]> git.saurik.com Git - apple/xnu.git/blob - osfmk/ipc/ipc_space.c
xnu-6153.61.1.tar.gz
[apple/xnu.git] / osfmk / ipc / ipc_space.c
1 /*
2 * Copyright (c) 2000-2004 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * @OSF_COPYRIGHT@
30 */
31 /*
32 * Mach Operating System
33 * Copyright (c) 1991,1990,1989 Carnegie Mellon University
34 * All Rights Reserved.
35 *
36 * Permission to use, copy, modify and distribute this software and its
37 * documentation is hereby granted, provided that both the copyright
38 * notice and this permission notice appear in all copies of the
39 * software, derivative works or modified versions, and any portions
40 * thereof, and that both notices appear in supporting documentation.
41 *
42 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
45 *
46 * Carnegie Mellon requests users of this software to return to
47 *
48 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU
49 * School of Computer Science
50 * Carnegie Mellon University
51 * Pittsburgh PA 15213-3890
52 *
53 * any improvements or extensions that they make and grant Carnegie Mellon
54 * the rights to redistribute these changes.
55 */
56 /*
57 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
58 * support for mandatory and extensible security protections. This notice
59 * is included in support of clause 2.2 (b) of the Apple Public License,
60 * Version 2.0.
61 */
62 /*
63 */
64 /*
65 * File: ipc/ipc_space.c
66 * Author: Rich Draves
67 * Date: 1989
68 *
69 * Functions to manipulate IPC capability spaces.
70 */
71
72 #include <mach/boolean.h>
73 #include <mach/kern_return.h>
74 #include <mach/port.h>
75 #include <kern/assert.h>
76 #include <kern/sched_prim.h>
77 #include <kern/zalloc.h>
78 #include <ipc/port.h>
79 #include <ipc/ipc_entry.h>
80 #include <ipc/ipc_object.h>
81 #include <ipc/ipc_hash.h>
82 #include <ipc/ipc_table.h>
83 #include <ipc/ipc_port.h>
84 #include <ipc/ipc_space.h>
85 #include <ipc/ipc_right.h>
86 #include <prng/random.h>
87 #include <string.h>
88
89 /* Remove this in the future so port names are less predictable. */
90 #define CONFIG_SEMI_RANDOM_ENTRIES
91 #ifdef CONFIG_SEMI_RANDOM_ENTRIES
92 #define NUM_SEQ_ENTRIES 8
93 #endif
94
95 zone_t ipc_space_zone;
96 ipc_space_t ipc_space_kernel;
97 ipc_space_t ipc_space_reply;
98
99 /*
100 * Routine: ipc_space_reference
101 * Routine: ipc_space_release
102 * Purpose:
103 * Function versions of the IPC space inline reference.
104 */
105
106 void
107 ipc_space_reference(
108 ipc_space_t space)
109 {
110 is_reference(space);
111 }
112
113 void
114 ipc_space_release(
115 ipc_space_t space)
116 {
117 is_release(space);
118 }
119
120 /* Routine: ipc_space_get_rollpoint
121 * Purpose:
122 * Generate a new gencount rollover point from a space's entropy pool
123 */
124 ipc_entry_bits_t
125 ipc_space_get_rollpoint(
126 ipc_space_t space)
127 {
128 return random_bool_gen_bits(
129 &space->bool_gen,
130 &space->is_entropy[0],
131 IS_ENTROPY_CNT,
132 IE_BITS_ROLL_BITS);
133 }
134
135 /*
136 * Routine: ipc_entry_rand_freelist
137 * Purpose:
138 * Pseudo-randomly permute the order of entries in an IPC space
139 * Arguments:
140 * space: the ipc space to initialize.
141 * table: the corresponding ipc table to initialize.
142 * bottom: the start of the range to initialize (inclusive).
143 * top: the end of the range to initialize (noninclusive).
144 */
145 void
146 ipc_space_rand_freelist(
147 ipc_space_t space,
148 ipc_entry_t table,
149 mach_port_index_t bottom,
150 mach_port_index_t top)
151 {
152 int at_start = (bottom == 0);
153 #ifdef CONFIG_SEMI_RANDOM_ENTRIES
154 /*
155 * Only make sequential entries at the start of the table, and not when
156 * we're growing the space.
157 */
158 ipc_entry_num_t total = 0;
159 #endif
160
161 /* First entry in the free list is always free, and is the start of the free list. */
162 mach_port_index_t curr = bottom;
163 bottom++;
164 top--;
165
166 /*
167 * Initialize the free list in the table.
168 * Add the entries in pseudo-random order and randomly set the generation
169 * number, in order to frustrate attacks involving port name reuse.
170 */
171 while (bottom <= top) {
172 ipc_entry_t entry = &table[curr];
173 int which;
174 #ifdef CONFIG_SEMI_RANDOM_ENTRIES
175 /*
176 * XXX: This is a horrible hack to make sure that randomizing the port
177 * doesn't break programs that might have (sad) hard-coded values for
178 * certain port names.
179 */
180 if (at_start && total++ < NUM_SEQ_ENTRIES) {
181 which = 0;
182 } else
183 #endif
184 which = random_bool_gen_bits(
185 &space->bool_gen,
186 &space->is_entropy[0],
187 IS_ENTROPY_CNT,
188 1);
189
190 mach_port_index_t next;
191 if (which) {
192 next = top;
193 top--;
194 } else {
195 next = bottom;
196 bottom++;
197 }
198
199 /*
200 * The entry's gencount will roll over on its first allocation, at which
201 * point a random rollover will be set for the entry.
202 */
203 entry->ie_bits = IE_BITS_GEN_MASK;
204 entry->ie_next = next;
205 entry->ie_object = IO_NULL;
206 entry->ie_dist = 0;
207 entry->ie_index = 0;
208 curr = next;
209 }
210 table[curr].ie_next = 0;
211 table[curr].ie_object = IO_NULL;
212 table[curr].ie_index = 0;
213 table[curr].ie_dist = 0;
214 table[curr].ie_bits = IE_BITS_GEN_MASK;
215
216 /* The freelist head should always have generation number set to 0 */
217 if (at_start) {
218 table[0].ie_bits = 0;
219 }
220 }
221
222
223 /*
224 * Routine: ipc_space_create
225 * Purpose:
226 * Creates a new IPC space.
227 *
228 * The new space has two references, one for the caller
229 * and one because it is active.
230 * Conditions:
231 * Nothing locked. Allocates memory.
232 * Returns:
233 * KERN_SUCCESS Created a space.
234 * KERN_RESOURCE_SHORTAGE Couldn't allocate memory.
235 */
236
237 kern_return_t
238 ipc_space_create(
239 ipc_table_size_t initial,
240 ipc_space_t *spacep)
241 {
242 ipc_space_t space;
243 ipc_entry_t table;
244 ipc_entry_num_t new_size;
245
246 space = is_alloc();
247 if (space == IS_NULL) {
248 return KERN_RESOURCE_SHORTAGE;
249 }
250
251 table = it_entries_alloc(initial);
252 if (table == IE_NULL) {
253 is_free(space);
254 return KERN_RESOURCE_SHORTAGE;
255 }
256
257 new_size = initial->its_size;
258 memset((void *) table, 0, new_size * sizeof(struct ipc_entry));
259
260 /* Set to 0 so entropy pool refills */
261 memset((void *) space->is_entropy, 0, sizeof(space->is_entropy));
262
263 random_bool_init(&space->bool_gen);
264 ipc_space_rand_freelist(space, table, 0, new_size);
265
266 is_lock_init(space);
267 space->is_bits = 2; /* 2 refs, active, not growing */
268 space->is_table_hashed = 0;
269 space->is_table_size = new_size;
270 space->is_table_free = new_size - 1;
271 space->is_table = table;
272 space->is_table_next = initial + 1;
273 space->is_task = NULL;
274 space->is_low_mod = new_size;
275 space->is_high_mod = 0;
276 space->is_node_id = HOST_LOCAL_NODE; /* HOST_LOCAL_NODE, except proxy spaces */
277
278 *spacep = space;
279 return KERN_SUCCESS;
280 }
281
282 /*
283 * Routine: ipc_space_create_special
284 * Purpose:
285 * Create a special space. A special space
286 * doesn't hold rights in the normal way.
287 * Instead it is place-holder for holding
288 * disembodied (naked) receive rights.
289 * See ipc_port_alloc_special/ipc_port_dealloc_special.
290 * Conditions:
291 * Nothing locked.
292 * Returns:
293 * KERN_SUCCESS Created a space.
294 * KERN_RESOURCE_SHORTAGE Couldn't allocate memory.
295 */
296
297 kern_return_t
298 ipc_space_create_special(
299 ipc_space_t *spacep)
300 {
301 ipc_space_t space;
302
303 space = is_alloc();
304 if (space == IS_NULL) {
305 return KERN_RESOURCE_SHORTAGE;
306 }
307
308 is_lock_init(space);
309
310 space->is_bits = IS_INACTIVE | 1; /* 1 ref, not active, not growing */
311 space->is_table = IE_NULL;
312 space->is_task = TASK_NULL;
313 space->is_table_next = 0;
314 space->is_low_mod = 0;
315 space->is_high_mod = 0;
316 space->is_node_id = HOST_LOCAL_NODE; /* HOST_LOCAL_NODE, except proxy spaces */
317
318 *spacep = space;
319 return KERN_SUCCESS;
320 }
321
322 /*
323 * ipc_space_clean - remove all port references from an ipc space.
324 *
325 * In order to follow the traditional semantic, ipc_space_destroy
326 * will not destroy the entire port table of a shared space. Instead
327 * it will simply clear its own sub-space.
328 */
329 void
330 ipc_space_clean(
331 ipc_space_t space)
332 {
333 ipc_entry_t table;
334 ipc_entry_num_t size;
335 mach_port_index_t index;
336
337 /*
338 * If somebody is trying to grow the table,
339 * we must wait until they finish and figure
340 * out the space died.
341 */
342 retry:
343 is_write_lock(space);
344 while (is_growing(space)) {
345 is_write_sleep(space);
346 }
347
348 if (!is_active(space)) {
349 is_write_unlock(space);
350 return;
351 }
352
353 /*
354 * Now we can futz with it since we have the write lock.
355 */
356
357 table = space->is_table;
358 size = space->is_table_size;
359
360 for (index = 0; index < size; index++) {
361 ipc_entry_t entry = &table[index];
362 mach_port_type_t type;
363
364 type = IE_BITS_TYPE(entry->ie_bits);
365 if (type != MACH_PORT_TYPE_NONE) {
366 mach_port_name_t name = MACH_PORT_MAKE(index,
367 IE_BITS_GEN(entry->ie_bits));
368 ipc_right_destroy(space, name, entry, FALSE, 0); /* unlocks space */
369 goto retry;
370 }
371 }
372
373 /*
374 * JMM - Now the table is cleaned out. We don't bother shrinking the
375 * size of the table at this point, but we probably should if it is
376 * really large.
377 */
378
379 is_write_unlock(space);
380 }
381
382
383 /*
384 * Routine: ipc_space_terminate
385 * Purpose:
386 * Marks the space as dead and cleans up the entries.
387 * Does nothing if the space is already dead.
388 * Conditions:
389 * Nothing locked.
390 */
391
392 void
393 ipc_space_terminate(
394 ipc_space_t space)
395 {
396 ipc_entry_t table;
397 ipc_entry_num_t size;
398 mach_port_index_t index;
399
400 assert(space != IS_NULL);
401
402 is_write_lock(space);
403 if (!is_active(space)) {
404 is_write_unlock(space);
405 return;
406 }
407 is_mark_inactive(space);
408
409 /*
410 * If somebody is trying to grow the table,
411 * we must wait until they finish and figure
412 * out the space died.
413 */
414 while (is_growing(space)) {
415 is_write_sleep(space);
416 }
417
418 is_write_unlock(space);
419
420
421 /*
422 * Now we can futz with it unlocked.
423 */
424
425 table = space->is_table;
426 size = space->is_table_size;
427
428 for (index = 0; index < size; index++) {
429 ipc_entry_t entry = &table[index];
430 mach_port_type_t type;
431
432 type = IE_BITS_TYPE(entry->ie_bits);
433 if (type != MACH_PORT_TYPE_NONE) {
434 mach_port_name_t name;
435
436 name = MACH_PORT_MAKE(index,
437 IE_BITS_GEN(entry->ie_bits));
438 ipc_right_terminate(space, name, entry);
439 }
440 }
441
442 it_entries_free(space->is_table_next - 1, table);
443 space->is_table_size = 0;
444 space->is_table_free = 0;
445
446 /*
447 * Because the space is now dead,
448 * we must release the "active" reference for it.
449 * Our caller still has his reference.
450 */
451 is_release(space);
452 }