osfmk/ipc/ipc_space.c

   1 /*
   2  * Copyright (c) 2000-2004 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * @OSF_COPYRIGHT@
  30  */
  31 /*
  32  * Mach Operating System
  33  * Copyright (c) 1991,1990,1989 Carnegie Mellon University
  34  * All Rights Reserved.
  35  *
  36  * Permission to use, copy, modify and distribute this software and its
  37  * documentation is hereby granted, provided that both the copyright
  38  * notice and this permission notice appear in all copies of the
  39  * software, derivative works or modified versions, and any portions
  40  * thereof, and that both notices appear in supporting documentation.
  41  *
  42  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
  43  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
  44  * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
  45  *
  46  * Carnegie Mellon requests users of this software to return to
  47  *
  48  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
  49  *  School of Computer Science
  50  *  Carnegie Mellon University
  51  *  Pittsburgh PA 15213-3890
  52  *
  53  * any improvements or extensions that they make and grant Carnegie Mellon
  54  * the rights to redistribute these changes.
  55  */
  56 /*
  57  * NOTICE: This file was modified by McAfee Research in 2004 to introduce
  58  * support for mandatory and extensible security protections.  This notice
  59  * is included in support of clause 2.2 (b) of the Apple Public License,
  60  * Version 2.0.
  61  */
  62 /*
  63  */
  64 /*
  65  *      File:   ipc/ipc_space.c
  66  *      Author: Rich Draves
  67  *      Date:   1989
  68  *
  69  *      Functions to manipulate IPC capability spaces.
  70  */
  71
  72 #include <mach/boolean.h>
  73 #include <mach/kern_return.h>
  74 #include <mach/port.h>
  75 #include <kern/assert.h>
  76 #include <kern/sched_prim.h>
  77 #include <kern/zalloc.h>
  78 #include <ipc/port.h>
  79 #include <ipc/ipc_entry.h>
  80 #include <ipc/ipc_object.h>
  81 #include <ipc/ipc_hash.h>
  82 #include <ipc/ipc_table.h>
  83 #include <ipc/ipc_port.h>
  84 #include <ipc/ipc_space.h>
  85 #include <ipc/ipc_right.h>
  86 #include <prng/random.h>
  87 #include <string.h>
  88
  89 /* Remove this in the future so port names are less predictable. */
  90 #define CONFIG_SEMI_RANDOM_ENTRIES
  91 #ifdef CONFIG_SEMI_RANDOM_ENTRIES
  92 #define NUM_SEQ_ENTRIES 8
  93 #endif
  94
  95 zone_t ipc_space_zone;
  96 ipc_space_t ipc_space_kernel;
  97 ipc_space_t ipc_space_reply;
  98
  99 /*
 100  *      Routine:        ipc_space_reference
 101  *      Routine:        ipc_space_release
 102  *      Purpose:
 103  *              Function versions of the IPC space inline reference.
 104  */
 105
 106 void
 107 ipc_space_reference(
 108         ipc_space_t     space)
 109 {
 110         is_reference(space);
 111 }
 112
 113 void
 114 ipc_space_release(
 115         ipc_space_t     space)
 116 {
 117         is_release(space);
 118 }
 119
 120 /*      Routine:                ipc_space_get_rollpoint
 121  *      Purpose:
 122  *              Generate a new gencount rollover point from a space's entropy pool
 123  */
 124 ipc_entry_bits_t
 125 ipc_space_get_rollpoint(
 126         ipc_space_t     space)
 127 {
 128         return random_bool_gen_bits(
 129                 &space->bool_gen,
 130                 &space->is_entropy[0],
 131                 IS_ENTROPY_CNT,
 132                 IE_BITS_ROLL_BITS);
 133 }
 134
 135 /*
 136  *      Routine:        ipc_entry_rand_freelist
 137  *      Purpose:
 138  *              Pseudo-randomly permute the order of entries in an IPC space
 139  *      Arguments:
 140  *              space:  the ipc space to initialize.
 141  *              table:  the corresponding ipc table to initialize.
 142  *              bottom: the start of the range to initialize (inclusive).
 143  *              top:    the end of the range to initialize (noninclusive).
 144  */
 145 void
 146 ipc_space_rand_freelist(
 147         ipc_space_t             space,
 148         ipc_entry_t             table,
 149         mach_port_index_t       bottom,
 150         mach_port_index_t       top)
 151 {
 152         int at_start = (bottom == 0);
 153 #ifdef CONFIG_SEMI_RANDOM_ENTRIES
 154         /*
 155          * Only make sequential entries at the start of the table, and not when
 156          * we're growing the space.
 157          */
 158         ipc_entry_num_t total = 0;
 159 #endif
 160
 161         /* First entry in the free list is always free, and is the start of the free list. */
 162         mach_port_index_t curr = bottom;
 163         bottom++;
 164         top--;
 165
 166         /*
 167          *      Initialize the free list in the table.
 168          *      Add the entries in pseudo-random order and randomly set the generation
 169          *      number, in order to frustrate attacks involving port name reuse.
 170          */
 171         while (bottom <= top) {
 172                 ipc_entry_t entry = &table[curr];
 173                 int which;
 174 #ifdef CONFIG_SEMI_RANDOM_ENTRIES
 175                 /*
 176                  * XXX: This is a horrible hack to make sure that randomizing the port
 177                  * doesn't break programs that might have (sad) hard-coded values for
 178                  * certain port names.
 179                  */
 180                 if (at_start && total++ < NUM_SEQ_ENTRIES) {
 181                         which = 0;
 182                 } else
 183 #endif
 184                 which = random_bool_gen_bits(
 185                         &space->bool_gen,
 186                         &space->is_entropy[0],
 187                         IS_ENTROPY_CNT,
 188                         1);
 189
 190                 mach_port_index_t next;
 191                 if (which) {
 192                         next = top;
 193                         top--;
 194                 } else {
 195                         next = bottom;
 196                         bottom++;
 197                 }
 198
 199                 /*
 200                  * The entry's gencount will roll over on its first allocation, at which
 201                  * point a random rollover will be set for the entry.
 202                  */
 203                 entry->ie_bits   = IE_BITS_GEN_MASK;
 204                 entry->ie_next   = next;
 205                 entry->ie_object = IO_NULL;
 206                 entry->ie_dist   = 0;
 207                 entry->ie_index  = 0;
 208                 curr = next;
 209         }
 210         table[curr].ie_next   = 0;
 211         table[curr].ie_object = IO_NULL;
 212         table[curr].ie_index  = 0;
 213         table[curr].ie_dist   = 0;
 214         table[curr].ie_bits   = IE_BITS_GEN_MASK;
 215
 216         /* The freelist head should always have generation number set to 0 */
 217         if (at_start) {
 218                 table[0].ie_bits = 0;
 219         }
 220 }
 221
 222
 223 /*
 224  *      Routine:        ipc_space_create
 225  *      Purpose:
 226  *              Creates a new IPC space.
 227  *
 228  *              The new space has two references, one for the caller
 229  *              and one because it is active.
 230  *      Conditions:
 231  *              Nothing locked.  Allocates memory.
 232  *      Returns:
 233  *              KERN_SUCCESS            Created a space.
 234  *              KERN_RESOURCE_SHORTAGE  Couldn't allocate memory.
 235  */
 236
 237 kern_return_t
 238 ipc_space_create(
 239         ipc_table_size_t        initial,
 240         ipc_label_t             label,
 241         ipc_space_t             *spacep)
 242 {
 243         ipc_space_t space;
 244         ipc_entry_t table;
 245         ipc_entry_num_t new_size;
 246
 247         space = is_alloc();
 248         if (space == IS_NULL) {
 249                 return KERN_RESOURCE_SHORTAGE;
 250         }
 251
 252         table = it_entries_alloc(initial);
 253         if (table == IE_NULL) {
 254                 is_free(space);
 255                 return KERN_RESOURCE_SHORTAGE;
 256         }
 257
 258         new_size = initial->its_size;
 259         memset((void *) table, 0, new_size * sizeof(struct ipc_entry));
 260
 261         /* Set to 0 so entropy pool refills */
 262         memset((void *) space->is_entropy, 0, sizeof(space->is_entropy));
 263
 264         random_bool_init(&space->bool_gen);
 265         ipc_space_rand_freelist(space, table, 0, new_size);
 266
 267         is_lock_init(space);
 268         space->is_bits = 2; /* 2 refs, active, not growing */
 269         space->is_table_hashed = 0;
 270         space->is_table_size = new_size;
 271         space->is_table_free = new_size - 1;
 272         space->is_table = table;
 273         space->is_table_next = initial + 1;
 274         space->is_task = NULL;
 275         space->is_label = label;
 276         space->is_low_mod = new_size;
 277         space->is_high_mod = 0;
 278         space->is_node_id = HOST_LOCAL_NODE; /* HOST_LOCAL_NODE, except proxy spaces */
 279
 280         *spacep = space;
 281         return KERN_SUCCESS;
 282 }
 283
 284 /*
 285  *      Routine:        ipc_space_label
 286  *      Purpose:
 287  *              Modify the label on a space. The desired
 288  *      label must be a super-set of the current
 289  *      label for the space (as rights may already
 290  *      have been previously copied out under the
 291  *      old label value.
 292  *      Conditions:
 293  *              Nothing locked.
 294  *      Returns:
 295  *              KERN_SUCCESS            Updated the label
 296  *              KERN_INVALID_VALUE  label not a superset of old
 297  */
 298 kern_return_t
 299 ipc_space_label(
 300         ipc_space_t space,
 301         ipc_label_t label)
 302 {
 303         is_write_lock(space);
 304         if (!is_active(space)) {
 305                 is_write_unlock(space);
 306                 return KERN_SUCCESS;
 307         }
 308
 309         if ((space->is_label & label) != space->is_label) {
 310                 is_write_unlock(space);
 311                 return KERN_INVALID_VALUE;
 312         }
 313         space->is_label = label;
 314         is_write_unlock(space);
 315         return KERN_SUCCESS;
 316 }
 317
 318 /*
 319  *      Routine:        ipc_space_add_label
 320  *      Purpose:
 321  *              Modify the label on a space. The desired
 322  *      label is added to the labels already set
 323  *      on the space.
 324  *      Conditions:
 325  *              Nothing locked.
 326  *      Returns:
 327  *              KERN_SUCCESS            Updated the label
 328  *              KERN_INVALID_VALUE  label not a superset of old
 329  */
 330 kern_return_t
 331 ipc_space_add_label(
 332         ipc_space_t space,
 333         ipc_label_t label)
 334 {
 335         is_write_lock(space);
 336         if (!is_active(space)) {
 337                 is_write_unlock(space);
 338                 return KERN_SUCCESS;
 339         }
 340
 341         space->is_label |= label;
 342         is_write_unlock(space);
 343         return KERN_SUCCESS;
 344 }
 345 /*
 346  *      Routine:        ipc_space_create_special
 347  *      Purpose:
 348  *              Create a special space.  A special space
 349  *              doesn't hold rights in the normal way.
 350  *              Instead it is place-holder for holding
 351  *              disembodied (naked) receive rights.
 352  *              See ipc_port_alloc_special/ipc_port_dealloc_special.
 353  *      Conditions:
 354  *              Nothing locked.
 355  *      Returns:
 356  *              KERN_SUCCESS            Created a space.
 357  *              KERN_RESOURCE_SHORTAGE  Couldn't allocate memory.
 358  */
 359
 360 kern_return_t
 361 ipc_space_create_special(
 362         ipc_space_t     *spacep)
 363 {
 364         ipc_space_t space;
 365
 366         space = is_alloc();
 367         if (space == IS_NULL) {
 368                 return KERN_RESOURCE_SHORTAGE;
 369         }
 370
 371         is_lock_init(space);
 372
 373         space->is_bits       = IS_INACTIVE | 1; /* 1 ref, not active, not growing */
 374         space->is_table      = IE_NULL;
 375         space->is_task       = TASK_NULL;
 376         space->is_label      = IPC_LABEL_SPECIAL;
 377         space->is_table_next = 0;
 378         space->is_low_mod    = 0;
 379         space->is_high_mod   = 0;
 380         space->is_node_id = HOST_LOCAL_NODE; /* HOST_LOCAL_NODE, except proxy spaces */
 381
 382         *spacep = space;
 383         return KERN_SUCCESS;
 384 }
 385
 386 /*
 387  * ipc_space_clean - remove all port references from an ipc space.
 388  *
 389  * In order to follow the traditional semantic, ipc_space_destroy
 390  * will not destroy the entire port table of a shared space.  Instead
 391  * it will simply clear its own sub-space.
 392  */
 393 void
 394 ipc_space_clean(
 395         ipc_space_t space)
 396 {
 397         ipc_entry_t table;
 398         ipc_entry_num_t size;
 399         mach_port_index_t index;
 400
 401         /*
 402          *      If somebody is trying to grow the table,
 403          *      we must wait until they finish and figure
 404          *      out the space died.
 405          */
 406 retry:
 407         is_write_lock(space);
 408         while (is_growing(space)) {
 409                 is_write_sleep(space);
 410         }
 411
 412         if (!is_active(space)) {
 413                 is_write_unlock(space);
 414                 return;
 415         }
 416
 417         /*
 418          *      Now we can futz with it since we have the write lock.
 419          */
 420
 421         table = space->is_table;
 422         size = space->is_table_size;
 423
 424         for (index = 0; index < size; index++) {
 425                 ipc_entry_t entry = &table[index];
 426                 mach_port_type_t type;
 427
 428                 type = IE_BITS_TYPE(entry->ie_bits);
 429                 if (type != MACH_PORT_TYPE_NONE) {
 430                         mach_port_name_t name = MACH_PORT_MAKE(index,
 431                             IE_BITS_GEN(entry->ie_bits));
 432                         ipc_right_destroy(space, name, entry, FALSE, 0); /* unlocks space */
 433                         goto retry;
 434                 }
 435         }
 436
 437         /*
 438          * JMM - Now the table is cleaned out.  We don't bother shrinking the
 439          * size of the table at this point, but we probably should if it is
 440          * really large.
 441          */
 442
 443         is_write_unlock(space);
 444 }
 445
 446
 447 /*
 448  *      Routine:        ipc_space_terminate
 449  *      Purpose:
 450  *              Marks the space as dead and cleans up the entries.
 451  *              Does nothing if the space is already dead.
 452  *      Conditions:
 453  *              Nothing locked.
 454  */
 455
 456 void
 457 ipc_space_terminate(
 458         ipc_space_t     space)
 459 {
 460         ipc_entry_t table;
 461         ipc_entry_num_t size;
 462         mach_port_index_t index;
 463
 464         assert(space != IS_NULL);
 465
 466         is_write_lock(space);
 467         if (!is_active(space)) {
 468                 is_write_unlock(space);
 469                 return;
 470         }
 471         is_mark_inactive(space);
 472
 473         /*
 474          *      If somebody is trying to grow the table,
 475          *      we must wait until they finish and figure
 476          *      out the space died.
 477          */
 478         while (is_growing(space)) {
 479                 is_write_sleep(space);
 480         }
 481
 482         is_write_unlock(space);
 483
 484
 485         /*
 486          *      Now we can futz with it unlocked.
 487          */
 488
 489         table = space->is_table;
 490         size = space->is_table_size;
 491
 492         for (index = 0; index < size; index++) {
 493                 ipc_entry_t entry = &table[index];
 494                 mach_port_type_t type;
 495
 496                 type = IE_BITS_TYPE(entry->ie_bits);
 497                 if (type != MACH_PORT_TYPE_NONE) {
 498                         mach_port_name_t name;
 499
 500                         name = MACH_PORT_MAKE(index,
 501                             IE_BITS_GEN(entry->ie_bits));
 502                         ipc_right_terminate(space, name, entry);
 503                 }
 504         }
 505
 506         it_entries_free(space->is_table_next - 1, table);
 507         space->is_table_size = 0;
 508         space->is_table_free = 0;
 509
 510         /*
 511          *      Because the space is now dead,
 512          *      we must release the "active" reference for it.
 513          *      Our caller still has his reference.
 514          */
 515         is_release(space);
 516 }