1/* 2 * Copyright (c) 2008 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28#include <kern/assert.h> 29#include <kern/debug.h> 30#include <kern/kext_alloc.h> 31#include <kern/misc_protos.h> 32 33#include <mach/host_priv_server.h> 34#include <mach/kern_return.h> 35#include <mach/mach_vm.h> 36#include <mach/vm_map.h> 37#include <mach/vm_types.h> 38 39#include <mach-o/loader.h> 40#include <libkern/kernel_mach_header.h> 41 42#define KASLR_IOREG_DEBUG 0 43 44 45vm_map_t g_kext_map = 0; 46#if KASLR_IOREG_DEBUG 47mach_vm_offset_t kext_alloc_base = 0; 48mach_vm_offset_t kext_alloc_max = 0; 49#else 50static mach_vm_offset_t kext_alloc_base = 0; 51static mach_vm_offset_t kext_alloc_max = 0; 52#if CONFIG_KEXT_BASEMENT 53static mach_vm_offset_t kext_post_boot_base = 0; 54#endif 55#endif 56 57/* 58 * On x86_64 systems, kernel extension text must remain within 2GB of the 59 * kernel's text segment. To ensure this happens, we snag 2GB of kernel VM 60 * as early as possible for kext allocations. 61 */ 62void 63kext_alloc_init(void) 64{ 65#if CONFIG_KEXT_BASEMENT 66 kern_return_t rval = 0; 67 kernel_segment_command_t *text = NULL; 68 kernel_segment_command_t *prelinkTextSegment = NULL; 69 mach_vm_offset_t text_end, text_start; 70 mach_vm_size_t text_size; 71 mach_vm_size_t kext_alloc_size; 72 73 /* Determine the start of the kernel's __TEXT segment and determine the 74 * lower bound of the allocated submap for kext allocations. 75 */ 76 77 text = getsegbyname(SEG_TEXT); 78 text_start = vm_map_trunc_page(text->vmaddr, 79 VM_MAP_PAGE_MASK(kernel_map)); 80 text_start &= ~((512ULL * 1024 * 1024 * 1024) - 1); 81 text_end = vm_map_round_page(text->vmaddr + text->vmsize, 82 VM_MAP_PAGE_MASK(kernel_map)); 83 text_size = text_end - text_start; 84 85 kext_alloc_base = KEXT_ALLOC_BASE(text_end); 86 kext_alloc_size = KEXT_ALLOC_SIZE(text_size); 87 kext_alloc_max = kext_alloc_base + kext_alloc_size; 88 89 /* Post boot kext allocation will start after the prelinked kexts */ 90 prelinkTextSegment = getsegbyname("__PRELINK_TEXT"); 91 if (prelinkTextSegment) { 92 /* use kext_post_boot_base to start allocations past all the prelinked 93 * kexts 94 */ 95 kext_post_boot_base = 96 vm_map_round_page(kext_alloc_base + prelinkTextSegment->vmsize, 97 VM_MAP_PAGE_MASK(kernel_map)); 98 } 99 else { 100 kext_post_boot_base = kext_alloc_base; 101 } 102 103 /* Allocate the sub block of the kernel map */ 104 rval = kmem_suballoc(kernel_map, (vm_offset_t *) &kext_alloc_base, 105 kext_alloc_size, /* pageable */ TRUE, 106 VM_FLAGS_FIXED|VM_FLAGS_OVERWRITE, 107 &g_kext_map); 108 if (rval != KERN_SUCCESS) { 109 panic("kext_alloc_init: kmem_suballoc failed 0x%x\n", rval); 110 } 111 112 if ((kext_alloc_base + kext_alloc_size) > kext_alloc_max) { 113 panic("kext_alloc_init: failed to get first 2GB\n"); 114 } 115 116 if (kernel_map->min_offset > kext_alloc_base) { 117 kernel_map->min_offset = kext_alloc_base; 118 } 119 120 printf("kext submap [0x%lx - 0x%lx], kernel text [0x%lx - 0x%lx]\n", 121 VM_KERNEL_UNSLIDE(kext_alloc_base), 122 VM_KERNEL_UNSLIDE(kext_alloc_max), 123 VM_KERNEL_UNSLIDE(text->vmaddr), 124 VM_KERNEL_UNSLIDE(text->vmaddr + text->vmsize)); 125 126#else 127 g_kext_map = kernel_map; 128 kext_alloc_base = VM_MIN_KERNEL_ADDRESS; 129 kext_alloc_max = VM_MAX_KERNEL_ADDRESS; 130#endif /* CONFIG_KEXT_BASEMENT */ 131} 132 133kern_return_t 134kext_alloc(vm_offset_t *_addr, vm_size_t size, boolean_t fixed) 135{ 136 kern_return_t rval = 0; 137#if CONFIG_KEXT_BASEMENT 138 mach_vm_offset_t addr = (fixed) ? *_addr : kext_post_boot_base; 139#else 140 mach_vm_offset_t addr = (fixed) ? *_addr : kext_alloc_base; 141#endif 142 int flags = (fixed) ? VM_FLAGS_FIXED : VM_FLAGS_ANYWHERE; 143 144#if CONFIG_KEXT_BASEMENT 145 /* Allocate the kext virtual memory 146 * 10608884 - use mach_vm_map since we want VM_FLAGS_ANYWHERE allocated past 147 * kext_post_boot_base (when possible). mach_vm_allocate will always 148 * start at 0 into the map no matter what you pass in addr. We want non 149 * fixed (post boot) kext allocations to start looking for free space 150 * just past where prelinked kexts have loaded. 151 */ 152 rval = mach_vm_map(g_kext_map, 153 &addr, 154 size, 155 0, 156 flags, 157 MACH_PORT_NULL, 158 0, 159 TRUE, 160 VM_PROT_DEFAULT, 161 VM_PROT_ALL, 162 VM_INHERIT_DEFAULT); 163 if (rval != KERN_SUCCESS) { 164 printf("mach_vm_map failed - %d\n", rval); 165 goto finish; 166 } 167#else 168 rval = mach_vm_allocate(g_kext_map, &addr, size, flags); 169 if (rval != KERN_SUCCESS) { 170 printf("vm_allocate failed - %d\n", rval); 171 goto finish; 172 } 173#endif 174 175 /* Check that the memory is reachable by kernel text */ 176 if ((addr + size) > kext_alloc_max) { 177 kext_free((vm_offset_t)addr, size); 178 rval = KERN_INVALID_ADDRESS; 179 goto finish; 180 } 181 182 *_addr = (vm_offset_t)addr; 183 rval = KERN_SUCCESS; 184 185finish: 186 return rval; 187} 188 189void 190kext_free(vm_offset_t addr, vm_size_t size) 191{ 192 kern_return_t rval; 193 194 rval = mach_vm_deallocate(g_kext_map, addr, size); 195 assert(rval == KERN_SUCCESS); 196} 197 198