void
KLDBootstrap::readPrelinkedExtensions(
kernel_section_t * prelinkInfoSect)
{
OSArray * infoDictArray = NULL; // do not release
OSObject * parsedXML = NULL; // must release
OSDictionary * prelinkInfoDict = NULL; // do not release
OSString * errorString = NULL; // must release
OSKext * theKernel = NULL; // must release
kernel_segment_command_t * prelinkTextSegment = NULL; // see code
kernel_segment_command_t * prelinkInfoSegment = NULL; // see code
/* We make some copies of data, but if anything fails we're basically
* going to fail the boot, so these won't be cleaned up on error.
*/
void * prelinkData = NULL; // see code
vm_size_t prelinkLength = 0;
OSDictionary * infoDict = NULL; // do not release
IORegistryEntry * registryRoot = NULL; // do not release
OSNumber * prelinkCountObj = NULL; // must release
u_int i = 0;
#if NO_KEXTD
bool ramDiskBoot;
bool developerDevice;
bool dontLoad;
#endif
OSData * kaslrOffsets = NULL;
unsigned long plk_segSizes[PLK_SEGMENTS];
vm_offset_t plk_segAddrs[PLK_SEGMENTS];
OSKextLog(/* kext */ NULL,
kOSKextLogProgressLevel |
kOSKextLogDirectoryScanFlag | kOSKextLogArchiveFlag,
"Starting from prelinked kernel.");
prelinkTextSegment = getsegbyname(kPrelinkTextSegment);
if (!prelinkTextSegment) {
OSKextLog(/* kext */ NULL,
kOSKextLogErrorLevel |
kOSKextLogDirectoryScanFlag | kOSKextLogArchiveFlag,
"Can't find prelinked kexts' text segment.");
goto finish;
}
#if KASLR_KEXT_DEBUG
unsigned long scratchSize;
vm_offset_t scratchAddr;
IOLog("kaslr: prelinked kernel address info: \n");
scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__TEXT", &scratchSize);
IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __TEXT \n",
(unsigned long)scratchAddr,
(unsigned long)(scratchAddr + scratchSize),
scratchSize);
scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__DATA", &scratchSize);
IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __DATA \n",
(unsigned long)scratchAddr,
(unsigned long)(scratchAddr + scratchSize),
scratchSize);
scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__LINKEDIT", &scratchSize);
IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __LINKEDIT \n",
(unsigned long)scratchAddr,
(unsigned long)(scratchAddr + scratchSize),
scratchSize);
scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__KLD", &scratchSize);
IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __KLD \n",
(unsigned long)scratchAddr,
(unsigned long)(scratchAddr + scratchSize),
scratchSize);
scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__PRELINK_TEXT", &scratchSize);
IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __PRELINK_TEXT \n",
(unsigned long)scratchAddr,
(unsigned long)(scratchAddr + scratchSize),
scratchSize);
scratchAddr = (vm_offset_t) getsegdatafromheader(&_mh_execute_header, "__PRELINK_INFO", &scratchSize);
IOLog("kaslr: start 0x%lx end 0x%lx length %lu for __PRELINK_INFO \n",
(unsigned long)scratchAddr,
(unsigned long)(scratchAddr + scratchSize),
scratchSize);
#endif
prelinkData = (void *) prelinkTextSegment->vmaddr;
prelinkLength = prelinkTextSegment->vmsize;
/* build arrays of plk info for later use */
const char ** segNamePtr;
for (segNamePtr = &plk_segNames[0], i = 0; *segNamePtr && i < PLK_SEGMENTS; segNamePtr++, i++) {
plk_segSizes[i] = 0;
plk_segAddrs[i] = (vm_offset_t)getsegdatafromheader(&_mh_execute_header, *segNamePtr, &plk_segSizes[i]);
}
/* Unserialize the info dictionary from the prelink info section.
*/
parsedXML = OSUnserializeXML((const char *)prelinkInfoSect->addr,
&errorString);
if (parsedXML) {
prelinkInfoDict = OSDynamicCast(OSDictionary, parsedXML);
}
if (!prelinkInfoDict) {
const char * errorCString = "(unknown error)";
if (errorString && errorString->getCStringNoCopy()) {
errorCString = errorString->getCStringNoCopy();
} else if (parsedXML) {
errorCString = "not a dictionary";
}
OSKextLog(/* kext */ NULL, kOSKextLogErrorLevel | kOSKextLogArchiveFlag,
"Error unserializing prelink plist: %s.", errorCString);
goto finish;
}
#if NO_KEXTD
/* Check if we should keep developer kexts around.
* TODO: Check DeviceTree instead of a boot-arg <rdar://problem/10604201>
*/
developerDevice = true;
PE_parse_boot_argn("developer", &developerDevice, sizeof(developerDevice));
ramDiskBoot = IORamDiskBSDRoot();
#endif /* NO_KEXTD */
infoDictArray = OSDynamicCast(OSArray,
prelinkInfoDict->getObject(kPrelinkInfoDictionaryKey));
if (!infoDictArray) {
OSKextLog(/* kext */ NULL, kOSKextLogErrorLevel | kOSKextLogArchiveFlag,
"The prelinked kernel has no kext info dictionaries");
goto finish;
}
/* kaslrOffsets are available use them to slide local relocations */
kaslrOffsets = OSDynamicCast(OSData,
prelinkInfoDict->getObject(kPrelinkLinkKASLROffsetsKey));
/* Create dictionary of excluded kexts
*/
OSKext::createExcludeListFromPrelinkInfo(infoDictArray);
/* Create OSKext objects for each info dictionary.
*/
for (i = 0; i < infoDictArray->getCount(); ++i) {
infoDict = OSDynamicCast(OSDictionary, infoDictArray->getObject(i));
if (!infoDict) {
OSKextLog(/* kext */ NULL,
kOSKextLogErrorLevel |
kOSKextLogDirectoryScanFlag | kOSKextLogArchiveFlag,
"Can't find info dictionary for prelinked kext #%d.", i);
continue;
}
#if NO_KEXTD
dontLoad = false;
/* If we're not on a developer device, skip and free developer kexts.
*/
if (developerDevice == false) {
OSBoolean *devOnlyBool = OSDynamicCast(OSBoolean,
infoDict->getObject(kOSBundleDeveloperOnlyKey));
if (devOnlyBool == kOSBooleanTrue) {
dontLoad = true;
}
}
/* Skip and free kexts that are only needed when booted from a ram disk.
*/
if (ramDiskBoot == false) {
OSBoolean *ramDiskOnlyBool = OSDynamicCast(OSBoolean,
infoDict->getObject(kOSBundleRamDiskOnlyKey));
if (ramDiskOnlyBool == kOSBooleanTrue) {
dontLoad = true;
}
}
if (dontLoad == true) {
OSString *bundleID = OSDynamicCast(OSString,
infoDict->getObject(kCFBundleIdentifierKey));
if (bundleID) {
OSKextLog(NULL, kOSKextLogWarningLevel | kOSKextLogGeneralFlag,
"Kext %s not loading.", bundleID->getCStringNoCopy());
}
OSNumber *addressNum = OSDynamicCast(OSNumber,
infoDict->getObject(kPrelinkExecutableLoadKey));
OSNumber *lengthNum = OSDynamicCast(OSNumber,
infoDict->getObject(kPrelinkExecutableSizeKey));
if (addressNum && lengthNum) {
#error Pick the right way to free prelinked data on this arch
}
infoDictArray->removeObject(i--);
continue;
}
#endif /* NO_KEXTD */
/* Create the kext for the entry, then release it, because the
* kext system keeps them around until explicitly removed.
* Any creation/registration failures are already logged for us.
*/
OSKext * newKext = OSKext::withPrelinkedInfoDict(infoDict, (kaslrOffsets ? TRUE : FALSE));
OSSafeReleaseNULL(newKext);
}
/* slide kxld relocations */
if (kaslrOffsets && vm_kernel_slide > 0) {
int slidKextAddrCount = 0;
int badSlideAddr = 0;
int badSlideTarget = 0;
kaslrPackedOffsets * myOffsets = NULL;
myOffsets = (kaslrPackedOffsets *) kaslrOffsets->getBytesNoCopy();
for (uint32_t j = 0; j < myOffsets->count; j++) {
uint64_t slideOffset = (uint64_t) myOffsets->offsetsArray[j];
uintptr_t * slideAddr = (uintptr_t *) ((uint64_t)prelinkData + slideOffset);
int slideAddrSegIndex = -1;
int addrToSlideSegIndex = -1;
slideAddrSegIndex = __whereIsAddr( (vm_offset_t)slideAddr, &plk_segSizes[0], &plk_segAddrs[0], PLK_SEGMENTS );
if (slideAddrSegIndex >= 0) {
addrToSlideSegIndex = __whereIsAddr( (vm_offset_t)(*slideAddr + vm_kernel_slide), &plk_segSizes[0], &plk_segAddrs[0], PLK_SEGMENTS );
if (addrToSlideSegIndex < 0) {
badSlideTarget++;
continue;
}
}
else {
badSlideAddr++;
continue;
}
slidKextAddrCount++;
*(slideAddr) += vm_kernel_slide;
} // for ...
/* All kexts are now slid, set VM protections for them */
OSKext::setAllVMAttributes();
}
/* Store the number of prelinked kexts in the registry so we can tell
* when the system has been started from a prelinked kernel.
*/
registryRoot = IORegistryEntry::getRegistryRoot();
assert(registryRoot);
prelinkCountObj = OSNumber::withNumber(
(unsigned long long)infoDictArray->getCount(),
8 * sizeof(uint32_t));
assert(prelinkCountObj);
if (prelinkCountObj) {
registryRoot->setProperty(kOSPrelinkKextCountKey, prelinkCountObj);
}
OSKextLog(/* kext */ NULL,
kOSKextLogProgressLevel |
kOSKextLogGeneralFlag | kOSKextLogKextBookkeepingFlag |
kOSKextLogDirectoryScanFlag | kOSKextLogArchiveFlag,
"%u prelinked kexts",
infoDictArray->getCount());
#if CONFIG_KEXT_BASEMENT
/* On CONFIG_KEXT_BASEMENT systems, kexts are copied to their own
* special VM region during OSKext init time, so we can free the whole
* segment now.
*/
ml_static_mfree((vm_offset_t) prelinkData, prelinkLength);
#endif /* __x86_64__ */
/* Free the prelink info segment, we're done with it.
*/
prelinkInfoSegment = getsegbyname(kPrelinkInfoSegment);
if (prelinkInfoSegment) {
ml_static_mfree((vm_offset_t)prelinkInfoSegment->vmaddr,
(vm_size_t)prelinkInfoSegment->vmsize);
}
finish:
OSSafeReleaseNULL(errorString);
OSSafeReleaseNULL(parsedXML);
OSSafeReleaseNULL(theKernel);
OSSafeReleaseNULL(prelinkCountObj);
return;
}
void
fbt_init( void )
{
PE_parse_boot_argn("DisableFBT", &gDisableFBT, sizeof (gDisableFBT));
if (0 == gDisableFBT)
{
int majdevno = cdevsw_add(FBT_MAJOR, &fbt_cdevsw);
unsigned long size = 0, header_size, round_size;
kern_return_t ret;
void *p, *q;
if (majdevno < 0) {
printf("fbt_init: failed to allocate a major number!\n");
return;
}
/*
* Capture the kernel's mach_header in its entirety and the contents of
* its LINKEDIT segment (and only that segment). This is sufficient to
* build all the fbt probes lazily the first time a client looks to
* the fbt provider. Remeber these on the global struct modctl g_fbt_kernctl.
*/
header_size = sizeof(kernel_mach_header_t) + _mh_execute_header.sizeofcmds;
p = getsegdatafromheader(&_mh_execute_header, SEG_LINKEDIT, &size);
round_size = round_page(header_size + size);
/* "q" will accomodate copied kernel_mach_header_t, its load commands, and LINKEIT segment. */
ret = kmem_alloc_pageable(kernel_map, (vm_offset_t *)&q, round_size);
if (p && (ret == KERN_SUCCESS)) {
kernel_segment_command_t *sgp;
bcopy( (void *)&_mh_execute_header, q, header_size);
bcopy( p, (char *)q + header_size, size);
sgp = getsegbynamefromheader(q, SEG_LINKEDIT);
if (sgp) {
sgp->vmaddr = (uintptr_t)((char *)q + header_size);
g_fbt_kernctl.address = (vm_address_t)q;
g_fbt_kernctl.size = header_size + size;
} else {
kmem_free(kernel_map, (vm_offset_t)q, round_size);
g_fbt_kernctl.address = (vm_address_t)NULL;
g_fbt_kernctl.size = 0;
}
} else {
if (ret == KERN_SUCCESS)
kmem_free(kernel_map, (vm_offset_t)q, round_size);
g_fbt_kernctl.address = (vm_address_t)NULL;
g_fbt_kernctl.size = 0;
}
strncpy((char *)&(g_fbt_kernctl.mod_modname), "mach_kernel", KMOD_MAX_NAME);
((char *)&(g_fbt_kernctl.mod_modname))[KMOD_MAX_NAME -1] = '\0';
fbt_attach( (dev_info_t *)(uintptr_t)majdevno, DDI_ATTACH );
gDisableFBT = 1; /* Ensure this initialization occurs just one time. */
}
else
printf("fbt_init: DisableFBT non-zero, no FBT probes will be provided.\n");
}
