+typedef struct kaslrPackedOffsets {
+ uint32_t count; /* number of offsets */
+ uint32_t offsetsArray[]; /* offsets to slide */
+} kaslrPackedOffsets;
+
+/*********************************************************************
+*********************************************************************/
+void
+KLDBootstrap::readPrelinkedExtensions(
+ kernel_section_t * prelinkInfoSect)
+{
+ OSArray * infoDictArray = NULL;// do not release
+ OSObject * parsedXML = NULL;// must release
+ OSDictionary * prelinkInfoDict = NULL;// do not release
+ OSString * errorString = NULL;// must release
+ OSKext * theKernel = NULL;// must release
+ OSData * kernelcacheUUID = NULL;// do not release
+
+ kernel_segment_command_t * prelinkTextSegment = NULL;// see code
+ kernel_segment_command_t * prelinkInfoSegment = NULL;// see code
+
+ /* We make some copies of data, but if anything fails we're basically
+ * going to fail the boot, so these won't be cleaned up on error.
+ */
+ void * prelinkData = NULL;// see code
+ vm_size_t prelinkLength = 0;
+
+
+ OSDictionary * infoDict = NULL;// do not release
+
+ IORegistryEntry * registryRoot = NULL;// do not release
+ OSNumber * prelinkCountObj = NULL;// must release
+
+ u_int i = 0;
+#if NO_KEXTD
+ bool ramDiskBoot;
+ bool developerDevice;
+ bool dontLoad;
+#endif
+ OSData * kaslrOffsets = NULL;
+ unsigned long plk_segSizes[PLK_SEGMENTS];
+ vm_offset_t plk_segAddrs[PLK_SEGMENTS];
+
+ OSKextLog(/* kext */ NULL,
+ kOSKextLogProgressLevel |
+ kOSKextLogDirectoryScanFlag | kOSKextLogArchiveFlag,
+ "Starting from prelinked kernel.");
+
+ prelinkTextSegment = getsegbyname(kPrelinkTextSegment);
+ if (!prelinkTextSegment) {
+ OSKextLog(/* kext */ NULL,
+ kOSKextLogErrorLevel |
+ kOSKextLogDirectoryScanFlag | kOSKextLogArchiveFlag,
+ "Can't find prelinked kexts' text segment.");
+ goto finish;
+ }
+
+#if KASLR_KEXT_DEBUG
+ unsigned long scratchSize;
+ vm_offset_t scratchAddr;
+
+ IOLog("kaslr: prelinked kernel address info: \n");
+
+ scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__TEXT", &scratchSize);
+ IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __TEXT \n",
+ (unsigned long)scratchAddr,
+ (unsigned long)(scratchAddr + scratchSize),
+ scratchSize);
+
+ scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__DATA", &scratchSize);
+ IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __DATA \n",
+ (unsigned long)scratchAddr,
+ (unsigned long)(scratchAddr + scratchSize),
+ scratchSize);
+
+ scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__LINKEDIT", &scratchSize);
+ IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __LINKEDIT \n",
+ (unsigned long)scratchAddr,
+ (unsigned long)(scratchAddr + scratchSize),
+ scratchSize);
+
+ scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__KLD", &scratchSize);
+ IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __KLD \n",
+ (unsigned long)scratchAddr,
+ (unsigned long)(scratchAddr + scratchSize),
+ scratchSize);
+
+ scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__PRELINK_TEXT", &scratchSize);
+ IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __PRELINK_TEXT \n",
+ (unsigned long)scratchAddr,
+ (unsigned long)(scratchAddr + scratchSize),
+ scratchSize);
+
+ scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__PRELINK_INFO", &scratchSize);
+ IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __PRELINK_INFO \n",
+ (unsigned long)scratchAddr,
+ (unsigned long)(scratchAddr + scratchSize),
+ scratchSize);
+#endif
+
+ prelinkData = (void *) prelinkTextSegment->vmaddr;
+ prelinkLength = prelinkTextSegment->vmsize;
+
+ /* build arrays of plk info for later use */
+ const char ** segNamePtr;
+
+ for (segNamePtr = &plk_segNames[0], i = 0; *segNamePtr && i < PLK_SEGMENTS; segNamePtr++, i++) {
+ plk_segSizes[i] = 0;
+ plk_segAddrs[i] = (vm_offset_t)getsegdatafromheader(&_mh_execute_header, *segNamePtr, &plk_segSizes[i]);
+ }
+
+
+ /* Unserialize the info dictionary from the prelink info section.
+ */
+ parsedXML = OSUnserializeXML((const char *)prelinkInfoSect->addr,
+ &errorString);
+ if (parsedXML) {
+ prelinkInfoDict = OSDynamicCast(OSDictionary, parsedXML);
+ }
+ if (!prelinkInfoDict) {
+ const char * errorCString = "(unknown error)";
+
+ if (errorString && errorString->getCStringNoCopy()) {
+ errorCString = errorString->getCStringNoCopy();
+ } else if (parsedXML) {
+ errorCString = "not a dictionary";
+ }
+ OSKextLog(/* kext */ NULL, kOSKextLogErrorLevel | kOSKextLogArchiveFlag,
+ "Error unserializing prelink plist: %s.", errorCString);
+ goto finish;
+ }
+
+#if NO_KEXTD
+ /* Check if we should keep developer kexts around.
+ * TODO: Check DeviceTree instead of a boot-arg <rdar://problem/10604201>
+ */
+ developerDevice = true;
+ PE_parse_boot_argn("developer", &developerDevice, sizeof(developerDevice));
+
+ ramDiskBoot = IORamDiskBSDRoot();
+#endif /* NO_KEXTD */
+
+ /* Copy in the kernelcache UUID */
+ kernelcacheUUID = OSDynamicCast(OSData,
+ prelinkInfoDict->getObject(kPrelinkInfoKCIDKey));
+ if (kernelcacheUUID) {
+ if (kernelcacheUUID->getLength() != sizeof(kernelcache_uuid)) {
+ panic("kernelcacheUUID length is %d, expected %lu", kernelcacheUUID->getLength(),
+ sizeof(kernelcache_uuid));
+ } else {
+ kernelcache_uuid_valid = TRUE;
+ memcpy((void *)&kernelcache_uuid, (const void *)kernelcacheUUID->getBytesNoCopy(), kernelcacheUUID->getLength());
+ uuid_unparse_upper(kernelcache_uuid, kernelcache_uuid_string);
+ }
+ }
+
+ infoDictArray = OSDynamicCast(OSArray,
+ prelinkInfoDict->getObject(kPrelinkInfoDictionaryKey));
+ if (!infoDictArray) {
+ OSKextLog(/* kext */ NULL, kOSKextLogErrorLevel | kOSKextLogArchiveFlag,
+ "The prelinked kernel has no kext info dictionaries");
+ goto finish;
+ }
+
+ /* kaslrOffsets are available use them to slide local relocations */
+ kaslrOffsets = OSDynamicCast(OSData,
+ prelinkInfoDict->getObject(kPrelinkLinkKASLROffsetsKey));
+
+ /* Create dictionary of excluded kexts
+ */
+#ifndef CONFIG_EMBEDDED
+ OSKext::createExcludeListFromPrelinkInfo(infoDictArray);
+#endif
+ /* Create OSKext objects for each info dictionary.
+ */
+ for (i = 0; i < infoDictArray->getCount(); ++i) {
+ infoDict = OSDynamicCast(OSDictionary, infoDictArray->getObject(i));
+ if (!infoDict) {
+ OSKextLog(/* kext */ NULL,
+ kOSKextLogErrorLevel |
+ kOSKextLogDirectoryScanFlag | kOSKextLogArchiveFlag,
+ "Can't find info dictionary for prelinked kext #%d.", i);
+ continue;
+ }
+
+#if NO_KEXTD
+ dontLoad = false;
+
+ /* If we're not on a developer device, skip and free developer kexts.
+ */
+ if (developerDevice == false) {
+ OSBoolean *devOnlyBool = OSDynamicCast(OSBoolean,
+ infoDict->getObject(kOSBundleDeveloperOnlyKey));
+ if (devOnlyBool == kOSBooleanTrue) {
+ dontLoad = true;
+ }
+ }
+
+ /* Skip and free kexts that are only needed when booted from a ram disk.
+ */
+ if (ramDiskBoot == false) {
+ OSBoolean *ramDiskOnlyBool = OSDynamicCast(OSBoolean,
+ infoDict->getObject(kOSBundleRamDiskOnlyKey));
+ if (ramDiskOnlyBool == kOSBooleanTrue) {
+ dontLoad = true;
+ }
+ }
+
+ if (dontLoad == true) {
+ OSString *bundleID = OSDynamicCast(OSString,
+ infoDict->getObject(kCFBundleIdentifierKey));
+ if (bundleID) {
+ OSKextLog(NULL, kOSKextLogWarningLevel | kOSKextLogGeneralFlag,
+ "Kext %s not loading.", bundleID->getCStringNoCopy());
+ }
+
+ OSNumber *addressNum = OSDynamicCast(OSNumber,
+ infoDict->getObject(kPrelinkExecutableLoadKey));
+ OSNumber *lengthNum = OSDynamicCast(OSNumber,
+ infoDict->getObject(kPrelinkExecutableSizeKey));
+ if (addressNum && lengthNum) {
+#if __arm__ || __arm64__
+ vm_offset_t data = ml_static_slide(addressNum->unsigned64BitValue());
+ vm_size_t length = (vm_size_t) (lengthNum->unsigned32BitValue());
+ ml_static_mfree(data, length);
+#else
+#error Pick the right way to free prelinked data on this arch
+#endif
+ }
+
+ infoDictArray->removeObject(i--);
+ continue;
+ }
+#endif /* NO_KEXTD */
+
+ /* Create the kext for the entry, then release it, because the
+ * kext system keeps them around until explicitly removed.
+ * Any creation/registration failures are already logged for us.
+ */
+ OSKext * newKext = OSKext::withPrelinkedInfoDict(infoDict, (kaslrOffsets ? TRUE : FALSE));
+ OSSafeReleaseNULL(newKext);
+ }
+
+ /* slide kxld relocations */
+ if (kaslrOffsets && vm_kernel_slide > 0) {
+ int slidKextAddrCount = 0;
+ int badSlideAddr = 0;
+ int badSlideTarget = 0;
+
+ const kaslrPackedOffsets * myOffsets = NULL;
+ myOffsets = (const kaslrPackedOffsets *) kaslrOffsets->getBytesNoCopy();
+
+ for (uint32_t j = 0; j < myOffsets->count; j++) {
+ uint64_t slideOffset = (uint64_t) myOffsets->offsetsArray[j];
+ uintptr_t * slideAddr = (uintptr_t *) ((uint64_t)prelinkData + slideOffset);
+ int slideAddrSegIndex = -1;
+ int addrToSlideSegIndex = -1;
+
+ slideAddrSegIndex = __whereIsAddr((vm_offset_t)slideAddr, &plk_segSizes[0], &plk_segAddrs[0], PLK_SEGMENTS );
+ if (slideAddrSegIndex >= 0) {
+ addrToSlideSegIndex = __whereIsAddr(ml_static_slide((vm_offset_t)(*slideAddr)), &plk_segSizes[0], &plk_segAddrs[0], PLK_SEGMENTS );
+ if (addrToSlideSegIndex < 0) {
+ badSlideTarget++;
+ continue;
+ }
+ } else {
+ badSlideAddr++;
+ continue;
+ }
+
+ slidKextAddrCount++;
+ *slideAddr = ml_static_slide(*slideAddr);
+ } // for ...
+
+ /* All kexts are now slid, set VM protections for them */
+ OSKext::setAllVMAttributes();
+ }
+
+ /* Store the number of prelinked kexts in the registry so we can tell
+ * when the system has been started from a prelinked kernel.
+ */
+ registryRoot = IORegistryEntry::getRegistryRoot();
+ assert(registryRoot);
+
+ prelinkCountObj = OSNumber::withNumber(
+ (unsigned long long)infoDictArray->getCount(),
+ 8 * sizeof(uint32_t));
+ assert(prelinkCountObj);
+ if (prelinkCountObj) {
+ registryRoot->setProperty(kOSPrelinkKextCountKey, prelinkCountObj);
+ }
+
+ OSKextLog(/* kext */ NULL,
+ kOSKextLogProgressLevel |
+ kOSKextLogGeneralFlag | kOSKextLogKextBookkeepingFlag |
+ kOSKextLogDirectoryScanFlag | kOSKextLogArchiveFlag,
+ "%u prelinked kexts",
+ infoDictArray->getCount());
+
+#if CONFIG_KEXT_BASEMENT
+ /* On CONFIG_KEXT_BASEMENT systems, kexts are copied to their own
+ * special VM region during OSKext init time, so we can free the whole
+ * segment now.
+ */
+ ml_static_mfree((vm_offset_t) prelinkData, prelinkLength);
+#endif /* __x86_64__ */
+
+ /* Free the prelink info segment, we're done with it.
+ */
+ prelinkInfoSegment = getsegbyname(kPrelinkInfoSegment);
+ if (prelinkInfoSegment) {
+ ml_static_mfree((vm_offset_t)prelinkInfoSegment->vmaddr,
+ (vm_size_t)prelinkInfoSegment->vmsize);
+ }
+
+finish:
+ OSSafeReleaseNULL(errorString);
+ OSSafeReleaseNULL(parsedXML);
+ OSSafeReleaseNULL(theKernel);
+ OSSafeReleaseNULL(prelinkCountObj);
+ return;
+}
projects / apple / xnu.git / blobdiff