]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/mach_loader.c
projects / apple / xnu.git / blob
? search:


225550f2a11fcd185bf8481da02473f91033cfb7
[apple/xnu.git] / bsd / kern / mach_loader.c
1 /*
2 * Copyright (c) 2000-2010 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (C) 1988, 1989, NeXT, Inc.
30 *
31 * File: kern/mach_loader.c
32 * Author: Avadis Tevanian, Jr.
33 *
34 * Mach object file loader (kernel version, for now).
35 *
36 * 21-Jul-88 Avadis Tevanian, Jr. (avie) at NeXT
37 * Started.
38 */
39
40 #include <sys/param.h>
41 #include <sys/vnode_internal.h>
42 #include <sys/uio.h>
43 #include <sys/namei.h>
44 #include <sys/proc_internal.h>
45 #include <sys/kauth.h>
46 #include <sys/stat.h>
47 #include <sys/malloc.h>
48 #include <sys/mount_internal.h>
49 #include <sys/fcntl.h>
50 #include <sys/ubc_internal.h>
51 #include <sys/imgact.h>
52 #include <sys/codesign.h>
53 #include <sys/proc_uuid_policy.h>
54 #include <sys/reason.h>
55 #include <sys/kdebug.h>
56
57 #include <mach/mach_types.h>
58 #include <mach/vm_map.h> /* vm_allocate() */
59 #include <mach/mach_vm.h> /* mach_vm_allocate() */
60 #include <mach/vm_statistics.h>
61 #include <mach/task.h>
62 #include <mach/thread_act.h>
63
64 #include <machine/vmparam.h>
65 #include <machine/exec.h>
66 #include <machine/pal_routines.h>
67
68 #include <kern/kern_types.h>
69 #include <kern/cpu_number.h>
70 #include <kern/mach_loader.h>
71 #include <kern/mach_fat.h>
72 #include <kern/kalloc.h>
73 #include <kern/task.h>
74 #include <kern/thread.h>
75 #include <kern/page_decrypt.h>
76
77 #include <mach-o/fat.h>
78 #include <mach-o/loader.h>
79
80 #include <vm/pmap.h>
81 #include <vm/vm_map.h>
82 #include <vm/vm_kern.h>
83 #include <vm/vm_pager.h>
84 #include <vm/vnode_pager.h>
85 #include <vm/vm_protos.h>
86 #include <IOKit/IOReturn.h> /* for kIOReturnNotPrivileged */
87
88 #include <os/overflow.h>
89
90 /*
91 * XXX vm/pmap.h should not treat these prototypes as MACH_KERNEL_PRIVATE
92 * when KERNEL is defined.
93 */
94 extern pmap_t pmap_create(ledger_t ledger, vm_map_size_t size,
95 boolean_t is_64bit);
96
97 /* XXX should have prototypes in a shared header file */
98 extern int get_map_nentries(vm_map_t);
99
100 extern kern_return_t memory_object_signed(memory_object_control_t control,
101 boolean_t is_signed);
102
103 /* An empty load_result_t */
104 static const load_result_t load_result_null = {
105 .mach_header = MACH_VM_MIN_ADDRESS,
106 .entry_point = MACH_VM_MIN_ADDRESS,
107 .user_stack = MACH_VM_MIN_ADDRESS,
108 .user_stack_size = 0,
109 .user_stack_alloc = MACH_VM_MIN_ADDRESS,
110 .user_stack_alloc_size = 0,
111 .all_image_info_addr = MACH_VM_MIN_ADDRESS,
112 .all_image_info_size = 0,
113 .thread_count = 0,
114 .unixproc = 0,
115 .dynlinker = 0,
116 .needs_dynlinker = 0,
117 .validentry = 0,
118 .using_lcmain = 0,
119 .is64bit = 0,
120 .csflags = 0,
121 .has_pagezero = 0,
122 .uuid = { 0 },
123 .min_vm_addr = MACH_VM_MAX_ADDRESS,
124 .max_vm_addr = MACH_VM_MIN_ADDRESS,
125 .cs_end_offset = 0,
126 .threadstate = NULL,
127 .threadstate_sz = 0
128 };
129
130 /*
131 * Prototypes of static functions.
132 */
133 static load_return_t
134 parse_machfile(
135 struct vnode *vp,
136 vm_map_t map,
137 thread_t thread,
138 struct mach_header *header,
139 off_t file_offset,
140 off_t macho_size,
141 int depth,
142 int64_t slide,
143 int64_t dyld_slide,
144 load_result_t *result,
145 load_result_t *binresult,
146 struct image_params *imgp
147 );
148
149 static load_return_t
150 load_segment(
151 struct load_command *lcp,
152 uint32_t filetype,
153 void *control,
154 off_t pager_offset,
155 off_t macho_size,
156 struct vnode *vp,
157 vm_map_t map,
158 int64_t slide,
159 load_result_t *result
160 );
161
162 static load_return_t
163 load_uuid(
164 struct uuid_command *uulp,
165 char *command_end,
166 load_result_t *result
167 );
168
169 static load_return_t
170 load_code_signature(
171 struct linkedit_data_command *lcp,
172 struct vnode *vp,
173 off_t macho_offset,
174 off_t macho_size,
175 cpu_type_t cputype,
176 load_result_t *result,
177 struct image_params *imgp);
178
179 #if CONFIG_CODE_DECRYPTION
180 static load_return_t
181 set_code_unprotect(
182 struct encryption_info_command *lcp,
183 caddr_t addr,
184 vm_map_t map,
185 int64_t slide,
186 struct vnode *vp,
187 off_t macho_offset,
188 cpu_type_t cputype,
189 cpu_subtype_t cpusubtype);
190 #endif
191
192 static
193 load_return_t
194 load_main(
195 struct entry_point_command *epc,
196 thread_t thread,
197 int64_t slide,
198 load_result_t *result
199 );
200
201 static load_return_t
202 load_unixthread(
203 struct thread_command *tcp,
204 thread_t thread,
205 int64_t slide,
206 load_result_t *result
207 );
208
209 static load_return_t
210 load_threadstate(
211 thread_t thread,
212 uint32_t *ts,
213 uint32_t total_size,
214 load_result_t *
215 );
216
217 static load_return_t
218 load_threadstack(
219 thread_t thread,
220 uint32_t *ts,
221 uint32_t total_size,
222 mach_vm_offset_t *user_stack,
223 int *customstack,
224 load_result_t *result
225 );
226
227 static load_return_t
228 load_threadentry(
229 thread_t thread,
230 uint32_t *ts,
231 uint32_t total_size,
232 mach_vm_offset_t *entry_point
233 );
234
235 static load_return_t
236 load_dylinker(
237 struct dylinker_command *lcp,
238 integer_t archbits,
239 vm_map_t map,
240 thread_t thread,
241 int depth,
242 int64_t slide,
243 load_result_t *result,
244 struct image_params *imgp
245 );
246
247 struct macho_data;
248
249 static load_return_t
250 get_macho_vnode(
251 char *path,
252 integer_t archbits,
253 struct mach_header *mach_header,
254 off_t *file_offset,
255 off_t *macho_size,
256 struct macho_data *macho_data,
257 struct vnode **vpp
258 );
259
260 static inline void
261 widen_segment_command(const struct segment_command *scp32,
262 struct segment_command_64 *scp)
263 {
264 scp->cmd = scp32->cmd;
265 scp->cmdsize = scp32->cmdsize;
266 bcopy(scp32->segname, scp->segname, sizeof(scp->segname));
267 scp->vmaddr = scp32->vmaddr;
268 scp->vmsize = scp32->vmsize;
269 scp->fileoff = scp32->fileoff;
270 scp->filesize = scp32->filesize;
271 scp->maxprot = scp32->maxprot;
272 scp->initprot = scp32->initprot;
273 scp->nsects = scp32->nsects;
274 scp->flags = scp32->flags;
275 }
276
277 static void
278 note_all_image_info_section(const struct segment_command_64 *scp,
279 boolean_t is64, size_t section_size, const void *sections,
280 int64_t slide, load_result_t *result)
281 {
282 const union {
283 struct section s32;
284 struct section_64 s64;
285 } *sectionp;
286 unsigned int i;
287
288 if (strncmp(scp->segname, "__DATA", sizeof(scp->segname)) != 0)
289 return;
290 for (i = 0; i < scp->nsects; ++i) {
291 sectionp = (const void *)
292 ((const char *)sections + section_size * i);
293 if (0 == strncmp(sectionp->s64.sectname, "__all_image_info",
294 sizeof(sectionp->s64.sectname))) {
295 result->all_image_info_addr =
296 is64 ? sectionp->s64.addr : sectionp->s32.addr;
297 result->all_image_info_addr += slide;
298 result->all_image_info_size =
299 is64 ? sectionp->s64.size : sectionp->s32.size;
300 return;
301 }
302 }
303 }
304
305
306 load_return_t
307 load_machfile(
308 struct image_params *imgp,
309 struct mach_header *header,
310 thread_t thread,
311 vm_map_t *mapp,
312 load_result_t *result
313 )
314 {
315 struct vnode *vp = imgp->ip_vp;
316 off_t file_offset = imgp->ip_arch_offset;
317 off_t macho_size = imgp->ip_arch_size;
318 off_t file_size = imgp->ip_vattr->va_data_size;
319 vm_map_t new_map = *mapp;
320 pmap_t pmap = 0; /* protected by create_map */
321 vm_map_t map;
322 load_result_t myresult;
323 load_return_t lret;
324 boolean_t create_map = FALSE;
325 boolean_t enforce_hard_pagezero = TRUE;
326 int spawn = (imgp->ip_flags & IMGPF_SPAWN);
327 task_t task = current_task();
328 proc_t p = current_proc();
329 mach_vm_offset_t aslr_offset = 0;
330 mach_vm_offset_t dyld_aslr_offset = 0;
331 kern_return_t kret;
332
333 if (macho_size > file_size) {
334 return(LOAD_BADMACHO);
335 }
336
337 if (new_map == VM_MAP_NULL) {
338 create_map = TRUE;
339 }
340
341 result->is64bit = ((imgp->ip_flags & IMGPF_IS_64BIT) == IMGPF_IS_64BIT);
342
343 /*
344 * If we are spawning, we have created backing objects for the process
345 * already, which include non-lazily creating the task map. So we
346 * are going to switch out the task map with one appropriate for the
347 * bitness of the image being loaded.
348 */
349 if (spawn) {
350 create_map = TRUE;
351 }
352
353 if (create_map) {
354 task_t ledger_task;
355 if (imgp->ip_new_thread) {
356 ledger_task = get_threadtask(imgp->ip_new_thread);
357 } else {
358 ledger_task = task;
359 }
360 pmap = pmap_create(get_task_ledger(ledger_task),
361 (vm_map_size_t) 0,
362 result->is64bit);
363 map = vm_map_create(pmap,
364 0,
365 vm_compute_max_offset(result->is64bit),
366 TRUE);
367 } else
368 map = new_map;
369
370 #if (__ARM_ARCH_7K__ >= 2) && defined(PLATFORM_WatchOS)
371 /* enforce 16KB alignment for watch targets with new ABI */
372 vm_map_set_page_shift(map, SIXTEENK_PAGE_SHIFT);
373 #endif /* __arm64__ */
374
375 #ifndef CONFIG_ENFORCE_SIGNED_CODE
376 /* This turns off faulting for executable pages, which allows
377 * to circumvent Code Signing Enforcement. The per process
378 * flag (CS_ENFORCEMENT) is not set yet, but we can use the
379 * global flag.
380 */
381 if ( !cs_enforcement(NULL) && (header->flags & MH_ALLOW_STACK_EXECUTION) )
382 vm_map_disable_NX(map);
383 #endif
384
385 /* Forcibly disallow execution from data pages on even if the arch
386 * normally permits it. */
387 if ((header->flags & MH_NO_HEAP_EXECUTION) && !(imgp->ip_flags & IMGPF_ALLOW_DATA_EXEC))
388 vm_map_disallow_data_exec(map);
389
390 /*
391 * Compute a random offset for ASLR, and an independent random offset for dyld.
392 */
393 if (!(imgp->ip_flags & IMGPF_DISABLE_ASLR)) {
394 uint64_t max_slide_pages;
395
396 max_slide_pages = vm_map_get_max_aslr_slide_pages(map);
397
398 aslr_offset = random();
399 aslr_offset %= max_slide_pages;
400 aslr_offset <<= vm_map_page_shift(map);
401
402 dyld_aslr_offset = random();
403 dyld_aslr_offset %= max_slide_pages;
404 dyld_aslr_offset <<= vm_map_page_shift(map);
405 }
406
407 if (!result)
408 result = &myresult;
409
410 *result = load_result_null;
411
412 /*
413 * re-set the bitness on the load result since we cleared the load result above.
414 */
415 result->is64bit = ((imgp->ip_flags & IMGPF_IS_64BIT) == IMGPF_IS_64BIT);
416
417 lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
418 0, (int64_t)aslr_offset, (int64_t)dyld_aslr_offset, result,
419 NULL, imgp);
420
421 if (lret != LOAD_SUCCESS) {
422 if (create_map) {
423 vm_map_deallocate(map); /* will lose pmap reference too */
424 }
425 return(lret);
426 }
427
428 #if __x86_64__
429 /*
430 * On x86, for compatibility, don't enforce the hard page-zero restriction for 32-bit binaries.
431 */
432 if (!result->is64bit) {
433 enforce_hard_pagezero = FALSE;
434 }
435 #endif
436 /*
437 * Check to see if the page zero is enforced by the map->min_offset.
438 */
439 if (enforce_hard_pagezero &&
440 (vm_map_has_hard_pagezero(map, 0x1000) == FALSE)) {
441 {
442 if (create_map) {
443 vm_map_deallocate(map); /* will lose pmap reference too */
444 }
445 return (LOAD_BADMACHO);
446 }
447 }
448
449 vm_commit_pagezero_status(map);
450
451 if (create_map) {
452 /*
453 * If this is an exec, then we are going to destroy the old
454 * task, and it's correct to halt it; if it's spawn, the
455 * task is not yet running, and it makes no sense.
456 */
457 if (!spawn) {
458 /*
459 * Mark the task as halting and start the other
460 * threads towards terminating themselves. Then
461 * make sure any threads waiting for a process
462 * transition get informed that we are committed to
463 * this transition, and then finally complete the
464 * task halting (wait for threads and then cleanup
465 * task resources).
466 *
467 * NOTE: task_start_halt() makes sure that no new
468 * threads are created in the task during the transition.
469 * We need to mark the workqueue as exiting before we
470 * wait for threads to terminate (at the end of which
471 * we no longer have a prohibition on thread creation).
472 *
473 * Finally, clean up any lingering workqueue data structures
474 * that may have been left behind by the workqueue threads
475 * as they exited (and then clean up the work queue itself).
476 */
477 kret = task_start_halt(task);
478 if (kret != KERN_SUCCESS) {
479 vm_map_deallocate(map); /* will lose pmap reference too */
480 return (LOAD_FAILURE);
481 }
482 proc_transcommit(p, 0);
483 workqueue_mark_exiting(p);
484 task_complete_halt(task);
485 workqueue_exit(p);
486 kqueue_dealloc(p->p_wqkqueue);
487 p->p_wqkqueue = NULL;
488 }
489 *mapp = map;
490 }
491 return(LOAD_SUCCESS);
492 }
493
494 int macho_printf = 0;
495 #define MACHO_PRINTF(args) \
496 do { \
497 if (macho_printf) { \
498 printf args; \
499 } \
500 } while (0)
501
502 /*
503 * The file size of a mach-o file is limited to 32 bits; this is because
504 * this is the limit on the kalloc() of enough bytes for a mach_header and
505 * the contents of its sizeofcmds, which is currently constrained to 32
506 * bits in the file format itself. We read into the kernel buffer the
507 * commands section, and then parse it in order to parse the mach-o file
508 * format load_command segment(s). We are only interested in a subset of
509 * the total set of possible commands. If "map"==VM_MAP_NULL or
510 * "thread"==THREAD_NULL, do not make permament VM modifications,
511 * just preflight the parse.
512 */
513 static
514 load_return_t
515 parse_machfile(
516 struct vnode *vp,
517 vm_map_t map,
518 thread_t thread,
519 struct mach_header *header,
520 off_t file_offset,
521 off_t macho_size,
522 int depth,
523 int64_t aslr_offset,
524 int64_t dyld_aslr_offset,
525 load_result_t *result,
526 load_result_t *binresult,
527 struct image_params *imgp
528 )
529 {
530 uint32_t ncmds;
531 struct load_command *lcp;
532 struct dylinker_command *dlp = 0;
533 integer_t dlarchbits = 0;
534 void * control;
535 load_return_t ret = LOAD_SUCCESS;
536 caddr_t addr;
537 void * kl_addr;
538 vm_size_t size,kl_size;
539 size_t offset;
540 size_t oldoffset; /* for overflow check */
541 int pass;
542 proc_t p = current_proc(); /* XXXX */
543 int error;
544 int resid = 0;
545 size_t mach_header_sz = sizeof(struct mach_header);
546 boolean_t abi64;
547 boolean_t got_code_signatures = FALSE;
548 boolean_t found_header_segment = FALSE;
549 boolean_t found_xhdr = FALSE;
550 int64_t slide = 0;
551 boolean_t dyld_no_load_addr = FALSE;
552 boolean_t is_dyld = FALSE;
553 vm_map_offset_t effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
554
555 if (header->magic == MH_MAGIC_64 ||
556 header->magic == MH_CIGAM_64) {
557 mach_header_sz = sizeof(struct mach_header_64);
558 }
559
560 /*
561 * Break infinite recursion
562 */
563 if (depth > 1) {
564 return(LOAD_FAILURE);
565 }
566
567 depth++;
568
569 /*
570 * Check to see if right machine type.
571 */
572 if (((cpu_type_t)(header->cputype & ~CPU_ARCH_MASK) != (cpu_type() & ~CPU_ARCH_MASK)) ||
573 !grade_binary(header->cputype,
574 header->cpusubtype & ~CPU_SUBTYPE_MASK))
575 return(LOAD_BADARCH);
576
577 abi64 = ((header->cputype & CPU_ARCH_ABI64) == CPU_ARCH_ABI64);
578
579 switch (header->filetype) {
580
581 case MH_EXECUTE:
582 if (depth != 1) {
583 return (LOAD_FAILURE);
584 }
585
586 break;
587 case MH_DYLINKER:
588 if (depth != 2) {
589 return (LOAD_FAILURE);
590 }
591 is_dyld = TRUE;
592 break;
593
594 default:
595 return (LOAD_FAILURE);
596 }
597
598 /*
599 * Get the pager for the file.
600 */
601 control = ubc_getobject(vp, UBC_FLAGS_NONE);
602
603 /*
604 * Map portion that must be accessible directly into
605 * kernel's map.
606 */
607 if ((off_t)(mach_header_sz + header->sizeofcmds) > macho_size)
608 return(LOAD_BADMACHO);
609
610 /*
611 * Round size of Mach-O commands up to page boundry.
612 */
613 size = round_page(mach_header_sz + header->sizeofcmds);
614 if (size <= 0)
615 return(LOAD_BADMACHO);
616
617 /*
618 * Map the load commands into kernel memory.
619 */
620 addr = 0;
621 kl_size = size;
622 kl_addr = kalloc(size);
623 addr = (caddr_t)kl_addr;
624 if (addr == NULL)
625 return(LOAD_NOSPACE);
626
627 error = vn_rdwr(UIO_READ, vp, addr, size, file_offset,
628 UIO_SYSSPACE, 0, kauth_cred_get(), &resid, p);
629 if (error) {
630 if (kl_addr)
631 kfree(kl_addr, kl_size);
632 return(LOAD_IOERROR);
633 }
634
635 if (resid) {
636 /* We must be able to read in as much as the mach_header indicated */
637 if (kl_addr)
638 kfree(kl_addr, kl_size);
639 return(LOAD_BADMACHO);
640 }
641
642 /*
643 * For PIE and dyld, slide everything by the ASLR offset.
644 */
645 if ((header->flags & MH_PIE) || is_dyld) {
646 slide = aslr_offset;
647 }
648
649 /*
650 * Scan through the commands, processing each one as necessary.
651 * We parse in three passes through the headers:
652 * 0: determine if TEXT and DATA boundary can be page-aligned
653 * 1: thread state, uuid, code signature
654 * 2: segments
655 * 3: dyld, encryption, check entry point
656 */
657
658 boolean_t slide_realign = FALSE;
659
660 for (pass = 0; pass <= 3; pass++) {
661
662 if (pass == 0 && !slide_realign && !is_dyld) {
663 /* if we dont need to realign the slide or determine dyld's load
664 * address, pass 0 can be skipped */
665 continue;
666 } else if (pass == 1) {
667
668 if (dyld_no_load_addr && binresult) {
669 /*
670 * The dyld Mach-O does not specify a load address. Try to locate
671 * it right after the main binary. If binresult == NULL, load
672 * directly to the given slide.
673 */
674 slide = vm_map_round_page(slide + binresult->max_vm_addr, effective_page_mask);
675 }
676 }
677
678 /*
679 * Check that the entry point is contained in an executable segments
680 */
681 if ((pass == 3) && (!result->using_lcmain && result->validentry == 0)) {
682 thread_state_initialize(thread);
683 ret = LOAD_FAILURE;
684 break;
685 }
686
687 /*
688 * Check that some segment maps the start of the mach-o file, which is
689 * needed by the dynamic loader to read the mach headers, etc.
690 */
691 if ((pass == 3) && (found_header_segment == FALSE)) {
692 ret = LOAD_BADMACHO;
693 break;
694 }
695
696 /*
697 * Loop through each of the load_commands indicated by the
698 * Mach-O header; if an absurd value is provided, we just
699 * run off the end of the reserved section by incrementing
700 * the offset too far, so we are implicitly fail-safe.
701 */
702 offset = mach_header_sz;
703 ncmds = header->ncmds;
704
705 while (ncmds--) {
706 /*
707 * Get a pointer to the command.
708 */
709 lcp = (struct load_command *)(addr + offset);
710 oldoffset = offset;
711 offset += lcp->cmdsize;
712
713 /*
714 * Perform prevalidation of the struct load_command
715 * before we attempt to use its contents. Invalid
716 * values are ones which result in an overflow, or
717 * which can not possibly be valid commands, or which
718 * straddle or exist past the reserved section at the
719 * start of the image.
720 */
721 if (oldoffset > offset ||
722 lcp->cmdsize < sizeof(struct load_command) ||
723 offset > header->sizeofcmds + mach_header_sz) {
724 ret = LOAD_BADMACHO;
725 break;
726 }
727
728 /*
729 * Act on struct load_command's for which kernel
730 * intervention is required.
731 */
732 switch(lcp->cmd) {
733 case LC_SEGMENT: {
734 struct segment_command *scp = (struct segment_command *) lcp;
735
736 if (pass == 0) {
737 if (is_dyld && scp->vmaddr == 0 && scp->fileoff == 0) {
738 dyld_no_load_addr = TRUE;
739 if (!slide_realign) {
740 /* got what we need, bail early on pass 0 */
741 continue;
742 }
743 }
744
745 break;
746 }
747
748 if (pass == 1 && !strncmp(scp->segname, "__XHDR", sizeof(scp->segname))) {
749 found_xhdr = TRUE;
750 }
751
752 if (pass != 2)
753 break;
754
755 if (abi64) {
756 /*
757 * Having an LC_SEGMENT command for the
758 * wrong ABI is invalid <rdar://problem/11021230>
759 */
760 ret = LOAD_BADMACHO;
761 break;
762 }
763
764 ret = load_segment(lcp,
765 header->filetype,
766 control,
767 file_offset,
768 macho_size,
769 vp,
770 map,
771 slide,
772 result);
773
774 if (ret == LOAD_SUCCESS && scp->fileoff == 0 && scp->filesize > 0) {
775 /* Enforce a single segment mapping offset zero, with R+X
776 * protection. */
777 if (found_header_segment ||
778 ((scp->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) != (VM_PROT_READ|VM_PROT_EXECUTE))) {
779 ret = LOAD_BADMACHO;
780 break;
781 }
782 found_header_segment = TRUE;
783 }
784
785 break;
786 }
787 case LC_SEGMENT_64: {
788 struct segment_command_64 *scp64 = (struct segment_command_64 *) lcp;
789
790 if (pass == 0) {
791 if (is_dyld && scp64->vmaddr == 0 && scp64->fileoff == 0) {
792 dyld_no_load_addr = TRUE;
793 if (!slide_realign) {
794 /* got what we need, bail early on pass 0 */
795 continue;
796 }
797 }
798 }
799
800 if (pass == 1 && !strncmp(scp64->segname, "__XHDR", sizeof(scp64->segname))) {
801 found_xhdr = TRUE;
802 }
803
804 if (pass != 2)
805 break;
806
807 if (!abi64) {
808 /*
809 * Having an LC_SEGMENT_64 command for the
810 * wrong ABI is invalid <rdar://problem/11021230>
811 */
812 ret = LOAD_BADMACHO;
813 break;
814 }
815
816 ret = load_segment(lcp,
817 header->filetype,
818 control,
819 file_offset,
820 macho_size,
821 vp,
822 map,
823 slide,
824 result);
825
826 if (ret == LOAD_SUCCESS && scp64->fileoff == 0 && scp64->filesize > 0) {
827 /* Enforce a single segment mapping offset zero, with R+X
828 * protection. */
829 if (found_header_segment ||
830 ((scp64->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) != (VM_PROT_READ|VM_PROT_EXECUTE))) {
831 ret = LOAD_BADMACHO;
832 break;
833 }
834 found_header_segment = TRUE;
835 }
836
837 break;
838 }
839 case LC_UNIXTHREAD:
840 if (pass != 1)
841 break;
842 ret = load_unixthread(
843 (struct thread_command *) lcp,
844 thread,
845 slide,
846 result);
847 break;
848 case LC_MAIN:
849 if (pass != 1)
850 break;
851 if (depth != 1)
852 break;
853 ret = load_main(
854 (struct entry_point_command *) lcp,
855 thread,
856 slide,
857 result);
858 break;
859 case LC_LOAD_DYLINKER:
860 if (pass != 3)
861 break;
862 if ((depth == 1) && (dlp == 0)) {
863 dlp = (struct dylinker_command *)lcp;
864 dlarchbits = (header->cputype & CPU_ARCH_MASK);
865 } else {
866 ret = LOAD_FAILURE;
867 }
868 break;
869 case LC_UUID:
870 if (pass == 1 && depth == 1) {
871 ret = load_uuid((struct uuid_command *) lcp,
872 (char *)addr + mach_header_sz + header->sizeofcmds,
873 result);
874 }
875 break;
876 case LC_CODE_SIGNATURE:
877 /* CODE SIGNING */
878 if (pass != 1)
879 break;
880 /* pager -> uip ->
881 load signatures & store in uip
882 set VM object "signed_pages"
883 */
884 ret = load_code_signature(
885 (struct linkedit_data_command *) lcp,
886 vp,
887 file_offset,
888 macho_size,
889 header->cputype,
890 result,
891 imgp);
892 if (ret != LOAD_SUCCESS) {
893 printf("proc %d: load code signature error %d "
894 "for file \"%s\"\n",
895 p->p_pid, ret, vp->v_name);
896 /*
897 * Allow injections to be ignored on devices w/o enforcement enabled
898 */
899 if (!cs_enforcement(NULL))
900 ret = LOAD_SUCCESS; /* ignore error */
901
902 } else {
903 got_code_signatures = TRUE;
904 }
905
906 if (got_code_signatures) {
907 unsigned tainted = CS_VALIDATE_TAINTED;
908 boolean_t valid = FALSE;
909 vm_size_t off = 0;
910
911
912 if (cs_debug > 10)
913 printf("validating initial pages of %s\n", vp->v_name);
914
915 while (off < size && ret == LOAD_SUCCESS) {
916 tainted = CS_VALIDATE_TAINTED;
917
918 valid = cs_validate_range(vp,
919 NULL,
920 file_offset + off,
921 addr + off,
922 PAGE_SIZE,
923 &tainted);
924 if (!valid || (tainted & CS_VALIDATE_TAINTED)) {
925 if (cs_debug)
926 printf("CODE SIGNING: %s[%d]: invalid initial page at offset %lld validated:%d tainted:%d csflags:0x%x\n",
927 vp->v_name, p->p_pid, (long long)(file_offset + off), valid, tainted, result->csflags);
928 if (cs_enforcement(NULL) ||
929 (result->csflags & (CS_HARD|CS_KILL|CS_ENFORCEMENT))) {
930 ret = LOAD_FAILURE;
931 }
932 result->csflags &= ~CS_VALID;
933 }
934 off += PAGE_SIZE;
935 }
936 }
937
938 break;
939 #if CONFIG_CODE_DECRYPTION
940 case LC_ENCRYPTION_INFO:
941 case LC_ENCRYPTION_INFO_64:
942 if (pass != 3)
943 break;
944 ret = set_code_unprotect(
945 (struct encryption_info_command *) lcp,
946 addr, map, slide, vp, file_offset,
947 header->cputype, header->cpusubtype);
948 if (ret != LOAD_SUCCESS) {
949 os_reason_t load_failure_reason = OS_REASON_NULL;
950 printf("proc %d: set_code_unprotect() error %d "
951 "for file \"%s\"\n",
952 p->p_pid, ret, vp->v_name);
953 /*
954 * Don't let the app run if it's
955 * encrypted but we failed to set up the
956 * decrypter. If the keys are missing it will
957 * return LOAD_DECRYPTFAIL.
958 */
959 if (ret == LOAD_DECRYPTFAIL) {
960 /* failed to load due to missing FP keys */
961 proc_lock(p);
962 p->p_lflag |= P_LTERM_DECRYPTFAIL;
963 proc_unlock(p);
964
965 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
966 p->p_pid, OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT, 0, 0);
967 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT);
968 } else {
969
970 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
971 p->p_pid, OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT, 0, 0);
972 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT);
973 }
974
975 assert(load_failure_reason != OS_REASON_NULL);
976 psignal_with_reason(p, SIGKILL, load_failure_reason);
977 }
978 break;
979 #endif
980 default:
981 /* Other commands are ignored by the kernel */
982 ret = LOAD_SUCCESS;
983 break;
984 }
985 if (ret != LOAD_SUCCESS)
986 break;
987 }
988 if (ret != LOAD_SUCCESS)
989 break;
990 }
991
992 if (ret == LOAD_SUCCESS) {
993 if (! got_code_signatures) {
994 if (cs_enforcement(NULL)) {
995 ret = LOAD_FAILURE;
996 } else {
997 /*
998 * No embedded signatures: look for detached by taskgated,
999 * this is only done on OSX, on embedded platforms we expect everything
1000 * to be have embedded signatures.
1001 */
1002 struct cs_blob *blob;
1003
1004 blob = ubc_cs_blob_get(vp, -1, file_offset);
1005 if (blob != NULL) {
1006 unsigned int cs_flag_data = blob->csb_flags;
1007 if(0 != ubc_cs_generation_check(vp)) {
1008 if (0 != ubc_cs_blob_revalidate(vp, blob, imgp, 0)) {
1009 /* clear out the flag data if revalidation fails */
1010 cs_flag_data = 0;
1011 result->csflags &= ~CS_VALID;
1012 }
1013 }
1014 /* get flags to be applied to the process */
1015 result->csflags |= cs_flag_data;
1016 }
1017 }
1018 }
1019
1020 /* Make sure if we need dyld, we got it */
1021 if (result->needs_dynlinker && !dlp) {
1022 ret = LOAD_FAILURE;
1023 }
1024
1025 if ((ret == LOAD_SUCCESS) && (dlp != 0)) {
1026 /*
1027 * load the dylinker, and slide it by the independent DYLD ASLR
1028 * offset regardless of the PIE-ness of the main binary.
1029 */
1030 ret = load_dylinker(dlp, dlarchbits, map, thread, depth,
1031 dyld_aslr_offset, result, imgp);
1032 }
1033
1034 if ((ret == LOAD_SUCCESS) && (depth == 1)) {
1035 if (result->thread_count == 0) {
1036 ret = LOAD_FAILURE;
1037 }
1038 }
1039 }
1040
1041 if (ret == LOAD_BADMACHO && found_xhdr) {
1042 ret = LOAD_BADMACHO_UPX;
1043 }
1044
1045 if (kl_addr) {
1046 kfree(kl_addr, kl_size);
1047 }
1048
1049 return(ret);
1050 }
1051
1052 #if CONFIG_CODE_DECRYPTION
1053
1054 #define APPLE_UNPROTECTED_HEADER_SIZE (3 * 4096)
1055
1056 static load_return_t
1057 unprotect_dsmos_segment(
1058 uint64_t file_off,
1059 uint64_t file_size,
1060 struct vnode *vp,
1061 off_t macho_offset,
1062 vm_map_t map,
1063 vm_map_offset_t map_addr,
1064 vm_map_size_t map_size)
1065 {
1066 kern_return_t kr;
1067
1068 /*
1069 * The first APPLE_UNPROTECTED_HEADER_SIZE bytes (from offset 0 of
1070 * this part of a Universal binary) are not protected...
1071 * The rest needs to be "transformed".
1072 */
1073 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE &&
1074 file_off + file_size <= APPLE_UNPROTECTED_HEADER_SIZE) {
1075 /* it's all unprotected, nothing to do... */
1076 kr = KERN_SUCCESS;
1077 } else {
1078 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE) {
1079 /*
1080 * We start mapping in the unprotected area.
1081 * Skip the unprotected part...
1082 */
1083 vm_map_offset_t delta;
1084
1085 delta = APPLE_UNPROTECTED_HEADER_SIZE;
1086 delta -= file_off;
1087 map_addr += delta;
1088 map_size -= delta;
1089 }
1090 /* ... transform the rest of the mapping. */
1091 struct pager_crypt_info crypt_info;
1092 crypt_info.page_decrypt = dsmos_page_transform;
1093 crypt_info.crypt_ops = NULL;
1094 crypt_info.crypt_end = NULL;
1095 #pragma unused(vp, macho_offset)
1096 crypt_info.crypt_ops = (void *)0x2e69cf40;
1097 vm_map_offset_t crypto_backing_offset;
1098 crypto_backing_offset = -1; /* i.e. use map entry's offset */
1099 #if VM_MAP_DEBUG_APPLE_PROTECT
1100 if (vm_map_debug_apple_protect) {
1101 struct proc *p;
1102 p = current_proc();
1103 printf("APPLE_PROTECT: %d[%s] map %p "
1104 "[0x%llx:0x%llx] %s(%s)\n",
1105 p->p_pid, p->p_comm, map,
1106 (uint64_t) map_addr,
1107 (uint64_t) (map_addr + map_size),
1108 __FUNCTION__, vp->v_name);
1109 }
1110 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
1111
1112 /* The DSMOS pager can only be used by apple signed code */
1113 struct cs_blob * blob = csvnode_get_blob(vp, file_off);
1114 if( blob == NULL || !blob->csb_platform_binary || blob->csb_platform_path)
1115 {
1116 return LOAD_FAILURE;
1117 }
1118
1119 kr = vm_map_apple_protected(map,
1120 map_addr,
1121 map_addr + map_size,
1122 crypto_backing_offset,
1123 &crypt_info);
1124 }
1125
1126 if (kr != KERN_SUCCESS) {
1127 return LOAD_FAILURE;
1128 }
1129 return LOAD_SUCCESS;
1130 }
1131 #else /* CONFIG_CODE_DECRYPTION */
1132 static load_return_t
1133 unprotect_dsmos_segment(
1134 __unused uint64_t file_off,
1135 __unused uint64_t file_size,
1136 __unused struct vnode *vp,
1137 __unused off_t macho_offset,
1138 __unused vm_map_t map,
1139 __unused vm_map_offset_t map_addr,
1140 __unused vm_map_size_t map_size)
1141 {
1142 return LOAD_SUCCESS;
1143 }
1144 #endif /* CONFIG_CODE_DECRYPTION */
1145
1146
1147 /*
1148 * map_segment:
1149 * Maps a Mach-O segment, taking care of mis-alignment (wrt the system
1150 * page size) issues.
1151 *
1152 * The mapping might result in 1, 2 or 3 map entries:
1153 * 1. for the first page, which could be overlap with the previous
1154 * mapping,
1155 * 2. for the center (if applicable),
1156 * 3. for the last page, which could overlap with the next mapping.
1157 *
1158 * For each of those map entries, we might have to interpose a
1159 * "fourk_pager" to deal with mis-alignment wrt the system page size,
1160 * either in the mapping address and/or size or the file offset and/or
1161 * size.
1162 * The "fourk_pager" itself would be mapped with proper alignment
1163 * wrt the system page size and would then be populated with the
1164 * information about the intended mapping, with a "4KB" granularity.
1165 */
1166 static kern_return_t
1167 map_segment(
1168 vm_map_t map,
1169 vm_map_offset_t vm_start,
1170 vm_map_offset_t vm_end,
1171 memory_object_control_t control,
1172 vm_map_offset_t file_start,
1173 vm_map_offset_t file_end,
1174 vm_prot_t initprot,
1175 vm_prot_t maxprot)
1176 {
1177 int extra_vm_flags, cur_extra_vm_flags;
1178 vm_map_offset_t cur_offset, cur_start, cur_end;
1179 kern_return_t ret;
1180 vm_map_offset_t effective_page_mask;
1181
1182 if (vm_end < vm_start ||
1183 file_end < file_start) {
1184 return LOAD_BADMACHO;
1185 }
1186 if (vm_end == vm_start ||
1187 file_end == file_start) {
1188 /* nothing to map... */
1189 return LOAD_SUCCESS;
1190 }
1191
1192 effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
1193
1194 extra_vm_flags = 0;
1195 if (vm_map_page_aligned(vm_start, effective_page_mask) &&
1196 vm_map_page_aligned(vm_end, effective_page_mask) &&
1197 vm_map_page_aligned(file_start, effective_page_mask) &&
1198 vm_map_page_aligned(file_end, effective_page_mask)) {
1199 /* all page-aligned and map-aligned: proceed */
1200 } else {
1201 panic("map_segment: unexpected mis-alignment "
1202 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx]\n",
1203 (uint64_t) vm_start,
1204 (uint64_t) vm_end,
1205 (uint64_t) file_start,
1206 (uint64_t) file_end);
1207 }
1208
1209 cur_offset = 0;
1210 cur_start = vm_start;
1211 cur_end = vm_start;
1212 if (cur_end >= vm_start + (file_end - file_start)) {
1213 /* all mapped: done */
1214 goto done;
1215 }
1216 if (vm_map_round_page(cur_end, effective_page_mask) >=
1217 vm_map_trunc_page(vm_start + (file_end - file_start),
1218 effective_page_mask)) {
1219 /* no middle */
1220 } else {
1221 cur_start = cur_end;
1222 if ((vm_start & effective_page_mask) !=
1223 (file_start & effective_page_mask)) {
1224 /* one 4K pager for the middle */
1225 cur_extra_vm_flags = extra_vm_flags;
1226 } else {
1227 /* regular mapping for the middle */
1228 cur_extra_vm_flags = 0;
1229 }
1230 cur_end = vm_map_trunc_page(vm_start + (file_end -
1231 file_start),
1232 effective_page_mask);
1233 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1234 ret = vm_map_enter_mem_object_control(
1235 map,
1236 &cur_start,
1237 cur_end - cur_start,
1238 (mach_vm_offset_t)0,
1239 VM_FLAGS_FIXED | cur_extra_vm_flags,
1240 control,
1241 file_start + cur_offset,
1242 TRUE, /* copy */
1243 initprot, maxprot,
1244 VM_INHERIT_DEFAULT);
1245 } else {
1246 ret = vm_map_enter_mem_object(
1247 map,
1248 &cur_start,
1249 cur_end - cur_start,
1250 (mach_vm_offset_t)0,
1251 VM_FLAGS_FIXED | cur_extra_vm_flags,
1252 IPC_PORT_NULL,
1253 0, /* offset */
1254 TRUE, /* copy */
1255 initprot, maxprot,
1256 VM_INHERIT_DEFAULT);
1257 }
1258 if (ret != KERN_SUCCESS) {
1259 return (LOAD_NOSPACE);
1260 }
1261 cur_offset += cur_end - cur_start;
1262 }
1263 if (cur_end >= vm_start + (file_end - file_start)) {
1264 /* all mapped: done */
1265 goto done;
1266 }
1267 cur_start = cur_end;
1268 done:
1269 assert(cur_end >= vm_start + (file_end - file_start));
1270 return LOAD_SUCCESS;
1271 }
1272
1273 static
1274 load_return_t
1275 load_segment(
1276 struct load_command *lcp,
1277 uint32_t filetype,
1278 void * control,
1279 off_t pager_offset,
1280 off_t macho_size,
1281 struct vnode *vp,
1282 vm_map_t map,
1283 int64_t slide,
1284 load_result_t *result)
1285 {
1286 struct segment_command_64 segment_command, *scp;
1287 kern_return_t ret;
1288 vm_map_size_t delta_size;
1289 vm_prot_t initprot;
1290 vm_prot_t maxprot;
1291 size_t segment_command_size, total_section_size,
1292 single_section_size;
1293 vm_map_offset_t file_offset, file_size;
1294 vm_map_offset_t vm_offset, vm_size;
1295 vm_map_offset_t vm_start, vm_end, vm_end_aligned;
1296 vm_map_offset_t file_start, file_end;
1297 kern_return_t kr;
1298 boolean_t verbose;
1299 vm_map_size_t effective_page_size;
1300 vm_map_offset_t effective_page_mask;
1301
1302 effective_page_size = MAX(PAGE_SIZE, vm_map_page_size(map));
1303 effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
1304
1305 verbose = FALSE;
1306 if (LC_SEGMENT_64 == lcp->cmd) {
1307 segment_command_size = sizeof(struct segment_command_64);
1308 single_section_size = sizeof(struct section_64);
1309 } else {
1310 segment_command_size = sizeof(struct segment_command);
1311 single_section_size = sizeof(struct section);
1312 }
1313 if (lcp->cmdsize < segment_command_size)
1314 return (LOAD_BADMACHO);
1315 total_section_size = lcp->cmdsize - segment_command_size;
1316
1317 if (LC_SEGMENT_64 == lcp->cmd) {
1318 scp = (struct segment_command_64 *)lcp;
1319 } else {
1320 scp = &segment_command;
1321 widen_segment_command((struct segment_command *)lcp, scp);
1322 }
1323
1324 if (verbose) {
1325 MACHO_PRINTF(("+++ load_segment %s "
1326 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx] "
1327 "prot %d/%d flags 0x%x\n",
1328 scp->segname,
1329 (uint64_t)(slide + scp->vmaddr),
1330 (uint64_t)(slide + scp->vmaddr + scp->vmsize),
1331 pager_offset + scp->fileoff,
1332 pager_offset + scp->fileoff + scp->filesize,
1333 scp->initprot,
1334 scp->maxprot,
1335 scp->flags));
1336 }
1337
1338 /*
1339 * Make sure what we get from the file is really ours (as specified
1340 * by macho_size).
1341 */
1342 if (scp->fileoff + scp->filesize < scp->fileoff ||
1343 scp->fileoff + scp->filesize > (uint64_t)macho_size) {
1344 return (LOAD_BADMACHO);
1345 }
1346 /*
1347 * Ensure that the number of sections specified would fit
1348 * within the load command size.
1349 */
1350 if (total_section_size / single_section_size < scp->nsects) {
1351 return (LOAD_BADMACHO);
1352 }
1353 /*
1354 * Make sure the segment is page-aligned in the file.
1355 */
1356 file_offset = pager_offset + scp->fileoff; /* limited to 32 bits */
1357 file_size = scp->filesize;
1358 if ((file_offset & PAGE_MASK_64) != 0 ||
1359 /* we can't mmap() it if it's not page-aligned in the file */
1360 (file_offset & vm_map_page_mask(map)) != 0) {
1361 /*
1362 * The 1st test would have failed if the system's page size
1363 * was what this process believe is the page size, so let's
1364 * fail here too for the sake of consistency.
1365 */
1366 return (LOAD_BADMACHO);
1367 }
1368
1369 /*
1370 * If we have a code signature attached for this slice
1371 * require that the segments are within the signed part
1372 * of the file.
1373 */
1374 if (result->cs_end_offset &&
1375 result->cs_end_offset < (off_t)scp->fileoff &&
1376 result->cs_end_offset - scp->fileoff < scp->filesize)
1377 {
1378 if (cs_debug)
1379 printf("section outside code signature\n");
1380 return LOAD_BADMACHO;
1381 }
1382
1383 vm_offset = scp->vmaddr + slide;
1384 vm_size = scp->vmsize;
1385
1386 if (vm_size == 0)
1387 return (LOAD_SUCCESS);
1388 if (scp->vmaddr == 0 &&
1389 file_size == 0 &&
1390 vm_size != 0 &&
1391 (scp->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
1392 (scp->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
1393 /*
1394 * For PIE, extend page zero rather than moving it. Extending
1395 * page zero keeps early allocations from falling predictably
1396 * between the end of page zero and the beginning of the first
1397 * slid segment.
1398 */
1399 /*
1400 * This is a "page zero" segment: it starts at address 0,
1401 * is not mapped from the binary file and is not accessible.
1402 * User-space should never be able to access that memory, so
1403 * make it completely off limits by raising the VM map's
1404 * minimum offset.
1405 */
1406 vm_end = vm_offset + vm_size;
1407 if (vm_end < vm_offset) {
1408 return (LOAD_BADMACHO);
1409 }
1410 if (verbose) {
1411 MACHO_PRINTF(("++++++ load_segment: "
1412 "page_zero up to 0x%llx\n",
1413 (uint64_t) vm_end));
1414 }
1415 {
1416 vm_end = vm_map_round_page(vm_end,
1417 PAGE_MASK_64);
1418 vm_end_aligned = vm_end;
1419 }
1420 ret = vm_map_raise_min_offset(map,
1421 vm_end_aligned);
1422
1423 if (ret != KERN_SUCCESS) {
1424 return (LOAD_FAILURE);
1425 }
1426 return (LOAD_SUCCESS);
1427 } else {
1428 }
1429
1430 {
1431 file_start = vm_map_trunc_page(file_offset,
1432 effective_page_mask);
1433 file_end = vm_map_round_page(file_offset + file_size,
1434 effective_page_mask);
1435 vm_start = vm_map_trunc_page(vm_offset,
1436 effective_page_mask);
1437 vm_end = vm_map_round_page(vm_offset + vm_size,
1438 effective_page_mask);
1439 }
1440
1441 if (vm_start < result->min_vm_addr)
1442 result->min_vm_addr = vm_start;
1443 if (vm_end > result->max_vm_addr)
1444 result->max_vm_addr = vm_end;
1445
1446 if (map == VM_MAP_NULL)
1447 return (LOAD_SUCCESS);
1448
1449 if (vm_size > 0) {
1450 initprot = (scp->initprot) & VM_PROT_ALL;
1451 maxprot = (scp->maxprot) & VM_PROT_ALL;
1452 /*
1453 * Map a copy of the file into the address space.
1454 */
1455 if (verbose) {
1456 MACHO_PRINTF(("++++++ load_segment: "
1457 "mapping at vm [0x%llx:0x%llx] of "
1458 "file [0x%llx:0x%llx]\n",
1459 (uint64_t) vm_start,
1460 (uint64_t) vm_end,
1461 (uint64_t) file_start,
1462 (uint64_t) file_end));
1463 }
1464 ret = map_segment(map,
1465 vm_start,
1466 vm_end,
1467 control,
1468 file_start,
1469 file_end,
1470 initprot,
1471 maxprot);
1472 if (ret) {
1473 return LOAD_NOSPACE;
1474 }
1475
1476 #if FIXME
1477 /*
1478 * If the file didn't end on a page boundary,
1479 * we need to zero the leftover.
1480 */
1481 delta_size = map_size - scp->filesize;
1482 if (delta_size > 0) {
1483 mach_vm_offset_t tmp;
1484
1485 ret = mach_vm_allocate(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE| VM_MAKE_TAG(VM_KERN_MEMORY_BSD));
1486 if (ret != KERN_SUCCESS) {
1487 return(LOAD_RESOURCE);
1488 }
1489
1490 if (copyout(tmp, map_addr + scp->filesize,
1491 delta_size)) {
1492 (void) mach_vm_deallocate(
1493 kernel_map, tmp, delta_size);
1494 return (LOAD_FAILURE);
1495 }
1496
1497 (void) mach_vm_deallocate(kernel_map, tmp, delta_size);
1498 }
1499 #endif /* FIXME */
1500 }
1501
1502 /*
1503 * If the virtual size of the segment is greater
1504 * than the size from the file, we need to allocate
1505 * zero fill memory for the rest.
1506 */
1507 if ((vm_end - vm_start) > (file_end - file_start)) {
1508 delta_size = (vm_end - vm_start) - (file_end - file_start);
1509 } else {
1510 delta_size = 0;
1511 }
1512 if (delta_size > 0) {
1513 mach_vm_offset_t tmp;
1514
1515 tmp = vm_start + (file_end - file_start);
1516 if (verbose) {
1517 MACHO_PRINTF(("++++++ load_segment: "
1518 "delta mapping vm [0x%llx:0x%llx]\n",
1519 (uint64_t) tmp,
1520 (uint64_t) (tmp + delta_size)));
1521 }
1522 kr = map_segment(map,
1523 tmp,
1524 tmp + delta_size,
1525 MEMORY_OBJECT_CONTROL_NULL,
1526 0,
1527 delta_size,
1528 scp->initprot,
1529 scp->maxprot);
1530 if (kr != KERN_SUCCESS) {
1531 return(LOAD_NOSPACE);
1532 }
1533 }
1534
1535 if ( (scp->fileoff == 0) && (scp->filesize != 0) )
1536 result->mach_header = vm_offset;
1537
1538 if (scp->flags & SG_PROTECTED_VERSION_1) {
1539 ret = unprotect_dsmos_segment(file_start,
1540 file_end - file_start,
1541 vp,
1542 pager_offset,
1543 map,
1544 vm_start,
1545 vm_end - vm_start);
1546 if (ret != LOAD_SUCCESS) {
1547 return ret;
1548 }
1549 } else {
1550 ret = LOAD_SUCCESS;
1551 }
1552
1553 if (LOAD_SUCCESS == ret &&
1554 filetype == MH_DYLINKER &&
1555 result->all_image_info_addr == MACH_VM_MIN_ADDRESS) {
1556 note_all_image_info_section(scp,
1557 LC_SEGMENT_64 == lcp->cmd,
1558 single_section_size,
1559 ((const char *)lcp +
1560 segment_command_size),
1561 slide,
1562 result);
1563 }
1564
1565 if (result->entry_point != MACH_VM_MIN_ADDRESS) {
1566 if ((result->entry_point >= vm_offset) && (result->entry_point < (vm_offset + vm_size))) {
1567 if ((scp->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) == (VM_PROT_READ|VM_PROT_EXECUTE)) {
1568 result->validentry = 1;
1569 } else {
1570 /* right range but wrong protections, unset if previously validated */
1571 result->validentry = 0;
1572 }
1573 }
1574 }
1575
1576 return ret;
1577 }
1578
1579 static
1580 load_return_t
1581 load_uuid(
1582 struct uuid_command *uulp,
1583 char *command_end,
1584 load_result_t *result
1585 )
1586 {
1587 /*
1588 * We need to check the following for this command:
1589 * - The command size should be atleast the size of struct uuid_command
1590 * - The UUID part of the command should be completely within the mach-o header
1591 */
1592
1593 if ((uulp->cmdsize < sizeof(struct uuid_command)) ||
1594 (((char *)uulp + sizeof(struct uuid_command)) > command_end)) {
1595 return (LOAD_BADMACHO);
1596 }
1597
1598 memcpy(&result->uuid[0], &uulp->uuid[0], sizeof(result->uuid));
1599 return (LOAD_SUCCESS);
1600 }
1601
1602 static
1603 load_return_t
1604 load_main(
1605 struct entry_point_command *epc,
1606 thread_t thread,
1607 int64_t slide,
1608 load_result_t *result
1609 )
1610 {
1611 mach_vm_offset_t addr;
1612 kern_return_t ret;
1613
1614 if (epc->cmdsize < sizeof(*epc))
1615 return (LOAD_BADMACHO);
1616 if (result->thread_count != 0) {
1617 return (LOAD_FAILURE);
1618 }
1619
1620 if (thread == THREAD_NULL)
1621 return (LOAD_SUCCESS);
1622
1623 /*
1624 * LC_MAIN specifies stack size but not location.
1625 * Add guard page to allocation size (MAXSSIZ includes guard page).
1626 */
1627 if (epc->stacksize) {
1628 if (os_add_overflow(epc->stacksize, 4*PAGE_SIZE, &result->user_stack_size)) {
1629 /*
1630 * We are going to immediately throw away this result, but we want
1631 * to make sure we aren't loading a dangerously close to
1632 * overflowing value, since this will have a guard page added to it
1633 * and be rounded to page boundaries
1634 */
1635 return LOAD_BADMACHO;
1636 }
1637 result->user_stack_size = epc->stacksize;
1638 if (os_add_overflow(epc->stacksize, PAGE_SIZE, &result->user_stack_alloc_size)) {
1639 return LOAD_BADMACHO;
1640 }
1641 } else {
1642 result->user_stack_alloc_size = MAXSSIZ;
1643 }
1644
1645 /* use default location for stack */
1646 ret = thread_userstackdefault(&addr, result->is64bit);
1647 if (ret != KERN_SUCCESS)
1648 return(LOAD_FAILURE);
1649
1650 /* The stack slides down from the default location */
1651 result->user_stack = addr;
1652 result->user_stack -= slide;
1653
1654 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
1655 /* Already processed LC_MAIN or LC_UNIXTHREAD */
1656 return (LOAD_FAILURE);
1657 }
1658
1659 /* kernel does *not* use entryoff from LC_MAIN. Dyld uses it. */
1660 result->needs_dynlinker = TRUE;
1661 result->using_lcmain = TRUE;
1662
1663 ret = thread_state_initialize( thread );
1664 if (ret != KERN_SUCCESS) {
1665 return(LOAD_FAILURE);
1666 }
1667
1668 result->unixproc = TRUE;
1669 result->thread_count++;
1670
1671 return(LOAD_SUCCESS);
1672 }
1673
1674
1675 static
1676 load_return_t
1677 load_unixthread(
1678 struct thread_command *tcp,
1679 thread_t thread,
1680 int64_t slide,
1681 load_result_t *result
1682 )
1683 {
1684 load_return_t ret;
1685 int customstack =0;
1686 mach_vm_offset_t addr;
1687
1688 if (tcp->cmdsize < sizeof(*tcp))
1689 return (LOAD_BADMACHO);
1690 if (result->thread_count != 0) {
1691 return (LOAD_FAILURE);
1692 }
1693
1694 if (thread == THREAD_NULL)
1695 return (LOAD_SUCCESS);
1696
1697 ret = load_threadstack(thread,
1698 (uint32_t *)(((vm_offset_t)tcp) +
1699 sizeof(struct thread_command)),
1700 tcp->cmdsize - sizeof(struct thread_command),
1701 &addr, &customstack, result);
1702 if (ret != LOAD_SUCCESS)
1703 return(ret);
1704
1705 /* LC_UNIXTHREAD optionally specifies stack size and location */
1706
1707 if (!customstack) {
1708 result->user_stack_alloc_size = MAXSSIZ;
1709 }
1710
1711 /* The stack slides down from the default location */
1712 result->user_stack = addr;
1713 result->user_stack -= slide;
1714
1715 ret = load_threadentry(thread,
1716 (uint32_t *)(((vm_offset_t)tcp) +
1717 sizeof(struct thread_command)),
1718 tcp->cmdsize - sizeof(struct thread_command),
1719 &addr);
1720 if (ret != LOAD_SUCCESS)
1721 return(ret);
1722
1723 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
1724 /* Already processed LC_MAIN or LC_UNIXTHREAD */
1725 return (LOAD_FAILURE);
1726 }
1727
1728 result->entry_point = addr;
1729 result->entry_point += slide;
1730
1731 ret = load_threadstate(thread,
1732 (uint32_t *)(((vm_offset_t)tcp) + sizeof(struct thread_command)),
1733 tcp->cmdsize - sizeof(struct thread_command),
1734 result);
1735 if (ret != LOAD_SUCCESS)
1736 return (ret);
1737
1738 result->unixproc = TRUE;
1739 result->thread_count++;
1740
1741 return(LOAD_SUCCESS);
1742 }
1743
1744 static
1745 load_return_t
1746 load_threadstate(
1747 thread_t thread,
1748 uint32_t *ts,
1749 uint32_t total_size,
1750 load_result_t *result
1751 )
1752 {
1753 uint32_t size;
1754 int flavor;
1755 uint32_t thread_size;
1756 uint32_t *local_ts = NULL;
1757 uint32_t local_ts_size = 0;
1758 int ret;
1759
1760 (void)thread;
1761
1762 if (total_size > 0) {
1763 local_ts_size = total_size;
1764 local_ts = kalloc(local_ts_size);
1765 if (local_ts == NULL) {
1766 return LOAD_FAILURE;
1767 }
1768 memcpy(local_ts, ts, local_ts_size);
1769 ts = local_ts;
1770 }
1771
1772 /*
1773 * Validate the new thread state; iterate through the state flavors in
1774 * the Mach-O file.
1775 * XXX: we should validate the machine state here, to avoid failing at
1776 * activation time where we can't bail out cleanly.
1777 */
1778 while (total_size > 0) {
1779 flavor = *ts++;
1780 size = *ts++;
1781
1782 if (os_add_and_mul_overflow(size, 2, sizeof(uint32_t), &thread_size) ||
1783 os_sub_overflow(total_size, thread_size, &total_size)) {
1784 ret = LOAD_BADMACHO;
1785 goto bad;
1786 }
1787
1788 ts += size; /* ts is a (uint32_t *) */
1789 }
1790
1791 result->threadstate = local_ts;
1792 result->threadstate_sz = local_ts_size;
1793 return LOAD_SUCCESS;
1794
1795 bad:
1796 if (local_ts) {
1797 kfree(local_ts, local_ts_size);
1798 }
1799 return ret;
1800 }
1801
1802 static
1803 load_return_t
1804 load_threadstack(
1805 thread_t thread,
1806 uint32_t *ts,
1807 uint32_t total_size,
1808 mach_vm_offset_t *user_stack,
1809 int *customstack,
1810 load_result_t *result
1811 )
1812 {
1813 kern_return_t ret;
1814 uint32_t size;
1815 int flavor;
1816 uint32_t stack_size;
1817
1818 while (total_size > 0) {
1819 flavor = *ts++;
1820 size = *ts++;
1821 if (UINT32_MAX-2 < size ||
1822 UINT32_MAX/sizeof(uint32_t) < size+2)
1823 return (LOAD_BADMACHO);
1824 stack_size = (size+2)*sizeof(uint32_t);
1825 if (stack_size > total_size)
1826 return(LOAD_BADMACHO);
1827 total_size -= stack_size;
1828
1829 /*
1830 * Third argument is a kernel space pointer; it gets cast
1831 * to the appropriate type in thread_userstack() based on
1832 * the value of flavor.
1833 */
1834 ret = thread_userstack(thread, flavor, (thread_state_t)ts, size, user_stack, customstack, result->is64bit);
1835 if (ret != KERN_SUCCESS) {
1836 return(LOAD_FAILURE);
1837 }
1838 ts += size; /* ts is a (uint32_t *) */
1839 }
1840 return(LOAD_SUCCESS);
1841 }
1842
1843 static
1844 load_return_t
1845 load_threadentry(
1846 thread_t thread,
1847 uint32_t *ts,
1848 uint32_t total_size,
1849 mach_vm_offset_t *entry_point
1850 )
1851 {
1852 kern_return_t ret;
1853 uint32_t size;
1854 int flavor;
1855 uint32_t entry_size;
1856
1857 /*
1858 * Set the thread state.
1859 */
1860 *entry_point = MACH_VM_MIN_ADDRESS;
1861 while (total_size > 0) {
1862 flavor = *ts++;
1863 size = *ts++;
1864 if (UINT32_MAX-2 < size ||
1865 UINT32_MAX/sizeof(uint32_t) < size+2)
1866 return (LOAD_BADMACHO);
1867 entry_size = (size+2)*sizeof(uint32_t);
1868 if (entry_size > total_size)
1869 return(LOAD_BADMACHO);
1870 total_size -= entry_size;
1871 /*
1872 * Third argument is a kernel space pointer; it gets cast
1873 * to the appropriate type in thread_entrypoint() based on
1874 * the value of flavor.
1875 */
1876 ret = thread_entrypoint(thread, flavor, (thread_state_t)ts, size, entry_point);
1877 if (ret != KERN_SUCCESS) {
1878 return(LOAD_FAILURE);
1879 }
1880 ts += size; /* ts is a (uint32_t *) */
1881 }
1882 return(LOAD_SUCCESS);
1883 }
1884
1885 struct macho_data {
1886 struct nameidata __nid;
1887 union macho_vnode_header {
1888 struct mach_header mach_header;
1889 struct fat_header fat_header;
1890 char __pad[512];
1891 } __header;
1892 };
1893
1894 #define DEFAULT_DYLD_PATH "/usr/lib/dyld"
1895
1896 #if (DEVELOPMENT || DEBUG)
1897 extern char dyld_alt_path[];
1898 extern int use_alt_dyld;
1899 #endif
1900
1901 static load_return_t
1902 load_dylinker(
1903 struct dylinker_command *lcp,
1904 integer_t archbits,
1905 vm_map_t map,
1906 thread_t thread,
1907 int depth,
1908 int64_t slide,
1909 load_result_t *result,
1910 struct image_params *imgp
1911 )
1912 {
1913 char *name;
1914 char *p;
1915 struct vnode *vp = NULLVP; /* set by get_macho_vnode() */
1916 struct mach_header *header;
1917 off_t file_offset = 0; /* set by get_macho_vnode() */
1918 off_t macho_size = 0; /* set by get_macho_vnode() */
1919 load_result_t *myresult;
1920 kern_return_t ret;
1921 struct macho_data *macho_data;
1922 struct {
1923 struct mach_header __header;
1924 load_result_t __myresult;
1925 struct macho_data __macho_data;
1926 } *dyld_data;
1927
1928 if (lcp->cmdsize < sizeof(*lcp))
1929 return (LOAD_BADMACHO);
1930
1931 name = (char *)lcp + lcp->name.offset;
1932
1933 /*
1934 * Check for a proper null terminated string.
1935 */
1936 p = name;
1937 do {
1938 if (p >= (char *)lcp + lcp->cmdsize)
1939 return(LOAD_BADMACHO);
1940 } while (*p++);
1941
1942 #if (DEVELOPMENT || DEBUG)
1943
1944 /*
1945 * rdar://23680808
1946 * If an alternate dyld has been specified via boot args, check
1947 * to see if PROC_UUID_ALT_DYLD_POLICY has been set on this
1948 * executable and redirect the kernel to load that linker.
1949 */
1950
1951 if (use_alt_dyld) {
1952 int policy_error;
1953 uint32_t policy_flags = 0;
1954 int32_t policy_gencount = 0;
1955
1956 policy_error = proc_uuid_policy_lookup(result->uuid, &policy_flags, &policy_gencount);
1957 if (policy_error == 0) {
1958 if (policy_flags & PROC_UUID_ALT_DYLD_POLICY) {
1959 name = dyld_alt_path;
1960 }
1961 }
1962 }
1963 #endif
1964
1965 #if !(DEVELOPMENT || DEBUG)
1966 if (0 != strcmp(name, DEFAULT_DYLD_PATH)) {
1967 return (LOAD_BADMACHO);
1968 }
1969 #endif
1970
1971 /* Allocate wad-of-data from heap to reduce excessively deep stacks */
1972
1973 MALLOC(dyld_data, void *, sizeof (*dyld_data), M_TEMP, M_WAITOK);
1974 header = &dyld_data->__header;
1975 myresult = &dyld_data->__myresult;
1976 macho_data = &dyld_data->__macho_data;
1977
1978 ret = get_macho_vnode(name, archbits, header,
1979 &file_offset, &macho_size, macho_data, &vp);
1980 if (ret)
1981 goto novp_out;
1982
1983 *myresult = load_result_null;
1984 myresult->is64bit = result->is64bit;
1985
1986 ret = parse_machfile(vp, map, thread, header, file_offset,
1987 macho_size, depth, slide, 0, myresult, result, imgp);
1988
1989 if (ret == LOAD_SUCCESS) {
1990 if (result->threadstate) {
1991 /* don't use the app's threadstate if we have a dyld */
1992 kfree(result->threadstate, result->threadstate_sz);
1993 }
1994 result->threadstate = myresult->threadstate;
1995 result->threadstate_sz = myresult->threadstate_sz;
1996
1997 result->dynlinker = TRUE;
1998 result->entry_point = myresult->entry_point;
1999 result->validentry = myresult->validentry;
2000 result->all_image_info_addr = myresult->all_image_info_addr;
2001 result->all_image_info_size = myresult->all_image_info_size;
2002 if (myresult->platform_binary) {
2003 result->csflags |= CS_DYLD_PLATFORM;
2004 }
2005 }
2006
2007 vnode_put(vp);
2008 novp_out:
2009 FREE(dyld_data, M_TEMP);
2010 return (ret);
2011
2012 }
2013
2014 static load_return_t
2015 load_code_signature(
2016 struct linkedit_data_command *lcp,
2017 struct vnode *vp,
2018 off_t macho_offset,
2019 off_t macho_size,
2020 cpu_type_t cputype,
2021 load_result_t *result,
2022 struct image_params *imgp)
2023 {
2024 int ret;
2025 kern_return_t kr;
2026 vm_offset_t addr;
2027 int resid;
2028 struct cs_blob *blob;
2029 int error;
2030 vm_size_t blob_size;
2031
2032 addr = 0;
2033 blob = NULL;
2034
2035 if (lcp->cmdsize != sizeof (struct linkedit_data_command) ||
2036 lcp->dataoff + lcp->datasize > macho_size) {
2037 ret = LOAD_BADMACHO;
2038 goto out;
2039 }
2040
2041 blob = ubc_cs_blob_get(vp, cputype, macho_offset);
2042 if (blob != NULL) {
2043 /* we already have a blob for this vnode and cputype */
2044 if (blob->csb_cpu_type == cputype &&
2045 blob->csb_base_offset == macho_offset &&
2046 blob->csb_mem_size == lcp->datasize) {
2047 /* it matches the blob we want here, lets verify the version */
2048 if(0 != ubc_cs_generation_check(vp)) {
2049 if (0 != ubc_cs_blob_revalidate(vp, blob, imgp, 0)) {
2050 ret = LOAD_FAILURE; /* set error same as from ubc_cs_blob_add */
2051 goto out;
2052 }
2053 }
2054 ret = LOAD_SUCCESS;
2055 } else {
2056 /* the blob has changed for this vnode: fail ! */
2057 ret = LOAD_BADMACHO;
2058 }
2059 goto out;
2060 }
2061
2062 blob_size = lcp->datasize;
2063 kr = ubc_cs_blob_allocate(&addr, &blob_size);
2064 if (kr != KERN_SUCCESS) {
2065 ret = LOAD_NOSPACE;
2066 goto out;
2067 }
2068
2069 resid = 0;
2070 error = vn_rdwr(UIO_READ,
2071 vp,
2072 (caddr_t) addr,
2073 lcp->datasize,
2074 macho_offset + lcp->dataoff,
2075 UIO_SYSSPACE,
2076 0,
2077 kauth_cred_get(),
2078 &resid,
2079 current_proc());
2080 if (error || resid != 0) {
2081 ret = LOAD_IOERROR;
2082 goto out;
2083 }
2084
2085 if (ubc_cs_blob_add(vp,
2086 cputype,
2087 macho_offset,
2088 &addr,
2089 lcp->datasize,
2090 imgp,
2091 0,
2092 &blob)) {
2093 if (addr) {
2094 ubc_cs_blob_deallocate(addr, blob_size);
2095 }
2096 ret = LOAD_FAILURE;
2097 goto out;
2098 } else {
2099 /* ubc_cs_blob_add() has consumed "addr" */
2100 addr = 0;
2101 }
2102
2103 #if CHECK_CS_VALIDATION_BITMAP
2104 ubc_cs_validation_bitmap_allocate( vp );
2105 #endif
2106
2107 ret = LOAD_SUCCESS;
2108 out:
2109 if (ret == LOAD_SUCCESS) {
2110 if (blob == NULL)
2111 panic("sucess, but no blob!");
2112
2113 result->csflags |= blob->csb_flags;
2114 result->platform_binary = blob->csb_platform_binary;
2115 result->cs_end_offset = blob->csb_end_offset;
2116 }
2117 if (addr != 0) {
2118 ubc_cs_blob_deallocate(addr, blob_size);
2119 addr = 0;
2120 }
2121
2122 return ret;
2123 }
2124
2125
2126 #if CONFIG_CODE_DECRYPTION
2127
2128 static load_return_t
2129 set_code_unprotect(
2130 struct encryption_info_command *eip,
2131 caddr_t addr,
2132 vm_map_t map,
2133 int64_t slide,
2134 struct vnode *vp,
2135 off_t macho_offset,
2136 cpu_type_t cputype,
2137 cpu_subtype_t cpusubtype)
2138 {
2139 int error, len;
2140 pager_crypt_info_t crypt_info;
2141 const char * cryptname = 0;
2142 char *vpath;
2143
2144 size_t offset;
2145 struct segment_command_64 *seg64;
2146 struct segment_command *seg32;
2147 vm_map_offset_t map_offset, map_size;
2148 vm_object_offset_t crypto_backing_offset;
2149 kern_return_t kr;
2150
2151 if (eip->cmdsize < sizeof(*eip)) return LOAD_BADMACHO;
2152
2153 switch(eip->cryptid) {
2154 case 0:
2155 /* not encrypted, just an empty load command */
2156 return LOAD_SUCCESS;
2157 case 1:
2158 cryptname="com.apple.unfree";
2159 break;
2160 case 0x10:
2161 /* some random cryptid that you could manually put into
2162 * your binary if you want NULL */
2163 cryptname="com.apple.null";
2164 break;
2165 default:
2166 return LOAD_BADMACHO;
2167 }
2168
2169 if (map == VM_MAP_NULL) return (LOAD_SUCCESS);
2170 if (NULL == text_crypter_create) return LOAD_FAILURE;
2171
2172 MALLOC_ZONE(vpath, char *, MAXPATHLEN, M_NAMEI, M_WAITOK);
2173 if(vpath == NULL) return LOAD_FAILURE;
2174
2175 len = MAXPATHLEN;
2176 error = vn_getpath(vp, vpath, &len);
2177 if (error) {
2178 FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
2179 return LOAD_FAILURE;
2180 }
2181
2182 /* set up decrypter first */
2183 crypt_file_data_t crypt_data = {
2184 .filename = vpath,
2185 .cputype = cputype,
2186 .cpusubtype = cpusubtype};
2187 kr=text_crypter_create(&crypt_info, cryptname, (void*)&crypt_data);
2188 #if VM_MAP_DEBUG_APPLE_PROTECT
2189 if (vm_map_debug_apple_protect) {
2190 struct proc *p;
2191 p = current_proc();
2192 printf("APPLE_PROTECT: %d[%s] map %p %s(%s) -> 0x%x\n",
2193 p->p_pid, p->p_comm, map, __FUNCTION__, vpath, kr);
2194 }
2195 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
2196 FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
2197
2198 if(kr) {
2199 printf("set_code_unprotect: unable to create decrypter %s, kr=%d\n",
2200 cryptname, kr);
2201 if (kr == kIOReturnNotPrivileged) {
2202 /* text encryption returned decryption failure */
2203 return(LOAD_DECRYPTFAIL);
2204 }else
2205 return LOAD_RESOURCE;
2206 }
2207
2208 /* this is terrible, but we have to rescan the load commands to find the
2209 * virtual address of this encrypted stuff. This code is gonna look like
2210 * the dyld source one day... */
2211 struct mach_header *header = (struct mach_header *)addr;
2212 size_t mach_header_sz = sizeof(struct mach_header);
2213 if (header->magic == MH_MAGIC_64 ||
2214 header->magic == MH_CIGAM_64) {
2215 mach_header_sz = sizeof(struct mach_header_64);
2216 }
2217 offset = mach_header_sz;
2218 uint32_t ncmds = header->ncmds;
2219 while (ncmds--) {
2220 /*
2221 * Get a pointer to the command.
2222 */
2223 struct load_command *lcp = (struct load_command *)(addr + offset);
2224 offset += lcp->cmdsize;
2225
2226 switch(lcp->cmd) {
2227 case LC_SEGMENT_64:
2228 seg64 = (struct segment_command_64 *)lcp;
2229 if ((seg64->fileoff <= eip->cryptoff) &&
2230 (seg64->fileoff+seg64->filesize >=
2231 eip->cryptoff+eip->cryptsize)) {
2232 map_offset = seg64->vmaddr + eip->cryptoff - seg64->fileoff + slide;
2233 map_size = eip->cryptsize;
2234 crypto_backing_offset = macho_offset + eip->cryptoff;
2235 goto remap_now;
2236 }
2237 case LC_SEGMENT:
2238 seg32 = (struct segment_command *)lcp;
2239 if ((seg32->fileoff <= eip->cryptoff) &&
2240 (seg32->fileoff+seg32->filesize >=
2241 eip->cryptoff+eip->cryptsize)) {
2242 map_offset = seg32->vmaddr + eip->cryptoff - seg32->fileoff + slide;
2243 map_size = eip->cryptsize;
2244 crypto_backing_offset = macho_offset + eip->cryptoff;
2245 goto remap_now;
2246 }
2247 }
2248 }
2249
2250 /* if we get here, did not find anything */
2251 return LOAD_BADMACHO;
2252
2253 remap_now:
2254 /* now remap using the decrypter */
2255 MACHO_PRINTF(("+++ set_code_unprotect: vm[0x%llx:0x%llx]\n",
2256 (uint64_t) map_offset,
2257 (uint64_t) (map_offset+map_size)));
2258 kr = vm_map_apple_protected(map,
2259 map_offset,
2260 map_offset+map_size,
2261 crypto_backing_offset,
2262 &crypt_info);
2263 if (kr) {
2264 printf("set_code_unprotect(): mapping failed with %x\n", kr);
2265 return LOAD_PROTECT;
2266 }
2267
2268 return LOAD_SUCCESS;
2269 }
2270
2271 #endif
2272
2273 /*
2274 * This routine exists to support the load_dylinker().
2275 *
2276 * This routine has its own, separate, understanding of the FAT file format,
2277 * which is terrifically unfortunate.
2278 */
2279 static
2280 load_return_t
2281 get_macho_vnode(
2282 char *path,
2283 integer_t archbits,
2284 struct mach_header *mach_header,
2285 off_t *file_offset,
2286 off_t *macho_size,
2287 struct macho_data *data,
2288 struct vnode **vpp
2289 )
2290 {
2291 struct vnode *vp;
2292 vfs_context_t ctx = vfs_context_current();
2293 proc_t p = vfs_context_proc(ctx);
2294 kauth_cred_t kerncred;
2295 struct nameidata *ndp = &data->__nid;
2296 boolean_t is_fat;
2297 struct fat_arch fat_arch;
2298 int error;
2299 int resid;
2300 union macho_vnode_header *header = &data->__header;
2301 off_t fsize = (off_t)0;
2302
2303 /*
2304 * Capture the kernel credential for use in the actual read of the
2305 * file, since the user doing the execution may have execute rights
2306 * but not read rights, but to exec something, we have to either map
2307 * or read it into the new process address space, which requires
2308 * read rights. This is to deal with lack of common credential
2309 * serialization code which would treat NOCRED as "serialize 'root'".
2310 */
2311 kerncred = vfs_context_ucred(vfs_context_kernel());
2312
2313 /* init the namei data to point the file user's program name */
2314 NDINIT(ndp, LOOKUP, OP_OPEN, FOLLOW | LOCKLEAF, UIO_SYSSPACE, CAST_USER_ADDR_T(path), ctx);
2315
2316 if ((error = namei(ndp)) != 0) {
2317 if (error == ENOENT) {
2318 error = LOAD_ENOENT;
2319 } else {
2320 error = LOAD_FAILURE;
2321 }
2322 return(error);
2323 }
2324 nameidone(ndp);
2325 vp = ndp->ni_vp;
2326
2327 /* check for regular file */
2328 if (vp->v_type != VREG) {
2329 error = LOAD_PROTECT;
2330 goto bad1;
2331 }
2332
2333 /* get size */
2334 if ((error = vnode_size(vp, &fsize, ctx)) != 0) {
2335 error = LOAD_FAILURE;
2336 goto bad1;
2337 }
2338
2339 /* Check mount point */
2340 if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
2341 error = LOAD_PROTECT;
2342 goto bad1;
2343 }
2344
2345 /* check access */
2346 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_EXECUTE | KAUTH_VNODE_READ_DATA, ctx)) != 0) {
2347 error = LOAD_PROTECT;
2348 goto bad1;
2349 }
2350
2351 /* try to open it */
2352 if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
2353 error = LOAD_PROTECT;
2354 goto bad1;
2355 }
2356
2357 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)header, sizeof (*header), 0,
2358 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p)) != 0) {
2359 error = LOAD_IOERROR;
2360 goto bad2;
2361 }
2362
2363 if (resid) {
2364 error = LOAD_BADMACHO;
2365 goto bad2;
2366 }
2367
2368 if (header->mach_header.magic == MH_MAGIC ||
2369 header->mach_header.magic == MH_MAGIC_64) {
2370 is_fat = FALSE;
2371 } else if (OSSwapBigToHostInt32(header->fat_header.magic) == FAT_MAGIC) {
2372 is_fat = TRUE;
2373 } else {
2374 error = LOAD_BADMACHO;
2375 goto bad2;
2376 }
2377
2378 if (is_fat) {
2379
2380 error = fatfile_validate_fatarches((vm_offset_t)(&header->fat_header),
2381 sizeof(*header));
2382 if (error != LOAD_SUCCESS) {
2383 goto bad2;
2384 }
2385
2386 /* Look up our architecture in the fat file. */
2387 error = fatfile_getarch_with_bits(archbits,
2388 (vm_offset_t)(&header->fat_header), sizeof(*header), &fat_arch);
2389 if (error != LOAD_SUCCESS)
2390 goto bad2;
2391
2392 /* Read the Mach-O header out of it */
2393 error = vn_rdwr(UIO_READ, vp, (caddr_t)&header->mach_header,
2394 sizeof (header->mach_header), fat_arch.offset,
2395 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p);
2396 if (error) {
2397 error = LOAD_IOERROR;
2398 goto bad2;
2399 }
2400
2401 if (resid) {
2402 error = LOAD_BADMACHO;
2403 goto bad2;
2404 }
2405
2406 /* Is this really a Mach-O? */
2407 if (header->mach_header.magic != MH_MAGIC &&
2408 header->mach_header.magic != MH_MAGIC_64) {
2409 error = LOAD_BADMACHO;
2410 goto bad2;
2411 }
2412
2413 *file_offset = fat_arch.offset;
2414 *macho_size = fat_arch.size;
2415 } else {
2416 /*
2417 * Force get_macho_vnode() to fail if the architecture bits
2418 * do not match the expected architecture bits. This in
2419 * turn causes load_dylinker() to fail for the same reason,
2420 * so it ensures the dynamic linker and the binary are in
2421 * lock-step. This is potentially bad, if we ever add to
2422 * the CPU_ARCH_* bits any bits that are desirable but not
2423 * required, since the dynamic linker might work, but we will
2424 * refuse to load it because of this check.
2425 */
2426 if ((cpu_type_t)(header->mach_header.cputype & CPU_ARCH_MASK) != archbits) {
2427 error = LOAD_BADARCH;
2428 goto bad2;
2429 }
2430
2431 *file_offset = 0;
2432 *macho_size = fsize;
2433 }
2434
2435 *mach_header = header->mach_header;
2436 *vpp = vp;
2437
2438 ubc_setsize(vp, fsize);
2439 return (error);
2440
2441 bad2:
2442 (void) VNOP_CLOSE(vp, FREAD, ctx);
2443 bad1:
2444 vnode_put(vp);
2445 return(error);
2446 }
mirror of XNU