【ios 内核】源码解读（1） darwin架构和可执行文件加载

struct fat_header {
	uint32_t	magic;		/* FAT_MAGIC */
	uint32_t	nfat_arch;	/* number of structs that follow */
};

struct fat_arch {
	cpu_type_t	cputype;	/* cpu specifier (int) */
	cpu_subtype_t	cpusubtype;	/* machine specifier (int) */
	uint32_t	offset;		/* file offset to this object file */
	uint32_t	size;		/* size of this object file */
	uint32_t	align;		/* alignment as a power of 2 */
};

load_return_t
load_machfile(
	struct image_params	*imgp,
	struct mach_header	*header,
	thread_t 		thread,
	vm_map_t 		*mapp,
	load_result_t		*result
)
{

	//xxx….

	pmap_t		pmap = 0;	/* protected by create_map *///用于映射物理地址
	vm_map_t		map;//虚拟地址
	int64_t			aslr_page_offset = 0;//随机页偏移量
	int64_t			dyld_aslr_page_offset = 0;//动态库的随机页偏移量
	int64_t			aslr_section_size = 0;
	int64_t			aslr_section_offset = 0;

	//xxxx….
	
	//先创建一个映射物理地址的pmap
	pmap = pmap_create(get_task_ledger(ledger_task),
			   (vm_map_size_t) 0,
			   result->is64bit);
	//基于pmap创建一个虚拟地址入口
	map = vm_map_create(pmap,
			0,
			vm_compute_max_offset(result->is64bit),
			TRUE);

	//xxxxx…
	/*
	 * Compute a random offset for ASLR, and an independent random offset for dyld.
	 */
	//这里是具体计算随机偏移量的部分
	if (!(imgp->ip_flags & IMGPF_DISABLE_ASLR)) {
		//先计算整个section的大小和偏移量
		vm_map_get_max_aslr_slide_section(map, &aslr_section_offset, &aslr_section_size);
		aslr_section_offset = (random() % aslr_section_offset) * aslr_section_size;

		//取一个随机数，模上最大可偏移页数，然后页对齐（就是乘以了页的大小）
		aslr_page_offset = random();
		aslr_page_offset %= vm_map_get_max_aslr_slide_pages(map);
		aslr_page_offset <<= vm_map_page_shift(map);//页对齐，一个页的大小是2^page_shift

		//这里计算方法和上面差不多
		dyld_aslr_page_offset = random();
		dyld_aslr_page_offset %= vm_map_get_max_loader_aslr_slide_pages(map);
		dyld_aslr_page_offset <<= vm_map_page_shift(map);

		//最后加上了整个section的偏移量
		aslr_page_offset += aslr_section_offset;
	}

	//xxxxx…..
	//调用parse_machfile来扫描文件和执行Load Command
	lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
	                      0, aslr_page_offset, dyld_aslr_page_offset, result,
			      NULL, imgp);

	//xxxxxx…..
}

static
load_return_t
parse_machfile(
	struct vnode 		*vp,//这里面存着文件信息       
	vm_map_t		map,//之前传进来的虚拟地址入口
	thread_t		thread,
	struct mach_header	*header,
	off_t			file_offset,
	off_t			macho_size,
	int			depth,
	int64_t			aslr_offset,//随机偏移量
	int64_t			dyld_aslr_offset,//针对动态库的随机偏移量
	load_result_t		*result,
	load_result_t		*binresult,
	struct image_params	*imgp
)
{
	
	//获取vnode的”memory object control”，里面有具体的”pager”来获取真正的页（虚拟内存相关知识，后续详细介绍）
	/*
	 *	Get the pager for the file.
	 */
	control = ubc_getobject(vp, UBC_FLAGS_NONE);

	//xxxxx….

	//PIE(Position-independent executable)，指代码的执行不依赖它的绝对地址
	/*
	 *	For PIE and dyld, slide everything by the ASLR offset.
	 */
	if ((header->flags & MH_PIE) || is_dyld) {
		slide = aslr_offset;
	}

	//xxxxx…
	
	/*
	 *  Scan through the commands, processing each one as necessary.
	 *  We parse in three passes through the headers:
	 *  0: determine if TEXT and DATA boundary can be page-aligned
	 *  1: thread state, uuid, code signature
	 *  2: segments
	 *  3: dyld, encryption, check entry point
	 */
	//四趟扫描，分别遍历Load Command
	for (pass = 0; pass <= 3; pass++) {

		//xxxxxx….

		/*
		 * Loop through each of the load_commands indicated by the
		 * Mach-O header; if an absurd value is provided, we just
		 * run off the end of the reserved section by incrementing
		 * the offset too far, so we are implicitly fail-safe.
		 */
		offset = mach_header_sz;
		ncmds = header->ncmds;

		while (ncmds--) {
			//xxxx..

			/*
			 *	Get a pointer to the command.
			 */
			lcp = (struct load_command *)(addr + offset);
			oldoffset = offset;

			//xxx….

			/*
			 * Act on struct load_command's for which kernel
			 * intervention is required.
			 */
			switch(lcp->cmd) {
			case LC_SEGMENT: {
				//加载段
				struct segment_command *scp = (struct segment_command *) lcp;

				//xxxx…

				ret = load_segment(lcp,
				                   header->filetype,
				                   control,
				                   file_offset,
				                   macho_size,
				                   vp,
				                   map,
				                   slide,
				                   result);

				//xxxxx….
			}

			case LC_SEGMENT_64: {
				//xxxx
			}
			case LC_UNIXTHREAD:
				//开启一个unix线程，区别于LC_THREAD(加载一个mach线程，用于内核)
				if (pass != 1)
					break;
				ret = load_unixthread(
						 (struct thread_command *) lcp,
						 thread,
						 slide,
						 result);
				break;
			case LC_MAIN:
				//用于取代LC_UNIXTHREAD，主要用来加载主线程，设置entry point，栈大小等
				//xxxx.
				break;
			case LC_LOAD_DYLINKER:
				//加载动态库
				if (pass != 3)
					break;
				if ((depth == 1) && (dlp == 0)) {
					dlp = (struct dylinker_command *)lcp;
					dlarchbits = (header->cputype & CPU_ARCH_MASK);
				} else {
					ret = LOAD_FAILURE;
				}
				break;
			case LC_UUID:
				if (pass == 1 && depth == 1) {
					ret = load_uuid((struct uuid_command *) lcp,
							(char *)addr + cmds_size,
							result);
				}
				break;
			//xxxxx…
			}
			//xxxx
		}
	}
}

static
load_return_t
load_segment(
	struct load_command	*lcp,
	uint32_t		filetype,
	void *			control,
	off_t			pager_offset,
	off_t			macho_size,
	struct vnode		*vp,
	vm_map_t		map,
	int64_t			slide,
	load_result_t		*result)
{
	struct segment_command_64 segment_command, *scp;
	kern_return_t		ret;

	size_t			segment_command_size, total_section_size,
				single_section_size;
	vm_map_offset_t		file_offset, file_size;//文件中的偏移量和大小
	vm_map_offset_t		vm_offset, vm_size;//load_command里定义的虚拟地址偏移量和大小
	vm_map_offset_t		vm_start, vm_end, vm_end_aligned;//计算得到的该段实际的开始和结束地址
	vm_map_offset_t		file_start, file_end;//文件中的开始和结束偏移量，根据file_offset计算得到，其实file_offset必须是4K-alignment的

	//实际用的page_size 和mask，取默认PAGE_SIZE和实际map中size的最大值
	vm_map_size_t		effective_page_size;
	vm_map_offset_t		effective_page_mask;
#if __arm64__
	vm_map_kernel_flags_t	vmk_flags;
	boolean_t		fourk_align;
#endif /* __arm64__ */

	effective_page_size = MAX(PAGE_SIZE, vm_map_page_size(map));
	effective_page_mask = MAX(PAGE_MASK, vm_map_page_mask(map));
	
	//xxxx…

	//判断是否需要4K-alignment（4k是默认的page_size）,需要通过fourk_pager来对齐
	if (LC_SEGMENT_64 == lcp->cmd) {
		segment_command_size = sizeof(struct segment_command_64);
		single_section_size  = sizeof(struct section_64);
#if __arm64__
		/* 64-bit binary: should already be 16K-aligned */
		fourk_align = FALSE;
#endif /* __arm64__ */
	} else {
		segment_command_size = sizeof(struct segment_command);
		single_section_size  = sizeof(struct section);
#if __arm64__
		/* 32-bit binary: might need 4K-alignment */
		if (effective_page_size != FOURK_PAGE_SIZE) {
			/* not using 4K page size: need fourk_pager */
			fourk_align = TRUE;
			verbose = TRUE;
		} else {
			/* using 4K page size: no need for re-alignment */
			fourk_align = FALSE;
		}
#endif /* __arm64__ */
	}

	//把lcp强转成具体命令
	if (LC_SEGMENT_64 == lcp->cmd) {
		scp = (struct segment_command_64 *)lcp;
	} else {
		scp = &segment_command;
		widen_segment_command((struct segment_command *)lcp, scp);
	}

	//xxxxx…

	//这里vm_offset用命令中指定的地址加上了之前传进来随机偏移量
	vm_offset = scp->vmaddr + slide;
	vm_size = scp->vmsize;
	
	//xxxxx…

	//根据是否要fourk_align来计算相应的vm_start和vm_end，本质上就是round和trunc的时候用的mask不同
#if __arm64__
	if (fourk_align) {
		//其实前面已经判断过file_offset是否已经是4K-alignment的了
		/* 4K-align */
		file_start = vm_map_trunc_page(file_offset,
					       FOURK_PAGE_MASK);
		file_end = vm_map_round_page(file_offset + file_size,
					     FOURK_PAGE_MASK);
		vm_start = vm_map_trunc_page(vm_offset,
					     FOURK_PAGE_MASK);
		vm_end = vm_map_round_page(vm_offset + vm_size,
					   FOURK_PAGE_MASK);
		if (!strncmp(scp->segname, "__LINKEDIT", 11) &&
		    page_aligned(file_start) &&
		    vm_map_page_aligned(file_start, vm_map_page_mask(map)) &&
		    page_aligned(vm_start) &&
		    vm_map_page_aligned(vm_start, vm_map_page_mask(map))) {
			/* XXX last segment: ignore mis-aligned tail */
			file_end = vm_map_round_page(file_end,
						     effective_page_mask);
			vm_end = vm_map_round_page(vm_end,
						   effective_page_mask);
		}
	} else
#endif /* __arm64__ */
	{
		file_start = vm_map_trunc_page(file_offset,
					       effective_page_mask);
		file_end = vm_map_round_page(file_offset + file_size,
					     effective_page_mask);
		vm_start = vm_map_trunc_page(vm_offset,
					     effective_page_mask);
		vm_end = vm_map_round_page(vm_offset + vm_size,
					   effective_page_mask);
	}

	//xxxxx….

	//根据先前计算得到的几个偏移量，用map_segment进行映射
	if (vm_size > 0) {
		initprot = (scp->initprot) & VM_PROT_ALL;
		maxprot = (scp->maxprot) & VM_PROT_ALL;
		/*
		 *	Map a copy of the file into the address space.
		 */
		ret = map_segment(map,
				  vm_start,
				  vm_end,
				  control,
				  file_start,
				  file_end,
				  initprot,
				  maxprot);
		if (ret) {
			return LOAD_NOSPACE;
		}

		//xxxx…….
	}
	return ret;
}