1/* 2 * Copyright (c) 2000-2010 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28/* 29 * @OSF_COPYRIGHT@ 30 */ 31/* 32 * Mach Operating System 33 * Copyright (c) 1991,1990,1989 Carnegie Mellon University 34 * All Rights Reserved. 35 * 36 * Permission to use, copy, modify and distribute this software and its 37 * documentation is hereby granted, provided that both the copyright 38 * notice and this permission notice appear in all copies of the 39 * software, derivative works or modified versions, and any portions 40 * thereof, and that both notices appear in supporting documentation. 41 * 42 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 43 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 44 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 45 * 46 * Carnegie Mellon requests users of this software to return to 47 * 48 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 49 * School of Computer Science 50 * Carnegie Mellon University 51 * Pittsburgh PA 15213-3890 52 * 53 * any improvements or extensions that they make and grant Carnegie Mellon 54 * the rights to redistribute these changes. 55 */ 56/* 57 * NOTICE: This file was modified by McAfee Research in 2004 to introduce 58 * support for mandatory and extensible security protections. This notice 59 * is included in support of clause 2.2 (b) of the Apple Public License, 60 * Version 2.0. 61 * Copyright (c) 2005 SPARTA, Inc. 62 */ 63/* 64 */ 65/* 66 * File: kern/ipc_kobject.c 67 * Author: Rich Draves 68 * Date: 1989 69 * 70 * Functions for letting a port represent a kernel object. 71 */ 72 73#include <mach_debug.h> 74#include <mach_ipc_test.h> 75#include <mach_rt.h> 76 77#include <mach/mig.h> 78#include <mach/port.h> 79#include <mach/kern_return.h> 80#include <mach/message.h> 81#include <mach/mig_errors.h> 82#include <mach/notify.h> 83#include <mach/ndr.h> 84#include <mach/vm_param.h> 85 86#include <mach/mach_vm_server.h> 87#include <mach/mach_port_server.h> 88#include <mach/mach_host_server.h> 89#include <mach/host_priv_server.h> 90#include <mach/host_security_server.h> 91#include <mach/clock_server.h> 92#include <mach/clock_priv_server.h> 93#include <mach/lock_set_server.h> 94#include <default_pager/default_pager_object_server.h> 95#include <mach/memory_object_server.h> 96#include <mach/memory_object_control_server.h> 97#include <mach/memory_object_default_server.h> 98#include <mach/processor_server.h> 99#include <mach/processor_set_server.h> 100#include <mach/task_server.h> 101#include <mach/mach_voucher_server.h> 102#include <mach/mach_voucher_attr_control_server.h> 103#if VM32_SUPPORT 104#include <mach/vm32_map_server.h> 105#endif 106#include <mach/thread_act_server.h> 107 108#include <device/device_types.h> 109#include <device/device_server.h> 110 111#include <UserNotification/UNDReplyServer.h> 112 113#if CONFIG_AUDIT 114#include <kern/audit_sessionport.h> 115#endif 116 117#if MACH_MACHINE_ROUTINES 118#include <machine/machine_routines.h> 119#endif /* MACH_MACHINE_ROUTINES */ 120#if XK_PROXY 121#include <uk_xkern/xk_uproxy_server.h> 122#endif /* XK_PROXY */ 123 124#include <kern/ipc_tt.h> 125#include <kern/ipc_mig.h> 126#include <kern/ipc_misc.h> 127#include <kern/ipc_kobject.h> 128#include <kern/host_notify.h> 129#include <kern/mk_timer.h> 130#include <kern/misc_protos.h> 131#include <ipc/ipc_kmsg.h> 132#include <ipc/ipc_port.h> 133#include <ipc/ipc_voucher.h> 134#include <kern/counters.h> 135 136#include <vm/vm_protos.h> 137 138#include <security/mac_mach_internal.h> 139 140extern char *proc_name_address(void *p); 141extern int proc_pid(void *p); 142 143/* 144 * Routine: ipc_kobject_notify 145 * Purpose: 146 * Deliver notifications to kobjects that care about them. 147 */ 148boolean_t 149ipc_kobject_notify( 150 mach_msg_header_t *request_header, 151 mach_msg_header_t *reply_header); 152 153typedef struct { 154 mach_msg_id_t num; 155 mig_routine_t routine; 156 int size; 157#if MACH_COUNTERS 158 mach_counter_t callcount; 159#endif 160} mig_hash_t; 161 162#define MAX_MIG_ENTRIES 1031 163#define MIG_HASH(x) (x) 164 165#ifndef max 166#define max(a,b) (((a) > (b)) ? (a) : (b)) 167#endif /* max */ 168 169static mig_hash_t mig_buckets[MAX_MIG_ENTRIES]; 170static int mig_table_max_displ; 171static mach_msg_size_t mig_reply_size = sizeof(mig_reply_error_t); 172 173 174 175const struct mig_subsystem *mig_e[] = { 176 (const struct mig_subsystem *)&mach_vm_subsystem, 177 (const struct mig_subsystem *)&mach_port_subsystem, 178 (const struct mig_subsystem *)&mach_host_subsystem, 179 (const struct mig_subsystem *)&host_priv_subsystem, 180 (const struct mig_subsystem *)&host_security_subsystem, 181 (const struct mig_subsystem *)&clock_subsystem, 182 (const struct mig_subsystem *)&clock_priv_subsystem, 183 (const struct mig_subsystem *)&processor_subsystem, 184 (const struct mig_subsystem *)&processor_set_subsystem, 185 (const struct mig_subsystem *)&is_iokit_subsystem, 186 (const struct mig_subsystem *)&lock_set_subsystem, 187 (const struct mig_subsystem *)&task_subsystem, 188 (const struct mig_subsystem *)&thread_act_subsystem, 189#if VM32_SUPPORT 190 (const struct mig_subsystem *)&vm32_map_subsystem, 191#endif 192 (const struct mig_subsystem *)&UNDReply_subsystem, 193 (const struct mig_subsystem *)&default_pager_object_subsystem, 194 (const struct mig_subsystem *)&mach_voucher_subsystem, 195 (const struct mig_subsystem *)&mach_voucher_attr_control_subsystem, 196 197#if XK_PROXY 198 (const struct mig_subsystem *)&do_uproxy_xk_uproxy_subsystem, 199#endif /* XK_PROXY */ 200#if MACH_MACHINE_ROUTINES 201 (const struct mig_subsystem *)&MACHINE_SUBSYSTEM, 202#endif /* MACH_MACHINE_ROUTINES */ 203#if MCMSG && iPSC860 204 (const struct mig_subsystem *)&mcmsg_info_subsystem, 205#endif /* MCMSG && iPSC860 */ 206}; 207 208void 209mig_init(void) 210{ 211 unsigned int i, n = sizeof(mig_e)/sizeof(const struct mig_subsystem *); 212 int howmany; 213 mach_msg_id_t j, pos, nentry, range; 214 215 for (i = 0; i < n; i++) { 216 range = mig_e[i]->end - mig_e[i]->start; 217 if (!mig_e[i]->start || range < 0) 218 panic("the msgh_ids in mig_e[] aren't valid!"); 219 220 for (j = 0; j < range; j++) { 221 if (mig_e[i]->routine[j].stub_routine) { 222 /* Only put real entries in the table */ 223 nentry = j + mig_e[i]->start; 224 for (pos = MIG_HASH(nentry) % MAX_MIG_ENTRIES, howmany = 1; 225 mig_buckets[pos].num; 226 pos++, pos = pos % MAX_MIG_ENTRIES, howmany++) { 227 if (mig_buckets[pos].num == nentry) { 228 printf("message id = %d\n", nentry); 229 panic("multiple entries with the same msgh_id"); 230 } 231 if (howmany == MAX_MIG_ENTRIES) 232 panic("the mig dispatch table is too small"); 233 } 234 235 mig_buckets[pos].num = nentry; 236 mig_buckets[pos].routine = mig_e[i]->routine[j].stub_routine; 237 if (mig_e[i]->routine[j].max_reply_msg) 238 mig_buckets[pos].size = mig_e[i]->routine[j].max_reply_msg; 239 else 240 mig_buckets[pos].size = mig_e[i]->maxsize; 241 242 mig_table_max_displ = max(howmany, mig_table_max_displ); 243 } 244 } 245 } 246 printf("mig_table_max_displ = %d\n", mig_table_max_displ); 247} 248 249 250/* 251 * Routine: ipc_kobject_server 252 * Purpose: 253 * Handle a message sent to the kernel. 254 * Generates a reply message. 255 * Version for Untyped IPC. 256 * Conditions: 257 * Nothing locked. 258 */ 259 260ipc_kmsg_t 261ipc_kobject_server( 262 ipc_kmsg_t request) 263{ 264 mach_msg_size_t reply_size; 265 ipc_kmsg_t reply; 266 kern_return_t kr; 267 ipc_port_t *destp; 268 mach_msg_format_0_trailer_t *trailer; 269 register mig_hash_t *ptr; 270 271 /* 272 * Find out corresponding mig_hash entry if any 273 */ 274 { 275 register int key = request->ikm_header->msgh_id; 276 register int i = MIG_HASH(key); 277 register int max_iter = mig_table_max_displ; 278 279 do 280 ptr = &mig_buckets[i++ % MAX_MIG_ENTRIES]; 281 while (key != ptr->num && ptr->num && --max_iter); 282 283 if (!ptr->routine || key != ptr->num) { 284 ptr = (mig_hash_t *)0; 285 reply_size = mig_reply_size; 286 } else { 287 reply_size = ptr->size; 288#if MACH_COUNTER 289 ptr->callcount++; 290#endif 291 } 292 } 293 294 /* round up for trailer size */ 295 reply_size += MAX_TRAILER_SIZE; 296 reply = ipc_kmsg_alloc(reply_size); 297 298 if (reply == IKM_NULL) { 299 printf("ipc_kobject_server: dropping request\n"); 300 ipc_kmsg_destroy(request); 301 return IKM_NULL; 302 } 303 304 /* 305 * Initialize reply message. 306 */ 307 { 308#define InP ((mach_msg_header_t *) request->ikm_header) 309#define OutP ((mig_reply_error_t *) reply->ikm_header) 310 311 /* 312 * MIG should really assure no data leakage - 313 * but until it does, pessimistically zero the 314 * whole reply buffer. 315 */ 316 bzero((void *)OutP, reply_size); 317 318 OutP->NDR = NDR_record; 319 OutP->Head.msgh_size = sizeof(mig_reply_error_t); 320 321 OutP->Head.msgh_bits = 322 MACH_MSGH_BITS_SET(MACH_MSGH_BITS_LOCAL(InP->msgh_bits), 0, 0, 0); 323 OutP->Head.msgh_remote_port = InP->msgh_local_port; 324 OutP->Head.msgh_local_port = MACH_PORT_NULL; 325 OutP->Head.msgh_voucher_port = MACH_PORT_NULL; 326 OutP->Head.msgh_id = InP->msgh_id + 100; 327 328#undef InP 329#undef OutP 330 } 331 332 /* 333 * Find the routine to call, and call it 334 * to perform the kernel function 335 */ 336 { 337 if (ptr) { 338 (*ptr->routine)(request->ikm_header, reply->ikm_header); 339 kernel_task->messages_received++; 340 } 341 else { 342 if (!ipc_kobject_notify(request->ikm_header, reply->ikm_header)){ 343#if MACH_IPC_TEST 344 printf("ipc_kobject_server: bogus kernel message, id=%d\n", 345 request->ikm_header->msgh_id); 346#endif /* MACH_IPC_TEST */ 347 _MIG_MSGID_INVALID(request->ikm_header->msgh_id); 348 349 ((mig_reply_error_t *) reply->ikm_header)->RetCode 350 = MIG_BAD_ID; 351 } 352 else 353 kernel_task->messages_received++; 354 } 355 kernel_task->messages_sent++; 356 } 357 358 /* 359 * Destroy destination. The following code differs from 360 * ipc_object_destroy in that we release the send-once 361 * right instead of generating a send-once notification 362 * (which would bring us here again, creating a loop). 363 * It also differs in that we only expect send or 364 * send-once rights, never receive rights. 365 * 366 * We set msgh_remote_port to IP_NULL so that the kmsg 367 * destroy routines don't try to destroy the port twice. 368 */ 369 destp = (ipc_port_t *) &request->ikm_header->msgh_remote_port; 370 switch (MACH_MSGH_BITS_REMOTE(request->ikm_header->msgh_bits)) { 371 case MACH_MSG_TYPE_PORT_SEND: 372 ipc_port_release_send(*destp); 373 break; 374 375 case MACH_MSG_TYPE_PORT_SEND_ONCE: 376 ipc_port_release_sonce(*destp); 377 break; 378 379 default: 380 panic("ipc_kobject_server: strange destination rights"); 381 } 382 *destp = IP_NULL; 383 384 /* 385 * Destroy voucher. The kernel MIG servers never take ownership 386 * of vouchers sent in messages. Swallow any such rights here. 387 */ 388 if (IP_VALID(request->ikm_voucher)) { 389 assert(MACH_MSG_TYPE_PORT_SEND == 390 MACH_MSGH_BITS_VOUCHER(request->ikm_header->msgh_bits)); 391 ipc_port_release_send(request->ikm_voucher); 392 request->ikm_voucher = IP_NULL; 393 } 394 395 if (!(reply->ikm_header->msgh_bits & MACH_MSGH_BITS_COMPLEX) && 396 ((mig_reply_error_t *) reply->ikm_header)->RetCode != KERN_SUCCESS) 397 kr = ((mig_reply_error_t *) reply->ikm_header)->RetCode; 398 else 399 kr = KERN_SUCCESS; 400 401 if ((kr == KERN_SUCCESS) || (kr == MIG_NO_REPLY)) { 402 /* 403 * The server function is responsible for the contents 404 * of the message. The reply port right is moved 405 * to the reply message, and we have deallocated 406 * the destination port right, so we just need 407 * to free the kmsg. 408 */ 409 ipc_kmsg_free(request); 410 411 } else { 412 /* 413 * The message contents of the request are intact. 414 * Destroy everthing except the reply port right, 415 * which is needed in the reply message. 416 */ 417 request->ikm_header->msgh_local_port = MACH_PORT_NULL; 418 ipc_kmsg_destroy(request); 419 } 420 421 if (kr == MIG_NO_REPLY) { 422 /* 423 * The server function will send a reply message 424 * using the reply port right, which it has saved. 425 */ 426 427 ipc_kmsg_free(reply); 428 429 return IKM_NULL; 430 } else if (!IP_VALID((ipc_port_t)reply->ikm_header->msgh_remote_port)) { 431 /* 432 * Can't queue the reply message if the destination 433 * (the reply port) isn't valid. 434 */ 435 436 ipc_kmsg_destroy(reply); 437 438 return IKM_NULL; 439 } 440 441 trailer = (mach_msg_format_0_trailer_t *) 442 ((vm_offset_t)reply->ikm_header + (int)reply->ikm_header->msgh_size); 443 444 trailer->msgh_sender = KERNEL_SECURITY_TOKEN; 445 trailer->msgh_trailer_type = MACH_MSG_TRAILER_FORMAT_0; 446 trailer->msgh_trailer_size = MACH_MSG_TRAILER_MINIMUM_SIZE; 447 448 return reply; 449} 450 451/* 452 * Routine: ipc_kobject_set 453 * Purpose: 454 * Make a port represent a kernel object of the given type. 455 * The caller is responsible for handling refs for the 456 * kernel object, if necessary. 457 * Conditions: 458 * Nothing locked. The port must be active if setting 459 * a kobject linkage. Clearing a linkage is OK on an 460 * inactive port. 461 */ 462void 463ipc_kobject_set( 464 ipc_port_t port, 465 ipc_kobject_t kobject, 466 ipc_kobject_type_t type) 467{ 468 ip_lock(port); 469 ipc_kobject_set_atomically(port, kobject, type); 470 ip_unlock(port); 471} 472 473void 474ipc_kobject_set_atomically( 475 ipc_port_t port, 476 ipc_kobject_t kobject, 477 ipc_kobject_type_t type) 478{ 479 assert(type == IKOT_NONE || ip_active(port)); 480#if MACH_ASSERT 481 port->ip_spares[2] = (port->ip_bits & IO_BITS_KOTYPE); 482#endif /* MACH_ASSERT */ 483 port->ip_bits = (port->ip_bits &~ IO_BITS_KOTYPE) | type; 484 port->ip_kobject = kobject; 485} 486 487/* 488 * Routine: ipc_kobject_destroy 489 * Purpose: 490 * Release any kernel object resources associated 491 * with the port, which is being destroyed. 492 * 493 * This should only be needed when resources are 494 * associated with a user's port. In the normal case, 495 * when the kernel is the receiver, the code calling 496 * ipc_port_dealloc_kernel should clean up the resources. 497 * Conditions: 498 * The port is not locked, but it is dead. 499 */ 500 501void 502ipc_kobject_destroy( 503 ipc_port_t port) 504{ 505 switch (ip_kotype(port)) { 506 507 case IKOT_TIMER: 508 mk_timer_port_destroy(port); 509 break; 510 511 case IKOT_NAMED_ENTRY: 512 mach_destroy_memory_entry(port); 513 break; 514 515 case IKOT_HOST_NOTIFY: 516 host_notify_port_destroy(port); 517 break; 518 519 default: 520 break; 521 } 522} 523 524 525boolean_t 526ipc_kobject_notify( 527 mach_msg_header_t *request_header, 528 mach_msg_header_t *reply_header) 529{ 530 ipc_port_t port = (ipc_port_t) request_header->msgh_remote_port; 531 532 ((mig_reply_error_t *) reply_header)->RetCode = MIG_NO_REPLY; 533 switch (request_header->msgh_id) { 534 case MACH_NOTIFY_NO_SENDERS: 535 if (ip_kotype(port) == IKOT_VOUCHER) { 536 ipc_voucher_notify(request_header); 537 return TRUE; 538 } 539 if (ip_kotype(port) == IKOT_VOUCHER_ATTR_CONTROL) { 540 ipc_voucher_attr_control_notify(request_header); 541 return TRUE; 542 } 543 if(ip_kotype(port) == IKOT_NAMED_ENTRY) { 544 ip_lock(port); 545 546 /* 547 * Bring the sequence number and mscount in 548 * line with ipc_port_destroy assertion. 549 */ 550 port->ip_mscount = 0; 551 port->ip_messages.imq_seqno = 0; 552 ipc_port_destroy(port); /* releases lock */ 553 return TRUE; 554 } 555 if (ip_kotype(port) == IKOT_UPL) { 556 upl_no_senders( 557 request_header->msgh_remote_port, 558 (mach_port_mscount_t) 559 ((mach_no_senders_notification_t *) 560 request_header)->not_count); 561 reply_header->msgh_remote_port = MACH_PORT_NULL; 562 return TRUE; 563 } 564#if CONFIG_AUDIT 565 if (ip_kotype(port) == IKOT_AU_SESSIONPORT) { 566 audit_session_nosenders(request_header); 567 return TRUE; 568 } 569#endif 570 if (ip_kotype(port) == IKOT_FILEPORT) { 571 fileport_notify(request_header); 572 return TRUE; 573 } 574 575 break; 576 577 case MACH_NOTIFY_PORT_DELETED: 578 case MACH_NOTIFY_PORT_DESTROYED: 579 case MACH_NOTIFY_SEND_ONCE: 580 case MACH_NOTIFY_DEAD_NAME: 581 break; 582 583 default: 584 return FALSE; 585 } 586 switch (ip_kotype(port)) { 587 588#ifdef IOKIT 589 case IKOT_IOKIT_OBJECT: 590 case IKOT_IOKIT_CONNECT: 591 case IKOT_IOKIT_SPARE: 592 { 593 return iokit_notify(request_header); 594 } 595#endif 596 case IKOT_TASK_RESUME: 597 { 598 return task_suspension_notify(request_header); 599 } 600 601 default: 602 return FALSE; 603 } 604} 605