1/* 2 * Copyright (c) 2000-2010 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28/* 29 * @OSF_COPYRIGHT@ 30 */ 31/* 32 * Mach Operating System 33 * Copyright (c) 1991,1990,1989 Carnegie Mellon University 34 * All Rights Reserved. 35 * 36 * Permission to use, copy, modify and distribute this software and its 37 * documentation is hereby granted, provided that both the copyright 38 * notice and this permission notice appear in all copies of the 39 * software, derivative works or modified versions, and any portions 40 * thereof, and that both notices appear in supporting documentation. 41 * 42 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 43 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 44 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 45 * 46 * Carnegie Mellon requests users of this software to return to 47 * 48 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 49 * School of Computer Science 50 * Carnegie Mellon University 51 * Pittsburgh PA 15213-3890 52 * 53 * any improvements or extensions that they make and grant Carnegie Mellon 54 * the rights to redistribute these changes. 55 */ 56/* 57 * NOTICE: This file was modified by McAfee Research in 2004 to introduce 58 * support for mandatory and extensible security protections. This notice 59 * is included in support of clause 2.2 (b) of the Apple Public License, 60 * Version 2.0. 61 * Copyright (c) 2005 SPARTA, Inc. 62 */ 63/* 64 */ 65/* 66 * File: kern/ipc_kobject.c 67 * Author: Rich Draves 68 * Date: 1989 69 * 70 * Functions for letting a port represent a kernel object. 71 */ 72 73#include <mach_debug.h> 74#include <mach_ipc_test.h> 75#include <mach_machine_routines.h> 76#include <norma_task.h> 77#include <mach_rt.h> 78#include <platforms.h> 79 80#include <mach/mig.h> 81#include <mach/port.h> 82#include <mach/kern_return.h> 83#include <mach/message.h> 84#include <mach/mig_errors.h> 85#include <mach/notify.h> 86#include <mach/ndr.h> 87#include <mach/vm_param.h> 88 89#include <mach/mach_vm_server.h> 90#include <mach/mach_port_server.h> 91#include <mach/mach_host_server.h> 92#include <mach/host_priv_server.h> 93#include <mach/host_security_server.h> 94#include <mach/clock_server.h> 95#include <mach/clock_priv_server.h> 96#include <mach/lock_set_server.h> 97#include <default_pager/default_pager_object_server.h> 98#include <mach/memory_object_server.h> 99#include <mach/memory_object_control_server.h> 100#include <mach/memory_object_default_server.h> 101#include <mach/memory_object_name_server.h> 102#include <mach/processor_server.h> 103#include <mach/processor_set_server.h> 104#include <mach/task_server.h> 105#if VM32_SUPPORT 106#include <mach/vm32_map_server.h> 107#endif 108#include <mach/thread_act_server.h> 109 110#include <device/device_types.h> 111#include <device/device_server.h> 112 113#include <UserNotification/UNDReplyServer.h> 114 115#if CONFIG_AUDIT 116#include <kern/audit_sessionport.h> 117#endif 118 119#if MACH_MACHINE_ROUTINES 120#include <machine/machine_routines.h> 121#endif /* MACH_MACHINE_ROUTINES */ 122#if XK_PROXY 123#include <uk_xkern/xk_uproxy_server.h> 124#endif /* XK_PROXY */ 125 126#include <kern/ipc_tt.h> 127#include <kern/ipc_mig.h> 128#include <kern/ipc_misc.h> 129#include <kern/ipc_kobject.h> 130#include <kern/host_notify.h> 131#include <kern/mk_timer.h> 132#include <kern/misc_protos.h> 133#include <ipc/ipc_kmsg.h> 134#include <ipc/ipc_port.h> 135#include <ipc/ipc_labelh.h> 136#include <kern/counters.h> 137 138#include <vm/vm_protos.h> 139 140#include <security/mac_mach_internal.h> 141 142/* 143 * Routine: ipc_kobject_notify 144 * Purpose: 145 * Deliver notifications to kobjects that care about them. 146 */ 147boolean_t 148ipc_kobject_notify( 149 mach_msg_header_t *request_header, 150 mach_msg_header_t *reply_header); 151 152typedef struct { 153 mach_msg_id_t num; 154 mig_routine_t routine; 155 int size; 156#if MACH_COUNTERS 157 mach_counter_t callcount; 158#endif 159} mig_hash_t; 160 161#define MAX_MIG_ENTRIES 1024 162#define MIG_HASH(x) (x) 163 164#ifndef max 165#define max(a,b) (((a) > (b)) ? (a) : (b)) 166#endif /* max */ 167 168mig_hash_t mig_buckets[MAX_MIG_ENTRIES]; 169int mig_table_max_displ; 170mach_msg_size_t mig_reply_size; 171 172#if CONFIG_MACF 173#include <mach/security_server.h> 174#endif 175 176 177 178const struct mig_subsystem *mig_e[] = { 179 (const struct mig_subsystem *)&mach_vm_subsystem, 180 (const struct mig_subsystem *)&mach_port_subsystem, 181 (const struct mig_subsystem *)&mach_host_subsystem, 182 (const struct mig_subsystem *)&host_priv_subsystem, 183 (const struct mig_subsystem *)&host_security_subsystem, 184 (const struct mig_subsystem *)&clock_subsystem, 185 (const struct mig_subsystem *)&clock_priv_subsystem, 186 (const struct mig_subsystem *)&processor_subsystem, 187 (const struct mig_subsystem *)&processor_set_subsystem, 188 (const struct mig_subsystem *)&is_iokit_subsystem, 189 (const struct mig_subsystem *)&memory_object_name_subsystem, 190 (const struct mig_subsystem *)&lock_set_subsystem, 191 (const struct mig_subsystem *)&task_subsystem, 192 (const struct mig_subsystem *)&thread_act_subsystem, 193#if VM32_SUPPORT 194 (const struct mig_subsystem *)&vm32_map_subsystem, 195#endif 196 (const struct mig_subsystem *)&UNDReply_subsystem, 197 (const struct mig_subsystem *)&default_pager_object_subsystem, 198 199#if XK_PROXY 200 (const struct mig_subsystem *)&do_uproxy_xk_uproxy_subsystem, 201#endif /* XK_PROXY */ 202#if MACH_MACHINE_ROUTINES 203 (const struct mig_subsystem *)&MACHINE_SUBSYSTEM, 204#endif /* MACH_MACHINE_ROUTINES */ 205#if MCMSG && iPSC860 206 (const struct mig_subsystem *)&mcmsg_info_subsystem, 207#endif /* MCMSG && iPSC860 */ 208 209#if CONFIG_MACF 210 (const struct mig_subsystem *)&security_subsystem, 211#endif 212}; 213 214void 215mig_init(void) 216{ 217 unsigned int i, n = sizeof(mig_e)/sizeof(const struct mig_subsystem *); 218 int howmany; 219 mach_msg_id_t j, pos, nentry, range; 220 221 for (i = 0; i < n; i++) { 222 range = mig_e[i]->end - mig_e[i]->start; 223 if (!mig_e[i]->start || range < 0) 224 panic("the msgh_ids in mig_e[] aren't valid!"); 225 mig_reply_size = max(mig_reply_size, mig_e[i]->maxsize); 226 227 for (j = 0; j < range; j++) { 228 if (mig_e[i]->routine[j].stub_routine) { 229 /* Only put real entries in the table */ 230 nentry = j + mig_e[i]->start; 231 for (pos = MIG_HASH(nentry) % MAX_MIG_ENTRIES, howmany = 1; 232 mig_buckets[pos].num; 233 pos++, pos = pos % MAX_MIG_ENTRIES, howmany++) { 234 if (mig_buckets[pos].num == nentry) { 235 printf("message id = %d\n", nentry); 236 panic("multiple entries with the same msgh_id"); 237 } 238 if (howmany == MAX_MIG_ENTRIES) 239 panic("the mig dispatch table is too small"); 240 } 241 242 mig_buckets[pos].num = nentry; 243 mig_buckets[pos].routine = mig_e[i]->routine[j].stub_routine; 244 if (mig_e[i]->routine[j].max_reply_msg) 245 mig_buckets[pos].size = mig_e[i]->routine[j].max_reply_msg; 246 else 247 mig_buckets[pos].size = mig_e[i]->maxsize; 248 249 mig_table_max_displ = max(howmany, mig_table_max_displ); 250 } 251 } 252 } 253 printf("mig_table_max_displ = %d\n", mig_table_max_displ); 254} 255 256 257/* 258 * Routine: ipc_kobject_server 259 * Purpose: 260 * Handle a message sent to the kernel. 261 * Generates a reply message. 262 * Version for Untyped IPC. 263 * Conditions: 264 * Nothing locked. 265 */ 266 267ipc_kmsg_t 268ipc_kobject_server( 269 ipc_kmsg_t request) 270{ 271 mach_msg_size_t reply_size; 272 ipc_kmsg_t reply; 273 kern_return_t kr; 274 ipc_port_t *destp; 275 mach_msg_format_0_trailer_t *trailer; 276 register mig_hash_t *ptr; 277 278 /* 279 * Find out corresponding mig_hash entry if any 280 */ 281 { 282 register int key = request->ikm_header->msgh_id; 283 register int i = MIG_HASH(key); 284 register int max_iter = mig_table_max_displ; 285 286 do 287 ptr = &mig_buckets[i++ % MAX_MIG_ENTRIES]; 288 while (key != ptr->num && ptr->num && --max_iter); 289 290 if (!ptr->routine || key != ptr->num) { 291 ptr = (mig_hash_t *)0; 292 reply_size = mig_reply_size; 293 } else { 294 reply_size = ptr->size; 295#if MACH_COUNTER 296 ptr->callcount++; 297#endif 298 } 299 } 300 301 /* round up for trailer size */ 302 reply_size += MAX_TRAILER_SIZE; 303 reply = ipc_kmsg_alloc(reply_size); 304 305 if (reply == IKM_NULL) { 306 printf("ipc_kobject_server: dropping request\n"); 307 ipc_kmsg_destroy(request); 308 return IKM_NULL; 309 } 310 311 /* 312 * Initialize reply message. 313 */ 314 { 315#define InP ((mach_msg_header_t *) request->ikm_header) 316#define OutP ((mig_reply_error_t *) reply->ikm_header) 317 318 /* 319 * MIG should really assure no data leakage - 320 * but until it does, pessimistically zero the 321 * whole reply buffer. 322 */ 323 bzero((void *)OutP, reply_size); 324 325 OutP->NDR = NDR_record; 326 OutP->Head.msgh_size = sizeof(mig_reply_error_t); 327 328 OutP->Head.msgh_bits = 329 MACH_MSGH_BITS(MACH_MSGH_BITS_LOCAL(InP->msgh_bits), 0); 330 OutP->Head.msgh_remote_port = InP->msgh_local_port; 331 OutP->Head.msgh_local_port = MACH_PORT_NULL; 332 OutP->Head.msgh_reserved = (mach_msg_size_t)InP->msgh_id; /* useful for debug */ 333 OutP->Head.msgh_id = InP->msgh_id + 100; 334 335#undef InP 336#undef OutP 337 } 338 339 /* 340 * Find the routine to call, and call it 341 * to perform the kernel function 342 */ 343 { 344#if 0 345 kprintf("[Mach] Message has routine %p", ptr->routine); 346 panic_print_symbol_name(ptr->routine); 347 kprintf("\n"); 348#endif 349 if (ptr) { 350 (*ptr->routine)(request->ikm_header, reply->ikm_header); 351 kernel_task->messages_received++; 352 353 } 354 else { 355 if (!ipc_kobject_notify(request->ikm_header, reply->ikm_header)){ 356#if MACH_IPC_TEST 357 printf("ipc_kobject_server: bogus kernel message, id=%d\n", 358 request->ikm_header->msgh_id); 359#endif /* MACH_IPC_TEST */ 360 _MIG_MSGID_INVALID(request->ikm_header->msgh_id); 361 362 ((mig_reply_error_t *) reply->ikm_header)->RetCode 363 = MIG_BAD_ID; 364 } 365 else 366 kernel_task->messages_received++; 367 } 368 kernel_task->messages_sent++; 369 } 370 371 /* 372 * Destroy destination. The following code differs from 373 * ipc_object_destroy in that we release the send-once 374 * right instead of generating a send-once notification 375 * (which would bring us here again, creating a loop). 376 * It also differs in that we only expect send or 377 * send-once rights, never receive rights. 378 * 379 * We set msgh_remote_port to IP_NULL so that the kmsg 380 * destroy routines don't try to destroy the port twice. 381 */ 382 destp = (ipc_port_t *) &request->ikm_header->msgh_remote_port; 383 switch (MACH_MSGH_BITS_REMOTE(request->ikm_header->msgh_bits)) { 384 case MACH_MSG_TYPE_PORT_SEND: 385 ipc_port_release_send(*destp); 386 break; 387 388 case MACH_MSG_TYPE_PORT_SEND_ONCE: 389 ipc_port_release_sonce(*destp); 390 break; 391 392 default: 393 panic("ipc_kobject_server: strange destination rights"); 394 } 395 *destp = IP_NULL; 396 397 if (!(reply->ikm_header->msgh_bits & MACH_MSGH_BITS_COMPLEX) && 398 ((mig_reply_error_t *) reply->ikm_header)->RetCode != KERN_SUCCESS) 399 kr = ((mig_reply_error_t *) reply->ikm_header)->RetCode; 400 else 401 kr = KERN_SUCCESS; 402 403 if ((kr == KERN_SUCCESS) || (kr == MIG_NO_REPLY)) { 404 /* 405 * The server function is responsible for the contents 406 * of the message. The reply port right is moved 407 * to the reply message, and we have deallocated 408 * the destination port right, so we just need 409 * to free the kmsg. 410 */ 411 ipc_kmsg_free(request); 412 413 } else { 414 /* 415 * The message contents of the request are intact. 416 * Destroy everthing except the reply port right, 417 * which is needed in the reply message. 418 */ 419 request->ikm_header->msgh_local_port = MACH_PORT_NULL; 420 ipc_kmsg_destroy(request); 421 } 422 423 if (kr == MIG_NO_REPLY) { 424 /* 425 * The server function will send a reply message 426 * using the reply port right, which it has saved. 427 */ 428 429 ipc_kmsg_free(reply); 430 431 return IKM_NULL; 432 } else if (!IP_VALID((ipc_port_t)reply->ikm_header->msgh_remote_port)) { 433 /* 434 * Can't queue the reply message if the destination 435 * (the reply port) isn't valid. 436 */ 437 438 ipc_kmsg_destroy(reply); 439 440 return IKM_NULL; 441 } 442 443 trailer = (mach_msg_format_0_trailer_t *) 444 ((vm_offset_t)reply->ikm_header + (int)reply->ikm_header->msgh_size); 445 446 trailer->msgh_sender = KERNEL_SECURITY_TOKEN; 447 trailer->msgh_trailer_type = MACH_MSG_TRAILER_FORMAT_0; 448 trailer->msgh_trailer_size = MACH_MSG_TRAILER_MINIMUM_SIZE; 449 450 return reply; 451} 452 453/* 454 * Routine: ipc_kobject_set 455 * Purpose: 456 * Make a port represent a kernel object of the given type. 457 * The caller is responsible for handling refs for the 458 * kernel object, if necessary. 459 * Conditions: 460 * Nothing locked. The port must be active if setting 461 * a kobject linkage. Clearing a linkage is OK on an 462 * inactive port. 463 */ 464void 465ipc_kobject_set( 466 ipc_port_t port, 467 ipc_kobject_t kobject, 468 ipc_kobject_type_t type) 469{ 470 ip_lock(port); 471 ipc_kobject_set_atomically(port, kobject, type); 472 473#if CONFIG_MACF_MACH 474 mac_port_label_update_kobject (&port->ip_label, type); 475#endif 476 477 ip_unlock(port); 478} 479 480void 481ipc_kobject_set_atomically( 482 ipc_port_t port, 483 ipc_kobject_t kobject, 484 ipc_kobject_type_t type) 485{ 486 assert(type == IKOT_NONE || ip_active(port)); 487#if MACH_ASSERT 488 port->ip_spares[2] = (port->ip_bits & IO_BITS_KOTYPE); 489#endif /* MACH_ASSERT */ 490 port->ip_bits = (port->ip_bits &~ IO_BITS_KOTYPE) | type; 491 port->ip_kobject = kobject; 492} 493 494/* 495 * Routine: ipc_kobject_destroy 496 * Purpose: 497 * Release any kernel object resources associated 498 * with the port, which is being destroyed. 499 * 500 * This should only be needed when resources are 501 * associated with a user's port. In the normal case, 502 * when the kernel is the receiver, the code calling 503 * ipc_port_dealloc_kernel should clean up the resources. 504 * Conditions: 505 * The port is not locked, but it is dead. 506 */ 507 508void 509ipc_kobject_destroy( 510 ipc_port_t port) 511{ 512 switch (ip_kotype(port)) { 513 514 case IKOT_TIMER: 515 mk_timer_port_destroy(port); 516 break; 517 518 case IKOT_NAMED_ENTRY: 519 mach_destroy_memory_entry(port); 520 break; 521 522 case IKOT_HOST_NOTIFY: 523 host_notify_port_destroy(port); 524 break; 525 526#if CONFIG_MACF_MACH 527 case IKOT_LABELH: 528 labelh_destroy(port); 529 break; 530#endif 531 532 default: 533 break; 534 } 535} 536 537 538boolean_t 539ipc_kobject_notify( 540 mach_msg_header_t *request_header, 541 mach_msg_header_t *reply_header) 542{ 543 ipc_port_t port = (ipc_port_t) request_header->msgh_remote_port; 544 545 ((mig_reply_error_t *) reply_header)->RetCode = MIG_NO_REPLY; 546 switch (request_header->msgh_id) { 547 case MACH_NOTIFY_NO_SENDERS: 548 if(ip_kotype(port) == IKOT_NAMED_ENTRY) { 549 ip_lock(port); 550 551 /* 552 * Bring the sequence number and mscount in 553 * line with ipc_port_destroy assertion. 554 */ 555 port->ip_mscount = 0; 556 port->ip_messages.imq_seqno = 0; 557 ipc_port_destroy(port); /* releases lock */ 558 return TRUE; 559 } 560 if (ip_kotype(port) == IKOT_UPL) { 561 upl_no_senders( 562 request_header->msgh_remote_port, 563 (mach_port_mscount_t) 564 ((mach_no_senders_notification_t *) 565 request_header)->not_count); 566 reply_header->msgh_remote_port = MACH_PORT_NULL; 567 return TRUE; 568 } 569#if CONFIG_AUDIT 570 if (ip_kotype(port) == IKOT_AU_SESSIONPORT) { 571 audit_session_nosenders(request_header); 572 return TRUE; 573 } 574#endif 575 if (ip_kotype(port) == IKOT_FILEPORT) { 576 fileport_notify(request_header); 577 return TRUE; 578 } 579 580 break; 581 582 case MACH_NOTIFY_PORT_DELETED: 583 case MACH_NOTIFY_PORT_DESTROYED: 584 case MACH_NOTIFY_SEND_ONCE: 585 case MACH_NOTIFY_DEAD_NAME: 586 break; 587 588 default: 589 return FALSE; 590 } 591 switch (ip_kotype(port)) { 592 593#ifdef IOKIT 594 case IKOT_IOKIT_OBJECT: 595 case IKOT_IOKIT_CONNECT: 596 case IKOT_IOKIT_SPARE: 597 { 598 return iokit_notify(request_header); 599 } 600#endif 601 default: 602 return FALSE; 603 } 604} 605