osfmk/ipc/ipc_space.c

   1 /*
   2  * Copyright (c) 2000-2020 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * @OSF_COPYRIGHT@
  30  */
  31 /*
  32  * Mach Operating System
  33  * Copyright (c) 1991,1990,1989 Carnegie Mellon University
  34  * All Rights Reserved.
  35  *
  36  * Permission to use, copy, modify and distribute this software and its
  37  * documentation is hereby granted, provided that both the copyright
  38  * notice and this permission notice appear in all copies of the
  39  * software, derivative works or modified versions, and any portions
  40  * thereof, and that both notices appear in supporting documentation.
  41  *
  42  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
  43  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
  44  * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
  45  *
  46  * Carnegie Mellon requests users of this software to return to
  47  *
  48  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
  49  *  School of Computer Science
  50  *  Carnegie Mellon University
  51  *  Pittsburgh PA 15213-3890
  52  *
  53  * any improvements or extensions that they make and grant Carnegie Mellon
  54  * the rights to redistribute these changes.
  55  */
  56 /*
  57  * NOTICE: This file was modified by McAfee Research in 2004 to introduce
  58  * support for mandatory and extensible security protections.  This notice
  59  * is included in support of clause 2.2 (b) of the Apple Public License,
  60  * Version 2.0.
  61  */
  62 /*
  63  */
  64 /*
  65  *      File:   ipc/ipc_space.c
  66  *      Author: Rich Draves
  67  *      Date:   1989
  68  *
  69  *      Functions to manipulate IPC capability spaces.
  70  */
  71
  72 #include <mach/boolean.h>
  73 #include <mach/kern_return.h>
  74 #include <mach/port.h>
  75 #include <kern/assert.h>
  76 #include <kern/sched_prim.h>
  77 #include <kern/zalloc.h>
  78 #include <ipc/port.h>
  79 #include <ipc/ipc_entry.h>
  80 #include <ipc/ipc_object.h>
  81 #include <ipc/ipc_hash.h>
  82 #include <ipc/ipc_table.h>
  83 #include <ipc/ipc_port.h>
  84 #include <ipc/ipc_space.h>
  85 #include <ipc/ipc_right.h>
  86 #include <prng/random.h>
  87 #include <string.h>
  88
  89 /* Remove this in the future so port names are less predictable. */
  90 #define CONFIG_SEMI_RANDOM_ENTRIES
  91 #ifdef CONFIG_SEMI_RANDOM_ENTRIES
  92 #define NUM_SEQ_ENTRIES 8
  93 #endif
  94
  95 ZONE_DECLARE(ipc_space_zone, "ipc spaces",
  96     sizeof(struct ipc_space), ZC_NOENCRYPT);
  97
  98 ipc_space_t ipc_space_kernel;
  99 ipc_space_t ipc_space_reply;
 100
 101 /*
 102  *      Routine:        ipc_space_reference
 103  *      Routine:        ipc_space_release
 104  *      Purpose:
 105  *              Function versions of the IPC space inline reference.
 106  */
 107
 108 void
 109 ipc_space_reference(
 110         ipc_space_t     space)
 111 {
 112         is_reference(space);
 113 }
 114
 115 void
 116 ipc_space_release(
 117         ipc_space_t     space)
 118 {
 119         is_release(space);
 120 }
 121
 122 /*      Routine:                ipc_space_get_rollpoint
 123  *      Purpose:
 124  *              Generate a new gencount rollover point from a space's entropy pool
 125  */
 126 ipc_entry_bits_t
 127 ipc_space_get_rollpoint(
 128         ipc_space_t     space)
 129 {
 130         return random_bool_gen_bits(
 131                 &space->bool_gen,
 132                 &space->is_entropy[0],
 133                 IS_ENTROPY_CNT,
 134                 IE_BITS_ROLL_BITS);
 135 }
 136
 137 /*
 138  *      Routine:        ipc_entry_rand_freelist
 139  *      Purpose:
 140  *              Pseudo-randomly permute the order of entries in an IPC space
 141  *      Arguments:
 142  *              space:  the ipc space to initialize.
 143  *              table:  the corresponding ipc table to initialize.
 144  *              bottom: the start of the range to initialize (inclusive).
 145  *              top:    the end of the range to initialize (noninclusive).
 146  */
 147 void
 148 ipc_space_rand_freelist(
 149         ipc_space_t             space,
 150         ipc_entry_t             table,
 151         mach_port_index_t       bottom,
 152         mach_port_index_t       top)
 153 {
 154         int at_start = (bottom == 0);
 155 #ifdef CONFIG_SEMI_RANDOM_ENTRIES
 156         /*
 157          * Only make sequential entries at the start of the table, and not when
 158          * we're growing the space.
 159          */
 160         ipc_entry_num_t total = 0;
 161 #endif
 162
 163         /* First entry in the free list is always free, and is the start of the free list. */
 164         mach_port_index_t curr = bottom;
 165         bottom++;
 166         top--;
 167
 168         /*
 169          *      Initialize the free list in the table.
 170          *      Add the entries in pseudo-random order and randomly set the generation
 171          *      number, in order to frustrate attacks involving port name reuse.
 172          */
 173         while (bottom <= top) {
 174                 ipc_entry_t entry = &table[curr];
 175                 int which;
 176 #ifdef CONFIG_SEMI_RANDOM_ENTRIES
 177                 /*
 178                  * XXX: This is a horrible hack to make sure that randomizing the port
 179                  * doesn't break programs that might have (sad) hard-coded values for
 180                  * certain port names.
 181                  */
 182                 if (at_start && total++ < NUM_SEQ_ENTRIES) {
 183                         which = 0;
 184                 } else
 185 #endif
 186                 which = random_bool_gen_bits(
 187                         &space->bool_gen,
 188                         &space->is_entropy[0],
 189                         IS_ENTROPY_CNT,
 190                         1);
 191
 192                 mach_port_index_t next;
 193                 if (which) {
 194                         next = top;
 195                         top--;
 196                 } else {
 197                         next = bottom;
 198                         bottom++;
 199                 }
 200
 201                 /*
 202                  * The entry's gencount will roll over on its first allocation, at which
 203                  * point a random rollover will be set for the entry.
 204                  */
 205                 entry->ie_bits   = IE_BITS_GEN_MASK;
 206                 entry->ie_next   = next;
 207                 entry->ie_object = IO_NULL;
 208                 entry->ie_dist   = 0;
 209                 entry->ie_index  = 0;
 210                 curr = next;
 211         }
 212         table[curr].ie_next   = 0;
 213         table[curr].ie_object = IO_NULL;
 214         table[curr].ie_index  = 0;
 215         table[curr].ie_dist   = 0;
 216         table[curr].ie_bits   = IE_BITS_GEN_MASK;
 217
 218         /* The freelist head should always have generation number set to 0 */
 219         if (at_start) {
 220                 table[0].ie_bits = 0;
 221         }
 222 }
 223
 224
 225 /*
 226  *      Routine:        ipc_space_create
 227  *      Purpose:
 228  *              Creates a new IPC space.
 229  *
 230  *              The new space has two references, one for the caller
 231  *              and one because it is active.
 232  *      Conditions:
 233  *              Nothing locked.  Allocates memory.
 234  *      Returns:
 235  *              KERN_SUCCESS            Created a space.
 236  *              KERN_RESOURCE_SHORTAGE  Couldn't allocate memory.
 237  */
 238
 239 kern_return_t
 240 ipc_space_create(
 241         ipc_table_size_t        initial,
 242         ipc_label_t             label,
 243         ipc_space_t             *spacep)
 244 {
 245         ipc_space_t space;
 246         ipc_entry_t table;
 247         ipc_entry_num_t new_size;
 248
 249         space = is_alloc();
 250         if (space == IS_NULL) {
 251                 return KERN_RESOURCE_SHORTAGE;
 252         }
 253
 254         table = it_entries_alloc(initial);
 255         if (table == IE_NULL) {
 256                 is_free(space);
 257                 return KERN_RESOURCE_SHORTAGE;
 258         }
 259
 260         new_size = initial->its_size;
 261         memset((void *) table, 0, new_size * sizeof(struct ipc_entry));
 262
 263         /* Set to 0 so entropy pool refills */
 264         memset((void *) space->is_entropy, 0, sizeof(space->is_entropy));
 265
 266         random_bool_init(&space->bool_gen);
 267         ipc_space_rand_freelist(space, table, 0, new_size);
 268
 269         is_lock_init(space);
 270         space->is_bits = 2; /* 2 refs, active, not growing */
 271         space->is_table_hashed = 0;
 272         space->is_table_size = new_size;
 273         space->is_table_free = new_size - 1;
 274         space->is_table = table;
 275         space->is_table_next = initial + 1;
 276         space->is_task = NULL;
 277         space->is_label = label;
 278         space->is_low_mod = new_size;
 279         space->is_high_mod = 0;
 280         space->is_node_id = HOST_LOCAL_NODE; /* HOST_LOCAL_NODE, except proxy spaces */
 281
 282         *spacep = space;
 283         return KERN_SUCCESS;
 284 }
 285
 286 /*
 287  *      Routine:        ipc_space_label
 288  *      Purpose:
 289  *              Modify the label on a space. The desired
 290  *      label must be a super-set of the current
 291  *      label for the space (as rights may already
 292  *      have been previously copied out under the
 293  *      old label value.
 294  *      Conditions:
 295  *              Nothing locked.
 296  *      Returns:
 297  *              KERN_SUCCESS            Updated the label
 298  *              KERN_INVALID_VALUE  label not a superset of old
 299  */
 300 kern_return_t
 301 ipc_space_label(
 302         ipc_space_t space,
 303         ipc_label_t label)
 304 {
 305         is_write_lock(space);
 306         if (!is_active(space)) {
 307                 is_write_unlock(space);
 308                 return KERN_SUCCESS;
 309         }
 310
 311         if ((space->is_label & label) != space->is_label) {
 312                 is_write_unlock(space);
 313                 return KERN_INVALID_VALUE;
 314         }
 315         space->is_label = label;
 316         is_write_unlock(space);
 317         return KERN_SUCCESS;
 318 }
 319
 320 /*
 321  *      Routine:        ipc_space_add_label
 322  *      Purpose:
 323  *              Modify the label on a space. The desired
 324  *      label is added to the labels already set
 325  *      on the space.
 326  *      Conditions:
 327  *              Nothing locked.
 328  *      Returns:
 329  *              KERN_SUCCESS            Updated the label
 330  *              KERN_INVALID_VALUE  label not a superset of old
 331  */
 332 kern_return_t
 333 ipc_space_add_label(
 334         ipc_space_t space,
 335         ipc_label_t label)
 336 {
 337         is_write_lock(space);
 338         if (!is_active(space)) {
 339                 is_write_unlock(space);
 340                 return KERN_SUCCESS;
 341         }
 342
 343         space->is_label |= label;
 344         is_write_unlock(space);
 345         return KERN_SUCCESS;
 346 }
 347 /*
 348  *      Routine:        ipc_space_create_special
 349  *      Purpose:
 350  *              Create a special space.  A special space
 351  *              doesn't hold rights in the normal way.
 352  *              Instead it is place-holder for holding
 353  *              disembodied (naked) receive rights.
 354  *              See ipc_port_alloc_special/ipc_port_dealloc_special.
 355  *      Conditions:
 356  *              Nothing locked.
 357  *      Returns:
 358  *              KERN_SUCCESS            Created a space.
 359  *              KERN_RESOURCE_SHORTAGE  Couldn't allocate memory.
 360  */
 361
 362 kern_return_t
 363 ipc_space_create_special(
 364         ipc_space_t     *spacep)
 365 {
 366         ipc_space_t space;
 367
 368         space = is_alloc();
 369         if (space == IS_NULL) {
 370                 return KERN_RESOURCE_SHORTAGE;
 371         }
 372
 373         is_lock_init(space);
 374
 375         space->is_bits       = IS_INACTIVE | 1; /* 1 ref, not active, not growing */
 376         space->is_table      = IE_NULL;
 377         space->is_task       = TASK_NULL;
 378         space->is_label      = IPC_LABEL_SPECIAL;
 379         space->is_table_next = 0;
 380         space->is_low_mod    = 0;
 381         space->is_high_mod   = 0;
 382         space->is_node_id = HOST_LOCAL_NODE; /* HOST_LOCAL_NODE, except proxy spaces */
 383
 384         *spacep = space;
 385         return KERN_SUCCESS;
 386 }
 387
 388 /*
 389  * ipc_space_clean - remove all port references from an ipc space.
 390  *
 391  * In order to follow the traditional semantic, ipc_space_destroy
 392  * will not destroy the entire port table of a shared space.  Instead
 393  * it will simply clear its own sub-space.
 394  */
 395 void
 396 ipc_space_clean(
 397         ipc_space_t space)
 398 {
 399         ipc_entry_t table;
 400         ipc_entry_num_t size;
 401         mach_port_index_t index;
 402
 403         /*
 404          *      If somebody is trying to grow the table,
 405          *      we must wait until they finish and figure
 406          *      out the space died.
 407          */
 408 retry:
 409         is_write_lock(space);
 410         while (is_growing(space)) {
 411                 is_write_sleep(space);
 412         }
 413
 414         if (!is_active(space)) {
 415                 is_write_unlock(space);
 416                 return;
 417         }
 418
 419         /*
 420          *      Now we can futz with it since we have the write lock.
 421          */
 422
 423         table = space->is_table;
 424         size = space->is_table_size;
 425
 426         for (index = 0; index < size; index++) {
 427                 ipc_entry_t entry = &table[index];
 428                 mach_port_type_t type;
 429
 430                 type = IE_BITS_TYPE(entry->ie_bits);
 431                 if (type != MACH_PORT_TYPE_NONE) {
 432                         mach_port_name_t name = MACH_PORT_MAKE(index,
 433                             IE_BITS_GEN(entry->ie_bits));
 434                         ipc_right_destroy(space, name, entry, FALSE, 0); /* unlocks space */
 435                         goto retry;
 436                 }
 437         }
 438
 439         /*
 440          * JMM - Now the table is cleaned out.  We don't bother shrinking the
 441          * size of the table at this point, but we probably should if it is
 442          * really large.
 443          */
 444
 445         is_write_unlock(space);
 446 }
 447
 448
 449 /*
 450  *      Routine:        ipc_space_terminate
 451  *      Purpose:
 452  *              Marks the space as dead and cleans up the entries.
 453  *              Does nothing if the space is already dead.
 454  *      Conditions:
 455  *              Nothing locked.
 456  */
 457
 458 void
 459 ipc_space_terminate(
 460         ipc_space_t     space)
 461 {
 462         ipc_entry_t table;
 463         ipc_entry_num_t size;
 464         mach_port_index_t index;
 465
 466         assert(space != IS_NULL);
 467
 468         is_write_lock(space);
 469         if (!is_active(space)) {
 470                 is_write_unlock(space);
 471                 return;
 472         }
 473         is_mark_inactive(space);
 474
 475         /*
 476          *      If somebody is trying to grow the table,
 477          *      we must wait until they finish and figure
 478          *      out the space died.
 479          */
 480         while (is_growing(space)) {
 481                 is_write_sleep(space);
 482         }
 483
 484         is_write_unlock(space);
 485
 486
 487         /*
 488          *      Now we can futz with it unlocked.
 489          */
 490
 491         table = space->is_table;
 492         size = space->is_table_size;
 493
 494         for (index = 0; index < size; index++) {
 495                 ipc_entry_t entry = &table[index];
 496                 mach_port_type_t type;
 497
 498                 type = IE_BITS_TYPE(entry->ie_bits);
 499                 if (type != MACH_PORT_TYPE_NONE) {
 500                         mach_port_name_t name;
 501
 502                         name = MACH_PORT_MAKE(index,
 503                             IE_BITS_GEN(entry->ie_bits));
 504                         ipc_right_terminate(space, name, entry);
 505                 }
 506         }
 507
 508         it_entries_free(space->is_table_next - 1, table);
 509         space->is_table_size = 0;
 510         space->is_table_free = 0;
 511
 512         /*
 513          *      Because the space is now dead,
 514          *      we must release the "active" reference for it.
 515          *      Our caller still has his reference.
 516          */
 517         is_release(space);
 518 }