[apple/xnu.git] / osfmk / kern / ipc_kobject.c

/*
 * Copyright (c) 2000-2008 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 * 
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 * 
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 * 
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 * 
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */
/*
 * @OSF_COPYRIGHT@
 */
/* 
 * Mach Operating System
 * Copyright (c) 1991,1990,1989 Carnegie Mellon University
 * All Rights Reserved.
 * 
 * Permission to use, copy, modify and distribute this software and its
 * documentation is hereby granted, provided that both the copyright
 * notice and this permission notice appear in all copies of the
 * software, derivative works or modified versions, and any portions
 * thereof, and that both notices appear in supporting documentation.
 * 
 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
 * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
 * 
 * Carnegie Mellon requests users of this software to return to
 * 
 *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
 *  School of Computer Science
 *  Carnegie Mellon University
 *  Pittsburgh PA 15213-3890
 * 
 * any improvements or extensions that they make and grant Carnegie Mellon
 * the rights to redistribute these changes.
 */
/*
 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
 * support for mandatory and extensible security protections.  This notice
 * is included in support of clause 2.2 (b) of the Apple Public License,
 * Version 2.0.
 * Copyright (c) 2005 SPARTA, Inc.
 */
/*
 */
/*
 *	File:	kern/ipc_kobject.c
 *	Author:	Rich Draves
 *	Date:	1989
 *
 *	Functions for letting a port represent a kernel object.
 */

#include <mach_debug.h>
#include <mach_ipc_test.h>
#include <mach_machine_routines.h>
#include <norma_task.h>
#include <mach_rt.h>
#include <platforms.h>

#include <mach/mig.h>
#include <mach/port.h>
#include <mach/kern_return.h>
#include <mach/message.h>
#include <mach/mig_errors.h>
#include <mach/notify.h>
#include <mach/ndr.h>
#include <mach/vm_param.h>

#include <mach/mach_vm_server.h>
#include <mach/mach_port_server.h>
#include <mach/mach_host_server.h>
#include <mach/host_priv_server.h>
#include <mach/host_security_server.h>
#include <mach/clock_server.h>
#include <mach/clock_priv_server.h>
#include <mach/ledger_server.h>
#include <mach/lock_set_server.h>
#include <default_pager/default_pager_object_server.h>
#include <mach/memory_object_server.h>
#include <mach/memory_object_control_server.h>
#include <mach/memory_object_default_server.h>
#include <mach/memory_object_name_server.h>
#include <mach/processor_server.h>
#include <mach/processor_set_server.h>
#include <mach/task_server.h>
#if VM32_SUPPORT
#include <mach/vm32_map_server.h>
#endif
#include <mach/thread_act_server.h>

#include <device/device_types.h>
#include <device/device_server.h>

#include <UserNotification/UNDReplyServer.h>

#if	CONFIG_AUDIT
#include <kern/audit_sessionport.h>
#endif

#if     MACH_MACHINE_ROUTINES
#include <machine/machine_routines.h>
#endif	/* MACH_MACHINE_ROUTINES */
#if	XK_PROXY
#include <uk_xkern/xk_uproxy_server.h>
#endif	/* XK_PROXY */

#include <kern/ipc_tt.h>
#include <kern/ipc_mig.h>
#include <kern/ipc_misc.h>
#include <kern/ipc_kobject.h>
#include <kern/host_notify.h>
#include <kern/mk_timer.h>
#include <kern/misc_protos.h>
#include <ipc/ipc_kmsg.h>
#include <ipc/ipc_port.h>
#include <ipc/ipc_labelh.h>
#include <kern/counters.h>

#include <vm/vm_protos.h>

#include <security/mac_mach_internal.h>

/*
 *	Routine:	ipc_kobject_notify
 *	Purpose:
 *		Deliver notifications to kobjects that care about them.
 */
boolean_t
ipc_kobject_notify(
        mach_msg_header_t *request_header,
        mach_msg_header_t *reply_header);

typedef struct {
        mach_msg_id_t num;
        mig_routine_t routine;
	int size;
#if	MACH_COUNTERS
	mach_counter_t callcount;
#endif
} mig_hash_t;

#define MAX_MIG_ENTRIES 1024
#define MIG_HASH(x) (x)

#ifndef max
#define max(a,b)        (((a) > (b)) ? (a) : (b))
#endif /* max */

mig_hash_t mig_buckets[MAX_MIG_ENTRIES];
int mig_table_max_displ;
mach_msg_size_t mig_reply_size;

#if CONFIG_MACF
#include <mach/security_server.h>
#endif


const struct mig_subsystem *mig_e[] = {
        (const struct mig_subsystem *)&mach_vm_subsystem,
        (const struct mig_subsystem *)&mach_port_subsystem,
        (const struct mig_subsystem *)&mach_host_subsystem,
        (const struct mig_subsystem *)&host_priv_subsystem,
        (const struct mig_subsystem *)&host_security_subsystem,
        (const struct mig_subsystem *)&clock_subsystem,
        (const struct mig_subsystem *)&clock_priv_subsystem,
        (const struct mig_subsystem *)&processor_subsystem,
        (const struct mig_subsystem *)&processor_set_subsystem,
        (const struct mig_subsystem *)&is_iokit_subsystem,
        (const struct mig_subsystem *)&memory_object_name_subsystem,
	(const struct mig_subsystem *)&lock_set_subsystem,
	(const struct mig_subsystem *)&ledger_subsystem,
	(const struct mig_subsystem *)&task_subsystem,
	(const struct mig_subsystem *)&thread_act_subsystem,
#if VM32_SUPPORT
	(const struct mig_subsystem *)&vm32_map_subsystem,
#endif
	(const struct mig_subsystem *)&UNDReply_subsystem,
	(const struct mig_subsystem *)&default_pager_object_subsystem,

#if     XK_PROXY
        (const struct mig_subsystem *)&do_uproxy_xk_uproxy_subsystem,
#endif /* XK_PROXY */
#if     MACH_MACHINE_ROUTINES
        (const struct mig_subsystem *)&MACHINE_SUBSYSTEM,
#endif  /* MACH_MACHINE_ROUTINES */
#if     MCMSG && iPSC860
	(const struct mig_subsystem *)&mcmsg_info_subsystem,
#endif  /* MCMSG && iPSC860 */

#if CONFIG_MACF
	(const struct mig_subsystem *)&security_subsystem,
#endif
};

void
mig_init(void)
{
    unsigned int i, n = sizeof(mig_e)/sizeof(const struct mig_subsystem *);
    int howmany;
    mach_msg_id_t j, pos, nentry, range;
	
    for (i = 0; i < n; i++) {
	range = mig_e[i]->end - mig_e[i]->start;
	if (!mig_e[i]->start || range < 0)
	    panic("the msgh_ids in mig_e[] aren't valid!");
	mig_reply_size = max(mig_reply_size, mig_e[i]->maxsize);

	for  (j = 0; j < range; j++) {
	  if (mig_e[i]->routine[j].stub_routine) { 
	    /* Only put real entries in the table */
	    nentry = j + mig_e[i]->start;	
	    for (pos = MIG_HASH(nentry) % MAX_MIG_ENTRIES, howmany = 1;
		 mig_buckets[pos].num;
		 pos++, pos = pos % MAX_MIG_ENTRIES, howmany++) {
	         if (mig_buckets[pos].num == nentry) {
		        printf("message id = %d\n", nentry);
		 	panic("multiple entries with the same msgh_id");
	         }
		 if (howmany == MAX_MIG_ENTRIES)
		       panic("the mig dispatch table is too small");
	    }
		
	    mig_buckets[pos].num = nentry;
	    mig_buckets[pos].routine = mig_e[i]->routine[j].stub_routine;
	    if (mig_e[i]->routine[j].max_reply_msg)
		    mig_buckets[pos].size = mig_e[i]->routine[j].max_reply_msg;
	    else
		    mig_buckets[pos].size = mig_e[i]->maxsize;

	    mig_table_max_displ = max(howmany, mig_table_max_displ);
	  }
	}
    }
    printf("mig_table_max_displ = %d\n", mig_table_max_displ);
}


/*
 *	Routine:	ipc_kobject_server
 *	Purpose:
 *		Handle a message sent to the kernel.
 *		Generates a reply message.
 *		Version for Untyped IPC.
 *	Conditions:
 *		Nothing locked.
 */

ipc_kmsg_t
ipc_kobject_server(
	ipc_kmsg_t	request)
{
	mach_msg_size_t reply_size;
	ipc_kmsg_t reply;
	kern_return_t kr;
	ipc_port_t *destp;
	mach_msg_format_0_trailer_t *trailer;
	register mig_hash_t *ptr;

	/*
	 * Find out corresponding mig_hash entry if any
	 */
	{
	    register int key = request->ikm_header->msgh_id;
	    register int i = MIG_HASH(key);
	    register int max_iter = mig_table_max_displ;
	
	    do
		ptr = &mig_buckets[i++ % MAX_MIG_ENTRIES];
	    while (key != ptr->num && ptr->num && --max_iter);

	    if (!ptr->routine || key != ptr->num) {
	        ptr = (mig_hash_t *)0;
		reply_size = mig_reply_size;
	    } else {
		reply_size = ptr->size;
#if	MACH_COUNTER
		ptr->callcount++;
#endif
	    }
	}

	/* round up for trailer size */
        reply_size += MAX_TRAILER_SIZE;
	reply = ipc_kmsg_alloc(reply_size);

	if (reply == IKM_NULL) {
		printf("ipc_kobject_server: dropping request\n");
		ipc_kmsg_destroy(request);
		return IKM_NULL;
	}

	/*
	 * Initialize reply message.
	 */
	{
#define	InP	((mach_msg_header_t *) request->ikm_header)
#define	OutP	((mig_reply_error_t *) reply->ikm_header)

	    OutP->NDR = NDR_record;
	    OutP->Head.msgh_size = sizeof(mig_reply_error_t);

	    OutP->Head.msgh_bits =
		MACH_MSGH_BITS(MACH_MSGH_BITS_LOCAL(InP->msgh_bits), 0);
	    OutP->Head.msgh_remote_port = InP->msgh_local_port;
	    OutP->Head.msgh_local_port  = MACH_PORT_NULL;
	    OutP->Head.msgh_id = InP->msgh_id + 100;

#undef	InP
#undef	OutP
	}

	/*
	 * Find the routine to call, and call it
	 * to perform the kernel function
	 */
	{
	    if (ptr) {	
		(*ptr->routine)(request->ikm_header, reply->ikm_header);
		kernel_task->messages_received++;
	    }
	    else {
		if (!ipc_kobject_notify(request->ikm_header, reply->ikm_header)){
#if	MACH_IPC_TEST
		    printf("ipc_kobject_server: bogus kernel message, id=%d\n",
			request->ikm_header->msgh_id);
#endif	/* MACH_IPC_TEST */
		    _MIG_MSGID_INVALID(request->ikm_header->msgh_id);

		    ((mig_reply_error_t *) reply->ikm_header)->RetCode
			= MIG_BAD_ID;
		}
		else
		  kernel_task->messages_received++;
	    }
	    kernel_task->messages_sent++;
	}

	/*
	 *	Destroy destination. The following code differs from
	 *	ipc_object_destroy in that we release the send-once
	 *	right instead of generating a send-once notification
	 * 	(which would bring us here again, creating a loop).
	 *	It also differs in that we only expect send or
	 *	send-once rights, never receive rights.
	 *
	 *	We set msgh_remote_port to IP_NULL so that the kmsg
	 *	destroy routines don't try to destroy the port twice.
	 */
	destp = (ipc_port_t *) &request->ikm_header->msgh_remote_port;
	switch (MACH_MSGH_BITS_REMOTE(request->ikm_header->msgh_bits)) {
		case MACH_MSG_TYPE_PORT_SEND:
		    ipc_port_release_send(*destp);
		    break;
		
		case MACH_MSG_TYPE_PORT_SEND_ONCE:
		    ipc_port_release_sonce(*destp);
		    break;
		
		default:
		    panic("ipc_kobject_server: strange destination rights");
	}
	*destp = IP_NULL;

        if (!(reply->ikm_header->msgh_bits & MACH_MSGH_BITS_COMPLEX) &&
           ((mig_reply_error_t *) reply->ikm_header)->RetCode != KERN_SUCCESS)
	 	kr = ((mig_reply_error_t *) reply->ikm_header)->RetCode;
	else
		kr = KERN_SUCCESS;

	if ((kr == KERN_SUCCESS) || (kr == MIG_NO_REPLY)) {
		/*
		 *	The server function is responsible for the contents
		 *	of the message.  The reply port right is moved
		 *	to the reply message, and we have deallocated
		 *	the destination port right, so we just need
		 *	to free the kmsg.
		 */
		ipc_kmsg_free(request);

	} else {
		/*
		 *	The message contents of the request are intact.
		 *	Destroy everthing except the reply port right,
		 *	which is needed in the reply message.
		 */
		request->ikm_header->msgh_local_port = MACH_PORT_NULL;
		ipc_kmsg_destroy(request);
	}

	if (kr == MIG_NO_REPLY) {
		/*
		 *	The server function will send a reply message
		 *	using the reply port right, which it has saved.
		 */

		ipc_kmsg_free(reply);

		return IKM_NULL;
	} else if (!IP_VALID((ipc_port_t)reply->ikm_header->msgh_remote_port)) {
		/*
		 *	Can't queue the reply message if the destination
		 *	(the reply port) isn't valid.
		 */

		ipc_kmsg_destroy(reply);

		return IKM_NULL;
	}

 	trailer = (mach_msg_format_0_trailer_t *)
		((vm_offset_t)reply->ikm_header + (int)reply->ikm_header->msgh_size);

 	trailer->msgh_sender = KERNEL_SECURITY_TOKEN;
 	trailer->msgh_trailer_type = MACH_MSG_TRAILER_FORMAT_0;
 	trailer->msgh_trailer_size = MACH_MSG_TRAILER_MINIMUM_SIZE;

	return reply;
}

/*
 *	Routine:	ipc_kobject_set
 *	Purpose:
 *		Make a port represent a kernel object of the given type.
 *		The caller is responsible for handling refs for the
 *		kernel object, if necessary.
 *	Conditions:
 *		Nothing locked.  The port must be active if setting
 *		a kobject linkage.  Clearing a linkage is OK on an
 *		inactive port.
 */
void
ipc_kobject_set(
	ipc_port_t			port,
	ipc_kobject_t		kobject,
	ipc_kobject_type_t	type)
{
	ip_lock(port);
	ipc_kobject_set_atomically(port, kobject, type);

#if CONFIG_MACF_MACH
	mac_port_label_update_kobject (&port->ip_label, type);
#endif

	ip_unlock(port);
}

void
ipc_kobject_set_atomically(
	ipc_port_t			port,
	ipc_kobject_t		kobject,
	ipc_kobject_type_t	type)
{
	assert(type == IKOT_NONE || ip_active(port));
#if	MACH_ASSERT
	port->ip_spares[2] = (port->ip_bits & IO_BITS_KOTYPE);
#endif	/* MACH_ASSERT */
	port->ip_bits = (port->ip_bits &~ IO_BITS_KOTYPE) | type;
	port->ip_kobject = kobject;
}

/*
 *	Routine:	ipc_kobject_destroy
 *	Purpose:
 *		Release any kernel object resources associated
 *		with the port, which is being destroyed.
 *
 *		This should only be needed when resources are
 *		associated with a user's port.  In the normal case,
 *		when the kernel is the receiver, the code calling
 *		ipc_port_dealloc_kernel should clean up the resources.
 *	Conditions:
 *		The port is not locked, but it is dead.
 */

void
ipc_kobject_destroy(
	ipc_port_t		port)
{
	switch (ip_kotype(port)) {

	case IKOT_TIMER:
		mk_timer_port_destroy(port);
		break;

	case IKOT_NAMED_ENTRY:
		mach_destroy_memory_entry(port);
		break;

	case IKOT_HOST_NOTIFY:
		host_notify_port_destroy(port);
		break;

#if CONFIG_MACF_MACH
	case IKOT_LABELH:
		labelh_destroy(port);
		break;
#endif

	default:
		break;
	}
}


boolean_t
ipc_kobject_notify(
	mach_msg_header_t *request_header,
	mach_msg_header_t *reply_header)
{
	ipc_port_t port = (ipc_port_t) request_header->msgh_remote_port;

	((mig_reply_error_t *) reply_header)->RetCode = MIG_NO_REPLY;
	switch (request_header->msgh_id) {
		case MACH_NOTIFY_NO_SENDERS:
		   if(ip_kotype(port) == IKOT_NAMED_ENTRY) {
			ip_lock(port);

			/*
			 * Bring the sequence number and mscount in
			 * line with ipc_port_destroy assertion.
			 */
			port->ip_mscount = 0;
			port->ip_messages.imq_seqno = 0;
			ipc_port_destroy(port); /* releases lock */
			return TRUE;
		   }
		   if (ip_kotype(port) == IKOT_UPL) {
			   upl_no_senders(
				request_header->msgh_remote_port, 
				(mach_port_mscount_t) 
				((mach_no_senders_notification_t *) 
				 request_header)->not_count);
			   reply_header->msgh_remote_port = MACH_PORT_NULL;
			   return TRUE;
		   }
#if	CONFIG_AUDIT
		   if (ip_kotype(port) == IKOT_AU_SESSIONPORT) {
			   audit_session_nosenders(request_header);
			   return TRUE;
		   }
#endif
#if CONFIG_EMBEDDED
		   if (ip_kotype(port) == IKOT_FILEPORT) {
			fileport_notify(request_header);
			return TRUE;
		   }
#endif

	  	   break;

		case MACH_NOTIFY_PORT_DELETED:
		case MACH_NOTIFY_PORT_DESTROYED:
		case MACH_NOTIFY_SEND_ONCE:
		case MACH_NOTIFY_DEAD_NAME:
		break;

		default:
		return FALSE;
	}
	switch (ip_kotype(port)) {

#ifdef IOKIT
		case IKOT_IOKIT_OBJECT:
		case IKOT_IOKIT_CONNECT:
		case IKOT_IOKIT_SPARE:
		{
                return iokit_notify(request_header);
		}
#endif
		default:
                return FALSE;
        }
}


#include <mach_kdb.h>
#if	MACH_COUNTERS && MACH_KDB

#include <ddb/db_output.h>
#include <ddb/db_sym.h>

#define printf  kdbprintf

extern void kobjserver_stats(void);
extern void bucket_stats_print(mig_hash_t *bucket);

extern void kobjserver_stats_clear(void);


void
kobjserver_stats_clear(void)
{
	int i;
	for (i = 0; i < MAX_MIG_ENTRIES; i++) {
		mig_buckets[i].callcount = 0;
	}
}

void
kobjserver_stats(void)
{
    register unsigned int i, n = sizeof(mig_e)/sizeof(struct mig_subsystem);
    register unsigned int howmany;
    register mach_msg_id_t j, pos, nentry, range;
	
    db_printf("Kobject server call counts:\n");
    for (i = 0; i < n; i++) {
	db_printf("  ");
	db_printsym((vm_offset_t)mig_e[i], DB_STGY_ANY);
	db_printf(":\n");
	range = mig_e[i]->end - mig_e[i]->start;
	if (!mig_e[i]->start || range < 0) continue;

	for  (j = 0; j < range; j++) {
	    nentry = j + mig_e[i]->start;	
	    for (pos = MIG_HASH(nentry) % MAX_MIG_ENTRIES, howmany = 1;
		 mig_buckets[pos].num;
		 pos++, pos = pos % MAX_MIG_ENTRIES, howmany++) {
		    if (mig_buckets[pos].num == nentry)
			bucket_stats_print(&mig_buckets[pos]);
	    }
	}
    }
}

void
bucket_stats_print(mig_hash_t *bucket)
{
	if (bucket->callcount) {
		db_printf("    ");
		db_printsym((vm_offset_t)bucket->routine, DB_STGY_ANY);
		db_printf(" (%d):\t%d\n", bucket->num, bucket->callcount);
	}
}


#endif	/* MACH_COUNTERS && MACH_KDB */
Commit	Line	Data
1c79356b	1	/*
b0d623f7	2	* Copyright (c) 2000-2008 Apple Inc. All rights reserved.
1c79356b	3	*
2d21ac55	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
1c79356b	5	*
2d21ac55 A	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
8f6c56a5	14	*
2d21ac55 A	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
8f6c56a5 A	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
8f6c56a5 A	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
2d21ac55 A	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
8f6c56a5	25	*
2d21ac55	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
1c79356b A	27	*/
	28	/*
	29	* @OSF_COPYRIGHT@
	30	*/
	31	/*
	32	* Mach Operating System
	33	* Copyright (c) 1991,1990,1989 Carnegie Mellon University
	34	* All Rights Reserved.
	35	*
	36	* Permission to use, copy, modify and distribute this software and its
	37	* documentation is hereby granted, provided that both the copyright
	38	* notice and this permission notice appear in all copies of the
	39	* software, derivative works or modified versions, and any portions
	40	* thereof, and that both notices appear in supporting documentation.
	41	*
	42	* CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
	43	* CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
	44	* ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
	45	*
	46	* Carnegie Mellon requests users of this software to return to
	47	*
	48	* Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU
	49	* School of Computer Science
	50	* Carnegie Mellon University
	51	* Pittsburgh PA 15213-3890
	52	*
	53	* any improvements or extensions that they make and grant Carnegie Mellon
	54	* the rights to redistribute these changes.
	55	*/
2d21ac55 A	56	/*
	57	* NOTICE: This file was modified by McAfee Research in 2004 to introduce
	58	* support for mandatory and extensible security protections. This notice
	59	* is included in support of clause 2.2 (b) of the Apple Public License,
	60	* Version 2.0.
	61	* Copyright (c) 2005 SPARTA, Inc.
	62	*/
1c79356b A	63	/*
	64	*/
	65	/*
	66	* File: kern/ipc_kobject.c
	67	* Author: Rich Draves
	68	* Date: 1989
	69	*
	70	* Functions for letting a port represent a kernel object.
	71	*/
	72
	73	#include <mach_debug.h>
	74	#include <mach_ipc_test.h>
	75	#include <mach_machine_routines.h>
	76	#include <norma_task.h>
	77	#include <mach_rt.h>
	78	#include <platforms.h>
	79
9bccf70c	80	#include <mach/mig.h>
1c79356b A	81	#include <mach/port.h>
	82	#include <mach/kern_return.h>
	83	#include <mach/message.h>
	84	#include <mach/mig_errors.h>
	85	#include <mach/notify.h>
91447636	86	#include <mach/ndr.h>
b0d623f7	87	#include <mach/vm_param.h>
91447636 A	88
	89	#include <mach/mach_vm_server.h>
	90	#include <mach/mach_port_server.h>
	91	#include <mach/mach_host_server.h>
	92	#include <mach/host_priv_server.h>
	93	#include <mach/host_security_server.h>
	94	#include <mach/clock_server.h>
	95	#include <mach/clock_priv_server.h>
	96	#include <mach/ledger_server.h>
	97	#include <mach/lock_set_server.h>
	98	#include <default_pager/default_pager_object_server.h>
	99	#include <mach/memory_object_server.h>
	100	#include <mach/memory_object_control_server.h>
	101	#include <mach/memory_object_default_server.h>
	102	#include <mach/memory_object_name_server.h>
	103	#include <mach/processor_server.h>
	104	#include <mach/processor_set_server.h>
91447636	105	#include <mach/task_server.h>
b0d623f7 A	106	#if VM32_SUPPORT
	107	#include <mach/vm32_map_server.h>
	108	#endif
91447636 A	109	#include <mach/thread_act_server.h>
	110
	111	#include <device/device_types.h>
	112	#include <device/device_server.h>
	113
	114	#include <UserNotification/UNDReplyServer.h>
	115
b0d623f7 A	116	#if CONFIG_AUDIT
	117	#include <kern/audit_sessionport.h>
	118	#endif
	119
91447636 A	120	#if MACH_MACHINE_ROUTINES
	121	#include <machine/machine_routines.h>
	122	#endif /* MACH_MACHINE_ROUTINES */
	123	#if XK_PROXY
	124	#include <uk_xkern/xk_uproxy_server.h>
	125	#endif /* XK_PROXY */
9bccf70c	126
91447636	127	#include <kern/ipc_tt.h>
1c79356b	128	#include <kern/ipc_mig.h>
d1ecb069	129	#include <kern/ipc_misc.h>
1c79356b	130	#include <kern/ipc_kobject.h>
55e303ae	131	#include <kern/host_notify.h>
1c79356b	132	#include <kern/mk_timer.h>
55e303ae	133	#include <kern/misc_protos.h>
1c79356b A	134	#include <ipc/ipc_kmsg.h>
1c79356b A	135	#include <ipc/ipc_port.h>
2d21ac55	136	#include <ipc/ipc_labelh.h>
1c79356b A	137	#include <kern/counters.h>
1c79356b A	138
91447636	139	#include <vm/vm_protos.h>
1c79356b	140
2d21ac55 A	141	#include <security/mac_mach_internal.h>
2d21ac55 A	142
1c79356b A	143	/*
	144	* Routine: ipc_kobject_notify
	145	* Purpose:
	146	* Deliver notifications to kobjects that care about them.
	147	*/
	148	boolean_t
	149	ipc_kobject_notify(
	150	mach_msg_header_t *request_header,
	151	mach_msg_header_t *reply_header);
	152
1c79356b A	153	typedef struct {
	154	mach_msg_id_t num;
	155	mig_routine_t routine;
	156	int size;
	157	#if MACH_COUNTERS
	158	mach_counter_t callcount;
	159	#endif
	160	} mig_hash_t;
	161
	162	#define MAX_MIG_ENTRIES 1024
	163	#define MIG_HASH(x) (x)
	164
	165	#ifndef max
	166	#define max(a,b) (((a) > (b)) ? (a) : (b))
	167	#endif /* max */
	168
	169	mig_hash_t mig_buckets[MAX_MIG_ENTRIES];
	170	int mig_table_max_displ;
	171	mach_msg_size_t mig_reply_size;
	172
2d21ac55 A	173	#if CONFIG_MACF
	174	#include <mach/security_server.h>
	175	#endif
1c79356b	176
1c79356b A	177
1c79356b A	178
91447636 A	179	const struct mig_subsystem *mig_e[] = {
	180	(const struct mig_subsystem *)&mach_vm_subsystem,
	181	(const struct mig_subsystem *)&mach_port_subsystem,
	182	(const struct mig_subsystem *)&mach_host_subsystem,
	183	(const struct mig_subsystem *)&host_priv_subsystem,
	184	(const struct mig_subsystem *)&host_security_subsystem,
	185	(const struct mig_subsystem *)&clock_subsystem,
	186	(const struct mig_subsystem *)&clock_priv_subsystem,
	187	(const struct mig_subsystem *)&processor_subsystem,
	188	(const struct mig_subsystem *)&processor_set_subsystem,
	189	(const struct mig_subsystem *)&is_iokit_subsystem,
	190	(const struct mig_subsystem *)&memory_object_name_subsystem,
	191	(const struct mig_subsystem *)&lock_set_subsystem,
	192	(const struct mig_subsystem *)&ledger_subsystem,
91447636 A	193	(const struct mig_subsystem *)&task_subsystem,
91447636 A	194	(const struct mig_subsystem *)&thread_act_subsystem,
b0d623f7 A	195	#if VM32_SUPPORT
	196	(const struct mig_subsystem *)&vm32_map_subsystem,
	197	#endif
91447636 A	198	(const struct mig_subsystem *)&UNDReply_subsystem,
91447636 A	199	(const struct mig_subsystem *)&default_pager_object_subsystem,
1c79356b A	200
1c79356b A	201	#if XK_PROXY
91447636	202	(const struct mig_subsystem *)&do_uproxy_xk_uproxy_subsystem,
1c79356b A	203	#endif /* XK_PROXY */
1c79356b A	204	#if MACH_MACHINE_ROUTINES
91447636	205	(const struct mig_subsystem *)&MACHINE_SUBSYSTEM,
1c79356b A	206	#endif /* MACH_MACHINE_ROUTINES */
1c79356b A	207	#if MCMSG && iPSC860
91447636	208	(const struct mig_subsystem *)&mcmsg_info_subsystem,
1c79356b	209	#endif /* MCMSG && iPSC860 */
2d21ac55 A	210
	211	#if CONFIG_MACF
	212	(const struct mig_subsystem *)&security_subsystem,
	213	#endif
1c79356b A	214	};
	215
	216	void
	217	mig_init(void)
	218	{
91447636 A	219	unsigned int i, n = sizeof(mig_e)/sizeof(const struct mig_subsystem *);
	220	int howmany;
	221	mach_msg_id_t j, pos, nentry, range;
1c79356b A	222
	223	for (i = 0; i < n; i++) {
	224	range = mig_e[i]->end - mig_e[i]->start;
	225	if (!mig_e[i]->start \|\| range < 0)
	226	panic("the msgh_ids in mig_e[] aren't valid!");
	227	mig_reply_size = max(mig_reply_size, mig_e[i]->maxsize);
	228
	229	for (j = 0; j < range; j++) {
	230	if (mig_e[i]->routine[j].stub_routine) {
	231	/* Only put real entries in the table */
	232	nentry = j + mig_e[i]->start;
	233	for (pos = MIG_HASH(nentry) % MAX_MIG_ENTRIES, howmany = 1;
	234	mig_buckets[pos].num;
2d21ac55	235	pos++, pos = pos % MAX_MIG_ENTRIES, howmany++) {
1c79356b A	236	if (mig_buckets[pos].num == nentry) {
	237	printf("message id = %d\n", nentry);
	238	panic("multiple entries with the same msgh_id");
	239	}
	240	if (howmany == MAX_MIG_ENTRIES)
	241	panic("the mig dispatch table is too small");
	242	}
	243
	244	mig_buckets[pos].num = nentry;
	245	mig_buckets[pos].routine = mig_e[i]->routine[j].stub_routine;
	246	if (mig_e[i]->routine[j].max_reply_msg)
	247	mig_buckets[pos].size = mig_e[i]->routine[j].max_reply_msg;
	248	else
	249	mig_buckets[pos].size = mig_e[i]->maxsize;
	250
	251	mig_table_max_displ = max(howmany, mig_table_max_displ);
	252	}
	253	}
	254	}
0b4e3aa0	255	printf("mig_table_max_displ = %d\n", mig_table_max_displ);
1c79356b A	256	}
	257
	258
	259	/*
	260	* Routine: ipc_kobject_server
	261	* Purpose:
	262	* Handle a message sent to the kernel.
	263	* Generates a reply message.
	264	* Version for Untyped IPC.
	265	* Conditions:
	266	* Nothing locked.
	267	*/
	268
	269	ipc_kmsg_t
	270	ipc_kobject_server(
	271	ipc_kmsg_t request)
	272	{
	273	mach_msg_size_t reply_size;
	274	ipc_kmsg_t reply;
	275	kern_return_t kr;
1c79356b A	276	ipc_port_t *destp;
	277	mach_msg_format_0_trailer_t *trailer;
	278	register mig_hash_t *ptr;
91447636	279
1c79356b	280	/*
91447636 A	281	* Find out corresponding mig_hash entry if any
91447636 A	282	*/
1c79356b	283	{
91447636	284	register int key = request->ikm_header->msgh_id;
1c79356b A	285	register int i = MIG_HASH(key);
	286	register int max_iter = mig_table_max_displ;
	287
	288	do
	289	ptr = &mig_buckets[i++ % MAX_MIG_ENTRIES];
	290	while (key != ptr->num && ptr->num && --max_iter);
	291
	292	if (!ptr->routine \|\| key != ptr->num) {
	293	ptr = (mig_hash_t *)0;
	294	reply_size = mig_reply_size;
	295	} else {
	296	reply_size = ptr->size;
	297	#if MACH_COUNTER
	298	ptr->callcount++;
	299	#endif
	300	}
	301	}
	302
	303	/* round up for trailer size */
	304	reply_size += MAX_TRAILER_SIZE;
	305	reply = ipc_kmsg_alloc(reply_size);
	306
	307	if (reply == IKM_NULL) {
	308	printf("ipc_kobject_server: dropping request\n");
	309	ipc_kmsg_destroy(request);
	310	return IKM_NULL;
	311	}
	312
	313	/*
	314	* Initialize reply message.
	315	*/
	316	{
91447636 A	317	#define InP ((mach_msg_header_t *) request->ikm_header)
91447636 A	318	#define OutP ((mig_reply_error_t *) reply->ikm_header)
1c79356b A	319
	320	OutP->NDR = NDR_record;
	321	OutP->Head.msgh_size = sizeof(mig_reply_error_t);
	322
	323	OutP->Head.msgh_bits =
	324	MACH_MSGH_BITS(MACH_MSGH_BITS_LOCAL(InP->msgh_bits), 0);
	325	OutP->Head.msgh_remote_port = InP->msgh_local_port;
	326	OutP->Head.msgh_local_port = MACH_PORT_NULL;
	327	OutP->Head.msgh_id = InP->msgh_id + 100;
	328
	329	#undef InP
	330	#undef OutP
	331	}
	332
	333	/*
	334	* Find the routine to call, and call it
	335	* to perform the kernel function
	336	*/
	337	{
	338	if (ptr) {
91447636	339	(*ptr->routine)(request->ikm_header, reply->ikm_header);
1c79356b A	340	kernel_task->messages_received++;
	341	}
	342	else {
91447636	343	if (!ipc_kobject_notify(request->ikm_header, reply->ikm_header)){
1c79356b A	344	#if MACH_IPC_TEST
1c79356b A	345	printf("ipc_kobject_server: bogus kernel message, id=%d\n",
91447636	346	request->ikm_header->msgh_id);
1c79356b	347	#endif /* MACH_IPC_TEST */
91447636	348	_MIG_MSGID_INVALID(request->ikm_header->msgh_id);
1c79356b	349
91447636	350	((mig_reply_error_t *) reply->ikm_header)->RetCode
1c79356b A	351	= MIG_BAD_ID;
	352	}
	353	else
	354	kernel_task->messages_received++;
	355	}
	356	kernel_task->messages_sent++;
	357	}
	358
	359	/*
	360	* Destroy destination. The following code differs from
	361	* ipc_object_destroy in that we release the send-once
	362	* right instead of generating a send-once notification
	363	* (which would bring us here again, creating a loop).
	364	* It also differs in that we only expect send or
	365	* send-once rights, never receive rights.
	366	*
	367	* We set msgh_remote_port to IP_NULL so that the kmsg
	368	* destroy routines don't try to destroy the port twice.
	369	*/
91447636 A	370	destp = (ipc_port_t *) &request->ikm_header->msgh_remote_port;
91447636 A	371	switch (MACH_MSGH_BITS_REMOTE(request->ikm_header->msgh_bits)) {
1c79356b A	372	case MACH_MSG_TYPE_PORT_SEND:
	373	ipc_port_release_send(*destp);
	374	break;
	375
	376	case MACH_MSG_TYPE_PORT_SEND_ONCE:
	377	ipc_port_release_sonce(*destp);
	378	break;
	379
	380	default:
9bccf70c	381	panic("ipc_kobject_server: strange destination rights");
1c79356b A	382	}
	383	*destp = IP_NULL;
	384
91447636 A	385	if (!(reply->ikm_header->msgh_bits & MACH_MSGH_BITS_COMPLEX) &&
	386	((mig_reply_error_t *) reply->ikm_header)->RetCode != KERN_SUCCESS)
	387	kr = ((mig_reply_error_t *) reply->ikm_header)->RetCode;
1c79356b A	388	else
	389	kr = KERN_SUCCESS;
	390
	391	if ((kr == KERN_SUCCESS) \|\| (kr == MIG_NO_REPLY)) {
	392	/*
	393	* The server function is responsible for the contents
	394	* of the message. The reply port right is moved
	395	* to the reply message, and we have deallocated
	396	* the destination port right, so we just need
	397	* to free the kmsg.
	398	*/
	399	ipc_kmsg_free(request);
	400
	401	} else {
	402	/*
	403	* The message contents of the request are intact.
	404	* Destroy everthing except the reply port right,
	405	* which is needed in the reply message.
	406	*/
91447636	407	request->ikm_header->msgh_local_port = MACH_PORT_NULL;
1c79356b A	408	ipc_kmsg_destroy(request);
	409	}
	410
	411	if (kr == MIG_NO_REPLY) {
	412	/*
	413	* The server function will send a reply message
	414	* using the reply port right, which it has saved.
	415	*/
	416
	417	ipc_kmsg_free(reply);
	418
1c79356b	419	return IKM_NULL;
91447636	420	} else if (!IP_VALID((ipc_port_t)reply->ikm_header->msgh_remote_port)) {
1c79356b A	421	/*
	422	* Can't queue the reply message if the destination
	423	* (the reply port) isn't valid.
	424	*/
	425
	426	ipc_kmsg_destroy(reply);
	427
1c79356b A	428	return IKM_NULL;
	429	}
	430
	431	trailer = (mach_msg_format_0_trailer_t *)
91447636 A	432	((vm_offset_t)reply->ikm_header + (int)reply->ikm_header->msgh_size);
91447636 A	433
1c79356b A	434	trailer->msgh_sender = KERNEL_SECURITY_TOKEN;
	435	trailer->msgh_trailer_type = MACH_MSG_TRAILER_FORMAT_0;
	436	trailer->msgh_trailer_size = MACH_MSG_TRAILER_MINIMUM_SIZE;
	437
1c79356b A	438	return reply;
	439	}
	440
	441	/*
	442	* Routine: ipc_kobject_set
	443	* Purpose:
	444	* Make a port represent a kernel object of the given type.
	445	* The caller is responsible for handling refs for the
	446	* kernel object, if necessary.
	447	* Conditions:
	448	* Nothing locked. The port must be active if setting
	449	* a kobject linkage. Clearing a linkage is OK on an
	450	* inactive port.
	451	*/
	452	void
	453	ipc_kobject_set(
	454	ipc_port_t port,
	455	ipc_kobject_t kobject,
	456	ipc_kobject_type_t type)
	457	{
	458	ip_lock(port);
	459	ipc_kobject_set_atomically(port, kobject, type);
2d21ac55 A	460
	461	#if CONFIG_MACF_MACH
	462	mac_port_label_update_kobject (&port->ip_label, type);
	463	#endif
	464
1c79356b A	465	ip_unlock(port);
	466	}
	467
	468	void
	469	ipc_kobject_set_atomically(
	470	ipc_port_t port,
	471	ipc_kobject_t kobject,
	472	ipc_kobject_type_t type)
	473	{
	474	assert(type == IKOT_NONE \|\| ip_active(port));
	475	#if MACH_ASSERT
	476	port->ip_spares[2] = (port->ip_bits & IO_BITS_KOTYPE);
	477	#endif /* MACH_ASSERT */
	478	port->ip_bits = (port->ip_bits &~ IO_BITS_KOTYPE) \| type;
	479	port->ip_kobject = kobject;
	480	}
	481
	482	/*
	483	* Routine: ipc_kobject_destroy
	484	* Purpose:
	485	* Release any kernel object resources associated
	486	* with the port, which is being destroyed.
	487	*
	488	* This should only be needed when resources are
	489	* associated with a user's port. In the normal case,
	490	* when the kernel is the receiver, the code calling
	491	* ipc_port_dealloc_kernel should clean up the resources.
	492	* Conditions:
	493	* The port is not locked, but it is dead.
	494	*/
	495
	496	void
	497	ipc_kobject_destroy(
	498	ipc_port_t port)
	499	{
	500	switch (ip_kotype(port)) {
	501
	502	case IKOT_TIMER:
	503	mk_timer_port_destroy(port);
	504	break;
	505
	506	case IKOT_NAMED_ENTRY:
	507	mach_destroy_memory_entry(port);
	508	break;
	509
55e303ae A	510	case IKOT_HOST_NOTIFY:
	511	host_notify_port_destroy(port);
	512	break;
	513
2d21ac55 A	514	#if CONFIG_MACF_MACH
	515	case IKOT_LABELH:
	516	labelh_destroy(port);
	517	break;
	518	#endif
	519
55e303ae	520	default:
1c79356b A	521	break;
	522	}
	523	}
	524
	525
1c79356b A	526	boolean_t
	527	ipc_kobject_notify(
	528	mach_msg_header_t *request_header,
	529	mach_msg_header_t *reply_header)
	530	{
	531	ipc_port_t port = (ipc_port_t) request_header->msgh_remote_port;
1c79356b A	532
	533	((mig_reply_error_t *) reply_header)->RetCode = MIG_NO_REPLY;
	534	switch (request_header->msgh_id) {
	535	case MACH_NOTIFY_NO_SENDERS:
	536	if(ip_kotype(port) == IKOT_NAMED_ENTRY) {
	537	ip_lock(port);
	538
	539	/*
	540	* Bring the sequence number and mscount in
	541	* line with ipc_port_destroy assertion.
	542	*/
	543	port->ip_mscount = 0;
	544	port->ip_messages.imq_seqno = 0;
	545	ipc_port_destroy(port); /* releases lock */
	546	return TRUE;
	547	}
0b4e3aa0 A	548	if (ip_kotype(port) == IKOT_UPL) {
0b4e3aa0 A	549	upl_no_senders(
91447636	550	request_header->msgh_remote_port,
0b4e3aa0 A	551	(mach_port_mscount_t)
	552	((mach_no_senders_notification_t *)
	553	request_header)->not_count);
2d21ac55	554	reply_header->msgh_remote_port = MACH_PORT_NULL;
0b4e3aa0	555	return TRUE;
1c79356b	556	}
b0d623f7 A	557	#if CONFIG_AUDIT
	558	if (ip_kotype(port) == IKOT_AU_SESSIONPORT) {
	559	audit_session_nosenders(request_header);
	560	return TRUE;
	561	}
	562	#endif
d1ecb069 A	563	#if CONFIG_EMBEDDED
	564	if (ip_kotype(port) == IKOT_FILEPORT) {
	565	fileport_notify(request_header);
	566	return TRUE;
	567	}
	568	#endif
b0d623f7	569
1c79356b	570	break;
0b4e3aa0	571
1c79356b A	572	case MACH_NOTIFY_PORT_DELETED:
	573	case MACH_NOTIFY_PORT_DESTROYED:
	574	case MACH_NOTIFY_SEND_ONCE:
	575	case MACH_NOTIFY_DEAD_NAME:
	576	break;
	577
	578	default:
	579	return FALSE;
	580	}
	581	switch (ip_kotype(port)) {
	582
	583	#ifdef IOKIT
	584	case IKOT_IOKIT_OBJECT:
	585	case IKOT_IOKIT_CONNECT:
	586	case IKOT_IOKIT_SPARE:
	587	{
1c79356b A	588	return iokit_notify(request_header);
	589	}
	590	#endif
	591	default:
	592	return FALSE;
	593	}
	594	}
	595
	596
	597
	598	#include <mach_kdb.h>
	599	#if MACH_COUNTERS && MACH_KDB
	600
	601	#include <ddb/db_output.h>
	602	#include <ddb/db_sym.h>
	603
	604	#define printf kdbprintf
	605
	606	extern void kobjserver_stats(void);
	607	extern void bucket_stats_print(mig_hash_t *bucket);
	608
	609	extern void kobjserver_stats_clear(void);
	610
	611
	612	void
	613	kobjserver_stats_clear(void)
	614	{
	615	int i;
	616	for (i = 0; i < MAX_MIG_ENTRIES; i++) {
	617	mig_buckets[i].callcount = 0;
	618	}
	619	}
	620
	621	void
	622	kobjserver_stats(void)
	623	{
91447636	624	register unsigned int i, n = sizeof(mig_e)/sizeof(struct mig_subsystem);
1c79356b A	625	register unsigned int howmany;
	626	register mach_msg_id_t j, pos, nentry, range;
	627
	628	db_printf("Kobject server call counts:\n");
	629	for (i = 0; i < n; i++) {
	630	db_printf(" ");
	631	db_printsym((vm_offset_t)mig_e[i], DB_STGY_ANY);
	632	db_printf(":\n");
	633	range = mig_e[i]->end - mig_e[i]->start;
	634	if (!mig_e[i]->start \|\| range < 0) continue;
	635
	636	for (j = 0; j < range; j++) {
	637	nentry = j + mig_e[i]->start;
	638	for (pos = MIG_HASH(nentry) % MAX_MIG_ENTRIES, howmany = 1;
	639	mig_buckets[pos].num;
2d21ac55	640	pos++, pos = pos % MAX_MIG_ENTRIES, howmany++) {
1c79356b A	641	if (mig_buckets[pos].num == nentry)
	642	bucket_stats_print(&mig_buckets[pos]);
	643	}
	644	}
	645	}
	646	}
	647
	648	void
	649	bucket_stats_print(mig_hash_t *bucket)
	650	{
	651	if (bucket->callcount) {
	652	db_printf(" ");
	653	db_printsym((vm_offset_t)bucket->routine, DB_STGY_ANY);
	654	db_printf(" (%d):\t%d\n", bucket->num, bucket->callcount);
	655	}
	656	}
	657
	658
	659	#endif /* MACH_COUNTERS && MACH_KDB */