]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/mach_loader.c
projects / apple / xnu.git / blob
? search:


ca2fb4338d2a87badd8dd4a9ec80ab5018655637
[apple/xnu.git] / bsd / kern / mach_loader.c
1 /*
2 * Copyright (c) 2000-2010 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (C) 1988, 1989, NeXT, Inc.
30 *
31 * File: kern/mach_loader.c
32 * Author: Avadis Tevanian, Jr.
33 *
34 * Mach object file loader (kernel version, for now).
35 *
36 * 21-Jul-88 Avadis Tevanian, Jr. (avie) at NeXT
37 * Started.
38 */
39
40 #include <sys/param.h>
41 #include <sys/vnode_internal.h>
42 #include <sys/uio.h>
43 #include <sys/namei.h>
44 #include <sys/proc_internal.h>
45 #include <sys/kauth.h>
46 #include <sys/stat.h>
47 #include <sys/malloc.h>
48 #include <sys/mount_internal.h>
49 #include <sys/fcntl.h>
50 #include <sys/ubc_internal.h>
51 #include <sys/imgact.h>
52 #include <sys/codesign.h>
53 #include <sys/proc_uuid_policy.h>
54 #include <sys/reason.h>
55 #include <sys/kdebug.h>
56
57 #include <mach/mach_types.h>
58 #include <mach/vm_map.h> /* vm_allocate() */
59 #include <mach/mach_vm.h> /* mach_vm_allocate() */
60 #include <mach/vm_statistics.h>
61 #include <mach/task.h>
62 #include <mach/thread_act.h>
63
64 #include <machine/vmparam.h>
65 #include <machine/exec.h>
66 #include <machine/pal_routines.h>
67
68 #include <kern/kern_types.h>
69 #include <kern/cpu_number.h>
70 #include <kern/mach_loader.h>
71 #include <kern/mach_fat.h>
72 #include <kern/kalloc.h>
73 #include <kern/task.h>
74 #include <kern/thread.h>
75 #include <kern/page_decrypt.h>
76
77 #include <mach-o/fat.h>
78 #include <mach-o/loader.h>
79
80 #include <vm/pmap.h>
81 #include <vm/vm_map.h>
82 #include <vm/vm_kern.h>
83 #include <vm/vm_pager.h>
84 #include <vm/vnode_pager.h>
85 #include <vm/vm_protos.h>
86 #include <IOKit/IOReturn.h> /* for kIOReturnNotPrivileged */
87
88 #include <os/overflow.h>
89
90 /*
91 * XXX vm/pmap.h should not treat these prototypes as MACH_KERNEL_PRIVATE
92 * when KERNEL is defined.
93 */
94 extern pmap_t pmap_create(ledger_t ledger, vm_map_size_t size,
95 boolean_t is_64bit);
96
97 /* XXX should have prototypes in a shared header file */
98 extern int get_map_nentries(vm_map_t);
99
100 extern kern_return_t memory_object_signed(memory_object_control_t control,
101 boolean_t is_signed);
102
103 /* An empty load_result_t */
104 static const load_result_t load_result_null = {
105 .mach_header = MACH_VM_MIN_ADDRESS,
106 .entry_point = MACH_VM_MIN_ADDRESS,
107 .user_stack = MACH_VM_MIN_ADDRESS,
108 .user_stack_size = 0,
109 .user_stack_alloc = MACH_VM_MIN_ADDRESS,
110 .user_stack_alloc_size = 0,
111 .all_image_info_addr = MACH_VM_MIN_ADDRESS,
112 .all_image_info_size = 0,
113 .thread_count = 0,
114 .unixproc = 0,
115 .dynlinker = 0,
116 .needs_dynlinker = 0,
117 .validentry = 0,
118 .using_lcmain = 0,
119 .is64bit = 0,
120 .csflags = 0,
121 .has_pagezero = 0,
122 .uuid = { 0 },
123 .min_vm_addr = MACH_VM_MAX_ADDRESS,
124 .max_vm_addr = MACH_VM_MIN_ADDRESS,
125 .cs_end_offset = 0,
126 .threadstate = NULL,
127 .threadstate_sz = 0
128 };
129
130 /*
131 * Prototypes of static functions.
132 */
133 static load_return_t
134 parse_machfile(
135 struct vnode *vp,
136 vm_map_t map,
137 thread_t thread,
138 struct mach_header *header,
139 off_t file_offset,
140 off_t macho_size,
141 int depth,
142 int64_t slide,
143 int64_t dyld_slide,
144 load_result_t *result,
145 load_result_t *binresult,
146 struct image_params *imgp
147 );
148
149 static load_return_t
150 load_segment(
151 struct load_command *lcp,
152 uint32_t filetype,
153 void *control,
154 off_t pager_offset,
155 off_t macho_size,
156 struct vnode *vp,
157 vm_map_t map,
158 int64_t slide,
159 load_result_t *result
160 );
161
162 static load_return_t
163 load_uuid(
164 struct uuid_command *uulp,
165 char *command_end,
166 load_result_t *result
167 );
168
169 static load_return_t
170 load_code_signature(
171 struct linkedit_data_command *lcp,
172 struct vnode *vp,
173 off_t macho_offset,
174 off_t macho_size,
175 cpu_type_t cputype,
176 load_result_t *result,
177 struct image_params *imgp);
178
179 #if CONFIG_CODE_DECRYPTION
180 static load_return_t
181 set_code_unprotect(
182 struct encryption_info_command *lcp,
183 caddr_t addr,
184 vm_map_t map,
185 int64_t slide,
186 struct vnode *vp,
187 off_t macho_offset,
188 cpu_type_t cputype,
189 cpu_subtype_t cpusubtype);
190 #endif
191
192 static
193 load_return_t
194 load_main(
195 struct entry_point_command *epc,
196 thread_t thread,
197 int64_t slide,
198 load_result_t *result
199 );
200
201 static load_return_t
202 load_unixthread(
203 struct thread_command *tcp,
204 thread_t thread,
205 int64_t slide,
206 load_result_t *result
207 );
208
209 static load_return_t
210 load_threadstate(
211 thread_t thread,
212 uint32_t *ts,
213 uint32_t total_size,
214 load_result_t *
215 );
216
217 static load_return_t
218 load_threadstack(
219 thread_t thread,
220 uint32_t *ts,
221 uint32_t total_size,
222 mach_vm_offset_t *user_stack,
223 int *customstack,
224 load_result_t *result
225 );
226
227 static load_return_t
228 load_threadentry(
229 thread_t thread,
230 uint32_t *ts,
231 uint32_t total_size,
232 mach_vm_offset_t *entry_point
233 );
234
235 static load_return_t
236 load_dylinker(
237 struct dylinker_command *lcp,
238 integer_t archbits,
239 vm_map_t map,
240 thread_t thread,
241 int depth,
242 int64_t slide,
243 load_result_t *result,
244 struct image_params *imgp
245 );
246
247 struct macho_data;
248
249 static load_return_t
250 get_macho_vnode(
251 char *path,
252 integer_t archbits,
253 struct mach_header *mach_header,
254 off_t *file_offset,
255 off_t *macho_size,
256 struct macho_data *macho_data,
257 struct vnode **vpp
258 );
259
260 static inline void
261 widen_segment_command(const struct segment_command *scp32,
262 struct segment_command_64 *scp)
263 {
264 scp->cmd = scp32->cmd;
265 scp->cmdsize = scp32->cmdsize;
266 bcopy(scp32->segname, scp->segname, sizeof(scp->segname));
267 scp->vmaddr = scp32->vmaddr;
268 scp->vmsize = scp32->vmsize;
269 scp->fileoff = scp32->fileoff;
270 scp->filesize = scp32->filesize;
271 scp->maxprot = scp32->maxprot;
272 scp->initprot = scp32->initprot;
273 scp->nsects = scp32->nsects;
274 scp->flags = scp32->flags;
275 }
276
277 static void
278 note_all_image_info_section(const struct segment_command_64 *scp,
279 boolean_t is64, size_t section_size, const void *sections,
280 int64_t slide, load_result_t *result)
281 {
282 const union {
283 struct section s32;
284 struct section_64 s64;
285 } *sectionp;
286 unsigned int i;
287
288 if (strncmp(scp->segname, "__DATA", sizeof(scp->segname)) != 0)
289 return;
290 for (i = 0; i < scp->nsects; ++i) {
291 sectionp = (const void *)
292 ((const char *)sections + section_size * i);
293 if (0 == strncmp(sectionp->s64.sectname, "__all_image_info",
294 sizeof(sectionp->s64.sectname))) {
295 result->all_image_info_addr =
296 is64 ? sectionp->s64.addr : sectionp->s32.addr;
297 result->all_image_info_addr += slide;
298 result->all_image_info_size =
299 is64 ? sectionp->s64.size : sectionp->s32.size;
300 return;
301 }
302 }
303 }
304
305
306 load_return_t
307 load_machfile(
308 struct image_params *imgp,
309 struct mach_header *header,
310 thread_t thread,
311 vm_map_t *mapp,
312 load_result_t *result
313 )
314 {
315 struct vnode *vp = imgp->ip_vp;
316 off_t file_offset = imgp->ip_arch_offset;
317 off_t macho_size = imgp->ip_arch_size;
318 off_t file_size = imgp->ip_vattr->va_data_size;
319 pmap_t pmap = 0; /* protected by create_map */
320 vm_map_t map;
321 load_result_t myresult;
322 load_return_t lret;
323 boolean_t enforce_hard_pagezero = TRUE;
324 int in_exec = (imgp->ip_flags & IMGPF_EXEC);
325 task_t task = current_task();
326 proc_t p = current_proc();
327 mach_vm_offset_t aslr_offset = 0;
328 mach_vm_offset_t dyld_aslr_offset = 0;
329 kern_return_t kret;
330
331 if (macho_size > file_size) {
332 return(LOAD_BADMACHO);
333 }
334
335 result->is64bit = ((imgp->ip_flags & IMGPF_IS_64BIT) == IMGPF_IS_64BIT);
336
337 task_t ledger_task;
338 if (imgp->ip_new_thread) {
339 ledger_task = get_threadtask(imgp->ip_new_thread);
340 } else {
341 ledger_task = task;
342 }
343 pmap = pmap_create(get_task_ledger(ledger_task),
344 (vm_map_size_t) 0,
345 result->is64bit);
346 map = vm_map_create(pmap,
347 0,
348 vm_compute_max_offset(result->is64bit),
349 TRUE);
350
351 #if (__ARM_ARCH_7K__ >= 2) && defined(PLATFORM_WatchOS)
352 /* enforce 16KB alignment for watch targets with new ABI */
353 vm_map_set_page_shift(map, SIXTEENK_PAGE_SHIFT);
354 #endif /* __arm64__ */
355
356 #ifndef CONFIG_ENFORCE_SIGNED_CODE
357 /* This turns off faulting for executable pages, which allows
358 * to circumvent Code Signing Enforcement. The per process
359 * flag (CS_ENFORCEMENT) is not set yet, but we can use the
360 * global flag.
361 */
362 if ( !cs_enforcement(NULL) && (header->flags & MH_ALLOW_STACK_EXECUTION) )
363 vm_map_disable_NX(map);
364 #endif
365
366 /* Forcibly disallow execution from data pages on even if the arch
367 * normally permits it. */
368 if ((header->flags & MH_NO_HEAP_EXECUTION) && !(imgp->ip_flags & IMGPF_ALLOW_DATA_EXEC))
369 vm_map_disallow_data_exec(map);
370
371 /*
372 * Compute a random offset for ASLR, and an independent random offset for dyld.
373 */
374 if (!(imgp->ip_flags & IMGPF_DISABLE_ASLR)) {
375 uint64_t max_slide_pages;
376
377 max_slide_pages = vm_map_get_max_aslr_slide_pages(map);
378
379 aslr_offset = random();
380 aslr_offset %= max_slide_pages;
381 aslr_offset <<= vm_map_page_shift(map);
382
383 dyld_aslr_offset = random();
384 dyld_aslr_offset %= max_slide_pages;
385 dyld_aslr_offset <<= vm_map_page_shift(map);
386 }
387
388 if (!result)
389 result = &myresult;
390
391 *result = load_result_null;
392
393 /*
394 * re-set the bitness on the load result since we cleared the load result above.
395 */
396 result->is64bit = ((imgp->ip_flags & IMGPF_IS_64BIT) == IMGPF_IS_64BIT);
397
398 lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
399 0, (int64_t)aslr_offset, (int64_t)dyld_aslr_offset, result,
400 NULL, imgp);
401
402 if (lret != LOAD_SUCCESS) {
403 vm_map_deallocate(map); /* will lose pmap reference too */
404 return(lret);
405 }
406
407 #if __x86_64__
408 /*
409 * On x86, for compatibility, don't enforce the hard page-zero restriction for 32-bit binaries.
410 */
411 if (!result->is64bit) {
412 enforce_hard_pagezero = FALSE;
413 }
414 #endif
415 /*
416 * Check to see if the page zero is enforced by the map->min_offset.
417 */
418 if (enforce_hard_pagezero &&
419 (vm_map_has_hard_pagezero(map, 0x1000) == FALSE)) {
420 {
421 vm_map_deallocate(map); /* will lose pmap reference too */
422 return (LOAD_BADMACHO);
423 }
424 }
425
426 vm_commit_pagezero_status(map);
427
428 /*
429 * If this is an exec, then we are going to destroy the old
430 * task, and it's correct to halt it; if it's spawn, the
431 * task is not yet running, and it makes no sense.
432 */
433 if (in_exec) {
434 /*
435 * Mark the task as halting and start the other
436 * threads towards terminating themselves. Then
437 * make sure any threads waiting for a process
438 * transition get informed that we are committed to
439 * this transition, and then finally complete the
440 * task halting (wait for threads and then cleanup
441 * task resources).
442 *
443 * NOTE: task_start_halt() makes sure that no new
444 * threads are created in the task during the transition.
445 * We need to mark the workqueue as exiting before we
446 * wait for threads to terminate (at the end of which
447 * we no longer have a prohibition on thread creation).
448 *
449 * Finally, clean up any lingering workqueue data structures
450 * that may have been left behind by the workqueue threads
451 * as they exited (and then clean up the work queue itself).
452 */
453 kret = task_start_halt(task);
454 if (kret != KERN_SUCCESS) {
455 vm_map_deallocate(map); /* will lose pmap reference too */
456 return (LOAD_FAILURE);
457 }
458 proc_transcommit(p, 0);
459 workqueue_mark_exiting(p);
460 task_complete_halt(task);
461 workqueue_exit(p);
462 kqueue_dealloc(p->p_wqkqueue);
463 p->p_wqkqueue = NULL;
464 /*
465 * Roll up accounting info to new task. The roll up is done after
466 * task_complete_halt to make sure the thread accounting info is
467 * rolled up to current_task.
468 */
469 task_rollup_accounting_info(get_threadtask(thread), task);
470 }
471 *mapp = map;
472 return(LOAD_SUCCESS);
473 }
474
475 int macho_printf = 0;
476 #define MACHO_PRINTF(args) \
477 do { \
478 if (macho_printf) { \
479 printf args; \
480 } \
481 } while (0)
482
483 /*
484 * The file size of a mach-o file is limited to 32 bits; this is because
485 * this is the limit on the kalloc() of enough bytes for a mach_header and
486 * the contents of its sizeofcmds, which is currently constrained to 32
487 * bits in the file format itself. We read into the kernel buffer the
488 * commands section, and then parse it in order to parse the mach-o file
489 * format load_command segment(s). We are only interested in a subset of
490 * the total set of possible commands. If "map"==VM_MAP_NULL or
491 * "thread"==THREAD_NULL, do not make permament VM modifications,
492 * just preflight the parse.
493 */
494 static
495 load_return_t
496 parse_machfile(
497 struct vnode *vp,
498 vm_map_t map,
499 thread_t thread,
500 struct mach_header *header,
501 off_t file_offset,
502 off_t macho_size,
503 int depth,
504 int64_t aslr_offset,
505 int64_t dyld_aslr_offset,
506 load_result_t *result,
507 load_result_t *binresult,
508 struct image_params *imgp
509 )
510 {
511 uint32_t ncmds;
512 struct load_command *lcp;
513 struct dylinker_command *dlp = 0;
514 integer_t dlarchbits = 0;
515 void * control;
516 load_return_t ret = LOAD_SUCCESS;
517 caddr_t addr;
518 void * kl_addr;
519 vm_size_t size,kl_size;
520 size_t offset;
521 size_t oldoffset; /* for overflow check */
522 int pass;
523 proc_t p = current_proc(); /* XXXX */
524 int error;
525 int resid = 0;
526 size_t mach_header_sz = sizeof(struct mach_header);
527 boolean_t abi64;
528 boolean_t got_code_signatures = FALSE;
529 boolean_t found_header_segment = FALSE;
530 boolean_t found_xhdr = FALSE;
531 int64_t slide = 0;
532 boolean_t dyld_no_load_addr = FALSE;
533 boolean_t is_dyld = FALSE;
534 vm_map_offset_t effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
535
536 if (header->magic == MH_MAGIC_64 ||
537 header->magic == MH_CIGAM_64) {
538 mach_header_sz = sizeof(struct mach_header_64);
539 }
540
541 /*
542 * Break infinite recursion
543 */
544 if (depth > 1) {
545 return(LOAD_FAILURE);
546 }
547
548 depth++;
549
550 /*
551 * Check to see if right machine type.
552 */
553 if (((cpu_type_t)(header->cputype & ~CPU_ARCH_MASK) != (cpu_type() & ~CPU_ARCH_MASK)) ||
554 !grade_binary(header->cputype,
555 header->cpusubtype & ~CPU_SUBTYPE_MASK))
556 return(LOAD_BADARCH);
557
558 abi64 = ((header->cputype & CPU_ARCH_ABI64) == CPU_ARCH_ABI64);
559
560 switch (header->filetype) {
561
562 case MH_EXECUTE:
563 if (depth != 1) {
564 return (LOAD_FAILURE);
565 }
566
567 break;
568 case MH_DYLINKER:
569 if (depth != 2) {
570 return (LOAD_FAILURE);
571 }
572 is_dyld = TRUE;
573 break;
574
575 default:
576 return (LOAD_FAILURE);
577 }
578
579 /*
580 * Get the pager for the file.
581 */
582 control = ubc_getobject(vp, UBC_FLAGS_NONE);
583
584 /*
585 * Map portion that must be accessible directly into
586 * kernel's map.
587 */
588 if ((off_t)(mach_header_sz + header->sizeofcmds) > macho_size)
589 return(LOAD_BADMACHO);
590
591 /*
592 * Round size of Mach-O commands up to page boundry.
593 */
594 size = round_page(mach_header_sz + header->sizeofcmds);
595 if (size <= 0)
596 return(LOAD_BADMACHO);
597
598 /*
599 * Map the load commands into kernel memory.
600 */
601 addr = 0;
602 kl_size = size;
603 kl_addr = kalloc(size);
604 addr = (caddr_t)kl_addr;
605 if (addr == NULL)
606 return(LOAD_NOSPACE);
607
608 error = vn_rdwr(UIO_READ, vp, addr, size, file_offset,
609 UIO_SYSSPACE, 0, kauth_cred_get(), &resid, p);
610 if (error) {
611 if (kl_addr)
612 kfree(kl_addr, kl_size);
613 return(LOAD_IOERROR);
614 }
615
616 if (resid) {
617 /* We must be able to read in as much as the mach_header indicated */
618 if (kl_addr)
619 kfree(kl_addr, kl_size);
620 return(LOAD_BADMACHO);
621 }
622
623 /*
624 * For PIE and dyld, slide everything by the ASLR offset.
625 */
626 if ((header->flags & MH_PIE) || is_dyld) {
627 slide = aslr_offset;
628 }
629
630 /*
631 * Scan through the commands, processing each one as necessary.
632 * We parse in three passes through the headers:
633 * 0: determine if TEXT and DATA boundary can be page-aligned
634 * 1: thread state, uuid, code signature
635 * 2: segments
636 * 3: dyld, encryption, check entry point
637 */
638
639 boolean_t slide_realign = FALSE;
640
641 for (pass = 0; pass <= 3; pass++) {
642
643 if (pass == 0 && !slide_realign && !is_dyld) {
644 /* if we dont need to realign the slide or determine dyld's load
645 * address, pass 0 can be skipped */
646 continue;
647 } else if (pass == 1) {
648
649 if (dyld_no_load_addr && binresult) {
650 /*
651 * The dyld Mach-O does not specify a load address. Try to locate
652 * it right after the main binary. If binresult == NULL, load
653 * directly to the given slide.
654 */
655 slide = vm_map_round_page(slide + binresult->max_vm_addr, effective_page_mask);
656 }
657 }
658
659 /*
660 * Check that the entry point is contained in an executable segments
661 */
662 if ((pass == 3) && (!result->using_lcmain && result->validentry == 0)) {
663 thread_state_initialize(thread);
664 ret = LOAD_FAILURE;
665 break;
666 }
667
668 /*
669 * Check that some segment maps the start of the mach-o file, which is
670 * needed by the dynamic loader to read the mach headers, etc.
671 */
672 if ((pass == 3) && (found_header_segment == FALSE)) {
673 ret = LOAD_BADMACHO;
674 break;
675 }
676
677 /*
678 * Loop through each of the load_commands indicated by the
679 * Mach-O header; if an absurd value is provided, we just
680 * run off the end of the reserved section by incrementing
681 * the offset too far, so we are implicitly fail-safe.
682 */
683 offset = mach_header_sz;
684 ncmds = header->ncmds;
685
686 while (ncmds--) {
687 /*
688 * Get a pointer to the command.
689 */
690 lcp = (struct load_command *)(addr + offset);
691 oldoffset = offset;
692 offset += lcp->cmdsize;
693
694 /*
695 * Perform prevalidation of the struct load_command
696 * before we attempt to use its contents. Invalid
697 * values are ones which result in an overflow, or
698 * which can not possibly be valid commands, or which
699 * straddle or exist past the reserved section at the
700 * start of the image.
701 */
702 if (oldoffset > offset ||
703 lcp->cmdsize < sizeof(struct load_command) ||
704 offset > header->sizeofcmds + mach_header_sz) {
705 ret = LOAD_BADMACHO;
706 break;
707 }
708
709 /*
710 * Act on struct load_command's for which kernel
711 * intervention is required.
712 */
713 switch(lcp->cmd) {
714 case LC_SEGMENT: {
715 struct segment_command *scp = (struct segment_command *) lcp;
716
717 if (pass == 0) {
718 if (is_dyld && scp->vmaddr == 0 && scp->fileoff == 0) {
719 dyld_no_load_addr = TRUE;
720 if (!slide_realign) {
721 /* got what we need, bail early on pass 0 */
722 continue;
723 }
724 }
725
726 break;
727 }
728
729 if (pass == 1 && !strncmp(scp->segname, "__XHDR", sizeof(scp->segname))) {
730 found_xhdr = TRUE;
731 }
732
733 if (pass != 2)
734 break;
735
736 if (abi64) {
737 /*
738 * Having an LC_SEGMENT command for the
739 * wrong ABI is invalid <rdar://problem/11021230>
740 */
741 ret = LOAD_BADMACHO;
742 break;
743 }
744
745 ret = load_segment(lcp,
746 header->filetype,
747 control,
748 file_offset,
749 macho_size,
750 vp,
751 map,
752 slide,
753 result);
754
755 if (ret == LOAD_SUCCESS && scp->fileoff == 0 && scp->filesize > 0) {
756 /* Enforce a single segment mapping offset zero, with R+X
757 * protection. */
758 if (found_header_segment ||
759 ((scp->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) != (VM_PROT_READ|VM_PROT_EXECUTE))) {
760 ret = LOAD_BADMACHO;
761 break;
762 }
763 found_header_segment = TRUE;
764 }
765
766 break;
767 }
768 case LC_SEGMENT_64: {
769 struct segment_command_64 *scp64 = (struct segment_command_64 *) lcp;
770
771 if (pass == 0) {
772 if (is_dyld && scp64->vmaddr == 0 && scp64->fileoff == 0) {
773 dyld_no_load_addr = TRUE;
774 if (!slide_realign) {
775 /* got what we need, bail early on pass 0 */
776 continue;
777 }
778 }
779 }
780
781 if (pass == 1 && !strncmp(scp64->segname, "__XHDR", sizeof(scp64->segname))) {
782 found_xhdr = TRUE;
783 }
784
785 if (pass != 2)
786 break;
787
788 if (!abi64) {
789 /*
790 * Having an LC_SEGMENT_64 command for the
791 * wrong ABI is invalid <rdar://problem/11021230>
792 */
793 ret = LOAD_BADMACHO;
794 break;
795 }
796
797 ret = load_segment(lcp,
798 header->filetype,
799 control,
800 file_offset,
801 macho_size,
802 vp,
803 map,
804 slide,
805 result);
806
807 if (ret == LOAD_SUCCESS && scp64->fileoff == 0 && scp64->filesize > 0) {
808 /* Enforce a single segment mapping offset zero, with R+X
809 * protection. */
810 if (found_header_segment ||
811 ((scp64->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) != (VM_PROT_READ|VM_PROT_EXECUTE))) {
812 ret = LOAD_BADMACHO;
813 break;
814 }
815 found_header_segment = TRUE;
816 }
817
818 break;
819 }
820 case LC_UNIXTHREAD:
821 if (pass != 1)
822 break;
823 ret = load_unixthread(
824 (struct thread_command *) lcp,
825 thread,
826 slide,
827 result);
828 break;
829 case LC_MAIN:
830 if (pass != 1)
831 break;
832 if (depth != 1)
833 break;
834 ret = load_main(
835 (struct entry_point_command *) lcp,
836 thread,
837 slide,
838 result);
839 break;
840 case LC_LOAD_DYLINKER:
841 if (pass != 3)
842 break;
843 if ((depth == 1) && (dlp == 0)) {
844 dlp = (struct dylinker_command *)lcp;
845 dlarchbits = (header->cputype & CPU_ARCH_MASK);
846 } else {
847 ret = LOAD_FAILURE;
848 }
849 break;
850 case LC_UUID:
851 if (pass == 1 && depth == 1) {
852 ret = load_uuid((struct uuid_command *) lcp,
853 (char *)addr + mach_header_sz + header->sizeofcmds,
854 result);
855 }
856 break;
857 case LC_CODE_SIGNATURE:
858 /* CODE SIGNING */
859 if (pass != 1)
860 break;
861 /* pager -> uip ->
862 load signatures & store in uip
863 set VM object "signed_pages"
864 */
865 ret = load_code_signature(
866 (struct linkedit_data_command *) lcp,
867 vp,
868 file_offset,
869 macho_size,
870 header->cputype,
871 result,
872 imgp);
873 if (ret != LOAD_SUCCESS) {
874 printf("proc %d: load code signature error %d "
875 "for file \"%s\"\n",
876 p->p_pid, ret, vp->v_name);
877 /*
878 * Allow injections to be ignored on devices w/o enforcement enabled
879 */
880 if (!cs_enforcement(NULL))
881 ret = LOAD_SUCCESS; /* ignore error */
882
883 } else {
884 got_code_signatures = TRUE;
885 }
886
887 if (got_code_signatures) {
888 unsigned tainted = CS_VALIDATE_TAINTED;
889 boolean_t valid = FALSE;
890 vm_size_t off = 0;
891
892
893 if (cs_debug > 10)
894 printf("validating initial pages of %s\n", vp->v_name);
895
896 while (off < size && ret == LOAD_SUCCESS) {
897 tainted = CS_VALIDATE_TAINTED;
898
899 valid = cs_validate_range(vp,
900 NULL,
901 file_offset + off,
902 addr + off,
903 PAGE_SIZE,
904 &tainted);
905 if (!valid || (tainted & CS_VALIDATE_TAINTED)) {
906 if (cs_debug)
907 printf("CODE SIGNING: %s[%d]: invalid initial page at offset %lld validated:%d tainted:%d csflags:0x%x\n",
908 vp->v_name, p->p_pid, (long long)(file_offset + off), valid, tainted, result->csflags);
909 if (cs_enforcement(NULL) ||
910 (result->csflags & (CS_HARD|CS_KILL|CS_ENFORCEMENT))) {
911 ret = LOAD_FAILURE;
912 }
913 result->csflags &= ~CS_VALID;
914 }
915 off += PAGE_SIZE;
916 }
917 }
918
919 break;
920 #if CONFIG_CODE_DECRYPTION
921 case LC_ENCRYPTION_INFO:
922 case LC_ENCRYPTION_INFO_64:
923 if (pass != 3)
924 break;
925 ret = set_code_unprotect(
926 (struct encryption_info_command *) lcp,
927 addr, map, slide, vp, file_offset,
928 header->cputype, header->cpusubtype);
929 if (ret != LOAD_SUCCESS) {
930 os_reason_t load_failure_reason = OS_REASON_NULL;
931 printf("proc %d: set_code_unprotect() error %d "
932 "for file \"%s\"\n",
933 p->p_pid, ret, vp->v_name);
934 /*
935 * Don't let the app run if it's
936 * encrypted but we failed to set up the
937 * decrypter. If the keys are missing it will
938 * return LOAD_DECRYPTFAIL.
939 */
940 if (ret == LOAD_DECRYPTFAIL) {
941 /* failed to load due to missing FP keys */
942 proc_lock(p);
943 p->p_lflag |= P_LTERM_DECRYPTFAIL;
944 proc_unlock(p);
945
946 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
947 p->p_pid, OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT, 0, 0);
948 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT);
949 } else {
950
951 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
952 p->p_pid, OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT, 0, 0);
953 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT);
954 }
955
956 assert(load_failure_reason != OS_REASON_NULL);
957 psignal_with_reason(p, SIGKILL, load_failure_reason);
958 }
959 break;
960 #endif
961 default:
962 /* Other commands are ignored by the kernel */
963 ret = LOAD_SUCCESS;
964 break;
965 }
966 if (ret != LOAD_SUCCESS)
967 break;
968 }
969 if (ret != LOAD_SUCCESS)
970 break;
971 }
972
973 if (ret == LOAD_SUCCESS) {
974 if (! got_code_signatures) {
975 if (cs_enforcement(NULL)) {
976 ret = LOAD_FAILURE;
977 } else {
978 /*
979 * No embedded signatures: look for detached by taskgated,
980 * this is only done on OSX, on embedded platforms we expect everything
981 * to be have embedded signatures.
982 */
983 struct cs_blob *blob;
984
985 blob = ubc_cs_blob_get(vp, -1, file_offset);
986 if (blob != NULL) {
987 unsigned int cs_flag_data = blob->csb_flags;
988 if(0 != ubc_cs_generation_check(vp)) {
989 if (0 != ubc_cs_blob_revalidate(vp, blob, imgp, 0)) {
990 /* clear out the flag data if revalidation fails */
991 cs_flag_data = 0;
992 result->csflags &= ~CS_VALID;
993 }
994 }
995 /* get flags to be applied to the process */
996 result->csflags |= cs_flag_data;
997 }
998 }
999 }
1000
1001 /* Make sure if we need dyld, we got it */
1002 if (result->needs_dynlinker && !dlp) {
1003 ret = LOAD_FAILURE;
1004 }
1005
1006 if ((ret == LOAD_SUCCESS) && (dlp != 0)) {
1007 /*
1008 * load the dylinker, and slide it by the independent DYLD ASLR
1009 * offset regardless of the PIE-ness of the main binary.
1010 */
1011 ret = load_dylinker(dlp, dlarchbits, map, thread, depth,
1012 dyld_aslr_offset, result, imgp);
1013 }
1014
1015 if ((ret == LOAD_SUCCESS) && (depth == 1)) {
1016 if (result->thread_count == 0) {
1017 ret = LOAD_FAILURE;
1018 }
1019 }
1020 }
1021
1022 if (ret == LOAD_BADMACHO && found_xhdr) {
1023 ret = LOAD_BADMACHO_UPX;
1024 }
1025
1026 if (kl_addr) {
1027 kfree(kl_addr, kl_size);
1028 }
1029
1030 return(ret);
1031 }
1032
1033 #if CONFIG_CODE_DECRYPTION
1034
1035 #define APPLE_UNPROTECTED_HEADER_SIZE (3 * 4096)
1036
1037 static load_return_t
1038 unprotect_dsmos_segment(
1039 uint64_t file_off,
1040 uint64_t file_size,
1041 struct vnode *vp,
1042 off_t macho_offset,
1043 vm_map_t map,
1044 vm_map_offset_t map_addr,
1045 vm_map_size_t map_size)
1046 {
1047 kern_return_t kr;
1048
1049 /*
1050 * The first APPLE_UNPROTECTED_HEADER_SIZE bytes (from offset 0 of
1051 * this part of a Universal binary) are not protected...
1052 * The rest needs to be "transformed".
1053 */
1054 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE &&
1055 file_off + file_size <= APPLE_UNPROTECTED_HEADER_SIZE) {
1056 /* it's all unprotected, nothing to do... */
1057 kr = KERN_SUCCESS;
1058 } else {
1059 if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE) {
1060 /*
1061 * We start mapping in the unprotected area.
1062 * Skip the unprotected part...
1063 */
1064 vm_map_offset_t delta;
1065
1066 delta = APPLE_UNPROTECTED_HEADER_SIZE;
1067 delta -= file_off;
1068 map_addr += delta;
1069 map_size -= delta;
1070 }
1071 /* ... transform the rest of the mapping. */
1072 struct pager_crypt_info crypt_info;
1073 crypt_info.page_decrypt = dsmos_page_transform;
1074 crypt_info.crypt_ops = NULL;
1075 crypt_info.crypt_end = NULL;
1076 #pragma unused(vp, macho_offset)
1077 crypt_info.crypt_ops = (void *)0x2e69cf40;
1078 vm_map_offset_t crypto_backing_offset;
1079 crypto_backing_offset = -1; /* i.e. use map entry's offset */
1080 #if VM_MAP_DEBUG_APPLE_PROTECT
1081 if (vm_map_debug_apple_protect) {
1082 struct proc *p;
1083 p = current_proc();
1084 printf("APPLE_PROTECT: %d[%s] map %p "
1085 "[0x%llx:0x%llx] %s(%s)\n",
1086 p->p_pid, p->p_comm, map,
1087 (uint64_t) map_addr,
1088 (uint64_t) (map_addr + map_size),
1089 __FUNCTION__, vp->v_name);
1090 }
1091 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
1092
1093 /* The DSMOS pager can only be used by apple signed code */
1094 struct cs_blob * blob = csvnode_get_blob(vp, file_off);
1095 if( blob == NULL || !blob->csb_platform_binary || blob->csb_platform_path)
1096 {
1097 return LOAD_FAILURE;
1098 }
1099
1100 kr = vm_map_apple_protected(map,
1101 map_addr,
1102 map_addr + map_size,
1103 crypto_backing_offset,
1104 &crypt_info);
1105 }
1106
1107 if (kr != KERN_SUCCESS) {
1108 return LOAD_FAILURE;
1109 }
1110 return LOAD_SUCCESS;
1111 }
1112 #else /* CONFIG_CODE_DECRYPTION */
1113 static load_return_t
1114 unprotect_dsmos_segment(
1115 __unused uint64_t file_off,
1116 __unused uint64_t file_size,
1117 __unused struct vnode *vp,
1118 __unused off_t macho_offset,
1119 __unused vm_map_t map,
1120 __unused vm_map_offset_t map_addr,
1121 __unused vm_map_size_t map_size)
1122 {
1123 return LOAD_SUCCESS;
1124 }
1125 #endif /* CONFIG_CODE_DECRYPTION */
1126
1127
1128 /*
1129 * map_segment:
1130 * Maps a Mach-O segment, taking care of mis-alignment (wrt the system
1131 * page size) issues.
1132 *
1133 * The mapping might result in 1, 2 or 3 map entries:
1134 * 1. for the first page, which could be overlap with the previous
1135 * mapping,
1136 * 2. for the center (if applicable),
1137 * 3. for the last page, which could overlap with the next mapping.
1138 *
1139 * For each of those map entries, we might have to interpose a
1140 * "fourk_pager" to deal with mis-alignment wrt the system page size,
1141 * either in the mapping address and/or size or the file offset and/or
1142 * size.
1143 * The "fourk_pager" itself would be mapped with proper alignment
1144 * wrt the system page size and would then be populated with the
1145 * information about the intended mapping, with a "4KB" granularity.
1146 */
1147 static kern_return_t
1148 map_segment(
1149 vm_map_t map,
1150 vm_map_offset_t vm_start,
1151 vm_map_offset_t vm_end,
1152 memory_object_control_t control,
1153 vm_map_offset_t file_start,
1154 vm_map_offset_t file_end,
1155 vm_prot_t initprot,
1156 vm_prot_t maxprot)
1157 {
1158 int extra_vm_flags, cur_extra_vm_flags;
1159 vm_map_offset_t cur_offset, cur_start, cur_end;
1160 kern_return_t ret;
1161 vm_map_offset_t effective_page_mask;
1162
1163 if (vm_end < vm_start ||
1164 file_end < file_start) {
1165 return LOAD_BADMACHO;
1166 }
1167 if (vm_end == vm_start ||
1168 file_end == file_start) {
1169 /* nothing to map... */
1170 return LOAD_SUCCESS;
1171 }
1172
1173 effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
1174
1175 extra_vm_flags = 0;
1176 if (vm_map_page_aligned(vm_start, effective_page_mask) &&
1177 vm_map_page_aligned(vm_end, effective_page_mask) &&
1178 vm_map_page_aligned(file_start, effective_page_mask) &&
1179 vm_map_page_aligned(file_end, effective_page_mask)) {
1180 /* all page-aligned and map-aligned: proceed */
1181 } else {
1182 panic("map_segment: unexpected mis-alignment "
1183 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx]\n",
1184 (uint64_t) vm_start,
1185 (uint64_t) vm_end,
1186 (uint64_t) file_start,
1187 (uint64_t) file_end);
1188 }
1189
1190 cur_offset = 0;
1191 cur_start = vm_start;
1192 cur_end = vm_start;
1193 if (cur_end >= vm_start + (file_end - file_start)) {
1194 /* all mapped: done */
1195 goto done;
1196 }
1197 if (vm_map_round_page(cur_end, effective_page_mask) >=
1198 vm_map_trunc_page(vm_start + (file_end - file_start),
1199 effective_page_mask)) {
1200 /* no middle */
1201 } else {
1202 cur_start = cur_end;
1203 if ((vm_start & effective_page_mask) !=
1204 (file_start & effective_page_mask)) {
1205 /* one 4K pager for the middle */
1206 cur_extra_vm_flags = extra_vm_flags;
1207 } else {
1208 /* regular mapping for the middle */
1209 cur_extra_vm_flags = 0;
1210 }
1211 cur_end = vm_map_trunc_page(vm_start + (file_end -
1212 file_start),
1213 effective_page_mask);
1214 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1215 ret = vm_map_enter_mem_object_control(
1216 map,
1217 &cur_start,
1218 cur_end - cur_start,
1219 (mach_vm_offset_t)0,
1220 VM_FLAGS_FIXED | cur_extra_vm_flags,
1221 control,
1222 file_start + cur_offset,
1223 TRUE, /* copy */
1224 initprot, maxprot,
1225 VM_INHERIT_DEFAULT);
1226 } else {
1227 ret = vm_map_enter_mem_object(
1228 map,
1229 &cur_start,
1230 cur_end - cur_start,
1231 (mach_vm_offset_t)0,
1232 VM_FLAGS_FIXED | cur_extra_vm_flags,
1233 IPC_PORT_NULL,
1234 0, /* offset */
1235 TRUE, /* copy */
1236 initprot, maxprot,
1237 VM_INHERIT_DEFAULT);
1238 }
1239 if (ret != KERN_SUCCESS) {
1240 return (LOAD_NOSPACE);
1241 }
1242 cur_offset += cur_end - cur_start;
1243 }
1244 if (cur_end >= vm_start + (file_end - file_start)) {
1245 /* all mapped: done */
1246 goto done;
1247 }
1248 cur_start = cur_end;
1249 done:
1250 assert(cur_end >= vm_start + (file_end - file_start));
1251 return LOAD_SUCCESS;
1252 }
1253
1254 static
1255 load_return_t
1256 load_segment(
1257 struct load_command *lcp,
1258 uint32_t filetype,
1259 void * control,
1260 off_t pager_offset,
1261 off_t macho_size,
1262 struct vnode *vp,
1263 vm_map_t map,
1264 int64_t slide,
1265 load_result_t *result)
1266 {
1267 struct segment_command_64 segment_command, *scp;
1268 kern_return_t ret;
1269 vm_map_size_t delta_size;
1270 vm_prot_t initprot;
1271 vm_prot_t maxprot;
1272 size_t segment_command_size, total_section_size,
1273 single_section_size;
1274 vm_map_offset_t file_offset, file_size;
1275 vm_map_offset_t vm_offset, vm_size;
1276 vm_map_offset_t vm_start, vm_end, vm_end_aligned;
1277 vm_map_offset_t file_start, file_end;
1278 kern_return_t kr;
1279 boolean_t verbose;
1280 vm_map_size_t effective_page_size;
1281 vm_map_offset_t effective_page_mask;
1282
1283 effective_page_size = MAX(PAGE_SIZE, vm_map_page_size(map));
1284 effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
1285
1286 verbose = FALSE;
1287 if (LC_SEGMENT_64 == lcp->cmd) {
1288 segment_command_size = sizeof(struct segment_command_64);
1289 single_section_size = sizeof(struct section_64);
1290 } else {
1291 segment_command_size = sizeof(struct segment_command);
1292 single_section_size = sizeof(struct section);
1293 }
1294 if (lcp->cmdsize < segment_command_size)
1295 return (LOAD_BADMACHO);
1296 total_section_size = lcp->cmdsize - segment_command_size;
1297
1298 if (LC_SEGMENT_64 == lcp->cmd) {
1299 scp = (struct segment_command_64 *)lcp;
1300 } else {
1301 scp = &segment_command;
1302 widen_segment_command((struct segment_command *)lcp, scp);
1303 }
1304
1305 if (verbose) {
1306 MACHO_PRINTF(("+++ load_segment %s "
1307 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx] "
1308 "prot %d/%d flags 0x%x\n",
1309 scp->segname,
1310 (uint64_t)(slide + scp->vmaddr),
1311 (uint64_t)(slide + scp->vmaddr + scp->vmsize),
1312 pager_offset + scp->fileoff,
1313 pager_offset + scp->fileoff + scp->filesize,
1314 scp->initprot,
1315 scp->maxprot,
1316 scp->flags));
1317 }
1318
1319 /*
1320 * Make sure what we get from the file is really ours (as specified
1321 * by macho_size).
1322 */
1323 if (scp->fileoff + scp->filesize < scp->fileoff ||
1324 scp->fileoff + scp->filesize > (uint64_t)macho_size) {
1325 return (LOAD_BADMACHO);
1326 }
1327 /*
1328 * Ensure that the number of sections specified would fit
1329 * within the load command size.
1330 */
1331 if (total_section_size / single_section_size < scp->nsects) {
1332 return (LOAD_BADMACHO);
1333 }
1334 /*
1335 * Make sure the segment is page-aligned in the file.
1336 */
1337 file_offset = pager_offset + scp->fileoff; /* limited to 32 bits */
1338 file_size = scp->filesize;
1339 if ((file_offset & PAGE_MASK_64) != 0 ||
1340 /* we can't mmap() it if it's not page-aligned in the file */
1341 (file_offset & vm_map_page_mask(map)) != 0) {
1342 /*
1343 * The 1st test would have failed if the system's page size
1344 * was what this process believe is the page size, so let's
1345 * fail here too for the sake of consistency.
1346 */
1347 return (LOAD_BADMACHO);
1348 }
1349
1350 /*
1351 * If we have a code signature attached for this slice
1352 * require that the segments are within the signed part
1353 * of the file.
1354 */
1355 if (result->cs_end_offset &&
1356 result->cs_end_offset < (off_t)scp->fileoff &&
1357 result->cs_end_offset - scp->fileoff < scp->filesize)
1358 {
1359 if (cs_debug)
1360 printf("section outside code signature\n");
1361 return LOAD_BADMACHO;
1362 }
1363
1364 vm_offset = scp->vmaddr + slide;
1365 vm_size = scp->vmsize;
1366
1367 if (vm_size == 0)
1368 return (LOAD_SUCCESS);
1369 if (scp->vmaddr == 0 &&
1370 file_size == 0 &&
1371 vm_size != 0 &&
1372 (scp->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
1373 (scp->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
1374 /*
1375 * For PIE, extend page zero rather than moving it. Extending
1376 * page zero keeps early allocations from falling predictably
1377 * between the end of page zero and the beginning of the first
1378 * slid segment.
1379 */
1380 /*
1381 * This is a "page zero" segment: it starts at address 0,
1382 * is not mapped from the binary file and is not accessible.
1383 * User-space should never be able to access that memory, so
1384 * make it completely off limits by raising the VM map's
1385 * minimum offset.
1386 */
1387 vm_end = vm_offset + vm_size;
1388 if (vm_end < vm_offset) {
1389 return (LOAD_BADMACHO);
1390 }
1391 if (verbose) {
1392 MACHO_PRINTF(("++++++ load_segment: "
1393 "page_zero up to 0x%llx\n",
1394 (uint64_t) vm_end));
1395 }
1396 {
1397 vm_end = vm_map_round_page(vm_end,
1398 PAGE_MASK_64);
1399 vm_end_aligned = vm_end;
1400 }
1401 ret = vm_map_raise_min_offset(map,
1402 vm_end_aligned);
1403
1404 if (ret != KERN_SUCCESS) {
1405 return (LOAD_FAILURE);
1406 }
1407 return (LOAD_SUCCESS);
1408 } else {
1409 }
1410
1411 {
1412 file_start = vm_map_trunc_page(file_offset,
1413 effective_page_mask);
1414 file_end = vm_map_round_page(file_offset + file_size,
1415 effective_page_mask);
1416 vm_start = vm_map_trunc_page(vm_offset,
1417 effective_page_mask);
1418 vm_end = vm_map_round_page(vm_offset + vm_size,
1419 effective_page_mask);
1420 }
1421
1422 if (vm_start < result->min_vm_addr)
1423 result->min_vm_addr = vm_start;
1424 if (vm_end > result->max_vm_addr)
1425 result->max_vm_addr = vm_end;
1426
1427 if (map == VM_MAP_NULL)
1428 return (LOAD_SUCCESS);
1429
1430 if (vm_size > 0) {
1431 initprot = (scp->initprot) & VM_PROT_ALL;
1432 maxprot = (scp->maxprot) & VM_PROT_ALL;
1433 /*
1434 * Map a copy of the file into the address space.
1435 */
1436 if (verbose) {
1437 MACHO_PRINTF(("++++++ load_segment: "
1438 "mapping at vm [0x%llx:0x%llx] of "
1439 "file [0x%llx:0x%llx]\n",
1440 (uint64_t) vm_start,
1441 (uint64_t) vm_end,
1442 (uint64_t) file_start,
1443 (uint64_t) file_end));
1444 }
1445 ret = map_segment(map,
1446 vm_start,
1447 vm_end,
1448 control,
1449 file_start,
1450 file_end,
1451 initprot,
1452 maxprot);
1453 if (ret) {
1454 return LOAD_NOSPACE;
1455 }
1456
1457 #if FIXME
1458 /*
1459 * If the file didn't end on a page boundary,
1460 * we need to zero the leftover.
1461 */
1462 delta_size = map_size - scp->filesize;
1463 if (delta_size > 0) {
1464 mach_vm_offset_t tmp;
1465
1466 ret = mach_vm_allocate(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE| VM_MAKE_TAG(VM_KERN_MEMORY_BSD));
1467 if (ret != KERN_SUCCESS) {
1468 return(LOAD_RESOURCE);
1469 }
1470
1471 if (copyout(tmp, map_addr + scp->filesize,
1472 delta_size)) {
1473 (void) mach_vm_deallocate(
1474 kernel_map, tmp, delta_size);
1475 return (LOAD_FAILURE);
1476 }
1477
1478 (void) mach_vm_deallocate(kernel_map, tmp, delta_size);
1479 }
1480 #endif /* FIXME */
1481 }
1482
1483 /*
1484 * If the virtual size of the segment is greater
1485 * than the size from the file, we need to allocate
1486 * zero fill memory for the rest.
1487 */
1488 if ((vm_end - vm_start) > (file_end - file_start)) {
1489 delta_size = (vm_end - vm_start) - (file_end - file_start);
1490 } else {
1491 delta_size = 0;
1492 }
1493 if (delta_size > 0) {
1494 mach_vm_offset_t tmp;
1495
1496 tmp = vm_start + (file_end - file_start);
1497 if (verbose) {
1498 MACHO_PRINTF(("++++++ load_segment: "
1499 "delta mapping vm [0x%llx:0x%llx]\n",
1500 (uint64_t) tmp,
1501 (uint64_t) (tmp + delta_size)));
1502 }
1503 kr = map_segment(map,
1504 tmp,
1505 tmp + delta_size,
1506 MEMORY_OBJECT_CONTROL_NULL,
1507 0,
1508 delta_size,
1509 scp->initprot,
1510 scp->maxprot);
1511 if (kr != KERN_SUCCESS) {
1512 return(LOAD_NOSPACE);
1513 }
1514 }
1515
1516 if ( (scp->fileoff == 0) && (scp->filesize != 0) )
1517 result->mach_header = vm_offset;
1518
1519 if (scp->flags & SG_PROTECTED_VERSION_1) {
1520 ret = unprotect_dsmos_segment(file_start,
1521 file_end - file_start,
1522 vp,
1523 pager_offset,
1524 map,
1525 vm_start,
1526 vm_end - vm_start);
1527 if (ret != LOAD_SUCCESS) {
1528 return ret;
1529 }
1530 } else {
1531 ret = LOAD_SUCCESS;
1532 }
1533
1534 if (LOAD_SUCCESS == ret &&
1535 filetype == MH_DYLINKER &&
1536 result->all_image_info_addr == MACH_VM_MIN_ADDRESS) {
1537 note_all_image_info_section(scp,
1538 LC_SEGMENT_64 == lcp->cmd,
1539 single_section_size,
1540 ((const char *)lcp +
1541 segment_command_size),
1542 slide,
1543 result);
1544 }
1545
1546 if (result->entry_point != MACH_VM_MIN_ADDRESS) {
1547 if ((result->entry_point >= vm_offset) && (result->entry_point < (vm_offset + vm_size))) {
1548 if ((scp->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) == (VM_PROT_READ|VM_PROT_EXECUTE)) {
1549 result->validentry = 1;
1550 } else {
1551 /* right range but wrong protections, unset if previously validated */
1552 result->validentry = 0;
1553 }
1554 }
1555 }
1556
1557 return ret;
1558 }
1559
1560 static
1561 load_return_t
1562 load_uuid(
1563 struct uuid_command *uulp,
1564 char *command_end,
1565 load_result_t *result
1566 )
1567 {
1568 /*
1569 * We need to check the following for this command:
1570 * - The command size should be atleast the size of struct uuid_command
1571 * - The UUID part of the command should be completely within the mach-o header
1572 */
1573
1574 if ((uulp->cmdsize < sizeof(struct uuid_command)) ||
1575 (((char *)uulp + sizeof(struct uuid_command)) > command_end)) {
1576 return (LOAD_BADMACHO);
1577 }
1578
1579 memcpy(&result->uuid[0], &uulp->uuid[0], sizeof(result->uuid));
1580 return (LOAD_SUCCESS);
1581 }
1582
1583 static
1584 load_return_t
1585 load_main(
1586 struct entry_point_command *epc,
1587 thread_t thread,
1588 int64_t slide,
1589 load_result_t *result
1590 )
1591 {
1592 mach_vm_offset_t addr;
1593 kern_return_t ret;
1594
1595 if (epc->cmdsize < sizeof(*epc))
1596 return (LOAD_BADMACHO);
1597 if (result->thread_count != 0) {
1598 return (LOAD_FAILURE);
1599 }
1600
1601 if (thread == THREAD_NULL)
1602 return (LOAD_SUCCESS);
1603
1604 /*
1605 * LC_MAIN specifies stack size but not location.
1606 * Add guard page to allocation size (MAXSSIZ includes guard page).
1607 */
1608 if (epc->stacksize) {
1609 if (os_add_overflow(epc->stacksize, 4*PAGE_SIZE, &result->user_stack_size)) {
1610 /*
1611 * We are going to immediately throw away this result, but we want
1612 * to make sure we aren't loading a dangerously close to
1613 * overflowing value, since this will have a guard page added to it
1614 * and be rounded to page boundaries
1615 */
1616 return LOAD_BADMACHO;
1617 }
1618 result->user_stack_size = epc->stacksize;
1619 if (os_add_overflow(epc->stacksize, PAGE_SIZE, &result->user_stack_alloc_size)) {
1620 return LOAD_BADMACHO;
1621 }
1622 } else {
1623 result->user_stack_alloc_size = MAXSSIZ;
1624 }
1625
1626 /* use default location for stack */
1627 ret = thread_userstackdefault(&addr, result->is64bit);
1628 if (ret != KERN_SUCCESS)
1629 return(LOAD_FAILURE);
1630
1631 /* The stack slides down from the default location */
1632 result->user_stack = addr;
1633 result->user_stack -= slide;
1634
1635 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
1636 /* Already processed LC_MAIN or LC_UNIXTHREAD */
1637 return (LOAD_FAILURE);
1638 }
1639
1640 /* kernel does *not* use entryoff from LC_MAIN. Dyld uses it. */
1641 result->needs_dynlinker = TRUE;
1642 result->using_lcmain = TRUE;
1643
1644 ret = thread_state_initialize( thread );
1645 if (ret != KERN_SUCCESS) {
1646 return(LOAD_FAILURE);
1647 }
1648
1649 result->unixproc = TRUE;
1650 result->thread_count++;
1651
1652 return(LOAD_SUCCESS);
1653 }
1654
1655
1656 static
1657 load_return_t
1658 load_unixthread(
1659 struct thread_command *tcp,
1660 thread_t thread,
1661 int64_t slide,
1662 load_result_t *result
1663 )
1664 {
1665 load_return_t ret;
1666 int customstack =0;
1667 mach_vm_offset_t addr;
1668
1669 if (tcp->cmdsize < sizeof(*tcp))
1670 return (LOAD_BADMACHO);
1671 if (result->thread_count != 0) {
1672 return (LOAD_FAILURE);
1673 }
1674
1675 if (thread == THREAD_NULL)
1676 return (LOAD_SUCCESS);
1677
1678 ret = load_threadstack(thread,
1679 (uint32_t *)(((vm_offset_t)tcp) +
1680 sizeof(struct thread_command)),
1681 tcp->cmdsize - sizeof(struct thread_command),
1682 &addr, &customstack, result);
1683 if (ret != LOAD_SUCCESS)
1684 return(ret);
1685
1686 /* LC_UNIXTHREAD optionally specifies stack size and location */
1687
1688 if (!customstack) {
1689 result->user_stack_alloc_size = MAXSSIZ;
1690 }
1691
1692 /* The stack slides down from the default location */
1693 result->user_stack = addr;
1694 result->user_stack -= slide;
1695
1696 ret = load_threadentry(thread,
1697 (uint32_t *)(((vm_offset_t)tcp) +
1698 sizeof(struct thread_command)),
1699 tcp->cmdsize - sizeof(struct thread_command),
1700 &addr);
1701 if (ret != LOAD_SUCCESS)
1702 return(ret);
1703
1704 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
1705 /* Already processed LC_MAIN or LC_UNIXTHREAD */
1706 return (LOAD_FAILURE);
1707 }
1708
1709 result->entry_point = addr;
1710 result->entry_point += slide;
1711
1712 ret = load_threadstate(thread,
1713 (uint32_t *)(((vm_offset_t)tcp) + sizeof(struct thread_command)),
1714 tcp->cmdsize - sizeof(struct thread_command),
1715 result);
1716 if (ret != LOAD_SUCCESS)
1717 return (ret);
1718
1719 result->unixproc = TRUE;
1720 result->thread_count++;
1721
1722 return(LOAD_SUCCESS);
1723 }
1724
1725 static
1726 load_return_t
1727 load_threadstate(
1728 thread_t thread,
1729 uint32_t *ts,
1730 uint32_t total_size,
1731 load_result_t *result
1732 )
1733 {
1734 uint32_t size;
1735 int flavor;
1736 uint32_t thread_size;
1737 uint32_t *local_ts = NULL;
1738 uint32_t local_ts_size = 0;
1739 int ret;
1740
1741 (void)thread;
1742
1743 if (total_size > 0) {
1744 local_ts_size = total_size;
1745 local_ts = kalloc(local_ts_size);
1746 if (local_ts == NULL) {
1747 return LOAD_FAILURE;
1748 }
1749 memcpy(local_ts, ts, local_ts_size);
1750 ts = local_ts;
1751 }
1752
1753 /*
1754 * Validate the new thread state; iterate through the state flavors in
1755 * the Mach-O file.
1756 * XXX: we should validate the machine state here, to avoid failing at
1757 * activation time where we can't bail out cleanly.
1758 */
1759 while (total_size > 0) {
1760 flavor = *ts++;
1761 size = *ts++;
1762
1763 if (os_add_and_mul_overflow(size, 2, sizeof(uint32_t), &thread_size) ||
1764 os_sub_overflow(total_size, thread_size, &total_size)) {
1765 ret = LOAD_BADMACHO;
1766 goto bad;
1767 }
1768
1769 ts += size; /* ts is a (uint32_t *) */
1770 }
1771
1772 result->threadstate = local_ts;
1773 result->threadstate_sz = local_ts_size;
1774 return LOAD_SUCCESS;
1775
1776 bad:
1777 if (local_ts) {
1778 kfree(local_ts, local_ts_size);
1779 }
1780 return ret;
1781 }
1782
1783 static
1784 load_return_t
1785 load_threadstack(
1786 thread_t thread,
1787 uint32_t *ts,
1788 uint32_t total_size,
1789 mach_vm_offset_t *user_stack,
1790 int *customstack,
1791 load_result_t *result
1792 )
1793 {
1794 kern_return_t ret;
1795 uint32_t size;
1796 int flavor;
1797 uint32_t stack_size;
1798
1799 while (total_size > 0) {
1800 flavor = *ts++;
1801 size = *ts++;
1802 if (UINT32_MAX-2 < size ||
1803 UINT32_MAX/sizeof(uint32_t) < size+2)
1804 return (LOAD_BADMACHO);
1805 stack_size = (size+2)*sizeof(uint32_t);
1806 if (stack_size > total_size)
1807 return(LOAD_BADMACHO);
1808 total_size -= stack_size;
1809
1810 /*
1811 * Third argument is a kernel space pointer; it gets cast
1812 * to the appropriate type in thread_userstack() based on
1813 * the value of flavor.
1814 */
1815 ret = thread_userstack(thread, flavor, (thread_state_t)ts, size, user_stack, customstack, result->is64bit);
1816 if (ret != KERN_SUCCESS) {
1817 return(LOAD_FAILURE);
1818 }
1819 ts += size; /* ts is a (uint32_t *) */
1820 }
1821 return(LOAD_SUCCESS);
1822 }
1823
1824 static
1825 load_return_t
1826 load_threadentry(
1827 thread_t thread,
1828 uint32_t *ts,
1829 uint32_t total_size,
1830 mach_vm_offset_t *entry_point
1831 )
1832 {
1833 kern_return_t ret;
1834 uint32_t size;
1835 int flavor;
1836 uint32_t entry_size;
1837
1838 /*
1839 * Set the thread state.
1840 */
1841 *entry_point = MACH_VM_MIN_ADDRESS;
1842 while (total_size > 0) {
1843 flavor = *ts++;
1844 size = *ts++;
1845 if (UINT32_MAX-2 < size ||
1846 UINT32_MAX/sizeof(uint32_t) < size+2)
1847 return (LOAD_BADMACHO);
1848 entry_size = (size+2)*sizeof(uint32_t);
1849 if (entry_size > total_size)
1850 return(LOAD_BADMACHO);
1851 total_size -= entry_size;
1852 /*
1853 * Third argument is a kernel space pointer; it gets cast
1854 * to the appropriate type in thread_entrypoint() based on
1855 * the value of flavor.
1856 */
1857 ret = thread_entrypoint(thread, flavor, (thread_state_t)ts, size, entry_point);
1858 if (ret != KERN_SUCCESS) {
1859 return(LOAD_FAILURE);
1860 }
1861 ts += size; /* ts is a (uint32_t *) */
1862 }
1863 return(LOAD_SUCCESS);
1864 }
1865
1866 struct macho_data {
1867 struct nameidata __nid;
1868 union macho_vnode_header {
1869 struct mach_header mach_header;
1870 struct fat_header fat_header;
1871 char __pad[512];
1872 } __header;
1873 };
1874
1875 #define DEFAULT_DYLD_PATH "/usr/lib/dyld"
1876
1877 #if (DEVELOPMENT || DEBUG)
1878 extern char dyld_alt_path[];
1879 extern int use_alt_dyld;
1880 #endif
1881
1882 static load_return_t
1883 load_dylinker(
1884 struct dylinker_command *lcp,
1885 integer_t archbits,
1886 vm_map_t map,
1887 thread_t thread,
1888 int depth,
1889 int64_t slide,
1890 load_result_t *result,
1891 struct image_params *imgp
1892 )
1893 {
1894 char *name;
1895 char *p;
1896 struct vnode *vp = NULLVP; /* set by get_macho_vnode() */
1897 struct mach_header *header;
1898 off_t file_offset = 0; /* set by get_macho_vnode() */
1899 off_t macho_size = 0; /* set by get_macho_vnode() */
1900 load_result_t *myresult;
1901 kern_return_t ret;
1902 struct macho_data *macho_data;
1903 struct {
1904 struct mach_header __header;
1905 load_result_t __myresult;
1906 struct macho_data __macho_data;
1907 } *dyld_data;
1908
1909 if (lcp->cmdsize < sizeof(*lcp))
1910 return (LOAD_BADMACHO);
1911
1912 name = (char *)lcp + lcp->name.offset;
1913
1914 /*
1915 * Check for a proper null terminated string.
1916 */
1917 p = name;
1918 do {
1919 if (p >= (char *)lcp + lcp->cmdsize)
1920 return(LOAD_BADMACHO);
1921 } while (*p++);
1922
1923 #if (DEVELOPMENT || DEBUG)
1924
1925 /*
1926 * rdar://23680808
1927 * If an alternate dyld has been specified via boot args, check
1928 * to see if PROC_UUID_ALT_DYLD_POLICY has been set on this
1929 * executable and redirect the kernel to load that linker.
1930 */
1931
1932 if (use_alt_dyld) {
1933 int policy_error;
1934 uint32_t policy_flags = 0;
1935 int32_t policy_gencount = 0;
1936
1937 policy_error = proc_uuid_policy_lookup(result->uuid, &policy_flags, &policy_gencount);
1938 if (policy_error == 0) {
1939 if (policy_flags & PROC_UUID_ALT_DYLD_POLICY) {
1940 name = dyld_alt_path;
1941 }
1942 }
1943 }
1944 #endif
1945
1946 #if !(DEVELOPMENT || DEBUG)
1947 if (0 != strcmp(name, DEFAULT_DYLD_PATH)) {
1948 return (LOAD_BADMACHO);
1949 }
1950 #endif
1951
1952 /* Allocate wad-of-data from heap to reduce excessively deep stacks */
1953
1954 MALLOC(dyld_data, void *, sizeof (*dyld_data), M_TEMP, M_WAITOK);
1955 header = &dyld_data->__header;
1956 myresult = &dyld_data->__myresult;
1957 macho_data = &dyld_data->__macho_data;
1958
1959 ret = get_macho_vnode(name, archbits, header,
1960 &file_offset, &macho_size, macho_data, &vp);
1961 if (ret)
1962 goto novp_out;
1963
1964 *myresult = load_result_null;
1965 myresult->is64bit = result->is64bit;
1966
1967 ret = parse_machfile(vp, map, thread, header, file_offset,
1968 macho_size, depth, slide, 0, myresult, result, imgp);
1969
1970 if (ret == LOAD_SUCCESS) {
1971 if (result->threadstate) {
1972 /* don't use the app's threadstate if we have a dyld */
1973 kfree(result->threadstate, result->threadstate_sz);
1974 }
1975 result->threadstate = myresult->threadstate;
1976 result->threadstate_sz = myresult->threadstate_sz;
1977
1978 result->dynlinker = TRUE;
1979 result->entry_point = myresult->entry_point;
1980 result->validentry = myresult->validentry;
1981 result->all_image_info_addr = myresult->all_image_info_addr;
1982 result->all_image_info_size = myresult->all_image_info_size;
1983 if (myresult->platform_binary) {
1984 result->csflags |= CS_DYLD_PLATFORM;
1985 }
1986 }
1987
1988 vnode_put(vp);
1989 novp_out:
1990 FREE(dyld_data, M_TEMP);
1991 return (ret);
1992
1993 }
1994
1995 static load_return_t
1996 load_code_signature(
1997 struct linkedit_data_command *lcp,
1998 struct vnode *vp,
1999 off_t macho_offset,
2000 off_t macho_size,
2001 cpu_type_t cputype,
2002 load_result_t *result,
2003 struct image_params *imgp)
2004 {
2005 int ret;
2006 kern_return_t kr;
2007 vm_offset_t addr;
2008 int resid;
2009 struct cs_blob *blob;
2010 int error;
2011 vm_size_t blob_size;
2012
2013 addr = 0;
2014 blob = NULL;
2015
2016 if (lcp->cmdsize != sizeof (struct linkedit_data_command) ||
2017 lcp->dataoff + lcp->datasize > macho_size) {
2018 ret = LOAD_BADMACHO;
2019 goto out;
2020 }
2021
2022 blob = ubc_cs_blob_get(vp, cputype, macho_offset);
2023 if (blob != NULL) {
2024 /* we already have a blob for this vnode and cputype */
2025 if (blob->csb_cpu_type == cputype &&
2026 blob->csb_base_offset == macho_offset) {
2027 /* it matches the blob we want here, lets verify the version */
2028 if(0 != ubc_cs_generation_check(vp)) {
2029 if (0 != ubc_cs_blob_revalidate(vp, blob, imgp, 0)) {
2030 ret = LOAD_FAILURE; /* set error same as from ubc_cs_blob_add */
2031 goto out;
2032 }
2033 }
2034 ret = LOAD_SUCCESS;
2035 } else {
2036 /* the blob has changed for this vnode: fail ! */
2037 ret = LOAD_BADMACHO;
2038 }
2039 goto out;
2040 }
2041
2042 blob_size = lcp->datasize;
2043 kr = ubc_cs_blob_allocate(&addr, &blob_size);
2044 if (kr != KERN_SUCCESS) {
2045 ret = LOAD_NOSPACE;
2046 goto out;
2047 }
2048
2049 resid = 0;
2050 error = vn_rdwr(UIO_READ,
2051 vp,
2052 (caddr_t) addr,
2053 lcp->datasize,
2054 macho_offset + lcp->dataoff,
2055 UIO_SYSSPACE,
2056 0,
2057 kauth_cred_get(),
2058 &resid,
2059 current_proc());
2060 if (error || resid != 0) {
2061 ret = LOAD_IOERROR;
2062 goto out;
2063 }
2064
2065 if (ubc_cs_blob_add(vp,
2066 cputype,
2067 macho_offset,
2068 &addr,
2069 lcp->datasize,
2070 imgp,
2071 0,
2072 &blob)) {
2073 if (addr) {
2074 ubc_cs_blob_deallocate(addr, blob_size);
2075 }
2076 ret = LOAD_FAILURE;
2077 goto out;
2078 } else {
2079 /* ubc_cs_blob_add() has consumed "addr" */
2080 addr = 0;
2081 }
2082
2083 #if CHECK_CS_VALIDATION_BITMAP
2084 ubc_cs_validation_bitmap_allocate( vp );
2085 #endif
2086
2087 ret = LOAD_SUCCESS;
2088 out:
2089 if (ret == LOAD_SUCCESS) {
2090 if (blob == NULL)
2091 panic("sucess, but no blob!");
2092
2093 result->csflags |= blob->csb_flags;
2094 result->platform_binary = blob->csb_platform_binary;
2095 result->cs_end_offset = blob->csb_end_offset;
2096 }
2097 if (addr != 0) {
2098 ubc_cs_blob_deallocate(addr, blob_size);
2099 addr = 0;
2100 }
2101
2102 return ret;
2103 }
2104
2105
2106 #if CONFIG_CODE_DECRYPTION
2107
2108 static load_return_t
2109 set_code_unprotect(
2110 struct encryption_info_command *eip,
2111 caddr_t addr,
2112 vm_map_t map,
2113 int64_t slide,
2114 struct vnode *vp,
2115 off_t macho_offset,
2116 cpu_type_t cputype,
2117 cpu_subtype_t cpusubtype)
2118 {
2119 int error, len;
2120 pager_crypt_info_t crypt_info;
2121 const char * cryptname = 0;
2122 char *vpath;
2123
2124 size_t offset;
2125 struct segment_command_64 *seg64;
2126 struct segment_command *seg32;
2127 vm_map_offset_t map_offset, map_size;
2128 vm_object_offset_t crypto_backing_offset;
2129 kern_return_t kr;
2130
2131 if (eip->cmdsize < sizeof(*eip)) return LOAD_BADMACHO;
2132
2133 switch(eip->cryptid) {
2134 case 0:
2135 /* not encrypted, just an empty load command */
2136 return LOAD_SUCCESS;
2137 case 1:
2138 cryptname="com.apple.unfree";
2139 break;
2140 case 0x10:
2141 /* some random cryptid that you could manually put into
2142 * your binary if you want NULL */
2143 cryptname="com.apple.null";
2144 break;
2145 default:
2146 return LOAD_BADMACHO;
2147 }
2148
2149 if (map == VM_MAP_NULL) return (LOAD_SUCCESS);
2150 if (NULL == text_crypter_create) return LOAD_FAILURE;
2151
2152 MALLOC_ZONE(vpath, char *, MAXPATHLEN, M_NAMEI, M_WAITOK);
2153 if(vpath == NULL) return LOAD_FAILURE;
2154
2155 len = MAXPATHLEN;
2156 error = vn_getpath(vp, vpath, &len);
2157 if (error) {
2158 FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
2159 return LOAD_FAILURE;
2160 }
2161
2162 /* set up decrypter first */
2163 crypt_file_data_t crypt_data = {
2164 .filename = vpath,
2165 .cputype = cputype,
2166 .cpusubtype = cpusubtype};
2167 kr=text_crypter_create(&crypt_info, cryptname, (void*)&crypt_data);
2168 #if VM_MAP_DEBUG_APPLE_PROTECT
2169 if (vm_map_debug_apple_protect) {
2170 struct proc *p;
2171 p = current_proc();
2172 printf("APPLE_PROTECT: %d[%s] map %p %s(%s) -> 0x%x\n",
2173 p->p_pid, p->p_comm, map, __FUNCTION__, vpath, kr);
2174 }
2175 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
2176 FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
2177
2178 if(kr) {
2179 printf("set_code_unprotect: unable to create decrypter %s, kr=%d\n",
2180 cryptname, kr);
2181 if (kr == kIOReturnNotPrivileged) {
2182 /* text encryption returned decryption failure */
2183 return(LOAD_DECRYPTFAIL);
2184 }else
2185 return LOAD_RESOURCE;
2186 }
2187
2188 /* this is terrible, but we have to rescan the load commands to find the
2189 * virtual address of this encrypted stuff. This code is gonna look like
2190 * the dyld source one day... */
2191 struct mach_header *header = (struct mach_header *)addr;
2192 size_t mach_header_sz = sizeof(struct mach_header);
2193 if (header->magic == MH_MAGIC_64 ||
2194 header->magic == MH_CIGAM_64) {
2195 mach_header_sz = sizeof(struct mach_header_64);
2196 }
2197 offset = mach_header_sz;
2198 uint32_t ncmds = header->ncmds;
2199 while (ncmds--) {
2200 /*
2201 * Get a pointer to the command.
2202 */
2203 struct load_command *lcp = (struct load_command *)(addr + offset);
2204 offset += lcp->cmdsize;
2205
2206 switch(lcp->cmd) {
2207 case LC_SEGMENT_64:
2208 seg64 = (struct segment_command_64 *)lcp;
2209 if ((seg64->fileoff <= eip->cryptoff) &&
2210 (seg64->fileoff+seg64->filesize >=
2211 eip->cryptoff+eip->cryptsize)) {
2212 map_offset = seg64->vmaddr + eip->cryptoff - seg64->fileoff + slide;
2213 map_size = eip->cryptsize;
2214 crypto_backing_offset = macho_offset + eip->cryptoff;
2215 goto remap_now;
2216 }
2217 case LC_SEGMENT:
2218 seg32 = (struct segment_command *)lcp;
2219 if ((seg32->fileoff <= eip->cryptoff) &&
2220 (seg32->fileoff+seg32->filesize >=
2221 eip->cryptoff+eip->cryptsize)) {
2222 map_offset = seg32->vmaddr + eip->cryptoff - seg32->fileoff + slide;
2223 map_size = eip->cryptsize;
2224 crypto_backing_offset = macho_offset + eip->cryptoff;
2225 goto remap_now;
2226 }
2227 }
2228 }
2229
2230 /* if we get here, did not find anything */
2231 return LOAD_BADMACHO;
2232
2233 remap_now:
2234 /* now remap using the decrypter */
2235 MACHO_PRINTF(("+++ set_code_unprotect: vm[0x%llx:0x%llx]\n",
2236 (uint64_t) map_offset,
2237 (uint64_t) (map_offset+map_size)));
2238 kr = vm_map_apple_protected(map,
2239 map_offset,
2240 map_offset+map_size,
2241 crypto_backing_offset,
2242 &crypt_info);
2243 if (kr) {
2244 printf("set_code_unprotect(): mapping failed with %x\n", kr);
2245 return LOAD_PROTECT;
2246 }
2247
2248 return LOAD_SUCCESS;
2249 }
2250
2251 #endif
2252
2253 /*
2254 * This routine exists to support the load_dylinker().
2255 *
2256 * This routine has its own, separate, understanding of the FAT file format,
2257 * which is terrifically unfortunate.
2258 */
2259 static
2260 load_return_t
2261 get_macho_vnode(
2262 char *path,
2263 integer_t archbits,
2264 struct mach_header *mach_header,
2265 off_t *file_offset,
2266 off_t *macho_size,
2267 struct macho_data *data,
2268 struct vnode **vpp
2269 )
2270 {
2271 struct vnode *vp;
2272 vfs_context_t ctx = vfs_context_current();
2273 proc_t p = vfs_context_proc(ctx);
2274 kauth_cred_t kerncred;
2275 struct nameidata *ndp = &data->__nid;
2276 boolean_t is_fat;
2277 struct fat_arch fat_arch;
2278 int error;
2279 int resid;
2280 union macho_vnode_header *header = &data->__header;
2281 off_t fsize = (off_t)0;
2282
2283 /*
2284 * Capture the kernel credential for use in the actual read of the
2285 * file, since the user doing the execution may have execute rights
2286 * but not read rights, but to exec something, we have to either map
2287 * or read it into the new process address space, which requires
2288 * read rights. This is to deal with lack of common credential
2289 * serialization code which would treat NOCRED as "serialize 'root'".
2290 */
2291 kerncred = vfs_context_ucred(vfs_context_kernel());
2292
2293 /* init the namei data to point the file user's program name */
2294 NDINIT(ndp, LOOKUP, OP_OPEN, FOLLOW | LOCKLEAF, UIO_SYSSPACE, CAST_USER_ADDR_T(path), ctx);
2295
2296 if ((error = namei(ndp)) != 0) {
2297 if (error == ENOENT) {
2298 error = LOAD_ENOENT;
2299 } else {
2300 error = LOAD_FAILURE;
2301 }
2302 return(error);
2303 }
2304 nameidone(ndp);
2305 vp = ndp->ni_vp;
2306
2307 /* check for regular file */
2308 if (vp->v_type != VREG) {
2309 error = LOAD_PROTECT;
2310 goto bad1;
2311 }
2312
2313 /* get size */
2314 if ((error = vnode_size(vp, &fsize, ctx)) != 0) {
2315 error = LOAD_FAILURE;
2316 goto bad1;
2317 }
2318
2319 /* Check mount point */
2320 if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
2321 error = LOAD_PROTECT;
2322 goto bad1;
2323 }
2324
2325 /* check access */
2326 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_EXECUTE | KAUTH_VNODE_READ_DATA, ctx)) != 0) {
2327 error = LOAD_PROTECT;
2328 goto bad1;
2329 }
2330
2331 /* try to open it */
2332 if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
2333 error = LOAD_PROTECT;
2334 goto bad1;
2335 }
2336
2337 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)header, sizeof (*header), 0,
2338 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p)) != 0) {
2339 error = LOAD_IOERROR;
2340 goto bad2;
2341 }
2342
2343 if (resid) {
2344 error = LOAD_BADMACHO;
2345 goto bad2;
2346 }
2347
2348 if (header->mach_header.magic == MH_MAGIC ||
2349 header->mach_header.magic == MH_MAGIC_64) {
2350 is_fat = FALSE;
2351 } else if (OSSwapBigToHostInt32(header->fat_header.magic) == FAT_MAGIC) {
2352 is_fat = TRUE;
2353 } else {
2354 error = LOAD_BADMACHO;
2355 goto bad2;
2356 }
2357
2358 if (is_fat) {
2359
2360 error = fatfile_validate_fatarches((vm_offset_t)(&header->fat_header),
2361 sizeof(*header));
2362 if (error != LOAD_SUCCESS) {
2363 goto bad2;
2364 }
2365
2366 /* Look up our architecture in the fat file. */
2367 error = fatfile_getarch_with_bits(archbits,
2368 (vm_offset_t)(&header->fat_header), sizeof(*header), &fat_arch);
2369 if (error != LOAD_SUCCESS)
2370 goto bad2;
2371
2372 /* Read the Mach-O header out of it */
2373 error = vn_rdwr(UIO_READ, vp, (caddr_t)&header->mach_header,
2374 sizeof (header->mach_header), fat_arch.offset,
2375 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p);
2376 if (error) {
2377 error = LOAD_IOERROR;
2378 goto bad2;
2379 }
2380
2381 if (resid) {
2382 error = LOAD_BADMACHO;
2383 goto bad2;
2384 }
2385
2386 /* Is this really a Mach-O? */
2387 if (header->mach_header.magic != MH_MAGIC &&
2388 header->mach_header.magic != MH_MAGIC_64) {
2389 error = LOAD_BADMACHO;
2390 goto bad2;
2391 }
2392
2393 *file_offset = fat_arch.offset;
2394 *macho_size = fat_arch.size;
2395 } else {
2396 /*
2397 * Force get_macho_vnode() to fail if the architecture bits
2398 * do not match the expected architecture bits. This in
2399 * turn causes load_dylinker() to fail for the same reason,
2400 * so it ensures the dynamic linker and the binary are in
2401 * lock-step. This is potentially bad, if we ever add to
2402 * the CPU_ARCH_* bits any bits that are desirable but not
2403 * required, since the dynamic linker might work, but we will
2404 * refuse to load it because of this check.
2405 */
2406 if ((cpu_type_t)(header->mach_header.cputype & CPU_ARCH_MASK) != archbits) {
2407 error = LOAD_BADARCH;
2408 goto bad2;
2409 }
2410
2411 *file_offset = 0;
2412 *macho_size = fsize;
2413 }
2414
2415 *mach_header = header->mach_header;
2416 *vpp = vp;
2417
2418 ubc_setsize(vp, fsize);
2419 return (error);
2420
2421 bad2:
2422 (void) VNOP_CLOSE(vp, FREAD, ctx);
2423 bad1:
2424 vnode_put(vp);
2425 return(error);
2426 }
mirror of XNU