]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/mach_loader.c
projects / apple / xnu.git / blob
? search:


43f1a78b0a329d673459d4e19a9f7f87b913037b
[apple/xnu.git] / bsd / kern / mach_loader.c
1 /*
2 * Copyright (c) 2000-2010 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (C) 1988, 1989, NeXT, Inc.
30 *
31 * File: kern/mach_loader.c
32 * Author: Avadis Tevanian, Jr.
33 *
34 * Mach object file loader (kernel version, for now).
35 *
36 * 21-Jul-88 Avadis Tevanian, Jr. (avie) at NeXT
37 * Started.
38 */
39
40 #include <sys/param.h>
41 #include <sys/vnode_internal.h>
42 #include <sys/uio.h>
43 #include <sys/namei.h>
44 #include <sys/proc_internal.h>
45 #include <sys/kauth.h>
46 #include <sys/stat.h>
47 #include <sys/malloc.h>
48 #include <sys/mount_internal.h>
49 #include <sys/fcntl.h>
50 #include <sys/ubc_internal.h>
51 #include <sys/imgact.h>
52 #include <sys/codesign.h>
53 #include <sys/proc_uuid_policy.h>
54 #include <sys/reason.h>
55 #include <sys/kdebug.h>
56
57 #include <mach/mach_types.h>
58 #include <mach/vm_map.h> /* vm_allocate() */
59 #include <mach/mach_vm.h> /* mach_vm_allocate() */
60 #include <mach/vm_statistics.h>
61 #include <mach/task.h>
62 #include <mach/thread_act.h>
63
64 #include <machine/vmparam.h>
65 #include <machine/exec.h>
66 #include <machine/pal_routines.h>
67
68 #include <kern/kern_types.h>
69 #include <kern/cpu_number.h>
70 #include <kern/mach_loader.h>
71 #include <kern/mach_fat.h>
72 #include <kern/kalloc.h>
73 #include <kern/task.h>
74 #include <kern/thread.h>
75 #include <kern/page_decrypt.h>
76
77 #include <mach-o/fat.h>
78 #include <mach-o/loader.h>
79
80 #include <vm/pmap.h>
81 #include <vm/vm_map.h>
82 #include <vm/vm_kern.h>
83 #include <vm/vm_pager.h>
84 #include <vm/vnode_pager.h>
85 #include <vm/vm_protos.h>
86 #include <IOKit/IOReturn.h> /* for kIOReturnNotPrivileged */
87
88 #include <os/overflow.h>
89
90 /*
91 * XXX vm/pmap.h should not treat these prototypes as MACH_KERNEL_PRIVATE
92 * when KERNEL is defined.
93 */
94 extern pmap_t pmap_create(ledger_t ledger, vm_map_size_t size,
95 boolean_t is_64bit);
96
97 /* XXX should have prototypes in a shared header file */
98 extern int get_map_nentries(vm_map_t);
99
100 extern kern_return_t memory_object_signed(memory_object_control_t control,
101 boolean_t is_signed);
102
103 /* An empty load_result_t */
104 static const load_result_t load_result_null = {
105 .mach_header = MACH_VM_MIN_ADDRESS,
106 .entry_point = MACH_VM_MIN_ADDRESS,
107 .user_stack = MACH_VM_MIN_ADDRESS,
108 .user_stack_size = 0,
109 .user_stack_alloc = MACH_VM_MIN_ADDRESS,
110 .user_stack_alloc_size = 0,
111 .all_image_info_addr = MACH_VM_MIN_ADDRESS,
112 .all_image_info_size = 0,
113 .thread_count = 0,
114 .unixproc = 0,
115 .dynlinker = 0,
116 .needs_dynlinker = 0,
117 .validentry = 0,
118 .using_lcmain = 0,
119 .is64bit = 0,
120 .csflags = 0,
121 .has_pagezero = 0,
122 .uuid = { 0 },
123 .min_vm_addr = MACH_VM_MAX_ADDRESS,
124 .max_vm_addr = MACH_VM_MIN_ADDRESS,
125 .cs_end_offset = 0,
126 .threadstate = NULL,
127 .threadstate_sz = 0
128 };
129
130 /*
131 * Prototypes of static functions.
132 */
133 static load_return_t
134 parse_machfile(
135 struct vnode *vp,
136 vm_map_t map,
137 thread_t thread,
138 struct mach_header *header,
139 off_t file_offset,
140 off_t macho_size,
141 int depth,
142 int64_t slide,
143 int64_t dyld_slide,
144 load_result_t *result,
145 load_result_t *binresult,
146 struct image_params *imgp
147 );
148
149 static load_return_t
150 load_segment(
151 struct load_command *lcp,
152 uint32_t filetype,
153 void *control,
154 off_t pager_offset,
155 off_t macho_size,
156 struct vnode *vp,
157 vm_map_t map,
158 int64_t slide,
159 load_result_t *result
160 );
161
162 static load_return_t
163 load_uuid(
164 struct uuid_command *uulp,
165 char *command_end,
166 load_result_t *result
167 );
168
169 static load_return_t
170 load_code_signature(
171 struct linkedit_data_command *lcp,
172 struct vnode *vp,
173 off_t macho_offset,
174 off_t macho_size,
175 cpu_type_t cputype,
176 load_result_t *result,
177 struct image_params *imgp);
178
179 #if CONFIG_CODE_DECRYPTION
180 static load_return_t
181 set_code_unprotect(
182 struct encryption_info_command *lcp,
183 caddr_t addr,
184 vm_map_t map,
185 int64_t slide,
186 struct vnode *vp,
187 off_t macho_offset,
188 cpu_type_t cputype,
189 cpu_subtype_t cpusubtype);
190 #endif
191
192 static
193 load_return_t
194 load_main(
195 struct entry_point_command *epc,
196 thread_t thread,
197 int64_t slide,
198 load_result_t *result
199 );
200
201 static load_return_t
202 load_unixthread(
203 struct thread_command *tcp,
204 thread_t thread,
205 int64_t slide,
206 load_result_t *result
207 );
208
209 static load_return_t
210 load_threadstate(
211 thread_t thread,
212 uint32_t *ts,
213 uint32_t total_size,
214 load_result_t *
215 );
216
217 static load_return_t
218 load_threadstack(
219 thread_t thread,
220 uint32_t *ts,
221 uint32_t total_size,
222 mach_vm_offset_t *user_stack,
223 int *customstack,
224 load_result_t *result
225 );
226
227 static load_return_t
228 load_threadentry(
229 thread_t thread,
230 uint32_t *ts,
231 uint32_t total_size,
232 mach_vm_offset_t *entry_point
233 );
234
235 static load_return_t
236 load_dylinker(
237 struct dylinker_command *lcp,
238 integer_t archbits,
239 vm_map_t map,
240 thread_t thread,
241 int depth,
242 int64_t slide,
243 load_result_t *result,
244 struct image_params *imgp
245 );
246
247 struct macho_data;
248
249 static load_return_t
250 get_macho_vnode(
251 const char *path,
252 integer_t archbits,
253 struct mach_header *mach_header,
254 off_t *file_offset,
255 off_t *macho_size,
256 struct macho_data *macho_data,
257 struct vnode **vpp
258 );
259
260 static inline void
261 widen_segment_command(const struct segment_command *scp32,
262 struct segment_command_64 *scp)
263 {
264 scp->cmd = scp32->cmd;
265 scp->cmdsize = scp32->cmdsize;
266 bcopy(scp32->segname, scp->segname, sizeof(scp->segname));
267 scp->vmaddr = scp32->vmaddr;
268 scp->vmsize = scp32->vmsize;
269 scp->fileoff = scp32->fileoff;
270 scp->filesize = scp32->filesize;
271 scp->maxprot = scp32->maxprot;
272 scp->initprot = scp32->initprot;
273 scp->nsects = scp32->nsects;
274 scp->flags = scp32->flags;
275 }
276
277 static void
278 note_all_image_info_section(const struct segment_command_64 *scp,
279 boolean_t is64, size_t section_size, const void *sections,
280 int64_t slide, load_result_t *result)
281 {
282 const union {
283 struct section s32;
284 struct section_64 s64;
285 } *sectionp;
286 unsigned int i;
287
288
289 if (strncmp(scp->segname, "__DATA", sizeof(scp->segname)) != 0)
290 return;
291 for (i = 0; i < scp->nsects; ++i) {
292 sectionp = (const void *)
293 ((const char *)sections + section_size * i);
294 if (0 == strncmp(sectionp->s64.sectname, "__all_image_info",
295 sizeof(sectionp->s64.sectname))) {
296 result->all_image_info_addr =
297 is64 ? sectionp->s64.addr : sectionp->s32.addr;
298 result->all_image_info_addr += slide;
299 result->all_image_info_size =
300 is64 ? sectionp->s64.size : sectionp->s32.size;
301 return;
302 }
303 }
304 }
305
306 #if __arm64__
307 /*
308 * Allow bypassing some security rules (hard pagezero, no write+execute)
309 * in exchange for better binary compatibility for legacy apps built
310 * before 16KB-alignment was enforced.
311 */
312 int fourk_binary_compatibility_unsafe = TRUE;
313 int fourk_binary_compatibility_allow_wx = FALSE;
314 #endif /* __arm64__ */
315
316 load_return_t
317 load_machfile(
318 struct image_params *imgp,
319 struct mach_header *header,
320 thread_t thread,
321 vm_map_t *mapp,
322 load_result_t *result
323 )
324 {
325 struct vnode *vp = imgp->ip_vp;
326 off_t file_offset = imgp->ip_arch_offset;
327 off_t macho_size = imgp->ip_arch_size;
328 off_t file_size = imgp->ip_vattr->va_data_size;
329 pmap_t pmap = 0; /* protected by create_map */
330 vm_map_t map;
331 load_result_t myresult;
332 load_return_t lret;
333 boolean_t enforce_hard_pagezero = TRUE;
334 int in_exec = (imgp->ip_flags & IMGPF_EXEC);
335 task_t task = current_task();
336 proc_t p = current_proc();
337 int64_t aslr_page_offset = 0;
338 int64_t dyld_aslr_page_offset = 0;
339 int64_t aslr_section_size = 0;
340 int64_t aslr_section_offset = 0;
341 kern_return_t kret;
342
343 if (macho_size > file_size) {
344 return(LOAD_BADMACHO);
345 }
346
347 result->is64bit = ((imgp->ip_flags & IMGPF_IS_64BIT) == IMGPF_IS_64BIT);
348
349 task_t ledger_task;
350 if (imgp->ip_new_thread) {
351 ledger_task = get_threadtask(imgp->ip_new_thread);
352 } else {
353 ledger_task = task;
354 }
355 pmap = pmap_create(get_task_ledger(ledger_task),
356 (vm_map_size_t) 0,
357 result->is64bit);
358 map = vm_map_create(pmap,
359 0,
360 vm_compute_max_offset(result->is64bit),
361 TRUE);
362
363 #if defined(__arm64__)
364 if (result->is64bit) {
365 /* enforce 16KB alignment of VM map entries */
366 vm_map_set_page_shift(map, SIXTEENK_PAGE_SHIFT);
367 } else {
368 vm_map_set_page_shift(map, page_shift_user32);
369 }
370 #elif (__ARM_ARCH_7K__ >= 2) && defined(PLATFORM_WatchOS)
371 /* enforce 16KB alignment for watch targets with new ABI */
372 vm_map_set_page_shift(map, SIXTEENK_PAGE_SHIFT);
373 #endif /* __arm64__ */
374
375 #ifndef CONFIG_ENFORCE_SIGNED_CODE
376 /* This turns off faulting for executable pages, which allows
377 * to circumvent Code Signing Enforcement. The per process
378 * flag (CS_ENFORCEMENT) is not set yet, but we can use the
379 * global flag.
380 */
381 if ( !cs_enforcement(NULL) && (header->flags & MH_ALLOW_STACK_EXECUTION) )
382 vm_map_disable_NX(map);
383 #endif
384
385 /* Forcibly disallow execution from data pages on even if the arch
386 * normally permits it. */
387 if ((header->flags & MH_NO_HEAP_EXECUTION) && !(imgp->ip_flags & IMGPF_ALLOW_DATA_EXEC))
388 vm_map_disallow_data_exec(map);
389
390 /*
391 * Compute a random offset for ASLR, and an independent random offset for dyld.
392 */
393 if (!(imgp->ip_flags & IMGPF_DISABLE_ASLR)) {
394 vm_map_get_max_aslr_slide_section(map, &aslr_section_offset, &aslr_section_size);
395 aslr_section_offset = (random() % aslr_section_offset) * aslr_section_size;
396
397 aslr_page_offset = random();
398 aslr_page_offset %= vm_map_get_max_aslr_slide_pages(map);
399 aslr_page_offset <<= vm_map_page_shift(map);
400
401 dyld_aslr_page_offset = random();
402 dyld_aslr_page_offset %= vm_map_get_max_loader_aslr_slide_pages(map);
403 dyld_aslr_page_offset <<= vm_map_page_shift(map);
404
405 aslr_page_offset += aslr_section_offset;
406 }
407
408 if (!result)
409 result = &myresult;
410
411 *result = load_result_null;
412
413 /*
414 * re-set the bitness on the load result since we cleared the load result above.
415 */
416 result->is64bit = ((imgp->ip_flags & IMGPF_IS_64BIT) == IMGPF_IS_64BIT);
417
418 lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
419 0, aslr_page_offset, dyld_aslr_page_offset, result,
420 NULL, imgp);
421
422 if (lret != LOAD_SUCCESS) {
423 vm_map_deallocate(map); /* will lose pmap reference too */
424 return(lret);
425 }
426
427 #if __x86_64__
428 /*
429 * On x86, for compatibility, don't enforce the hard page-zero restriction for 32-bit binaries.
430 */
431 if (!result->is64bit) {
432 enforce_hard_pagezero = FALSE;
433 }
434
435 /*
436 * For processes with IMGPF_HIGH_BITS_ASLR, add a few random high bits
437 * to the start address for "anywhere" memory allocations.
438 */
439 #define VM_MAP_HIGH_START_BITS_COUNT 8
440 #define VM_MAP_HIGH_START_BITS_SHIFT 27
441 if (result->is64bit &&
442 (imgp->ip_flags & IMGPF_HIGH_BITS_ASLR)) {
443 int random_bits;
444 vm_map_offset_t high_start;
445
446 random_bits = random();
447 random_bits &= (1 << VM_MAP_HIGH_START_BITS_COUNT)-1;
448 high_start = (((vm_map_offset_t)random_bits)
449 << VM_MAP_HIGH_START_BITS_SHIFT);
450 vm_map_set_high_start(map, high_start);
451 }
452 #endif /* __x86_64__ */
453
454 /*
455 * Check to see if the page zero is enforced by the map->min_offset.
456 */
457 if (enforce_hard_pagezero &&
458 (vm_map_has_hard_pagezero(map, 0x1000) == FALSE)) {
459 #if __arm64__
460 if (!result->is64bit && /* not 64-bit */
461 !(header->flags & MH_PIE) && /* not PIE */
462 (vm_map_page_shift(map) != FOURK_PAGE_SHIFT ||
463 PAGE_SHIFT != FOURK_PAGE_SHIFT) && /* page size != 4KB */
464 result->has_pagezero && /* has a "soft" page zero */
465 fourk_binary_compatibility_unsafe) {
466 /*
467 * For backwards compatibility of "4K" apps on
468 * a 16K system, do not enforce a hard page zero...
469 */
470 } else
471 #endif /* __arm64__ */
472 {
473 vm_map_deallocate(map); /* will lose pmap reference too */
474 return (LOAD_BADMACHO);
475 }
476 }
477
478 vm_commit_pagezero_status(map);
479
480 /*
481 * If this is an exec, then we are going to destroy the old
482 * task, and it's correct to halt it; if it's spawn, the
483 * task is not yet running, and it makes no sense.
484 */
485 if (in_exec) {
486 /*
487 * Mark the task as halting and start the other
488 * threads towards terminating themselves. Then
489 * make sure any threads waiting for a process
490 * transition get informed that we are committed to
491 * this transition, and then finally complete the
492 * task halting (wait for threads and then cleanup
493 * task resources).
494 *
495 * NOTE: task_start_halt() makes sure that no new
496 * threads are created in the task during the transition.
497 * We need to mark the workqueue as exiting before we
498 * wait for threads to terminate (at the end of which
499 * we no longer have a prohibition on thread creation).
500 *
501 * Finally, clean up any lingering workqueue data structures
502 * that may have been left behind by the workqueue threads
503 * as they exited (and then clean up the work queue itself).
504 */
505 kret = task_start_halt(task);
506 if (kret != KERN_SUCCESS) {
507 vm_map_deallocate(map); /* will lose pmap reference too */
508 return (LOAD_FAILURE);
509 }
510 proc_transcommit(p, 0);
511 workqueue_mark_exiting(p);
512 task_complete_halt(task);
513 workqueue_exit(p);
514
515 /*
516 * Roll up accounting info to new task. The roll up is done after
517 * task_complete_halt to make sure the thread accounting info is
518 * rolled up to current_task.
519 */
520 task_rollup_accounting_info(get_threadtask(thread), task);
521 }
522 *mapp = map;
523 return(LOAD_SUCCESS);
524 }
525
526 int macho_printf = 0;
527 #define MACHO_PRINTF(args) \
528 do { \
529 if (macho_printf) { \
530 printf args; \
531 } \
532 } while (0)
533
534 /*
535 * The file size of a mach-o file is limited to 32 bits; this is because
536 * this is the limit on the kalloc() of enough bytes for a mach_header and
537 * the contents of its sizeofcmds, which is currently constrained to 32
538 * bits in the file format itself. We read into the kernel buffer the
539 * commands section, and then parse it in order to parse the mach-o file
540 * format load_command segment(s). We are only interested in a subset of
541 * the total set of possible commands. If "map"==VM_MAP_NULL or
542 * "thread"==THREAD_NULL, do not make permament VM modifications,
543 * just preflight the parse.
544 */
545 static
546 load_return_t
547 parse_machfile(
548 struct vnode *vp,
549 vm_map_t map,
550 thread_t thread,
551 struct mach_header *header,
552 off_t file_offset,
553 off_t macho_size,
554 int depth,
555 int64_t aslr_offset,
556 int64_t dyld_aslr_offset,
557 load_result_t *result,
558 load_result_t *binresult,
559 struct image_params *imgp
560 )
561 {
562 uint32_t ncmds;
563 struct load_command *lcp;
564 struct dylinker_command *dlp = 0;
565 integer_t dlarchbits = 0;
566 void * control;
567 load_return_t ret = LOAD_SUCCESS;
568 void * addr;
569 vm_size_t alloc_size, cmds_size;
570 size_t offset;
571 size_t oldoffset; /* for overflow check */
572 int pass;
573 proc_t p = current_proc(); /* XXXX */
574 int error;
575 int resid = 0;
576 size_t mach_header_sz = sizeof(struct mach_header);
577 boolean_t abi64;
578 boolean_t got_code_signatures = FALSE;
579 boolean_t found_header_segment = FALSE;
580 boolean_t found_xhdr = FALSE;
581 int64_t slide = 0;
582 boolean_t dyld_no_load_addr = FALSE;
583 boolean_t is_dyld = FALSE;
584 vm_map_offset_t effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
585 #if __arm64__
586 uint32_t pagezero_end = 0;
587 uint32_t executable_end = 0;
588 uint32_t writable_start = 0;
589 vm_map_size_t effective_page_size;
590
591 effective_page_size = MAX(PAGE_SIZE, vm_map_page_size(map));
592 #endif /* __arm64__ */
593
594 if (header->magic == MH_MAGIC_64 ||
595 header->magic == MH_CIGAM_64) {
596 mach_header_sz = sizeof(struct mach_header_64);
597 }
598
599 /*
600 * Break infinite recursion
601 */
602 if (depth > 1) {
603 return(LOAD_FAILURE);
604 }
605
606 depth++;
607
608 /*
609 * Check to see if right machine type.
610 */
611 if (((cpu_type_t)(header->cputype & ~CPU_ARCH_MASK) != (cpu_type() & ~CPU_ARCH_MASK)) ||
612 !grade_binary(header->cputype,
613 header->cpusubtype & ~CPU_SUBTYPE_MASK))
614 return(LOAD_BADARCH);
615
616 abi64 = ((header->cputype & CPU_ARCH_ABI64) == CPU_ARCH_ABI64);
617
618 switch (header->filetype) {
619
620 case MH_EXECUTE:
621 if (depth != 1) {
622 return (LOAD_FAILURE);
623 }
624 #if CONFIG_EMBEDDED
625 if (header->flags & MH_DYLDLINK) {
626 /* Check properties of dynamic executables */
627 if (!(header->flags & MH_PIE) && pie_required(header->cputype, header->cpusubtype & ~CPU_SUBTYPE_MASK)) {
628 return (LOAD_FAILURE);
629 }
630 result->needs_dynlinker = TRUE;
631 } else {
632 /* Check properties of static executables (disallowed except for development) */
633 #if !(DEVELOPMENT || DEBUG)
634 return (LOAD_FAILURE);
635 #endif
636 }
637 #endif /* CONFIG_EMBEDDED */
638
639 break;
640 case MH_DYLINKER:
641 if (depth != 2) {
642 return (LOAD_FAILURE);
643 }
644 is_dyld = TRUE;
645 break;
646
647 default:
648 return (LOAD_FAILURE);
649 }
650
651 /*
652 * Get the pager for the file.
653 */
654 control = ubc_getobject(vp, UBC_FLAGS_NONE);
655
656 /* ensure header + sizeofcmds falls within the file */
657 if (os_add_overflow(mach_header_sz, header->sizeofcmds, &cmds_size) ||
658 (off_t)cmds_size > macho_size ||
659 round_page_overflow(cmds_size, &alloc_size)) {
660 return LOAD_BADMACHO;
661 }
662
663 /*
664 * Map the load commands into kernel memory.
665 */
666 addr = kalloc(alloc_size);
667 if (addr == NULL) {
668 return LOAD_NOSPACE;
669 }
670
671 error = vn_rdwr(UIO_READ, vp, addr, alloc_size, file_offset,
672 UIO_SYSSPACE, 0, kauth_cred_get(), &resid, p);
673 if (error) {
674 kfree(addr, alloc_size);
675 return LOAD_IOERROR;
676 }
677
678 if (resid) {
679 /* We must be able to read in as much as the mach_header indicated */
680 kfree(addr, alloc_size);
681 return LOAD_BADMACHO;
682 }
683
684 /*
685 * For PIE and dyld, slide everything by the ASLR offset.
686 */
687 if ((header->flags & MH_PIE) || is_dyld) {
688 slide = aslr_offset;
689 }
690
691 /*
692 * Scan through the commands, processing each one as necessary.
693 * We parse in three passes through the headers:
694 * 0: determine if TEXT and DATA boundary can be page-aligned
695 * 1: thread state, uuid, code signature
696 * 2: segments
697 * 3: dyld, encryption, check entry point
698 */
699
700 boolean_t slide_realign = FALSE;
701 #if __arm64__
702 if (!abi64) {
703 slide_realign = TRUE;
704 }
705 #endif
706
707 for (pass = 0; pass <= 3; pass++) {
708
709 if (pass == 0 && !slide_realign && !is_dyld) {
710 /* if we dont need to realign the slide or determine dyld's load
711 * address, pass 0 can be skipped */
712 continue;
713 } else if (pass == 1) {
714 #if __arm64__
715 boolean_t is_pie;
716 int64_t adjust;
717
718 is_pie = ((header->flags & MH_PIE) != 0);
719 if (pagezero_end != 0 &&
720 pagezero_end < effective_page_size) {
721 /* need at least 1 page for PAGEZERO */
722 adjust = effective_page_size;
723 MACHO_PRINTF(("pagezero boundary at "
724 "0x%llx; adjust slide from "
725 "0x%llx to 0x%llx%s\n",
726 (uint64_t) pagezero_end,
727 slide,
728 slide + adjust,
729 (is_pie
730 ? ""
731 : " BUT NO PIE ****** :-(")));
732 if (is_pie) {
733 slide += adjust;
734 pagezero_end += adjust;
735 executable_end += adjust;
736 writable_start += adjust;
737 }
738 }
739 if (pagezero_end != 0) {
740 result->has_pagezero = TRUE;
741 }
742 if (executable_end == writable_start &&
743 (executable_end & effective_page_mask) != 0 &&
744 (executable_end & FOURK_PAGE_MASK) == 0) {
745
746 /*
747 * The TEXT/DATA boundary is 4K-aligned but
748 * not page-aligned. Adjust the slide to make
749 * it page-aligned and avoid having a page
750 * with both write and execute permissions.
751 */
752 adjust =
753 (effective_page_size -
754 (executable_end & effective_page_mask));
755 MACHO_PRINTF(("page-unaligned X-W boundary at "
756 "0x%llx; adjust slide from "
757 "0x%llx to 0x%llx%s\n",
758 (uint64_t) executable_end,
759 slide,
760 slide + adjust,
761 (is_pie
762 ? ""
763 : " BUT NO PIE ****** :-(")));
764 if (is_pie)
765 slide += adjust;
766 }
767 #endif /* __arm64__ */
768
769 if (dyld_no_load_addr && binresult) {
770 /*
771 * The dyld Mach-O does not specify a load address. Try to locate
772 * it right after the main binary. If binresult == NULL, load
773 * directly to the given slide.
774 */
775 slide = vm_map_round_page(slide + binresult->max_vm_addr, effective_page_mask);
776 }
777 }
778
779 /*
780 * Check that the entry point is contained in an executable segments
781 */
782 if ((pass == 3) && (!result->using_lcmain && result->validentry == 0)) {
783 thread_state_initialize(thread);
784 ret = LOAD_FAILURE;
785 break;
786 }
787
788 /*
789 * Check that some segment maps the start of the mach-o file, which is
790 * needed by the dynamic loader to read the mach headers, etc.
791 */
792 if ((pass == 3) && (found_header_segment == FALSE)) {
793 ret = LOAD_BADMACHO;
794 break;
795 }
796
797 /*
798 * Loop through each of the load_commands indicated by the
799 * Mach-O header; if an absurd value is provided, we just
800 * run off the end of the reserved section by incrementing
801 * the offset too far, so we are implicitly fail-safe.
802 */
803 offset = mach_header_sz;
804 ncmds = header->ncmds;
805
806 while (ncmds--) {
807
808 /* ensure enough space for a minimal load command */
809 if (offset + sizeof(struct load_command) > cmds_size) {
810 ret = LOAD_BADMACHO;
811 break;
812 }
813
814 /*
815 * Get a pointer to the command.
816 */
817 lcp = (struct load_command *)(addr + offset);
818 oldoffset = offset;
819
820 /*
821 * Perform prevalidation of the struct load_command
822 * before we attempt to use its contents. Invalid
823 * values are ones which result in an overflow, or
824 * which can not possibly be valid commands, or which
825 * straddle or exist past the reserved section at the
826 * start of the image.
827 */
828 if (os_add_overflow(offset, lcp->cmdsize, &offset) ||
829 lcp->cmdsize < sizeof(struct load_command) ||
830 offset > cmds_size) {
831 ret = LOAD_BADMACHO;
832 break;
833 }
834
835 /*
836 * Act on struct load_command's for which kernel
837 * intervention is required.
838 */
839 switch(lcp->cmd) {
840 case LC_SEGMENT: {
841 struct segment_command *scp = (struct segment_command *) lcp;
842
843 if (pass == 0) {
844 if (is_dyld && scp->vmaddr == 0 && scp->fileoff == 0) {
845 dyld_no_load_addr = TRUE;
846 if (!slide_realign) {
847 /* got what we need, bail early on pass 0 */
848 continue;
849 }
850 }
851
852 #if __arm64__
853 assert(!abi64);
854
855 if (scp->initprot == 0 && scp->maxprot == 0 && scp->vmaddr == 0) {
856 /* PAGEZERO */
857 if (os_add3_overflow(scp->vmaddr, scp->vmsize, slide, &pagezero_end)) {
858 ret = LOAD_BADMACHO;
859 break;
860 }
861 }
862 if (scp->initprot & VM_PROT_EXECUTE) {
863 /* TEXT */
864 if (os_add3_overflow(scp->vmaddr, scp->vmsize, slide, &executable_end)) {
865 ret = LOAD_BADMACHO;
866 break;
867 }
868 }
869 if (scp->initprot & VM_PROT_WRITE) {
870 /* DATA */
871 if (os_add_overflow(scp->vmaddr, slide, &writable_start)) {
872 ret = LOAD_BADMACHO;
873 break;
874 }
875 }
876 #endif /* __arm64__ */
877 break;
878 }
879
880 if (pass == 1 && !strncmp(scp->segname, "__XHDR", sizeof(scp->segname))) {
881 found_xhdr = TRUE;
882 }
883
884 if (pass != 2)
885 break;
886
887 if (abi64) {
888 /*
889 * Having an LC_SEGMENT command for the
890 * wrong ABI is invalid <rdar://problem/11021230>
891 */
892 ret = LOAD_BADMACHO;
893 break;
894 }
895
896 ret = load_segment(lcp,
897 header->filetype,
898 control,
899 file_offset,
900 macho_size,
901 vp,
902 map,
903 slide,
904 result);
905
906 if (ret == LOAD_SUCCESS && scp->fileoff == 0 && scp->filesize > 0) {
907 /* Enforce a single segment mapping offset zero, with R+X
908 * protection. */
909 if (found_header_segment ||
910 ((scp->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) != (VM_PROT_READ|VM_PROT_EXECUTE))) {
911 ret = LOAD_BADMACHO;
912 break;
913 }
914 found_header_segment = TRUE;
915 }
916
917 break;
918 }
919 case LC_SEGMENT_64: {
920 struct segment_command_64 *scp64 = (struct segment_command_64 *) lcp;
921
922 if (pass == 0) {
923 if (is_dyld && scp64->vmaddr == 0 && scp64->fileoff == 0) {
924 dyld_no_load_addr = TRUE;
925 if (!slide_realign) {
926 /* got what we need, bail early on pass 0 */
927 continue;
928 }
929 }
930 }
931
932 if (pass == 1 && !strncmp(scp64->segname, "__XHDR", sizeof(scp64->segname))) {
933 found_xhdr = TRUE;
934 }
935
936 if (pass != 2)
937 break;
938
939 if (!abi64) {
940 /*
941 * Having an LC_SEGMENT_64 command for the
942 * wrong ABI is invalid <rdar://problem/11021230>
943 */
944 ret = LOAD_BADMACHO;
945 break;
946 }
947
948 ret = load_segment(lcp,
949 header->filetype,
950 control,
951 file_offset,
952 macho_size,
953 vp,
954 map,
955 slide,
956 result);
957
958 if (ret == LOAD_SUCCESS && scp64->fileoff == 0 && scp64->filesize > 0) {
959 /* Enforce a single segment mapping offset zero, with R+X
960 * protection. */
961 if (found_header_segment ||
962 ((scp64->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) != (VM_PROT_READ|VM_PROT_EXECUTE))) {
963 ret = LOAD_BADMACHO;
964 break;
965 }
966 found_header_segment = TRUE;
967 }
968
969 break;
970 }
971 case LC_UNIXTHREAD:
972 if (pass != 1)
973 break;
974 ret = load_unixthread(
975 (struct thread_command *) lcp,
976 thread,
977 slide,
978 result);
979 break;
980 case LC_MAIN:
981 if (pass != 1)
982 break;
983 if (depth != 1)
984 break;
985 ret = load_main(
986 (struct entry_point_command *) lcp,
987 thread,
988 slide,
989 result);
990 break;
991 case LC_LOAD_DYLINKER:
992 if (pass != 3)
993 break;
994 if ((depth == 1) && (dlp == 0)) {
995 dlp = (struct dylinker_command *)lcp;
996 dlarchbits = (header->cputype & CPU_ARCH_MASK);
997 } else {
998 ret = LOAD_FAILURE;
999 }
1000 break;
1001 case LC_UUID:
1002 if (pass == 1 && depth == 1) {
1003 ret = load_uuid((struct uuid_command *) lcp,
1004 (char *)addr + cmds_size,
1005 result);
1006 }
1007 break;
1008 case LC_CODE_SIGNATURE:
1009 /* CODE SIGNING */
1010 if (pass != 1)
1011 break;
1012 /* pager -> uip ->
1013 load signatures & store in uip
1014 set VM object "signed_pages"
1015 */
1016 ret = load_code_signature(
1017 (struct linkedit_data_command *) lcp,
1018 vp,
1019 file_offset,
1020 macho_size,
1021 header->cputype,
1022 result,
1023 imgp);
1024 if (ret != LOAD_SUCCESS) {
1025 printf("proc %d: load code signature error %d "
1026 "for file \"%s\"\n",
1027 p->p_pid, ret, vp->v_name);
1028 /*
1029 * Allow injections to be ignored on devices w/o enforcement enabled
1030 */
1031 if (!cs_enforcement(NULL))
1032 ret = LOAD_SUCCESS; /* ignore error */
1033
1034 } else {
1035 got_code_signatures = TRUE;
1036 }
1037
1038 if (got_code_signatures) {
1039 unsigned tainted = CS_VALIDATE_TAINTED;
1040 boolean_t valid = FALSE;
1041 vm_size_t off = 0;
1042
1043
1044 if (cs_debug > 10)
1045 printf("validating initial pages of %s\n", vp->v_name);
1046
1047 while (off < alloc_size && ret == LOAD_SUCCESS) {
1048 tainted = CS_VALIDATE_TAINTED;
1049
1050 valid = cs_validate_range(vp,
1051 NULL,
1052 file_offset + off,
1053 addr + off,
1054 PAGE_SIZE,
1055 &tainted);
1056 if (!valid || (tainted & CS_VALIDATE_TAINTED)) {
1057 if (cs_debug)
1058 printf("CODE SIGNING: %s[%d]: invalid initial page at offset %lld validated:%d tainted:%d csflags:0x%x\n",
1059 vp->v_name, p->p_pid, (long long)(file_offset + off), valid, tainted, result->csflags);
1060 if (cs_enforcement(NULL) ||
1061 (result->csflags & (CS_HARD|CS_KILL|CS_ENFORCEMENT))) {
1062 ret = LOAD_FAILURE;
1063 }
1064 result->csflags &= ~CS_VALID;
1065 }
1066 off += PAGE_SIZE;
1067 }
1068 }
1069
1070 break;
1071 #if CONFIG_CODE_DECRYPTION
1072 case LC_ENCRYPTION_INFO:
1073 case LC_ENCRYPTION_INFO_64:
1074 if (pass != 3)
1075 break;
1076 ret = set_code_unprotect(
1077 (struct encryption_info_command *) lcp,
1078 addr, map, slide, vp, file_offset,
1079 header->cputype, header->cpusubtype);
1080 if (ret != LOAD_SUCCESS) {
1081 os_reason_t load_failure_reason = OS_REASON_NULL;
1082 printf("proc %d: set_code_unprotect() error %d "
1083 "for file \"%s\"\n",
1084 p->p_pid, ret, vp->v_name);
1085 /*
1086 * Don't let the app run if it's
1087 * encrypted but we failed to set up the
1088 * decrypter. If the keys are missing it will
1089 * return LOAD_DECRYPTFAIL.
1090 */
1091 if (ret == LOAD_DECRYPTFAIL) {
1092 /* failed to load due to missing FP keys */
1093 proc_lock(p);
1094 p->p_lflag |= P_LTERM_DECRYPTFAIL;
1095 proc_unlock(p);
1096
1097 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
1098 p->p_pid, OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT, 0, 0);
1099 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT);
1100 } else {
1101
1102 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
1103 p->p_pid, OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT, 0, 0);
1104 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT);
1105 }
1106
1107 assert(load_failure_reason != OS_REASON_NULL);
1108 psignal_with_reason(p, SIGKILL, load_failure_reason);
1109 }
1110 break;
1111 #endif
1112 default:
1113 /* Other commands are ignored by the kernel */
1114 ret = LOAD_SUCCESS;
1115 break;
1116 }
1117 if (ret != LOAD_SUCCESS)
1118 break;
1119 }
1120 if (ret != LOAD_SUCCESS)
1121 break;
1122 }
1123
1124 if (ret == LOAD_SUCCESS) {
1125 if (! got_code_signatures) {
1126 if (cs_enforcement(NULL)) {
1127 ret = LOAD_FAILURE;
1128 } else {
1129 #if !CONFIG_EMBEDDED
1130 /*
1131 * No embedded signatures: look for detached by taskgated,
1132 * this is only done on OSX, on embedded platforms we expect everything
1133 * to be have embedded signatures.
1134 */
1135 struct cs_blob *blob;
1136
1137 blob = ubc_cs_blob_get(vp, -1, file_offset);
1138 if (blob != NULL) {
1139 unsigned int cs_flag_data = blob->csb_flags;
1140 if(0 != ubc_cs_generation_check(vp)) {
1141 if (0 != ubc_cs_blob_revalidate(vp, blob, imgp, 0)) {
1142 /* clear out the flag data if revalidation fails */
1143 cs_flag_data = 0;
1144 result->csflags &= ~CS_VALID;
1145 }
1146 }
1147 /* get flags to be applied to the process */
1148 result->csflags |= cs_flag_data;
1149 }
1150 #endif
1151 }
1152 }
1153
1154 /* Make sure if we need dyld, we got it */
1155 if (result->needs_dynlinker && !dlp) {
1156 ret = LOAD_FAILURE;
1157 }
1158
1159 if ((ret == LOAD_SUCCESS) && (dlp != 0)) {
1160 /*
1161 * load the dylinker, and slide it by the independent DYLD ASLR
1162 * offset regardless of the PIE-ness of the main binary.
1163 */
1164 ret = load_dylinker(dlp, dlarchbits, map, thread, depth,
1165 dyld_aslr_offset, result, imgp);
1166 }
1167
1168 if ((ret == LOAD_SUCCESS) && (depth == 1)) {
1169 if (result->thread_count == 0) {
1170 ret = LOAD_FAILURE;
1171 }
1172 #if CONFIG_EMBEDDED
1173 if (result->needs_dynlinker && !(result->csflags & CS_DYLD_PLATFORM)) {
1174 ret = LOAD_FAILURE;
1175 }
1176 #endif
1177 }
1178 }
1179
1180 if (ret == LOAD_BADMACHO && found_xhdr) {
1181 ret = LOAD_BADMACHO_UPX;
1182 }
1183
1184 kfree(addr, alloc_size);
1185
1186 return ret;
1187 }
1188
1189 #if CONFIG_CODE_DECRYPTION
1190
1191 #define APPLE_UNPROTECTED_HEADER_SIZE (3 * 4096)
1192
1193 static load_return_t
1194 unprotect_dsmos_segment(
1195 uint64_t file_off,
1196 uint64_t file_size,
1197 struct vnode *vp,
1198 off_t macho_offset,
1199 vm_map_t map,
1200 vm_map_offset_t map_addr,
1201 vm_map_size_t map_size)
1202 {
1203 kern_return_t kr;
1204
1205 /*
1206 * The first APPLE_UNPROTECTED_HEADER_SIZE bytes (from offset 0 of
1207 * this part of a Universal binary) are not protected...
1208 * The rest needs to be "transformed".
1209 */
1210 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE &&
1211 file_off + file_size <= APPLE_UNPROTECTED_HEADER_SIZE) {
1212 /* it's all unprotected, nothing to do... */
1213 kr = KERN_SUCCESS;
1214 } else {
1215 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE) {
1216 /*
1217 * We start mapping in the unprotected area.
1218 * Skip the unprotected part...
1219 */
1220 vm_map_offset_t delta;
1221
1222 delta = APPLE_UNPROTECTED_HEADER_SIZE;
1223 delta -= file_off;
1224 map_addr += delta;
1225 map_size -= delta;
1226 }
1227 /* ... transform the rest of the mapping. */
1228 struct pager_crypt_info crypt_info;
1229 crypt_info.page_decrypt = dsmos_page_transform;
1230 crypt_info.crypt_ops = NULL;
1231 crypt_info.crypt_end = NULL;
1232 #pragma unused(vp, macho_offset)
1233 crypt_info.crypt_ops = (void *)0x2e69cf40;
1234 vm_map_offset_t crypto_backing_offset;
1235 crypto_backing_offset = -1; /* i.e. use map entry's offset */
1236 #if VM_MAP_DEBUG_APPLE_PROTECT
1237 if (vm_map_debug_apple_protect) {
1238 struct proc *p;
1239 p = current_proc();
1240 printf("APPLE_PROTECT: %d[%s] map %p "
1241 "[0x%llx:0x%llx] %s(%s)\n",
1242 p->p_pid, p->p_comm, map,
1243 (uint64_t) map_addr,
1244 (uint64_t) (map_addr + map_size),
1245 __FUNCTION__, vp->v_name);
1246 }
1247 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
1248
1249 /* The DSMOS pager can only be used by apple signed code */
1250 struct cs_blob * blob = csvnode_get_blob(vp, file_off);
1251 if( blob == NULL || !blob->csb_platform_binary || blob->csb_platform_path)
1252 {
1253 return LOAD_FAILURE;
1254 }
1255
1256 kr = vm_map_apple_protected(map,
1257 map_addr,
1258 map_addr + map_size,
1259 crypto_backing_offset,
1260 &crypt_info);
1261 }
1262
1263 if (kr != KERN_SUCCESS) {
1264 return LOAD_FAILURE;
1265 }
1266 return LOAD_SUCCESS;
1267 }
1268 #else /* CONFIG_CODE_DECRYPTION */
1269 static load_return_t
1270 unprotect_dsmos_segment(
1271 __unused uint64_t file_off,
1272 __unused uint64_t file_size,
1273 __unused struct vnode *vp,
1274 __unused off_t macho_offset,
1275 __unused vm_map_t map,
1276 __unused vm_map_offset_t map_addr,
1277 __unused vm_map_size_t map_size)
1278 {
1279 return LOAD_SUCCESS;
1280 }
1281 #endif /* CONFIG_CODE_DECRYPTION */
1282
1283
1284 /*
1285 * map_segment:
1286 * Maps a Mach-O segment, taking care of mis-alignment (wrt the system
1287 * page size) issues.
1288 *
1289 * The mapping might result in 1, 2 or 3 map entries:
1290 * 1. for the first page, which could be overlap with the previous
1291 * mapping,
1292 * 2. for the center (if applicable),
1293 * 3. for the last page, which could overlap with the next mapping.
1294 *
1295 * For each of those map entries, we might have to interpose a
1296 * "fourk_pager" to deal with mis-alignment wrt the system page size,
1297 * either in the mapping address and/or size or the file offset and/or
1298 * size.
1299 * The "fourk_pager" itself would be mapped with proper alignment
1300 * wrt the system page size and would then be populated with the
1301 * information about the intended mapping, with a "4KB" granularity.
1302 */
1303 static kern_return_t
1304 map_segment(
1305 vm_map_t map,
1306 vm_map_offset_t vm_start,
1307 vm_map_offset_t vm_end,
1308 memory_object_control_t control,
1309 vm_map_offset_t file_start,
1310 vm_map_offset_t file_end,
1311 vm_prot_t initprot,
1312 vm_prot_t maxprot)
1313 {
1314 vm_map_offset_t cur_offset, cur_start, cur_end;
1315 kern_return_t ret;
1316 vm_map_offset_t effective_page_mask;
1317 vm_map_kernel_flags_t vmk_flags, cur_vmk_flags;
1318
1319 if (vm_end < vm_start ||
1320 file_end < file_start) {
1321 return LOAD_BADMACHO;
1322 }
1323 if (vm_end == vm_start ||
1324 file_end == file_start) {
1325 /* nothing to map... */
1326 return LOAD_SUCCESS;
1327 }
1328
1329 effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
1330
1331 vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
1332 if (vm_map_page_aligned(vm_start, effective_page_mask) &&
1333 vm_map_page_aligned(vm_end, effective_page_mask) &&
1334 vm_map_page_aligned(file_start, effective_page_mask) &&
1335 vm_map_page_aligned(file_end, effective_page_mask)) {
1336 /* all page-aligned and map-aligned: proceed */
1337 } else {
1338 #if __arm64__
1339 /* use an intermediate "4K" pager */
1340 vmk_flags.vmkf_fourk = TRUE;
1341 #else /* __arm64__ */
1342 panic("map_segment: unexpected mis-alignment "
1343 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx]\n",
1344 (uint64_t) vm_start,
1345 (uint64_t) vm_end,
1346 (uint64_t) file_start,
1347 (uint64_t) file_end);
1348 #endif /* __arm64__ */
1349 }
1350
1351 cur_offset = 0;
1352 cur_start = vm_start;
1353 cur_end = vm_start;
1354 #if __arm64__
1355 if (!vm_map_page_aligned(vm_start, effective_page_mask)) {
1356 /* one 4K pager for the 1st page */
1357 cur_end = vm_map_round_page(cur_start, effective_page_mask);
1358 if (cur_end > vm_end) {
1359 cur_end = vm_start + (file_end - file_start);
1360 }
1361 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1362 ret = vm_map_enter_mem_object_control(
1363 map,
1364 &cur_start,
1365 cur_end - cur_start,
1366 (mach_vm_offset_t)0,
1367 VM_FLAGS_FIXED,
1368 vmk_flags,
1369 VM_KERN_MEMORY_NONE,
1370 control,
1371 file_start + cur_offset,
1372 TRUE, /* copy */
1373 initprot, maxprot,
1374 VM_INHERIT_DEFAULT);
1375 } else {
1376 ret = vm_map_enter_mem_object(
1377 map,
1378 &cur_start,
1379 cur_end - cur_start,
1380 (mach_vm_offset_t)0,
1381 VM_FLAGS_FIXED,
1382 vmk_flags,
1383 VM_KERN_MEMORY_NONE,
1384 IPC_PORT_NULL,
1385 0, /* offset */
1386 TRUE, /* copy */
1387 initprot, maxprot,
1388 VM_INHERIT_DEFAULT);
1389 }
1390 if (ret != KERN_SUCCESS) {
1391 return (LOAD_NOSPACE);
1392 }
1393 cur_offset += cur_end - cur_start;
1394 }
1395 #endif /* __arm64__ */
1396 if (cur_end >= vm_start + (file_end - file_start)) {
1397 /* all mapped: done */
1398 goto done;
1399 }
1400 if (vm_map_round_page(cur_end, effective_page_mask) >=
1401 vm_map_trunc_page(vm_start + (file_end - file_start),
1402 effective_page_mask)) {
1403 /* no middle */
1404 } else {
1405 cur_start = cur_end;
1406 if ((vm_start & effective_page_mask) !=
1407 (file_start & effective_page_mask)) {
1408 /* one 4K pager for the middle */
1409 cur_vmk_flags = vmk_flags;
1410 } else {
1411 /* regular mapping for the middle */
1412 cur_vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
1413 }
1414 cur_end = vm_map_trunc_page(vm_start + (file_end -
1415 file_start),
1416 effective_page_mask);
1417 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1418 ret = vm_map_enter_mem_object_control(
1419 map,
1420 &cur_start,
1421 cur_end - cur_start,
1422 (mach_vm_offset_t)0,
1423 VM_FLAGS_FIXED,
1424 cur_vmk_flags,
1425 VM_KERN_MEMORY_NONE,
1426 control,
1427 file_start + cur_offset,
1428 TRUE, /* copy */
1429 initprot, maxprot,
1430 VM_INHERIT_DEFAULT);
1431 } else {
1432 ret = vm_map_enter_mem_object(
1433 map,
1434 &cur_start,
1435 cur_end - cur_start,
1436 (mach_vm_offset_t)0,
1437 VM_FLAGS_FIXED,
1438 cur_vmk_flags,
1439 VM_KERN_MEMORY_NONE,
1440 IPC_PORT_NULL,
1441 0, /* offset */
1442 TRUE, /* copy */
1443 initprot, maxprot,
1444 VM_INHERIT_DEFAULT);
1445 }
1446 if (ret != KERN_SUCCESS) {
1447 return (LOAD_NOSPACE);
1448 }
1449 cur_offset += cur_end - cur_start;
1450 }
1451 if (cur_end >= vm_start + (file_end - file_start)) {
1452 /* all mapped: done */
1453 goto done;
1454 }
1455 cur_start = cur_end;
1456 #if __arm64__
1457 if (!vm_map_page_aligned(vm_start + (file_end - file_start),
1458 effective_page_mask)) {
1459 /* one 4K pager for the last page */
1460 cur_end = vm_start + (file_end - file_start);
1461 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1462 ret = vm_map_enter_mem_object_control(
1463 map,
1464 &cur_start,
1465 cur_end - cur_start,
1466 (mach_vm_offset_t)0,
1467 VM_FLAGS_FIXED,
1468 vmk_flags,
1469 VM_KERN_MEMORY_NONE,
1470 control,
1471 file_start + cur_offset,
1472 TRUE, /* copy */
1473 initprot, maxprot,
1474 VM_INHERIT_DEFAULT);
1475 } else {
1476 ret = vm_map_enter_mem_object(
1477 map,
1478 &cur_start,
1479 cur_end - cur_start,
1480 (mach_vm_offset_t)0,
1481 VM_FLAGS_FIXED,
1482 vmk_flags,
1483 VM_KERN_MEMORY_NONE,
1484 IPC_PORT_NULL,
1485 0, /* offset */
1486 TRUE, /* copy */
1487 initprot, maxprot,
1488 VM_INHERIT_DEFAULT);
1489 }
1490 if (ret != KERN_SUCCESS) {
1491 return (LOAD_NOSPACE);
1492 }
1493 cur_offset += cur_end - cur_start;
1494 }
1495 #endif /* __arm64__ */
1496 done:
1497 assert(cur_end >= vm_start + (file_end - file_start));
1498 return LOAD_SUCCESS;
1499 }
1500
1501 static
1502 load_return_t
1503 load_segment(
1504 struct load_command *lcp,
1505 uint32_t filetype,
1506 void * control,
1507 off_t pager_offset,
1508 off_t macho_size,
1509 struct vnode *vp,
1510 vm_map_t map,
1511 int64_t slide,
1512 load_result_t *result)
1513 {
1514 struct segment_command_64 segment_command, *scp;
1515 kern_return_t ret;
1516 vm_map_size_t delta_size;
1517 vm_prot_t initprot;
1518 vm_prot_t maxprot;
1519 size_t segment_command_size, total_section_size,
1520 single_section_size;
1521 vm_map_offset_t file_offset, file_size;
1522 vm_map_offset_t vm_offset, vm_size;
1523 vm_map_offset_t vm_start, vm_end, vm_end_aligned;
1524 vm_map_offset_t file_start, file_end;
1525 kern_return_t kr;
1526 boolean_t verbose;
1527 vm_map_size_t effective_page_size;
1528 vm_map_offset_t effective_page_mask;
1529 #if __arm64__
1530 vm_map_kernel_flags_t vmk_flags;
1531 boolean_t fourk_align;
1532 #endif /* __arm64__ */
1533
1534 effective_page_size = MAX(PAGE_SIZE, vm_map_page_size(map));
1535 effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
1536
1537 verbose = FALSE;
1538 if (LC_SEGMENT_64 == lcp->cmd) {
1539 segment_command_size = sizeof(struct segment_command_64);
1540 single_section_size = sizeof(struct section_64);
1541 #if __arm64__
1542 /* 64-bit binary: should already be 16K-aligned */
1543 fourk_align = FALSE;
1544 #endif /* __arm64__ */
1545 } else {
1546 segment_command_size = sizeof(struct segment_command);
1547 single_section_size = sizeof(struct section);
1548 #if __arm64__
1549 /* 32-bit binary: might need 4K-alignment */
1550 if (effective_page_size != FOURK_PAGE_SIZE) {
1551 /* not using 4K page size: need fourk_pager */
1552 fourk_align = TRUE;
1553 verbose = TRUE;
1554 } else {
1555 /* using 4K page size: no need for re-alignment */
1556 fourk_align = FALSE;
1557 }
1558 #endif /* __arm64__ */
1559 }
1560 if (lcp->cmdsize < segment_command_size)
1561 return (LOAD_BADMACHO);
1562 total_section_size = lcp->cmdsize - segment_command_size;
1563
1564 if (LC_SEGMENT_64 == lcp->cmd) {
1565 scp = (struct segment_command_64 *)lcp;
1566 } else {
1567 scp = &segment_command;
1568 widen_segment_command((struct segment_command *)lcp, scp);
1569 }
1570
1571 if (verbose) {
1572 MACHO_PRINTF(("+++ load_segment %s "
1573 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx] "
1574 "prot %d/%d flags 0x%x\n",
1575 scp->segname,
1576 (uint64_t)(slide + scp->vmaddr),
1577 (uint64_t)(slide + scp->vmaddr + scp->vmsize),
1578 pager_offset + scp->fileoff,
1579 pager_offset + scp->fileoff + scp->filesize,
1580 scp->initprot,
1581 scp->maxprot,
1582 scp->flags));
1583 }
1584
1585 /*
1586 * Make sure what we get from the file is really ours (as specified
1587 * by macho_size).
1588 */
1589 if (scp->fileoff + scp->filesize < scp->fileoff ||
1590 scp->fileoff + scp->filesize > (uint64_t)macho_size) {
1591 return (LOAD_BADMACHO);
1592 }
1593 /*
1594 * Ensure that the number of sections specified would fit
1595 * within the load command size.
1596 */
1597 if (total_section_size / single_section_size < scp->nsects) {
1598 return (LOAD_BADMACHO);
1599 }
1600 /*
1601 * Make sure the segment is page-aligned in the file.
1602 */
1603 file_offset = pager_offset + scp->fileoff; /* limited to 32 bits */
1604 file_size = scp->filesize;
1605 #if __arm64__
1606 if (fourk_align) {
1607 if ((file_offset & FOURK_PAGE_MASK) != 0) {
1608 /*
1609 * we can't mmap() it if it's not at least 4KB-aligned
1610 * in the file
1611 */
1612 return LOAD_BADMACHO;
1613 }
1614 } else
1615 #endif /* __arm64__ */
1616 if ((file_offset & PAGE_MASK_64) != 0 ||
1617 /* we can't mmap() it if it's not page-aligned in the file */
1618 (file_offset & vm_map_page_mask(map)) != 0) {
1619 /*
1620 * The 1st test would have failed if the system's page size
1621 * was what this process believe is the page size, so let's
1622 * fail here too for the sake of consistency.
1623 */
1624 return (LOAD_BADMACHO);
1625 }
1626
1627 /*
1628 * If we have a code signature attached for this slice
1629 * require that the segments are within the signed part
1630 * of the file.
1631 */
1632 if (result->cs_end_offset &&
1633 result->cs_end_offset < (off_t)scp->fileoff &&
1634 result->cs_end_offset - scp->fileoff < scp->filesize)
1635 {
1636 if (cs_debug)
1637 printf("section outside code signature\n");
1638 return LOAD_BADMACHO;
1639 }
1640
1641 vm_offset = scp->vmaddr + slide;
1642 vm_size = scp->vmsize;
1643
1644 if (vm_size == 0)
1645 return (LOAD_SUCCESS);
1646 if (scp->vmaddr == 0 &&
1647 file_size == 0 &&
1648 vm_size != 0 &&
1649 (scp->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
1650 (scp->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
1651 /*
1652 * For PIE, extend page zero rather than moving it. Extending
1653 * page zero keeps early allocations from falling predictably
1654 * between the end of page zero and the beginning of the first
1655 * slid segment.
1656 */
1657 /*
1658 * This is a "page zero" segment: it starts at address 0,
1659 * is not mapped from the binary file and is not accessible.
1660 * User-space should never be able to access that memory, so
1661 * make it completely off limits by raising the VM map's
1662 * minimum offset.
1663 */
1664 vm_end = vm_offset + vm_size;
1665 if (vm_end < vm_offset) {
1666 return (LOAD_BADMACHO);
1667 }
1668 if (verbose) {
1669 MACHO_PRINTF(("++++++ load_segment: "
1670 "page_zero up to 0x%llx\n",
1671 (uint64_t) vm_end));
1672 }
1673 #if __arm64__
1674 if (fourk_align) {
1675 /* raise min_offset as much as page-alignment allows */
1676 vm_end_aligned = vm_map_trunc_page(vm_end,
1677 effective_page_mask);
1678 } else
1679 #endif /* __arm64__ */
1680 {
1681 vm_end = vm_map_round_page(vm_end,
1682 PAGE_MASK_64);
1683 vm_end_aligned = vm_end;
1684 }
1685 ret = vm_map_raise_min_offset(map,
1686 vm_end_aligned);
1687 #if __arm64__
1688 if (ret == 0 &&
1689 vm_end > vm_end_aligned) {
1690 /* use fourk_pager to map the rest of pagezero */
1691 assert(fourk_align);
1692 vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
1693 vmk_flags.vmkf_fourk = TRUE;
1694 ret = vm_map_enter_mem_object(
1695 map,
1696 &vm_end_aligned,
1697 vm_end - vm_end_aligned,
1698 (mach_vm_offset_t) 0, /* mask */
1699 VM_FLAGS_FIXED,
1700 vmk_flags,
1701 VM_KERN_MEMORY_NONE,
1702 IPC_PORT_NULL,
1703 0,
1704 FALSE, /* copy */
1705 (scp->initprot & VM_PROT_ALL),
1706 (scp->maxprot & VM_PROT_ALL),
1707 VM_INHERIT_DEFAULT);
1708 }
1709 #endif /* __arm64__ */
1710
1711 if (ret != KERN_SUCCESS) {
1712 return (LOAD_FAILURE);
1713 }
1714 return (LOAD_SUCCESS);
1715 } else {
1716 #if CONFIG_EMBEDDED
1717 /* not PAGEZERO: should not be mapped at address 0 */
1718 if (filetype != MH_DYLINKER && scp->vmaddr == 0) {
1719 return LOAD_BADMACHO;
1720 }
1721 #endif /* CONFIG_EMBEDDED */
1722 }
1723
1724 #if __arm64__
1725 if (fourk_align) {
1726 /* 4K-align */
1727 file_start = vm_map_trunc_page(file_offset,
1728 FOURK_PAGE_MASK);
1729 file_end = vm_map_round_page(file_offset + file_size,
1730 FOURK_PAGE_MASK);
1731 vm_start = vm_map_trunc_page(vm_offset,
1732 FOURK_PAGE_MASK);
1733 vm_end = vm_map_round_page(vm_offset + vm_size,
1734 FOURK_PAGE_MASK);
1735 if (!strncmp(scp->segname, "__LINKEDIT", 11) &&
1736 page_aligned(file_start) &&
1737 vm_map_page_aligned(file_start, vm_map_page_mask(map)) &&
1738 page_aligned(vm_start) &&
1739 vm_map_page_aligned(vm_start, vm_map_page_mask(map))) {
1740 /* XXX last segment: ignore mis-aligned tail */
1741 file_end = vm_map_round_page(file_end,
1742 effective_page_mask);
1743 vm_end = vm_map_round_page(vm_end,
1744 effective_page_mask);
1745 }
1746 } else
1747 #endif /* __arm64__ */
1748 {
1749 file_start = vm_map_trunc_page(file_offset,
1750 effective_page_mask);
1751 file_end = vm_map_round_page(file_offset + file_size,
1752 effective_page_mask);
1753 vm_start = vm_map_trunc_page(vm_offset,
1754 effective_page_mask);
1755 vm_end = vm_map_round_page(vm_offset + vm_size,
1756 effective_page_mask);
1757 }
1758
1759 if (vm_start < result->min_vm_addr)
1760 result->min_vm_addr = vm_start;
1761 if (vm_end > result->max_vm_addr)
1762 result->max_vm_addr = vm_end;
1763
1764 if (map == VM_MAP_NULL)
1765 return (LOAD_SUCCESS);
1766
1767 if (vm_size > 0) {
1768 initprot = (scp->initprot) & VM_PROT_ALL;
1769 maxprot = (scp->maxprot) & VM_PROT_ALL;
1770 /*
1771 * Map a copy of the file into the address space.
1772 */
1773 if (verbose) {
1774 MACHO_PRINTF(("++++++ load_segment: "
1775 "mapping at vm [0x%llx:0x%llx] of "
1776 "file [0x%llx:0x%llx]\n",
1777 (uint64_t) vm_start,
1778 (uint64_t) vm_end,
1779 (uint64_t) file_start,
1780 (uint64_t) file_end));
1781 }
1782 ret = map_segment(map,
1783 vm_start,
1784 vm_end,
1785 control,
1786 file_start,
1787 file_end,
1788 initprot,
1789 maxprot);
1790 if (ret) {
1791 return LOAD_NOSPACE;
1792 }
1793
1794 #if FIXME
1795 /*
1796 * If the file didn't end on a page boundary,
1797 * we need to zero the leftover.
1798 */
1799 delta_size = map_size - scp->filesize;
1800 if (delta_size > 0) {
1801 mach_vm_offset_t tmp;
1802
1803 ret = mach_vm_allocate_kernel(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE, VM_KERN_MEMORY_BSD);
1804 if (ret != KERN_SUCCESS) {
1805 return(LOAD_RESOURCE);
1806 }
1807
1808 if (copyout(tmp, map_addr + scp->filesize,
1809 delta_size)) {
1810 (void) mach_vm_deallocate(
1811 kernel_map, tmp, delta_size);
1812 return (LOAD_FAILURE);
1813 }
1814
1815 (void) mach_vm_deallocate(kernel_map, tmp, delta_size);
1816 }
1817 #endif /* FIXME */
1818 }
1819
1820 /*
1821 * If the virtual size of the segment is greater
1822 * than the size from the file, we need to allocate
1823 * zero fill memory for the rest.
1824 */
1825 if ((vm_end - vm_start) > (file_end - file_start)) {
1826 delta_size = (vm_end - vm_start) - (file_end - file_start);
1827 } else {
1828 delta_size = 0;
1829 }
1830 if (delta_size > 0) {
1831 mach_vm_offset_t tmp;
1832
1833 tmp = vm_start + (file_end - file_start);
1834 if (verbose) {
1835 MACHO_PRINTF(("++++++ load_segment: "
1836 "delta mapping vm [0x%llx:0x%llx]\n",
1837 (uint64_t) tmp,
1838 (uint64_t) (tmp + delta_size)));
1839 }
1840 kr = map_segment(map,
1841 tmp,
1842 tmp + delta_size,
1843 MEMORY_OBJECT_CONTROL_NULL,
1844 0,
1845 delta_size,
1846 scp->initprot,
1847 scp->maxprot);
1848 if (kr != KERN_SUCCESS) {
1849 return(LOAD_NOSPACE);
1850 }
1851 }
1852
1853 if ( (scp->fileoff == 0) && (scp->filesize != 0) )
1854 result->mach_header = vm_offset;
1855
1856 if (scp->flags & SG_PROTECTED_VERSION_1) {
1857 ret = unprotect_dsmos_segment(file_start,
1858 file_end - file_start,
1859 vp,
1860 pager_offset,
1861 map,
1862 vm_start,
1863 vm_end - vm_start);
1864 if (ret != LOAD_SUCCESS) {
1865 return ret;
1866 }
1867 } else {
1868 ret = LOAD_SUCCESS;
1869 }
1870
1871 if (LOAD_SUCCESS == ret &&
1872 filetype == MH_DYLINKER &&
1873 result->all_image_info_addr == MACH_VM_MIN_ADDRESS) {
1874 note_all_image_info_section(scp,
1875 LC_SEGMENT_64 == lcp->cmd,
1876 single_section_size,
1877 ((const char *)lcp +
1878 segment_command_size),
1879 slide,
1880 result);
1881 }
1882
1883 if (result->entry_point != MACH_VM_MIN_ADDRESS) {
1884 if ((result->entry_point >= vm_offset) && (result->entry_point < (vm_offset + vm_size))) {
1885 if ((scp->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) == (VM_PROT_READ|VM_PROT_EXECUTE)) {
1886 result->validentry = 1;
1887 } else {
1888 /* right range but wrong protections, unset if previously validated */
1889 result->validentry = 0;
1890 }
1891 }
1892 }
1893
1894 return ret;
1895 }
1896
1897 static
1898 load_return_t
1899 load_uuid(
1900 struct uuid_command *uulp,
1901 char *command_end,
1902 load_result_t *result
1903 )
1904 {
1905 /*
1906 * We need to check the following for this command:
1907 * - The command size should be atleast the size of struct uuid_command
1908 * - The UUID part of the command should be completely within the mach-o header
1909 */
1910
1911 if ((uulp->cmdsize < sizeof(struct uuid_command)) ||
1912 (((char *)uulp + sizeof(struct uuid_command)) > command_end)) {
1913 return (LOAD_BADMACHO);
1914 }
1915
1916 memcpy(&result->uuid[0], &uulp->uuid[0], sizeof(result->uuid));
1917 return (LOAD_SUCCESS);
1918 }
1919
1920 static
1921 load_return_t
1922 load_main(
1923 struct entry_point_command *epc,
1924 thread_t thread,
1925 int64_t slide,
1926 load_result_t *result
1927 )
1928 {
1929 mach_vm_offset_t addr;
1930 kern_return_t ret;
1931
1932 if (epc->cmdsize < sizeof(*epc))
1933 return (LOAD_BADMACHO);
1934 if (result->thread_count != 0) {
1935 return (LOAD_FAILURE);
1936 }
1937
1938 if (thread == THREAD_NULL)
1939 return (LOAD_SUCCESS);
1940
1941 /*
1942 * LC_MAIN specifies stack size but not location.
1943 * Add guard page to allocation size (MAXSSIZ includes guard page).
1944 */
1945 if (epc->stacksize) {
1946 if (os_add_overflow(epc->stacksize, 4*PAGE_SIZE, &result->user_stack_size)) {
1947 /*
1948 * We are going to immediately throw away this result, but we want
1949 * to make sure we aren't loading a dangerously close to
1950 * overflowing value, since this will have a guard page added to it
1951 * and be rounded to page boundaries
1952 */
1953 return LOAD_BADMACHO;
1954 }
1955 result->user_stack_size = epc->stacksize;
1956 if (os_add_overflow(epc->stacksize, PAGE_SIZE, &result->user_stack_alloc_size)) {
1957 return LOAD_BADMACHO;
1958 }
1959 } else {
1960 result->user_stack_alloc_size = MAXSSIZ;
1961 }
1962
1963 /* use default location for stack */
1964 ret = thread_userstackdefault(&addr, result->is64bit);
1965 if (ret != KERN_SUCCESS)
1966 return(LOAD_FAILURE);
1967
1968 /* The stack slides down from the default location */
1969 result->user_stack = addr;
1970 result->user_stack -= slide;
1971
1972 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
1973 /* Already processed LC_MAIN or LC_UNIXTHREAD */
1974 return (LOAD_FAILURE);
1975 }
1976
1977 /* kernel does *not* use entryoff from LC_MAIN. Dyld uses it. */
1978 result->needs_dynlinker = TRUE;
1979 result->using_lcmain = TRUE;
1980
1981 ret = thread_state_initialize( thread );
1982 if (ret != KERN_SUCCESS) {
1983 return(LOAD_FAILURE);
1984 }
1985
1986 result->unixproc = TRUE;
1987 result->thread_count++;
1988
1989 return(LOAD_SUCCESS);
1990 }
1991
1992
1993 static
1994 load_return_t
1995 load_unixthread(
1996 struct thread_command *tcp,
1997 thread_t thread,
1998 int64_t slide,
1999 load_result_t *result
2000 )
2001 {
2002 load_return_t ret;
2003 int customstack =0;
2004 mach_vm_offset_t addr;
2005
2006 if (tcp->cmdsize < sizeof(*tcp))
2007 return (LOAD_BADMACHO);
2008 if (result->thread_count != 0) {
2009 return (LOAD_FAILURE);
2010 }
2011
2012 if (thread == THREAD_NULL)
2013 return (LOAD_SUCCESS);
2014
2015 ret = load_threadstack(thread,
2016 (uint32_t *)(((vm_offset_t)tcp) +
2017 sizeof(struct thread_command)),
2018 tcp->cmdsize - sizeof(struct thread_command),
2019 &addr, &customstack, result);
2020 if (ret != LOAD_SUCCESS)
2021 return(ret);
2022
2023 /* LC_UNIXTHREAD optionally specifies stack size and location */
2024
2025 if (!customstack) {
2026 result->user_stack_alloc_size = MAXSSIZ;
2027 }
2028
2029 /* The stack slides down from the default location */
2030 result->user_stack = addr;
2031 result->user_stack -= slide;
2032
2033 ret = load_threadentry(thread,
2034 (uint32_t *)(((vm_offset_t)tcp) +
2035 sizeof(struct thread_command)),
2036 tcp->cmdsize - sizeof(struct thread_command),
2037 &addr);
2038 if (ret != LOAD_SUCCESS)
2039 return(ret);
2040
2041 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
2042 /* Already processed LC_MAIN or LC_UNIXTHREAD */
2043 return (LOAD_FAILURE);
2044 }
2045
2046 result->entry_point = addr;
2047 result->entry_point += slide;
2048
2049 ret = load_threadstate(thread,
2050 (uint32_t *)(((vm_offset_t)tcp) + sizeof(struct thread_command)),
2051 tcp->cmdsize - sizeof(struct thread_command),
2052 result);
2053 if (ret != LOAD_SUCCESS)
2054 return (ret);
2055
2056 result->unixproc = TRUE;
2057 result->thread_count++;
2058
2059 return(LOAD_SUCCESS);
2060 }
2061
2062 static
2063 load_return_t
2064 load_threadstate(
2065 thread_t thread,
2066 uint32_t *ts,
2067 uint32_t total_size,
2068 load_result_t *result
2069 )
2070 {
2071 uint32_t size;
2072 int flavor;
2073 uint32_t thread_size;
2074 uint32_t *local_ts = NULL;
2075 uint32_t local_ts_size = 0;
2076 int ret;
2077
2078 (void)thread;
2079
2080 if (total_size > 0) {
2081 local_ts_size = total_size;
2082 local_ts = kalloc(local_ts_size);
2083 if (local_ts == NULL) {
2084 return LOAD_FAILURE;
2085 }
2086 memcpy(local_ts, ts, local_ts_size);
2087 ts = local_ts;
2088 }
2089
2090 /*
2091 * Validate the new thread state; iterate through the state flavors in
2092 * the Mach-O file.
2093 * XXX: we should validate the machine state here, to avoid failing at
2094 * activation time where we can't bail out cleanly.
2095 */
2096 while (total_size > 0) {
2097 flavor = *ts++;
2098 size = *ts++;
2099
2100 if (os_add_and_mul_overflow(size, 2, sizeof(uint32_t), &thread_size) ||
2101 os_sub_overflow(total_size, thread_size, &total_size)) {
2102 ret = LOAD_BADMACHO;
2103 goto bad;
2104 }
2105
2106 ts += size; /* ts is a (uint32_t *) */
2107 }
2108
2109 result->threadstate = local_ts;
2110 result->threadstate_sz = local_ts_size;
2111 return LOAD_SUCCESS;
2112
2113 bad:
2114 if (local_ts) {
2115 kfree(local_ts, local_ts_size);
2116 }
2117 return ret;
2118 }
2119
2120 static
2121 load_return_t
2122 load_threadstack(
2123 thread_t thread,
2124 uint32_t *ts,
2125 uint32_t total_size,
2126 mach_vm_offset_t *user_stack,
2127 int *customstack,
2128 load_result_t *result
2129 )
2130 {
2131 kern_return_t ret;
2132 uint32_t size;
2133 int flavor;
2134 uint32_t stack_size;
2135
2136 while (total_size > 0) {
2137 flavor = *ts++;
2138 size = *ts++;
2139 if (UINT32_MAX-2 < size ||
2140 UINT32_MAX/sizeof(uint32_t) < size+2)
2141 return (LOAD_BADMACHO);
2142 stack_size = (size+2)*sizeof(uint32_t);
2143 if (stack_size > total_size)
2144 return(LOAD_BADMACHO);
2145 total_size -= stack_size;
2146
2147 /*
2148 * Third argument is a kernel space pointer; it gets cast
2149 * to the appropriate type in thread_userstack() based on
2150 * the value of flavor.
2151 */
2152 ret = thread_userstack(thread, flavor, (thread_state_t)ts, size, user_stack, customstack, result->is64bit);
2153 if (ret != KERN_SUCCESS) {
2154 return(LOAD_FAILURE);
2155 }
2156 ts += size; /* ts is a (uint32_t *) */
2157 }
2158 return(LOAD_SUCCESS);
2159 }
2160
2161 static
2162 load_return_t
2163 load_threadentry(
2164 thread_t thread,
2165 uint32_t *ts,
2166 uint32_t total_size,
2167 mach_vm_offset_t *entry_point
2168 )
2169 {
2170 kern_return_t ret;
2171 uint32_t size;
2172 int flavor;
2173 uint32_t entry_size;
2174
2175 /*
2176 * Set the thread state.
2177 */
2178 *entry_point = MACH_VM_MIN_ADDRESS;
2179 while (total_size > 0) {
2180 flavor = *ts++;
2181 size = *ts++;
2182 if (UINT32_MAX-2 < size ||
2183 UINT32_MAX/sizeof(uint32_t) < size+2)
2184 return (LOAD_BADMACHO);
2185 entry_size = (size+2)*sizeof(uint32_t);
2186 if (entry_size > total_size)
2187 return(LOAD_BADMACHO);
2188 total_size -= entry_size;
2189 /*
2190 * Third argument is a kernel space pointer; it gets cast
2191 * to the appropriate type in thread_entrypoint() based on
2192 * the value of flavor.
2193 */
2194 ret = thread_entrypoint(thread, flavor, (thread_state_t)ts, size, entry_point);
2195 if (ret != KERN_SUCCESS) {
2196 return(LOAD_FAILURE);
2197 }
2198 ts += size; /* ts is a (uint32_t *) */
2199 }
2200 return(LOAD_SUCCESS);
2201 }
2202
2203 struct macho_data {
2204 struct nameidata __nid;
2205 union macho_vnode_header {
2206 struct mach_header mach_header;
2207 struct fat_header fat_header;
2208 char __pad[512];
2209 } __header;
2210 };
2211
2212 #define DEFAULT_DYLD_PATH "/usr/lib/dyld"
2213
2214 #if (DEVELOPMENT || DEBUG)
2215 extern char dyld_alt_path[];
2216 extern int use_alt_dyld;
2217 #endif
2218
2219 static uint64_t get_va_fsid(struct vnode_attr *vap)
2220 {
2221 if (VATTR_IS_SUPPORTED(vap, va_fsid64)) {
2222 return *(uint64_t *)&vap->va_fsid64;
2223 } else {
2224 return vap->va_fsid;
2225 }
2226 }
2227
2228 static load_return_t
2229 load_dylinker(
2230 struct dylinker_command *lcp,
2231 integer_t archbits,
2232 vm_map_t map,
2233 thread_t thread,
2234 int depth,
2235 int64_t slide,
2236 load_result_t *result,
2237 struct image_params *imgp
2238 )
2239 {
2240 const char *name;
2241 struct vnode *vp = NULLVP; /* set by get_macho_vnode() */
2242 struct mach_header *header;
2243 off_t file_offset = 0; /* set by get_macho_vnode() */
2244 off_t macho_size = 0; /* set by get_macho_vnode() */
2245 load_result_t *myresult;
2246 kern_return_t ret;
2247 struct macho_data *macho_data;
2248 struct {
2249 struct mach_header __header;
2250 load_result_t __myresult;
2251 struct macho_data __macho_data;
2252 } *dyld_data;
2253
2254 if (lcp->cmdsize < sizeof(*lcp) || lcp->name.offset >= lcp->cmdsize)
2255 return LOAD_BADMACHO;
2256
2257 name = (const char *)lcp + lcp->name.offset;
2258
2259 /* Check for a proper null terminated string. */
2260 size_t maxsz = lcp->cmdsize - lcp->name.offset;
2261 size_t namelen = strnlen(name, maxsz);
2262 if (namelen >= maxsz) {
2263 return LOAD_BADMACHO;
2264 }
2265
2266 #if (DEVELOPMENT || DEBUG)
2267
2268 /*
2269 * rdar://23680808
2270 * If an alternate dyld has been specified via boot args, check
2271 * to see if PROC_UUID_ALT_DYLD_POLICY has been set on this
2272 * executable and redirect the kernel to load that linker.
2273 */
2274
2275 if (use_alt_dyld) {
2276 int policy_error;
2277 uint32_t policy_flags = 0;
2278 int32_t policy_gencount = 0;
2279
2280 policy_error = proc_uuid_policy_lookup(result->uuid, &policy_flags, &policy_gencount);
2281 if (policy_error == 0) {
2282 if (policy_flags & PROC_UUID_ALT_DYLD_POLICY) {
2283 name = dyld_alt_path;
2284 }
2285 }
2286 }
2287 #endif
2288
2289 #if !(DEVELOPMENT || DEBUG)
2290 if (0 != strcmp(name, DEFAULT_DYLD_PATH)) {
2291 return (LOAD_BADMACHO);
2292 }
2293 #endif
2294
2295 /* Allocate wad-of-data from heap to reduce excessively deep stacks */
2296
2297 MALLOC(dyld_data, void *, sizeof (*dyld_data), M_TEMP, M_WAITOK);
2298 header = &dyld_data->__header;
2299 myresult = &dyld_data->__myresult;
2300 macho_data = &dyld_data->__macho_data;
2301
2302 ret = get_macho_vnode(name, archbits, header,
2303 &file_offset, &macho_size, macho_data, &vp);
2304 if (ret)
2305 goto novp_out;
2306
2307 *myresult = load_result_null;
2308 myresult->is64bit = result->is64bit;
2309
2310 ret = parse_machfile(vp, map, thread, header, file_offset,
2311 macho_size, depth, slide, 0, myresult, result, imgp);
2312
2313 if (ret == LOAD_SUCCESS) {
2314 if (result->threadstate) {
2315 /* don't use the app's threadstate if we have a dyld */
2316 kfree(result->threadstate, result->threadstate_sz);
2317 }
2318 result->threadstate = myresult->threadstate;
2319 result->threadstate_sz = myresult->threadstate_sz;
2320
2321 result->dynlinker = TRUE;
2322 result->entry_point = myresult->entry_point;
2323 result->validentry = myresult->validentry;
2324 result->all_image_info_addr = myresult->all_image_info_addr;
2325 result->all_image_info_size = myresult->all_image_info_size;
2326 if (myresult->platform_binary) {
2327 result->csflags |= CS_DYLD_PLATFORM;
2328 }
2329 }
2330
2331 struct vnode_attr va;
2332 VATTR_INIT(&va);
2333 VATTR_WANTED(&va, va_fsid64);
2334 VATTR_WANTED(&va, va_fsid);
2335 VATTR_WANTED(&va, va_fileid);
2336 int error = vnode_getattr(vp, &va, imgp->ip_vfs_context);
2337 if (error == 0) {
2338 imgp->ip_dyld_fsid = get_va_fsid(&va);
2339 imgp->ip_dyld_fsobjid = va.va_fileid;
2340 }
2341
2342 vnode_put(vp);
2343 novp_out:
2344 FREE(dyld_data, M_TEMP);
2345 return (ret);
2346
2347 }
2348
2349 static load_return_t
2350 load_code_signature(
2351 struct linkedit_data_command *lcp,
2352 struct vnode *vp,
2353 off_t macho_offset,
2354 off_t macho_size,
2355 cpu_type_t cputype,
2356 load_result_t *result,
2357 struct image_params *imgp)
2358 {
2359 int ret;
2360 kern_return_t kr;
2361 vm_offset_t addr;
2362 int resid;
2363 struct cs_blob *blob;
2364 int error;
2365 vm_size_t blob_size;
2366
2367 addr = 0;
2368 blob = NULL;
2369
2370 if (lcp->cmdsize != sizeof (struct linkedit_data_command) ||
2371 lcp->dataoff + lcp->datasize > macho_size) {
2372 ret = LOAD_BADMACHO;
2373 goto out;
2374 }
2375
2376 blob = ubc_cs_blob_get(vp, cputype, macho_offset);
2377 if (blob != NULL) {
2378 /* we already have a blob for this vnode and cputype */
2379 if (blob->csb_cpu_type == cputype &&
2380 blob->csb_base_offset == macho_offset) {
2381 /* it matches the blob we want here, lets verify the version */
2382 if(0 != ubc_cs_generation_check(vp)) {
2383 if (0 != ubc_cs_blob_revalidate(vp, blob, imgp, 0)) {
2384 ret = LOAD_FAILURE; /* set error same as from ubc_cs_blob_add */
2385 goto out;
2386 }
2387 }
2388 ret = LOAD_SUCCESS;
2389 } else {
2390 /* the blob has changed for this vnode: fail ! */
2391 ret = LOAD_BADMACHO;
2392 }
2393 goto out;
2394 }
2395
2396 blob_size = lcp->datasize;
2397 kr = ubc_cs_blob_allocate(&addr, &blob_size);
2398 if (kr != KERN_SUCCESS) {
2399 ret = LOAD_NOSPACE;
2400 goto out;
2401 }
2402
2403 resid = 0;
2404 error = vn_rdwr(UIO_READ,
2405 vp,
2406 (caddr_t) addr,
2407 lcp->datasize,
2408 macho_offset + lcp->dataoff,
2409 UIO_SYSSPACE,
2410 0,
2411 kauth_cred_get(),
2412 &resid,
2413 current_proc());
2414 if (error || resid != 0) {
2415 ret = LOAD_IOERROR;
2416 goto out;
2417 }
2418
2419 if (ubc_cs_blob_add(vp,
2420 cputype,
2421 macho_offset,
2422 &addr,
2423 lcp->datasize,
2424 imgp,
2425 0,
2426 &blob)) {
2427 if (addr) {
2428 ubc_cs_blob_deallocate(addr, blob_size);
2429 }
2430 ret = LOAD_FAILURE;
2431 goto out;
2432 } else {
2433 /* ubc_cs_blob_add() has consumed "addr" */
2434 addr = 0;
2435 }
2436
2437 #if CHECK_CS_VALIDATION_BITMAP
2438 ubc_cs_validation_bitmap_allocate( vp );
2439 #endif
2440
2441 ret = LOAD_SUCCESS;
2442 out:
2443 if (ret == LOAD_SUCCESS) {
2444 if (blob == NULL)
2445 panic("success, but no blob!");
2446
2447 result->csflags |= blob->csb_flags;
2448 result->platform_binary = blob->csb_platform_binary;
2449 result->cs_end_offset = blob->csb_end_offset;
2450 }
2451 if (addr != 0) {
2452 ubc_cs_blob_deallocate(addr, blob_size);
2453 addr = 0;
2454 }
2455
2456 return ret;
2457 }
2458
2459
2460 #if CONFIG_CODE_DECRYPTION
2461
2462 static load_return_t
2463 set_code_unprotect(
2464 struct encryption_info_command *eip,
2465 caddr_t addr,
2466 vm_map_t map,
2467 int64_t slide,
2468 struct vnode *vp,
2469 off_t macho_offset,
2470 cpu_type_t cputype,
2471 cpu_subtype_t cpusubtype)
2472 {
2473 int error, len;
2474 pager_crypt_info_t crypt_info;
2475 const char * cryptname = 0;
2476 char *vpath;
2477
2478 size_t offset;
2479 struct segment_command_64 *seg64;
2480 struct segment_command *seg32;
2481 vm_map_offset_t map_offset, map_size;
2482 vm_object_offset_t crypto_backing_offset;
2483 kern_return_t kr;
2484
2485 if (eip->cmdsize < sizeof(*eip)) return LOAD_BADMACHO;
2486
2487 switch(eip->cryptid) {
2488 case 0:
2489 /* not encrypted, just an empty load command */
2490 return LOAD_SUCCESS;
2491 case 1:
2492 cryptname="com.apple.unfree";
2493 break;
2494 case 0x10:
2495 /* some random cryptid that you could manually put into
2496 * your binary if you want NULL */
2497 cryptname="com.apple.null";
2498 break;
2499 default:
2500 return LOAD_BADMACHO;
2501 }
2502
2503 if (map == VM_MAP_NULL) return (LOAD_SUCCESS);
2504 if (NULL == text_crypter_create) return LOAD_FAILURE;
2505
2506 MALLOC_ZONE(vpath, char *, MAXPATHLEN, M_NAMEI, M_WAITOK);
2507 if(vpath == NULL) return LOAD_FAILURE;
2508
2509 len = MAXPATHLEN;
2510 error = vn_getpath(vp, vpath, &len);
2511 if (error) {
2512 FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
2513 return LOAD_FAILURE;
2514 }
2515
2516 /* set up decrypter first */
2517 crypt_file_data_t crypt_data = {
2518 .filename = vpath,
2519 .cputype = cputype,
2520 .cpusubtype = cpusubtype};
2521 kr=text_crypter_create(&crypt_info, cryptname, (void*)&crypt_data);
2522 #if VM_MAP_DEBUG_APPLE_PROTECT
2523 if (vm_map_debug_apple_protect) {
2524 struct proc *p;
2525 p = current_proc();
2526 printf("APPLE_PROTECT: %d[%s] map %p %s(%s) -> 0x%x\n",
2527 p->p_pid, p->p_comm, map, __FUNCTION__, vpath, kr);
2528 }
2529 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
2530 FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
2531
2532 if(kr) {
2533 printf("set_code_unprotect: unable to create decrypter %s, kr=%d\n",
2534 cryptname, kr);
2535 if (kr == kIOReturnNotPrivileged) {
2536 /* text encryption returned decryption failure */
2537 return(LOAD_DECRYPTFAIL);
2538 }else
2539 return LOAD_RESOURCE;
2540 }
2541
2542 /* this is terrible, but we have to rescan the load commands to find the
2543 * virtual address of this encrypted stuff. This code is gonna look like
2544 * the dyld source one day... */
2545 struct mach_header *header = (struct mach_header *)addr;
2546 size_t mach_header_sz = sizeof(struct mach_header);
2547 if (header->magic == MH_MAGIC_64 ||
2548 header->magic == MH_CIGAM_64) {
2549 mach_header_sz = sizeof(struct mach_header_64);
2550 }
2551 offset = mach_header_sz;
2552 uint32_t ncmds = header->ncmds;
2553 while (ncmds--) {
2554 /*
2555 * Get a pointer to the command.
2556 */
2557 struct load_command *lcp = (struct load_command *)(addr + offset);
2558 offset += lcp->cmdsize;
2559
2560 switch(lcp->cmd) {
2561 case LC_SEGMENT_64:
2562 seg64 = (struct segment_command_64 *)lcp;
2563 if ((seg64->fileoff <= eip->cryptoff) &&
2564 (seg64->fileoff+seg64->filesize >=
2565 eip->cryptoff+eip->cryptsize)) {
2566 map_offset = seg64->vmaddr + eip->cryptoff - seg64->fileoff + slide;
2567 map_size = eip->cryptsize;
2568 crypto_backing_offset = macho_offset + eip->cryptoff;
2569 goto remap_now;
2570 }
2571 case LC_SEGMENT:
2572 seg32 = (struct segment_command *)lcp;
2573 if ((seg32->fileoff <= eip->cryptoff) &&
2574 (seg32->fileoff+seg32->filesize >=
2575 eip->cryptoff+eip->cryptsize)) {
2576 map_offset = seg32->vmaddr + eip->cryptoff - seg32->fileoff + slide;
2577 map_size = eip->cryptsize;
2578 crypto_backing_offset = macho_offset + eip->cryptoff;
2579 goto remap_now;
2580 }
2581 }
2582 }
2583
2584 /* if we get here, did not find anything */
2585 return LOAD_BADMACHO;
2586
2587 remap_now:
2588 /* now remap using the decrypter */
2589 MACHO_PRINTF(("+++ set_code_unprotect: vm[0x%llx:0x%llx]\n",
2590 (uint64_t) map_offset,
2591 (uint64_t) (map_offset+map_size)));
2592 kr = vm_map_apple_protected(map,
2593 map_offset,
2594 map_offset+map_size,
2595 crypto_backing_offset,
2596 &crypt_info);
2597 if (kr) {
2598 printf("set_code_unprotect(): mapping failed with %x\n", kr);
2599 return LOAD_PROTECT;
2600 }
2601
2602 return LOAD_SUCCESS;
2603 }
2604
2605 #endif
2606
2607 /*
2608 * This routine exists to support the load_dylinker().
2609 *
2610 * This routine has its own, separate, understanding of the FAT file format,
2611 * which is terrifically unfortunate.
2612 */
2613 static
2614 load_return_t
2615 get_macho_vnode(
2616 const char *path,
2617 integer_t archbits,
2618 struct mach_header *mach_header,
2619 off_t *file_offset,
2620 off_t *macho_size,
2621 struct macho_data *data,
2622 struct vnode **vpp
2623 )
2624 {
2625 struct vnode *vp;
2626 vfs_context_t ctx = vfs_context_current();
2627 proc_t p = vfs_context_proc(ctx);
2628 kauth_cred_t kerncred;
2629 struct nameidata *ndp = &data->__nid;
2630 boolean_t is_fat;
2631 struct fat_arch fat_arch;
2632 int error;
2633 int resid;
2634 union macho_vnode_header *header = &data->__header;
2635 off_t fsize = (off_t)0;
2636
2637 /*
2638 * Capture the kernel credential for use in the actual read of the
2639 * file, since the user doing the execution may have execute rights
2640 * but not read rights, but to exec something, we have to either map
2641 * or read it into the new process address space, which requires
2642 * read rights. This is to deal with lack of common credential
2643 * serialization code which would treat NOCRED as "serialize 'root'".
2644 */
2645 kerncred = vfs_context_ucred(vfs_context_kernel());
2646
2647 /* init the namei data to point the file user's program name */
2648 NDINIT(ndp, LOOKUP, OP_OPEN, FOLLOW | LOCKLEAF, UIO_SYSSPACE, CAST_USER_ADDR_T(path), ctx);
2649
2650 if ((error = namei(ndp)) != 0) {
2651 if (error == ENOENT) {
2652 error = LOAD_ENOENT;
2653 } else {
2654 error = LOAD_FAILURE;
2655 }
2656 return(error);
2657 }
2658 nameidone(ndp);
2659 vp = ndp->ni_vp;
2660
2661 /* check for regular file */
2662 if (vp->v_type != VREG) {
2663 error = LOAD_PROTECT;
2664 goto bad1;
2665 }
2666
2667 /* get size */
2668 if ((error = vnode_size(vp, &fsize, ctx)) != 0) {
2669 error = LOAD_FAILURE;
2670 goto bad1;
2671 }
2672
2673 /* Check mount point */
2674 if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
2675 error = LOAD_PROTECT;
2676 goto bad1;
2677 }
2678
2679 /* check access */
2680 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_EXECUTE | KAUTH_VNODE_READ_DATA, ctx)) != 0) {
2681 error = LOAD_PROTECT;
2682 goto bad1;
2683 }
2684
2685 /* try to open it */
2686 if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
2687 error = LOAD_PROTECT;
2688 goto bad1;
2689 }
2690
2691 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)header, sizeof (*header), 0,
2692 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p)) != 0) {
2693 error = LOAD_IOERROR;
2694 goto bad2;
2695 }
2696
2697 if (resid) {
2698 error = LOAD_BADMACHO;
2699 goto bad2;
2700 }
2701
2702 if (header->mach_header.magic == MH_MAGIC ||
2703 header->mach_header.magic == MH_MAGIC_64) {
2704 is_fat = FALSE;
2705 } else if (OSSwapBigToHostInt32(header->fat_header.magic) == FAT_MAGIC) {
2706 is_fat = TRUE;
2707 } else {
2708 error = LOAD_BADMACHO;
2709 goto bad2;
2710 }
2711
2712 if (is_fat) {
2713
2714 error = fatfile_validate_fatarches((vm_offset_t)(&header->fat_header),
2715 sizeof(*header));
2716 if (error != LOAD_SUCCESS) {
2717 goto bad2;
2718 }
2719
2720 /* Look up our architecture in the fat file. */
2721 error = fatfile_getarch_with_bits(archbits,
2722 (vm_offset_t)(&header->fat_header), sizeof(*header), &fat_arch);
2723 if (error != LOAD_SUCCESS)
2724 goto bad2;
2725
2726 /* Read the Mach-O header out of it */
2727 error = vn_rdwr(UIO_READ, vp, (caddr_t)&header->mach_header,
2728 sizeof (header->mach_header), fat_arch.offset,
2729 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p);
2730 if (error) {
2731 error = LOAD_IOERROR;
2732 goto bad2;
2733 }
2734
2735 if (resid) {
2736 error = LOAD_BADMACHO;
2737 goto bad2;
2738 }
2739
2740 /* Is this really a Mach-O? */
2741 if (header->mach_header.magic != MH_MAGIC &&
2742 header->mach_header.magic != MH_MAGIC_64) {
2743 error = LOAD_BADMACHO;
2744 goto bad2;
2745 }
2746
2747 *file_offset = fat_arch.offset;
2748 *macho_size = fat_arch.size;
2749 } else {
2750 /*
2751 * Force get_macho_vnode() to fail if the architecture bits
2752 * do not match the expected architecture bits. This in
2753 * turn causes load_dylinker() to fail for the same reason,
2754 * so it ensures the dynamic linker and the binary are in
2755 * lock-step. This is potentially bad, if we ever add to
2756 * the CPU_ARCH_* bits any bits that are desirable but not
2757 * required, since the dynamic linker might work, but we will
2758 * refuse to load it because of this check.
2759 */
2760 if ((cpu_type_t)(header->mach_header.cputype & CPU_ARCH_MASK) != archbits) {
2761 error = LOAD_BADARCH;
2762 goto bad2;
2763 }
2764
2765 *file_offset = 0;
2766 *macho_size = fsize;
2767 }
2768
2769 *mach_header = header->mach_header;
2770 *vpp = vp;
2771
2772 ubc_setsize(vp, fsize);
2773 return (error);
2774
2775 bad2:
2776 (void) VNOP_CLOSE(vp, FREAD, ctx);
2777 bad1:
2778 vnode_put(vp);
2779 return(error);
2780 }
mirror of XNU