1/*
2 * Copyright (c) 2008 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28#include <kern/assert.h>
29#include <kern/debug.h>
30#include <kern/kext_alloc.h>
31#include <kern/misc_protos.h>
32
33#include <mach/host_priv_server.h>
34#include <mach/kern_return.h>
35#include <mach/mach_vm.h>
36#include <mach/vm_map.h>
37#include <mach/vm_types.h>
38
39#include <mach-o/loader.h>
40#include <libkern/kernel_mach_header.h>
41#include <san/kasan.h>
42
43#define KASLR_IOREG_DEBUG 0
44
45
46vm_map_t g_kext_map = 0;
47#if KASLR_IOREG_DEBUG
48mach_vm_offset_t kext_alloc_base = 0;
49mach_vm_offset_t kext_alloc_max = 0;
50#else
51static mach_vm_offset_t kext_alloc_base = 0;
52static mach_vm_offset_t kext_alloc_max = 0;
53#if CONFIG_KEXT_BASEMENT
54static mach_vm_offset_t kext_post_boot_base = 0;
55#endif
56#endif
57
58/*
59 * On x86_64 systems, kernel extension text must remain within 2GB of the
60 * kernel's text segment. To ensure this happens, we snag 2GB of kernel VM
61 * as early as possible for kext allocations.
62 */
63void
64kext_alloc_init(void)
65{
66#if CONFIG_KEXT_BASEMENT
67 kern_return_t rval = 0;
68 kernel_segment_command_t *text = NULL;
69 kernel_segment_command_t *prelinkTextSegment = NULL;
70 mach_vm_offset_t text_end, text_start;
71 mach_vm_size_t text_size;
72 mach_vm_size_t kext_alloc_size;
73
74 /* Determine the start of the kernel's __TEXT segment and determine the
75 * lower bound of the allocated submap for kext allocations.
76 */
77
78 text = getsegbyname(SEG_TEXT);
79 text_start = vm_map_trunc_page(text->vmaddr,
80 VM_MAP_PAGE_MASK(kernel_map));
81 text_start &= ~((512ULL * 1024 * 1024 * 1024) - 1);
82 text_end = vm_map_round_page(text->vmaddr + text->vmsize,
83 VM_MAP_PAGE_MASK(kernel_map));
84 text_size = text_end - text_start;
85
86 kext_alloc_base = KEXT_ALLOC_BASE(text_end);
87 kext_alloc_size = KEXT_ALLOC_SIZE(text_size);
88 kext_alloc_max = kext_alloc_base + kext_alloc_size;
89
90 /* Post boot kext allocation will start after the prelinked kexts */
91 prelinkTextSegment = getsegbyname("__PRELINK_TEXT");
92 if (prelinkTextSegment) {
93 /* use kext_post_boot_base to start allocations past all the prelinked
94 * kexts
95 */
96 kext_post_boot_base =
97 vm_map_round_page(kext_alloc_base + prelinkTextSegment->vmsize,
98 VM_MAP_PAGE_MASK(kernel_map));
99 }
100 else {
101 kext_post_boot_base = kext_alloc_base;
102 }
103
104 /* Allocate the sub block of the kernel map */
105 rval = kmem_suballoc(kernel_map, (vm_offset_t *) &kext_alloc_base,
106 kext_alloc_size, /* pageable */ TRUE,
107 VM_FLAGS_FIXED|VM_FLAGS_OVERWRITE,
108 VM_MAP_KERNEL_FLAGS_NONE, VM_KERN_MEMORY_KEXT,
109 &g_kext_map);
110 if (rval != KERN_SUCCESS) {
111 panic("kext_alloc_init: kmem_suballoc failed 0x%x\n", rval);
112 }
113
114 if ((kext_alloc_base + kext_alloc_size) > kext_alloc_max) {
115 panic("kext_alloc_init: failed to get first 2GB\n");
116 }
117
118 if (kernel_map->min_offset > kext_alloc_base) {
119 kernel_map->min_offset = kext_alloc_base;
120 }
121
122 printf("kext submap [0x%lx - 0x%lx], kernel text [0x%lx - 0x%lx]\n",
123 VM_KERNEL_UNSLIDE(kext_alloc_base),
124 VM_KERNEL_UNSLIDE(kext_alloc_max),
125 VM_KERNEL_UNSLIDE(text->vmaddr),
126 VM_KERNEL_UNSLIDE(text->vmaddr + text->vmsize));
127
128#else
129 g_kext_map = kernel_map;
130 kext_alloc_base = VM_MIN_KERNEL_ADDRESS;
131 kext_alloc_max = VM_MAX_KERNEL_ADDRESS;
132#endif /* CONFIG_KEXT_BASEMENT */
133}
134
135kern_return_t
136kext_alloc(vm_offset_t *_addr, vm_size_t size, boolean_t fixed)
137{
138 kern_return_t rval = 0;
139#if CONFIG_KEXT_BASEMENT
140 mach_vm_offset_t addr = (fixed) ? *_addr : kext_post_boot_base;
141#else
142 mach_vm_offset_t addr = (fixed) ? *_addr : kext_alloc_base;
143#endif
144 int flags = (fixed) ? VM_FLAGS_FIXED : VM_FLAGS_ANYWHERE;
145
146#if CONFIG_KEXT_BASEMENT
147 /* Allocate the kext virtual memory
148 * 10608884 - use mach_vm_map since we want VM_FLAGS_ANYWHERE allocated past
149 * kext_post_boot_base (when possible). mach_vm_allocate will always
150 * start at 0 into the map no matter what you pass in addr. We want non
151 * fixed (post boot) kext allocations to start looking for free space
152 * just past where prelinked kexts have loaded.
153 */
154 rval = mach_vm_map_kernel(g_kext_map,
155 &addr,
156 size,
157 0,
158 flags,
159 VM_MAP_KERNEL_FLAGS_NONE,
160 VM_KERN_MEMORY_KEXT,
161 MACH_PORT_NULL,
162 0,
163 TRUE,
164 VM_PROT_DEFAULT,
165 VM_PROT_ALL,
166 VM_INHERIT_DEFAULT);
167 if (rval != KERN_SUCCESS) {
168 printf("mach_vm_map failed - %d\n", rval);
169 goto finish;
170 }
171#else
172 rval = mach_vm_allocate_kernel(g_kext_map, &addr, size, flags, VM_KERN_MEMORY_KEXT);
173 if (rval != KERN_SUCCESS) {
174 printf("vm_allocate failed - %d\n", rval);
175 goto finish;
176 }
177#endif
178
179 /* Check that the memory is reachable by kernel text */
180 if ((addr + size) > kext_alloc_max) {
181 kext_free((vm_offset_t)addr, size);
182 rval = KERN_INVALID_ADDRESS;
183 goto finish;
184 }
185
186 *_addr = (vm_offset_t)addr;
187 rval = KERN_SUCCESS;
188#if KASAN
189 kasan_notify_address(addr, size);
190#endif
191
192finish:
193 return rval;
194}
195
196void
197kext_free(vm_offset_t addr, vm_size_t size)
198{
199 kern_return_t rval;
200
201 rval = mach_vm_deallocate(g_kext_map, addr, size);
202 assert(rval == KERN_SUCCESS);
203}
204
205