]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/mach_loader.c
projects / apple / xnu.git / blob
? search:


47253a898b268ca575643d8055bdfa6442133395
[apple/xnu.git] / bsd / kern / mach_loader.c
1 /*
2 * Copyright (c) 2000-2010 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (C) 1988, 1989, NeXT, Inc.
30 *
31 * File: kern/mach_loader.c
32 * Author: Avadis Tevanian, Jr.
33 *
34 * Mach object file loader (kernel version, for now).
35 *
36 * 21-Jul-88 Avadis Tevanian, Jr. (avie) at NeXT
37 * Started.
38 */
39
40 #include <sys/param.h>
41 #include <sys/vnode_internal.h>
42 #include <sys/uio.h>
43 #include <sys/namei.h>
44 #include <sys/proc_internal.h>
45 #include <sys/kauth.h>
46 #include <sys/stat.h>
47 #include <sys/malloc.h>
48 #include <sys/mount_internal.h>
49 #include <sys/fcntl.h>
50 #include <sys/ubc_internal.h>
51 #include <sys/imgact.h>
52
53 #include <mach/mach_types.h>
54 #include <mach/vm_map.h> /* vm_allocate() */
55 #include <mach/mach_vm.h> /* mach_vm_allocate() */
56 #include <mach/vm_statistics.h>
57 #include <mach/task.h>
58 #include <mach/thread_act.h>
59
60 #include <machine/vmparam.h>
61 #include <machine/exec.h>
62 #include <machine/pal_routines.h>
63
64 #include <kern/kern_types.h>
65 #include <kern/cpu_number.h>
66 #include <kern/mach_loader.h>
67 #include <kern/mach_fat.h>
68 #include <kern/kalloc.h>
69 #include <kern/task.h>
70 #include <kern/thread.h>
71 #include <kern/page_decrypt.h>
72
73 #include <mach-o/fat.h>
74 #include <mach-o/loader.h>
75
76 #include <vm/pmap.h>
77 #include <vm/vm_map.h>
78 #include <vm/vm_kern.h>
79 #include <vm/vm_pager.h>
80 #include <vm/vnode_pager.h>
81 #include <vm/vm_protos.h>
82
83 /*
84 * XXX vm/pmap.h should not treat these prototypes as MACH_KERNEL_PRIVATE
85 * when KERNEL is defined.
86 */
87 extern pmap_t pmap_create(vm_map_size_t size, boolean_t is_64bit);
88 extern void pmap_switch(pmap_t);
89
90 /*
91 * XXX kern/thread.h should not treat these prototypes as MACH_KERNEL_PRIVATE
92 * when KERNEL is defined.
93 */
94 extern kern_return_t thread_setstatus(thread_t thread, int flavor,
95 thread_state_t tstate,
96 mach_msg_type_number_t count);
97
98 extern kern_return_t thread_state_initialize(thread_t thread);
99
100
101 /* XXX should have prototypes in a shared header file */
102 extern int get_map_nentries(vm_map_t);
103
104 extern kern_return_t memory_object_signed(memory_object_control_t control,
105 boolean_t is_signed);
106
107 /* An empty load_result_t */
108 static load_result_t load_result_null = {
109 .mach_header = MACH_VM_MIN_ADDRESS,
110 .entry_point = MACH_VM_MIN_ADDRESS,
111 .user_stack = MACH_VM_MIN_ADDRESS,
112 .all_image_info_addr = MACH_VM_MIN_ADDRESS,
113 .all_image_info_size = 0,
114 .thread_count = 0,
115 .unixproc = 0,
116 .dynlinker = 0,
117 .customstack = 0,
118 .validentry = 0,
119 .csflags = 0,
120 .uuid = { 0 },
121 .min_vm_addr = MACH_VM_MAX_ADDRESS,
122 .max_vm_addr = MACH_VM_MIN_ADDRESS
123 };
124
125 /*
126 * Prototypes of static functions.
127 */
128 static load_return_t
129 parse_machfile(
130 struct vnode *vp,
131 vm_map_t map,
132 thread_t thread,
133 struct mach_header *header,
134 off_t file_offset,
135 off_t macho_size,
136 int depth,
137 int64_t slide,
138 load_result_t *result
139 );
140
141 static load_return_t
142 load_segment(
143 struct load_command *lcp,
144 uint32_t filetype,
145 void *control,
146 off_t pager_offset,
147 off_t macho_size,
148 struct vnode *vp,
149 vm_map_t map,
150 int64_t slide,
151 load_result_t *result
152 );
153
154 static load_return_t
155 load_code_signature(
156 struct linkedit_data_command *lcp,
157 struct vnode *vp,
158 off_t macho_offset,
159 off_t macho_size,
160 cpu_type_t cputype,
161 load_result_t *result);
162
163 #if CONFIG_CODE_DECRYPTION
164 static load_return_t
165 set_code_unprotect(
166 struct encryption_info_command *lcp,
167 caddr_t addr,
168 vm_map_t map,
169 struct vnode *vp);
170 #endif
171
172 static load_return_t
173 load_unixthread(
174 struct thread_command *tcp,
175 thread_t thread,
176 int64_t slide,
177 load_result_t *result
178 );
179
180 static load_return_t
181 load_threadstate(
182 thread_t thread,
183 uint32_t *ts,
184 uint32_t total_size
185 );
186
187 static load_return_t
188 load_threadstack(
189 thread_t thread,
190 uint32_t *ts,
191 uint32_t total_size,
192 mach_vm_offset_t *user_stack,
193 int *customstack
194 );
195
196 static load_return_t
197 load_threadentry(
198 thread_t thread,
199 uint32_t *ts,
200 uint32_t total_size,
201 mach_vm_offset_t *entry_point
202 );
203
204 static load_return_t
205 load_dylinker(
206 struct dylinker_command *lcp,
207 integer_t archbits,
208 vm_map_t map,
209 thread_t thread,
210 int depth,
211 int64_t slide,
212 load_result_t *result
213 );
214
215 struct macho_data;
216
217 static load_return_t
218 get_macho_vnode(
219 char *path,
220 integer_t archbits,
221 struct mach_header *mach_header,
222 off_t *file_offset,
223 off_t *macho_size,
224 struct macho_data *macho_data,
225 struct vnode **vpp
226 );
227
228 static inline void
229 widen_segment_command(const struct segment_command *scp32,
230 struct segment_command_64 *scp)
231 {
232 scp->cmd = scp32->cmd;
233 scp->cmdsize = scp32->cmdsize;
234 bcopy(scp32->segname, scp->segname, sizeof(scp->segname));
235 scp->vmaddr = scp32->vmaddr;
236 scp->vmsize = scp32->vmsize;
237 scp->fileoff = scp32->fileoff;
238 scp->filesize = scp32->filesize;
239 scp->maxprot = scp32->maxprot;
240 scp->initprot = scp32->initprot;
241 scp->nsects = scp32->nsects;
242 scp->flags = scp32->flags;
243 }
244
245 static void
246 note_all_image_info_section(const struct segment_command_64 *scp,
247 boolean_t is64, size_t section_size, const void *sections,
248 int64_t slide, load_result_t *result)
249 {
250 const union {
251 struct section s32;
252 struct section_64 s64;
253 } *sectionp;
254 unsigned int i;
255
256 if (strncmp(scp->segname, "__DATA", sizeof(scp->segname)) != 0)
257 return;
258 for (i = 0; i < scp->nsects; ++i) {
259 sectionp = (const void *)
260 ((const char *)sections + section_size * i);
261 if (0 == strncmp(sectionp->s64.sectname, "__all_image_info",
262 sizeof(sectionp->s64.sectname))) {
263 result->all_image_info_addr =
264 is64 ? sectionp->s64.addr : sectionp->s32.addr;
265 result->all_image_info_addr += slide;
266 result->all_image_info_size =
267 is64 ? sectionp->s64.size : sectionp->s32.size;
268 return;
269 }
270 }
271 }
272
273 load_return_t
274 load_machfile(
275 struct image_params *imgp,
276 struct mach_header *header,
277 thread_t thread,
278 vm_map_t new_map,
279 load_result_t *result
280 )
281 {
282 struct vnode *vp = imgp->ip_vp;
283 off_t file_offset = imgp->ip_arch_offset;
284 off_t macho_size = imgp->ip_arch_size;
285
286 pmap_t pmap = 0; /* protected by create_map */
287 vm_map_t map;
288 vm_map_t old_map;
289 task_t old_task = TASK_NULL; /* protected by create_map */
290 load_result_t myresult;
291 load_return_t lret;
292 boolean_t create_map = FALSE;
293 int spawn = (imgp->ip_flags & IMGPF_SPAWN);
294 task_t task = current_task();
295 proc_t p = current_proc();
296 mach_vm_offset_t aslr_offset = 0;
297 kern_return_t kret;
298
299 if (new_map == VM_MAP_NULL) {
300 create_map = TRUE;
301 old_task = current_task();
302 }
303
304 /*
305 * If we are spawning, we have created backing objects for the process
306 * already, which include non-lazily creating the task map. So we
307 * are going to switch out the task map with one appropriate for the
308 * bitness of the image being loaded.
309 */
310 if (spawn) {
311 create_map = TRUE;
312 old_task = get_threadtask(thread);
313 }
314
315 if (create_map) {
316 pmap = pmap_create((vm_map_size_t) 0, (imgp->ip_flags & IMGPF_IS_64BIT));
317 pal_switch_pmap(thread, pmap, imgp->ip_flags & IMGPF_IS_64BIT);
318 map = vm_map_create(pmap,
319 0,
320 vm_compute_max_offset((imgp->ip_flags & IMGPF_IS_64BIT)),
321 TRUE);
322
323 } else
324 map = new_map;
325
326 #ifndef CONFIG_ENFORCE_SIGNED_CODE
327 /* This turns off faulting for executable pages, which allows to
328 * circumvent Code Signing Enforcement */
329 if ( (header->flags & MH_ALLOW_STACK_EXECUTION) )
330 vm_map_disable_NX(map);
331 #endif
332
333 /* Forcibly disallow execution from data pages on even if the arch
334 * normally permits it. */
335 if ((header->flags & MH_NO_HEAP_EXECUTION) && !(imgp->ip_flags & IMGPF_ALLOW_DATA_EXEC))
336 vm_map_disallow_data_exec(map);
337
338 /*
339 * Compute a random offset for ASLR.
340 */
341 if (!(imgp->ip_flags & IMGPF_DISABLE_ASLR)) {
342 aslr_offset = random();
343 aslr_offset %= 1 << ((imgp->ip_flags & IMGPF_IS_64BIT) ? 16 : 8);
344 aslr_offset <<= PAGE_SHIFT;
345 }
346
347 if (!result)
348 result = &myresult;
349
350 *result = load_result_null;
351
352 lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
353 0, (int64_t)aslr_offset, result);
354
355 if (lret != LOAD_SUCCESS) {
356 if (create_map) {
357 vm_map_deallocate(map); /* will lose pmap reference too */
358 }
359 return(lret);
360 }
361
362 /*
363 * For 64-bit users, check for presence of a 4GB page zero
364 * which will enable the kernel to share the user's address space
365 * and hence avoid TLB flushes on kernel entry/exit
366 */
367
368 if ((imgp->ip_flags & IMGPF_IS_64BIT) &&
369 vm_map_has_4GB_pagezero(map))
370 vm_map_set_4GB_pagezero(map);
371
372 /*
373 * Commit to new map.
374 *
375 * Swap the new map for the old, which consumes our new map
376 * reference but each leaves us responsible for the old_map reference.
377 * That lets us get off the pmap associated with it, and
378 * then we can release it.
379 */
380
381 if (create_map) {
382 /*
383 * If this is an exec, then we are going to destroy the old
384 * task, and it's correct to halt it; if it's spawn, the
385 * task is not yet running, and it makes no sense.
386 */
387 if (!spawn) {
388 /*
389 * Mark the task as halting and start the other
390 * threads towards terminating themselves. Then
391 * make sure any threads waiting for a process
392 * transition get informed that we are committed to
393 * this transition, and then finally complete the
394 * task halting (wait for threads and then cleanup
395 * task resources).
396 *
397 * NOTE: task_start_halt() makes sure that no new
398 * threads are created in the task during the transition.
399 * We need to mark the workqueue as exiting before we
400 * wait for threads to terminate (at the end of which
401 * we no longer have a prohibition on thread creation).
402 *
403 * Finally, clean up any lingering workqueue data structures
404 * that may have been left behind by the workqueue threads
405 * as they exited (and then clean up the work queue itself).
406 */
407 kret = task_start_halt(task);
408 if (kret != KERN_SUCCESS) {
409 return(kret);
410 }
411 proc_transcommit(p, 0);
412 workqueue_mark_exiting(p);
413 task_complete_halt(task);
414 workqueue_exit(p);
415 }
416 old_map = swap_task_map(old_task, thread, map, !spawn);
417 vm_map_clear_4GB_pagezero(old_map);
418 vm_map_deallocate(old_map);
419 }
420 return(LOAD_SUCCESS);
421 }
422
423 /*
424 * The file size of a mach-o file is limited to 32 bits; this is because
425 * this is the limit on the kalloc() of enough bytes for a mach_header and
426 * the contents of its sizeofcmds, which is currently constrained to 32
427 * bits in the file format itself. We read into the kernel buffer the
428 * commands section, and then parse it in order to parse the mach-o file
429 * format load_command segment(s). We are only interested in a subset of
430 * the total set of possible commands. If "map"==VM_MAP_NULL or
431 * "thread"==THREAD_NULL, do not make permament VM modifications,
432 * just preflight the parse.
433 */
434 static
435 load_return_t
436 parse_machfile(
437 struct vnode *vp,
438 vm_map_t map,
439 thread_t thread,
440 struct mach_header *header,
441 off_t file_offset,
442 off_t macho_size,
443 int depth,
444 int64_t aslr_offset,
445 load_result_t *result
446 )
447 {
448 uint32_t ncmds;
449 struct load_command *lcp;
450 struct dylinker_command *dlp = 0;
451 struct uuid_command *uulp = 0;
452 integer_t dlarchbits = 0;
453 void * control;
454 load_return_t ret = LOAD_SUCCESS;
455 caddr_t addr;
456 void * kl_addr;
457 vm_size_t size,kl_size;
458 size_t offset;
459 size_t oldoffset; /* for overflow check */
460 int pass;
461 proc_t p = current_proc(); /* XXXX */
462 int error;
463 int resid=0;
464 size_t mach_header_sz = sizeof(struct mach_header);
465 boolean_t abi64;
466 boolean_t got_code_signatures = FALSE;
467 int64_t slide = 0;
468
469 if (header->magic == MH_MAGIC_64 ||
470 header->magic == MH_CIGAM_64) {
471 mach_header_sz = sizeof(struct mach_header_64);
472 }
473
474 /*
475 * Break infinite recursion
476 */
477 if (depth > 6) {
478 return(LOAD_FAILURE);
479 }
480
481 depth++;
482
483 /*
484 * Check to see if right machine type.
485 */
486 if (((cpu_type_t)(header->cputype & ~CPU_ARCH_MASK) != cpu_type()) ||
487 !grade_binary(header->cputype,
488 header->cpusubtype & ~CPU_SUBTYPE_MASK))
489 return(LOAD_BADARCH);
490
491 abi64 = ((header->cputype & CPU_ARCH_ABI64) == CPU_ARCH_ABI64);
492
493 switch (header->filetype) {
494
495 case MH_OBJECT:
496 case MH_EXECUTE:
497 case MH_PRELOAD:
498 if (depth != 1) {
499 return (LOAD_FAILURE);
500 }
501 break;
502
503 case MH_FVMLIB:
504 case MH_DYLIB:
505 if (depth == 1) {
506 return (LOAD_FAILURE);
507 }
508 break;
509
510 case MH_DYLINKER:
511 if (depth != 2) {
512 return (LOAD_FAILURE);
513 }
514 break;
515
516 default:
517 return (LOAD_FAILURE);
518 }
519
520 /*
521 * Get the pager for the file.
522 */
523 control = ubc_getobject(vp, UBC_FLAGS_NONE);
524
525 /*
526 * Map portion that must be accessible directly into
527 * kernel's map.
528 */
529 if ((off_t)(mach_header_sz + header->sizeofcmds) > macho_size)
530 return(LOAD_BADMACHO);
531
532 /*
533 * Round size of Mach-O commands up to page boundry.
534 */
535 size = round_page(mach_header_sz + header->sizeofcmds);
536 if (size <= 0)
537 return(LOAD_BADMACHO);
538
539 /*
540 * Map the load commands into kernel memory.
541 */
542 addr = 0;
543 kl_size = size;
544 kl_addr = kalloc(size);
545 addr = (caddr_t)kl_addr;
546 if (addr == NULL)
547 return(LOAD_NOSPACE);
548
549 error = vn_rdwr(UIO_READ, vp, addr, size, file_offset,
550 UIO_SYSSPACE, 0, kauth_cred_get(), &resid, p);
551 if (error) {
552 if (kl_addr )
553 kfree(kl_addr, kl_size);
554 return(LOAD_IOERROR);
555 }
556
557 /*
558 * For PIE and dyld, slide everything by the ASLR offset.
559 */
560 if ((header->flags & MH_PIE) || (header->filetype == MH_DYLINKER)) {
561 slide = aslr_offset;
562 }
563
564 /*
565 * Scan through the commands, processing each one as necessary.
566 */
567 for (pass = 1; pass <= 3; pass++) {
568
569 #if CONFIG_EMBEDDED
570 /*
571 * Check that the entry point is contained in an executable segments
572 */
573 if ((pass == 3) && (result->validentry == 0)) {
574 thread_state_initialize(thread);
575 ret = LOAD_FAILURE;
576 break;
577 }
578 #endif
579
580 /*
581 * Loop through each of the load_commands indicated by the
582 * Mach-O header; if an absurd value is provided, we just
583 * run off the end of the reserved section by incrementing
584 * the offset too far, so we are implicitly fail-safe.
585 */
586 offset = mach_header_sz;
587 ncmds = header->ncmds;
588
589 while (ncmds--) {
590 /*
591 * Get a pointer to the command.
592 */
593 lcp = (struct load_command *)(addr + offset);
594 oldoffset = offset;
595 offset += lcp->cmdsize;
596
597 /*
598 * Perform prevalidation of the struct load_command
599 * before we attempt to use its contents. Invalid
600 * values are ones which result in an overflow, or
601 * which can not possibly be valid commands, or which
602 * straddle or exist past the reserved section at the
603 * start of the image.
604 */
605 if (oldoffset > offset ||
606 lcp->cmdsize < sizeof(struct load_command) ||
607 offset > header->sizeofcmds + mach_header_sz) {
608 ret = LOAD_BADMACHO;
609 break;
610 }
611
612 /*
613 * Act on struct load_command's for which kernel
614 * intervention is required.
615 */
616 switch(lcp->cmd) {
617 case LC_SEGMENT:
618 case LC_SEGMENT_64:
619 if (pass != 2)
620 break;
621 ret = load_segment(lcp,
622 header->filetype,
623 control,
624 file_offset,
625 macho_size,
626 vp,
627 map,
628 slide,
629 result);
630 break;
631 case LC_UNIXTHREAD:
632 if (pass != 1)
633 break;
634 ret = load_unixthread(
635 (struct thread_command *) lcp,
636 thread,
637 slide,
638 result);
639 break;
640 case LC_LOAD_DYLINKER:
641 if (pass != 3)
642 break;
643 if ((depth == 1) && (dlp == 0)) {
644 dlp = (struct dylinker_command *)lcp;
645 dlarchbits = (header->cputype & CPU_ARCH_MASK);
646 } else {
647 ret = LOAD_FAILURE;
648 }
649 break;
650 case LC_UUID:
651 if (pass == 1 && depth == 1) {
652 uulp = (struct uuid_command *)lcp;
653 memcpy(&result->uuid[0], &uulp->uuid[0], sizeof(result->uuid));
654 }
655 break;
656 case LC_CODE_SIGNATURE:
657 /* CODE SIGNING */
658 if (pass != 1)
659 break;
660 /* pager -> uip ->
661 load signatures & store in uip
662 set VM object "signed_pages"
663 */
664 ret = load_code_signature(
665 (struct linkedit_data_command *) lcp,
666 vp,
667 file_offset,
668 macho_size,
669 header->cputype,
670 (depth == 1) ? result : NULL);
671 if (ret != LOAD_SUCCESS) {
672 printf("proc %d: load code signature error %d "
673 "for file \"%s\"\n",
674 p->p_pid, ret, vp->v_name);
675 ret = LOAD_SUCCESS; /* ignore error */
676 } else {
677 got_code_signatures = TRUE;
678 }
679 break;
680 #if CONFIG_CODE_DECRYPTION
681 case LC_ENCRYPTION_INFO:
682 if (pass != 3)
683 break;
684 ret = set_code_unprotect(
685 (struct encryption_info_command *) lcp,
686 addr, map, vp);
687 if (ret != LOAD_SUCCESS) {
688 printf("proc %d: set_code_unprotect() error %d "
689 "for file \"%s\"\n",
690 p->p_pid, ret, vp->v_name);
691 /* Don't let the app run if it's
692 * encrypted but we failed to set up the
693 * decrypter */
694 psignal(p, SIGKILL);
695 }
696 break;
697 #endif
698 default:
699 /* Other commands are ignored by the kernel */
700 ret = LOAD_SUCCESS;
701 break;
702 }
703 if (ret != LOAD_SUCCESS)
704 break;
705 }
706 if (ret != LOAD_SUCCESS)
707 break;
708 }
709 if (ret == LOAD_SUCCESS) {
710 if (! got_code_signatures) {
711 struct cs_blob *blob;
712 /* no embedded signatures: look for detached ones */
713 blob = ubc_cs_blob_get(vp, -1, file_offset);
714 if (blob != NULL) {
715 /* get flags to be applied to the process */
716 result->csflags |= blob->csb_flags;
717 }
718 }
719
720 if (dlp != 0) {
721 /* load the dylinker, and always slide it by the ASLR
722 * offset regardless of PIE */
723 ret = load_dylinker(dlp, dlarchbits, map, thread, depth, aslr_offset, result);
724 }
725
726 if(depth == 1) {
727 if (result->thread_count == 0) {
728 ret = LOAD_FAILURE;
729 }
730 }
731 }
732
733 if (kl_addr )
734 kfree(kl_addr, kl_size);
735
736 return(ret);
737 }
738
739 #if CONFIG_CODE_DECRYPTION
740
741 #define APPLE_UNPROTECTED_HEADER_SIZE (3 * PAGE_SIZE_64)
742
743 static load_return_t
744 unprotect_segment(
745 uint64_t file_off,
746 uint64_t file_size,
747 struct vnode *vp,
748 off_t macho_offset,
749 vm_map_t map,
750 vm_map_offset_t map_addr,
751 vm_map_size_t map_size)
752 {
753 kern_return_t kr;
754
755 /*
756 * The first APPLE_UNPROTECTED_HEADER_SIZE bytes (from offset 0 of
757 * this part of a Universal binary) are not protected...
758 * The rest needs to be "transformed".
759 */
760 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE &&
761 file_off + file_size <= APPLE_UNPROTECTED_HEADER_SIZE) {
762 /* it's all unprotected, nothing to do... */
763 kr = KERN_SUCCESS;
764 } else {
765 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE) {
766 /*
767 * We start mapping in the unprotected area.
768 * Skip the unprotected part...
769 */
770 vm_map_offset_t delta;
771
772 delta = APPLE_UNPROTECTED_HEADER_SIZE;
773 delta -= file_off;
774 map_addr += delta;
775 map_size -= delta;
776 }
777 /* ... transform the rest of the mapping. */
778 struct pager_crypt_info crypt_info;
779 crypt_info.page_decrypt = dsmos_page_transform;
780 crypt_info.crypt_ops = NULL;
781 crypt_info.crypt_end = NULL;
782 #pragma unused(vp, macho_offset)
783 crypt_info.crypt_ops = (void *)0x2e69cf40;
784 kr = vm_map_apple_protected(map,
785 map_addr,
786 map_addr + map_size,
787 &crypt_info);
788 }
789
790 if (kr != KERN_SUCCESS) {
791 return LOAD_FAILURE;
792 }
793 return LOAD_SUCCESS;
794 }
795 #else /* CONFIG_CODE_DECRYPTION */
796 static load_return_t
797 unprotect_segment(
798 __unused uint64_t file_off,
799 __unused uint64_t file_size,
800 __unused struct vnode *vp,
801 __unused off_t macho_offset,
802 __unused vm_map_t map,
803 __unused vm_map_offset_t map_addr,
804 __unused vm_map_size_t map_size)
805 {
806 return LOAD_SUCCESS;
807 }
808 #endif /* CONFIG_CODE_DECRYPTION */
809
810 static
811 load_return_t
812 load_segment(
813 struct load_command *lcp,
814 uint32_t filetype,
815 void * control,
816 off_t pager_offset,
817 off_t macho_size,
818 struct vnode *vp,
819 vm_map_t map,
820 int64_t slide,
821 load_result_t *result
822 )
823 {
824 struct segment_command_64 segment_command, *scp;
825 kern_return_t ret;
826 mach_vm_offset_t map_addr, map_offset;
827 mach_vm_size_t map_size, seg_size, delta_size;
828 vm_prot_t initprot;
829 vm_prot_t maxprot;
830 size_t segment_command_size, total_section_size,
831 single_section_size;
832
833 if (LC_SEGMENT_64 == lcp->cmd) {
834 segment_command_size = sizeof(struct segment_command_64);
835 single_section_size = sizeof(struct section_64);
836 } else {
837 segment_command_size = sizeof(struct segment_command);
838 single_section_size = sizeof(struct section);
839 }
840 if (lcp->cmdsize < segment_command_size)
841 return (LOAD_BADMACHO);
842 total_section_size = lcp->cmdsize - segment_command_size;
843
844 if (LC_SEGMENT_64 == lcp->cmd)
845 scp = (struct segment_command_64 *)lcp;
846 else {
847 scp = &segment_command;
848 widen_segment_command((struct segment_command *)lcp, scp);
849 }
850
851 /*
852 * Make sure what we get from the file is really ours (as specified
853 * by macho_size).
854 */
855 if (scp->fileoff + scp->filesize < scp->fileoff ||
856 scp->fileoff + scp->filesize > (uint64_t)macho_size)
857 return (LOAD_BADMACHO);
858 /*
859 * Ensure that the number of sections specified would fit
860 * within the load command size.
861 */
862 if (total_section_size / single_section_size < scp->nsects)
863 return (LOAD_BADMACHO);
864 /*
865 * Make sure the segment is page-aligned in the file.
866 */
867 if ((scp->fileoff & PAGE_MASK_64) != 0)
868 return (LOAD_BADMACHO);
869
870 /*
871 * Round sizes to page size.
872 */
873 seg_size = round_page_64(scp->vmsize);
874 map_size = round_page_64(scp->filesize);
875 map_addr = trunc_page_64(scp->vmaddr); /* JVXXX note that in XNU TOT this is round instead of trunc for 64 bits */
876 if (seg_size == 0)
877 return (KERN_SUCCESS);
878 if (map_addr == 0 &&
879 map_size == 0 &&
880 seg_size != 0 &&
881 (scp->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
882 (scp->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
883 /*
884 * For PIE, extend page zero rather than moving it. Extending
885 * page zero keeps early allocations from falling predictably
886 * between the end of page zero and the beginning of the first
887 * slid segment.
888 */
889 seg_size += slide;
890 slide = 0;
891
892 /* XXX (4596982) this interferes with Rosetta, so limit to 64-bit tasks */
893 if (scp->cmd == LC_SEGMENT_64) {
894 /*
895 * This is a "page zero" segment: it starts at address 0,
896 * is not mapped from the binary file and is not accessible.
897 * User-space should never be able to access that memory, so
898 * make it completely off limits by raising the VM map's
899 * minimum offset.
900 */
901 ret = vm_map_raise_min_offset(map, seg_size);
902 if (ret != KERN_SUCCESS) {
903 return (LOAD_FAILURE);
904 }
905 return (LOAD_SUCCESS);
906 }
907 }
908
909 /* If a non-zero slide was specified by the caller, apply now */
910 map_addr += slide;
911
912 if (map_addr < result->min_vm_addr)
913 result->min_vm_addr = map_addr;
914 if (map_addr+seg_size > result->max_vm_addr)
915 result->max_vm_addr = map_addr+seg_size;
916
917 if (map == VM_MAP_NULL)
918 return (LOAD_SUCCESS);
919
920 map_offset = pager_offset + scp->fileoff; /* limited to 32 bits */
921
922 if (map_size > 0) {
923 initprot = (scp->initprot) & VM_PROT_ALL;
924 maxprot = (scp->maxprot) & VM_PROT_ALL;
925 /*
926 * Map a copy of the file into the address space.
927 */
928 ret = vm_map_enter_mem_object_control(map,
929 &map_addr, map_size, (mach_vm_offset_t)0,
930 VM_FLAGS_FIXED, control, map_offset, TRUE,
931 initprot, maxprot,
932 VM_INHERIT_DEFAULT);
933 if (ret != KERN_SUCCESS)
934 return (LOAD_NOSPACE);
935
936 /*
937 * If the file didn't end on a page boundary,
938 * we need to zero the leftover.
939 */
940 delta_size = map_size - scp->filesize;
941 #if FIXME
942 if (delta_size > 0) {
943 mach_vm_offset_t tmp;
944
945 ret = mach_vm_allocate(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE);
946 if (ret != KERN_SUCCESS)
947 return(LOAD_RESOURCE);
948
949 if (copyout(tmp, map_addr + scp->filesize,
950 delta_size)) {
951 (void) mach_vm_deallocate(
952 kernel_map, tmp, delta_size);
953 return (LOAD_FAILURE);
954 }
955
956 (void) mach_vm_deallocate(kernel_map, tmp, delta_size);
957 }
958 #endif /* FIXME */
959 }
960
961 /*
962 * If the virtual size of the segment is greater
963 * than the size from the file, we need to allocate
964 * zero fill memory for the rest.
965 */
966 delta_size = seg_size - map_size;
967 if (delta_size > 0) {
968 mach_vm_offset_t tmp = map_addr + map_size;
969
970 ret = mach_vm_map(map, &tmp, delta_size, 0, VM_FLAGS_FIXED,
971 NULL, 0, FALSE,
972 scp->initprot, scp->maxprot,
973 VM_INHERIT_DEFAULT);
974 if (ret != KERN_SUCCESS)
975 return(LOAD_NOSPACE);
976 }
977
978 if ( (scp->fileoff == 0) && (scp->filesize != 0) )
979 result->mach_header = map_addr;
980
981 if (scp->flags & SG_PROTECTED_VERSION_1) {
982 ret = unprotect_segment(scp->fileoff,
983 scp->filesize,
984 vp,
985 pager_offset,
986 map,
987 map_addr,
988 map_size);
989 } else {
990 ret = LOAD_SUCCESS;
991 }
992 if (LOAD_SUCCESS == ret && filetype == MH_DYLINKER &&
993 result->all_image_info_addr == MACH_VM_MIN_ADDRESS)
994 note_all_image_info_section(scp,
995 LC_SEGMENT_64 == lcp->cmd, single_section_size,
996 (const char *)lcp + segment_command_size, slide, result);
997
998 if ((result->entry_point >= map_addr) && (result->entry_point < (map_addr + map_size)))
999 result->validentry = 1;
1000
1001 return ret;
1002 }
1003
1004 static
1005 load_return_t
1006 load_unixthread(
1007 struct thread_command *tcp,
1008 thread_t thread,
1009 int64_t slide,
1010 load_result_t *result
1011 )
1012 {
1013 load_return_t ret;
1014 int customstack =0;
1015
1016 if (tcp->cmdsize < sizeof(*tcp))
1017 return (LOAD_BADMACHO);
1018 if (result->thread_count != 0) {
1019 printf("load_unixthread: already have a thread!");
1020 return (LOAD_FAILURE);
1021 }
1022
1023 if (thread == THREAD_NULL)
1024 return (LOAD_SUCCESS);
1025
1026 ret = load_threadstack(thread,
1027 (uint32_t *)(((vm_offset_t)tcp) +
1028 sizeof(struct thread_command)),
1029 tcp->cmdsize - sizeof(struct thread_command),
1030 &result->user_stack,
1031 &customstack);
1032 if (ret != LOAD_SUCCESS)
1033 return(ret);
1034
1035 if (customstack)
1036 result->customstack = 1;
1037 else
1038 result->customstack = 0;
1039
1040 result->user_stack += slide;
1041
1042 ret = load_threadentry(thread,
1043 (uint32_t *)(((vm_offset_t)tcp) +
1044 sizeof(struct thread_command)),
1045 tcp->cmdsize - sizeof(struct thread_command),
1046 &result->entry_point);
1047 if (ret != LOAD_SUCCESS)
1048 return(ret);
1049
1050 result->entry_point += slide;
1051
1052 ret = load_threadstate(thread,
1053 (uint32_t *)(((vm_offset_t)tcp) +
1054 sizeof(struct thread_command)),
1055 tcp->cmdsize - sizeof(struct thread_command));
1056 if (ret != LOAD_SUCCESS)
1057 return (ret);
1058
1059 result->unixproc = TRUE;
1060 result->thread_count++;
1061
1062 return(LOAD_SUCCESS);
1063 }
1064
1065 static
1066 load_return_t
1067 load_threadstate(
1068 thread_t thread,
1069 uint32_t *ts,
1070 uint32_t total_size
1071 )
1072 {
1073 kern_return_t ret;
1074 uint32_t size;
1075 int flavor;
1076 uint32_t thread_size;
1077
1078 ret = thread_state_initialize( thread );
1079 if (ret != KERN_SUCCESS) {
1080 return(LOAD_FAILURE);
1081 }
1082
1083 /*
1084 * Set the new thread state; iterate through the state flavors in
1085 * the mach-o file.
1086 */
1087 while (total_size > 0) {
1088 flavor = *ts++;
1089 size = *ts++;
1090 if (UINT32_MAX-2 < size ||
1091 UINT32_MAX/sizeof(uint32_t) < size+2)
1092 return (LOAD_BADMACHO);
1093 thread_size = (size+2)*sizeof(uint32_t);
1094 if (thread_size > total_size)
1095 return(LOAD_BADMACHO);
1096 total_size -= thread_size;
1097 /*
1098 * Third argument is a kernel space pointer; it gets cast
1099 * to the appropriate type in machine_thread_set_state()
1100 * based on the value of flavor.
1101 */
1102 ret = thread_setstatus(thread, flavor, (thread_state_t)ts, size);
1103 if (ret != KERN_SUCCESS) {
1104 return(LOAD_FAILURE);
1105 }
1106 ts += size; /* ts is a (uint32_t *) */
1107 }
1108 return(LOAD_SUCCESS);
1109 }
1110
1111 static
1112 load_return_t
1113 load_threadstack(
1114 thread_t thread,
1115 uint32_t *ts,
1116 uint32_t total_size,
1117 mach_vm_offset_t *user_stack,
1118 int *customstack
1119 )
1120 {
1121 kern_return_t ret;
1122 uint32_t size;
1123 int flavor;
1124 uint32_t stack_size;
1125
1126 while (total_size > 0) {
1127 flavor = *ts++;
1128 size = *ts++;
1129 if (UINT32_MAX-2 < size ||
1130 UINT32_MAX/sizeof(uint32_t) < size+2)
1131 return (LOAD_BADMACHO);
1132 stack_size = (size+2)*sizeof(uint32_t);
1133 if (stack_size > total_size)
1134 return(LOAD_BADMACHO);
1135 total_size -= stack_size;
1136
1137 /*
1138 * Third argument is a kernel space pointer; it gets cast
1139 * to the appropriate type in thread_userstack() based on
1140 * the value of flavor.
1141 */
1142 ret = thread_userstack(thread, flavor, (thread_state_t)ts, size, user_stack, customstack);
1143 if (ret != KERN_SUCCESS) {
1144 return(LOAD_FAILURE);
1145 }
1146 ts += size; /* ts is a (uint32_t *) */
1147 }
1148 return(LOAD_SUCCESS);
1149 }
1150
1151 static
1152 load_return_t
1153 load_threadentry(
1154 thread_t thread,
1155 uint32_t *ts,
1156 uint32_t total_size,
1157 mach_vm_offset_t *entry_point
1158 )
1159 {
1160 kern_return_t ret;
1161 uint32_t size;
1162 int flavor;
1163 uint32_t entry_size;
1164
1165 /*
1166 * Set the thread state.
1167 */
1168 *entry_point = MACH_VM_MIN_ADDRESS;
1169 while (total_size > 0) {
1170 flavor = *ts++;
1171 size = *ts++;
1172 if (UINT32_MAX-2 < size ||
1173 UINT32_MAX/sizeof(uint32_t) < size+2)
1174 return (LOAD_BADMACHO);
1175 entry_size = (size+2)*sizeof(uint32_t);
1176 if (entry_size > total_size)
1177 return(LOAD_BADMACHO);
1178 total_size -= entry_size;
1179 /*
1180 * Third argument is a kernel space pointer; it gets cast
1181 * to the appropriate type in thread_entrypoint() based on
1182 * the value of flavor.
1183 */
1184 ret = thread_entrypoint(thread, flavor, (thread_state_t)ts, size, entry_point);
1185 if (ret != KERN_SUCCESS) {
1186 return(LOAD_FAILURE);
1187 }
1188 ts += size; /* ts is a (uint32_t *) */
1189 }
1190 return(LOAD_SUCCESS);
1191 }
1192
1193 struct macho_data {
1194 struct nameidata __nid;
1195 union macho_vnode_header {
1196 struct mach_header mach_header;
1197 struct fat_header fat_header;
1198 char __pad[512];
1199 } __header;
1200 };
1201
1202 static load_return_t
1203 load_dylinker(
1204 struct dylinker_command *lcp,
1205 integer_t archbits,
1206 vm_map_t map,
1207 thread_t thread,
1208 int depth,
1209 int64_t slide,
1210 load_result_t *result
1211 )
1212 {
1213 char *name;
1214 char *p;
1215 struct vnode *vp = NULLVP; /* set by get_macho_vnode() */
1216 struct mach_header *header;
1217 off_t file_offset = 0; /* set by get_macho_vnode() */
1218 off_t macho_size = 0; /* set by get_macho_vnode() */
1219 load_result_t *myresult;
1220 kern_return_t ret;
1221 struct macho_data *macho_data;
1222 struct {
1223 struct mach_header __header;
1224 load_result_t __myresult;
1225 struct macho_data __macho_data;
1226 } *dyld_data;
1227
1228 if (lcp->cmdsize < sizeof(*lcp))
1229 return (LOAD_BADMACHO);
1230
1231 name = (char *)lcp + lcp->name.offset;
1232 /*
1233 * Check for a proper null terminated string.
1234 */
1235 p = name;
1236 do {
1237 if (p >= (char *)lcp + lcp->cmdsize)
1238 return(LOAD_BADMACHO);
1239 } while (*p++);
1240
1241 /* Allocate wad-of-data from heap to reduce excessively deep stacks */
1242
1243 MALLOC(dyld_data, void *, sizeof (*dyld_data), M_TEMP, M_WAITOK);
1244 header = &dyld_data->__header;
1245 myresult = &dyld_data->__myresult;
1246 macho_data = &dyld_data->__macho_data;
1247
1248 ret = get_macho_vnode(name, archbits, header,
1249 &file_offset, &macho_size, macho_data, &vp);
1250 if (ret)
1251 goto novp_out;
1252
1253 *myresult = load_result_null;
1254
1255 /*
1256 * First try to map dyld in directly. This should work most of
1257 * the time since there shouldn't normally be something already
1258 * mapped to its address.
1259 */
1260
1261 ret = parse_machfile(vp, map, thread, header, file_offset,
1262 macho_size, depth, slide, myresult);
1263
1264 /*
1265 * If it turned out something was in the way, then we'll take
1266 * take this longer path to preflight dyld's vm ranges, then
1267 * map it at a free location in the address space.
1268 */
1269
1270 if (ret == LOAD_NOSPACE) {
1271 mach_vm_offset_t dyl_start, map_addr;
1272 mach_vm_size_t dyl_length;
1273 int64_t slide_amount;
1274
1275 *myresult = load_result_null;
1276
1277 /*
1278 * Preflight parsing the Mach-O file with a NULL
1279 * map, which will return the ranges needed for a
1280 * subsequent map attempt (with a slide) in "myresult"
1281 */
1282 ret = parse_machfile(vp, VM_MAP_NULL, THREAD_NULL, header,
1283 file_offset, macho_size, depth, 0 /* slide */, myresult);
1284
1285 if (ret != LOAD_SUCCESS) {
1286 goto out;
1287 }
1288
1289 dyl_start = myresult->min_vm_addr;
1290 dyl_length = myresult->max_vm_addr - myresult->min_vm_addr;
1291
1292 dyl_length += slide;
1293
1294 /* To find an appropriate load address, do a quick allocation */
1295 map_addr = dyl_start;
1296 ret = mach_vm_allocate(map, &map_addr, dyl_length, VM_FLAGS_ANYWHERE);
1297 if (ret != KERN_SUCCESS) {
1298 ret = LOAD_NOSPACE;
1299 goto out;
1300 }
1301
1302 ret = mach_vm_deallocate(map, map_addr, dyl_length);
1303 if (ret != KERN_SUCCESS) {
1304 ret = LOAD_NOSPACE;
1305 goto out;
1306 }
1307
1308 if (map_addr < dyl_start)
1309 slide_amount = -(int64_t)(dyl_start - map_addr);
1310 else
1311 slide_amount = (int64_t)(map_addr - dyl_start);
1312
1313 slide_amount += slide;
1314
1315 *myresult = load_result_null;
1316
1317 ret = parse_machfile(vp, map, thread, header,
1318 file_offset, macho_size, depth, slide_amount, myresult);
1319
1320 if (ret) {
1321 goto out;
1322 }
1323 }
1324
1325 if (ret == LOAD_SUCCESS) {
1326 result->dynlinker = TRUE;
1327 result->entry_point = myresult->entry_point;
1328 result->all_image_info_addr = myresult->all_image_info_addr;
1329 result->all_image_info_size = myresult->all_image_info_size;
1330 }
1331 out:
1332 vnode_put(vp);
1333 novp_out:
1334 FREE(dyld_data, M_TEMP);
1335 return (ret);
1336
1337 }
1338
1339 static load_return_t
1340 load_code_signature(
1341 struct linkedit_data_command *lcp,
1342 struct vnode *vp,
1343 off_t macho_offset,
1344 off_t macho_size,
1345 cpu_type_t cputype,
1346 load_result_t *result)
1347 {
1348 int ret;
1349 kern_return_t kr;
1350 vm_offset_t addr;
1351 int resid;
1352 struct cs_blob *blob;
1353 int error;
1354 vm_size_t blob_size;
1355
1356 addr = 0;
1357 blob = NULL;
1358
1359 if (lcp->cmdsize != sizeof (struct linkedit_data_command) ||
1360 lcp->dataoff + lcp->datasize > macho_size) {
1361 ret = LOAD_BADMACHO;
1362 goto out;
1363 }
1364
1365 blob = ubc_cs_blob_get(vp, cputype, -1);
1366 if (blob != NULL) {
1367 /* we already have a blob for this vnode and cputype */
1368 if (blob->csb_cpu_type == cputype &&
1369 blob->csb_base_offset == macho_offset &&
1370 blob->csb_mem_size == lcp->datasize) {
1371 /* it matches the blob we want here: we're done */
1372 ret = LOAD_SUCCESS;
1373 } else {
1374 /* the blob has changed for this vnode: fail ! */
1375 ret = LOAD_BADMACHO;
1376 }
1377 goto out;
1378 }
1379
1380 blob_size = lcp->datasize;
1381 kr = ubc_cs_blob_allocate(&addr, &blob_size);
1382 if (kr != KERN_SUCCESS) {
1383 ret = LOAD_NOSPACE;
1384 goto out;
1385 }
1386
1387 resid = 0;
1388 error = vn_rdwr(UIO_READ,
1389 vp,
1390 (caddr_t) addr,
1391 lcp->datasize,
1392 macho_offset + lcp->dataoff,
1393 UIO_SYSSPACE,
1394 0,
1395 kauth_cred_get(),
1396 &resid,
1397 current_proc());
1398 if (error || resid != 0) {
1399 ret = LOAD_IOERROR;
1400 goto out;
1401 }
1402
1403 if (ubc_cs_blob_add(vp,
1404 cputype,
1405 macho_offset,
1406 addr,
1407 lcp->datasize)) {
1408 ret = LOAD_FAILURE;
1409 goto out;
1410 } else {
1411 /* ubc_cs_blob_add() has consumed "addr" */
1412 addr = 0;
1413 }
1414
1415 #if CHECK_CS_VALIDATION_BITMAP
1416 ubc_cs_validation_bitmap_allocate( vp );
1417 #endif
1418
1419 blob = ubc_cs_blob_get(vp, cputype, -1);
1420
1421 ret = LOAD_SUCCESS;
1422 out:
1423 if (result && ret == LOAD_SUCCESS) {
1424 result->csflags |= blob->csb_flags;
1425 }
1426 if (addr != 0) {
1427 ubc_cs_blob_deallocate(addr, blob_size);
1428 addr = 0;
1429 }
1430
1431 return ret;
1432 }
1433
1434
1435 #if CONFIG_CODE_DECRYPTION
1436
1437 static load_return_t
1438 set_code_unprotect(
1439 struct encryption_info_command *eip,
1440 caddr_t addr,
1441 vm_map_t map,
1442 struct vnode *vp)
1443 {
1444 int result, len;
1445 pager_crypt_info_t crypt_info;
1446 const char * cryptname = 0;
1447 char *vpath;
1448
1449 size_t offset;
1450 struct segment_command_64 *seg64;
1451 struct segment_command *seg32;
1452 vm_map_offset_t map_offset, map_size;
1453 kern_return_t kr;
1454
1455 if (eip->cmdsize < sizeof(*eip)) return LOAD_BADMACHO;
1456
1457 switch(eip->cryptid) {
1458 case 0:
1459 /* not encrypted, just an empty load command */
1460 return LOAD_SUCCESS;
1461 case 1:
1462 cryptname="com.apple.unfree";
1463 break;
1464 case 0x10:
1465 /* some random cryptid that you could manually put into
1466 * your binary if you want NULL */
1467 cryptname="com.apple.null";
1468 break;
1469 default:
1470 return LOAD_BADMACHO;
1471 }
1472
1473 if (map == VM_MAP_NULL) return (LOAD_SUCCESS);
1474 if (NULL == text_crypter_create) return LOAD_FAILURE;
1475
1476 MALLOC_ZONE(vpath, char *, MAXPATHLEN, M_NAMEI, M_WAITOK);
1477 if(vpath == NULL) return LOAD_FAILURE;
1478
1479 len = MAXPATHLEN;
1480 result = vn_getpath(vp, vpath, &len);
1481 if(result) {
1482 FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
1483 return LOAD_FAILURE;
1484 }
1485
1486 /* set up decrypter first */
1487 kr=text_crypter_create(&crypt_info, cryptname, (void*)vpath);
1488 FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
1489
1490 if(kr) {
1491 printf("set_code_unprotect: unable to create decrypter %s, kr=%d\n",
1492 cryptname, kr);
1493 return LOAD_RESOURCE;
1494 }
1495
1496 /* this is terrible, but we have to rescan the load commands to find the
1497 * virtual address of this encrypted stuff. This code is gonna look like
1498 * the dyld source one day... */
1499 struct mach_header *header = (struct mach_header *)addr;
1500 size_t mach_header_sz = sizeof(struct mach_header);
1501 if (header->magic == MH_MAGIC_64 ||
1502 header->magic == MH_CIGAM_64) {
1503 mach_header_sz = sizeof(struct mach_header_64);
1504 }
1505 offset = mach_header_sz;
1506 uint32_t ncmds = header->ncmds;
1507 while (ncmds--) {
1508 /*
1509 * Get a pointer to the command.
1510 */
1511 struct load_command *lcp = (struct load_command *)(addr + offset);
1512 offset += lcp->cmdsize;
1513
1514 switch(lcp->cmd) {
1515 case LC_SEGMENT_64:
1516 seg64 = (struct segment_command_64 *)lcp;
1517 if ((seg64->fileoff <= eip->cryptoff) &&
1518 (seg64->fileoff+seg64->filesize >=
1519 eip->cryptoff+eip->cryptsize)) {
1520 map_offset = seg64->vmaddr + eip->cryptoff - seg64->fileoff;
1521 map_size = eip->cryptsize;
1522 goto remap_now;
1523 }
1524 case LC_SEGMENT:
1525 seg32 = (struct segment_command *)lcp;
1526 if ((seg32->fileoff <= eip->cryptoff) &&
1527 (seg32->fileoff+seg32->filesize >=
1528 eip->cryptoff+eip->cryptsize)) {
1529 map_offset = seg32->vmaddr + eip->cryptoff - seg32->fileoff;
1530 map_size = eip->cryptsize;
1531 goto remap_now;
1532 }
1533 }
1534 }
1535
1536 /* if we get here, did not find anything */
1537 return LOAD_BADMACHO;
1538
1539 remap_now:
1540 /* now remap using the decrypter */
1541 kr = vm_map_apple_protected(map, map_offset, map_offset+map_size, &crypt_info);
1542 if(kr) {
1543 printf("set_code_unprotect(): mapping failed with %x\n", kr);
1544 crypt_info.crypt_end(crypt_info.crypt_ops);
1545 return LOAD_PROTECT;
1546 }
1547
1548 return LOAD_SUCCESS;
1549 }
1550
1551 #endif
1552
1553 /*
1554 * This routine exists to support the load_dylinker().
1555 *
1556 * This routine has its own, separate, understanding of the FAT file format,
1557 * which is terrifically unfortunate.
1558 */
1559 static
1560 load_return_t
1561 get_macho_vnode(
1562 char *path,
1563 integer_t archbits,
1564 struct mach_header *mach_header,
1565 off_t *file_offset,
1566 off_t *macho_size,
1567 struct macho_data *data,
1568 struct vnode **vpp
1569 )
1570 {
1571 struct vnode *vp;
1572 vfs_context_t ctx = vfs_context_current();
1573 proc_t p = vfs_context_proc(ctx);
1574 kauth_cred_t kerncred;
1575 struct nameidata *ndp = &data->__nid;
1576 boolean_t is_fat;
1577 struct fat_arch fat_arch;
1578 int error;
1579 int resid;
1580 union macho_vnode_header *header = &data->__header;
1581 off_t fsize = (off_t)0;
1582
1583 /*
1584 * Capture the kernel credential for use in the actual read of the
1585 * file, since the user doing the execution may have execute rights
1586 * but not read rights, but to exec something, we have to either map
1587 * or read it into the new process address space, which requires
1588 * read rights. This is to deal with lack of common credential
1589 * serialization code which would treat NOCRED as "serialize 'root'".
1590 */
1591 kerncred = vfs_context_ucred(vfs_context_kernel());
1592
1593 /* init the namei data to point the file user's program name */
1594 NDINIT(ndp, LOOKUP, OP_OPEN, FOLLOW | LOCKLEAF, UIO_SYSSPACE, CAST_USER_ADDR_T(path), ctx);
1595
1596 if ((error = namei(ndp)) != 0) {
1597 if (error == ENOENT) {
1598 error = LOAD_ENOENT;
1599 } else {
1600 error = LOAD_FAILURE;
1601 }
1602 return(error);
1603 }
1604 nameidone(ndp);
1605 vp = ndp->ni_vp;
1606
1607 /* check for regular file */
1608 if (vp->v_type != VREG) {
1609 error = LOAD_PROTECT;
1610 goto bad1;
1611 }
1612
1613 /* get size */
1614 if ((error = vnode_size(vp, &fsize, ctx)) != 0) {
1615 error = LOAD_FAILURE;
1616 goto bad1;
1617 }
1618
1619 /* Check mount point */
1620 if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
1621 error = LOAD_PROTECT;
1622 goto bad1;
1623 }
1624
1625 /* check access */
1626 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_EXECUTE, ctx)) != 0) {
1627 error = LOAD_PROTECT;
1628 goto bad1;
1629 }
1630
1631 /* try to open it */
1632 if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
1633 error = LOAD_PROTECT;
1634 goto bad1;
1635 }
1636
1637 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)header, sizeof (*header), 0,
1638 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p)) != 0) {
1639 error = LOAD_IOERROR;
1640 goto bad2;
1641 }
1642
1643 if (header->mach_header.magic == MH_MAGIC ||
1644 header->mach_header.magic == MH_MAGIC_64) {
1645 is_fat = FALSE;
1646 } else if (header->fat_header.magic == FAT_MAGIC ||
1647 header->fat_header.magic == FAT_CIGAM) {
1648 is_fat = TRUE;
1649 } else {
1650 error = LOAD_BADMACHO;
1651 goto bad2;
1652 }
1653
1654 if (is_fat) {
1655 /* Look up our architecture in the fat file. */
1656 error = fatfile_getarch_with_bits(vp, archbits,
1657 (vm_offset_t)(&header->fat_header), &fat_arch);
1658 if (error != LOAD_SUCCESS)
1659 goto bad2;
1660
1661 /* Read the Mach-O header out of it */
1662 error = vn_rdwr(UIO_READ, vp, (caddr_t)&header->mach_header,
1663 sizeof (header->mach_header), fat_arch.offset,
1664 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p);
1665 if (error) {
1666 error = LOAD_IOERROR;
1667 goto bad2;
1668 }
1669
1670 /* Is this really a Mach-O? */
1671 if (header->mach_header.magic != MH_MAGIC &&
1672 header->mach_header.magic != MH_MAGIC_64) {
1673 error = LOAD_BADMACHO;
1674 goto bad2;
1675 }
1676
1677 *file_offset = fat_arch.offset;
1678 *macho_size = fat_arch.size;
1679 } else {
1680 /*
1681 * Force get_macho_vnode() to fail if the architecture bits
1682 * do not match the expected architecture bits. This in
1683 * turn causes load_dylinker() to fail for the same reason,
1684 * so it ensures the dynamic linker and the binary are in
1685 * lock-step. This is potentially bad, if we ever add to
1686 * the CPU_ARCH_* bits any bits that are desirable but not
1687 * required, since the dynamic linker might work, but we will
1688 * refuse to load it because of this check.
1689 */
1690 if ((cpu_type_t)(header->mach_header.cputype & CPU_ARCH_MASK) != archbits) {
1691 error = LOAD_BADARCH;
1692 goto bad2;
1693 }
1694
1695 *file_offset = 0;
1696 *macho_size = fsize;
1697 }
1698
1699 *mach_header = header->mach_header;
1700 *vpp = vp;
1701
1702 ubc_setsize(vp, fsize);
1703 return (error);
1704
1705 bad2:
1706 (void) VNOP_CLOSE(vp, FREAD, ctx);
1707 bad1:
1708 vnode_put(vp);
1709 return(error);
1710 }
mirror of XNU