boolean_t
mig_object_no_senders(
ipc_port_t port,
mach_port_mscount_t mscount)
{
mig_object_t mig_object;
ip_lock(port);
if (port->ip_mscount > mscount) {
ipc_port_t previous;
/*
* Somebody created new send rights while the
* notification was in-flight. Just create a
* new send-once right and re-register with
* the new (higher) mscount threshold.
*/
/* make a sonce right for the notification */
port->ip_sorights++;
ip_reference(port);
ipc_port_nsrequest(port, mscount, port, &previous);
/* port unlocked */
assert(previous == IP_NULL);
return (FALSE);
}
/*
* Clear the port pointer while we have it locked.
*/
mig_object = (mig_object_t)port->ip_kobject;
mig_object->port = IP_NULL;
/*
* Bring the sequence number and mscount in
* line with ipc_port_destroy assertion.
*/
port->ip_mscount = 0;
port->ip_messages.imq_seqno = 0;
ipc_port_destroy(port); /* releases lock */
/*
* Release the port's reference on the object.
*/
mig_object->pVtbl->Release((IMIGObject *)mig_object);
return (TRUE);
}
void
ipc_port_release_receive(
ipc_port_t port)
{
ipc_port_t dest;
assert(IP_VALID(port));
ip_lock(port);
assert(ip_active(port));
assert(port->ip_receiver_name == MACH_PORT_NULL);
dest = port->ip_destination;
ipc_port_destroy(port); /* consumes ref, unlocks */
if (dest != IP_NULL)
ipc_port_release(dest);
}
void
ipc_port_dealloc_special(
ipc_port_t port,
__assert_only ipc_space_t space)
{
ip_lock(port);
assert(ip_active(port));
// assert(port->ip_receiver_name != MACH_PORT_NULL);
assert(port->ip_receiver == space);
/*
* We clear ip_receiver_name and ip_receiver to simplify
* the ipc_space_kernel check in ipc_mqueue_send.
*/
port->ip_receiver_name = MACH_PORT_NULL;
port->ip_receiver = IS_NULL;
/* relevant part of ipc_port_clear_receiver */
ipc_port_set_mscount(port, 0);
port->ip_messages.imq_seqno = 0;
ipc_port_destroy(port);
}
boolean_t
ipc_kobject_notify(
mach_msg_header_t *request_header,
mach_msg_header_t *reply_header)
{
mach_msg_max_trailer_t * trailer;
ipc_port_t port = (ipc_port_t) request_header->msgh_remote_port;
((mig_reply_error_t *) reply_header)->RetCode = MIG_NO_REPLY;
trailer = (mach_msg_max_trailer_t *)
((vm_offset_t)request_header + request_header->msgh_size);
/*
* The kobject notification is privileged and can change the
* refcount on kernel-internal objects - make sure
* that the message wasn't faked!
*/
if (0 != bcmp(&trailer->msgh_audit, &KERNEL_AUDIT_TOKEN,
sizeof(trailer->msgh_audit))) {
return FALSE;
}
if (0 != bcmp(&trailer->msgh_sender, &KERNEL_SECURITY_TOKEN,
sizeof(trailer->msgh_sender))) {
return FALSE;
}
switch (request_header->msgh_id) {
case MACH_NOTIFY_NO_SENDERS:
switch (ip_kotype(port)) {
case IKOT_VOUCHER:
ipc_voucher_notify(request_header);
return TRUE;
case IKOT_VOUCHER_ATTR_CONTROL:
ipc_voucher_attr_control_notify(request_header);
return TRUE;
case IKOT_SEMAPHORE:
semaphore_notify(request_header);
return TRUE;
case IKOT_TASK:
task_port_notify(request_header);
return TRUE;
case IKOT_NAMED_ENTRY:
ip_lock(port);
/*
* Bring the sequence number and mscount in
* line with ipc_port_destroy assertion.
*/
port->ip_mscount = 0;
port->ip_messages.imq_seqno = 0;
ipc_port_destroy(port); /* releases lock */
return TRUE;
case IKOT_UPL:
upl_no_senders(
request_header->msgh_remote_port,
(mach_port_mscount_t)
((mach_no_senders_notification_t *)
request_header)->not_count);
reply_header->msgh_remote_port = MACH_PORT_NULL;
return TRUE;
#if CONFIG_AUDIT
case IKOT_AU_SESSIONPORT:
audit_session_nosenders(request_header);
return TRUE;
#endif
case IKOT_FILEPORT:
fileport_notify(request_header);
return TRUE;
case IKOT_WORK_INTERVAL:
work_interval_port_notify(request_header);
return TRUE;
}
break;
case MACH_NOTIFY_PORT_DELETED:
case MACH_NOTIFY_PORT_DESTROYED:
case MACH_NOTIFY_SEND_ONCE:
case MACH_NOTIFY_DEAD_NAME:
break;
default:
return FALSE;
}
switch (ip_kotype(port)) {
#ifdef IOKIT
case IKOT_IOKIT_OBJECT:
case IKOT_IOKIT_CONNECT:
case IKOT_IOKIT_SPARE:
{
return iokit_notify(request_header);
}
#endif
case IKOT_TASK_RESUME:
{
return task_suspension_notify(request_header);
}
default:
return FALSE;
}
}
kern_return_t
ipc_right_delta(
ipc_space_t space,
mach_port_t name,
ipc_entry_t entry,
mach_port_right_t right,
mach_port_delta_t delta)
{
ipc_entry_bits_t bits = entry->ie_bits;
assert(space->is_active);
assert(right < MACH_PORT_RIGHT_NUMBER);
/* Rights-specific restrictions and operations. */
switch (right) {
case MACH_PORT_RIGHT_PORT_SET: {
ipc_pset_t pset;
if ((bits & MACH_PORT_TYPE_PORT_SET) == 0)
goto invalid_right;
assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_PORT_SET);
assert(IE_BITS_UREFS(bits) == 0);
assert((bits & IE_BITS_MAREQUEST) == 0);
assert(entry->ie_request == 0);
if (delta == 0)
goto success;
if (delta != -1)
goto invalid_value;
pset = (ipc_pset_t) entry->ie_object;
assert(pset != IPS_NULL);
entry->ie_object = IO_NULL;
ipc_entry_dealloc(space, name, entry);
ips_lock(pset);
assert(ips_active(pset));
is_write_unlock(space);
ipc_pset_destroy(pset); /* consumes ref, unlocks */
break;
}
case MACH_PORT_RIGHT_RECEIVE: {
ipc_port_t port;
ipc_port_t dnrequest = IP_NULL;
if ((bits & MACH_PORT_TYPE_RECEIVE) == 0)
goto invalid_right;
if (delta == 0)
goto success;
if (delta != -1)
goto invalid_value;
if (bits & IE_BITS_MAREQUEST) {
bits &= ~IE_BITS_MAREQUEST;
ipc_marequest_cancel(space, name);
}
port = (ipc_port_t) entry->ie_object;
assert(port != IP_NULL);
/*
* The port lock is needed for ipc_right_dncancel;
* otherwise, we wouldn't have to take the lock
* until just before dropping the space lock.
*/
ip_lock(port);
assert(ip_active(port));
assert(port->ip_receiver_name == name);
assert(port->ip_receiver == space);
if (bits & MACH_PORT_TYPE_SEND) {
assert(IE_BITS_TYPE(bits) ==
MACH_PORT_TYPE_SEND_RECEIVE);
assert(IE_BITS_UREFS(bits) > 0);
assert(IE_BITS_UREFS(bits) < MACH_PORT_UREFS_MAX);
assert(port->ip_srights > 0);
/*
* The remaining send right turns into a
* dead name. Notice we don't decrement
* ip_srights, generate a no-senders notif,
* or use ipc_right_dncancel, because the
* port is destroyed "first".
*/
bits &= ~IE_BITS_TYPE_MASK;
bits |= MACH_PORT_TYPE_DEAD_NAME;
if (entry->ie_request != 0) {
entry->ie_request = 0;
bits++; /* increment urefs */
}
entry->ie_bits = bits;
entry->ie_object = IO_NULL;
} else {
assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_RECEIVE);
assert(IE_BITS_UREFS(bits) == 0);
dnrequest = ipc_right_dncancel_macro(space, port,
name, entry);
entry->ie_object = IO_NULL;
ipc_entry_dealloc(space, name, entry);
}
is_write_unlock(space);
ipc_port_clear_receiver(port);
ipc_port_destroy(port); /* consumes ref, unlocks */
if (dnrequest != IP_NULL)
ipc_notify_port_deleted(dnrequest, name);
break;
}
case MACH_PORT_RIGHT_SEND_ONCE: {
ipc_port_t port, dnrequest;
if ((bits & MACH_PORT_TYPE_SEND_ONCE) == 0)
goto invalid_right;
assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_ONCE);
assert(IE_BITS_UREFS(bits) == 1);
assert((bits & IE_BITS_MAREQUEST) == 0);
if ((delta > 0) || (delta < -1))
goto invalid_value;
port = (ipc_port_t) entry->ie_object;
assert(port != IP_NULL);
if (ipc_right_check(space, port, name, entry)) {
assert(!(entry->ie_bits & MACH_PORT_TYPE_SEND_ONCE));
goto invalid_right;
}
/* port is locked and active */
assert(port->ip_sorights > 0);
if (delta == 0) {
ip_unlock(port);
goto success;
}
dnrequest = ipc_right_dncancel_macro(space, port, name, entry);
ip_unlock(port);
entry->ie_object = IO_NULL;
ipc_entry_dealloc(space, name, entry);
is_write_unlock(space);
ipc_notify_send_once(port);
if (dnrequest != IP_NULL)
ipc_notify_port_deleted(dnrequest, name);
break;
}
case MACH_PORT_RIGHT_DEAD_NAME: {
mach_port_urefs_t urefs;
if (bits & MACH_PORT_TYPE_SEND_RIGHTS) {
ipc_port_t port;
port = (ipc_port_t) entry->ie_object;
assert(port != IP_NULL);
if (!ipc_right_check(space, port, name, entry)) {
/* port is locked and active */
ip_unlock(port);
goto invalid_right;
}
bits = entry->ie_bits;
} else if ((bits & MACH_PORT_TYPE_DEAD_NAME) == 0)
goto invalid_right;
assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_DEAD_NAME);
assert(IE_BITS_UREFS(bits) > 0);
assert((bits & IE_BITS_MAREQUEST) == 0);
assert(entry->ie_object == IO_NULL);
assert(entry->ie_request == 0);
urefs = IE_BITS_UREFS(bits);
if (MACH_PORT_UREFS_UNDERFLOW(urefs, delta))
goto invalid_value;
if (MACH_PORT_UREFS_OVERFLOW(urefs, delta))
goto urefs_overflow;
if ((urefs + delta) == 0)
ipc_entry_dealloc(space, name, entry);
else
entry->ie_bits = bits + delta;
is_write_unlock(space);
break;
}
case MACH_PORT_RIGHT_SEND: {
mach_port_urefs_t urefs;
ipc_port_t port;
ipc_port_t dnrequest = IP_NULL;
ipc_port_t nsrequest = IP_NULL;
mach_port_mscount_t mscount = 0; /* '=0' to shut up lint */
if ((bits & MACH_PORT_TYPE_SEND) == 0)
goto invalid_right;
/* maximum urefs for send is MACH_PORT_UREFS_MAX-1 */
urefs = IE_BITS_UREFS(bits);
if (MACH_PORT_UREFS_UNDERFLOW(urefs, delta))
goto invalid_value;
if (MACH_PORT_UREFS_OVERFLOW(urefs+1, delta))
goto urefs_overflow;
port = (ipc_port_t) entry->ie_object;
assert(port != IP_NULL);
if (ipc_right_check(space, port, name, entry)) {
assert((entry->ie_bits & MACH_PORT_TYPE_SEND) == 0);
goto invalid_right;
}
/* port is locked and active */
assert(port->ip_srights > 0);
if ((urefs + delta) == 0) {
if (--port->ip_srights == 0) {
nsrequest = port->ip_nsrequest;
if (nsrequest != IP_NULL) {
port->ip_nsrequest = IP_NULL;
mscount = port->ip_mscount;
}
}
if (bits & MACH_PORT_TYPE_RECEIVE) {
assert(port->ip_receiver_name == name);
assert(port->ip_receiver == space);
assert(IE_BITS_TYPE(bits) ==
MACH_PORT_TYPE_SEND_RECEIVE);
entry->ie_bits = bits &~ (IE_BITS_UREFS_MASK|
MACH_PORT_TYPE_SEND);
} else {
assert(IE_BITS_TYPE(bits) ==
MACH_PORT_TYPE_SEND);
dnrequest = ipc_right_dncancel_macro(
space, port, name, entry);
ipc_reverse_remove(space, (ipc_object_t) port);
if (bits & IE_BITS_MAREQUEST)
ipc_marequest_cancel(space, name);
ip_release(port);
entry->ie_object = IO_NULL;
ipc_entry_dealloc(space, name, entry);
}
} else
entry->ie_bits = bits + delta;
ip_unlock(port); /* even if dropped a ref, port is active */
is_write_unlock(space);
if (nsrequest != IP_NULL)
ipc_notify_no_senders(nsrequest, mscount);
if (dnrequest != IP_NULL)
ipc_notify_port_deleted(dnrequest, name);
break;
}
default:
#if MACH_ASSERT
assert(!"ipc_right_delta: strange right");
#else
panic("ipc_right_delta: strange right");
#endif
}
return KERN_SUCCESS;
success:
is_write_unlock(space);
return KERN_SUCCESS;
invalid_right:
is_write_unlock(space);
return KERN_INVALID_RIGHT;
invalid_value:
is_write_unlock(space);
return KERN_INVALID_VALUE;
urefs_overflow:
is_write_unlock(space);
return KERN_UREFS_OVERFLOW;
}
kern_return_t
ipc_right_destroy(
ipc_space_t space,
mach_port_t name,
ipc_entry_t entry)
{
ipc_entry_bits_t bits = entry->ie_bits;
mach_port_type_t type = IE_BITS_TYPE(bits);
assert(space->is_active);
switch (type) {
case MACH_PORT_TYPE_DEAD_NAME:
assert(entry->ie_request == 0);
assert(entry->ie_object == IO_NULL);
assert((bits & IE_BITS_MAREQUEST) == 0);
ipc_entry_dealloc(space, name, entry);
is_write_unlock(space);
break;
case MACH_PORT_TYPE_PORT_SET: {
ipc_pset_t pset = (ipc_pset_t) entry->ie_object;
assert(entry->ie_request == 0);
assert(pset != IPS_NULL);
entry->ie_object = IO_NULL;
ipc_entry_dealloc(space, name, entry);
ips_lock(pset);
assert(ips_active(pset));
is_write_unlock(space);
ipc_pset_destroy(pset); /* consumes ref, unlocks */
break;
}
case MACH_PORT_TYPE_SEND:
case MACH_PORT_TYPE_RECEIVE:
case MACH_PORT_TYPE_SEND_RECEIVE:
case MACH_PORT_TYPE_SEND_ONCE: {
ipc_port_t port = (ipc_port_t) entry->ie_object;
ipc_port_t nsrequest = IP_NULL;
mach_port_mscount_t mscount = 0; /* '=0' to shut up lint */
ipc_port_t dnrequest;
assert(port != IP_NULL);
if (bits & IE_BITS_MAREQUEST) {
assert(type & MACH_PORT_TYPE_SEND_RECEIVE);
ipc_marequest_cancel(space, name);
}
if (type == MACH_PORT_TYPE_SEND)
ipc_reverse_remove(space, (ipc_object_t) port);
ip_lock(port);
if (!ip_active(port)) {
assert((type & MACH_PORT_TYPE_RECEIVE) == 0);
ip_release(port);
ip_check_unlock(port);
entry->ie_request = 0;
entry->ie_object = IO_NULL;
ipc_entry_dealloc(space, name, entry);
is_write_unlock(space);
break;
}
dnrequest = ipc_right_dncancel_macro(space, port, name, entry);
entry->ie_object = IO_NULL;
ipc_entry_dealloc(space, name, entry);
is_write_unlock(space);
if (type & MACH_PORT_TYPE_SEND) {
assert(port->ip_srights > 0);
if (--port->ip_srights == 0) {
nsrequest = port->ip_nsrequest;
if (nsrequest != IP_NULL) {
port->ip_nsrequest = IP_NULL;
mscount = port->ip_mscount;
}
}
}
if (type & MACH_PORT_TYPE_RECEIVE) {
assert(ip_active(port));
assert(port->ip_receiver == space);
ipc_port_clear_receiver(port);
ipc_port_destroy(port); /* consumes our ref, unlocks */
} else if (type & MACH_PORT_TYPE_SEND_ONCE) {
assert(port->ip_sorights > 0);
ip_unlock(port);
ipc_notify_send_once(port); /* consumes our ref */
} else {
assert(port->ip_receiver != space);
ip_release(port);
ip_unlock(port);
}
if (nsrequest != IP_NULL)
ipc_notify_no_senders(nsrequest, mscount);
if (dnrequest != IP_NULL)
ipc_notify_port_deleted(dnrequest, name);
break;
}
default:
#if MACH_ASSERT
assert(!"ipc_right_destroy: strange type");
#else
panic("ipc_right_destroy: strange type");
#endif
}
return KERN_SUCCESS;
}
void
ipc_right_clean(
ipc_space_t space,
mach_port_t name,
ipc_entry_t entry)
{
ipc_entry_bits_t bits = entry->ie_bits;
mach_port_type_t type = IE_BITS_TYPE(bits);
assert(!space->is_active);
/*
* We can't clean up IE_BITS_MAREQUEST when the space is dead.
* This is because ipc_marequest_destroy can't turn off
* the bit if the space is dead. Hence, it might be on
* even though the marequest has been destroyed. It's OK
* not to cancel the marequest, because ipc_marequest_destroy
* cancels for us if the space is dead.
*
* IE_BITS_COMPAT/ipc_right_dncancel doesn't have this
* problem, because we check that the port is active. If
* we didn't cancel IE_BITS_COMPAT, ipc_port_destroy
* would still work, but dead space refs would accumulate
* in ip_dnrequests. They would use up slots in
* ip_dnrequests and keep the spaces from being freed.
*/
switch (type) {
case MACH_PORT_TYPE_DEAD_NAME:
assert(entry->ie_request == 0);
assert(entry->ie_object == IO_NULL);
assert((bits & IE_BITS_MAREQUEST) == 0);
break;
case MACH_PORT_TYPE_PORT_SET: {
ipc_pset_t pset = (ipc_pset_t) entry->ie_object;
assert(entry->ie_request == 0);
assert((bits & IE_BITS_MAREQUEST) == 0);
assert(pset != IPS_NULL);
ips_lock(pset);
assert(ips_active(pset));
ipc_pset_destroy(pset); /* consumes ref, unlocks */
break;
}
case MACH_PORT_TYPE_SEND:
case MACH_PORT_TYPE_RECEIVE:
case MACH_PORT_TYPE_SEND_RECEIVE:
case MACH_PORT_TYPE_SEND_ONCE: {
ipc_port_t port = (ipc_port_t) entry->ie_object;
ipc_port_t dnrequest;
ipc_port_t nsrequest = IP_NULL;
mach_port_mscount_t mscount = 0; /* '=0' to shut up lint */
assert(port != IP_NULL);
ip_lock(port);
if (!ip_active(port)) {
ip_release(port);
ip_check_unlock(port);
break;
}
dnrequest = ipc_right_dncancel_macro(space, port, name, entry);
if (type & MACH_PORT_TYPE_SEND) {
assert(port->ip_srights > 0);
if (--port->ip_srights == 0) {
nsrequest = port->ip_nsrequest;
if (nsrequest != IP_NULL) {
port->ip_nsrequest = IP_NULL;
mscount = port->ip_mscount;
}
}
}
if (type & MACH_PORT_TYPE_RECEIVE) {
assert(port->ip_receiver_name == name);
assert(port->ip_receiver == space);
ipc_port_clear_receiver(port);
ipc_port_destroy(port); /* consumes our ref, unlocks */
} else if (type & MACH_PORT_TYPE_SEND_ONCE) {
assert(port->ip_sorights > 0);
ip_unlock(port);
ipc_notify_send_once(port); /* consumes our ref */
} else {
assert(port->ip_receiver != space);
ip_release(port);
ip_unlock(port); /* port is active */
}
if (nsrequest != IP_NULL)
ipc_notify_no_senders(nsrequest, mscount);
if (dnrequest != IP_NULL)
ipc_notify_port_deleted(dnrequest, name);
break;
}
default:
#if MACH_ASSERT
assert(!"ipc_right_clean: strange type");
#else
panic("ipc_right_clean: strange type");
#endif
}
}
boolean_t
ipc_kobject_notify(
mach_msg_header_t *request_header,
mach_msg_header_t *reply_header)
{
ipc_port_t port = (ipc_port_t) request_header->msgh_remote_port;
((mig_reply_error_t *) reply_header)->RetCode = MIG_NO_REPLY;
switch (request_header->msgh_id) {
case MACH_NOTIFY_NO_SENDERS:
switch (ip_kotype(port)) {
case IKOT_VOUCHER:
ipc_voucher_notify(request_header);
return TRUE;
case IKOT_VOUCHER_ATTR_CONTROL:
ipc_voucher_attr_control_notify(request_header);
return TRUE;
case IKOT_SEMAPHORE:
semaphore_notify(request_header);
return TRUE;
case IKOT_NAMED_ENTRY:
ip_lock(port);
/*
* Bring the sequence number and mscount in
* line with ipc_port_destroy assertion.
*/
port->ip_mscount = 0;
port->ip_messages.imq_seqno = 0;
ipc_port_destroy(port); /* releases lock */
return TRUE;
case IKOT_UPL:
upl_no_senders(
request_header->msgh_remote_port,
(mach_port_mscount_t)
((mach_no_senders_notification_t *)
request_header)->not_count);
reply_header->msgh_remote_port = MACH_PORT_NULL;
return TRUE;
#if CONFIG_AUDIT
case IKOT_AU_SESSIONPORT:
audit_session_nosenders(request_header);
return TRUE;
#endif
case IKOT_FILEPORT:
fileport_notify(request_header);
return TRUE;
}
break;
case MACH_NOTIFY_PORT_DELETED:
case MACH_NOTIFY_PORT_DESTROYED:
case MACH_NOTIFY_SEND_ONCE:
case MACH_NOTIFY_DEAD_NAME:
break;
default:
return FALSE;
}
switch (ip_kotype(port)) {
#ifdef IOKIT
case IKOT_IOKIT_OBJECT:
case IKOT_IOKIT_CONNECT:
case IKOT_IOKIT_SPARE:
{
return iokit_notify(request_header);
}
#endif
case IKOT_TASK_RESUME:
{
return task_suspension_notify(request_header);
}
default:
return FALSE;
}
}
