1 | /* |
2 | * Copyright (c) 2008 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | #include <kern/assert.h> |
29 | #include <kern/debug.h> |
30 | #include <kern/kext_alloc.h> |
31 | #include <kern/misc_protos.h> |
32 | |
33 | #include <mach/host_priv_server.h> |
34 | #include <mach/kern_return.h> |
35 | #include <mach/mach_vm.h> |
36 | #include <mach/vm_map.h> |
37 | #include <mach/vm_types.h> |
38 | |
39 | #include <mach-o/loader.h> |
40 | #include <libkern/kernel_mach_header.h> |
41 | #include <san/kasan.h> |
42 | |
43 | #define KASLR_IOREG_DEBUG 0 |
44 | |
45 | |
46 | vm_map_t g_kext_map = 0; |
47 | #if KASLR_IOREG_DEBUG |
48 | mach_vm_offset_t kext_alloc_base = 0; |
49 | mach_vm_offset_t kext_alloc_max = 0; |
50 | #else |
51 | static mach_vm_offset_t kext_alloc_base = 0; |
52 | static mach_vm_offset_t kext_alloc_max = 0; |
53 | #if CONFIG_KEXT_BASEMENT |
54 | static mach_vm_offset_t kext_post_boot_base = 0; |
55 | #endif |
56 | #endif |
57 | |
58 | /* |
59 | * On x86_64 systems, kernel extension text must remain within 2GB of the |
60 | * kernel's text segment. To ensure this happens, we snag 2GB of kernel VM |
61 | * as early as possible for kext allocations. |
62 | */ |
63 | void |
64 | kext_alloc_init(void) |
65 | { |
66 | #if CONFIG_KEXT_BASEMENT |
67 | kern_return_t rval = 0; |
68 | kernel_segment_command_t *text = NULL; |
69 | kernel_segment_command_t *prelinkTextSegment = NULL; |
70 | mach_vm_offset_t text_end, text_start; |
71 | mach_vm_size_t text_size; |
72 | mach_vm_size_t kext_alloc_size; |
73 | |
74 | /* Determine the start of the kernel's __TEXT segment and determine the |
75 | * lower bound of the allocated submap for kext allocations. |
76 | */ |
77 | |
78 | text = getsegbyname(SEG_TEXT); |
79 | text_start = vm_map_trunc_page(text->vmaddr, |
80 | VM_MAP_PAGE_MASK(kernel_map)); |
81 | text_start &= ~((512ULL * 1024 * 1024 * 1024) - 1); |
82 | text_end = vm_map_round_page(text->vmaddr + text->vmsize, |
83 | VM_MAP_PAGE_MASK(kernel_map)); |
84 | text_size = text_end - text_start; |
85 | |
86 | kext_alloc_base = KEXT_ALLOC_BASE(text_end); |
87 | kext_alloc_size = KEXT_ALLOC_SIZE(text_size); |
88 | kext_alloc_max = kext_alloc_base + kext_alloc_size; |
89 | |
90 | /* Post boot kext allocation will start after the prelinked kexts */ |
91 | prelinkTextSegment = getsegbyname("__PRELINK_TEXT" ); |
92 | if (prelinkTextSegment) { |
93 | /* use kext_post_boot_base to start allocations past all the prelinked |
94 | * kexts |
95 | */ |
96 | kext_post_boot_base = |
97 | vm_map_round_page(kext_alloc_base + prelinkTextSegment->vmsize, |
98 | VM_MAP_PAGE_MASK(kernel_map)); |
99 | } |
100 | else { |
101 | kext_post_boot_base = kext_alloc_base; |
102 | } |
103 | |
104 | /* Allocate the sub block of the kernel map */ |
105 | rval = kmem_suballoc(kernel_map, (vm_offset_t *) &kext_alloc_base, |
106 | kext_alloc_size, /* pageable */ TRUE, |
107 | VM_FLAGS_FIXED|VM_FLAGS_OVERWRITE, |
108 | VM_MAP_KERNEL_FLAGS_NONE, VM_KERN_MEMORY_KEXT, |
109 | &g_kext_map); |
110 | if (rval != KERN_SUCCESS) { |
111 | panic("kext_alloc_init: kmem_suballoc failed 0x%x\n" , rval); |
112 | } |
113 | |
114 | if ((kext_alloc_base + kext_alloc_size) > kext_alloc_max) { |
115 | panic("kext_alloc_init: failed to get first 2GB\n" ); |
116 | } |
117 | |
118 | if (kernel_map->min_offset > kext_alloc_base) { |
119 | kernel_map->min_offset = kext_alloc_base; |
120 | } |
121 | |
122 | printf("kext submap [0x%lx - 0x%lx], kernel text [0x%lx - 0x%lx]\n" , |
123 | VM_KERNEL_UNSLIDE(kext_alloc_base), |
124 | VM_KERNEL_UNSLIDE(kext_alloc_max), |
125 | VM_KERNEL_UNSLIDE(text->vmaddr), |
126 | VM_KERNEL_UNSLIDE(text->vmaddr + text->vmsize)); |
127 | |
128 | #else |
129 | g_kext_map = kernel_map; |
130 | kext_alloc_base = VM_MIN_KERNEL_ADDRESS; |
131 | kext_alloc_max = VM_MAX_KERNEL_ADDRESS; |
132 | #endif /* CONFIG_KEXT_BASEMENT */ |
133 | } |
134 | |
135 | kern_return_t |
136 | kext_alloc(vm_offset_t *_addr, vm_size_t size, boolean_t fixed) |
137 | { |
138 | kern_return_t rval = 0; |
139 | #if CONFIG_KEXT_BASEMENT |
140 | mach_vm_offset_t addr = (fixed) ? *_addr : kext_post_boot_base; |
141 | #else |
142 | mach_vm_offset_t addr = (fixed) ? *_addr : kext_alloc_base; |
143 | #endif |
144 | int flags = (fixed) ? VM_FLAGS_FIXED : VM_FLAGS_ANYWHERE; |
145 | |
146 | #if CONFIG_KEXT_BASEMENT |
147 | /* Allocate the kext virtual memory |
148 | * 10608884 - use mach_vm_map since we want VM_FLAGS_ANYWHERE allocated past |
149 | * kext_post_boot_base (when possible). mach_vm_allocate will always |
150 | * start at 0 into the map no matter what you pass in addr. We want non |
151 | * fixed (post boot) kext allocations to start looking for free space |
152 | * just past where prelinked kexts have loaded. |
153 | */ |
154 | rval = mach_vm_map_kernel(g_kext_map, |
155 | &addr, |
156 | size, |
157 | 0, |
158 | flags, |
159 | VM_MAP_KERNEL_FLAGS_NONE, |
160 | VM_KERN_MEMORY_KEXT, |
161 | MACH_PORT_NULL, |
162 | 0, |
163 | TRUE, |
164 | VM_PROT_DEFAULT, |
165 | VM_PROT_ALL, |
166 | VM_INHERIT_DEFAULT); |
167 | if (rval != KERN_SUCCESS) { |
168 | printf("mach_vm_map failed - %d\n" , rval); |
169 | goto finish; |
170 | } |
171 | #else |
172 | rval = mach_vm_allocate_kernel(g_kext_map, &addr, size, flags, VM_KERN_MEMORY_KEXT); |
173 | if (rval != KERN_SUCCESS) { |
174 | printf("vm_allocate failed - %d\n" , rval); |
175 | goto finish; |
176 | } |
177 | #endif |
178 | |
179 | /* Check that the memory is reachable by kernel text */ |
180 | if ((addr + size) > kext_alloc_max) { |
181 | kext_free((vm_offset_t)addr, size); |
182 | rval = KERN_INVALID_ADDRESS; |
183 | goto finish; |
184 | } |
185 | |
186 | *_addr = (vm_offset_t)addr; |
187 | rval = KERN_SUCCESS; |
188 | #if KASAN |
189 | kasan_notify_address(addr, size); |
190 | #endif |
191 | |
192 | finish: |
193 | return rval; |
194 | } |
195 | |
196 | void |
197 | kext_free(vm_offset_t addr, vm_size_t size) |
198 | { |
199 | kern_return_t rval; |
200 | |
201 | rval = mach_vm_deallocate(g_kext_map, addr, size); |
202 | assert(rval == KERN_SUCCESS); |
203 | } |
204 | |
205 | |