1 /*
2  * Copyright (c) 2000-2010 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 /*
29  *	Copyright (C) 1988, 1989,  NeXT, Inc.
30  *
31  *	File:	kern/mach_loader.c
32  *	Author:	Avadis Tevanian, Jr.
33  *
34  *	Mach object file loader (kernel version, for now).
35  *
36  * 21-Jul-88  Avadis Tevanian, Jr. (avie) at NeXT
37  *	Started.
38  */
39 
40 #include <sys/param.h>
41 #include <sys/vnode_internal.h>
42 #include <sys/uio.h>
43 #include <sys/namei.h>
44 #include <sys/proc_internal.h>
45 #include <sys/kauth.h>
46 #include <sys/stat.h>
47 #include <sys/malloc.h>
48 #include <sys/mount_internal.h>
49 #include <sys/fcntl.h>
50 #include <sys/ubc_internal.h>
51 #include <sys/imgact.h>
52 #include <sys/codesign.h>
53 #include <sys/proc_uuid_policy.h>
54 #include <sys/reason.h>
55 #include <sys/kdebug.h>
56 
57 #include <mach/mach_types.h>
58 #include <mach/vm_map.h>	/* vm_allocate() */
59 #include <mach/mach_vm.h>	/* mach_vm_allocate() */
60 #include <mach/vm_statistics.h>
61 #include <mach/task.h>
62 #include <mach/thread_act.h>
63 
64 #include <machine/vmparam.h>
65 #include <machine/exec.h>
66 #include <machine/pal_routines.h>
67 
68 #include <kern/kern_types.h>
69 #include <kern/cpu_number.h>
70 #include <kern/mach_loader.h>
71 #include <kern/mach_fat.h>
72 #include <kern/kalloc.h>
73 #include <kern/task.h>
74 #include <kern/thread.h>
75 #include <kern/page_decrypt.h>
76 
77 #include <mach-o/fat.h>
78 #include <mach-o/loader.h>
79 
80 #include <vm/pmap.h>
81 #include <vm/vm_map.h>
82 #include <vm/vm_kern.h>
83 #include <vm/vm_pager.h>
84 #include <vm/vnode_pager.h>
85 #include <vm/vm_protos.h>
86 #include <IOKit/IOReturn.h>	/* for kIOReturnNotPrivileged */
87 
88 #include <os/overflow.h>
89 
90 /*
91  * XXX vm/pmap.h should not treat these prototypes as MACH_KERNEL_PRIVATE
92  * when KERNEL is defined.
93  */
94 extern pmap_t	pmap_create(ledger_t ledger, vm_map_size_t size,
95 				boolean_t is_64bit);
96 
97 /* XXX should have prototypes in a shared header file */
98 extern int	get_map_nentries(vm_map_t);
99 
100 extern kern_return_t	memory_object_signed(memory_object_control_t control,
101 					     boolean_t is_signed);
102 
103 /* An empty load_result_t */
104 static const load_result_t load_result_null = {
105 	.mach_header = MACH_VM_MIN_ADDRESS,
106 	.entry_point = MACH_VM_MIN_ADDRESS,
107 	.user_stack = MACH_VM_MIN_ADDRESS,
108 	.user_stack_size = 0,
109 	.user_stack_alloc = MACH_VM_MIN_ADDRESS,
110 	.user_stack_alloc_size = 0,
111 	.all_image_info_addr = MACH_VM_MIN_ADDRESS,
112 	.all_image_info_size = 0,
113 	.thread_count = 0,
114 	.unixproc = 0,
115 	.dynlinker = 0,
116 	.needs_dynlinker = 0,
117 	.validentry = 0,
118 	.using_lcmain = 0,
119 	.is64bit = 0,
120 	.csflags = 0,
121 	.has_pagezero = 0,
122 	.uuid = { 0 },
123 	.min_vm_addr = MACH_VM_MAX_ADDRESS,
124 	.max_vm_addr = MACH_VM_MIN_ADDRESS,
125 	.cs_end_offset = 0,
126 	.threadstate = NULL,
127 	.threadstate_sz = 0
128 };
129 
130 /*
131  * Prototypes of static functions.
132  */
133 static load_return_t
134 parse_machfile(
135 	struct vnode		*vp,
136 	vm_map_t		map,
137 	thread_t		thread,
138 	struct mach_header	*header,
139 	off_t			file_offset,
140 	off_t			macho_size,
141 	int			depth,
142 	int64_t			slide,
143 	int64_t			dyld_slide,
144 	load_result_t		*result,
145 	load_result_t		*binresult,
146 	struct image_params	*imgp
147 );
148 
149 static load_return_t
150 load_segment(
151 	struct load_command		*lcp,
152 	uint32_t			filetype,
153 	void				*control,
154 	off_t				pager_offset,
155 	off_t				macho_size,
156 	struct vnode			*vp,
157 	vm_map_t			map,
158 	int64_t				slide,
159 	load_result_t			*result
160 );
161 
162 static load_return_t
163 load_uuid(
164 	struct uuid_command		*uulp,
165 	char				*command_end,
166 	load_result_t			*result
167 );
168 
169 static load_return_t
170 load_code_signature(
171 	struct linkedit_data_command	*lcp,
172 	struct vnode			*vp,
173 	off_t				macho_offset,
174 	off_t				macho_size,
175 	cpu_type_t			cputype,
176 	load_result_t			*result,
177 	struct image_params		*imgp);
178 
179 #if CONFIG_CODE_DECRYPTION
180 static load_return_t
181 set_code_unprotect(
182 	struct encryption_info_command	*lcp,
183 	caddr_t				addr,
184 	vm_map_t			map,
185 	int64_t				slide,
186 	struct vnode			*vp,
187 	off_t				macho_offset,
188 	cpu_type_t			cputype,
189 	cpu_subtype_t			cpusubtype);
190 #endif
191 
192 static
193 load_return_t
194 load_main(
195 	struct entry_point_command	*epc,
196 	thread_t		thread,
197 	int64_t				slide,
198 	load_result_t		*result
199 );
200 
201 static load_return_t
202 load_unixthread(
203 	struct thread_command	*tcp,
204 	thread_t			thread,
205 	int64_t				slide,
206 	load_result_t			*result
207 );
208 
209 static load_return_t
210 load_threadstate(
211 	thread_t		thread,
212 	uint32_t	*ts,
213 	uint32_t	total_size,
214 	load_result_t *
215 );
216 
217 static load_return_t
218 load_threadstack(
219 	thread_t		thread,
220 	uint32_t		*ts,
221 	uint32_t		total_size,
222 	mach_vm_offset_t	*user_stack,
223 	int			*customstack,
224 	load_result_t 		*result
225 );
226 
227 static load_return_t
228 load_threadentry(
229 	thread_t		thread,
230 	uint32_t	*ts,
231 	uint32_t	total_size,
232 	mach_vm_offset_t	*entry_point
233 );
234 
235 static load_return_t
236 load_dylinker(
237 	struct dylinker_command	*lcp,
238 	integer_t		archbits,
239 	vm_map_t		map,
240 	thread_t		thread,
241 	int			depth,
242 	int64_t			slide,
243 	load_result_t		*result,
244 	struct image_params	*imgp
245 );
246 
247 struct macho_data;
248 
249 static load_return_t
250 get_macho_vnode(
251 	char				*path,
252 	integer_t		archbits,
253 	struct mach_header	*mach_header,
254 	off_t			*file_offset,
255 	off_t			*macho_size,
256 	struct macho_data	*macho_data,
257 	struct vnode		**vpp
258 );
259 
260 static inline void
widen_segment_command(const struct segment_command *scp32, struct segment_command_64 *scp)261 widen_segment_command(const struct segment_command *scp32,
262     struct segment_command_64 *scp)
263 {
264 	scp->cmd = scp32->cmd;
265 	scp->cmdsize = scp32->cmdsize;
266 	bcopy(scp32->segname, scp->segname, sizeof(scp->segname));
267 	scp->vmaddr = scp32->vmaddr;
268 	scp->vmsize = scp32->vmsize;
269 	scp->fileoff = scp32->fileoff;
270 	scp->filesize = scp32->filesize;
271 	scp->maxprot = scp32->maxprot;
272 	scp->initprot = scp32->initprot;
273 	scp->nsects = scp32->nsects;
274 	scp->flags = scp32->flags;
275 }
276 
277 static void
note_all_image_info_section(const struct segment_command_64 *scp, boolean_t is64, size_t section_size, const void *sections, int64_t slide, load_result_t *result)278 note_all_image_info_section(const struct segment_command_64 *scp,
279     boolean_t is64, size_t section_size, const void *sections,
280     int64_t slide, load_result_t *result)
281 {
282 	const union {
283 		struct section s32;
284 		struct section_64 s64;
285 	} *sectionp;
286 	unsigned int i;
287 
288 	if (strncmp(scp->segname, "__DATA", sizeof(scp->segname)) != 0)
289 		return;
290 	for (i = 0; i < scp->nsects; ++i) {
291 		sectionp = (const void *)
292 		    ((const char *)sections + section_size * i);
293 		if (0 == strncmp(sectionp->s64.sectname, "__all_image_info",
294 		    sizeof(sectionp->s64.sectname))) {
295 			result->all_image_info_addr =
296 			    is64 ? sectionp->s64.addr : sectionp->s32.addr;
297 			result->all_image_info_addr += slide;
298 			result->all_image_info_size =
299 			    is64 ? sectionp->s64.size : sectionp->s32.size;
300 			return;
301 		}
302 	}
303 }
304 
305 
306 load_return_t
load_machfile( struct image_params *imgp, struct mach_header *header, thread_t thread, vm_map_t *mapp, load_result_t *result )307 load_machfile(
308 	struct image_params	*imgp,
309 	struct mach_header	*header,
310 	thread_t 		thread,
311 	vm_map_t 		*mapp,
312 	load_result_t		*result
313 )
314 {
315 	struct vnode		*vp = imgp->ip_vp;
316 	off_t			file_offset = imgp->ip_arch_offset;
317 	off_t			macho_size = imgp->ip_arch_size;
318 	off_t			file_size = imgp->ip_vattr->va_data_size;
319 	pmap_t			pmap = 0;	/* protected by create_map */
320 	vm_map_t		map;
321 	load_result_t		myresult;
322 	load_return_t		lret;
323 	boolean_t enforce_hard_pagezero = TRUE;
324 	int in_exec = (imgp->ip_flags & IMGPF_EXEC);
325 	task_t task = current_task();
326 	proc_t p = current_proc();
327 	mach_vm_offset_t	aslr_offset = 0;
328 	mach_vm_offset_t	dyld_aslr_offset = 0;
329 	kern_return_t 		kret;
330 
331 	if (macho_size > file_size) {
332 		return(LOAD_BADMACHO);
333 	}
334 
335 	result->is64bit = ((imgp->ip_flags & IMGPF_IS_64BIT) == IMGPF_IS_64BIT);
336 
337 	task_t ledger_task;
338 	if (imgp->ip_new_thread) {
339 		ledger_task = get_threadtask(imgp->ip_new_thread);
340 	} else {
341 		ledger_task = task;
342 	}
343 	pmap = pmap_create(get_task_ledger(ledger_task),
344 			   (vm_map_size_t) 0,
345 			   result->is64bit);
346 	map = vm_map_create(pmap,
347 			0,
348 			vm_compute_max_offset(result->is64bit),
349 			TRUE);
350 
351 #if   (__ARM_ARCH_7K__ >= 2) && defined(PLATFORM_WatchOS)
352 	/* enforce 16KB alignment for watch targets with new ABI */
353 	vm_map_set_page_shift(map, SIXTEENK_PAGE_SHIFT);
354 #endif /* __arm64__ */
355 
356 #ifndef	CONFIG_ENFORCE_SIGNED_CODE
357 	/* This turns off faulting for executable pages, which allows
358 	 * to circumvent Code Signing Enforcement. The per process
359 	 * flag (CS_ENFORCEMENT) is not set yet, but we can use the
360 	 * global flag.
361 	 */
362 	if ( !cs_enforcement(NULL) && (header->flags & MH_ALLOW_STACK_EXECUTION) )
363 	        vm_map_disable_NX(map);
364 #endif
365 
366 	/* Forcibly disallow execution from data pages on even if the arch
367 	 * normally permits it. */
368 	if ((header->flags & MH_NO_HEAP_EXECUTION) && !(imgp->ip_flags & IMGPF_ALLOW_DATA_EXEC))
369 		vm_map_disallow_data_exec(map);
370 
371 	/*
372 	 * Compute a random offset for ASLR, and an independent random offset for dyld.
373 	 */
374 	if (!(imgp->ip_flags & IMGPF_DISABLE_ASLR)) {
375 		uint64_t max_slide_pages;
376 
377 		max_slide_pages = vm_map_get_max_aslr_slide_pages(map);
378 
379 		aslr_offset = random();
380 		aslr_offset %= max_slide_pages;
381 		aslr_offset <<= vm_map_page_shift(map);
382 
383 		dyld_aslr_offset = random();
384 		dyld_aslr_offset %= max_slide_pages;
385 		dyld_aslr_offset <<= vm_map_page_shift(map);
386 	}
387 
388 	if (!result)
389 		result = &myresult;
390 
391 	*result = load_result_null;
392 
393 	/*
394 	 * re-set the bitness on the load result since we cleared the load result above.
395 	 */
396 	result->is64bit = ((imgp->ip_flags & IMGPF_IS_64BIT) == IMGPF_IS_64BIT);
397 
398 	lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
399 	                      0, (int64_t)aslr_offset, (int64_t)dyld_aslr_offset, result,
400 			      NULL, imgp);
401 
402 	if (lret != LOAD_SUCCESS) {
403 		vm_map_deallocate(map);	/* will lose pmap reference too */
404 		return(lret);
405 	}
406 
407 #if __x86_64__
408 	/*
409 	 * On x86, for compatibility, don't enforce the hard page-zero restriction for 32-bit binaries.
410 	 */
411 	if (!result->is64bit) {
412 		enforce_hard_pagezero = FALSE;
413 	}
414 #endif
415 	/*
416 	 * Check to see if the page zero is enforced by the map->min_offset.
417 	 */
418 	if (enforce_hard_pagezero &&
419 	    (vm_map_has_hard_pagezero(map, 0x1000) == FALSE)) {
420 		{
421 			vm_map_deallocate(map);	/* will lose pmap reference too */
422 			return (LOAD_BADMACHO);
423 		}
424 	}
425 
426 	vm_commit_pagezero_status(map);
427 
428 	/*
429 	 * If this is an exec, then we are going to destroy the old
430 	 * task, and it's correct to halt it; if it's spawn, the
431 	 * task is not yet running, and it makes no sense.
432 	 */
433 	if (in_exec) {
434 		/*
435 		 * Mark the task as halting and start the other
436 		 * threads towards terminating themselves.  Then
437 		 * make sure any threads waiting for a process
438 		 * transition get informed that we are committed to
439 		 * this transition, and then finally complete the
440 		 * task halting (wait for threads and then cleanup
441 		 * task resources).
442 		 *
443 		 * NOTE: task_start_halt() makes sure that no new
444 		 * threads are created in the task during the transition.
445 		 * We need to mark the workqueue as exiting before we
446 		 * wait for threads to terminate (at the end of which
447 		 * we no longer have a prohibition on thread creation).
448 		 *
449 		 * Finally, clean up any lingering workqueue data structures
450 		 * that may have been left behind by the workqueue threads
451 		 * as they exited (and then clean up the work queue itself).
452 		 */
453 		kret = task_start_halt(task);
454 		if (kret != KERN_SUCCESS) {
455 			vm_map_deallocate(map);	/* will lose pmap reference too */
456 			return (LOAD_FAILURE);
457 		}
458 		proc_transcommit(p, 0);
459 		workqueue_mark_exiting(p);
460 		task_complete_halt(task);
461 		workqueue_exit(p);
462 		kqueue_dealloc(p->p_wqkqueue);
463 		p->p_wqkqueue = NULL;
464 		/*
465 		 * Roll up accounting info to new task. The roll up is done after
466 		 * task_complete_halt to make sure the thread accounting info is
467 		 * rolled up to current_task.
468 		 */
469 		task_rollup_accounting_info(get_threadtask(thread), task);
470 	}
471 	*mapp = map;
472 	return(LOAD_SUCCESS);
473 }
474 
475 int macho_printf = 0;
476 #define MACHO_PRINTF(args)				\
477 	do {						\
478 		if (macho_printf) {			\
479 			printf args;			\
480 		}					\
481 	} while (0)
482 
483 /*
484  * The file size of a mach-o file is limited to 32 bits; this is because
485  * this is the limit on the kalloc() of enough bytes for a mach_header and
486  * the contents of its sizeofcmds, which is currently constrained to 32
487  * bits in the file format itself.  We read into the kernel buffer the
488  * commands section, and then parse it in order to parse the mach-o file
489  * format load_command segment(s).  We are only interested in a subset of
490  * the total set of possible commands. If "map"==VM_MAP_NULL or
491  * "thread"==THREAD_NULL, do not make permament VM modifications,
492  * just preflight the parse.
493  */
494 static
495 load_return_t
parse_machfile( struct vnode *vp, vm_map_t map, thread_t thread, struct mach_header *header, off_t file_offset, off_t macho_size, int depth, int64_t aslr_offset, int64_t dyld_aslr_offset, load_result_t *result, load_result_t *binresult, struct image_params *imgp )496 parse_machfile(
497 	struct vnode 		*vp,
498 	vm_map_t		map,
499 	thread_t		thread,
500 	struct mach_header	*header,
501 	off_t			file_offset,
502 	off_t			macho_size,
503 	int			depth,
504 	int64_t			aslr_offset,
505 	int64_t			dyld_aslr_offset,
506 	load_result_t		*result,
507 	load_result_t		*binresult,
508 	struct image_params	*imgp
509 )
510 {
511 	uint32_t		ncmds;
512 	struct load_command	*lcp;
513 	struct dylinker_command	*dlp = 0;
514 	integer_t		dlarchbits = 0;
515 	void *			control;
516 	load_return_t		ret = LOAD_SUCCESS;
517 	caddr_t			addr;
518 	void *			kl_addr;
519 	vm_size_t		size,kl_size;
520 	size_t			offset;
521 	size_t			oldoffset;	/* for overflow check */
522 	int			pass;
523 	proc_t			p = current_proc();		/* XXXX */
524 	int			error;
525 	int 			resid = 0;
526 	size_t			mach_header_sz = sizeof(struct mach_header);
527 	boolean_t		abi64;
528 	boolean_t		got_code_signatures = FALSE;
529 	boolean_t		found_header_segment = FALSE;
530 	boolean_t		found_xhdr = FALSE;
531 	int64_t			slide = 0;
532 	boolean_t		dyld_no_load_addr = FALSE;
533 	boolean_t		is_dyld = FALSE;
534 	vm_map_offset_t		effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
535 
536 	if (header->magic == MH_MAGIC_64 ||
537 	    header->magic == MH_CIGAM_64) {
538 	    	mach_header_sz = sizeof(struct mach_header_64);
539 	}
540 
541 	/*
542 	 *	Break infinite recursion
543 	 */
544 	if (depth > 1) {
545 		return(LOAD_FAILURE);
546 	}
547 
548 	depth++;
549 
550 	/*
551 	 *	Check to see if right machine type.
552 	 */
553 	if (((cpu_type_t)(header->cputype & ~CPU_ARCH_MASK) != (cpu_type() & ~CPU_ARCH_MASK)) ||
554 	    !grade_binary(header->cputype,
555 	    	header->cpusubtype & ~CPU_SUBTYPE_MASK))
556 		return(LOAD_BADARCH);
557 
558 	abi64 = ((header->cputype & CPU_ARCH_ABI64) == CPU_ARCH_ABI64);
559 
560 	switch (header->filetype) {
561 
562 	case MH_EXECUTE:
563 		if (depth != 1) {
564 			return (LOAD_FAILURE);
565 		}
566 
567 		break;
568 	case MH_DYLINKER:
569 		if (depth != 2) {
570 			return (LOAD_FAILURE);
571 		}
572 		is_dyld = TRUE;
573 		break;
574 
575 	default:
576 		return (LOAD_FAILURE);
577 	}
578 
579 	/*
580 	 *	Get the pager for the file.
581 	 */
582 	control = ubc_getobject(vp, UBC_FLAGS_NONE);
583 
584 	/*
585 	 *	Map portion that must be accessible directly into
586 	 *	kernel's map.
587 	 */
588 	if ((off_t)(mach_header_sz + header->sizeofcmds) > macho_size)
589 		return(LOAD_BADMACHO);
590 
591 	/*
592 	 *	Round size of Mach-O commands up to page boundry.
593 	 */
594 	size = round_page(mach_header_sz + header->sizeofcmds);
595 	if (size <= 0)
596 		return(LOAD_BADMACHO);
597 
598 	/*
599 	 * Map the load commands into kernel memory.
600 	 */
601 	addr = 0;
602 	kl_size = size;
603 	kl_addr = kalloc(size);
604 	addr = (caddr_t)kl_addr;
605 	if (addr == NULL)
606 		return(LOAD_NOSPACE);
607 
608 	error = vn_rdwr(UIO_READ, vp, addr, size, file_offset,
609 	    UIO_SYSSPACE, 0, kauth_cred_get(), &resid, p);
610 	if (error) {
611 		if (kl_addr)
612 			kfree(kl_addr, kl_size);
613 		return(LOAD_IOERROR);
614 	}
615 
616 	if (resid) {
617 		/* We must be able to read in as much as the mach_header indicated */
618 		if (kl_addr)
619 			kfree(kl_addr, kl_size);
620 		return(LOAD_BADMACHO);
621 	}
622 
623 	/*
624 	 *	For PIE and dyld, slide everything by the ASLR offset.
625 	 */
626 	if ((header->flags & MH_PIE) || is_dyld) {
627 		slide = aslr_offset;
628 	}
629 
630 	/*
631 	 *  Scan through the commands, processing each one as necessary.
632 	 *  We parse in three passes through the headers:
633 	 *  0: determine if TEXT and DATA boundary can be page-aligned
634 	 *  1: thread state, uuid, code signature
635 	 *  2: segments
636 	 *  3: dyld, encryption, check entry point
637 	 */
638 
639 	boolean_t slide_realign = FALSE;
640 
641 	for (pass = 0; pass <= 3; pass++) {
642 
643 		if (pass == 0 && !slide_realign && !is_dyld) {
644 			/* if we dont need to realign the slide or determine dyld's load
645 			 * address, pass 0 can be skipped */
646 			continue;
647 		} else if (pass == 1) {
648 
649 			if (dyld_no_load_addr && binresult) {
650 				/*
651 				 * The dyld Mach-O does not specify a load address. Try to locate
652 				 * it right after the main binary. If binresult == NULL, load
653 				 * directly to the given slide.
654 				 */
655 				slide = vm_map_round_page(slide + binresult->max_vm_addr, effective_page_mask);
656 			}
657 		}
658 
659 		/*
660 		 * Check that the entry point is contained in an executable segments
661 		 */
662 		if ((pass == 3) && (!result->using_lcmain && result->validentry == 0)) {
663 			thread_state_initialize(thread);
664 			ret = LOAD_FAILURE;
665 			break;
666 		}
667 
668 		/*
669 		 * Check that some segment maps the start of the mach-o file, which is
670 		 * needed by the dynamic loader to read the mach headers, etc.
671 		 */
672 		if ((pass == 3) && (found_header_segment == FALSE)) {
673 			ret = LOAD_BADMACHO;
674 			break;
675 		}
676 
677 		/*
678 		 * Loop through each of the load_commands indicated by the
679 		 * Mach-O header; if an absurd value is provided, we just
680 		 * run off the end of the reserved section by incrementing
681 		 * the offset too far, so we are implicitly fail-safe.
682 		 */
683 		offset = mach_header_sz;
684 		ncmds = header->ncmds;
685 
686 		while (ncmds--) {
687 			/*
688 			 *	Get a pointer to the command.
689 			 */
690 			lcp = (struct load_command *)(addr + offset);
691 			oldoffset = offset;
692 			offset += lcp->cmdsize;
693 
694 			/*
695 			 * Perform prevalidation of the struct load_command
696 			 * before we attempt to use its contents.  Invalid
697 			 * values are ones which result in an overflow, or
698 			 * which can not possibly be valid commands, or which
699 			 * straddle or exist past the reserved section at the
700 			 * start of the image.
701 			 */
702 			if (oldoffset > offset ||
703 			    lcp->cmdsize < sizeof(struct load_command) ||
704 			    offset > header->sizeofcmds + mach_header_sz) {
705 				ret = LOAD_BADMACHO;
706 				break;
707 			}
708 
709 			/*
710 			 * Act on struct load_command's for which kernel
711 			 * intervention is required.
712 			 */
713 			switch(lcp->cmd) {
714 			case LC_SEGMENT: {
715 				struct segment_command *scp = (struct segment_command *) lcp;
716 
717 				if (pass == 0) {
718 					if (is_dyld && scp->vmaddr == 0 && scp->fileoff == 0) {
719 						dyld_no_load_addr = TRUE;
720 						if (!slide_realign) {
721 							/* got what we need, bail early on pass 0 */
722 							continue;
723 						}
724 					}
725 
726 					break;
727 				}
728 
729 				if (pass == 1 && !strncmp(scp->segname, "__XHDR", sizeof(scp->segname))) {
730 					found_xhdr = TRUE;
731 				}
732 
733 				if (pass != 2)
734 					break;
735 
736 				if (abi64) {
737 					/*
738 					 * Having an LC_SEGMENT command for the
739 					 * wrong ABI is invalid <rdar://problem/11021230>
740 					 */
741 					ret = LOAD_BADMACHO;
742 					break;
743 				}
744 
745 				ret = load_segment(lcp,
746 				                   header->filetype,
747 				                   control,
748 				                   file_offset,
749 				                   macho_size,
750 				                   vp,
751 				                   map,
752 				                   slide,
753 				                   result);
754 
755 				if (ret == LOAD_SUCCESS && scp->fileoff == 0 && scp->filesize > 0) {
756 					/* Enforce a single segment mapping offset zero, with R+X
757 					 * protection. */
758 					if (found_header_segment ||
759 							((scp->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) != (VM_PROT_READ|VM_PROT_EXECUTE))) {
760 						ret = LOAD_BADMACHO;
761 						break;
762 					}
763 					found_header_segment = TRUE;
764 				}
765 
766 				break;
767 			}
768 			case LC_SEGMENT_64: {
769 				struct segment_command_64 *scp64 = (struct segment_command_64 *) lcp;
770 
771 				if (pass == 0) {
772 					if (is_dyld && scp64->vmaddr == 0 && scp64->fileoff == 0) {
773 						dyld_no_load_addr = TRUE;
774 						if (!slide_realign) {
775 							/* got what we need, bail early on pass 0 */
776 							continue;
777 						}
778 					}
779 				}
780 
781 				if (pass == 1 && !strncmp(scp64->segname, "__XHDR", sizeof(scp64->segname))) {
782 					found_xhdr = TRUE;
783 				}
784 
785 				if (pass != 2)
786 					break;
787 
788 				if (!abi64) {
789 					/*
790 					 * Having an LC_SEGMENT_64 command for the
791 					 * wrong ABI is invalid <rdar://problem/11021230>
792 					 */
793 					ret = LOAD_BADMACHO;
794 					break;
795 				}
796 
797 				ret = load_segment(lcp,
798 				                   header->filetype,
799 				                   control,
800 				                   file_offset,
801 				                   macho_size,
802 				                   vp,
803 				                   map,
804 				                   slide,
805 				                   result);
806 
807 				if (ret == LOAD_SUCCESS && scp64->fileoff == 0 && scp64->filesize > 0) {
808 					/* Enforce a single segment mapping offset zero, with R+X
809 					 * protection. */
810 					if (found_header_segment ||
811 							((scp64->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) != (VM_PROT_READ|VM_PROT_EXECUTE))) {
812 						ret = LOAD_BADMACHO;
813 						break;
814 					}
815 					found_header_segment = TRUE;
816 				}
817 
818 				break;
819 			}
820 			case LC_UNIXTHREAD:
821 				if (pass != 1)
822 					break;
823 				ret = load_unixthread(
824 						 (struct thread_command *) lcp,
825 						 thread,
826 						 slide,
827 						 result);
828 				break;
829 			case LC_MAIN:
830 				if (pass != 1)
831 					break;
832 				if (depth != 1)
833 					break;
834 				ret = load_main(
835 						 (struct entry_point_command *) lcp,
836 						 thread,
837 						 slide,
838 						 result);
839 				break;
840 			case LC_LOAD_DYLINKER:
841 				if (pass != 3)
842 					break;
843 				if ((depth == 1) && (dlp == 0)) {
844 					dlp = (struct dylinker_command *)lcp;
845 					dlarchbits = (header->cputype & CPU_ARCH_MASK);
846 				} else {
847 					ret = LOAD_FAILURE;
848 				}
849 				break;
850 			case LC_UUID:
851 				if (pass == 1 && depth == 1) {
852 					ret = load_uuid((struct uuid_command *) lcp,
853 							(char *)addr + mach_header_sz + header->sizeofcmds,
854 							result);
855 				}
856 				break;
857 			case LC_CODE_SIGNATURE:
858 				/* CODE SIGNING */
859 				if (pass != 1)
860 					break;
861 				/* pager -> uip ->
862 				   load signatures & store in uip
863 				   set VM object "signed_pages"
864 				*/
865 				ret = load_code_signature(
866 					(struct linkedit_data_command *) lcp,
867 					vp,
868 					file_offset,
869 					macho_size,
870 					header->cputype,
871 					result,
872 					imgp);
873 				if (ret != LOAD_SUCCESS) {
874 					printf("proc %d: load code signature error %d "
875 					       "for file \"%s\"\n",
876 					       p->p_pid, ret, vp->v_name);
877 					/*
878 					 * Allow injections to be ignored on devices w/o enforcement enabled
879 					 */
880 					if (!cs_enforcement(NULL))
881 					    ret = LOAD_SUCCESS; /* ignore error */
882 
883 				} else {
884 					got_code_signatures = TRUE;
885 				}
886 
887 				if (got_code_signatures) {
888 					unsigned tainted = CS_VALIDATE_TAINTED;
889 					boolean_t valid = FALSE;
890 					vm_size_t off = 0;
891 
892 
893 					if (cs_debug > 10)
894 						printf("validating initial pages of %s\n", vp->v_name);
895 
896 					while (off < size && ret == LOAD_SUCCESS) {
897 					     tainted = CS_VALIDATE_TAINTED;
898 
899 					     valid = cs_validate_range(vp,
900 								       NULL,
901 								       file_offset + off,
902 								       addr + off,
903 								       PAGE_SIZE,
904 								       &tainted);
905 					     if (!valid || (tainted & CS_VALIDATE_TAINTED)) {
906 						     if (cs_debug)
907 							     printf("CODE SIGNING: %s[%d]: invalid initial page at offset %lld validated:%d tainted:%d csflags:0x%x\n",
908 								    vp->v_name, p->p_pid, (long long)(file_offset + off), valid, tainted, result->csflags);
909 						     if (cs_enforcement(NULL) ||
910 							 (result->csflags & (CS_HARD|CS_KILL|CS_ENFORCEMENT))) {
911 							     ret = LOAD_FAILURE;
912 						     }
913 						     result->csflags &= ~CS_VALID;
914 					     }
915 					     off += PAGE_SIZE;
916 					}
917 				}
918 
919 				break;
920 #if CONFIG_CODE_DECRYPTION
921 			case LC_ENCRYPTION_INFO:
922 			case LC_ENCRYPTION_INFO_64:
923 				if (pass != 3)
924 					break;
925 				ret = set_code_unprotect(
926 					(struct encryption_info_command *) lcp,
927 					addr, map, slide, vp, file_offset,
928 					header->cputype, header->cpusubtype);
929 				if (ret != LOAD_SUCCESS) {
930 					os_reason_t load_failure_reason = OS_REASON_NULL;
931 					printf("proc %d: set_code_unprotect() error %d "
932 					       "for file \"%s\"\n",
933 					       p->p_pid, ret, vp->v_name);
934 					/*
935 					 * Don't let the app run if it's
936 					 * encrypted but we failed to set up the
937 					 * decrypter. If the keys are missing it will
938 					 * return LOAD_DECRYPTFAIL.
939 					 */
940 					 if (ret == LOAD_DECRYPTFAIL) {
941 						/* failed to load due to missing FP keys */
942 						proc_lock(p);
943 						p->p_lflag |= P_LTERM_DECRYPTFAIL;
944 						proc_unlock(p);
945 
946 						KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
947 								p->p_pid, OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT, 0, 0);
948 						load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT);
949 					 } else {
950 
951 						KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
952 								p->p_pid, OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT, 0, 0);
953 						load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT);
954 					 }
955 
956 					 assert(load_failure_reason != OS_REASON_NULL);
957 					 psignal_with_reason(p, SIGKILL, load_failure_reason);
958 				}
959 				break;
960 #endif
961 			default:
962 				/* Other commands are ignored by the kernel */
963 				ret = LOAD_SUCCESS;
964 				break;
965 			}
966 			if (ret != LOAD_SUCCESS)
967 				break;
968 		}
969 		if (ret != LOAD_SUCCESS)
970 			break;
971 	}
972 
973 	if (ret == LOAD_SUCCESS) {
974 		if (! got_code_signatures) {
975 			if (cs_enforcement(NULL)) {
976 				ret = LOAD_FAILURE;
977 			} else {
978                                /*
979                                 * No embedded signatures: look for detached by taskgated,
980                                 * this is only done on OSX, on embedded platforms we expect everything
981                                 * to be have embedded signatures.
982                                 */
983 				struct cs_blob *blob;
984 
985 				blob = ubc_cs_blob_get(vp, -1, file_offset);
986 				if (blob != NULL) {
987 					unsigned int cs_flag_data = blob->csb_flags;
988 					if(0 != ubc_cs_generation_check(vp)) {
989 						if (0 != ubc_cs_blob_revalidate(vp, blob, imgp, 0)) {
990 							/* clear out the flag data if revalidation fails */
991 							cs_flag_data = 0;
992 							result->csflags &= ~CS_VALID;
993 						}
994 					}
995 					/* get flags to be applied to the process */
996 					result->csflags |= cs_flag_data;
997 				}
998 			}
999 		}
1000 
1001 		/* Make sure if we need dyld, we got it */
1002 		if (result->needs_dynlinker && !dlp) {
1003 			ret = LOAD_FAILURE;
1004 		}
1005 
1006 		if ((ret == LOAD_SUCCESS) && (dlp != 0)) {
1007 			/*
1008 			 * load the dylinker, and slide it by the independent DYLD ASLR
1009 			 * offset regardless of the PIE-ness of the main binary.
1010 			 */
1011 			ret = load_dylinker(dlp, dlarchbits, map, thread, depth,
1012 					    dyld_aslr_offset, result, imgp);
1013 		}
1014 
1015 		if ((ret == LOAD_SUCCESS) && (depth == 1)) {
1016 			if (result->thread_count == 0) {
1017 				ret = LOAD_FAILURE;
1018 			}
1019 	    }
1020 	}
1021 
1022 	if (ret == LOAD_BADMACHO && found_xhdr) {
1023 		ret = LOAD_BADMACHO_UPX;
1024 	}
1025 
1026 	if (kl_addr) {
1027 		kfree(kl_addr, kl_size);
1028 	}
1029 
1030 	return(ret);
1031 }
1032 
1033 #if CONFIG_CODE_DECRYPTION
1034 
1035 #define	APPLE_UNPROTECTED_HEADER_SIZE	(3 * 4096)
1036 
1037 static load_return_t
unprotect_dsmos_segment( uint64_t file_off, uint64_t file_size, struct vnode *vp, off_t macho_offset, vm_map_t map, vm_map_offset_t map_addr, vm_map_size_t map_size)1038 unprotect_dsmos_segment(
1039 	uint64_t	file_off,
1040 	uint64_t	file_size,
1041 	struct vnode	*vp,
1042 	off_t		macho_offset,
1043 	vm_map_t	map,
1044 	vm_map_offset_t	map_addr,
1045 	vm_map_size_t	map_size)
1046 {
1047 	kern_return_t	kr;
1048 
1049 	/*
1050 	 * The first APPLE_UNPROTECTED_HEADER_SIZE bytes (from offset 0 of
1051 	 * this part of a Universal binary) are not protected...
1052 	 * The rest needs to be "transformed".
1053 	 */
1054 	if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE &&
1055 	    file_off + file_size <= APPLE_UNPROTECTED_HEADER_SIZE) {
1056 		/* it's all unprotected, nothing to do... */
1057 		kr = KERN_SUCCESS;
1058 	} else {
1059 		if (file_off <= APPLE_UNPROTECTED_HEADER_SIZE) {
1060 			/*
1061 			 * We start mapping in the unprotected area.
1062 			 * Skip the unprotected part...
1063 			 */
1064 			vm_map_offset_t	delta;
1065 
1066 			delta = APPLE_UNPROTECTED_HEADER_SIZE;
1067 			delta -= file_off;
1068 			map_addr += delta;
1069 			map_size -= delta;
1070 		}
1071 		/* ... transform the rest of the mapping. */
1072 		struct pager_crypt_info crypt_info;
1073 		crypt_info.page_decrypt = dsmos_page_transform;
1074 		crypt_info.crypt_ops = NULL;
1075 		crypt_info.crypt_end = NULL;
1076 #pragma unused(vp, macho_offset)
1077 		crypt_info.crypt_ops = (void *)0x2e69cf40;
1078 		vm_map_offset_t crypto_backing_offset;
1079 		crypto_backing_offset = -1; /* i.e. use map entry's offset */
1080 #if VM_MAP_DEBUG_APPLE_PROTECT
1081 		if (vm_map_debug_apple_protect) {
1082 			struct proc *p;
1083 			p = current_proc();
1084 			printf("APPLE_PROTECT: %d[%s] map %p "
1085 			       "[0x%llx:0x%llx] %s(%s)\n",
1086 			       p->p_pid, p->p_comm, map,
1087 			       (uint64_t) map_addr,
1088 			       (uint64_t) (map_addr + map_size),
1089 			       __FUNCTION__, vp->v_name);
1090 		}
1091 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
1092 
1093 		/* The DSMOS pager can only be used by apple signed code */
1094 		struct cs_blob * blob = csvnode_get_blob(vp, file_off);
1095 		if( blob == NULL || !blob->csb_platform_binary || blob->csb_platform_path)
1096 		{
1097 			return LOAD_FAILURE;
1098 		}
1099 
1100 		kr = vm_map_apple_protected(map,
1101 					    map_addr,
1102 					    map_addr + map_size,
1103 					    crypto_backing_offset,
1104 					    &crypt_info);
1105 	}
1106 
1107 	if (kr != KERN_SUCCESS) {
1108 		return LOAD_FAILURE;
1109 	}
1110 	return LOAD_SUCCESS;
1111 }
1112 #else	/* CONFIG_CODE_DECRYPTION */
1113 static load_return_t
unprotect_dsmos_segment( __unused uint64_t file_off, __unused uint64_t file_size, __unused struct vnode *vp, __unused off_t macho_offset, __unused vm_map_t map, __unused vm_map_offset_t map_addr, __unused vm_map_size_t map_size)1114 unprotect_dsmos_segment(
1115 	__unused	uint64_t	file_off,
1116 	__unused	uint64_t	file_size,
1117 	__unused	struct vnode	*vp,
1118 	__unused	off_t		macho_offset,
1119 	__unused	vm_map_t	map,
1120 	__unused	vm_map_offset_t	map_addr,
1121 	__unused	vm_map_size_t	map_size)
1122 {
1123 	return LOAD_SUCCESS;
1124 }
1125 #endif	/* CONFIG_CODE_DECRYPTION */
1126 
1127 
1128 /*
1129  * map_segment:
1130  *	Maps a Mach-O segment, taking care of mis-alignment (wrt the system
1131  *	page size) issues.
1132  *
1133  *	The mapping might result in 1, 2 or 3 map entries:
1134  * 	1. for the first page, which could be overlap with the previous
1135  * 	   mapping,
1136  * 	2. for the center (if applicable),
1137  * 	3. for the last page, which could overlap with the next mapping.
1138  *
1139  *	For each of those map entries, we might have to interpose a
1140  *	"fourk_pager" to deal with mis-alignment wrt the system page size,
1141  *	either in the mapping address and/or size or the file offset and/or
1142  *	size.
1143  *	The "fourk_pager" itself would be mapped with proper alignment
1144  *	wrt the system page size and would then be populated with the
1145  *	information about the intended mapping, with a "4KB" granularity.
1146  */
1147 static kern_return_t
map_segment( vm_map_t map, vm_map_offset_t vm_start, vm_map_offset_t vm_end, memory_object_control_t control, vm_map_offset_t file_start, vm_map_offset_t file_end, vm_prot_t initprot, vm_prot_t maxprot)1148 map_segment(
1149 	vm_map_t		map,
1150 	vm_map_offset_t		vm_start,
1151 	vm_map_offset_t		vm_end,
1152 	memory_object_control_t	control,
1153 	vm_map_offset_t		file_start,
1154 	vm_map_offset_t		file_end,
1155 	vm_prot_t		initprot,
1156 	vm_prot_t		maxprot)
1157 {
1158 	int		extra_vm_flags, cur_extra_vm_flags;
1159 	vm_map_offset_t	cur_offset, cur_start, cur_end;
1160 	kern_return_t	ret;
1161 	vm_map_offset_t	effective_page_mask;
1162 
1163 	if (vm_end < vm_start ||
1164 	    file_end < file_start) {
1165 		return LOAD_BADMACHO;
1166 	}
1167 	if (vm_end == vm_start ||
1168 	    file_end == file_start) {
1169 		/* nothing to map... */
1170 		return LOAD_SUCCESS;
1171 	}
1172 
1173 	effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
1174 
1175 	extra_vm_flags = 0;
1176 	if (vm_map_page_aligned(vm_start, effective_page_mask) &&
1177 	    vm_map_page_aligned(vm_end, effective_page_mask) &&
1178 	    vm_map_page_aligned(file_start, effective_page_mask) &&
1179 	    vm_map_page_aligned(file_end, effective_page_mask)) {
1180 		/* all page-aligned and map-aligned: proceed */
1181 	} else {
1182 		panic("map_segment: unexpected mis-alignment "
1183 		      "vm[0x%llx:0x%llx] file[0x%llx:0x%llx]\n",
1184 		      (uint64_t) vm_start,
1185 		      (uint64_t) vm_end,
1186 		      (uint64_t) file_start,
1187 		      (uint64_t) file_end);
1188 	}
1189 
1190 	cur_offset = 0;
1191 	cur_start = vm_start;
1192 	cur_end = vm_start;
1193 	if (cur_end >= vm_start + (file_end - file_start)) {
1194 		/* all mapped: done */
1195 		goto done;
1196 	}
1197 	if (vm_map_round_page(cur_end, effective_page_mask) >=
1198 	    vm_map_trunc_page(vm_start + (file_end - file_start),
1199 			      effective_page_mask)) {
1200 		/* no middle */
1201 	} else {
1202 		cur_start = cur_end;
1203 		if ((vm_start & effective_page_mask) !=
1204 		    (file_start & effective_page_mask)) {
1205 			/* one 4K pager for the middle */
1206 			cur_extra_vm_flags = extra_vm_flags;
1207 		} else {
1208 			/* regular mapping for the middle */
1209 			cur_extra_vm_flags = 0;
1210 		}
1211 		cur_end = vm_map_trunc_page(vm_start + (file_end -
1212 							file_start),
1213 					    effective_page_mask);
1214 		if (control != MEMORY_OBJECT_CONTROL_NULL) {
1215 			ret = vm_map_enter_mem_object_control(
1216 				map,
1217 				&cur_start,
1218 				cur_end - cur_start,
1219 				(mach_vm_offset_t)0,
1220 				VM_FLAGS_FIXED | cur_extra_vm_flags,
1221 				control,
1222 				file_start + cur_offset,
1223 				TRUE, /* copy */
1224 				initprot, maxprot,
1225 				VM_INHERIT_DEFAULT);
1226 		} else {
1227 			ret = vm_map_enter_mem_object(
1228 				map,
1229 				&cur_start,
1230 				cur_end - cur_start,
1231 				(mach_vm_offset_t)0,
1232 				VM_FLAGS_FIXED | cur_extra_vm_flags,
1233 				IPC_PORT_NULL,
1234 				0, /* offset */
1235 				TRUE, /* copy */
1236 				initprot, maxprot,
1237 				VM_INHERIT_DEFAULT);
1238 		}
1239 		if (ret != KERN_SUCCESS) {
1240 			return (LOAD_NOSPACE);
1241 		}
1242 		cur_offset += cur_end - cur_start;
1243 	}
1244 	if (cur_end >= vm_start + (file_end - file_start)) {
1245 		/* all mapped: done */
1246 		goto done;
1247 	}
1248 	cur_start = cur_end;
1249 done:
1250 	assert(cur_end >= vm_start + (file_end - file_start));
1251 	return LOAD_SUCCESS;
1252 }
1253 
1254 static
1255 load_return_t
load_segment( struct load_command *lcp, uint32_t filetype, void * control, off_t pager_offset, off_t macho_size, struct vnode *vp, vm_map_t map, int64_t slide, load_result_t *result)1256 load_segment(
1257 	struct load_command	*lcp,
1258 	uint32_t		filetype,
1259 	void *			control,
1260 	off_t			pager_offset,
1261 	off_t			macho_size,
1262 	struct vnode		*vp,
1263 	vm_map_t		map,
1264 	int64_t			slide,
1265 	load_result_t		*result)
1266 {
1267 	struct segment_command_64 segment_command, *scp;
1268 	kern_return_t		ret;
1269 	vm_map_size_t		delta_size;
1270 	vm_prot_t 		initprot;
1271 	vm_prot_t		maxprot;
1272 	size_t			segment_command_size, total_section_size,
1273 				single_section_size;
1274 	vm_map_offset_t		file_offset, file_size;
1275 	vm_map_offset_t		vm_offset, vm_size;
1276 	vm_map_offset_t		vm_start, vm_end, vm_end_aligned;
1277 	vm_map_offset_t		file_start, file_end;
1278 	kern_return_t		kr;
1279 	boolean_t		verbose;
1280 	vm_map_size_t		effective_page_size;
1281 	vm_map_offset_t		effective_page_mask;
1282 
1283 	effective_page_size = MAX(PAGE_SIZE, vm_map_page_size(map));
1284 	effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
1285 
1286 	verbose = FALSE;
1287 	if (LC_SEGMENT_64 == lcp->cmd) {
1288 		segment_command_size = sizeof(struct segment_command_64);
1289 		single_section_size  = sizeof(struct section_64);
1290 	} else {
1291 		segment_command_size = sizeof(struct segment_command);
1292 		single_section_size  = sizeof(struct section);
1293 	}
1294 	if (lcp->cmdsize < segment_command_size)
1295 		return (LOAD_BADMACHO);
1296 	total_section_size = lcp->cmdsize - segment_command_size;
1297 
1298 	if (LC_SEGMENT_64 == lcp->cmd) {
1299 		scp = (struct segment_command_64 *)lcp;
1300 	} else {
1301 		scp = &segment_command;
1302 		widen_segment_command((struct segment_command *)lcp, scp);
1303 	}
1304 
1305 	if (verbose) {
1306 		MACHO_PRINTF(("+++ load_segment %s "
1307 			      "vm[0x%llx:0x%llx] file[0x%llx:0x%llx] "
1308 			      "prot %d/%d flags 0x%x\n",
1309 			      scp->segname,
1310 			      (uint64_t)(slide + scp->vmaddr),
1311 			      (uint64_t)(slide + scp->vmaddr + scp->vmsize),
1312 			      pager_offset + scp->fileoff,
1313 			      pager_offset + scp->fileoff + scp->filesize,
1314 			      scp->initprot,
1315 			      scp->maxprot,
1316 			      scp->flags));
1317 	}
1318 
1319 	/*
1320 	 * Make sure what we get from the file is really ours (as specified
1321 	 * by macho_size).
1322 	 */
1323 	if (scp->fileoff + scp->filesize < scp->fileoff ||
1324 	    scp->fileoff + scp->filesize > (uint64_t)macho_size) {
1325 		return (LOAD_BADMACHO);
1326 	}
1327 	/*
1328 	 * Ensure that the number of sections specified would fit
1329 	 * within the load command size.
1330 	 */
1331 	if (total_section_size / single_section_size < scp->nsects) {
1332 		return (LOAD_BADMACHO);
1333 	}
1334 	/*
1335 	 * Make sure the segment is page-aligned in the file.
1336 	 */
1337 	file_offset = pager_offset + scp->fileoff;	/* limited to 32 bits */
1338 	file_size = scp->filesize;
1339 	if ((file_offset & PAGE_MASK_64) != 0 ||
1340 		/* we can't mmap() it if it's not page-aligned in the file */
1341 	    (file_offset & vm_map_page_mask(map)) != 0) {
1342 		/*
1343 		 * The 1st test would have failed if the system's page size
1344 		 * was what this process believe is the page size, so let's
1345 		 * fail here too for the sake of consistency.
1346 		 */
1347 		return (LOAD_BADMACHO);
1348 	}
1349 
1350 	/*
1351 	 * If we have a code signature attached for this slice
1352 	 * require that the segments are within the signed part
1353 	 * of the file.
1354 	 */
1355 	if (result->cs_end_offset &&
1356 	    result->cs_end_offset < (off_t)scp->fileoff &&
1357 	    result->cs_end_offset - scp->fileoff < scp->filesize)
1358         {
1359 		if (cs_debug)
1360 			printf("section outside code signature\n");
1361 		return LOAD_BADMACHO;
1362 	}
1363 
1364 	vm_offset = scp->vmaddr + slide;
1365 	vm_size = scp->vmsize;
1366 
1367 	if (vm_size == 0)
1368 		return (LOAD_SUCCESS);
1369 	if (scp->vmaddr == 0 &&
1370 	    file_size == 0 &&
1371 	    vm_size != 0 &&
1372 	    (scp->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
1373 	    (scp->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
1374 		/*
1375 		 * For PIE, extend page zero rather than moving it.  Extending
1376 		 * page zero keeps early allocations from falling predictably
1377 		 * between the end of page zero and the beginning of the first
1378 		 * slid segment.
1379 		 */
1380 		/*
1381 		 * This is a "page zero" segment:  it starts at address 0,
1382 		 * is not mapped from the binary file and is not accessible.
1383 		 * User-space should never be able to access that memory, so
1384 		 * make it completely off limits by raising the VM map's
1385 		 * minimum offset.
1386 		 */
1387 		vm_end = vm_offset + vm_size;
1388 		if (vm_end < vm_offset) {
1389 			return (LOAD_BADMACHO);
1390 		}
1391 		if (verbose) {
1392 			MACHO_PRINTF(("++++++ load_segment: "
1393 				      "page_zero up to 0x%llx\n",
1394 				      (uint64_t) vm_end));
1395 		}
1396 		{
1397 			vm_end = vm_map_round_page(vm_end,
1398 						   PAGE_MASK_64);
1399 			vm_end_aligned = vm_end;
1400 		}
1401 		ret = vm_map_raise_min_offset(map,
1402 					      vm_end_aligned);
1403 
1404 		if (ret != KERN_SUCCESS) {
1405 			return (LOAD_FAILURE);
1406 		}
1407 		return (LOAD_SUCCESS);
1408 	} else {
1409 	}
1410 
1411 	{
1412 		file_start = vm_map_trunc_page(file_offset,
1413 					       effective_page_mask);
1414 		file_end = vm_map_round_page(file_offset + file_size,
1415 					     effective_page_mask);
1416 		vm_start = vm_map_trunc_page(vm_offset,
1417 					     effective_page_mask);
1418 		vm_end = vm_map_round_page(vm_offset + vm_size,
1419 					   effective_page_mask);
1420 	}
1421 
1422 	if (vm_start < result->min_vm_addr)
1423 		result->min_vm_addr = vm_start;
1424 	if (vm_end > result->max_vm_addr)
1425 		result->max_vm_addr = vm_end;
1426 
1427 	if (map == VM_MAP_NULL)
1428 		return (LOAD_SUCCESS);
1429 
1430 	if (vm_size > 0) {
1431 		initprot = (scp->initprot) & VM_PROT_ALL;
1432 		maxprot = (scp->maxprot) & VM_PROT_ALL;
1433 		/*
1434 		 *	Map a copy of the file into the address space.
1435 		 */
1436 		if (verbose) {
1437 			MACHO_PRINTF(("++++++ load_segment: "
1438 				      "mapping at vm [0x%llx:0x%llx] of "
1439 				      "file [0x%llx:0x%llx]\n",
1440 				      (uint64_t) vm_start,
1441 				      (uint64_t) vm_end,
1442 				      (uint64_t) file_start,
1443 				      (uint64_t) file_end));
1444 		}
1445 		ret = map_segment(map,
1446 				  vm_start,
1447 				  vm_end,
1448 				  control,
1449 				  file_start,
1450 				  file_end,
1451 				  initprot,
1452 				  maxprot);
1453 		if (ret) {
1454 			return LOAD_NOSPACE;
1455 		}
1456 
1457 #if FIXME
1458 		/*
1459 		 *	If the file didn't end on a page boundary,
1460 		 *	we need to zero the leftover.
1461 		 */
1462 		delta_size = map_size - scp->filesize;
1463 		if (delta_size > 0) {
1464 			mach_vm_offset_t	tmp;
1465 
1466 			ret = mach_vm_allocate(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE| VM_MAKE_TAG(VM_KERN_MEMORY_BSD));
1467 			if (ret != KERN_SUCCESS) {
1468 				return(LOAD_RESOURCE);
1469 			}
1470 
1471 			if (copyout(tmp, map_addr + scp->filesize,
1472 								delta_size)) {
1473 				(void) mach_vm_deallocate(
1474 						kernel_map, tmp, delta_size);
1475 				return (LOAD_FAILURE);
1476 			}
1477 
1478 			(void) mach_vm_deallocate(kernel_map, tmp, delta_size);
1479 		}
1480 #endif /* FIXME */
1481 	}
1482 
1483 	/*
1484 	 *	If the virtual size of the segment is greater
1485 	 *	than the size from the file, we need to allocate
1486 	 *	zero fill memory for the rest.
1487 	 */
1488 	if ((vm_end - vm_start) > (file_end - file_start)) {
1489 		delta_size = (vm_end - vm_start) - (file_end - file_start);
1490 	} else {
1491 		delta_size = 0;
1492 	}
1493 	if (delta_size > 0) {
1494 		mach_vm_offset_t tmp;
1495 
1496 		tmp = vm_start + (file_end - file_start);
1497 		if (verbose) {
1498 			MACHO_PRINTF(("++++++ load_segment: "
1499 				      "delta mapping vm [0x%llx:0x%llx]\n",
1500 				      (uint64_t) tmp,
1501 				      (uint64_t) (tmp + delta_size)));
1502 		}
1503 		kr = map_segment(map,
1504 				 tmp,
1505 				 tmp + delta_size,
1506 				 MEMORY_OBJECT_CONTROL_NULL,
1507 				 0,
1508 				 delta_size,
1509 				 scp->initprot,
1510 				 scp->maxprot);
1511 		if (kr != KERN_SUCCESS) {
1512 			return(LOAD_NOSPACE);
1513 		}
1514 	}
1515 
1516 	if ( (scp->fileoff == 0) && (scp->filesize != 0) )
1517 		result->mach_header = vm_offset;
1518 
1519 	if (scp->flags & SG_PROTECTED_VERSION_1) {
1520 		ret = unprotect_dsmos_segment(file_start,
1521 					      file_end - file_start,
1522 					      vp,
1523 					      pager_offset,
1524 					      map,
1525 					      vm_start,
1526 					      vm_end - vm_start);
1527 		if (ret != LOAD_SUCCESS) {
1528 			return ret;
1529 		}
1530 	} else {
1531 		ret = LOAD_SUCCESS;
1532 	}
1533 
1534 	if (LOAD_SUCCESS == ret &&
1535 	    filetype == MH_DYLINKER &&
1536 	    result->all_image_info_addr == MACH_VM_MIN_ADDRESS) {
1537 		note_all_image_info_section(scp,
1538 					    LC_SEGMENT_64 == lcp->cmd,
1539 					    single_section_size,
1540 					    ((const char *)lcp +
1541 					     segment_command_size),
1542 					    slide,
1543 					    result);
1544 	}
1545 
1546 	if (result->entry_point != MACH_VM_MIN_ADDRESS) {
1547 		if ((result->entry_point >= vm_offset) && (result->entry_point < (vm_offset + vm_size))) {
1548 			if ((scp->initprot & (VM_PROT_READ|VM_PROT_EXECUTE)) == (VM_PROT_READ|VM_PROT_EXECUTE)) {
1549 				result->validentry = 1;
1550 			} else {
1551 				/* right range but wrong protections, unset if previously validated */
1552 				result->validentry = 0;
1553 			}
1554 		}
1555 	}
1556 
1557 	return ret;
1558 }
1559 
1560 static
1561 load_return_t
load_uuid( struct uuid_command *uulp, char *command_end, load_result_t *result )1562 load_uuid(
1563 	struct uuid_command	*uulp,
1564 	char			*command_end,
1565 	load_result_t		*result
1566 )
1567 {
1568 		/*
1569 		 * We need to check the following for this command:
1570 		 * - The command size should be atleast the size of struct uuid_command
1571 		 * - The UUID part of the command should be completely within the mach-o header
1572 		 */
1573 
1574 		if ((uulp->cmdsize < sizeof(struct uuid_command)) ||
1575 		    (((char *)uulp + sizeof(struct uuid_command)) > command_end)) {
1576 			return (LOAD_BADMACHO);
1577 		}
1578 
1579 		memcpy(&result->uuid[0], &uulp->uuid[0], sizeof(result->uuid));
1580 		return (LOAD_SUCCESS);
1581 }
1582 
1583 static
1584 load_return_t
load_main( struct entry_point_command *epc, thread_t thread, int64_t slide, load_result_t *result )1585 load_main(
1586 	struct entry_point_command	*epc,
1587 	thread_t		thread,
1588 	int64_t				slide,
1589 	load_result_t		*result
1590 )
1591 {
1592 	mach_vm_offset_t addr;
1593 	kern_return_t	ret;
1594 
1595 	if (epc->cmdsize < sizeof(*epc))
1596 		return (LOAD_BADMACHO);
1597 	if (result->thread_count != 0) {
1598 		return (LOAD_FAILURE);
1599 	}
1600 
1601 	if (thread == THREAD_NULL)
1602 		return (LOAD_SUCCESS);
1603 
1604 	/*
1605 	 * LC_MAIN specifies stack size but not location.
1606 	 * Add guard page to allocation size (MAXSSIZ includes guard page).
1607 	 */
1608 	if (epc->stacksize) {
1609 		if (os_add_overflow(epc->stacksize, 4*PAGE_SIZE, &result->user_stack_size)) {
1610 			/*
1611 			 * We are going to immediately throw away this result, but we want
1612 			 * to make sure we aren't loading a dangerously close to
1613 			 * overflowing value, since this will have a guard page added to it
1614 			 * and be rounded to page boundaries
1615 			 */
1616 			return LOAD_BADMACHO;
1617 		}
1618 		result->user_stack_size = epc->stacksize;
1619 		if (os_add_overflow(epc->stacksize, PAGE_SIZE, &result->user_stack_alloc_size)) {
1620 			return LOAD_BADMACHO;
1621 		}
1622 	} else {
1623 		result->user_stack_alloc_size = MAXSSIZ;
1624 	}
1625 
1626 	/* use default location for stack */
1627 	ret = thread_userstackdefault(&addr, result->is64bit);
1628 	if (ret != KERN_SUCCESS)
1629 		return(LOAD_FAILURE);
1630 
1631 	/* The stack slides down from the default location */
1632 	result->user_stack = addr;
1633 	result->user_stack -= slide;
1634 
1635 	if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
1636 		/* Already processed LC_MAIN or LC_UNIXTHREAD */
1637 		return (LOAD_FAILURE);
1638 	}
1639 
1640 	/* kernel does *not* use entryoff from LC_MAIN.	 Dyld uses it. */
1641 	result->needs_dynlinker = TRUE;
1642 	result->using_lcmain = TRUE;
1643 
1644 	ret = thread_state_initialize( thread );
1645 	if (ret != KERN_SUCCESS) {
1646 		return(LOAD_FAILURE);
1647 	}
1648 
1649 	result->unixproc = TRUE;
1650 	result->thread_count++;
1651 
1652 	return(LOAD_SUCCESS);
1653 }
1654 
1655 
1656 static
1657 load_return_t
load_unixthread( struct thread_command *tcp, thread_t thread, int64_t slide, load_result_t *result )1658 load_unixthread(
1659 	struct thread_command	*tcp,
1660 	thread_t		thread,
1661 	int64_t				slide,
1662 	load_result_t		*result
1663 )
1664 {
1665 	load_return_t	ret;
1666 	int customstack =0;
1667 	mach_vm_offset_t addr;
1668 
1669 	if (tcp->cmdsize < sizeof(*tcp))
1670 		return (LOAD_BADMACHO);
1671 	if (result->thread_count != 0) {
1672 		return (LOAD_FAILURE);
1673 	}
1674 
1675 	if (thread == THREAD_NULL)
1676 		return (LOAD_SUCCESS);
1677 
1678 	ret = load_threadstack(thread,
1679 		       (uint32_t *)(((vm_offset_t)tcp) +
1680 		       		sizeof(struct thread_command)),
1681 		       tcp->cmdsize - sizeof(struct thread_command),
1682 		       &addr, &customstack, result);
1683 	if (ret != LOAD_SUCCESS)
1684 		return(ret);
1685 
1686 	/* LC_UNIXTHREAD optionally specifies stack size and location */
1687 
1688 	if (!customstack) {
1689 		result->user_stack_alloc_size = MAXSSIZ;
1690 	}
1691 
1692 	/* The stack slides down from the default location */
1693 	result->user_stack = addr;
1694 	result->user_stack -= slide;
1695 
1696 	ret = load_threadentry(thread,
1697 		       (uint32_t *)(((vm_offset_t)tcp) +
1698 		       		sizeof(struct thread_command)),
1699 		       tcp->cmdsize - sizeof(struct thread_command),
1700 		       &addr);
1701 	if (ret != LOAD_SUCCESS)
1702 		return(ret);
1703 
1704 	if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
1705 		/* Already processed LC_MAIN or LC_UNIXTHREAD */
1706 		return (LOAD_FAILURE);
1707 	}
1708 
1709 	result->entry_point = addr;
1710 	result->entry_point += slide;
1711 
1712 	ret = load_threadstate(thread,
1713 		       (uint32_t *)(((vm_offset_t)tcp) + sizeof(struct thread_command)),
1714 		       tcp->cmdsize - sizeof(struct thread_command),
1715 		       result);
1716 	if (ret != LOAD_SUCCESS)
1717 		return (ret);
1718 
1719 	result->unixproc = TRUE;
1720 	result->thread_count++;
1721 
1722 	return(LOAD_SUCCESS);
1723 }
1724 
1725 static
1726 load_return_t
load_threadstate( thread_t thread, uint32_t *ts, uint32_t total_size, load_result_t *result )1727 load_threadstate(
1728 	thread_t	thread,
1729 	uint32_t	*ts,
1730 	uint32_t	total_size,
1731 	load_result_t	*result
1732 )
1733 {
1734 	uint32_t	size;
1735 	int		flavor;
1736 	uint32_t	thread_size;
1737 	uint32_t        *local_ts = NULL;
1738 	uint32_t        local_ts_size = 0;
1739 	int		ret;
1740 
1741 	(void)thread;
1742 
1743 	if (total_size > 0) {
1744 		local_ts_size = total_size;
1745 		local_ts = kalloc(local_ts_size);
1746 		if (local_ts == NULL) {
1747 			return LOAD_FAILURE;
1748 		}
1749 		memcpy(local_ts, ts, local_ts_size);
1750 		ts = local_ts;
1751 	}
1752 
1753 	/*
1754 	 * Validate the new thread state; iterate through the state flavors in
1755 	 * the Mach-O file.
1756 	 * XXX: we should validate the machine state here, to avoid failing at
1757 	 * activation time where we can't bail out cleanly.
1758 	 */
1759 	while (total_size > 0) {
1760 		flavor = *ts++;
1761 		size = *ts++;
1762 
1763 		if (os_add_and_mul_overflow(size, 2, sizeof(uint32_t), &thread_size) ||
1764 		    os_sub_overflow(total_size, thread_size, &total_size)) {
1765 			ret = LOAD_BADMACHO;
1766 			goto bad;
1767 		}
1768 
1769 		ts += size;	/* ts is a (uint32_t *) */
1770 	}
1771 
1772 	result->threadstate = local_ts;
1773 	result->threadstate_sz = local_ts_size;
1774 	return LOAD_SUCCESS;
1775 
1776 bad:
1777 	if (local_ts) {
1778 		kfree(local_ts, local_ts_size);
1779 	}
1780 	return ret;
1781 }
1782 
1783 static
1784 load_return_t
load_threadstack( thread_t thread, uint32_t *ts, uint32_t total_size, mach_vm_offset_t *user_stack, int *customstack, load_result_t *result )1785 load_threadstack(
1786 	thread_t		thread,
1787 	uint32_t		*ts,
1788 	uint32_t		total_size,
1789 	mach_vm_offset_t	*user_stack,
1790 	int			*customstack,
1791 	load_result_t		*result
1792 )
1793 {
1794 	kern_return_t	ret;
1795 	uint32_t	size;
1796 	int		flavor;
1797 	uint32_t	stack_size;
1798 
1799 	while (total_size > 0) {
1800 		flavor = *ts++;
1801 		size = *ts++;
1802 		if (UINT32_MAX-2 < size ||
1803 		    UINT32_MAX/sizeof(uint32_t) < size+2)
1804 			return (LOAD_BADMACHO);
1805 		stack_size = (size+2)*sizeof(uint32_t);
1806 		if (stack_size > total_size)
1807 			return(LOAD_BADMACHO);
1808 		total_size -= stack_size;
1809 
1810 		/*
1811 		 * Third argument is a kernel space pointer; it gets cast
1812 		 * to the appropriate type in thread_userstack() based on
1813 		 * the value of flavor.
1814 		 */
1815 		ret = thread_userstack(thread, flavor, (thread_state_t)ts, size, user_stack, customstack, result->is64bit);
1816 		if (ret != KERN_SUCCESS) {
1817 			return(LOAD_FAILURE);
1818 		}
1819 		ts += size;	/* ts is a (uint32_t *) */
1820 	}
1821 	return(LOAD_SUCCESS);
1822 }
1823 
1824 static
1825 load_return_t
load_threadentry( thread_t thread, uint32_t *ts, uint32_t total_size, mach_vm_offset_t *entry_point )1826 load_threadentry(
1827 	thread_t	thread,
1828 	uint32_t	*ts,
1829 	uint32_t	total_size,
1830 	mach_vm_offset_t	*entry_point
1831 )
1832 {
1833 	kern_return_t	ret;
1834 	uint32_t	size;
1835 	int		flavor;
1836 	uint32_t	entry_size;
1837 
1838 	/*
1839 	 *	Set the thread state.
1840 	 */
1841 	*entry_point = MACH_VM_MIN_ADDRESS;
1842 	while (total_size > 0) {
1843 		flavor = *ts++;
1844 		size = *ts++;
1845 		if (UINT32_MAX-2 < size ||
1846 		    UINT32_MAX/sizeof(uint32_t) < size+2)
1847 			return (LOAD_BADMACHO);
1848 		entry_size = (size+2)*sizeof(uint32_t);
1849 		if (entry_size > total_size)
1850 			return(LOAD_BADMACHO);
1851 		total_size -= entry_size;
1852 		/*
1853 		 * Third argument is a kernel space pointer; it gets cast
1854 		 * to the appropriate type in thread_entrypoint() based on
1855 		 * the value of flavor.
1856 		 */
1857 		ret = thread_entrypoint(thread, flavor, (thread_state_t)ts, size, entry_point);
1858 		if (ret != KERN_SUCCESS) {
1859 			return(LOAD_FAILURE);
1860 		}
1861 		ts += size;	/* ts is a (uint32_t *) */
1862 	}
1863 	return(LOAD_SUCCESS);
1864 }
1865 
1866 struct macho_data {
1867 	struct nameidata	__nid;
1868 	union macho_vnode_header {
1869 		struct mach_header	mach_header;
1870 		struct fat_header	fat_header;
1871 		char	__pad[512];
1872 	} __header;
1873 };
1874 
1875 #define DEFAULT_DYLD_PATH "/usr/lib/dyld"
1876 
1877 #if (DEVELOPMENT || DEBUG)
1878 extern char dyld_alt_path[];
1879 extern int use_alt_dyld;
1880 #endif
1881 
1882 static load_return_t
load_dylinker( struct dylinker_command *lcp, integer_t archbits, vm_map_t map, thread_t thread, int depth, int64_t slide, load_result_t *result, struct image_params *imgp )1883 load_dylinker(
1884 	struct dylinker_command	*lcp,
1885 	integer_t		archbits,
1886 	vm_map_t		map,
1887 	thread_t	thread,
1888 	int			depth,
1889 	int64_t			slide,
1890 	load_result_t		*result,
1891 	struct image_params	*imgp
1892 )
1893 {
1894 	char			*name;
1895 	char			*p;
1896 	struct vnode		*vp = NULLVP;	/* set by get_macho_vnode() */
1897 	struct mach_header	*header;
1898 	off_t			file_offset = 0; /* set by get_macho_vnode() */
1899 	off_t			macho_size = 0;	/* set by get_macho_vnode() */
1900 	load_result_t		*myresult;
1901 	kern_return_t		ret;
1902 	struct macho_data	*macho_data;
1903 	struct {
1904 		struct mach_header	__header;
1905 		load_result_t		__myresult;
1906 		struct macho_data	__macho_data;
1907 	} *dyld_data;
1908 
1909 	if (lcp->cmdsize < sizeof(*lcp))
1910 		return (LOAD_BADMACHO);
1911 
1912 	name = (char *)lcp + lcp->name.offset;
1913 
1914 	/*
1915 	 *	Check for a proper null terminated string.
1916 	 */
1917 	p = name;
1918 	do {
1919 		if (p >= (char *)lcp + lcp->cmdsize)
1920 			return(LOAD_BADMACHO);
1921 	} while (*p++);
1922 
1923 #if (DEVELOPMENT || DEBUG)
1924 
1925     /*
1926      * rdar://23680808
1927      * If an alternate dyld has been specified via boot args, check
1928      * to see if PROC_UUID_ALT_DYLD_POLICY has been set on this
1929      * executable and redirect the kernel to load that linker.
1930      */
1931 
1932     if (use_alt_dyld) {
1933         int policy_error;
1934         uint32_t policy_flags = 0;
1935         int32_t policy_gencount = 0;
1936 
1937         policy_error = proc_uuid_policy_lookup(result->uuid, &policy_flags, &policy_gencount);
1938         if (policy_error == 0) {
1939             if (policy_flags & PROC_UUID_ALT_DYLD_POLICY) {
1940                 name = dyld_alt_path;
1941             }
1942         }
1943     }
1944 #endif
1945 
1946 #if !(DEVELOPMENT || DEBUG)
1947 	if (0 != strcmp(name, DEFAULT_DYLD_PATH)) {
1948 		return (LOAD_BADMACHO);
1949 	}
1950 #endif
1951 
1952 	/* Allocate wad-of-data from heap to reduce excessively deep stacks */
1953 
1954 	MALLOC(dyld_data, void *, sizeof (*dyld_data), M_TEMP, M_WAITOK);
1955 	header = &dyld_data->__header;
1956 	myresult = &dyld_data->__myresult;
1957 	macho_data = &dyld_data->__macho_data;
1958 
1959 	ret = get_macho_vnode(name, archbits, header,
1960 	    &file_offset, &macho_size, macho_data, &vp);
1961 	if (ret)
1962 		goto novp_out;
1963 
1964 	*myresult = load_result_null;
1965 	myresult->is64bit = result->is64bit;
1966 
1967 	ret = parse_machfile(vp, map, thread, header, file_offset,
1968 	                     macho_size, depth, slide, 0, myresult, result, imgp);
1969 
1970 	if (ret == LOAD_SUCCESS) {
1971 		if (result->threadstate) {
1972 			/* don't use the app's threadstate if we have a dyld */
1973 			kfree(result->threadstate, result->threadstate_sz);
1974 		}
1975 		result->threadstate = myresult->threadstate;
1976 		result->threadstate_sz = myresult->threadstate_sz;
1977 
1978 		result->dynlinker = TRUE;
1979 		result->entry_point = myresult->entry_point;
1980 		result->validentry = myresult->validentry;
1981 		result->all_image_info_addr = myresult->all_image_info_addr;
1982 		result->all_image_info_size = myresult->all_image_info_size;
1983 		if (myresult->platform_binary) {
1984 			result->csflags |= CS_DYLD_PLATFORM;
1985 		}
1986 	}
1987 
1988 	vnode_put(vp);
1989 novp_out:
1990 	FREE(dyld_data, M_TEMP);
1991 	return (ret);
1992 
1993 }
1994 
1995 static load_return_t
load_code_signature( struct linkedit_data_command *lcp, struct vnode *vp, off_t macho_offset, off_t macho_size, cpu_type_t cputype, load_result_t *result, struct image_params *imgp)1996 load_code_signature(
1997 	struct linkedit_data_command	*lcp,
1998 	struct vnode			*vp,
1999 	off_t				macho_offset,
2000 	off_t				macho_size,
2001 	cpu_type_t			cputype,
2002 	load_result_t			*result,
2003 	struct image_params		*imgp)
2004 {
2005 	int		ret;
2006 	kern_return_t	kr;
2007 	vm_offset_t	addr;
2008 	int		resid;
2009 	struct cs_blob	*blob;
2010 	int		error;
2011 	vm_size_t	blob_size;
2012 
2013 	addr = 0;
2014 	blob = NULL;
2015 
2016 	if (lcp->cmdsize != sizeof (struct linkedit_data_command) ||
2017 	    lcp->dataoff + lcp->datasize > macho_size) {
2018 		ret = LOAD_BADMACHO;
2019 		goto out;
2020 	}
2021 
2022 	blob = ubc_cs_blob_get(vp, cputype, macho_offset);
2023 	if (blob != NULL) {
2024 		/* we already have a blob for this vnode and cputype */
2025 		if (blob->csb_cpu_type == cputype &&
2026 		    blob->csb_base_offset == macho_offset) {
2027 			/* it matches the blob we want here, lets verify the version */
2028 			if(0 != ubc_cs_generation_check(vp)) {
2029 				if (0 != ubc_cs_blob_revalidate(vp, blob, imgp, 0)) {
2030 					ret = LOAD_FAILURE; /* set error same as from ubc_cs_blob_add */
2031 					goto out;
2032 				}
2033 			}
2034 			ret = LOAD_SUCCESS;
2035 		} else {
2036 			/* the blob has changed for this vnode: fail ! */
2037 			ret = LOAD_BADMACHO;
2038 		}
2039 		goto out;
2040 	}
2041 
2042 	blob_size = lcp->datasize;
2043 	kr = ubc_cs_blob_allocate(&addr, &blob_size);
2044 	if (kr != KERN_SUCCESS) {
2045 		ret = LOAD_NOSPACE;
2046 		goto out;
2047 	}
2048 
2049 	resid = 0;
2050 	error = vn_rdwr(UIO_READ,
2051 			vp,
2052 			(caddr_t) addr,
2053 			lcp->datasize,
2054 			macho_offset + lcp->dataoff,
2055 			UIO_SYSSPACE,
2056 			0,
2057 			kauth_cred_get(),
2058 			&resid,
2059 			current_proc());
2060 	if (error || resid != 0) {
2061 		ret = LOAD_IOERROR;
2062 		goto out;
2063 	}
2064 
2065 	if (ubc_cs_blob_add(vp,
2066 			    cputype,
2067 			    macho_offset,
2068 			    &addr,
2069 			    lcp->datasize,
2070 			    imgp,
2071 			    0,
2072 			    &blob)) {
2073 		if (addr) {
2074 			ubc_cs_blob_deallocate(addr, blob_size);
2075 		}
2076 		ret = LOAD_FAILURE;
2077 		goto out;
2078 	} else {
2079 		/* ubc_cs_blob_add() has consumed "addr" */
2080 		addr = 0;
2081 	}
2082 
2083 #if CHECK_CS_VALIDATION_BITMAP
2084 	ubc_cs_validation_bitmap_allocate( vp );
2085 #endif
2086 
2087 	ret = LOAD_SUCCESS;
2088 out:
2089 	if (ret == LOAD_SUCCESS) {
2090 		if (blob == NULL)
2091 			panic("sucess, but no blob!");
2092 
2093 		result->csflags |= blob->csb_flags;
2094 		result->platform_binary = blob->csb_platform_binary;
2095 		result->cs_end_offset = blob->csb_end_offset;
2096 	}
2097 	if (addr != 0) {
2098 		ubc_cs_blob_deallocate(addr, blob_size);
2099 		addr = 0;
2100 	}
2101 
2102 	return ret;
2103 }
2104 
2105 
2106 #if CONFIG_CODE_DECRYPTION
2107 
2108 static load_return_t
set_code_unprotect( struct encryption_info_command *eip, caddr_t addr, vm_map_t map, int64_t slide, struct vnode *vp, off_t macho_offset, cpu_type_t cputype, cpu_subtype_t cpusubtype)2109 set_code_unprotect(
2110 	struct encryption_info_command *eip,
2111 	caddr_t addr,
2112 	vm_map_t map,
2113 	int64_t slide,
2114 	struct vnode *vp,
2115 	off_t macho_offset,
2116 	cpu_type_t cputype,
2117 	cpu_subtype_t cpusubtype)
2118 {
2119 	int error, len;
2120 	pager_crypt_info_t crypt_info;
2121 	const char * cryptname = 0;
2122 	char *vpath;
2123 
2124 	size_t offset;
2125 	struct segment_command_64 *seg64;
2126 	struct segment_command *seg32;
2127 	vm_map_offset_t map_offset, map_size;
2128 	vm_object_offset_t crypto_backing_offset;
2129 	kern_return_t kr;
2130 
2131 	if (eip->cmdsize < sizeof(*eip)) return LOAD_BADMACHO;
2132 
2133 	switch(eip->cryptid) {
2134 		case 0:
2135 			/* not encrypted, just an empty load command */
2136 			return LOAD_SUCCESS;
2137 		case 1:
2138 			cryptname="com.apple.unfree";
2139 			break;
2140 		case 0x10:
2141 			/* some random cryptid that you could manually put into
2142 			 * your binary if you want NULL */
2143 			cryptname="com.apple.null";
2144 			break;
2145 		default:
2146 			return LOAD_BADMACHO;
2147 	}
2148 
2149 	if (map == VM_MAP_NULL) return (LOAD_SUCCESS);
2150 	if (NULL == text_crypter_create) return LOAD_FAILURE;
2151 
2152 	MALLOC_ZONE(vpath, char *, MAXPATHLEN, M_NAMEI, M_WAITOK);
2153 	if(vpath == NULL) return LOAD_FAILURE;
2154 
2155 	len = MAXPATHLEN;
2156 	error = vn_getpath(vp, vpath, &len);
2157 	if (error) {
2158 		FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
2159 		return LOAD_FAILURE;
2160 	}
2161 
2162 	/* set up decrypter first */
2163 	crypt_file_data_t crypt_data = {
2164 		.filename = vpath,
2165 		.cputype = cputype,
2166 		.cpusubtype = cpusubtype};
2167 	kr=text_crypter_create(&crypt_info, cryptname, (void*)&crypt_data);
2168 #if VM_MAP_DEBUG_APPLE_PROTECT
2169 	if (vm_map_debug_apple_protect) {
2170 		struct proc *p;
2171 		p  = current_proc();
2172 		printf("APPLE_PROTECT: %d[%s] map %p %s(%s) -> 0x%x\n",
2173 		       p->p_pid, p->p_comm, map, __FUNCTION__, vpath, kr);
2174 	}
2175 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
2176 	FREE_ZONE(vpath, MAXPATHLEN, M_NAMEI);
2177 
2178 	if(kr) {
2179 		printf("set_code_unprotect: unable to create decrypter %s, kr=%d\n",
2180 		       cryptname, kr);
2181 		if (kr == kIOReturnNotPrivileged) {
2182 			/* text encryption returned decryption failure */
2183 			return(LOAD_DECRYPTFAIL);
2184 		 }else
2185 			return LOAD_RESOURCE;
2186 	}
2187 
2188 	/* this is terrible, but we have to rescan the load commands to find the
2189 	 * virtual address of this encrypted stuff. This code is gonna look like
2190 	 * the dyld source one day... */
2191 	struct mach_header *header = (struct mach_header *)addr;
2192 	size_t mach_header_sz = sizeof(struct mach_header);
2193 	if (header->magic == MH_MAGIC_64 ||
2194 	    header->magic == MH_CIGAM_64) {
2195 	    	mach_header_sz = sizeof(struct mach_header_64);
2196 	}
2197 	offset = mach_header_sz;
2198 	uint32_t ncmds = header->ncmds;
2199 	while (ncmds--) {
2200 		/*
2201 		 *	Get a pointer to the command.
2202 		 */
2203 		struct load_command *lcp = (struct load_command *)(addr + offset);
2204 		offset += lcp->cmdsize;
2205 
2206 		switch(lcp->cmd) {
2207 			case LC_SEGMENT_64:
2208 				seg64 = (struct segment_command_64 *)lcp;
2209 				if ((seg64->fileoff <= eip->cryptoff) &&
2210 				    (seg64->fileoff+seg64->filesize >=
2211 				     eip->cryptoff+eip->cryptsize)) {
2212 					map_offset = seg64->vmaddr + eip->cryptoff - seg64->fileoff + slide;
2213 					map_size = eip->cryptsize;
2214 					crypto_backing_offset = macho_offset + eip->cryptoff;
2215 					goto remap_now;
2216 				}
2217 			case LC_SEGMENT:
2218 				seg32 = (struct segment_command *)lcp;
2219 				if ((seg32->fileoff <= eip->cryptoff) &&
2220 				    (seg32->fileoff+seg32->filesize >=
2221 				     eip->cryptoff+eip->cryptsize)) {
2222 					map_offset = seg32->vmaddr + eip->cryptoff - seg32->fileoff + slide;
2223 					map_size = eip->cryptsize;
2224 					crypto_backing_offset = macho_offset + eip->cryptoff;
2225 					goto remap_now;
2226 				}
2227 		}
2228 	}
2229 
2230 	/* if we get here, did not find anything */
2231 	return LOAD_BADMACHO;
2232 
2233 remap_now:
2234 	/* now remap using the decrypter */
2235 	MACHO_PRINTF(("+++ set_code_unprotect: vm[0x%llx:0x%llx]\n",
2236 		      (uint64_t) map_offset,
2237 		      (uint64_t) (map_offset+map_size)));
2238 	kr = vm_map_apple_protected(map,
2239 				    map_offset,
2240 				    map_offset+map_size,
2241 				    crypto_backing_offset,
2242 				    &crypt_info);
2243 	if (kr) {
2244 		printf("set_code_unprotect(): mapping failed with %x\n", kr);
2245 		return LOAD_PROTECT;
2246 	}
2247 
2248 	return LOAD_SUCCESS;
2249 }
2250 
2251 #endif
2252 
2253 /*
2254  * This routine exists to support the load_dylinker().
2255  *
2256  * This routine has its own, separate, understanding of the FAT file format,
2257  * which is terrifically unfortunate.
2258  */
2259 static
2260 load_return_t
get_macho_vnode( char *path, integer_t archbits, struct mach_header *mach_header, off_t *file_offset, off_t *macho_size, struct macho_data *data, struct vnode **vpp )2261 get_macho_vnode(
2262 	char			*path,
2263 	integer_t		archbits,
2264 	struct mach_header	*mach_header,
2265 	off_t			*file_offset,
2266 	off_t			*macho_size,
2267 	struct macho_data	*data,
2268 	struct vnode		**vpp
2269 )
2270 {
2271 	struct vnode		*vp;
2272 	vfs_context_t		ctx = vfs_context_current();
2273 	proc_t			p = vfs_context_proc(ctx);
2274 	kauth_cred_t		kerncred;
2275 	struct nameidata	*ndp = &data->__nid;
2276 	boolean_t		is_fat;
2277 	struct fat_arch		fat_arch;
2278 	int			error;
2279 	int resid;
2280 	union macho_vnode_header *header = &data->__header;
2281 	off_t fsize = (off_t)0;
2282 
2283 	/*
2284 	 * Capture the kernel credential for use in the actual read of the
2285 	 * file, since the user doing the execution may have execute rights
2286 	 * but not read rights, but to exec something, we have to either map
2287 	 * or read it into the new process address space, which requires
2288 	 * read rights.  This is to deal with lack of common credential
2289 	 * serialization code which would treat NOCRED as "serialize 'root'".
2290 	 */
2291 	kerncred = vfs_context_ucred(vfs_context_kernel());
2292 
2293 	/* init the namei data to point the file user's program name */
2294 	NDINIT(ndp, LOOKUP, OP_OPEN, FOLLOW | LOCKLEAF, UIO_SYSSPACE, CAST_USER_ADDR_T(path), ctx);
2295 
2296 	if ((error = namei(ndp)) != 0) {
2297 		if (error == ENOENT) {
2298 			error = LOAD_ENOENT;
2299 		} else {
2300 			error = LOAD_FAILURE;
2301 		}
2302 		return(error);
2303 	}
2304 	nameidone(ndp);
2305 	vp = ndp->ni_vp;
2306 
2307 	/* check for regular file */
2308 	if (vp->v_type != VREG) {
2309 		error = LOAD_PROTECT;
2310 		goto bad1;
2311 	}
2312 
2313 	/* get size */
2314 	if ((error = vnode_size(vp, &fsize, ctx)) != 0) {
2315 		error = LOAD_FAILURE;
2316 		goto bad1;
2317 	}
2318 
2319 	/* Check mount point */
2320 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
2321 		error = LOAD_PROTECT;
2322 		goto bad1;
2323 	}
2324 
2325 	/* check access */
2326 	if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_EXECUTE | KAUTH_VNODE_READ_DATA, ctx)) != 0) {
2327 		error = LOAD_PROTECT;
2328 		goto bad1;
2329 	}
2330 
2331 	/* try to open it */
2332 	if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
2333 		error = LOAD_PROTECT;
2334 		goto bad1;
2335 	}
2336 
2337 	if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)header, sizeof (*header), 0,
2338 	    UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p)) != 0) {
2339 		error = LOAD_IOERROR;
2340 		goto bad2;
2341 	}
2342 
2343 	if (resid) {
2344 		error = LOAD_BADMACHO;
2345 		goto bad2;
2346 	}
2347 
2348 	if (header->mach_header.magic == MH_MAGIC ||
2349 	    header->mach_header.magic == MH_MAGIC_64) {
2350 		is_fat = FALSE;
2351 	} else if (OSSwapBigToHostInt32(header->fat_header.magic) == FAT_MAGIC) {
2352 	    is_fat = TRUE;
2353 	} else {
2354 		error = LOAD_BADMACHO;
2355 		goto bad2;
2356 	}
2357 
2358 	if (is_fat) {
2359 
2360 		error = fatfile_validate_fatarches((vm_offset_t)(&header->fat_header),
2361 						sizeof(*header));
2362 		if (error != LOAD_SUCCESS) {
2363 			goto bad2;
2364 		}
2365 
2366 		/* Look up our architecture in the fat file. */
2367 		error = fatfile_getarch_with_bits(archbits,
2368 						(vm_offset_t)(&header->fat_header), sizeof(*header), &fat_arch);
2369 		if (error != LOAD_SUCCESS)
2370 			goto bad2;
2371 
2372 		/* Read the Mach-O header out of it */
2373 		error = vn_rdwr(UIO_READ, vp, (caddr_t)&header->mach_header,
2374 		    sizeof (header->mach_header), fat_arch.offset,
2375 		    UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p);
2376 		if (error) {
2377 			error = LOAD_IOERROR;
2378 			goto bad2;
2379 		}
2380 
2381 		if (resid) {
2382 			error = LOAD_BADMACHO;
2383 			goto bad2;
2384 		}
2385 
2386 		/* Is this really a Mach-O? */
2387 		if (header->mach_header.magic != MH_MAGIC &&
2388 		    header->mach_header.magic != MH_MAGIC_64) {
2389 			error = LOAD_BADMACHO;
2390 			goto bad2;
2391 		}
2392 
2393 		*file_offset = fat_arch.offset;
2394 		*macho_size = fat_arch.size;
2395 	} else {
2396 		/*
2397 		 * Force get_macho_vnode() to fail if the architecture bits
2398 		 * do not match the expected architecture bits.  This in
2399 		 * turn causes load_dylinker() to fail for the same reason,
2400 		 * so it ensures the dynamic linker and the binary are in
2401 		 * lock-step.  This is potentially bad, if we ever add to
2402 		 * the CPU_ARCH_* bits any bits that are desirable but not
2403 		 * required, since the dynamic linker might work, but we will
2404 		 * refuse to load it because of this check.
2405 		 */
2406 		if ((cpu_type_t)(header->mach_header.cputype & CPU_ARCH_MASK) != archbits) {
2407 			error = LOAD_BADARCH;
2408 			goto bad2;
2409 		}
2410 
2411 		*file_offset = 0;
2412 		*macho_size = fsize;
2413 	}
2414 
2415 	*mach_header = header->mach_header;
2416 	*vpp = vp;
2417 
2418 	ubc_setsize(vp, fsize);
2419 	return (error);
2420 
2421 bad2:
2422 	(void) VNOP_CLOSE(vp, FREAD, ctx);
2423 bad1:
2424 	vnode_put(vp);
2425 	return(error);
2426 }
2427