 ret = vm_allocate(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE);
904 if (ret != KERN_SUCCESS)
905 return(LOAD_RESOURCE);
906
907 if (copyout(tmp, map_addr + scp64->filesize,
908 delta_size)) {
909 (void) vm_deallocate(
910 kernel_map, tmp, delta_size);
911 return (LOAD_FAILURE);
912 }
913
914 (void) vm_deallocate(kernel_map, tmp, delta_size);
915 }
916 #endif /* FIXME */
917 }
918
919 /*
920 * If the virtual size of the segment is greater
921 * than the size from the file, we need to allocate
922 * zero fill memory for the rest.
923 */
924 delta_size = seg_size - map_size;
925 if (delta_size > 0) {
926 mach_vm_offset_t tmp = map_addr + map_size;
927
928 ret = mach_vm_map(map, &tmp, delta_size, 0, VM_FLAGS_FIXED,
929 NULL, 0, FALSE,
930 scp64->initprot, scp64->maxprot,
931 VM_INHERIT_DEFAULT);
932 if (ret != KERN_SUCCESS)
933 return(LOAD_NOSPACE);
934 }
935
936 if ( (scp64->fileoff == 0) && (scp64->filesize != 0) )
937 result->mach_header = map_addr;
938
939 if (scp64->flags & SG_PROTECTED_VERSION_1) {
940 ret = unprotect_segment_64(scp64->fileoff,
941 scp64->filesize,
942 map,
943 map_addr,
944 map_size);
945 } else {
946 ret = LOAD_SUCCESS;
947 }
948
949 return ret;
950 }
951
952 static
953 load_return_t
954 load_thread(
955 struct thread_command *tcp,
956 thread_t thread,
957 load_result_t *result
958 )
959 {
960 kern_return_t kret;
961 load_return_t lret;
962 task_t task;
963 int customstack=0;
964
965 task = get_threadtask(thread);
966
967 /* if count is 0; same as thread */
968 if (result->thread_count != 0) {
969 kret = thread_create(task, &thread);
970 if (kret != KERN_SUCCESS)
971 return(LOAD_RESOURCE);
972 thread_deallocate(thread);
973 }
974
975 lret = load_threadstate(thread,
976 (unsigned long *)(((vm_offset_t)tcp) +
977 sizeof(struct thread_command)),
978 tcp->cmdsize - sizeof(struct thread_command));
979 if (lret != LOAD_SUCCESS)
980 return (lret);
981
982 if (result->thread_count == 0) {
983 lret = load_threadstack(thread,
984 (unsigned long *)(((vm_offset_t)tcp) +
985 sizeof(struct thread_command)),
986 tcp->cmdsize - sizeof(struct thread_command),
987 &result->user_stack,
988 &customstack);
989 if (customstack)
990 result->customstack = 1;
991 else
992 result->customstack = 0;
993
994 if (lret != LOAD_SUCCESS)
995 return(lret);
996
997 lret = load_threadentry(thread,
998 (unsigned long *)(((vm_offset_t)tcp) +
999 sizeof(struct thread_command)),
1000 tcp->cmdsize - sizeof(struct thread_command),
1001 &result->entry_point);
1002 if (lret != LOAD_SUCCESS)
1003 return(lret);
1004 }
1005 /*
1006 * Resume thread now, note that this means that the thread
1007 * commands should appear after all the load commands to
1008 * be sure they don't reference anything not yet mapped.
1009 */
1010 else
1011 thread_resume(thread);
1012
1013 result->thread_count++;
1014
1015 return(LOAD_SUCCESS);
1016 }
1017
1018 static
1019 load_return_t
1020 load_unixthread(
1021 struct thread_command *tcp,
1022 thread_t thread,
1023 load_result_t *result
1024 )
1025 {
1026 load_return_t ret;
1027 int customstack =0;
1028
1029 if (result->thread_count != 0) {
1030 printf("load_unixthread: already have a thread!");
1031 return (LOAD_FAILURE);
1032 }
1033
1034 ret = load_threadstack(thread,
1035 (unsigned long *)(((vm_offset_t)tcp) +
1036 sizeof(struct thread_command)),
1037 tcp->cmdsize - sizeof(struct thread_command),
1038 &result->user_stack,
1039 &customstack);
1040 if (ret != LOAD_SUCCESS)
1041 return(ret);
1042
1043 if (customstack)
1044 result->customstack = 1;
1045 else
1046 result->customstack = 0;
1047 ret = load_threadentry(thread,
1048 (unsigned long *)(((vm_offset_t)tcp) +
1049 sizeof(struct thread_command)),
1050 tcp->cmdsize - sizeof(struct thread_command),
1051 &result->entry_point);
1052 if (ret != LOAD_SUCCESS)
1053 return(ret);
1054
1055 ret = load_threadstate(thread,
1056 (unsigned long *)(((vm_offset_t)tcp) +
1057 sizeof(struct thread_command)),
1058 tcp->cmdsize - sizeof(struct thread_command));
1059 if (ret != LOAD_SUCCESS)
1060 return (ret);
1061
1062 result->unixproc = TRUE;
1063 result->thread_count++;
1064
1065 return(LOAD_SUCCESS);
1066 }
1067
1068 static
1069 load_return_t
1070 load_threadstate(
1071 thread_t thread,
1072 unsigned long *ts,
1073 unsigned long total_size
1074 )
1075 {
1076 kern_return_t ret;
1077 unsigned long size;
1078 int flavor;
1079 unsigned long thread_size;
1080
1081 ret = thread_state_initialize( thread );
1082 if (ret != KERN_SUCCESS) {
1083 return(LOAD_FAILURE);
1084 }
1085
1086 /*
1087 * Set the new thread state; iterate through the state flavors in
1088 * the mach-o file.
1089 */
1090 while (total_size > 0) {
1091 flavor = *ts++;
1092 size = *ts++;
1093 thread_size = (size+2)*sizeof(unsigned long);
1094 if (thread_size > total_size)
1095 return(LOAD_BADMACHO);
1096 total_size -= thread_size;
1097 /*
1098 * Third argument is a kernel space pointer; it gets cast
1099 * to the appropriate type in machine_thread_set_state()
1100 * based on the value of flavor.
1101 */
1102 ret = thread_setstatus(thread, flavor, (thread_state_t)ts, size);
1103 if (ret != KERN_SUCCESS) {
1104 return(LOAD_FAILURE);
1105 }
1106 ts += size; /* ts is a (unsigned long *) */
1107 }
1108 return(LOAD_SUCCESS);
1109 }
1110
1111 static
1112 load_return_t
1113 load_threadstack(
1114 thread_t thread,
1115 unsigned long *ts,
1116 unsigned long total_size,
1117 user_addr_t *user_stack,
1118 int *customstack
1119 )
1120 {
1121 kern_return_t ret;
1122 unsigned long size;
1123 int flavor;
1124 unsigned long stack_size;
1125
1126 while (total_size > 0) {
1127 flavor = *ts++;
1128 size = *ts++;
1129 stack_size = (size+2)*sizeof(unsigned long);
1130 if (stack_size > total_size)
1131 return(LOAD_BADMACHO);
1132 total_size -= stack_size;
1133
1134 /*
1135 * Third argument is a kernel space pointer; it gets cast
1136 * to the appropriate type in thread_userstack() based on
1137 * the value of flavor.
1138 */
1139 ret = thread_userstack(thread, flavor, (thread_state_t)ts, size, user_stack, customstack);
1140 if (ret != KERN_SUCCESS) {
1141 return(LOAD_FAILURE);
1142 }
1143 ts += size; /* ts is a (unsigned long *) */
1144 }
1145 return(LOAD_SUCCESS);
1146 }
1147
1148 static
1149 load_return_t
1150 load_threadentry(
1151 thread_t thread,
1152 unsigned long *ts,
1153 unsigned long total_size,
1154 mach_vm_offset_t *entry_point
1155 )
1156 {
1157 kern_return_t ret;
1158 unsigned long size;
1159 int flavor;
1160 unsigned long entry_size;
1161
1162 /*
1163 * Set the thread state.
1164 */
1165 *entry_point = MACH_VM_MIN_ADDRESS;
1166 while (total_size > 0) {
1167 flavor = *ts++;
1168 size = *ts++;
1169 entry_size = (size+2)*sizeof(unsigned long);
1170 if (entry_size > total_size)
1171 return(LOAD_BADMACHO);
1172 total_size -= entry_size;
1173 /*
1174 * Third argument is a kernel space pointer; it gets cast
1175 * to the appropriate type in thread_entrypoint() based on
1176 * the value of flavor.
1177 */
1178 ret = thread_entrypoint(thread, flavor, (thread_state_t)ts, size, entry_point);
1179 if (ret != KERN_SUCCESS) {
1180 return(LOAD_FAILURE);
1181 }
1182 ts += size; /* ts is a (unsigned long *) */
1183 }
1184 return(LOAD_SUCCESS);
1185 }
1186
1187
1188 static
1189 load_return_t
1190 load_dylinker(
1191 struct dylinker_command *lcp,
1192 integer_t archbits,
1193 vm_map_t map,
1194 thread_t thread,
1195 int depth,
1196 load_result_t *result,
1197 boolean_t is_64bit
1198 )
1199 {
1200 char *name;
1201 char *p;
1202 struct vnode *vp = NULLVP; /* set by get_macho_vnode() */
1203 struct mach_header header;
1204 off_t file_offset = 0; /* set by get_macho_vnode() */
1205 off_t macho_size = 0; /* set by get_macho_vnode() */
1206 vm_map_t copy_map;
1207 load_result_t myresult;
1208 kern_return_t ret;
1209 vm_map_copy_t tmp;
1210 mach_vm_offset_t dyl_start, map_addr;
1211 mach_vm_size_t dyl_length;
1212
1213 name = (char *)lcp + lcp->name.offset;
1214 /*
1215 * Check for a proper null terminated string.
1216 */
1217 p = name;
1218 do {
1219 if (p >= (char *)lcp + lcp->cmdsize)
1220 return(LOAD_BADMACHO);
1221 } while (*p++);
1222
1223 ret = get_macho_vnode(name, archbits, &header, &file_offset, &macho_size, &vp);
1224 if (ret)
1225 return (ret);
1226
1227 myresult = load_result_null;
1228
1229 /*
1230 * First try to map dyld in directly. This should work most of
1231 * the time since there shouldn't normally be something already
1232 * mapped to its address.
1233 */
1234
1235 ret = parse_machfile(vp, map, thread, &header, file_offset, macho_size,
1236 depth, &myresult);
1237
1238 /*
1239 * If it turned out something was in the way, then we'll take
1240 * take this longer path to map dyld into a temporary map and
1241 * copy it into destination map at a different address.
1242 */
1243
1244 if (ret == LOAD_NOSPACE) {
1245
1246 /*
1247 * Load the Mach-O.
1248 * Use a temporary map to do the work.
1249 */
1250 copy_map = vm_map_create(pmap_create(vm_map_round_page(macho_size),
1251 is_64bit),
1252 get_map_min(map), get_map_max(map), TRUE);
1253 if (VM_MAP_NULL == copy_map) {
1254 ret = LOAD_RESOURCE;
1255 goto out;
1256 }
1257
1258 myresult = load_result_null;
1259
1260 ret = parse_machfile(vp, copy_map, thread, &header,
1261 file_offset, macho_size,
1262 depth, &myresult);
1263
1264 if (ret) {
1265 vm_map_deallocate(copy_map);
1266 goto out;
1267 }
1268
1269 if (get_map_nentries(copy_map) > 0) {
1270
1271 dyl_start = mach_get_vm_start(copy_map);
1272 dyl_length = mach_get_vm_end(copy_map) - dyl_start;
1273
1274 map_addr = dyl_start;
1275 ret = mach_vm_allocate(map, &map_addr, dyl_length, VM_FLAGS_ANYWHERE);
1276
1277 if (ret != KERN_SUCCESS) {
1278 vm_map_deallocate(copy_map);
1279 ret = LOAD_NOSPACE;
1280 goto out;
1281
1282 }
1283
1284 ret = vm_map_copyin(copy_map,
1285 (vm_map_address_t)dyl_start,
1286 (vm_map_size_t)dyl_length,
1287 TRUE, &tmp);
1288 if (ret != KERN_SUCCESS) {
1289 (void) vm_map_remove(map,
1290 vm_map_trunc_page(map_addr),
1291 vm_map_round_page(map_addr + dyl_length),
1292 VM_MAP_NO_FLAGS);
1293 vm_map_deallocate(copy_map);
1294 goto out;
1295 }
1296
1297 ret = vm_map_copy_overwrite(map,
1298 (vm_map_address_t)map_addr,
1299 tmp, FALSE);
1300 if (ret != KERN_SUCCESS) {
1301 vm_map_copy_discard(tmp);
1302 (void) vm_map_remove(map,
1303 vm_map_trunc_page(map_addr),
1304 vm_map_round_page(map_addr + dyl_length),
1305 VM_MAP_NO_FLAGS);
1306 vm_map_deallocate(copy_map);
1307 goto out;
1308 }
1309
1310 if (map_addr != dyl_start)
1311 myresult.entry_point += (map_addr - dyl_start);
1312 } else {
1313 ret = LOAD_FAILURE;
1314 }
1315
1316 vm_map_deallocate(copy_map);
1317 }
1318
1319 if (ret == LOAD_SUCCESS) {
1320 result->dynlinker = TRUE;
1321 result->entry_point = myresult.entry_point;
1322 }
1323 out:
1324 vnode_put(vp);
1325 return (ret);
1326
1327 }
1328
1329 int
1330 load_code_signature(
1331 struct linkedit_data_command *lcp,
1332 struct vnode *vp,
1333 off_t macho_offset,
1334 off_t macho_size,
1335 cpu_type_t cputype,
1336 load_result_t *result)
1337 {
1338 int ret;
1339 kern_return_t kr;
1340 vm_offset_t addr;
1341 int resid;
1342 struct cs_blob *blob;
1343 int error;
1344 vm_size_t blob_size;
1345
1346 addr = 0;
1347 blob = NULL;
1348
1349 if (lcp->cmdsize != sizeof (struct linkedit_data_command) ||
1350 lcp->dataoff + lcp->datasize > macho_size) {
1351 ret = LOAD_BADMACHO;
1352 goto out;
1353 }
1354
1355 blob = ubc_cs_blob_get(vp, cputype, -1);
1356 if (blob != NULL) {
1357 /* we already have a blob for this vnode and cputype */
1358 if (blob->csb_cpu_type == cputype &&
1359 blob->csb_base_offset == macho_offset &&
1360 blob->csb_mem_size == lcp->datasize) {
1361 /* it matches the blob we want here: we're done */
1362 ret = LOAD_SUCCESS;
1363 } else {
1364 /* the blob has changed for this vnode: fail ! */
1365 ret = LOAD_BADMACHO;
1366 }
1367 goto out;
1368 }
1369
1370 blob_size = lcp->datasize;
1371 kr = ubc_cs_blob_allocate(&addr, &blob_size);
1372 if (kr != KERN_SUCCESS) {
1373 ret = LOAD_NOSPACE;
1374 goto out;
1375 }
1376
1377 resid = 0;
1378 error = vn_rdwr(UIO_READ,
1379 vp,
1380 (caddr_t) addr,
1381 lcp->datasize,
1382 macho_offset + lcp->dataoff,
1383 UIO_SYSSPACE32,
1384 0,
1385 kauth_cred_get(),
1386 &resid,
1387 current_proc());
1388 if (error || resid != 0) {
1389 ret = LOAD_IOERROR;
1390 goto out;
1391 }
1392
1393 if (ubc_cs_blob_add(vp,
1394 cputype,
1395 macho_offset,
1396 addr,
1397 lcp->datasize)) {
1398 ret = LOAD_FAILURE;
1399 goto out;
1400 } else {
1401 /* ubc_cs_blob_add() has consumed "addr" */
1402 addr = 0;
1403 }
1404
1405 blob = ubc_cs_blob_get(vp, cputype, -1);
1406
1407 ret = LOAD_SUCCESS;
1408 out:
1409 if (result && ret == LOAD_SUCCESS) {
1410 result->csflags |= blob->csb_flags;
1411 }
1412 if (addr != 0) {
1413 ubc_cs_blob_deallocate(addr, blob_size);
1414 addr = 0;
1415 }
1416
1417 return ret;
1418 }
1419
1420
1421 #if CONFIG_CODE_DECRYPTION
1422
1423 static load_return_t
1424 set_code_unprotect(
1425 struct encryption_info_command *eip,
1426 caddr_t addr,
1427 vm_map_t map,
1428 struct vnode *vp)
1429 {
1430 int result, len;
1431 char vpath[MAXPATHLEN];
1432 pager_crypt_info_t crypt_info;
1433 const char * cryptname = 0;
1434
1435 size_t offset;
1436 struct segment_command_64 *seg64;
1437 struct segment_command *seg32;
1438 vm_map_offset_t map_offset, map_size;
1439 kern_return_t kr;
1440
1441 switch(eip->cryptid) {
1442 case 0:
1443 /* not encrypted, just an empty load command */
1444 return LOAD_SUCCESS;
1445 case 1:
1446 cryptname="com.apple.unfree";
1447 break;
1448 case 0x10:
1449 /* some random cryptid that you could manually put into
1450 * your binary if you want NULL */
1451 cryptname="com.apple.null";
1452 break;
1453 default:
1454 return LOAD_FAILURE;
1455 }
1456
1457 len = MAXPATHLEN;
1458 result = vn_getpath(vp, vpath, &len);
1459 if(result) return result;
1460
1461 /* set up decrypter first */
1462 if(NULL==text_crypter_create) return LOAD_FAILURE;
1463 kr=text_crypter_create(&crypt_info, cryptname, (void*)vpath);
1464
1465 if(kr) {
1466 printf("set_code_unprotect: unable to find decrypter %s, kr=%d\n",
1467 cryptname, kr);
1468 return LOAD_FAILURE;
1469 }
1470
1471 /* this is terrible, but we have to rescan the load commands to find the
1472 * virtual address of this encrypted stuff. This code is gonna look like
1473 * the dyld source one day... */
1474 struct mach_header *header = (struct mach_header *)addr;
1475 size_t mach_header_sz = sizeof(struct mach_header);
1476 if (header->magic == MH_MAGIC_64 ||
1477 header->magic == MH_CIGAM_64) {
1478 mach_header_sz = sizeof(struct mach_header_64);
1479 }
1480 offset = mach_header_sz;
1481 uint32_t ncmds = header->ncmds;
1482 while (ncmds--) {
1483 /*
1484 * Get a pointer to the command.
1485 */
1486 struct load_command *lcp = (struct load_command *)(addr + offset);
1487 offset += lcp->cmdsize;
1488
1489 switch(lcp->cmd) {
1490 case LC_SEGMENT_64:
1491 seg64 = (struct segment_command_64 *)lcp;
1492 if ((seg64->fileoff <= eip->cryptoff) &&
1493 (seg64->fileoff+seg64->filesize >=
1494 eip->cryptoff+eip->cryptsize)) {
1495 map_offset = seg64->vmaddr + eip->cryptoff - seg64->fileoff;
1496 map_size = eip->cryptsize;
1497 goto remap_now;
1498 }
1499 case LC_SEGMENT:
1500 seg32 = (struct segment_command *)lcp;
1501 if ((seg32->fileoff <= eip->cryptoff) &&
1502 (seg32->fileoff+seg32->filesize >=
1503 eip->cryptoff+eip->cryptsize)) {
1504 map_offset = seg32->vmaddr + eip->cryptoff - seg32->fileoff;
1505 map_size = eip->cryptsize;
1506 goto remap_now;
1507 }
1508 }
1509 }
1510
1511 /* if we get here, did not find anything */
1512 return LOAD_FAILURE;
1513
1514 remap_now:
1515 /* now remap using the decrypter */
1516 kr = vm_map_apple_protected(map, map_offset, map_offset+map_size, &crypt_info);
1517 if(kr) printf("set_code_unprotect(): mapping failed with %x\n", kr);
1518
1519 return LOAD_SUCCESS;
1520 }
1521
1522 #endif
1523
1524 /*
1525 * This routine exists to support the load_dylinker().
1526 *
1527 * This routine has its own, separate, understanding of the FAT file format,
1528 * which is terrifically unfortunate.
1529 */
1530 static
1531 load_return_t
1532 get_macho_vnode(
1533 char *path,
1534 integer_t archbits,
1535 struct mach_header *mach_header,
1536 off_t *file_offset,
1537 off_t *macho_size,
1538 struct vnode **vpp
1539 )
1540 {
1541 struct vnode *vp;
1542 vfs_context_t ctx = vfs_context_current();
1543 proc_t p = vfs_context_proc(ctx);
1544 kauth_cred_t kerncred;
1545 struct nameidata nid, *ndp;
1546 boolean_t is_fat;
1547 struct fat_arch fat_arch;
1548 int error = LOAD_SUCCESS;
1549 int resid;
1550 union {
1551 struct mach_header mach_header;
1552 struct fat_header fat_header;
1553 char pad[512];
1554 } header;
1555 off_t fsize = (off_t)0;
1556 int err2;
1557
1558 /*
1559 * Capture the kernel credential for use in the actual read of the
1560 * file, since the user doing the execution may have execute rights
1561 * but not read rights, but to exec something, we have to either map
1562 * or read it into the new process address space, which requires
1563 * read rights. This is to deal with lack of common credential
1564 * serialization code which would treat NOCRED as "serialize 'root'".
1565 */
1566 kerncred = vfs_context_ucred(vfs_context_kernel());
1567
1568 ndp = &nid;
1569
1570 /* init the namei data to point the file user's program name */
1571 NDINIT(ndp, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE32, CAST_USER_ADDR_T(path), ctx);
1572
1573 if ((error = namei(ndp)) != 0) {
1574 if (error == ENOENT) {
1575 error = LOAD_ENOENT;
1576 } else {
1577 error = LOAD_FAILURE;
1578 }
1579 return(error);
1580 }
1581 nameidone(ndp);
1582 vp = ndp->ni_vp;
1583
1584 /* check for regular file */
1585 if (vp->v_type != VREG) {
1586 error = LOAD_PROTECT;
1587 goto bad1;
1588 }
1589
1590 /* get size */
1591 if ((error = vnode_size(vp, &fsize, ctx)) != 0) {
1592 error = LOAD_FAILURE;
1593 goto bad1;
1594 }
1595
1596 /* Check mount point */
1597 if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
1598 error = LOAD_PROTECT;
1599 goto bad1;
1600 }
1601
1602 /* check access */
1603 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_EXECUTE, ctx)) != 0) {
1604 error = LOAD_PROTECT;
1605 goto bad1;
1606 }
1607
1608 /* try to open it */
1609 if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
1610 error = LOAD_PROTECT;
1611 goto bad1;
1612 }
1613
1614 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&header, sizeof(header), 0,
1615 UIO_SYSSPACE32, IO_NODELOCKED, kerncred, &resid, p)) != 0) {
1616 error = LOAD_IOERROR;
1617 goto bad2;
1618 }
1619
1620 if (header.mach_header.magic == MH_MAGIC ||
1621 header.mach_header.magic == MH_MAGIC_64)
1622 is_fat = FALSE;
1623 else if (header.fat_header.magic == FAT_MAGIC ||
1624 header.fat_header.magic == FAT_CIGAM)
1625 is_fat = TRUE;
1626 else {
1627 error = LOAD_BADMACHO;
1628 goto bad2;
1629 }
1630
1631 if (is_fat) {
1632 /* Look up our architecture in the fat file. */
1633 error = fatfile_getarch_with_bits(vp, archbits, (vm_offset_t)(&header.fat_header), &fat_arch);
1634 if (error != LOAD_SUCCESS)
1635 goto bad2;
1636
1637 /* Read the Mach-O header out of it */
1638 error = vn_rdwr(UIO_READ, vp, (caddr_t)&header.mach_header,
1639 sizeof(header.mach_header), fat_arch.offset,
1640 UIO_SYSSPACE32, IO_NODELOCKED, kerncred, &resid, p);
1641 if (error) {
1642 error = LOAD_IOERROR;
1643 goto bad2;
1644 }
1645
1646 /* Is this really a Mach-O? */
1647 if (header.mach_header.magic != MH_MAGIC &&
1648 header.mach_header.magic != MH_MAGIC_64) {
1649 error = LOAD_BADMACHO;
1650 goto bad2;
1651 }
1652
1653 *file_offset = fat_arch.offset;
1654 *macho_size = fat_arch.size;
1655 } else {
1656 /*
1657 * Force get_macho_vnode() to fail if the architecture bits
1658 * do not match the expected architecture bits. This in
1659 * turn causes load_dylinker() to fail for the same reason,
1660 * so it ensures the dynamic linker and the binary are in
1661 * lock-step. This is potentially bad, if we ever add to
1662 * the CPU_ARCH_* bits any bits that are desirable but not
1663 * required, since the dynamic linker might work, but we will
1664 * refuse to load it because of this check.
1665 */
1666 if ((cpu_type_t)(header.mach_header.cputype & CPU_ARCH_MASK) != archbits)
1667 return(LOAD_BADARCH);
1668
1669 *file_offset = 0;
1670 *macho_size = fsize;
1671 }
1672
1673 *mach_header = header.mach_header;
1674 *vpp = vp;
1675
1676 ubc_setsize(vp, fsize);
1677
1678 return (error);
1679
1680 bad2:
1681 err2 = VNOP_CLOSE(vp, FREAD, ctx);
1682 vnode_put(vp);
1683 return (error);
1684
1685 bad1:
1686 vnode_put(vp);
1687 return(error);
1688 }
mirror of XNU