]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/mach_loader.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-1228.12.14.tar.gz
[apple/xnu.git] / bsd / kern / mach_loader.c
1 /*
2 * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (C) 1988, 1989, NeXT, Inc.
30 *
31 * File: kern/mach_loader.c
32 * Author: Avadis Tevanian, Jr.
33 *
34 * Mach object file loader (kernel version, for now).
35 *
36 * 21-Jul-88 Avadis Tevanian, Jr. (avie) at NeXT
37 * Started.
38 */
39
40 #include <sys/param.h>
41 #include <sys/vnode_internal.h>
42 #include <sys/uio.h>
43 #include <sys/namei.h>
44 #include <sys/proc_internal.h>
45 #include <sys/kauth.h>
46 #include <sys/stat.h>
47 #include <sys/malloc.h>
48 #include <sys/mount_internal.h>
49 #include <sys/fcntl.h>
50 #include <sys/ubc_internal.h>
51 #include <sys/imgact.h>
52
53 #include <mach/mach_types.h>
54 #include <mach/vm_map.h> /* vm_allocate() */
55 #include <mach/mach_vm.h> /* mach_vm_allocate() */
56 #include <mach/vm_statistics.h>
57 #include <mach/task.h>
58 #include <mach/thread_act.h>
59
60 #include <machine/vmparam.h>
61 #include <machine/exec.h>
62
63 #include <kern/kern_types.h>
64 #include <kern/cpu_number.h>
65 #include <kern/mach_loader.h>
66 #include <kern/kalloc.h>
67 #include <kern/task.h>
68 #include <kern/thread.h>
69 #include <kern/page_decrypt.h>
70
71 #include <mach-o/fat.h>
72 #include <mach-o/loader.h>
73
74 #include <vm/pmap.h>
75 #include <vm/vm_map.h>
76 #include <vm/vm_kern.h>
77 #include <vm/vm_pager.h>
78 #include <vm/vnode_pager.h>
79 #include <vm/vm_protos.h>
80
81 /*
82 * XXX vm/pmap.h should not treat these prototypes as MACH_KERNEL_PRIVATE
83 * when KERNEL is defined.
84 */
85 extern pmap_t pmap_create(vm_map_size_t size, boolean_t is_64bit);
86 extern void pmap_switch(pmap_t);
87
88 /*
89 * XXX kern/thread.h should not treat these prototypes as MACH_KERNEL_PRIVATE
90 * when KERNEL is defined.
91 */
92 extern kern_return_t thread_setstatus(thread_t thread, int flavor,
93 thread_state_t tstate,
94 mach_msg_type_number_t count);
95
96 extern kern_return_t thread_state_initialize(thread_t thread);
97
98
99 /* XXX should have prototypes in a shared header file */
100 extern int get_map_nentries(vm_map_t);
101 extern kern_return_t thread_userstack(thread_t, int, thread_state_t,
102 unsigned int, mach_vm_offset_t *, int *);
103 extern kern_return_t thread_entrypoint(thread_t, int, thread_state_t,
104 unsigned int, mach_vm_offset_t *);
105
106 extern kern_return_t memory_object_signed(memory_object_control_t control,
107 boolean_t is_signed);
108
109 /* An empty load_result_t */
110 static load_result_t load_result_null = {
111 .mach_header = MACH_VM_MIN_ADDRESS,
112 .entry_point = MACH_VM_MIN_ADDRESS,
113 .user_stack = MACH_VM_MIN_ADDRESS,
114 .thread_count = 0,
115 .unixproc = 0,
116 .dynlinker = 0,
117 .customstack = 0,
118 .csflags = 0
119 };
120
121 /*
122 * Prototypes of static functions.
123 */
124 static load_return_t
125 parse_machfile(
126 struct vnode *vp,
127 vm_map_t map,
128 thread_t thread,
129 struct mach_header *header,
130 off_t file_offset,
131 off_t macho_size,
132 int depth,
133 load_result_t *result
134 );
135
136 static load_return_t
137 load_segment(
138 struct segment_command *scp,
139 void * pager,
140 off_t pager_offset,
141 off_t macho_size,
142 off_t end_of_file,
143 vm_map_t map,
144 load_result_t *result
145 );
146
147 static load_return_t
148 load_segment_64(
149 struct segment_command_64 *scp64,
150 void *pager,
151 off_t pager_offset,
152 off_t macho_size,
153 off_t end_of_file,
154 vm_map_t map,
155 load_result_t *result
156 );
157
158 int load_code_signature(
159 struct linkedit_data_command *lcp,
160 struct vnode *vp,
161 off_t macho_offset,
162 off_t macho_size,
163 cpu_type_t cputype,
164 load_result_t *result);
165
166 #if CONFIG_CODE_DECRYPTION
167 static load_return_t
168 set_code_unprotect(
169 struct encryption_info_command *lcp,
170 caddr_t addr,
171 vm_map_t map,
172 struct vnode *vp);
173 #endif
174
175 static load_return_t
176 load_unixthread(
177 struct thread_command *tcp,
178 thread_t thread,
179 load_result_t *result
180 );
181
182 static load_return_t
183 load_thread(
184 struct thread_command *tcp,
185 thread_t thread,
186 load_result_t *result
187 );
188
189 static load_return_t
190 load_threadstate(
191 thread_t thread,
192 unsigned long *ts,
193 unsigned long total_size
194 );
195
196 static load_return_t
197 load_threadstack(
198 thread_t thread,
199 unsigned long *ts,
200 unsigned long total_size,
201 user_addr_t *user_stack,
202 int *customstack
203 );
204
205 static load_return_t
206 load_threadentry(
207 thread_t thread,
208 unsigned long *ts,
209 unsigned long total_size,
210 mach_vm_offset_t *entry_point
211 );
212
213 static load_return_t
214 load_dylinker(
215 struct dylinker_command *lcp,
216 integer_t archbits,
217 vm_map_t map,
218 thread_t thread,
219 int depth,
220 load_result_t *result,
221 boolean_t is_64bit
222 );
223
224 static load_return_t
225 get_macho_vnode(
226 char *path,
227 integer_t archbits,
228 struct mach_header *mach_header,
229 off_t *file_offset,
230 off_t *macho_size,
231 struct vnode **vpp
232 );
233
234 load_return_t
235 load_machfile(
236 struct image_params *imgp,
237 struct mach_header *header,
238 thread_t thread,
239 vm_map_t new_map,
240 load_result_t *result
241 )
242 {
243 struct vnode *vp = imgp->ip_vp;
244 off_t file_offset = imgp->ip_arch_offset;
245 off_t macho_size = imgp->ip_arch_size;
246
247 pmap_t pmap = 0; /* protected by create_map */
248 vm_map_t map;
249 vm_map_t old_map;
250 load_result_t myresult;
251 load_return_t lret;
252 boolean_t create_map = TRUE;
253
254 if (new_map != VM_MAP_NULL) {
255 create_map = FALSE;
256 }
257
258 if (create_map) {
259 old_map = current_map();
260 pmap = pmap_create((vm_map_size_t) 0, (imgp->ip_flags & IMGPF_IS_64BIT));
261 map = vm_map_create(pmap,
262 0,
263 vm_compute_max_offset((imgp->ip_flags & IMGPF_IS_64BIT)),
264 TRUE);
265 } else
266 map = new_map;
267
268 if ( (header->flags & MH_ALLOW_STACK_EXECUTION) )
269 vm_map_disable_NX(map);
270
271 if (!result)
272 result = &myresult;
273
274 *result = load_result_null;
275
276 lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
277 0, result);
278
279 if (lret != LOAD_SUCCESS) {
280 if (create_map) {
281 vm_map_deallocate(map); /* will lose pmap reference too */
282 }
283 return(lret);
284 }
285
286 /*
287 * For 64-bit users, check for presence of a 4GB page zero
288 * which will enable the kernel to share the user's address space
289 * and hence avoid TLB flushes on kernel entry/exit
290 */
291 if ((imgp->ip_flags & IMGPF_IS_64BIT) &&
292 vm_map_has_4GB_pagezero(map))
293 vm_map_set_4GB_pagezero(map);
294
295 /*
296 * Commit to new map. First make sure that the current
297 * users of the task get done with it, and that we clean
298 * up the old contents of IPC and memory. The task is
299 * guaranteed to be single threaded upon return (us).
300 *
301 * Swap the new map for the old, which consumes our new map
302 * reference but each leaves us responsible for the old_map reference.
303 * That lets us get off the pmap associated with it, and
304 * then we can release it.
305 */
306
307 if (create_map) {
308 task_halt(current_task());
309
310 old_map = swap_task_map(current_task(), map);
311 vm_map_clear_4GB_pagezero(old_map);
312 pmap_switch(pmap); /* Make sure we are using the new pmap */
313 vm_map_deallocate(old_map);
314 }
315 return(LOAD_SUCCESS);
316 }
317
318 /*
319 * The file size of a mach-o file is limited to 32 bits; this is because
320 * this is the limit on the kalloc() of enough bytes for a mach_header and
321 * the contents of its sizeofcmds, which is currently constrained to 32
322 * bits in the file format itself. We read into the kernel buffer the
323 * commands section, and then parse it in order to parse the mach-o file
324 * format load_command segment(s). We are only interested in a subset of
325 * the total set of possible commands.
326 */
327 static
328 load_return_t
329 parse_machfile(
330 struct vnode *vp,
331 vm_map_t map,
332 thread_t thread,
333 struct mach_header *header,
334 off_t file_offset,
335 off_t macho_size,
336 int depth,
337 load_result_t *result
338 )
339 {
340 uint32_t ncmds;
341 struct load_command *lcp;
342 struct dylinker_command *dlp = 0;
343 integer_t dlarchbits = 0;
344 void * pager;
345 load_return_t ret = LOAD_SUCCESS;
346 caddr_t addr;
347 void * kl_addr;
348 vm_size_t size,kl_size;
349 size_t offset;
350 size_t oldoffset; /* for overflow check */
351 int pass;
352 proc_t p = current_proc(); /* XXXX */
353 int error;
354 int resid=0;
355 task_t task;
356 size_t mach_header_sz = sizeof(struct mach_header);
357 boolean_t abi64;
358 boolean_t got_code_signatures = FALSE;
359
360 if (header->magic == MH_MAGIC_64 ||
361 header->magic == MH_CIGAM_64) {
362 mach_header_sz = sizeof(struct mach_header_64);
363 }
364
365 /*
366 * Break infinite recursion
367 */
368 if (depth > 6) {
369 return(LOAD_FAILURE);
370 }
371
372 task = (task_t)get_threadtask(thread);
373
374 depth++;
375
376 /*
377 * Check to see if right machine type.
378 */
379 if (((cpu_type_t)(header->cputype & ~CPU_ARCH_MASK) != cpu_type()) ||
380 !grade_binary(header->cputype,
381 header->cpusubtype & ~CPU_SUBTYPE_MASK))
382 return(LOAD_BADARCH);
383
384 abi64 = ((header->cputype & CPU_ARCH_ABI64) == CPU_ARCH_ABI64);
385
386 switch (header->filetype) {
387
388 case MH_OBJECT:
389 case MH_EXECUTE:
390 case MH_PRELOAD:
391 if (depth != 1) {
392 return (LOAD_FAILURE);
393 }
394 break;
395
396 case MH_FVMLIB:
397 case MH_DYLIB:
398 if (depth == 1) {
399 return (LOAD_FAILURE);
400 }
401 break;
402
403 case MH_DYLINKER:
404 if (depth != 2) {
405 return (LOAD_FAILURE);
406 }
407 break;
408
409 default:
410 return (LOAD_FAILURE);
411 }
412
413 /*
414 * Get the pager for the file.
415 */
416 pager = (void *) ubc_getpager(vp);
417
418 /*
419 * Map portion that must be accessible directly into
420 * kernel's map.
421 */
422 if ((mach_header_sz + header->sizeofcmds) > macho_size)
423 return(LOAD_BADMACHO);
424
425 /*
426 * Round size of Mach-O commands up to page boundry.
427 */
428 size = round_page(mach_header_sz + header->sizeofcmds);
429 if (size <= 0)
430 return(LOAD_BADMACHO);
431
432 /*
433 * Map the load commands into kernel memory.
434 */
435 addr = 0;
436 kl_size = size;
437 kl_addr = kalloc(size);
438 addr = (caddr_t)kl_addr;
439 if (addr == NULL)
440 return(LOAD_NOSPACE);
441
442 error = vn_rdwr(UIO_READ, vp, addr, size, file_offset,
443 UIO_SYSSPACE32, 0, kauth_cred_get(), &resid, p);
444 if (error) {
445 if (kl_addr )
446 kfree(kl_addr, kl_size);
447 return(LOAD_IOERROR);
448 }
449
450 /*
451 * Scan through the commands, processing each one as necessary.
452 */
453 for (pass = 1; pass <= 2; pass++) {
454 /*
455 * Loop through each of the load_commands indicated by the
456 * Mach-O header; if an absurd value is provided, we just
457 * run off the end of the reserved section by incrementing
458 * the offset too far, so we are implicitly fail-safe.
459 */
460 offset = mach_header_sz;
461 ncmds = header->ncmds;
462 while (ncmds--) {
463 /*
464 * Get a pointer to the command.
465 */
466 lcp = (struct load_command *)(addr + offset);
467 oldoffset = offset;
468 offset += lcp->cmdsize;
469
470 /*
471 * Perform prevalidation of the struct load_command
472 * before we attempt to use its contents. Invalid
473 * values are ones which result in an overflow, or
474 * which can not possibly be valid commands, or which
475 * straddle or exist past the reserved section at the
476 * start of the image.
477 */
478 if (oldoffset > offset ||
479 lcp->cmdsize < sizeof(struct load_command) ||
480 offset > header->sizeofcmds + mach_header_sz) {
481 ret = LOAD_BADMACHO;
482 break;
483 }
484
485 /*
486 * Act on struct load_command's for which kernel
487 * intervention is required.
488 */
489 switch(lcp->cmd) {
490 case LC_SEGMENT_64:
491 if (pass != 1)
492 break;
493 ret = load_segment_64(
494 (struct segment_command_64 *)lcp,
495 pager,
496 file_offset,
497 macho_size,
498 ubc_getsize(vp),
499 map,
500 result);
501 break;
502 case LC_SEGMENT:
503 if (pass != 1)
504 break;
505 ret = load_segment(
506 (struct segment_command *) lcp,
507 pager,
508 file_offset,
509 macho_size,
510 ubc_getsize(vp),
511 map,
512 result);
513 break;
514 case LC_THREAD:
515 if (pass != 2)
516 break;
517 ret = load_thread((struct thread_command *)lcp,
518 thread,
519 result);
520 break;
521 case LC_UNIXTHREAD:
522 if (pass != 2)
523 break;
524 ret = load_unixthread(
525 (struct thread_command *) lcp,
526 thread,
527 result);
528 break;
529 case LC_LOAD_DYLINKER:
530 if (pass != 2)
531 break;
532 if ((depth == 1) && (dlp == 0)) {
533 dlp = (struct dylinker_command *)lcp;
534 dlarchbits = (header->cputype & CPU_ARCH_MASK);
535 } else {
536 ret = LOAD_FAILURE;
537 }
538 break;
539 case LC_CODE_SIGNATURE:
540 /* CODE SIGNING */
541 if (pass != 2)
542 break;
543 /* pager -> uip ->
544 load signatures & store in uip
545 set VM object "signed_pages"
546 */
547 ret = load_code_signature(
548 (struct linkedit_data_command *) lcp,
549 vp,
550 file_offset,
551 macho_size,
552 header->cputype,
553 (depth == 1) ? result : NULL);
554 if (ret != LOAD_SUCCESS) {
555 printf("proc %d: load code signature error %d "
556 "for file \"%s\"\n",
557 p->p_pid, ret, vp->v_name);
558 ret = LOAD_SUCCESS; /* ignore error */
559 } else {
560 got_code_signatures = TRUE;
561 }
562 break;
563 #if CONFIG_CODE_DECRYPTION
564 case LC_ENCRYPTION_INFO:
565 if (pass != 2)
566 break;
567 ret = set_code_unprotect(
568 (struct encryption_info_command *) lcp,
569 addr, map, vp);
570 if (ret != LOAD_SUCCESS) {
571 printf("proc %d: set_code_unprotect() error %d "
572 "for file \"%s\"\n",
573 p->p_pid, ret, vp->v_name);
574 /* Don't let the app run if it's
575 * encrypted but we failed to set up the
576 * decrypter */
577 psignal(p, SIGKILL);
578 }
579 break;
580 #endif
581 default:
582 /* Other commands are ignored by the kernel */
583 ret = LOAD_SUCCESS;
584 break;
585 }
586 if (ret != LOAD_SUCCESS)
587 break;
588 }
589 if (ret != LOAD_SUCCESS)
590 break;
591 }
592 if (ret == LOAD_SUCCESS) {
593 if (! got_code_signatures) {
594 struct cs_blob *blob;
595 /* no embedded signatures: look for detached ones */
596 blob = ubc_cs_blob_get(vp, -1, file_offset);
597 if (blob != NULL) {
598 /* get flags to be applied to the process */
599 result->csflags |= blob->csb_flags;
600 }
601 }
602
603 if (dlp != 0)
604 ret = load_dylinker(dlp, dlarchbits, map, thread, depth, result, abi64);
605
606 if(depth == 1) {
607 if (result->thread_count == 0) {
608 ret = LOAD_FAILURE;
609 } else if ( abi64 ) {
610 #ifdef __ppc__
611 /* Map in 64-bit commpage */
612 /* LP64todo - make this clean */
613 /*
614 * PPC51: ppc64 is limited to 51-bit addresses.
615 * Memory above that limit is handled specially
616 * at the pmap level.
617 */
618 pmap_map_sharedpage(current_task(), get_map_pmap(map));
619 #endif /* __ppc__ */
620 }
621 }
622 }
623
624 if (kl_addr )
625 kfree(kl_addr, kl_size);
626
627 return(ret);
628 }
629
630 #if CONFIG_CODE_DECRYPTION
631
632 #define APPLE_UNPROTECTED_HEADER_SIZE (3 * PAGE_SIZE_64)
633
634 static load_return_t
635 unprotect_segment_64(
636 uint64_t file_off,
637 uint64_t file_size,
638 vm_map_t map,
639 vm_map_offset_t map_addr,
640 vm_map_size_t map_size)
641 {
642 kern_return_t kr;
643
644 /*
645 * The first APPLE_UNPROTECTED_HEADER_SIZE bytes (from offset 0 of
646 * this part of a Universal binary) are not protected...
647 * The rest needs to be "transformed".
648 */
649 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE &&
650 file_off + file_size <= APPLE_UNPROTECTED_HEADER_SIZE) {
651 /* it's all unprotected, nothing to do... */
652 kr = KERN_SUCCESS;
653 } else {
654 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE) {
655 /*
656 * We start mapping in the unprotected area.
657 * Skip the unprotected part...
658 */
659 vm_map_offset_t delta;
660
661 delta = APPLE_UNPROTECTED_HEADER_SIZE;
662 delta -= file_off;
663 map_addr += delta;
664 map_size -= delta;
665 }
666 /* ... transform the rest of the mapping. */
667 struct pager_crypt_info crypt_info;
668 crypt_info.page_decrypt = dsmos_page_transform;
669 crypt_info.crypt_ops = NULL;
670 crypt_info.crypt_end = NULL;
671 kr = vm_map_apple_protected(map,
672 map_addr,
673 map_addr + map_size,
674 &crypt_info);
675 }
676
677 if (kr != KERN_SUCCESS) {
678 return LOAD_FAILURE;
679 }
680 return LOAD_SUCCESS;
681 }
682 #else /* CONFIG_CODE_DECRYPTION */
683 #define unprotect_segment_64(file_off, file_size, map, map_addr, map_size) \
684 LOAD_SUCCESS
685 #endif /* CONFIG_CODE_DECRYPTION */
686
687 static
688 load_return_t
689 load_segment(
690 struct segment_command *scp,
691 void * pager,
692 off_t pager_offset,
693 off_t macho_size,
694 __unused off_t end_of_file,
695 vm_map_t map,
696 load_result_t *result
697 )
698 {
699 kern_return_t ret;
700 vm_offset_t map_addr, map_offset;
701 vm_size_t map_size, seg_size, delta_size;
702 vm_prot_t initprot;
703 vm_prot_t maxprot;
704
705 /*
706 * Make sure what we get from the file is really ours (as specified
707 * by macho_size).
708 */
709 if (scp->fileoff + scp->filesize > macho_size)
710 return (LOAD_BADMACHO);
711 /*
712 * Make sure the segment is page-aligned in the file.
713 */
714 if ((scp->fileoff & PAGE_MASK) != 0)
715 return LOAD_BADMACHO;
716
717 seg_size = round_page(scp->vmsize);
718 if (seg_size == 0)
719 return(KERN_SUCCESS);
720
721 /*
722 * Round sizes to page size.
723 */
724 map_size = round_page(scp->filesize);
725 map_addr = trunc_page(scp->vmaddr);
726
727 #if 0 /* XXX (4596982) this interferes with Rosetta */
728 if (map_addr == 0 &&
729 map_size == 0 &&
730 seg_size != 0 &&
731 (scp->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
732 (scp->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
733 /*
734 * This is a "page zero" segment: it starts at address 0,
735 * is not mapped from the binary file and is not accessible.
736 * User-space should never be able to access that memory, so
737 * make it completely off limits by raising the VM map's
738 * minimum offset.
739 */
740 ret = vm_map_raise_min_offset(map, (vm_map_offset_t) seg_size);
741 if (ret != KERN_SUCCESS) {
742 return LOAD_FAILURE;
743 }
744 return LOAD_SUCCESS;
745 }
746 #endif
747
748 map_offset = pager_offset + scp->fileoff;
749
750 if (map_size > 0) {
751 initprot = (scp->initprot) & VM_PROT_ALL;
752 maxprot = (scp->maxprot) & VM_PROT_ALL;
753 /*
754 * Map a copy of the file into the address space.
755 */
756 ret = vm_map(map,
757 &map_addr, map_size, (vm_offset_t)0,
758 VM_FLAGS_FIXED, pager, map_offset, TRUE,
759 initprot, maxprot,
760 VM_INHERIT_DEFAULT);
761 if (ret != KERN_SUCCESS)
762 return(LOAD_NOSPACE);
763
764 /*
765 * If the file didn't end on a page boundary,
766 * we need to zero the leftover.
767 */
768 delta_size = map_size - scp->filesize;
769 #if FIXME
770 if (delta_size > 0) {
771 vm_offset_t tmp;
772
773 ret = vm_allocate(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE);
774 if (ret != KERN_SUCCESS)
775 return(LOAD_RESOURCE);
776
777 if (copyout(tmp, map_addr + scp->filesize,
778 delta_size)) {
779 (void) vm_deallocate(
780 kernel_map, tmp, delta_size);
781 return(LOAD_FAILURE);
782 }
783
784 (void) vm_deallocate(kernel_map, tmp, delta_size);
785 }
786 #endif /* FIXME */
787 }
788
789 /*
790 * If the virtual size of the segment is greater
791 * than the size from the file, we need to allocate
792 * zero fill memory for the rest.
793 */
794 delta_size = seg_size - map_size;
795 if (delta_size > 0) {
796 vm_offset_t tmp = map_addr + map_size;
797
798 ret = vm_map(map, &tmp, delta_size, 0, VM_FLAGS_FIXED,
799 NULL, 0, FALSE,
800 scp->initprot, scp->maxprot,
801 VM_INHERIT_DEFAULT);
802 if (ret != KERN_SUCCESS)
803 return(LOAD_NOSPACE);
804 }
805
806 if ( (scp->fileoff == 0) && (scp->filesize != 0) )
807 result->mach_header = map_addr;
808
809 if (scp->flags & SG_PROTECTED_VERSION_1) {
810 ret = unprotect_segment_64((uint64_t) scp->fileoff,
811 (uint64_t) scp->filesize,
812 map,
813 (vm_map_offset_t) map_addr,
814 (vm_map_size_t) map_size);
815 } else {
816 ret = LOAD_SUCCESS;
817 }
818
819 return ret;
820 }
821
822 static
823 load_return_t
824 load_segment_64(
825 struct segment_command_64 *scp64,
826 void * pager,
827 off_t pager_offset,
828 off_t macho_size,
829 __unused off_t end_of_file,
830 vm_map_t map,
831 load_result_t *result
832 )
833 {
834 kern_return_t ret;
835 mach_vm_offset_t map_addr, map_offset;
836 mach_vm_size_t map_size, seg_size, delta_size;
837 vm_prot_t initprot;
838 vm_prot_t maxprot;
839
840 /*
841 * Make sure what we get from the file is really ours (as specified
842 * by macho_size).
843 */
844 if (scp64->fileoff + scp64->filesize > (uint64_t)macho_size)
845 return (LOAD_BADMACHO);
846 /*
847 * Make sure the segment is page-aligned in the file.
848 */
849 if ((scp64->fileoff & PAGE_MASK_64) != 0)
850 return LOAD_BADMACHO;
851
852 seg_size = round_page_64(scp64->vmsize);
853 if (seg_size == 0)
854 return(KERN_SUCCESS);
855
856 /*
857 * Round sizes to page size.
858 */
859 map_size = round_page_64(scp64->filesize); /* limited to 32 bits */
860 map_addr = round_page_64(scp64->vmaddr);
861
862 if (map_addr == 0 &&
863 map_size == 0 &&
864 seg_size != 0 &&
865 (scp64->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
866 (scp64->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
867 /*
868 * This is a "page zero" segment: it starts at address 0,
869 * is not mapped from the binary file and is not accessible.
870 * User-space should never be able to access that memory, so
871 * make it completely off limits by raising the VM map's
872 * minimum offset.
873 */
874 ret = vm_map_raise_min_offset(map, seg_size);
875 if (ret != KERN_SUCCESS) {
876 return LOAD_FAILURE;
877 }
878 return LOAD_SUCCESS;
879 }
880
881 map_offset = pager_offset + scp64->fileoff; /* limited to 32 bits */
882
883 if (map_size > 0) {
884 initprot = (scp64->initprot) & VM_PROT_ALL;
885 maxprot = (scp64->maxprot) & VM_PROT_ALL;
886 /*
887 * Map a copy of the file into the address space.
888 */
889 ret = mach_vm_map(map,
890 &map_addr, map_size, (mach_vm_offset_t)0,
891 VM_FLAGS_FIXED, pager, map_offset, TRUE,
892 initprot, maxprot,
893 VM_INHERIT_DEFAULT);
894 if (ret != KERN_SUCCESS)
895 return(LOAD_NOSPACE);
896
897 /*
898 * If the file didn't end on a page boundary,
899 * we need to zero the leftover.
900 */
901 delta_size = map_size - scp64->filesize;
902 #if FIXME
903 if (delta_size > 0) {
904 mach_vm_offset_t tmp;
905
906 ret = vm_allocate(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE);
907 if (ret != KERN_SUCCESS)
908 return(LOAD_RESOURCE);
909
910 if (copyout(tmp, map_addr + scp64->filesize,
911 delta_size)) {
912 (void) vm_deallocate(
913 kernel_map, tmp, delta_size);
914 return (LOAD_FAILURE);
915 }
916
917 (void) vm_deallocate(kernel_map, tmp, delta_size);
918 }
919 #endif /* FIXME */
920 }
921
922 /*
923 * If the virtual size of the segment is greater
924 * than the size from the file, we need to allocate
925 * zero fill memory for the rest.
926 */
927 delta_size = seg_size - map_size;
928 if (delta_size > 0) {
929 mach_vm_offset_t tmp = map_addr + map_size;
930
931 ret = mach_vm_map(map, &tmp, delta_size, 0, VM_FLAGS_FIXED,
932 NULL, 0, FALSE,
933 scp64->initprot, scp64->maxprot,
934 VM_INHERIT_DEFAULT);
935 if (ret != KERN_SUCCESS)
936 return(LOAD_NOSPACE);
937 }
938
939 if ( (scp64->fileoff == 0) && (scp64->filesize != 0) )
940 result->mach_header = map_addr;
941
942 if (scp64->flags & SG_PROTECTED_VERSION_1) {
943 ret = unprotect_segment_64(scp64->fileoff,
944 scp64->filesize,
945 map,
946 map_addr,
947 map_size);
948 } else {
949 ret = LOAD_SUCCESS;
950 }
951
952 return ret;
953 }
954
955 static
956 load_return_t
957 load_thread(
958 struct thread_command *tcp,
959 thread_t thread,
960 load_result_t *result
961 )
962 {
963 kern_return_t kret;
964 load_return_t lret;
965 task_t task;
966 int customstack=0;
967
968 task = get_threadtask(thread);
969
970 /* if count is 0; same as thread */
971 if (result->thread_count != 0) {
972 kret = thread_create(task, &thread);
973 if (kret != KERN_SUCCESS)
974 return(LOAD_RESOURCE);
975 thread_deallocate(thread);
976 }
977
978 lret = load_threadstate(thread,
979 (unsigned long *)(((vm_offset_t)tcp) +
980 sizeof(struct thread_command)),
981 tcp->cmdsize - sizeof(struct thread_command));
982 if (lret != LOAD_SUCCESS)
983 return (lret);
984
985 if (result->thread_count == 0) {
986 lret = load_threadstack(thread,
987 (unsigned long *)(((vm_offset_t)tcp) +
988 sizeof(struct thread_command)),
989 tcp->cmdsize - sizeof(struct thread_command),
990 &result->user_stack,
991 &customstack);
992 if (customstack)
993 result->customstack = 1;
994 else
995 result->customstack = 0;
996
997 if (lret != LOAD_SUCCESS)
998 return(lret);
999
1000 lret = load_threadentry(thread,
1001 (unsigned long *)(((vm_offset_t)tcp) +
1002 sizeof(struct thread_command)),
1003 tcp->cmdsize - sizeof(struct thread_command),
1004 &result->entry_point);
1005 if (lret != LOAD_SUCCESS)
1006 return(lret);
1007 }
1008 /*
1009 * Resume thread now, note that this means that the thread
1010 * commands should appear after all the load commands to
1011 * be sure they don't reference anything not yet mapped.
1012 */
1013 else
1014 thread_resume(thread);
1015
1016 result->thread_count++;
1017
1018 return(LOAD_SUCCESS);
1019 }
1020
1021 static
1022 load_return_t
1023 load_unixthread(
1024 struct thread_command *tcp,
1025 thread_t thread,
1026 load_result_t *result
1027 )
1028 {
1029 load_return_t ret;
1030 int customstack =0;
1031
1032 if (result->thread_count != 0) {
1033 printf("load_unixthread: already have a thread!");
1034 return (LOAD_FAILURE);
1035 }
1036
1037 ret = load_threadstack(thread,
1038 (unsigned long *)(((vm_offset_t)tcp) +
1039 sizeof(struct thread_command)),
1040 tcp->cmdsize - sizeof(struct thread_command),
1041 &result->user_stack,
1042 &customstack);
1043 if (ret != LOAD_SUCCESS)
1044 return(ret);
1045
1046 if (customstack)
1047 result->customstack = 1;
1048 else
1049 result->customstack = 0;
1050 ret = load_threadentry(thread,
1051 (unsigned long *)(((vm_offset_t)tcp) +
1052 sizeof(struct thread_command)),
1053 tcp->cmdsize - sizeof(struct thread_command),
1054 &result->entry_point);
1055 if (ret != LOAD_SUCCESS)
1056 return(ret);
1057
1058 ret = load_threadstate(thread,
1059 (unsigned long *)(((vm_offset_t)tcp) +
1060 sizeof(struct thread_command)),
1061 tcp->cmdsize - sizeof(struct thread_command));
1062 if (ret != LOAD_SUCCESS)
1063 return (ret);
1064
1065 result->unixproc = TRUE;
1066 result->thread_count++;
1067
1068 return(LOAD_SUCCESS);
1069 }
1070
1071 static
1072 load_return_t
1073 load_threadstate(
1074 thread_t thread,
1075 unsigned long *ts,
1076 unsigned long total_size
1077 )
1078 {
1079 kern_return_t ret;
1080 unsigned long size;
1081 int flavor;
1082 unsigned long thread_size;
1083
1084 ret = thread_state_initialize( thread );
1085 if (ret != KERN_SUCCESS) {
1086 return(LOAD_FAILURE);
1087 }
1088
1089 /*
1090 * Set the new thread state; iterate through the state flavors in
1091 * the mach-o file.
1092 */
1093 while (total_size > 0) {
1094 flavor = *ts++;
1095 size = *ts++;
1096 thread_size = (size+2)*sizeof(unsigned long);
1097 if (thread_size > total_size)
1098 return(LOAD_BADMACHO);
1099 total_size -= thread_size;
1100 /*
1101 * Third argument is a kernel space pointer; it gets cast
1102 * to the appropriate type in machine_thread_set_state()
1103 * based on the value of flavor.
1104 */
1105 ret = thread_setstatus(thread, flavor, (thread_state_t)ts, size);
1106 if (ret != KERN_SUCCESS) {
1107 return(LOAD_FAILURE);
1108 }
1109 ts += size; /* ts is a (unsigned long *) */
1110 }
1111 return(LOAD_SUCCESS);
1112 }
1113
1114 static
1115 load_return_t
1116 load_threadstack(
1117 thread_t thread,
1118 unsigned long *ts,
1119 unsigned long total_size,
1120 user_addr_t *user_stack,
1121 int *customstack
1122 )
1123 {
1124 kern_return_t ret;
1125 unsigned long size;
1126 int flavor;
1127 unsigned long stack_size;
1128
1129 while (total_size > 0) {
1130 flavor = *ts++;
1131 size = *ts++;
1132 stack_size = (size+2)*sizeof(unsigned long);
1133 if (stack_size > total_size)
1134 return(LOAD_BADMACHO);
1135 total_size -= stack_size;
1136
1137 /*
1138 * Third argument is a kernel space pointer; it gets cast
1139 * to the appropriate type in thread_userstack() based on
1140 * the value of flavor.
1141 */
1142 ret = thread_userstack(thread, flavor, (thread_state_t)ts, size, user_stack, customstack);
1143 if (ret != KERN_SUCCESS) {
1144 return(LOAD_FAILURE);
1145 }
1146 ts += size; /* ts is a (unsigned long *) */
1147 }
1148 return(LOAD_SUCCESS);
1149 }
1150
1151 static
1152 load_return_t
1153 load_threadentry(
1154 thread_t thread,
1155 unsigned long *ts,
1156 unsigned long total_size,
1157 mach_vm_offset_t *entry_point
1158 )
1159 {
1160 kern_return_t ret;
1161 unsigned long size;
1162 int flavor;
1163 unsigned long entry_size;
1164
1165 /*
1166 * Set the thread state.
1167 */
1168 *entry_point = MACH_VM_MIN_ADDRESS;
1169 while (total_size > 0) {
1170 flavor = *ts++;
1171 size = *ts++;
1172 entry_size = (size+2)*sizeof(unsigned long);
1173 if (entry_size > total_size)
1174 return(LOAD_BADMACHO);
1175 total_size -= entry_size;
1176 /*
1177 * Third argument is a kernel space pointer; it gets cast
1178 * to the appropriate type in thread_entrypoint() based on
1179 * the value of flavor.
1180 */
1181 ret = thread_entrypoint(thread, flavor, (thread_state_t)ts, size, entry_point);
1182 if (ret != KERN_SUCCESS) {
1183 return(LOAD_FAILURE);
1184 }
1185 ts += size; /* ts is a (unsigned long *) */
1186 }
1187 return(LOAD_SUCCESS);
1188 }
1189
1190
1191 static
1192 load_return_t
1193 load_dylinker(
1194 struct dylinker_command *lcp,
1195 integer_t archbits,
1196 vm_map_t map,
1197 thread_t thread,
1198 int depth,
1199 load_result_t *result,
1200 boolean_t is_64bit
1201 )
1202 {
1203 char *name;
1204 char *p;
1205 struct vnode *vp = NULLVP; /* set by get_macho_vnode() */
1206 struct mach_header header;
1207 off_t file_offset = 0; /* set by get_macho_vnode() */
1208 off_t macho_size = 0; /* set by get_macho_vnode() */
1209 vm_map_t copy_map;
1210 load_result_t myresult;
1211 kern_return_t ret;
1212 vm_map_copy_t tmp;
1213 mach_vm_offset_t dyl_start, map_addr;
1214 mach_vm_size_t dyl_length;
1215
1216 name = (char *)lcp + lcp->name.offset;
1217 /*
1218 * Check for a proper null terminated string.
1219 */
1220 p = name;
1221 do {
1222 if (p >= (char *)lcp + lcp->cmdsize)
1223 return(LOAD_BADMACHO);
1224 } while (*p++);
1225
1226 ret = get_macho_vnode(name, archbits, &header, &file_offset, &macho_size, &vp);
1227 if (ret)
1228 return (ret);
1229
1230 myresult = load_result_null;
1231
1232 /*
1233 * First try to map dyld in directly. This should work most of
1234 * the time since there shouldn't normally be something already
1235 * mapped to its address.
1236 */
1237
1238 ret = parse_machfile(vp, map, thread, &header, file_offset, macho_size,
1239 depth, &myresult);
1240
1241 /*
1242 * If it turned out something was in the way, then we'll take
1243 * take this longer path to map dyld into a temporary map and
1244 * copy it into destination map at a different address.
1245 */
1246
1247 if (ret == LOAD_NOSPACE) {
1248
1249 /*
1250 * Load the Mach-O.
1251 * Use a temporary map to do the work.
1252 */
1253 copy_map = vm_map_create(pmap_create(vm_map_round_page(macho_size),
1254 is_64bit),
1255 get_map_min(map), get_map_max(map), TRUE);
1256 if (VM_MAP_NULL == copy_map) {
1257 ret = LOAD_RESOURCE;
1258 goto out;
1259 }
1260
1261 myresult = load_result_null;
1262
1263 ret = parse_machfile(vp, copy_map, thread, &header,
1264 file_offset, macho_size,
1265 depth, &myresult);
1266
1267 if (ret) {
1268 vm_map_deallocate(copy_map);
1269 goto out;
1270 }
1271
1272 if (get_map_nentries(copy_map) > 0) {
1273
1274 dyl_start = mach_get_vm_start(copy_map);
1275 dyl_length = mach_get_vm_end(copy_map) - dyl_start;
1276
1277 map_addr = dyl_start;
1278 ret = mach_vm_allocate(map, &map_addr, dyl_length, VM_FLAGS_ANYWHERE);
1279
1280 if (ret != KERN_SUCCESS) {
1281 vm_map_deallocate(copy_map);
1282 ret = LOAD_NOSPACE;
1283 goto out;
1284
1285 }
1286
1287 ret = vm_map_copyin(copy_map,
1288 (vm_map_address_t)dyl_start,
1289 (vm_map_size_t)dyl_length,
1290 TRUE, &tmp);
1291 if (ret != KERN_SUCCESS) {
1292 (void) vm_map_remove(map,
1293 vm_map_trunc_page(map_addr),
1294 vm_map_round_page(map_addr + dyl_length),
1295 VM_MAP_NO_FLAGS);
1296 vm_map_deallocate(copy_map);
1297 goto out;
1298 }
1299
1300 ret = vm_map_copy_overwrite(map,
1301 (vm_map_address_t)map_addr,
1302 tmp, FALSE);
1303 if (ret != KERN_SUCCESS) {
1304 vm_map_copy_discard(tmp);
1305 (void) vm_map_remove(map,
1306 vm_map_trunc_page(map_addr),
1307 vm_map_round_page(map_addr + dyl_length),
1308 VM_MAP_NO_FLAGS);
1309 vm_map_deallocate(copy_map);
1310 goto out;
1311 }
1312
1313 if (map_addr != dyl_start)
1314 myresult.entry_point += (map_addr - dyl_start);
1315 } else {
1316 ret = LOAD_FAILURE;
1317 }
1318
1319 vm_map_deallocate(copy_map);
1320 }
1321
1322 if (ret == LOAD_SUCCESS) {
1323 result->dynlinker = TRUE;
1324 result->entry_point = myresult.entry_point;
1325 }
1326 out:
1327 vnode_put(vp);
1328 return (ret);
1329
1330 }
1331
1332 int
1333 load_code_signature(
1334 struct linkedit_data_command *lcp,
1335 struct vnode *vp,
1336 off_t macho_offset,
1337 off_t macho_size,
1338 cpu_type_t cputype,
1339 load_result_t *result)
1340 {
1341 int ret;
1342 kern_return_t kr;
1343 vm_offset_t addr;
1344 int resid;
1345 struct cs_blob *blob;
1346 int error;
1347 vm_size_t blob_size;
1348
1349 addr = 0;
1350 blob = NULL;
1351
1352 if (lcp->cmdsize != sizeof (struct linkedit_data_command) ||
1353 lcp->dataoff + lcp->datasize > macho_size) {
1354 ret = LOAD_BADMACHO;
1355 goto out;
1356 }
1357
1358 blob = ubc_cs_blob_get(vp, cputype, -1);
1359 if (blob != NULL) {
1360 /* we already have a blob for this vnode and cputype */
1361 if (blob->csb_cpu_type == cputype &&
1362 blob->csb_base_offset == macho_offset &&
1363 blob->csb_mem_size == lcp->datasize) {
1364 /* it matches the blob we want here: we're done */
1365 ret = LOAD_SUCCESS;
1366 } else {
1367 /* the blob has changed for this vnode: fail ! */
1368 ret = LOAD_BADMACHO;
1369 }
1370 goto out;
1371 }
1372
1373 blob_size = lcp->datasize;
1374 kr = ubc_cs_blob_allocate(&addr, &blob_size);
1375 if (kr != KERN_SUCCESS) {
1376 ret = LOAD_NOSPACE;
1377 goto out;
1378 }
1379
1380 resid = 0;
1381 error = vn_rdwr(UIO_READ,
1382 vp,
1383 (caddr_t) addr,
1384 lcp->datasize,
1385 macho_offset + lcp->dataoff,
1386 UIO_SYSSPACE32,
1387 0,
1388 kauth_cred_get(),
1389 &resid,
1390 current_proc());
1391 if (error || resid != 0) {
1392 ret = LOAD_IOERROR;
1393 goto out;
1394 }
1395
1396 if (ubc_cs_blob_add(vp,
1397 cputype,
1398 macho_offset,
1399 addr,
1400 lcp->datasize)) {
1401 ret = LOAD_FAILURE;
1402 goto out;
1403 } else {
1404 /* ubc_cs_blob_add() has consumed "addr" */
1405 addr = 0;
1406 }
1407
1408 blob = ubc_cs_blob_get(vp, cputype, -1);
1409
1410 ret = LOAD_SUCCESS;
1411 out:
1412 if (result && ret == LOAD_SUCCESS) {
1413 result->csflags |= blob->csb_flags;
1414 }
1415 if (addr != 0) {
1416 ubc_cs_blob_deallocate(addr, blob_size);
1417 addr = 0;
1418 }
1419
1420 return ret;
1421 }
1422
1423
1424 #if CONFIG_CODE_DECRYPTION
1425
1426 static load_return_t
1427 set_code_unprotect(
1428 struct encryption_info_command *eip,
1429 caddr_t addr,
1430 vm_map_t map,
1431 struct vnode *vp)
1432 {
1433 int result, len;
1434 char vpath[MAXPATHLEN];
1435 pager_crypt_info_t crypt_info;
1436 const char * cryptname = 0;
1437
1438 size_t offset;
1439 struct segment_command_64 *seg64;
1440 struct segment_command *seg32;
1441 vm_map_offset_t map_offset, map_size;
1442 kern_return_t kr;
1443
1444 switch(eip->cryptid) {
1445 case 0:
1446 /* not encrypted, just an empty load command */
1447 return LOAD_SUCCESS;
1448 case 1:
1449 cryptname="com.apple.unfree";
1450 break;
1451 case 0x10:
1452 /* some random cryptid that you could manually put into
1453 * your binary if you want NULL */
1454 cryptname="com.apple.null";
1455 break;
1456 default:
1457 return LOAD_BADMACHO;
1458 }
1459
1460 len = MAXPATHLEN;
1461 result = vn_getpath(vp, vpath, &len);
1462 if(result) return result;
1463
1464 /* set up decrypter first */
1465 if(NULL==text_crypter_create) return LOAD_FAILURE;
1466 kr=text_crypter_create(&crypt_info, cryptname, (void*)vpath);
1467
1468 if(kr) {
1469 printf("set_code_unprotect: unable to create decrypter %s, kr=%d\n",
1470 cryptname, kr);
1471 return LOAD_RESOURCE;
1472 }
1473
1474 /* this is terrible, but we have to rescan the load commands to find the
1475 * virtual address of this encrypted stuff. This code is gonna look like
1476 * the dyld source one day... */
1477 struct mach_header *header = (struct mach_header *)addr;
1478 size_t mach_header_sz = sizeof(struct mach_header);
1479 if (header->magic == MH_MAGIC_64 ||
1480 header->magic == MH_CIGAM_64) {
1481 mach_header_sz = sizeof(struct mach_header_64);
1482 }
1483 offset = mach_header_sz;
1484 uint32_t ncmds = header->ncmds;
1485 while (ncmds--) {
1486 /*
1487 * Get a pointer to the command.
1488 */
1489 struct load_command *lcp = (struct load_command *)(addr + offset);
1490 offset += lcp->cmdsize;
1491
1492 switch(lcp->cmd) {
1493 case LC_SEGMENT_64:
1494 seg64 = (struct segment_command_64 *)lcp;
1495 if ((seg64->fileoff <= eip->cryptoff) &&
1496 (seg64->fileoff+seg64->filesize >=
1497 eip->cryptoff+eip->cryptsize)) {
1498 map_offset = seg64->vmaddr + eip->cryptoff - seg64->fileoff;
1499 map_size = eip->cryptsize;
1500 goto remap_now;
1501 }
1502 case LC_SEGMENT:
1503 seg32 = (struct segment_command *)lcp;
1504 if ((seg32->fileoff <= eip->cryptoff) &&
1505 (seg32->fileoff+seg32->filesize >=
1506 eip->cryptoff+eip->cryptsize)) {
1507 map_offset = seg32->vmaddr + eip->cryptoff - seg32->fileoff;
1508 map_size = eip->cryptsize;
1509 goto remap_now;
1510 }
1511 }
1512 }
1513
1514 /* if we get here, did not find anything */
1515 return LOAD_BADMACHO;
1516
1517 remap_now:
1518 /* now remap using the decrypter */
1519 kr = vm_map_apple_protected(map, map_offset, map_offset+map_size, &crypt_info);
1520 if(kr) {
1521 printf("set_code_unprotect(): mapping failed with %x\n", kr);
1522 crypt_info.crypt_end(crypt_info.crypt_ops);
1523 return LOAD_PROTECT;
1524 }
1525
1526 return LOAD_SUCCESS;
1527 }
1528
1529 #endif
1530
1531 /*
1532 * This routine exists to support the load_dylinker().
1533 *
1534 * This routine has its own, separate, understanding of the FAT file format,
1535 * which is terrifically unfortunate.
1536 */
1537 static
1538 load_return_t
1539 get_macho_vnode(
1540 char *path,
1541 integer_t archbits,
1542 struct mach_header *mach_header,
1543 off_t *file_offset,
1544 off_t *macho_size,
1545 struct vnode **vpp
1546 )
1547 {
1548 struct vnode *vp;
1549 vfs_context_t ctx = vfs_context_current();
1550 proc_t p = vfs_context_proc(ctx);
1551 kauth_cred_t kerncred;
1552 struct nameidata nid, *ndp;
1553 boolean_t is_fat;
1554 struct fat_arch fat_arch;
1555 int error = LOAD_SUCCESS;
1556 int resid;
1557 union {
1558 struct mach_header mach_header;
1559 struct fat_header fat_header;
1560 char pad[512];
1561 } header;
1562 off_t fsize = (off_t)0;
1563 int err2;
1564
1565 /*
1566 * Capture the kernel credential for use in the actual read of the
1567 * file, since the user doing the execution may have execute rights
1568 * but not read rights, but to exec something, we have to either map
1569 * or read it into the new process address space, which requires
1570 * read rights. This is to deal with lack of common credential
1571 * serialization code which would treat NOCRED as "serialize 'root'".
1572 */
1573 kerncred = vfs_context_ucred(vfs_context_kernel());
1574
1575 ndp = &nid;
1576
1577 /* init the namei data to point the file user's program name */
1578 NDINIT(ndp, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE32, CAST_USER_ADDR_T(path), ctx);
1579
1580 if ((error = namei(ndp)) != 0) {
1581 if (error == ENOENT) {
1582 error = LOAD_ENOENT;
1583 } else {
1584 error = LOAD_FAILURE;
1585 }
1586 return(error);
1587 }
1588 nameidone(ndp);
1589 vp = ndp->ni_vp;
1590
1591 /* check for regular file */
1592 if (vp->v_type != VREG) {
1593 error = LOAD_PROTECT;
1594 goto bad1;
1595 }
1596
1597 /* get size */
1598 if ((error = vnode_size(vp, &fsize, ctx)) != 0) {
1599 error = LOAD_FAILURE;
1600 goto bad1;
1601 }
1602
1603 /* Check mount point */
1604 if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
1605 error = LOAD_PROTECT;
1606 goto bad1;
1607 }
1608
1609 /* check access */
1610 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_EXECUTE, ctx)) != 0) {
1611 error = LOAD_PROTECT;
1612 goto bad1;
1613 }
1614
1615 /* try to open it */
1616 if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
1617 error = LOAD_PROTECT;
1618 goto bad1;
1619 }
1620
1621 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&header, sizeof(header), 0,
1622 UIO_SYSSPACE32, IO_NODELOCKED, kerncred, &resid, p)) != 0) {
1623 error = LOAD_IOERROR;
1624 goto bad2;
1625 }
1626
1627 if (header.mach_header.magic == MH_MAGIC ||
1628 header.mach_header.magic == MH_MAGIC_64)
1629 is_fat = FALSE;
1630 else if (header.fat_header.magic == FAT_MAGIC ||
1631 header.fat_header.magic == FAT_CIGAM)
1632 is_fat = TRUE;
1633 else {
1634 error = LOAD_BADMACHO;
1635 goto bad2;
1636 }
1637
1638 if (is_fat) {
1639 /* Look up our architecture in the fat file. */
1640 error = fatfile_getarch_with_bits(vp, archbits, (vm_offset_t)(&header.fat_header), &fat_arch);
1641 if (error != LOAD_SUCCESS)
1642 goto bad2;
1643
1644 /* Read the Mach-O header out of it */
1645 error = vn_rdwr(UIO_READ, vp, (caddr_t)&header.mach_header,
1646 sizeof(header.mach_header), fat_arch.offset,
1647 UIO_SYSSPACE32, IO_NODELOCKED, kerncred, &resid, p);
1648 if (error) {
1649 error = LOAD_IOERROR;
1650 goto bad2;
1651 }
1652
1653 /* Is this really a Mach-O? */
1654 if (header.mach_header.magic != MH_MAGIC &&
1655 header.mach_header.magic != MH_MAGIC_64) {
1656 error = LOAD_BADMACHO;
1657 goto bad2;
1658 }
1659
1660 *file_offset = fat_arch.offset;
1661 *macho_size = fat_arch.size;
1662 } else {
1663 /*
1664 * Force get_macho_vnode() to fail if the architecture bits
1665 * do not match the expected architecture bits. This in
1666 * turn causes load_dylinker() to fail for the same reason,
1667 * so it ensures the dynamic linker and the binary are in
1668 * lock-step. This is potentially bad, if we ever add to
1669 * the CPU_ARCH_* bits any bits that are desirable but not
1670 * required, since the dynamic linker might work, but we will
1671 * refuse to load it because of this check.
1672 */
1673 if ((cpu_type_t)(header.mach_header.cputype & CPU_ARCH_MASK) != archbits)
1674 return(LOAD_BADARCH);
1675
1676 *file_offset = 0;
1677 *macho_size = fsize;
1678 }
1679
1680 *mach_header = header.mach_header;
1681 *vpp = vp;
1682
1683 ubc_setsize(vp, fsize);
1684
1685 return (error);
1686
1687 bad2:
1688 err2 = VNOP_CLOSE(vp, FREAD, ctx);
1689 vnode_put(vp);
1690 return (error);
1691
1692 bad1:
1693 vnode_put(vp);
1694 return(error);
1695 }
mirror of XNU