ipc_port_t retrieve_thread_self_fast( thread_t thread) { register ipc_port_t port; assert(thread == current_thread()); thread_mtx_lock(thread); assert(thread->ith_self != IP_NULL); if ((port = thread->ith_sself) == thread->ith_self) { /* no interposing */ ip_lock(port); assert(ip_active(port)); ip_reference(port); port->ip_srights++; ip_unlock(port); } else port = ipc_port_copy_send(port); thread_mtx_unlock(thread); return port; }
ipc_port_t ipc_port_lookup_notify( ipc_space_t space, mach_port_name_t name) { ipc_port_t port; ipc_entry_t entry; assert(is_active(space)); entry = ipc_entry_lookup(space, name); if (entry == IE_NULL) return IP_NULL; if ((entry->ie_bits & MACH_PORT_TYPE_RECEIVE) == 0) return IP_NULL; port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); ip_reference(port); port->ip_sorights++; ip_unlock(port); return port; }
EXTERN io_object_t iokit_lookup_connect_ref(io_object_t connectRef, ipc_space_t space) { io_object_t obj = NULL; if (connectRef && MACH_PORT_VALID(CAST_MACH_PORT_TO_NAME(connectRef))) { ipc_port_t port; kern_return_t kr; kr = ipc_object_translate(space, CAST_MACH_PORT_TO_NAME(connectRef), MACH_PORT_RIGHT_SEND, (ipc_object_t *)&port); if (kr == KERN_SUCCESS) { assert(IP_VALID(port)); ip_reference(port); ip_unlock(port); iokit_lock_port(port); if (ip_active(port) && (ip_kotype(port) == IKOT_IOKIT_CONNECT)) { obj = (io_object_t) port->ip_kobject; iokit_add_connect_reference(obj); } iokit_unlock_port(port); ip_release(port); } } return obj; }
ipc_port_t retrieve_task_self_fast( register task_t task) { register ipc_port_t port; assert(task == current_task()); itk_lock(task); assert(task->itk_self != IP_NULL); if ((port = task->itk_sself) == task->itk_self) { /* no interposing */ ip_lock(port); assert(ip_active(port)); ip_reference(port); port->ip_srights++; ip_unlock(port); } else port = ipc_port_copy_send(port); itk_unlock(task); return port; }
ipc_port_t ipc_port_make_sonce_locked( ipc_port_t port) { assert(ip_active(port)); port->ip_sorights++; ip_reference(port); return port; }
void exception( integer_t _exception, integer_t code, integer_t subcode) { ipc_thread_t self = current_thread(); ipc_port_t exc_port; if (_exception == KERN_SUCCESS) panic("exception"); /* * Optimized version of retrieve_thread_exception. */ ith_lock(self); assert(self->ith_self != IP_NULL); exc_port = self->ith_exception; if (!IP_VALID(exc_port)) { ith_unlock(self); exception_try_task(_exception, code, subcode); /*NOTREACHED*/ } ip_lock(exc_port); ith_unlock(self); if (!ip_active(exc_port)) { ip_unlock(exc_port); exception_try_task(_exception, code, subcode); /*NOTREACHED*/ } /* * Make a naked send right for the exception port. */ ip_reference(exc_port); exc_port->ip_srights++; ip_unlock(exc_port); /* * If this exception port doesn't work, * we will want to try the task's exception port. * Indicate this by saving the exception state. */ self->ith_exc = _exception; self->ith_exc_code = code; self->ith_exc_subcode = subcode; exception_raise(exc_port, retrieve_thread_self_fast(self), retrieve_task_self_fast(self->task), _exception, code, subcode); /*NOTREACHED*/ }
/* * Routine: ipc_port_make_send_locked * Purpose: * Make a naked send right from a receive right. * * Conditions: * port locked and active. */ ipc_port_t ipc_port_make_send_locked( ipc_port_t port) { assert(ip_active(port)); port->ip_mscount++; port->ip_srights++; ip_reference(port); return port; }
/* * Routine: convert_mig_object_to_port [interface] * Purpose: * Base implementation of MIG outtrans routine to convert from * a mig object reference to a new send right on the object's * port. The object reference is consumed. * Returns: * IP_NULL - Null MIG object supplied * Otherwise, a newly made send right for the port * Conditions: * Nothing locked. */ ipc_port_t convert_mig_object_to_port( mig_object_t mig_object) { ipc_port_t port; boolean_t deallocate = TRUE; if (mig_object == MIG_OBJECT_NULL) return IP_NULL; port = mig_object->port; while ((port == IP_NULL) || ((port = ipc_port_make_send(port)) == IP_NULL)) { ipc_port_t previous; /* * Either the port was never set up, or it was just * deallocated out from under us by the no-senders * processing. In either case, we must: * Attempt to make one * Arrange for no senders * Try to atomically register it with the object * Destroy it if we are raced. */ port = ipc_port_alloc_kernel(); ip_lock(port); ipc_kobject_set_atomically(port, (ipc_kobject_t) mig_object, IKOT_MIG); /* make a sonce right for the notification */ port->ip_sorights++; ip_reference(port); ipc_port_nsrequest(port, 1, port, &previous); /* port unlocked */ assert(previous == IP_NULL); if (OSCompareAndSwapPtr((void *)IP_NULL, (void *)port, (void * volatile *)&mig_object->port)) { deallocate = FALSE; } else { ipc_port_dealloc_kernel(port); port = mig_object->port; } } if (deallocate) mig_object->pVtbl->Release((IMIGObject *)mig_object); return (port); }
void exception_try_task( integer_t _exception, integer_t code, integer_t subcode) { ipc_thread_t self = current_thread(); task_t task = self->task; ipc_port_t exc_port; /* * Optimized version of retrieve_task_exception. */ itk_lock(task); assert(task->itk_self != IP_NULL); exc_port = task->itk_exception; if (!IP_VALID(exc_port)) { itk_unlock(task); exception_no_server(); /*NOTREACHED*/ } ip_lock(exc_port); itk_unlock(task); if (!ip_active(exc_port)) { ip_unlock(exc_port); exception_no_server(); /*NOTREACHED*/ } /* * Make a naked send right for the exception port. */ ip_reference(exc_port); exc_port->ip_srights++; ip_unlock(exc_port); /* * This is the thread's last chance. * Clear the saved exception state. */ self->ith_exc = KERN_SUCCESS; exception_raise(exc_port, retrieve_thread_self_fast(self), retrieve_task_self_fast(task), _exception, code, subcode); /*NOTREACHED*/ }
ipc_port_t ipc_port_make_sonce( ipc_port_t port) { assert(IP_VALID(port)); ip_lock(port); assert(ip_active(port)); port->ip_sorights++; ip_reference(port); ip_unlock(port); return port; }
boolean_t mig_object_no_senders( ipc_port_t port, mach_port_mscount_t mscount) { mig_object_t mig_object; ip_lock(port); if (port->ip_mscount > mscount) { ipc_port_t previous; /* * Somebody created new send rights while the * notification was in-flight. Just create a * new send-once right and re-register with * the new (higher) mscount threshold. */ /* make a sonce right for the notification */ port->ip_sorights++; ip_reference(port); ipc_port_nsrequest(port, mscount, port, &previous); /* port unlocked */ assert(previous == IP_NULL); return (FALSE); } /* * Clear the port pointer while we have it locked. */ mig_object = (mig_object_t)port->ip_kobject; mig_object->port = IP_NULL; /* * Bring the sequence number and mscount in * line with ipc_port_destroy assertion. */ port->ip_mscount = 0; port->ip_messages.imq_seqno = 0; ipc_port_destroy(port); /* releases lock */ /* * Release the port's reference on the object. */ mig_object->pVtbl->Release((IMIGObject *)mig_object); return (TRUE); }
ipc_port_t ipc_port_make_sonce( ipc_port_t port) { if (!IP_VALID(port)) return port; ip_lock(port); if (ip_active(port)) { port->ip_sorights++; ip_reference(port); ip_unlock(port); return port; } ip_unlock(port); return IP_DEAD; }
ipc_port_t ipc_port_copy_send( ipc_port_t port) { ipc_port_t sright; if (!IP_VALID(port)) return port; ip_lock(port); if (ip_active(port)) { assert(port->ip_srights > 0); ip_reference(port); port->ip_srights++; sright = port; } else sright = IP_DEAD; ip_unlock(port); return sright; }
mach_port_name_t mk_timer_create_trap( __unused struct mk_timer_create_trap_args *args) { mk_timer_t timer; ipc_space_t myspace = current_space(); mach_port_name_t name = MACH_PORT_NULL; ipc_port_t port; kern_return_t result; timer = (mk_timer_t)zalloc(mk_timer_zone); if (timer == NULL) return (MACH_PORT_NULL); result = mach_port_allocate_qos(myspace, MACH_PORT_RIGHT_RECEIVE, &mk_timer_qos, &name); if (result == KERN_SUCCESS) result = ipc_port_translate_receive(myspace, name, &port); if (result != KERN_SUCCESS) { zfree(mk_timer_zone, timer); return (MACH_PORT_NULL); } simple_lock_init(&timer->lock, 0); call_entry_setup(&timer->call_entry, mk_timer_expire, timer); timer->is_armed = timer->is_dead = FALSE; timer->active = 0; timer->port = port; ipc_kobject_set_atomically(port, (ipc_kobject_t)timer, IKOT_TIMER); port->ip_srights++; ip_reference(port); ip_unlock(port); return (name); }
kern_return_t ipc_right_copyin( ipc_space_t space, mach_port_t name, ipc_entry_t entry, mach_msg_type_name_t msgt_name, boolean_t deadok, ipc_object_t *objectp, ipc_port_t *sorightp) { ipc_entry_bits_t bits = entry->ie_bits; assert(space->is_active); switch (msgt_name) { case MACH_MSG_TYPE_MAKE_SEND: { ipc_port_t port; if ((bits & MACH_PORT_TYPE_RECEIVE) == 0) goto invalid_right; port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); port->ip_mscount++; port->ip_srights++; ip_reference(port); ip_unlock(port); *objectp = (ipc_object_t) port; *sorightp = IP_NULL; break; } case MACH_MSG_TYPE_MAKE_SEND_ONCE: { ipc_port_t port; if ((bits & MACH_PORT_TYPE_RECEIVE) == 0) goto invalid_right; port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); port->ip_sorights++; ip_reference(port); ip_unlock(port); *objectp = (ipc_object_t) port; *sorightp = IP_NULL; break; } case MACH_MSG_TYPE_MOVE_RECEIVE: { ipc_port_t port; ipc_port_t dnrequest = IP_NULL; if ((bits & MACH_PORT_TYPE_RECEIVE) == 0) goto invalid_right; port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); if (bits & MACH_PORT_TYPE_SEND) { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_RECEIVE); assert(IE_BITS_UREFS(bits) > 0); assert(port->ip_srights > 0); entry->ie_name = name; ipc_reverse_insert(space, (ipc_object_t) port, entry); ip_reference(port); } else { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_RECEIVE); assert(IE_BITS_UREFS(bits) == 0); dnrequest = ipc_right_dncancel_macro(space, port, name, entry); if (bits & IE_BITS_MAREQUEST) ipc_marequest_cancel(space, name); entry->ie_object = IO_NULL; } entry->ie_bits = bits &~ MACH_PORT_TYPE_RECEIVE; ipc_port_clear_receiver(port); port->ip_receiver_name = MACH_PORT_NULL; port->ip_destination = IP_NULL; /* * Clear the protected payload field to retain * the behavior of mach_msg. */ ipc_port_flag_protected_payload_clear(port); ip_unlock(port); *objectp = (ipc_object_t) port; *sorightp = dnrequest; break; } case MACH_MSG_TYPE_COPY_SEND: { ipc_port_t port; if (bits & MACH_PORT_TYPE_DEAD_NAME) goto copy_dead; /* allow for dead send-once rights */ if ((bits & MACH_PORT_TYPE_SEND_RIGHTS) == 0) goto invalid_right; assert(IE_BITS_UREFS(bits) > 0); port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); if (ipc_right_check(space, port, name, entry)) { bits = entry->ie_bits; goto copy_dead; } /* port is locked and active */ if ((bits & MACH_PORT_TYPE_SEND) == 0) { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_ONCE); assert(port->ip_sorights > 0); ip_unlock(port); goto invalid_right; } assert(port->ip_srights > 0); port->ip_srights++; ip_reference(port); ip_unlock(port); *objectp = (ipc_object_t) port; *sorightp = IP_NULL; break; } case MACH_MSG_TYPE_MOVE_SEND: { ipc_port_t port; ipc_port_t dnrequest = IP_NULL; if (bits & MACH_PORT_TYPE_DEAD_NAME) goto move_dead; /* allow for dead send-once rights */ if ((bits & MACH_PORT_TYPE_SEND_RIGHTS) == 0) goto invalid_right; assert(IE_BITS_UREFS(bits) > 0); port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); if (ipc_right_check(space, port, name, entry)) { bits = entry->ie_bits; goto move_dead; } /* port is locked and active */ if ((bits & MACH_PORT_TYPE_SEND) == 0) { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_ONCE); assert(port->ip_sorights > 0); ip_unlock(port); goto invalid_right; } assert(port->ip_srights > 0); if (IE_BITS_UREFS(bits) == 1) { if (bits & MACH_PORT_TYPE_RECEIVE) { assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_RECEIVE); ip_reference(port); } else { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND); dnrequest = ipc_right_dncancel_macro( space, port, name, entry); ipc_reverse_remove(space, (ipc_object_t) port); if (bits & IE_BITS_MAREQUEST) ipc_marequest_cancel(space, name); entry->ie_object = IO_NULL; } entry->ie_bits = bits &~ (IE_BITS_UREFS_MASK|MACH_PORT_TYPE_SEND); } else { port->ip_srights++; ip_reference(port); entry->ie_bits = bits-1; /* decrement urefs */ } ip_unlock(port); *objectp = (ipc_object_t) port; *sorightp = dnrequest; break; } case MACH_MSG_TYPE_MOVE_SEND_ONCE: { ipc_port_t port; ipc_port_t dnrequest; if (bits & MACH_PORT_TYPE_DEAD_NAME) goto move_dead; /* allow for dead send rights */ if ((bits & MACH_PORT_TYPE_SEND_RIGHTS) == 0) goto invalid_right; assert(IE_BITS_UREFS(bits) > 0); port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); if (ipc_right_check(space, port, name, entry)) { bits = entry->ie_bits; goto move_dead; } /* port is locked and active */ if ((bits & MACH_PORT_TYPE_SEND_ONCE) == 0) { assert(bits & MACH_PORT_TYPE_SEND); assert(port->ip_srights > 0); ip_unlock(port); goto invalid_right; } assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_ONCE); assert(IE_BITS_UREFS(bits) == 1); assert((bits & IE_BITS_MAREQUEST) == 0); assert(port->ip_sorights > 0); dnrequest = ipc_right_dncancel_macro(space, port, name, entry); ip_unlock(port); entry->ie_object = IO_NULL; entry->ie_bits = bits &~ MACH_PORT_TYPE_SEND_ONCE; *objectp = (ipc_object_t) port; *sorightp = dnrequest; break; } default: #if MACH_ASSERT assert(!"ipc_right_copyin: strange rights"); #else panic("ipc_right_copyin: strange rights"); #endif } return KERN_SUCCESS; copy_dead: assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_DEAD_NAME); assert(IE_BITS_UREFS(bits) > 0); assert((bits & IE_BITS_MAREQUEST) == 0); assert(entry->ie_request == 0); assert(entry->ie_object == 0); if (!deadok) goto invalid_right; *objectp = IO_DEAD; *sorightp = IP_NULL; return KERN_SUCCESS; move_dead: assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_DEAD_NAME); assert(IE_BITS_UREFS(bits) > 0); assert((bits & IE_BITS_MAREQUEST) == 0); assert(entry->ie_request == 0); assert(entry->ie_object == 0); if (!deadok) goto invalid_right; if (IE_BITS_UREFS(bits) == 1) entry->ie_bits = bits &~ MACH_PORT_TYPE_DEAD_NAME; else entry->ie_bits = bits-1; /* decrement urefs */ *objectp = IO_DEAD; *sorightp = IP_NULL; return KERN_SUCCESS; invalid_right: return KERN_INVALID_RIGHT; }
kern_return_t ipc_right_copyin_two( ipc_space_t space, mach_port_t name, ipc_entry_t entry, ipc_object_t *objectp, ipc_port_t *sorightp) { ipc_entry_bits_t bits = entry->ie_bits; mach_port_urefs_t urefs; ipc_port_t port; ipc_port_t dnrequest = IP_NULL; assert(space->is_active); if ((bits & MACH_PORT_TYPE_SEND) == 0) goto invalid_right; urefs = IE_BITS_UREFS(bits); if (urefs < 2) goto invalid_right; port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); if (ipc_right_check(space, port, name, entry)) { goto invalid_right; } /* port is locked and active */ assert(port->ip_srights > 0); if (urefs == 2) { if (bits & MACH_PORT_TYPE_RECEIVE) { assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_RECEIVE); port->ip_srights++; ip_reference(port); ip_reference(port); } else { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND); dnrequest = ipc_right_dncancel_macro(space, port, name, entry); ipc_reverse_remove(space, (ipc_object_t) port); if (bits & IE_BITS_MAREQUEST) ipc_marequest_cancel(space, name); port->ip_srights++; ip_reference(port); entry->ie_object = IO_NULL; } entry->ie_bits = bits &~ (IE_BITS_UREFS_MASK|MACH_PORT_TYPE_SEND); } else { port->ip_srights += 2; ip_reference(port); ip_reference(port); entry->ie_bits = bits-2; /* decrement urefs */ } ip_unlock(port); *objectp = (ipc_object_t) port; *sorightp = dnrequest; return KERN_SUCCESS; invalid_right: return KERN_INVALID_RIGHT; }
void ipc_port_reference(ipc_port_t port) { ip_reference(port); }
boolean_t ipc_port_check_circularity( ipc_port_t port, ipc_port_t dest) { ipc_port_t base; assert(port != IP_NULL); assert(dest != IP_NULL); if (port == dest) return TRUE; base = dest; /* * First try a quick check that can run in parallel. * No circularity if dest is not in transit. */ ip_lock(port); if (ip_lock_try(dest)) { if (!ip_active(dest) || (dest->ip_receiver_name != MACH_PORT_NULL) || (dest->ip_destination == IP_NULL)) goto not_circular; /* dest is in transit; further checking necessary */ ip_unlock(dest); } ip_unlock(port); ipc_port_multiple_lock(); /* massive serialization */ /* * Search for the end of the chain (a port not in transit), * acquiring locks along the way. */ for (;;) { ip_lock(base); if (!ip_active(base) || (base->ip_receiver_name != MACH_PORT_NULL) || (base->ip_destination == IP_NULL)) break; base = base->ip_destination; } /* all ports in chain from dest to base, inclusive, are locked */ if (port == base) { /* circularity detected! */ ipc_port_multiple_unlock(); /* port (== base) is in limbo */ assert(ip_active(port)); assert(port->ip_receiver_name == MACH_PORT_NULL); assert(port->ip_destination == IP_NULL); while (dest != IP_NULL) { ipc_port_t next; /* dest is in transit or in limbo */ assert(ip_active(dest)); assert(dest->ip_receiver_name == MACH_PORT_NULL); next = dest->ip_destination; ip_unlock(dest); dest = next; } return TRUE; } /* * The guarantee: lock port while the entire chain is locked. * Once port is locked, we can take a reference to dest, * add port to the chain, and unlock everything. */ ip_lock(port); ipc_port_multiple_unlock(); not_circular: /* port is in limbo */ assert(ip_active(port)); assert(port->ip_receiver_name == MACH_PORT_NULL); assert(port->ip_destination == IP_NULL); ip_reference(dest); port->ip_destination = dest; /* now unlock chain */ while (port != base) { ipc_port_t next; /* port is in transit */ assert(ip_active(port)); assert(port->ip_receiver_name == MACH_PORT_NULL); assert(port->ip_destination != IP_NULL); next = port->ip_destination; ip_unlock(port); port = next; } /* base is not in transit */ assert(!ip_active(base) || (base->ip_receiver_name != MACH_PORT_NULL) || (base->ip_destination == IP_NULL)); ip_unlock(base); return FALSE; }
/* * thread_switch: * * Context switch. User may supply thread hint. */ kern_return_t thread_switch( struct thread_switch_args *args) { thread_t thread = THREAD_NULL; thread_t self = current_thread(); mach_port_name_t thread_name = args->thread_name; int option = args->option; mach_msg_timeout_t option_time = args->option_time; uint32_t scale_factor = NSEC_PER_MSEC; boolean_t reenable_workq_callback = FALSE; boolean_t depress_option = FALSE; boolean_t wait_option = FALSE; /* * Validate and process option. */ switch (option) { case SWITCH_OPTION_NONE: workqueue_thread_yielded(); break; case SWITCH_OPTION_WAIT: wait_option = TRUE; workqueue_thread_yielded(); break; case SWITCH_OPTION_DEPRESS: depress_option = TRUE; workqueue_thread_yielded(); break; case SWITCH_OPTION_DISPATCH_CONTENTION: scale_factor = NSEC_PER_USEC; wait_option = TRUE; if (thread_switch_disable_workqueue_sched_callback()) reenable_workq_callback = TRUE; break; case SWITCH_OPTION_OSLOCK_DEPRESS: depress_option = TRUE; if (thread_switch_disable_workqueue_sched_callback()) reenable_workq_callback = TRUE; break; case SWITCH_OPTION_OSLOCK_WAIT: wait_option = TRUE; if (thread_switch_disable_workqueue_sched_callback()) reenable_workq_callback = TRUE; break; default: return (KERN_INVALID_ARGUMENT); } /* * Translate the port name if supplied. */ if (thread_name != MACH_PORT_NULL) { ipc_port_t port; if (ipc_port_translate_send(self->task->itk_space, thread_name, &port) == KERN_SUCCESS) { ip_reference(port); ip_unlock(port); thread = convert_port_to_thread(port); ip_release(port); if (thread == self) { thread_deallocate(thread); thread = THREAD_NULL; } } } if (option == SWITCH_OPTION_OSLOCK_DEPRESS || option == SWITCH_OPTION_OSLOCK_WAIT) { if (thread != THREAD_NULL) { if (thread->task != self->task) { /* * OSLock boosting only applies to other threads * in your same task (even if you have a port for * a thread in another task) */ thread_deallocate(thread); thread = THREAD_NULL; } else { /* * Attempt to kick the lock owner up to our same IO throttling tier. * If the thread is currently blocked in throttle_lowpri_io(), * it will immediately break out. * * TODO: SFI break out? */ int new_policy = proc_get_effective_thread_policy(self, TASK_POLICY_IO); set_thread_iotier_override(thread, new_policy); } } } /* * Try to handoff if supplied. */ if (thread != THREAD_NULL) { spl_t s = splsched(); /* This may return a different thread if the target is pushing on something */ thread_t pulled_thread = thread_run_queue_remove_for_handoff(thread); KERNEL_DEBUG_CONSTANT(MACHDBG_CODE(DBG_MACH_SCHED,MACH_SCHED_THREAD_SWITCH)|DBG_FUNC_NONE, thread_tid(thread), thread->state, pulled_thread ? TRUE : FALSE, 0, 0); if (pulled_thread != THREAD_NULL) { /* We can't be dropping the last ref here */ thread_deallocate_safe(thread); if (wait_option) assert_wait_timeout((event_t)assert_wait_timeout, THREAD_ABORTSAFE, option_time, scale_factor); else if (depress_option) thread_depress_ms(option_time); self->saved.swtch.option = option; self->saved.swtch.reenable_workq_callback = reenable_workq_callback; thread_run(self, (thread_continue_t)thread_switch_continue, NULL, pulled_thread); /* NOTREACHED */ panic("returned from thread_run!"); } splx(s); thread_deallocate(thread); } if (wait_option) assert_wait_timeout((event_t)assert_wait_timeout, THREAD_ABORTSAFE, option_time, scale_factor); else if (depress_option) thread_depress_ms(option_time); self->saved.swtch.option = option; self->saved.swtch.reenable_workq_callback = reenable_workq_callback; thread_block_reason((thread_continue_t)thread_switch_continue, NULL, AST_YIELD); if (depress_option) thread_depress_abort_internal(self); if (reenable_workq_callback) thread_switch_enable_workqueue_sched_callback(); return (KERN_SUCCESS); }
void ipc_object_copyout_dest( ipc_space_t space, ipc_object_t object, mach_msg_type_name_t msgt_name, mach_port_name_t *namep) { mach_port_name_t name; assert(IO_VALID(object)); assert(io_active(object)); io_release(object); /* * If the space is the receiver/owner of the object, * then we quietly consume the right and return * the space's name for the object. Otherwise * we destroy the right and return MACH_PORT_NULL. */ switch (msgt_name) { case MACH_MSG_TYPE_PORT_SEND: { ipc_port_t port = (ipc_port_t) object; ipc_port_t nsrequest = IP_NULL; mach_port_mscount_t mscount; if (port->ip_receiver == space) name = port->ip_receiver_name; else name = MACH_PORT_NULL; assert(port->ip_srights > 0); if (--port->ip_srights == 0 && port->ip_nsrequest != IP_NULL) { nsrequest = port->ip_nsrequest; port->ip_nsrequest = IP_NULL; mscount = port->ip_mscount; ip_unlock(port); ipc_notify_no_senders(nsrequest, mscount); } else ip_unlock(port); break; } case MACH_MSG_TYPE_PORT_SEND_ONCE: { ipc_port_t port = (ipc_port_t) object; assert(port->ip_sorights > 0); if (port->ip_receiver == space) { /* quietly consume the send-once right */ port->ip_sorights--; name = port->ip_receiver_name; ip_unlock(port); } else { /* * A very bizarre case. The message * was received, but before this copyout * happened the space lost receive rights. * We can't quietly consume the soright * out from underneath some other task, * so generate a send-once notification. */ ip_reference(port); /* restore ref */ ip_unlock(port); ipc_notify_send_once(port); name = MACH_PORT_NULL; } break; } default: panic("ipc_object_copyout_dest: strange rights"); name = MACH_PORT_DEAD; } *namep = name; }
void ipc_object_copyin_from_kernel( ipc_object_t object, mach_msg_type_name_t msgt_name) { assert(IO_VALID(object)); switch (msgt_name) { case MACH_MSG_TYPE_MOVE_RECEIVE: { ipc_port_t port = (ipc_port_t) object; ip_lock(port); assert(ip_active(port)); if (port->ip_destination != IP_NULL) { assert(port->ip_receiver == ipc_space_kernel); /* relevant part of ipc_port_clear_receiver */ ipc_port_set_mscount(port, 0); port->ip_receiver_name = MACH_PORT_NULL; port->ip_destination = IP_NULL; } ip_unlock(port); break; } case MACH_MSG_TYPE_COPY_SEND: { ipc_port_t port = (ipc_port_t) object; ip_lock(port); if (ip_active(port)) { assert(port->ip_srights > 0); port->ip_srights++; } ip_reference(port); ip_unlock(port); break; } case MACH_MSG_TYPE_MAKE_SEND: { ipc_port_t port = (ipc_port_t) object; ip_lock(port); if (ip_active(port)) { assert(port->ip_receiver_name != MACH_PORT_NULL); assert((port->ip_receiver == ipc_space_kernel) || (port->ip_receiver->is_node_id != HOST_LOCAL_NODE)); port->ip_mscount++; } port->ip_srights++; ip_reference(port); ip_unlock(port); break; } case MACH_MSG_TYPE_MOVE_SEND: { /* move naked send right into the message */ assert(((ipc_port_t)object)->ip_srights); break; } case MACH_MSG_TYPE_MAKE_SEND_ONCE: { ipc_port_t port = (ipc_port_t) object; ip_lock(port); if (ip_active(port)) { assert(port->ip_receiver_name != MACH_PORT_NULL); } port->ip_sorights++; ip_reference(port); ip_unlock(port); break; } case MACH_MSG_TYPE_MOVE_SEND_ONCE: { /* move naked send-once right into the message */ assert(((ipc_port_t)object)->ip_sorights); break; } default: panic("ipc_object_copyin_from_kernel: strange rights"); } }
/* * Routine: exception_deliver * Purpose: * Make an upcall to the exception server provided. * Conditions: * Nothing locked and no resources held. * Called from an exception context, so * thread_exception_return and thread_kdb_return * are possible. * Returns: * KERN_SUCCESS if the exception was handled */ kern_return_t exception_deliver( thread_t thread, exception_type_t exception, mach_exception_data_t code, mach_msg_type_number_t codeCnt, struct exception_action *excp, lck_mtx_t *mutex) { ipc_port_t exc_port; exception_data_type_t small_code[EXCEPTION_CODE_MAX]; int code64; int behavior; int flavor; kern_return_t kr; /* * Save work if we are terminating. * Just go back to our AST handler. */ if (!thread->active) return KERN_SUCCESS; /* * Snapshot the exception action data under lock for consistency. * Hold a reference to the port over the exception_raise_* calls * so it can't be destroyed. This seems like overkill, but keeps * the port from disappearing between now and when * ipc_object_copyin_from_kernel is finally called. */ lck_mtx_lock(mutex); exc_port = excp->port; if (!IP_VALID(exc_port)) { lck_mtx_unlock(mutex); return KERN_FAILURE; } ip_lock(exc_port); if (!ip_active(exc_port)) { ip_unlock(exc_port); lck_mtx_unlock(mutex); return KERN_FAILURE; } ip_reference(exc_port); exc_port->ip_srights++; ip_unlock(exc_port); flavor = excp->flavor; behavior = excp->behavior; lck_mtx_unlock(mutex); code64 = (behavior & MACH_EXCEPTION_CODES); behavior &= ~MACH_EXCEPTION_CODES; if (!code64) { small_code[0] = CAST_DOWN_EXPLICIT(exception_data_type_t, code[0]); small_code[1] = CAST_DOWN_EXPLICIT(exception_data_type_t, code[1]); } switch (behavior) { case EXCEPTION_STATE: { mach_msg_type_number_t state_cnt; thread_state_data_t state; c_thr_exc_raise_state++; state_cnt = _MachineStateCount[flavor]; kr = thread_getstatus(thread, flavor, (thread_state_t)state, &state_cnt); if (kr == KERN_SUCCESS) { if (code64) { kr = mach_exception_raise_state(exc_port, exception, code, codeCnt, &flavor, state, state_cnt, state, &state_cnt); } else { kr = exception_raise_state(exc_port, exception, small_code, codeCnt, &flavor, state, state_cnt, state, &state_cnt); } if (kr == MACH_MSG_SUCCESS) kr = thread_setstatus(thread, flavor, (thread_state_t)state, state_cnt); } return kr; } case EXCEPTION_DEFAULT: c_thr_exc_raise++; if (code64) { kr = mach_exception_raise(exc_port, retrieve_thread_self_fast(thread), retrieve_task_self_fast(thread->task), exception, code, codeCnt); } else { kr = exception_raise(exc_port, retrieve_thread_self_fast(thread), retrieve_task_self_fast(thread->task), exception, small_code, codeCnt); } return kr; case EXCEPTION_STATE_IDENTITY: { mach_msg_type_number_t state_cnt; thread_state_data_t state; c_thr_exc_raise_state_id++; state_cnt = _MachineStateCount[flavor]; kr = thread_getstatus(thread, flavor, (thread_state_t)state, &state_cnt); if (kr == KERN_SUCCESS) { if (code64) { kr = mach_exception_raise_state_identity( exc_port, retrieve_thread_self_fast(thread), retrieve_task_self_fast(thread->task), exception, code, codeCnt, &flavor, state, state_cnt, state, &state_cnt); } else { kr = exception_raise_state_identity(exc_port, retrieve_thread_self_fast(thread), retrieve_task_self_fast(thread->task), exception, small_code, codeCnt, &flavor, state, state_cnt, state, &state_cnt); } if (kr == MACH_MSG_SUCCESS) kr = thread_setstatus(thread, flavor, (thread_state_t)state, state_cnt); } return kr; } default: panic ("bad exception behavior!"); return KERN_FAILURE; }/* switch */ }
void exception_raise( ipc_port_t dest_port, ipc_port_t thread_port, ipc_port_t task_port, integer_t _exception, integer_t code, integer_t subcode) { ipc_thread_t self = current_thread(); ipc_thread_t receiver; ipc_port_t reply_port; ipc_mqueue_t dest_mqueue; ipc_mqueue_t reply_mqueue; ipc_kmsg_t kmsg; mach_msg_return_t mr; assert(IP_VALID(dest_port)); /* * We will eventually need a message buffer. * Grab the buffer now, while nothing is locked. * This buffer will get handed to the exception server, * and it will give the buffer back with its reply. */ kmsg = ikm_cache(); if (kmsg != IKM_NULL) { ikm_cache() = IKM_NULL; ikm_check_initialized(kmsg, IKM_SAVED_KMSG_SIZE); } else { kmsg = ikm_alloc(IKM_SAVED_MSG_SIZE); if (kmsg == IKM_NULL) panic("exception_raise"); ikm_init(kmsg, IKM_SAVED_MSG_SIZE); } /* * We need a reply port for the RPC. * Check first for a cached port. */ ith_lock(self); assert(self->ith_self != IP_NULL); reply_port = self->ith_rpc_reply; if (reply_port == IP_NULL) { ith_unlock(self); reply_port = ipc_port_alloc_reply(); ith_lock(self); if ((reply_port == IP_NULL) || (self->ith_rpc_reply != IP_NULL)) panic("exception_raise"); self->ith_rpc_reply = reply_port; } ip_lock(reply_port); assert(ip_active(reply_port)); ith_unlock(self); /* * Make a naked send-once right for the reply port, * to hand to the exception server. * Make an extra reference for the reply port, * to receive on. This protects us against * mach_msg_abort_rpc. */ reply_port->ip_sorights++; ip_reference(reply_port); ip_reference(reply_port); self->ith_port = reply_port; reply_mqueue = &reply_port->ip_messages; imq_lock(reply_mqueue); assert(ipc_kmsg_queue_empty(&reply_mqueue->imq_messages)); ip_unlock(reply_port); /* * Make sure we can queue to the destination port. */ if (!ip_lock_try(dest_port)) { imq_unlock(reply_mqueue); goto slow_exception_raise; } if (!ip_active(dest_port) || (dest_port->ip_receiver == ipc_space_kernel)) { imq_unlock(reply_mqueue); ip_unlock(dest_port); goto slow_exception_raise; } /* * Find the destination message queue. */ { ipc_pset_t dest_pset; dest_pset = dest_port->ip_pset; if (dest_pset == IPS_NULL) dest_mqueue = &dest_port->ip_messages; else dest_mqueue = &dest_pset->ips_messages; } if (!imq_lock_try(dest_mqueue)) { imq_unlock(reply_mqueue); ip_unlock(dest_port); goto slow_exception_raise; } /* * Safe to unlock dest_port, because we hold * dest_mqueue locked. We never bother changing * dest_port->ip_msgcount. */ ip_unlock(dest_port); receiver = ipc_thread_queue_first(&dest_mqueue->imq_threads); if ((receiver == ITH_NULL) || !((receiver->swap_func == (void (*)()) mach_msg_continue) || ((receiver->swap_func == (void (*)()) mach_msg_receive_continue) && (sizeof(struct mach_exception) <= receiver->ith_msize) && ((receiver->ith_option & MACH_RCV_NOTIFY) == 0))) || !thread_handoff(self, exception_raise_continue, receiver)) { imq_unlock(reply_mqueue); imq_unlock(dest_mqueue); goto slow_exception_raise; } counter(c_exception_raise_block++); assert(current_thread() == receiver); /* * We need to finish preparing self for its * time asleep in reply_mqueue. self is left * holding the extra ref for reply_port. */ ipc_thread_enqueue_macro(&reply_mqueue->imq_threads, self); self->ith_state = MACH_RCV_IN_PROGRESS; self->ith_msize = MACH_MSG_SIZE_MAX; imq_unlock(reply_mqueue); /* * Finish extracting receiver from dest_mqueue. */ ipc_thread_rmqueue_first_macro( &dest_mqueue->imq_threads, receiver); imq_unlock(dest_mqueue); /* * Release the receiver's reference for his object. */ { ipc_object_t object = receiver->ith_object; io_lock(object); io_release(object); io_check_unlock(object); } { struct mach_exception *exc = (struct mach_exception *) &kmsg->ikm_header; ipc_space_t space = receiver->task->itk_space; /* * We are running as the receiver now. We hold * the following resources, which must be consumed: * kmsg, send-once right for reply_port * send rights for dest_port, thread_port, task_port * Synthesize a kmsg for copyout to the receiver. */ exc->Head.msgh_bits = (MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, MACH_MSG_TYPE_PORT_SEND) | MACH_MSGH_BITS_COMPLEX); exc->Head.msgh_size = sizeof *exc; /* exc->Head.msgh_remote_port later */ /* exc->Head.msgh_local_port later */ exc->Head.msgh_seqno = 0; exc->Head.msgh_id = MACH_EXCEPTION_ID; exc->threadType = exc_port_proto; /* exc->thread later */ exc->taskType = exc_port_proto; /* exc->task later */ exc->exceptionType = exc_code_proto; exc->exception = _exception; exc->codeType = exc_code_proto; exc->code = code; exc->subcodeType = exc_code_proto; exc->subcode = subcode; /* * Check that the receiver can handle the message. */ if (receiver->ith_rcv_size < sizeof(struct mach_exception)) { /* * ipc_kmsg_destroy is a handy way to consume * the resources we hold, but it requires setup. */ exc->Head.msgh_bits = (MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE) | MACH_MSGH_BITS_COMPLEX); exc->Head.msgh_remote_port = (mach_port_t) dest_port; exc->Head.msgh_local_port = (mach_port_t) reply_port; exc->thread = (mach_port_t) thread_port; exc->task = (mach_port_t) task_port; ipc_kmsg_destroy(kmsg); thread_syscall_return(MACH_RCV_TOO_LARGE); /*NOTREACHED*/ } is_write_lock(space); assert(space->is_active); /* * To do an atomic copyout, need simultaneous * locks on both ports and the space. */ ip_lock(dest_port); if (!ip_active(dest_port) || !ip_lock_try(reply_port)) { abort_copyout: ip_unlock(dest_port); is_write_unlock(space); /* * Oh well, we have to do the header the slow way. * First make it look like it's in-transit. */ exc->Head.msgh_bits = (MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE) | MACH_MSGH_BITS_COMPLEX); exc->Head.msgh_remote_port = (mach_port_t) dest_port; exc->Head.msgh_local_port = (mach_port_t) reply_port; mr = ipc_kmsg_copyout_header(&exc->Head, space, MACH_PORT_NULL); if (mr == MACH_MSG_SUCCESS) goto copyout_body; /* * Ack! Prepare for ipc_kmsg_copyout_dest. * It will consume thread_port and task_port. */ exc->thread = (mach_port_t) thread_port; exc->task = (mach_port_t) task_port; ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(receiver->ith_msg, kmsg, sizeof(mach_msg_header_t)); thread_syscall_return(mr); /*NOTREACHED*/ } if (!ip_active(reply_port)) { ip_unlock(reply_port); goto abort_copyout; } assert(reply_port->ip_sorights > 0); ip_unlock(reply_port); { kern_return_t kr; ipc_entry_t entry; kr = ipc_entry_get (space, &exc->Head.msgh_remote_port, &entry); if (kr) goto abort_copyout; { mach_port_gen_t gen; assert((entry->ie_bits &~ IE_BITS_GEN_MASK) == 0); gen = entry->ie_bits + IE_BITS_GEN_ONE; /* optimized ipc_right_copyout */ entry->ie_bits = gen | (MACH_PORT_TYPE_SEND_ONCE | 1); } entry->ie_object = (ipc_object_t) reply_port; is_write_unlock(space); } /* optimized ipc_object_copyout_dest */ assert(dest_port->ip_srights > 0); ip_release(dest_port); exc->Head.msgh_local_port = ((dest_port->ip_receiver == space) ? dest_port->ip_receiver_name : MACH_PORT_NULL); if ((--dest_port->ip_srights == 0) && (dest_port->ip_nsrequest != IP_NULL)) { ipc_port_t nsrequest; mach_port_mscount_t mscount; /* a rather rare case */ nsrequest = dest_port->ip_nsrequest; mscount = dest_port->ip_mscount; dest_port->ip_nsrequest = IP_NULL; ip_unlock(dest_port); ipc_notify_no_senders(nsrequest, mscount); } else ip_unlock(dest_port); copyout_body: /* * Optimized version of ipc_kmsg_copyout_body, * to handle the two ports in the body. */ mr = (ipc_kmsg_copyout_object(space, (ipc_object_t) thread_port, MACH_MSG_TYPE_PORT_SEND, &exc->thread) | ipc_kmsg_copyout_object(space, (ipc_object_t) task_port, MACH_MSG_TYPE_PORT_SEND, &exc->task)); if (mr != MACH_MSG_SUCCESS) { (void) ipc_kmsg_put(receiver->ith_msg, kmsg, kmsg->ikm_header.msgh_size); thread_syscall_return(mr | MACH_RCV_BODY_ERROR); /*NOTREACHED*/ } } /* * Optimized version of ipc_kmsg_put. * We must check ikm_cache after copyoutmsg. */ ikm_check_initialized(kmsg, kmsg->ikm_size); assert(kmsg->ikm_size == IKM_SAVED_KMSG_SIZE); if (copyoutmsg(&kmsg->ikm_header, receiver->ith_msg, sizeof(struct mach_exception)) || (ikm_cache() != IKM_NULL)) { mr = ipc_kmsg_put(receiver->ith_msg, kmsg, kmsg->ikm_header.msgh_size); thread_syscall_return(mr); /*NOTREACHED*/ } ikm_cache() = kmsg; thread_syscall_return(MACH_MSG_SUCCESS); /*NOTREACHED*/ #ifndef __GNUC__ return; /* help for the compiler */ #endif slow_exception_raise: { struct mach_exception *exc = (struct mach_exception *) &kmsg->ikm_header; ipc_kmsg_t reply_kmsg; mach_port_seqno_t reply_seqno; exception_raise_misses++; /* * We hold the following resources, which must be consumed: * kmsg, send-once right and ref for reply_port * send rights for dest_port, thread_port, task_port * Synthesize a kmsg to send. */ exc->Head.msgh_bits = (MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE) | MACH_MSGH_BITS_COMPLEX); exc->Head.msgh_size = sizeof *exc; exc->Head.msgh_remote_port = (mach_port_t) dest_port; exc->Head.msgh_local_port = (mach_port_t) reply_port; exc->Head.msgh_seqno = 0; exc->Head.msgh_id = MACH_EXCEPTION_ID; exc->threadType = exc_port_proto; exc->thread = (mach_port_t) thread_port; exc->taskType = exc_port_proto; exc->task = (mach_port_t) task_port; exc->exceptionType = exc_code_proto; exc->exception = _exception; exc->codeType = exc_code_proto; exc->code = code; exc->subcodeType = exc_code_proto; exc->subcode = subcode; ipc_mqueue_send_always(kmsg); /* * We are left with a ref for reply_port, * which we use to receive the reply message. */ ip_lock(reply_port); if (!ip_active(reply_port)) { ip_unlock(reply_port); exception_raise_continue_slow(MACH_RCV_PORT_DIED, IKM_NULL, /*dummy*/0); /*NOTREACHED*/ } imq_lock(reply_mqueue); ip_unlock(reply_port); mr = ipc_mqueue_receive(reply_mqueue, MACH_MSG_OPTION_NONE, MACH_MSG_SIZE_MAX, MACH_MSG_TIMEOUT_NONE, FALSE, exception_raise_continue, &reply_kmsg, &reply_seqno); /* reply_mqueue is unlocked */ exception_raise_continue_slow(mr, reply_kmsg, reply_seqno); /*NOTREACHED*/ } }
void ipc_object_copyin_from_kernel( ipc_object_t object, mach_msg_type_name_t msgt_name) { assert(IO_VALID(object)); switch (msgt_name) { case MACH_MSG_TYPE_MOVE_RECEIVE: { ipc_port_t port = (ipc_port_t) object; ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name != MACH_PORT_NULL); assert(port->ip_receiver == ipc_space_kernel); /* relevant part of ipc_port_clear_receiver */ ipc_port_set_mscount(port, 0); port->ip_receiver_name = MACH_PORT_NULL; port->ip_destination = IP_NULL; ipc_port_flag_protected_payload_clear(port); ip_unlock(port); break; } case MACH_MSG_TYPE_COPY_SEND: { ipc_port_t port = (ipc_port_t) object; ip_lock(port); if (ip_active(port)) { assert(port->ip_srights > 0); port->ip_srights++; } ip_reference(port); ip_unlock(port); break; } case MACH_MSG_TYPE_MAKE_SEND: { ipc_port_t port = (ipc_port_t) object; ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name != MACH_PORT_NULL); assert(port->ip_receiver == ipc_space_kernel); ip_reference(port); port->ip_mscount++; port->ip_srights++; ip_unlock(port); break; } case MACH_MSG_TYPE_MOVE_SEND: /* move naked send right into the message */ break; case MACH_MSG_TYPE_MAKE_SEND_ONCE: { ipc_port_t port = (ipc_port_t) object; ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name != MACH_PORT_NULL); assert(port->ip_receiver == ipc_space_kernel); ip_reference(port); port->ip_sorights++; ip_unlock(port); break; } case MACH_MSG_TYPE_MOVE_SEND_ONCE: /* move naked send-once right into the message */ break; default: #if MACH_ASSERT assert(!"ipc_object_copyin_from_kernel: strange rights"); #else panic("ipc_object_copyin_from_kernel: strange rights"); #endif } }
kern_return_t ipc_port_request_grow( ipc_port_t port, ipc_table_elems_t target_size) { ipc_table_size_t its; ipc_port_request_t otable, ntable; assert(ip_active(port)); otable = port->ip_requests; if (otable == IPR_NULL) its = &ipc_table_requests[0]; else its = otable->ipr_size + 1; if (target_size != ITS_SIZE_NONE) { if ((otable != IPR_NULL) && (target_size <= otable->ipr_size->its_size)) { ip_unlock(port); return KERN_SUCCESS; } while ((its->its_size) && (its->its_size < target_size)) { its++; } if (its->its_size == 0) { ip_unlock(port); return KERN_NO_SPACE; } } ip_reference(port); ip_unlock(port); if ((its->its_size == 0) || ((ntable = it_requests_alloc(its)) == IPR_NULL)) { ip_release(port); return KERN_RESOURCE_SHORTAGE; } ip_lock(port); /* * Check that port is still active and that nobody else * has slipped in and grown the table on us. Note that * just checking if the current table pointer == otable * isn't sufficient; must check ipr_size. */ if (ip_active(port) && (port->ip_requests == otable) && ((otable == IPR_NULL) || (otable->ipr_size+1 == its))) { ipc_table_size_t oits; ipc_table_elems_t osize, nsize; ipc_port_request_index_t free, i; /* copy old table to new table */ if (otable != IPR_NULL) { oits = otable->ipr_size; osize = oits->its_size; free = otable->ipr_next; (void) memcpy((void *)(ntable + 1), (const void *)(otable + 1), (osize - 1) * sizeof(struct ipc_port_request)); } else { osize = 1; oits = 0; free = 0; } nsize = its->its_size; assert(nsize > osize); /* add new elements to the new table's free list */ for (i = osize; i < nsize; i++) { ipc_port_request_t ipr = &ntable[i]; ipr->ipr_name = MACH_PORT_NULL; ipr->ipr_next = free; free = i; } ntable->ipr_next = free; ntable->ipr_size = its; port->ip_requests = ntable; ip_unlock(port); ip_release(port); if (otable != IPR_NULL) { it_requests_free(oits, otable); } } else { ip_unlock(port); ip_release(port); it_requests_free(its, ntable); } return KERN_SUCCESS; }
mach_msg_return_t mach_msg_trap( mach_msg_header_t *msg, mach_msg_option_t option, mach_msg_size_t send_size, mach_msg_size_t rcv_size, mach_port_t rcv_name, mach_msg_timeout_t time_out, mach_port_t notify) { mach_msg_return_t mr; /* first check for common cases */ if (option == (MACH_SEND_MSG|MACH_RCV_MSG)) { ipc_thread_t self = current_thread(); ipc_space_t space = self->task->itk_space; ipc_kmsg_t kmsg; ipc_port_t dest_port; ipc_object_t rcv_object; ipc_mqueue_t rcv_mqueue; mach_msg_size_t reply_size; /* * This case is divided into ten sections, each * with a label. There are five optimized * sections and six unoptimized sections, which * do the same thing but handle all possible * cases and are slower. * * The five sections for an RPC are * 1) Get request message into a buffer. * (fast_get or slow_get) * 2) Copyin request message and rcv_name. * (fast_copyin or slow_copyin) * 3) Enqueue request and dequeue reply. * (fast_send_receive or * slow_send and slow_receive) * 4) Copyout reply message. * (fast_copyout or slow_copyout) * 5) Put reply message to user's buffer. * (fast_put or slow_put) * * Keep the locking hierarchy firmly in mind. * (First spaces, then ports, then port sets, * then message queues.) Only a non-blocking * attempt can be made to acquire locks out of * order, or acquire two locks on the same level. * Acquiring two locks on the same level will * fail if the objects are really the same, * unless simple locking is disabled. This is OK, * because then the extra unlock does nothing. * * There are two major reasons these RPCs can't use * ipc_thread_switch, and use slow_send/slow_receive: * 1) Kernel RPCs. * 2) Servers fall behind clients, so * client doesn't find a blocked server thread and * server finds waiting messages and can't block. */ /* fast_get: */ /* * optimized ipc_kmsg_get * * No locks, references, or messages held. * We must clear ikm_cache before copyinmsg. */ if ((send_size > IKM_SAVED_MSG_SIZE) || (send_size < sizeof(mach_msg_header_t)) || (send_size & 3) || ((kmsg = ikm_cache()) == IKM_NULL)) goto slow_get; ikm_cache() = IKM_NULL; ikm_check_initialized(kmsg, IKM_SAVED_KMSG_SIZE); if (copyinmsg(msg, &kmsg->ikm_header, send_size)) { ikm_free(kmsg); goto slow_get; } kmsg->ikm_header.msgh_size = send_size; fast_copyin: /* * optimized ipc_kmsg_copyin/ipc_mqueue_copyin * * We have the request message data in kmsg. * Must still do copyin, send, receive, etc. * * If the message isn't simple, we can't combine * ipc_kmsg_copyin_header and ipc_mqueue_copyin, * because copyin of the message body might * affect rcv_name. */ switch (kmsg->ikm_header.msgh_bits) { case MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE): { ipc_entry_t table; ipc_entry_num_t size; ipc_port_t reply_port; /* sending a request message */ { mach_port_index_t index; mach_port_gen_t gen; { mach_port_t reply_name = kmsg->ikm_header.msgh_local_port; if (reply_name != rcv_name) goto slow_copyin; /* optimized ipc_entry_lookup of reply_name */ index = MACH_PORT_INDEX(reply_name); gen = MACH_PORT_GEN(reply_name); } is_read_lock(space); assert(space->is_active); size = space->is_table_size; table = space->is_table; if (index >= size) goto abort_request_copyin; { ipc_entry_t entry; ipc_entry_bits_t bits; entry = &table[index]; bits = entry->ie_bits; /* check generation number and type bit */ if ((bits & (IE_BITS_GEN_MASK| MACH_PORT_TYPE_RECEIVE)) != (gen | MACH_PORT_TYPE_RECEIVE)) goto abort_request_copyin; reply_port = (ipc_port_t) entry->ie_object; assert(reply_port != IP_NULL); } } /* optimized ipc_entry_lookup of dest_name */ { mach_port_index_t index; mach_port_gen_t gen; { mach_port_t dest_name = kmsg->ikm_header.msgh_remote_port; index = MACH_PORT_INDEX(dest_name); gen = MACH_PORT_GEN(dest_name); } if (index >= size) goto abort_request_copyin; { ipc_entry_t entry; ipc_entry_bits_t bits; entry = &table[index]; bits = entry->ie_bits; /* check generation number and type bit */ if ((bits & (IE_BITS_GEN_MASK|MACH_PORT_TYPE_SEND)) != (gen | MACH_PORT_TYPE_SEND)) goto abort_request_copyin; assert(IE_BITS_UREFS(bits) > 0); dest_port = (ipc_port_t) entry->ie_object; assert(dest_port != IP_NULL); } } /* * To do an atomic copyin, need simultaneous * locks on both ports and the space. If * dest_port == reply_port, and simple locking is * enabled, then we will abort. Otherwise it's * OK to unlock twice. */ ip_lock(dest_port); if (!ip_active(dest_port) || !ip_lock_try(reply_port)) { ip_unlock(dest_port); goto abort_request_copyin; } is_read_unlock(space); assert(dest_port->ip_srights > 0); dest_port->ip_srights++; ip_reference(dest_port); assert(ip_active(reply_port)); assert(reply_port->ip_receiver_name == kmsg->ikm_header.msgh_local_port); assert(reply_port->ip_receiver == space); reply_port->ip_sorights++; ip_reference(reply_port); kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE); kmsg->ikm_header.msgh_remote_port = (mach_port_t) dest_port; kmsg->ikm_header.msgh_local_port = (mach_port_t) reply_port; /* make sure we can queue to the destination */ if (dest_port->ip_receiver == ipc_space_kernel) { /* * The kernel server has a reference to * the reply port, which it hands back * to us in the reply message. We do * not need to keep another reference to * it. */ ip_unlock(reply_port); assert(ip_active(dest_port)); ip_unlock(dest_port); goto kernel_send; } if (dest_port->ip_msgcount >= dest_port->ip_qlimit) goto abort_request_send_receive; /* optimized ipc_mqueue_copyin */ if (reply_port->ip_pset != IPS_NULL) goto abort_request_send_receive; rcv_object = (ipc_object_t) reply_port; io_reference(rcv_object); rcv_mqueue = &reply_port->ip_messages; imq_lock(rcv_mqueue); io_unlock(rcv_object); goto fast_send_receive; abort_request_copyin: is_read_unlock(space); goto slow_copyin; abort_request_send_receive: ip_unlock(dest_port); ip_unlock(reply_port); goto slow_send; } case MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND_ONCE, 0): { ipc_entry_num_t size; ipc_entry_t table; /* sending a reply message */ { mach_port_t reply_name = kmsg->ikm_header.msgh_local_port; if (reply_name != MACH_PORT_NULL) goto slow_copyin; } is_write_lock(space); assert(space->is_active); /* optimized ipc_entry_lookup */ size = space->is_table_size; table = space->is_table; { ipc_entry_t entry; mach_port_gen_t gen; mach_port_index_t index; { mach_port_t dest_name = kmsg->ikm_header.msgh_remote_port; index = MACH_PORT_INDEX(dest_name); gen = MACH_PORT_GEN(dest_name); } if (index >= size) goto abort_reply_dest_copyin; entry = &table[index]; /* check generation, collision bit, and type bit */ if ((entry->ie_bits & (IE_BITS_GEN_MASK| IE_BITS_COLLISION| MACH_PORT_TYPE_SEND_ONCE)) != (gen | MACH_PORT_TYPE_SEND_ONCE)) goto abort_reply_dest_copyin; /* optimized ipc_right_copyin */ assert(IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_SEND_ONCE); assert(IE_BITS_UREFS(entry->ie_bits) == 1); assert((entry->ie_bits & IE_BITS_MAREQUEST) == 0); if (entry->ie_request != 0) goto abort_reply_dest_copyin; dest_port = (ipc_port_t) entry->ie_object; assert(dest_port != IP_NULL); ip_lock(dest_port); if (!ip_active(dest_port)) { ip_unlock(dest_port); goto abort_reply_dest_copyin; } assert(dest_port->ip_sorights > 0); /* optimized ipc_entry_dealloc */ entry->ie_next = table->ie_next; table->ie_next = index; entry->ie_bits = gen; entry->ie_object = IO_NULL; } kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, 0); kmsg->ikm_header.msgh_remote_port = (mach_port_t) dest_port; /* make sure we can queue to the destination */ assert(dest_port->ip_receiver != ipc_space_kernel); /* optimized ipc_entry_lookup/ipc_mqueue_copyin */ { ipc_entry_t entry; ipc_entry_bits_t bits; { mach_port_index_t index; mach_port_gen_t gen; index = MACH_PORT_INDEX(rcv_name); gen = MACH_PORT_GEN(rcv_name); if (index >= size) goto abort_reply_rcv_copyin; entry = &table[index]; bits = entry->ie_bits; /* check generation number */ if ((bits & IE_BITS_GEN_MASK) != gen) goto abort_reply_rcv_copyin; } /* check type bits; looking for receive or set */ if (bits & MACH_PORT_TYPE_PORT_SET) { ipc_pset_t rcv_pset; rcv_pset = (ipc_pset_t) entry->ie_object; assert(rcv_pset != IPS_NULL); ips_lock(rcv_pset); assert(ips_active(rcv_pset)); rcv_object = (ipc_object_t) rcv_pset; rcv_mqueue = &rcv_pset->ips_messages; } else if (bits & MACH_PORT_TYPE_RECEIVE) { ipc_port_t rcv_port; rcv_port = (ipc_port_t) entry->ie_object; assert(rcv_port != IP_NULL); if (!ip_lock_try(rcv_port)) goto abort_reply_rcv_copyin; assert(ip_active(rcv_port)); if (rcv_port->ip_pset != IPS_NULL) { ip_unlock(rcv_port); goto abort_reply_rcv_copyin; } rcv_object = (ipc_object_t) rcv_port; rcv_mqueue = &rcv_port->ip_messages; } else goto abort_reply_rcv_copyin; } is_write_unlock(space); io_reference(rcv_object); imq_lock(rcv_mqueue); io_unlock(rcv_object); goto fast_send_receive; abort_reply_dest_copyin: is_write_unlock(space); goto slow_copyin; abort_reply_rcv_copyin: ip_unlock(dest_port); is_write_unlock(space); goto slow_send; } default: goto slow_copyin; } /*NOTREACHED*/ fast_send_receive: /* * optimized ipc_mqueue_send/ipc_mqueue_receive * * Finished get/copyin of kmsg and copyin of rcv_name. * space is unlocked, dest_port is locked, * we can queue kmsg to dest_port, * rcv_mqueue is locked, rcv_object holds a ref, * if rcv_object is a port it isn't in a port set * * Note that if simple locking is turned off, * then we could have dest_mqueue == rcv_mqueue * and not abort when we try to lock dest_mqueue. */ assert(ip_active(dest_port)); assert(dest_port->ip_receiver != ipc_space_kernel); assert((dest_port->ip_msgcount < dest_port->ip_qlimit) || (MACH_MSGH_BITS_REMOTE(kmsg->ikm_header.msgh_bits) == MACH_MSG_TYPE_PORT_SEND_ONCE)); assert((kmsg->ikm_header.msgh_bits & MACH_MSGH_BITS_CIRCULAR) == 0); { ipc_mqueue_t dest_mqueue; ipc_thread_t receiver; { ipc_pset_t dest_pset; dest_pset = dest_port->ip_pset; if (dest_pset == IPS_NULL) dest_mqueue = &dest_port->ip_messages; else dest_mqueue = &dest_pset->ips_messages; } if (!imq_lock_try(dest_mqueue)) { abort_send_receive: ip_unlock(dest_port); imq_unlock(rcv_mqueue); ipc_object_release(rcv_object); goto slow_send; } receiver = ipc_thread_queue_first(&dest_mqueue->imq_threads); if ((receiver == ITH_NULL) || (ipc_kmsg_queue_first(&rcv_mqueue->imq_messages) != IKM_NULL)) { imq_unlock(dest_mqueue); goto abort_send_receive; } /* * There is a receiver thread waiting, and * there is no reply message for us to pick up. * We have hope of hand-off, so save state. */ self->ith_msg = msg; self->ith_rcv_size = rcv_size; self->ith_object = rcv_object; self->ith_mqueue = rcv_mqueue; if ((receiver->swap_func == (void (*)()) mach_msg_continue) && thread_handoff(self, mach_msg_continue, receiver)) { assert(current_thread() == receiver); /* * We can use the optimized receive code, * because the receiver is using no options. */ } else if ((receiver->swap_func == (void (*)()) exception_raise_continue) && thread_handoff(self, mach_msg_continue, receiver)) { counter(c_mach_msg_trap_block_exc++); assert(current_thread() == receiver); /* * We are a reply message coming back through * the optimized exception-handling path. * Finish with rcv_mqueue and dest_mqueue, * and then jump to exception code with * dest_port still locked. We don't bother * with a sequence number in this case. */ ipc_thread_enqueue_macro( &rcv_mqueue->imq_threads, self); self->ith_state = MACH_RCV_IN_PROGRESS; self->ith_msize = MACH_MSG_SIZE_MAX; imq_unlock(rcv_mqueue); ipc_thread_rmqueue_first_macro( &dest_mqueue->imq_threads, receiver); imq_unlock(dest_mqueue); exception_raise_continue_fast(dest_port, kmsg); /*NOTREACHED*/ return MACH_MSG_SUCCESS; } else if ((send_size <= receiver->ith_msize) && thread_handoff(self, mach_msg_continue, receiver)) { assert(current_thread() == receiver); if ((receiver->swap_func == (void (*)()) mach_msg_receive_continue) && ((receiver->ith_option & MACH_RCV_NOTIFY) == 0)) { /* * We can still use the optimized code. */ } else { counter(c_mach_msg_trap_block_slow++); /* * We are running as the receiver, * but we can't use the optimized code. * Finish send/receive processing. */ dest_port->ip_msgcount++; ip_unlock(dest_port); ipc_thread_enqueue_macro( &rcv_mqueue->imq_threads, self); self->ith_state = MACH_RCV_IN_PROGRESS; self->ith_msize = MACH_MSG_SIZE_MAX; imq_unlock(rcv_mqueue); ipc_thread_rmqueue_first_macro( &dest_mqueue->imq_threads, receiver); receiver->ith_state = MACH_MSG_SUCCESS; receiver->ith_kmsg = kmsg; receiver->ith_seqno = dest_port->ip_seqno++; imq_unlock(dest_mqueue); /* * Call the receiver's continuation. */ receiver->wait_result = THREAD_AWAKENED; (*receiver->swap_func)(); /*NOTREACHED*/ return MACH_MSG_SUCCESS; } } else { /* * The receiver can't accept the message, * or we can't switch to the receiver. */ imq_unlock(dest_mqueue); goto abort_send_receive; } counter(c_mach_msg_trap_block_fast++); /* * Safe to unlock dest_port now that we are * committed to this path, because we hold * dest_mqueue locked. We never bother changing * dest_port->ip_msgcount. */ ip_unlock(dest_port); /* * We need to finish preparing self for its * time asleep in rcv_mqueue. */ ipc_thread_enqueue_macro(&rcv_mqueue->imq_threads, self); self->ith_state = MACH_RCV_IN_PROGRESS; self->ith_msize = MACH_MSG_SIZE_MAX; imq_unlock(rcv_mqueue); /* * Finish extracting receiver from dest_mqueue. */ ipc_thread_rmqueue_first_macro( &dest_mqueue->imq_threads, receiver); kmsg->ikm_header.msgh_seqno = dest_port->ip_seqno++; imq_unlock(dest_mqueue); /* * We don't have to do any post-dequeue processing of * the message. We never incremented ip_msgcount, we * know it has no msg-accepted request, and blocked * senders aren't a worry because we found the port * with a receiver waiting. */ self = receiver; space = self->task->itk_space; msg = self->ith_msg; rcv_size = self->ith_rcv_size; rcv_object = self->ith_object; /* inline ipc_object_release */ io_lock(rcv_object); io_release(rcv_object); io_check_unlock(rcv_object); } fast_copyout: /* * Nothing locked and no references held, except * we have kmsg with msgh_seqno filled in. Must * still check against rcv_size and do * ipc_kmsg_copyout/ipc_kmsg_put. */ assert((ipc_port_t) kmsg->ikm_header.msgh_remote_port == dest_port); reply_size = kmsg->ikm_header.msgh_size; if (rcv_size < reply_size) goto slow_copyout; /* optimized ipc_kmsg_copyout/ipc_kmsg_copyout_header */ switch (kmsg->ikm_header.msgh_bits) { case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE): { ipc_port_t reply_port = (ipc_port_t) kmsg->ikm_header.msgh_local_port; mach_port_t dest_name, reply_name; /* receiving a request message */ if (!IP_VALID(reply_port)) goto slow_copyout; is_write_lock(space); assert(space->is_active); /* * To do an atomic copyout, need simultaneous * locks on both ports and the space. If * dest_port == reply_port, and simple locking is * enabled, then we will abort. Otherwise it's * OK to unlock twice. */ ip_lock(dest_port); if (!ip_active(dest_port) || !ip_lock_try(reply_port)) goto abort_request_copyout; if (!ip_active(reply_port)) { ip_unlock(reply_port); goto abort_request_copyout; } assert(reply_port->ip_sorights > 0); ip_unlock(reply_port); { ipc_entry_t table; ipc_entry_t entry; mach_port_index_t index; /* optimized ipc_entry_get */ table = space->is_table; index = table->ie_next; if (index == 0) goto abort_request_copyout; entry = &table[index]; table->ie_next = entry->ie_next; entry->ie_request = 0; { mach_port_gen_t gen; assert((entry->ie_bits &~ IE_BITS_GEN_MASK) == 0); gen = entry->ie_bits + IE_BITS_GEN_ONE; reply_name = MACH_PORT_MAKE(index, gen); /* optimized ipc_right_copyout */ entry->ie_bits = gen | (MACH_PORT_TYPE_SEND_ONCE | 1); } assert(MACH_PORT_VALID(reply_name)); entry->ie_object = (ipc_object_t) reply_port; is_write_unlock(space); } /* optimized ipc_object_copyout_dest */ assert(dest_port->ip_srights > 0); ip_release(dest_port); if (dest_port->ip_receiver == space) dest_name = dest_port->ip_receiver_name; else dest_name = MACH_PORT_NULL; if ((--dest_port->ip_srights == 0) && (dest_port->ip_nsrequest != IP_NULL)) { ipc_port_t nsrequest; mach_port_mscount_t mscount; /* a rather rare case */ nsrequest = dest_port->ip_nsrequest; mscount = dest_port->ip_mscount; dest_port->ip_nsrequest = IP_NULL; ip_unlock(dest_port); ipc_notify_no_senders(nsrequest, mscount); } else ip_unlock(dest_port); if (! ipc_port_flag_protected_payload(dest_port)) { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS( MACH_MSG_TYPE_PORT_SEND_ONCE, MACH_MSG_TYPE_PORT_SEND); kmsg->ikm_header.msgh_local_port = dest_name; } else { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS( MACH_MSG_TYPE_PORT_SEND_ONCE, MACH_MSG_TYPE_PROTECTED_PAYLOAD); kmsg->ikm_header.msgh_protected_payload = dest_port->ip_protected_payload; } kmsg->ikm_header.msgh_remote_port = reply_name; goto fast_put; abort_request_copyout: ip_unlock(dest_port); is_write_unlock(space); goto slow_copyout; } case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, 0): { mach_port_t dest_name; /* receiving a reply message */ ip_lock(dest_port); if (!ip_active(dest_port)) goto slow_copyout; /* optimized ipc_object_copyout_dest */ assert(dest_port->ip_sorights > 0); if (dest_port->ip_receiver == space) { ip_release(dest_port); dest_port->ip_sorights--; dest_name = dest_port->ip_receiver_name; ip_unlock(dest_port); } else { ip_unlock(dest_port); ipc_notify_send_once(dest_port); dest_name = MACH_PORT_NULL; } if (! ipc_port_flag_protected_payload(dest_port)) { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS( 0, MACH_MSG_TYPE_PORT_SEND_ONCE); kmsg->ikm_header.msgh_local_port = dest_name; } else { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS( 0, MACH_MSG_TYPE_PROTECTED_PAYLOAD); kmsg->ikm_header.msgh_protected_payload = dest_port->ip_protected_payload; } kmsg->ikm_header.msgh_remote_port = MACH_PORT_NULL; goto fast_put; } case MACH_MSGH_BITS_COMPLEX| MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, 0): { mach_port_t dest_name; /* receiving a complex reply message */ ip_lock(dest_port); if (!ip_active(dest_port)) goto slow_copyout; /* optimized ipc_object_copyout_dest */ assert(dest_port->ip_sorights > 0); if (dest_port->ip_receiver == space) { ip_release(dest_port); dest_port->ip_sorights--; dest_name = dest_port->ip_receiver_name; ip_unlock(dest_port); } else { ip_unlock(dest_port); ipc_notify_send_once(dest_port); dest_name = MACH_PORT_NULL; } if (! ipc_port_flag_protected_payload(dest_port)) { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS( 0, MACH_MSG_TYPE_PORT_SEND_ONCE); kmsg->ikm_header.msgh_local_port = dest_name; } else { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS( 0, MACH_MSG_TYPE_PROTECTED_PAYLOAD); kmsg->ikm_header.msgh_protected_payload = dest_port->ip_protected_payload; } kmsg->ikm_header.msgh_remote_port = MACH_PORT_NULL; mr = ipc_kmsg_copyout_body( (vm_offset_t) (&kmsg->ikm_header + 1), (vm_offset_t) &kmsg->ikm_header + kmsg->ikm_header.msgh_size, space, current_map()); if (mr != MACH_MSG_SUCCESS) { (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); return mr | MACH_RCV_BODY_ERROR; } goto fast_put; } default: goto slow_copyout; } /*NOTREACHED*/ fast_put: /* * We have the reply message data in kmsg, * and the reply message size in reply_size. * Just need to copy it out to the user and free kmsg. * We must check ikm_cache after copyoutmsg. */ ikm_check_initialized(kmsg, kmsg->ikm_size); if ((kmsg->ikm_size != IKM_SAVED_KMSG_SIZE) || copyoutmsg(&kmsg->ikm_header, msg, reply_size) || (ikm_cache() != IKM_NULL)) goto slow_put; ikm_cache() = kmsg; thread_syscall_return(MACH_MSG_SUCCESS); /*NOTREACHED*/ return MACH_MSG_SUCCESS; /* help for the compiler */ /* * The slow path has a few non-register temporary * variables used only for call-by-reference. */ { ipc_kmsg_t temp_kmsg; mach_port_seqno_t temp_seqno; ipc_object_t temp_rcv_object; ipc_mqueue_t temp_rcv_mqueue; slow_get: /* * No locks, references, or messages held. * Still have to get the request, send it, * receive reply, etc. */ mr = ipc_kmsg_get(msg, send_size, &temp_kmsg); if (mr != MACH_MSG_SUCCESS) { thread_syscall_return(mr); /*NOTREACHED*/ } kmsg = temp_kmsg; /* try to get back on optimized path */ goto fast_copyin; slow_copyin: /* * We have the message data in kmsg, but * we still need to copyin, send it, * receive a reply, and do copyout. */ mr = ipc_kmsg_copyin(kmsg, space, current_map(), MACH_PORT_NULL); if (mr != MACH_MSG_SUCCESS) { ikm_free(kmsg); thread_syscall_return(mr); /*NOTREACHED*/ } /* try to get back on optimized path */ if (kmsg->ikm_header.msgh_bits & MACH_MSGH_BITS_CIRCULAR) goto slow_send; dest_port = (ipc_port_t) kmsg->ikm_header.msgh_remote_port; assert(IP_VALID(dest_port)); ip_lock(dest_port); if (dest_port->ip_receiver == ipc_space_kernel) { assert(ip_active(dest_port)); ip_unlock(dest_port); goto kernel_send; } if (ip_active(dest_port) && ((dest_port->ip_msgcount < dest_port->ip_qlimit) || (MACH_MSGH_BITS_REMOTE(kmsg->ikm_header.msgh_bits) == MACH_MSG_TYPE_PORT_SEND_ONCE))) { /* * Try an optimized ipc_mqueue_copyin. * It will work if this is a request message. */ ipc_port_t reply_port; reply_port = (ipc_port_t) kmsg->ikm_header.msgh_local_port; if (IP_VALID(reply_port)) { if (ip_lock_try(reply_port)) { if (ip_active(reply_port) && reply_port->ip_receiver == space && reply_port->ip_receiver_name == rcv_name && reply_port->ip_pset == IPS_NULL) { /* Grab a reference to the reply port. */ rcv_object = (ipc_object_t) reply_port; io_reference(rcv_object); rcv_mqueue = &reply_port->ip_messages; imq_lock(rcv_mqueue); io_unlock(rcv_object); goto fast_send_receive; } ip_unlock(reply_port); } } } ip_unlock(dest_port); goto slow_send; kernel_send: /* * Special case: send message to kernel services. * The request message has been copied into the * kmsg. Nothing is locked. */ { ipc_port_t reply_port; /* * Perform the kernel function. */ kmsg = ipc_kobject_server(kmsg); if (kmsg == IKM_NULL) { /* * No reply. Take the * slow receive path. */ goto slow_get_rcv_port; } /* * Check that: * the reply port is alive * we hold the receive right * the name has not changed. * the port is not in a set * If any of these are not true, * we cannot directly receive the reply * message. */ reply_port = (ipc_port_t) kmsg->ikm_header.msgh_remote_port; ip_lock(reply_port); if ((!ip_active(reply_port)) || (reply_port->ip_receiver != space) || (reply_port->ip_receiver_name != rcv_name) || (reply_port->ip_pset != IPS_NULL)) { ip_unlock(reply_port); ipc_mqueue_send_always(kmsg); goto slow_get_rcv_port; } rcv_mqueue = &reply_port->ip_messages; imq_lock(rcv_mqueue); /* keep port locked, and don`t change ref count yet */ /* * If there are messages on the port * or other threads waiting for a message, * we cannot directly receive the reply. */ if ((ipc_thread_queue_first(&rcv_mqueue->imq_threads) != ITH_NULL) || (ipc_kmsg_queue_first(&rcv_mqueue->imq_messages) != IKM_NULL)) { imq_unlock(rcv_mqueue); ip_unlock(reply_port); ipc_mqueue_send_always(kmsg); goto slow_get_rcv_port; } /* * We can directly receive this reply. * Since the kernel reply never blocks, * it holds no message_accepted request. * Since there were no messages queued * on the reply port, there should be * no threads blocked waiting to send. */ assert(kmsg->ikm_marequest == IMAR_NULL); assert(ipc_thread_queue_first(&reply_port->ip_blocked) == ITH_NULL); dest_port = reply_port; kmsg->ikm_header.msgh_seqno = dest_port->ip_seqno++; imq_unlock(rcv_mqueue); /* * inline ipc_object_release. * Port is still locked. * Reference count was not incremented. */ ip_check_unlock(reply_port); /* copy out the kernel reply */ goto fast_copyout; } slow_send: /* * Nothing is locked. We have acquired kmsg, but * we still need to send it and receive a reply. */ mr = ipc_mqueue_send(kmsg, MACH_MSG_OPTION_NONE, MACH_MSG_TIMEOUT_NONE); if (mr != MACH_MSG_SUCCESS) { mr |= ipc_kmsg_copyout_pseudo(kmsg, space, current_map()); assert(kmsg->ikm_marequest == IMAR_NULL); (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); thread_syscall_return(mr); /*NOTREACHED*/ } slow_get_rcv_port: /* * We have sent the message. Copy in the receive port. */ mr = ipc_mqueue_copyin(space, rcv_name, &temp_rcv_mqueue, &temp_rcv_object); if (mr != MACH_MSG_SUCCESS) { thread_syscall_return(mr); /*NOTREACHED*/ } rcv_mqueue = temp_rcv_mqueue; rcv_object = temp_rcv_object; /* hold ref for rcv_object; rcv_mqueue is locked */ /* slow_receive: */ /* * Now we have sent the request and copied in rcv_name, * so rcv_mqueue is locked and hold ref for rcv_object. * Just receive a reply and try to get back to fast path. * * ipc_mqueue_receive may not return, because if we block * then our kernel stack may be discarded. So we save * state here for mach_msg_continue to pick up. */ self->ith_msg = msg; self->ith_rcv_size = rcv_size; self->ith_object = rcv_object; self->ith_mqueue = rcv_mqueue; mr = ipc_mqueue_receive(rcv_mqueue, MACH_MSG_OPTION_NONE, MACH_MSG_SIZE_MAX, MACH_MSG_TIMEOUT_NONE, FALSE, mach_msg_continue, &temp_kmsg, &temp_seqno); /* rcv_mqueue is unlocked */ ipc_object_release(rcv_object); if (mr != MACH_MSG_SUCCESS) { thread_syscall_return(mr); /*NOTREACHED*/ } (kmsg = temp_kmsg)->ikm_header.msgh_seqno = temp_seqno; dest_port = (ipc_port_t) kmsg->ikm_header.msgh_remote_port; goto fast_copyout; slow_copyout: /* * Nothing locked and no references held, except * we have kmsg with msgh_seqno filled in. Must * still check against rcv_size and do * ipc_kmsg_copyout/ipc_kmsg_put. */ reply_size = kmsg->ikm_header.msgh_size; if (rcv_size < reply_size) { ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(msg, kmsg, sizeof *msg); thread_syscall_return(MACH_RCV_TOO_LARGE); /*NOTREACHED*/ } mr = ipc_kmsg_copyout(kmsg, space, current_map(), MACH_PORT_NULL); if (mr != MACH_MSG_SUCCESS) { if ((mr &~ MACH_MSG_MASK) == MACH_RCV_BODY_ERROR) { (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); } else { ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(msg, kmsg, sizeof *msg); } thread_syscall_return(mr); /*NOTREACHED*/ } /* try to get back on optimized path */ goto fast_put; slow_put: mr = ipc_kmsg_put(msg, kmsg, reply_size); thread_syscall_return(mr); /*NOTREACHED*/ } } else if (option == MACH_SEND_MSG) { ipc_space_t space = current_space(); vm_map_t map = current_map(); ipc_kmsg_t kmsg; mr = ipc_kmsg_get(msg, send_size, &kmsg); if (mr != MACH_MSG_SUCCESS) return mr; mr = ipc_kmsg_copyin(kmsg, space, map, MACH_PORT_NULL); if (mr != MACH_MSG_SUCCESS) { ikm_free(kmsg); return mr; } mr = ipc_mqueue_send(kmsg, MACH_MSG_OPTION_NONE, MACH_MSG_TIMEOUT_NONE); if (mr != MACH_MSG_SUCCESS) { mr |= ipc_kmsg_copyout_pseudo(kmsg, space, map); assert(kmsg->ikm_marequest == IMAR_NULL); (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); } return mr; } else if (option == MACH_RCV_MSG) { ipc_thread_t self = current_thread(); ipc_space_t space = current_space(); vm_map_t map = current_map(); ipc_object_t object; ipc_mqueue_t mqueue; ipc_kmsg_t kmsg; mach_port_seqno_t seqno; mr = ipc_mqueue_copyin(space, rcv_name, &mqueue, &object); if (mr != MACH_MSG_SUCCESS) return mr; /* hold ref for object; mqueue is locked */ /* * ipc_mqueue_receive may not return, because if we block * then our kernel stack may be discarded. So we save * state here for mach_msg_continue to pick up. */ self->ith_msg = msg; self->ith_rcv_size = rcv_size; self->ith_object = object; self->ith_mqueue = mqueue; mr = ipc_mqueue_receive(mqueue, MACH_MSG_OPTION_NONE, MACH_MSG_SIZE_MAX, MACH_MSG_TIMEOUT_NONE, FALSE, mach_msg_continue, &kmsg, &seqno); /* mqueue is unlocked */ ipc_object_release(object); if (mr != MACH_MSG_SUCCESS) return mr; kmsg->ikm_header.msgh_seqno = seqno; if (rcv_size < kmsg->ikm_header.msgh_size) { ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(msg, kmsg, sizeof *msg); return MACH_RCV_TOO_LARGE; } mr = ipc_kmsg_copyout(kmsg, space, map, MACH_PORT_NULL); if (mr != MACH_MSG_SUCCESS) { if ((mr &~ MACH_MSG_MASK) == MACH_RCV_BODY_ERROR) { (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); } else { ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(msg, kmsg, sizeof *msg); } return mr; } return ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); } else if (option == MACH_MSG_OPTION_NONE) { /* * We can measure the "null mach_msg_trap" * (syscall entry and thread_syscall_return exit) * with this path. */ thread_syscall_return(MACH_MSG_SUCCESS); /*NOTREACHED*/ } if (option & MACH_SEND_MSG) { mr = mach_msg_send(msg, option, send_size, time_out, notify); if (mr != MACH_MSG_SUCCESS) return mr; } if (option & MACH_RCV_MSG) { mr = mach_msg_receive(msg, option, rcv_size, rcv_name, time_out, notify); if (mr != MACH_MSG_SUCCESS) return mr; } return MACH_MSG_SUCCESS; }
boolean_t ipc_port_check_circularity( ipc_port_t port, ipc_port_t dest) { ipc_port_t base; #if IMPORTANCE_INHERITANCE task_t task = TASK_NULL; task_t release_task = TASK_NULL; int assertcnt = 0; #endif /* IMPORTANCE_INHERITANCE */ assert(port != IP_NULL); assert(dest != IP_NULL); if (port == dest) return TRUE; base = dest; /* * First try a quick check that can run in parallel. * No circularity if dest is not in transit. */ ip_lock(port); if (ip_lock_try(dest)) { if (!ip_active(dest) || (dest->ip_receiver_name != MACH_PORT_NULL) || (dest->ip_destination == IP_NULL)) goto not_circular; /* dest is in transit; further checking necessary */ ip_unlock(dest); } ip_unlock(port); ipc_port_multiple_lock(); /* massive serialization */ /* * Search for the end of the chain (a port not in transit), * acquiring locks along the way. */ for (;;) { ip_lock(base); if (!ip_active(base) || (base->ip_receiver_name != MACH_PORT_NULL) || (base->ip_destination == IP_NULL)) break; base = base->ip_destination; } /* all ports in chain from dest to base, inclusive, are locked */ if (port == base) { /* circularity detected! */ ipc_port_multiple_unlock(); /* port (== base) is in limbo */ assert(ip_active(port)); assert(port->ip_receiver_name == MACH_PORT_NULL); assert(port->ip_destination == IP_NULL); while (dest != IP_NULL) { ipc_port_t next; /* dest is in transit or in limbo */ assert(ip_active(dest)); assert(dest->ip_receiver_name == MACH_PORT_NULL); next = dest->ip_destination; ip_unlock(dest); dest = next; } return TRUE; } /* * The guarantee: lock port while the entire chain is locked. * Once port is locked, we can take a reference to dest, * add port to the chain, and unlock everything. */ ip_lock(port); ipc_port_multiple_unlock(); not_circular: /* port is in limbo */ assert(ip_active(port)); assert(port->ip_receiver_name == MACH_PORT_NULL); assert(port->ip_destination == IP_NULL); ip_reference(dest); port->ip_destination = dest; #if IMPORTANCE_INHERITANCE /* must have been in limbo or still bound to a task */ assert(port->ip_tempowner != 0); if (port->ip_taskptr != 0) { /* * We delayed dropping assertions from a specific task. * Cache that info now (we'll drop assertions and the * task reference below). */ release_task = port->ip_imp_task; port->ip_imp_task = TASK_NULL; port->ip_taskptr = 0; } assertcnt = port->ip_impcount; /* take the port out of limbo w.r.t. assertions */ port->ip_tempowner = 0; #endif /* IMPORTANCE_INHERITANCE */ /* now unlock chain */ ip_unlock(port); for (;;) { #if IMPORTANCE_INHERITANCE /* every port along chain track assertions behind it */ dest->ip_impcount += assertcnt; #endif /* IMPORTANCE_INHERITANCE */ if (dest == base) break; /* port is in transit */ assert(ip_active(dest)); assert(dest->ip_receiver_name == MACH_PORT_NULL); assert(dest->ip_destination != IP_NULL); #if IMPORTANCE_INHERITANCE assert(dest->ip_tempowner == 0); #endif /* IMPORTANCE_INHERITANCE */ port = dest->ip_destination; ip_unlock(dest); dest = port; } /* base is not in transit */ assert(!ip_active(base) || (base->ip_receiver_name != MACH_PORT_NULL) || (base->ip_destination == IP_NULL)); #if IMPORTANCE_INHERITANCE /* * Find the task to boost (if any). * We will boost "through" ports that don't know * about inheritance to deliver receive rights that * do. */ if (ip_active(base) && (assertcnt > 0)) { if (base->ip_tempowner != 0) { if (base->ip_taskptr != 0) /* specified tempowner task */ task = base->ip_imp_task; /* otherwise don't boost current task */ } else if (base->ip_receiver_name != MACH_PORT_NULL) { ipc_space_t space = base->ip_receiver; /* only spaces with boost-accepting tasks */ if (space->is_task != TASK_NULL && space->is_task->imp_receiver != 0) task = space->is_task; } /* take reference before unlocking base */ if (task != TASK_NULL) { assert(task->imp_receiver != 0); task_reference(task); } } #endif /* IMPORTANCE_INHERITANCE */ ip_unlock(base); #if IMPORTANCE_INHERITANCE /* * Transfer assertions now that the ports are unlocked. * Avoid extra overhead if transferring to/from the same task. */ boolean_t transfer_assertions = (task != release_task) ? TRUE : FALSE; if (task != TASK_NULL) { if (transfer_assertions) task_importance_hold_internal_assertion(task, assertcnt); task_deallocate(task); task = TASK_NULL; } if (release_task != TASK_NULL) { if (transfer_assertions) task_importance_drop_internal_assertion(release_task, assertcnt); task_deallocate(release_task); release_task = TASK_NULL; } #endif /* IMPORTANCE_INHERITANCE */ return FALSE; }