void ipc_port_release_send( ipc_port_t port) { ipc_port_t nsrequest = IP_NULL; mach_port_mscount_t mscount; if (!IP_VALID(port)) return; ip_lock(port); if (!ip_active(port)) { ip_unlock(port); ip_release(port); return; } assert(port->ip_srights > 0); if (--port->ip_srights == 0 && port->ip_nsrequest != IP_NULL) { nsrequest = port->ip_nsrequest; port->ip_nsrequest = IP_NULL; mscount = port->ip_mscount; ip_unlock(port); ip_release(port); ipc_notify_no_senders(nsrequest, mscount); } else { ip_unlock(port); ip_release(port); } }
EXTERN io_object_t iokit_lookup_connect_ref(io_object_t connectRef, ipc_space_t space) { io_object_t obj = NULL; if (connectRef && MACH_PORT_VALID(CAST_MACH_PORT_TO_NAME(connectRef))) { ipc_port_t port; kern_return_t kr; kr = ipc_object_translate(space, CAST_MACH_PORT_TO_NAME(connectRef), MACH_PORT_RIGHT_SEND, (ipc_object_t *)&port); if (kr == KERN_SUCCESS) { assert(IP_VALID(port)); ip_reference(port); ip_unlock(port); iokit_lock_port(port); if (ip_active(port) && (ip_kotype(port) == IKOT_IOKIT_CONNECT)) { obj = (io_object_t) port->ip_kobject; iokit_add_connect_reference(obj); } iokit_unlock_port(port); ip_release(port); } } return obj; }
void exception_raise_continue_fast( ipc_port_t reply_port, ipc_kmsg_t kmsg) { ipc_thread_t self = current_thread(); kern_return_t kr; assert(ip_active(reply_port)); assert(reply_port == self->ith_port); assert(reply_port == (ipc_port_t) kmsg->ikm_header.msgh_remote_port); assert(MACH_MSGH_BITS_REMOTE(kmsg->ikm_header.msgh_bits) == MACH_MSG_TYPE_PORT_SEND_ONCE); /* * Release the send-once right (from the message header) * and the saved reference (from self->ith_port). */ reply_port->ip_sorights--; ip_release(reply_port); ip_release(reply_port); ip_unlock(reply_port); /* * Consume the reply message. */ kr = exception_parse_reply(kmsg); if (kr == KERN_SUCCESS) { thread_exception_return(); /*NOTREACHED*/ } if (self->ith_exc != KERN_SUCCESS) { exception_try_task(self->ith_exc, self->ith_exc_code, self->ith_exc_subcode); /*NOTREACHED*/ } exception_no_server(); /*NOTREACHED*/ }
kern_return_t ipc_object_copyin( ipc_space_t space, mach_port_name_t name, mach_msg_type_name_t msgt_name, ipc_object_t *objectp) { ipc_entry_t entry; ipc_port_t soright; ipc_port_t release_port; kern_return_t kr; queue_head_t links_data; queue_t links = &links_data; wait_queue_link_t wql; queue_init(links); /* * Could first try a read lock when doing * MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND, * and MACH_MSG_TYPE_MAKE_SEND_ONCE. */ kr = ipc_right_lookup_write(space, name, &entry); if (kr != KERN_SUCCESS) return kr; /* space is write-locked and active */ release_port = IP_NULL; kr = ipc_right_copyin(space, name, entry, msgt_name, TRUE, objectp, &soright, &release_port, links); if (IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_NONE) ipc_entry_dealloc(space, name, entry); is_write_unlock(space); while(!queue_empty(links)) { wql = (wait_queue_link_t) dequeue(links); wait_queue_link_free(wql); } if (release_port != IP_NULL) ip_release(release_port); if ((kr == KERN_SUCCESS) && (soright != IP_NULL)) ipc_notify_port_deleted(soright, name); return kr; }
void ipc_port_release_send( ipc_port_t port) { ipc_port_t nsrequest = IP_NULL; mach_port_mscount_t mscount; assert(IP_VALID(port)); ip_lock(port); if (!ip_active(port)) { ip_unlock(port); ip_release(port); return; } assert(port->ip_srights > 0); if (--port->ip_srights == 0 && port->ip_nsrequest != IP_NULL) { nsrequest = port->ip_nsrequest; port->ip_nsrequest = IP_NULL; mscount = port->ip_mscount; ip_unlock(port); ipc_notify_no_senders(nsrequest, mscount); #if 0 /* * Check that there are no other locks taken, because * [norma_]ipc_notify_no_senders routines may block. */ check_simple_locks(); #endif } else ip_unlock(port); ip_release(port); }
void ipc_port_release_sonce( ipc_port_t port) { assert(IP_VALID(port)); ip_lock(port); assert(port->ip_sorights > 0); port->ip_sorights--; ip_unlock(port); ip_release(port); }
kern_return_t ipc_object_copyin( ipc_space_t space, mach_port_name_t name, mach_msg_type_name_t msgt_name, ipc_object_t *objectp) { ipc_entry_t entry; ipc_port_t soright; ipc_port_t release_port; kern_return_t kr; int assertcnt = 0; /* * Could first try a read lock when doing * MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND, * and MACH_MSG_TYPE_MAKE_SEND_ONCE. */ kr = ipc_right_lookup_write(space, name, &entry); if (kr != KERN_SUCCESS) return kr; /* space is write-locked and active */ release_port = IP_NULL; kr = ipc_right_copyin(space, name, entry, msgt_name, TRUE, objectp, &soright, &release_port, &assertcnt); if (IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_NONE) ipc_entry_dealloc(space, name, entry); is_write_unlock(space); #if IMPORTANCE_INHERITANCE if (0 < assertcnt && ipc_importance_task_is_any_receiver_type(current_task()->task_imp_base)) { ipc_importance_task_drop_internal_assertion(current_task()->task_imp_base, assertcnt); } #endif /* IMPORTANCE_INHERITANCE */ if (release_port != IP_NULL) ip_release(release_port); if ((kr == KERN_SUCCESS) && (soright != IP_NULL)) ipc_notify_port_deleted(soright, name); return kr; }
void ipc_port_release_receive( ipc_port_t port) { ipc_port_t dest; if (!IP_VALID(port)) return; ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name == MACH_PORT_NULL); dest = port->ip_destination; ipc_port_destroy(port); /* consumes ref, unlocks */ if (dest != IP_NULL) ip_release(dest); }
void ipc_port_release_sonce( ipc_port_t port) { assert(IP_VALID(port)); ip_lock(port); assert(port->ip_sorights > 0); port->ip_sorights--; ip_release(port); if (!ip_active(port)) { ip_check_unlock(port); return; } ip_unlock(port); }
kern_return_t ipc_port_request_grow( ipc_port_t port, ipc_table_elems_t target_size) { ipc_table_size_t its; ipc_port_request_t otable, ntable; assert(ip_active(port)); otable = port->ip_requests; if (otable == IPR_NULL) its = &ipc_table_requests[0]; else its = otable->ipr_size + 1; if (target_size != ITS_SIZE_NONE) { if ((otable != IPR_NULL) && (target_size <= otable->ipr_size->its_size)) { ip_unlock(port); return KERN_SUCCESS; } while ((its->its_size) && (its->its_size < target_size)) { its++; } if (its->its_size == 0) { ip_unlock(port); return KERN_NO_SPACE; } } ip_reference(port); ip_unlock(port); if ((its->its_size == 0) || ((ntable = it_requests_alloc(its)) == IPR_NULL)) { ip_release(port); return KERN_RESOURCE_SHORTAGE; } ip_lock(port); /* * Check that port is still active and that nobody else * has slipped in and grown the table on us. Note that * just checking if the current table pointer == otable * isn't sufficient; must check ipr_size. */ if (ip_active(port) && (port->ip_requests == otable) && ((otable == IPR_NULL) || (otable->ipr_size+1 == its))) { ipc_table_size_t oits; ipc_table_elems_t osize, nsize; ipc_port_request_index_t free, i; /* copy old table to new table */ if (otable != IPR_NULL) { oits = otable->ipr_size; osize = oits->its_size; free = otable->ipr_next; (void) memcpy((void *)(ntable + 1), (const void *)(otable + 1), (osize - 1) * sizeof(struct ipc_port_request)); } else { osize = 1; oits = 0; free = 0; } nsize = its->its_size; assert(nsize > osize); /* add new elements to the new table's free list */ for (i = osize; i < nsize; i++) { ipc_port_request_t ipr = &ntable[i]; ipr->ipr_name = MACH_PORT_NULL; ipr->ipr_next = free; free = i; } ntable->ipr_next = free; ntable->ipr_size = its; port->ip_requests = ntable; ip_unlock(port); ip_release(port); if (otable != IPR_NULL) { it_requests_free(oits, otable); } } else { ip_unlock(port); ip_release(port); it_requests_free(its, ntable); } return KERN_SUCCESS; }
kern_return_t ipc_right_copyout( ipc_space_t space, mach_port_t name, ipc_entry_t entry, mach_msg_type_name_t msgt_name, boolean_t overflow, ipc_object_t object) { ipc_entry_bits_t bits = entry->ie_bits; ipc_port_t port; assert(IO_VALID(object)); assert(io_otype(object) == IOT_PORT); assert(io_active(object)); assert(entry->ie_object == object); port = (ipc_port_t) object; switch (msgt_name) { case MACH_MSG_TYPE_PORT_SEND_ONCE: assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_NONE); assert(port->ip_sorights > 0); /* transfer send-once right and ref to entry */ ip_unlock(port); entry->ie_bits = bits | (MACH_PORT_TYPE_SEND_ONCE | 1); break; case MACH_MSG_TYPE_PORT_SEND: assert(port->ip_srights > 0); if (bits & MACH_PORT_TYPE_SEND) { mach_port_urefs_t urefs = IE_BITS_UREFS(bits); assert(port->ip_srights > 1); assert(urefs > 0); assert(urefs < MACH_PORT_UREFS_MAX); if (urefs+1 == MACH_PORT_UREFS_MAX) { if (overflow) { /* leave urefs pegged to maximum */ port->ip_srights--; ip_release(port); ip_unlock(port); return KERN_SUCCESS; } ip_unlock(port); return KERN_UREFS_OVERFLOW; } port->ip_srights--; ip_release(port); ip_unlock(port); } else if (bits & MACH_PORT_TYPE_RECEIVE) { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_RECEIVE); assert(IE_BITS_UREFS(bits) == 0); /* transfer send right to entry */ ip_release(port); ip_unlock(port); } else { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_NONE); assert(IE_BITS_UREFS(bits) == 0); /* transfer send right and ref to entry */ ip_unlock(port); /* entry is locked holding ref, so can use port */ entry->ie_name = name; ipc_reverse_insert(space, (ipc_object_t) port, entry); } entry->ie_bits = (bits | MACH_PORT_TYPE_SEND) + 1; break; case MACH_MSG_TYPE_PORT_RECEIVE: { ipc_port_t dest; assert(port->ip_mscount == 0); assert(port->ip_receiver_name == MACH_PORT_NULL); dest = port->ip_destination; port->ip_receiver_name = name; port->ip_receiver = space; /* * Clear the protected payload field to retain * the behavior of mach_msg. */ ipc_port_flag_protected_payload_clear(port); assert((bits & MACH_PORT_TYPE_RECEIVE) == 0); if (bits & MACH_PORT_TYPE_SEND) { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND); assert(IE_BITS_UREFS(bits) > 0); assert(port->ip_srights > 0); ip_release(port); ip_unlock(port); /* entry is locked holding ref, so can use port */ ipc_reverse_remove(space, (ipc_object_t) port); } else { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_NONE); assert(IE_BITS_UREFS(bits) == 0); /* transfer ref to entry */ ip_unlock(port); } entry->ie_bits = bits | MACH_PORT_TYPE_RECEIVE; if (dest != IP_NULL) ipc_port_release(dest); break; } default: #if MACH_ASSERT assert(!"ipc_right_copyout: strange rights"); #else panic("ipc_right_copyout: strange rights"); #endif } return KERN_SUCCESS; }
void ipc_port_release(ipc_port_t port) { ip_release(port); }
void ipc_right_clean( ipc_space_t space, mach_port_t name, ipc_entry_t entry) { ipc_entry_bits_t bits = entry->ie_bits; mach_port_type_t type = IE_BITS_TYPE(bits); assert(!space->is_active); /* * We can't clean up IE_BITS_MAREQUEST when the space is dead. * This is because ipc_marequest_destroy can't turn off * the bit if the space is dead. Hence, it might be on * even though the marequest has been destroyed. It's OK * not to cancel the marequest, because ipc_marequest_destroy * cancels for us if the space is dead. * * IE_BITS_COMPAT/ipc_right_dncancel doesn't have this * problem, because we check that the port is active. If * we didn't cancel IE_BITS_COMPAT, ipc_port_destroy * would still work, but dead space refs would accumulate * in ip_dnrequests. They would use up slots in * ip_dnrequests and keep the spaces from being freed. */ switch (type) { case MACH_PORT_TYPE_DEAD_NAME: assert(entry->ie_request == 0); assert(entry->ie_object == IO_NULL); assert((bits & IE_BITS_MAREQUEST) == 0); break; case MACH_PORT_TYPE_PORT_SET: { ipc_pset_t pset = (ipc_pset_t) entry->ie_object; assert(entry->ie_request == 0); assert((bits & IE_BITS_MAREQUEST) == 0); assert(pset != IPS_NULL); ips_lock(pset); assert(ips_active(pset)); ipc_pset_destroy(pset); /* consumes ref, unlocks */ break; } case MACH_PORT_TYPE_SEND: case MACH_PORT_TYPE_RECEIVE: case MACH_PORT_TYPE_SEND_RECEIVE: case MACH_PORT_TYPE_SEND_ONCE: { ipc_port_t port = (ipc_port_t) entry->ie_object; ipc_port_t dnrequest; ipc_port_t nsrequest = IP_NULL; mach_port_mscount_t mscount = 0; /* '=0' to shut up lint */ assert(port != IP_NULL); ip_lock(port); if (!ip_active(port)) { ip_release(port); ip_check_unlock(port); break; } dnrequest = ipc_right_dncancel_macro(space, port, name, entry); if (type & MACH_PORT_TYPE_SEND) { assert(port->ip_srights > 0); if (--port->ip_srights == 0) { nsrequest = port->ip_nsrequest; if (nsrequest != IP_NULL) { port->ip_nsrequest = IP_NULL; mscount = port->ip_mscount; } } } if (type & MACH_PORT_TYPE_RECEIVE) { assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); ipc_port_clear_receiver(port); ipc_port_destroy(port); /* consumes our ref, unlocks */ } else if (type & MACH_PORT_TYPE_SEND_ONCE) { assert(port->ip_sorights > 0); ip_unlock(port); ipc_notify_send_once(port); /* consumes our ref */ } else { assert(port->ip_receiver != space); ip_release(port); ip_unlock(port); /* port is active */ } if (nsrequest != IP_NULL) ipc_notify_no_senders(nsrequest, mscount); if (dnrequest != IP_NULL) ipc_notify_port_deleted(dnrequest, name); break; } default: #if MACH_ASSERT assert(!"ipc_right_clean: strange type"); #else panic("ipc_right_clean: strange type"); #endif } }
/* * thread_switch: * * Context switch. User may supply thread hint. */ kern_return_t thread_switch( struct thread_switch_args *args) { thread_t thread = THREAD_NULL; thread_t self = current_thread(); mach_port_name_t thread_name = args->thread_name; int option = args->option; mach_msg_timeout_t option_time = args->option_time; uint32_t scale_factor = NSEC_PER_MSEC; boolean_t reenable_workq_callback = FALSE; boolean_t depress_option = FALSE; boolean_t wait_option = FALSE; /* * Validate and process option. */ switch (option) { case SWITCH_OPTION_NONE: workqueue_thread_yielded(); break; case SWITCH_OPTION_WAIT: wait_option = TRUE; workqueue_thread_yielded(); break; case SWITCH_OPTION_DEPRESS: depress_option = TRUE; workqueue_thread_yielded(); break; case SWITCH_OPTION_DISPATCH_CONTENTION: scale_factor = NSEC_PER_USEC; wait_option = TRUE; if (thread_switch_disable_workqueue_sched_callback()) reenable_workq_callback = TRUE; break; case SWITCH_OPTION_OSLOCK_DEPRESS: depress_option = TRUE; if (thread_switch_disable_workqueue_sched_callback()) reenable_workq_callback = TRUE; break; case SWITCH_OPTION_OSLOCK_WAIT: wait_option = TRUE; if (thread_switch_disable_workqueue_sched_callback()) reenable_workq_callback = TRUE; break; default: return (KERN_INVALID_ARGUMENT); } /* * Translate the port name if supplied. */ if (thread_name != MACH_PORT_NULL) { ipc_port_t port; if (ipc_port_translate_send(self->task->itk_space, thread_name, &port) == KERN_SUCCESS) { ip_reference(port); ip_unlock(port); thread = convert_port_to_thread(port); ip_release(port); if (thread == self) { thread_deallocate(thread); thread = THREAD_NULL; } } } if (option == SWITCH_OPTION_OSLOCK_DEPRESS || option == SWITCH_OPTION_OSLOCK_WAIT) { if (thread != THREAD_NULL) { if (thread->task != self->task) { /* * OSLock boosting only applies to other threads * in your same task (even if you have a port for * a thread in another task) */ thread_deallocate(thread); thread = THREAD_NULL; } else { /* * Attempt to kick the lock owner up to our same IO throttling tier. * If the thread is currently blocked in throttle_lowpri_io(), * it will immediately break out. * * TODO: SFI break out? */ int new_policy = proc_get_effective_thread_policy(self, TASK_POLICY_IO); set_thread_iotier_override(thread, new_policy); } } } /* * Try to handoff if supplied. */ if (thread != THREAD_NULL) { spl_t s = splsched(); /* This may return a different thread if the target is pushing on something */ thread_t pulled_thread = thread_run_queue_remove_for_handoff(thread); KERNEL_DEBUG_CONSTANT(MACHDBG_CODE(DBG_MACH_SCHED,MACH_SCHED_THREAD_SWITCH)|DBG_FUNC_NONE, thread_tid(thread), thread->state, pulled_thread ? TRUE : FALSE, 0, 0); if (pulled_thread != THREAD_NULL) { /* We can't be dropping the last ref here */ thread_deallocate_safe(thread); if (wait_option) assert_wait_timeout((event_t)assert_wait_timeout, THREAD_ABORTSAFE, option_time, scale_factor); else if (depress_option) thread_depress_ms(option_time); self->saved.swtch.option = option; self->saved.swtch.reenable_workq_callback = reenable_workq_callback; thread_run(self, (thread_continue_t)thread_switch_continue, NULL, pulled_thread); /* NOTREACHED */ panic("returned from thread_run!"); } splx(s); thread_deallocate(thread); } if (wait_option) assert_wait_timeout((event_t)assert_wait_timeout, THREAD_ABORTSAFE, option_time, scale_factor); else if (depress_option) thread_depress_ms(option_time); self->saved.swtch.option = option; self->saved.swtch.reenable_workq_callback = reenable_workq_callback; thread_block_reason((thread_continue_t)thread_switch_continue, NULL, AST_YIELD); if (depress_option) thread_depress_abort_internal(self); if (reenable_workq_callback) thread_switch_enable_workqueue_sched_callback(); return (KERN_SUCCESS); }
void exception_raise( ipc_port_t dest_port, ipc_port_t thread_port, ipc_port_t task_port, integer_t _exception, integer_t code, integer_t subcode) { ipc_thread_t self = current_thread(); ipc_thread_t receiver; ipc_port_t reply_port; ipc_mqueue_t dest_mqueue; ipc_mqueue_t reply_mqueue; ipc_kmsg_t kmsg; mach_msg_return_t mr; assert(IP_VALID(dest_port)); /* * We will eventually need a message buffer. * Grab the buffer now, while nothing is locked. * This buffer will get handed to the exception server, * and it will give the buffer back with its reply. */ kmsg = ikm_cache(); if (kmsg != IKM_NULL) { ikm_cache() = IKM_NULL; ikm_check_initialized(kmsg, IKM_SAVED_KMSG_SIZE); } else { kmsg = ikm_alloc(IKM_SAVED_MSG_SIZE); if (kmsg == IKM_NULL) panic("exception_raise"); ikm_init(kmsg, IKM_SAVED_MSG_SIZE); } /* * We need a reply port for the RPC. * Check first for a cached port. */ ith_lock(self); assert(self->ith_self != IP_NULL); reply_port = self->ith_rpc_reply; if (reply_port == IP_NULL) { ith_unlock(self); reply_port = ipc_port_alloc_reply(); ith_lock(self); if ((reply_port == IP_NULL) || (self->ith_rpc_reply != IP_NULL)) panic("exception_raise"); self->ith_rpc_reply = reply_port; } ip_lock(reply_port); assert(ip_active(reply_port)); ith_unlock(self); /* * Make a naked send-once right for the reply port, * to hand to the exception server. * Make an extra reference for the reply port, * to receive on. This protects us against * mach_msg_abort_rpc. */ reply_port->ip_sorights++; ip_reference(reply_port); ip_reference(reply_port); self->ith_port = reply_port; reply_mqueue = &reply_port->ip_messages; imq_lock(reply_mqueue); assert(ipc_kmsg_queue_empty(&reply_mqueue->imq_messages)); ip_unlock(reply_port); /* * Make sure we can queue to the destination port. */ if (!ip_lock_try(dest_port)) { imq_unlock(reply_mqueue); goto slow_exception_raise; } if (!ip_active(dest_port) || (dest_port->ip_receiver == ipc_space_kernel)) { imq_unlock(reply_mqueue); ip_unlock(dest_port); goto slow_exception_raise; } /* * Find the destination message queue. */ { ipc_pset_t dest_pset; dest_pset = dest_port->ip_pset; if (dest_pset == IPS_NULL) dest_mqueue = &dest_port->ip_messages; else dest_mqueue = &dest_pset->ips_messages; } if (!imq_lock_try(dest_mqueue)) { imq_unlock(reply_mqueue); ip_unlock(dest_port); goto slow_exception_raise; } /* * Safe to unlock dest_port, because we hold * dest_mqueue locked. We never bother changing * dest_port->ip_msgcount. */ ip_unlock(dest_port); receiver = ipc_thread_queue_first(&dest_mqueue->imq_threads); if ((receiver == ITH_NULL) || !((receiver->swap_func == (void (*)()) mach_msg_continue) || ((receiver->swap_func == (void (*)()) mach_msg_receive_continue) && (sizeof(struct mach_exception) <= receiver->ith_msize) && ((receiver->ith_option & MACH_RCV_NOTIFY) == 0))) || !thread_handoff(self, exception_raise_continue, receiver)) { imq_unlock(reply_mqueue); imq_unlock(dest_mqueue); goto slow_exception_raise; } counter(c_exception_raise_block++); assert(current_thread() == receiver); /* * We need to finish preparing self for its * time asleep in reply_mqueue. self is left * holding the extra ref for reply_port. */ ipc_thread_enqueue_macro(&reply_mqueue->imq_threads, self); self->ith_state = MACH_RCV_IN_PROGRESS; self->ith_msize = MACH_MSG_SIZE_MAX; imq_unlock(reply_mqueue); /* * Finish extracting receiver from dest_mqueue. */ ipc_thread_rmqueue_first_macro( &dest_mqueue->imq_threads, receiver); imq_unlock(dest_mqueue); /* * Release the receiver's reference for his object. */ { ipc_object_t object = receiver->ith_object; io_lock(object); io_release(object); io_check_unlock(object); } { struct mach_exception *exc = (struct mach_exception *) &kmsg->ikm_header; ipc_space_t space = receiver->task->itk_space; /* * We are running as the receiver now. We hold * the following resources, which must be consumed: * kmsg, send-once right for reply_port * send rights for dest_port, thread_port, task_port * Synthesize a kmsg for copyout to the receiver. */ exc->Head.msgh_bits = (MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, MACH_MSG_TYPE_PORT_SEND) | MACH_MSGH_BITS_COMPLEX); exc->Head.msgh_size = sizeof *exc; /* exc->Head.msgh_remote_port later */ /* exc->Head.msgh_local_port later */ exc->Head.msgh_seqno = 0; exc->Head.msgh_id = MACH_EXCEPTION_ID; exc->threadType = exc_port_proto; /* exc->thread later */ exc->taskType = exc_port_proto; /* exc->task later */ exc->exceptionType = exc_code_proto; exc->exception = _exception; exc->codeType = exc_code_proto; exc->code = code; exc->subcodeType = exc_code_proto; exc->subcode = subcode; /* * Check that the receiver can handle the message. */ if (receiver->ith_rcv_size < sizeof(struct mach_exception)) { /* * ipc_kmsg_destroy is a handy way to consume * the resources we hold, but it requires setup. */ exc->Head.msgh_bits = (MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE) | MACH_MSGH_BITS_COMPLEX); exc->Head.msgh_remote_port = (mach_port_t) dest_port; exc->Head.msgh_local_port = (mach_port_t) reply_port; exc->thread = (mach_port_t) thread_port; exc->task = (mach_port_t) task_port; ipc_kmsg_destroy(kmsg); thread_syscall_return(MACH_RCV_TOO_LARGE); /*NOTREACHED*/ } is_write_lock(space); assert(space->is_active); /* * To do an atomic copyout, need simultaneous * locks on both ports and the space. */ ip_lock(dest_port); if (!ip_active(dest_port) || !ip_lock_try(reply_port)) { abort_copyout: ip_unlock(dest_port); is_write_unlock(space); /* * Oh well, we have to do the header the slow way. * First make it look like it's in-transit. */ exc->Head.msgh_bits = (MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE) | MACH_MSGH_BITS_COMPLEX); exc->Head.msgh_remote_port = (mach_port_t) dest_port; exc->Head.msgh_local_port = (mach_port_t) reply_port; mr = ipc_kmsg_copyout_header(&exc->Head, space, MACH_PORT_NULL); if (mr == MACH_MSG_SUCCESS) goto copyout_body; /* * Ack! Prepare for ipc_kmsg_copyout_dest. * It will consume thread_port and task_port. */ exc->thread = (mach_port_t) thread_port; exc->task = (mach_port_t) task_port; ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(receiver->ith_msg, kmsg, sizeof(mach_msg_header_t)); thread_syscall_return(mr); /*NOTREACHED*/ } if (!ip_active(reply_port)) { ip_unlock(reply_port); goto abort_copyout; } assert(reply_port->ip_sorights > 0); ip_unlock(reply_port); { kern_return_t kr; ipc_entry_t entry; kr = ipc_entry_get (space, &exc->Head.msgh_remote_port, &entry); if (kr) goto abort_copyout; { mach_port_gen_t gen; assert((entry->ie_bits &~ IE_BITS_GEN_MASK) == 0); gen = entry->ie_bits + IE_BITS_GEN_ONE; /* optimized ipc_right_copyout */ entry->ie_bits = gen | (MACH_PORT_TYPE_SEND_ONCE | 1); } entry->ie_object = (ipc_object_t) reply_port; is_write_unlock(space); } /* optimized ipc_object_copyout_dest */ assert(dest_port->ip_srights > 0); ip_release(dest_port); exc->Head.msgh_local_port = ((dest_port->ip_receiver == space) ? dest_port->ip_receiver_name : MACH_PORT_NULL); if ((--dest_port->ip_srights == 0) && (dest_port->ip_nsrequest != IP_NULL)) { ipc_port_t nsrequest; mach_port_mscount_t mscount; /* a rather rare case */ nsrequest = dest_port->ip_nsrequest; mscount = dest_port->ip_mscount; dest_port->ip_nsrequest = IP_NULL; ip_unlock(dest_port); ipc_notify_no_senders(nsrequest, mscount); } else ip_unlock(dest_port); copyout_body: /* * Optimized version of ipc_kmsg_copyout_body, * to handle the two ports in the body. */ mr = (ipc_kmsg_copyout_object(space, (ipc_object_t) thread_port, MACH_MSG_TYPE_PORT_SEND, &exc->thread) | ipc_kmsg_copyout_object(space, (ipc_object_t) task_port, MACH_MSG_TYPE_PORT_SEND, &exc->task)); if (mr != MACH_MSG_SUCCESS) { (void) ipc_kmsg_put(receiver->ith_msg, kmsg, kmsg->ikm_header.msgh_size); thread_syscall_return(mr | MACH_RCV_BODY_ERROR); /*NOTREACHED*/ } } /* * Optimized version of ipc_kmsg_put. * We must check ikm_cache after copyoutmsg. */ ikm_check_initialized(kmsg, kmsg->ikm_size); assert(kmsg->ikm_size == IKM_SAVED_KMSG_SIZE); if (copyoutmsg(&kmsg->ikm_header, receiver->ith_msg, sizeof(struct mach_exception)) || (ikm_cache() != IKM_NULL)) { mr = ipc_kmsg_put(receiver->ith_msg, kmsg, kmsg->ikm_header.msgh_size); thread_syscall_return(mr); /*NOTREACHED*/ } ikm_cache() = kmsg; thread_syscall_return(MACH_MSG_SUCCESS); /*NOTREACHED*/ #ifndef __GNUC__ return; /* help for the compiler */ #endif slow_exception_raise: { struct mach_exception *exc = (struct mach_exception *) &kmsg->ikm_header; ipc_kmsg_t reply_kmsg; mach_port_seqno_t reply_seqno; exception_raise_misses++; /* * We hold the following resources, which must be consumed: * kmsg, send-once right and ref for reply_port * send rights for dest_port, thread_port, task_port * Synthesize a kmsg to send. */ exc->Head.msgh_bits = (MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE) | MACH_MSGH_BITS_COMPLEX); exc->Head.msgh_size = sizeof *exc; exc->Head.msgh_remote_port = (mach_port_t) dest_port; exc->Head.msgh_local_port = (mach_port_t) reply_port; exc->Head.msgh_seqno = 0; exc->Head.msgh_id = MACH_EXCEPTION_ID; exc->threadType = exc_port_proto; exc->thread = (mach_port_t) thread_port; exc->taskType = exc_port_proto; exc->task = (mach_port_t) task_port; exc->exceptionType = exc_code_proto; exc->exception = _exception; exc->codeType = exc_code_proto; exc->code = code; exc->subcodeType = exc_code_proto; exc->subcode = subcode; ipc_mqueue_send_always(kmsg); /* * We are left with a ref for reply_port, * which we use to receive the reply message. */ ip_lock(reply_port); if (!ip_active(reply_port)) { ip_unlock(reply_port); exception_raise_continue_slow(MACH_RCV_PORT_DIED, IKM_NULL, /*dummy*/0); /*NOTREACHED*/ } imq_lock(reply_mqueue); ip_unlock(reply_port); mr = ipc_mqueue_receive(reply_mqueue, MACH_MSG_OPTION_NONE, MACH_MSG_SIZE_MAX, MACH_MSG_TIMEOUT_NONE, FALSE, exception_raise_continue, &reply_kmsg, &reply_seqno); /* reply_mqueue is unlocked */ exception_raise_continue_slow(mr, reply_kmsg, reply_seqno); /*NOTREACHED*/ } }
void ipc_port_destroy( ipc_port_t port) { ipc_port_t pdrequest, nsrequest; ipc_mqueue_t mqueue; ipc_kmsg_t kmsg; #if IMPORTANCE_INHERITANCE task_t release_imp_task = TASK_NULL; thread_t self = current_thread(); boolean_t top = (self->ith_assertions == 0); natural_t assertcnt = 0; #endif /* IMPORTANCE_INHERITANCE */ assert(ip_active(port)); /* port->ip_receiver_name is garbage */ /* port->ip_receiver/port->ip_destination is garbage */ assert(port->ip_pset_count == 0); assert(port->ip_mscount == 0); /* check for a backup port */ pdrequest = port->ip_pdrequest; #if IMPORTANCE_INHERITANCE /* determine how may assertions to drop and from whom */ if (port->ip_tempowner != 0) { assert(top); if (port->ip_taskptr != 0) { release_imp_task = port->ip_imp_task; port->ip_imp_task = TASK_NULL; port->ip_taskptr = 0; assertcnt = port->ip_impcount; } /* Otherwise, nothing to drop */ } else { assert(port->ip_taskptr == 0); assertcnt = port->ip_impcount; if (pdrequest != IP_NULL) /* mark in limbo for the journey */ port->ip_tempowner = 1; } if (top) self->ith_assertions = assertcnt; #endif /* IMPORTANCE_INHERITANCE */ if (pdrequest != IP_NULL) { /* we assume the ref for pdrequest */ port->ip_pdrequest = IP_NULL; /* make port be in limbo */ port->ip_receiver_name = MACH_PORT_NULL; port->ip_destination = IP_NULL; ip_unlock(port); /* consumes our refs for port and pdrequest */ ipc_notify_port_destroyed(pdrequest, port); goto drop_assertions; } /* once port is dead, we don't need to keep it locked */ port->ip_object.io_bits &= ~IO_BITS_ACTIVE; port->ip_timestamp = ipc_port_timestamp(); /* * If the port has a preallocated message buffer and that buffer * is not inuse, free it. If it has an inuse one, then the kmsg * free will detect that we freed the association and it can free it * like a normal buffer. */ if (IP_PREALLOC(port)) { ipc_port_t inuse_port; kmsg = port->ip_premsg; assert(kmsg != IKM_NULL); inuse_port = ikm_prealloc_inuse_port(kmsg); IP_CLEAR_PREALLOC(port, kmsg); ip_unlock(port); if (inuse_port != IP_NULL) { assert(inuse_port == port); } else { ipc_kmsg_free(kmsg); } } else { ip_unlock(port); } /* throw away no-senders request */ nsrequest = port->ip_nsrequest; if (nsrequest != IP_NULL) ipc_notify_send_once(nsrequest); /* consumes ref */ /* destroy any queued messages */ mqueue = &port->ip_messages; ipc_mqueue_destroy(mqueue); /* generate dead-name notifications */ ipc_port_dnnotify(port); ipc_kobject_destroy(port); ip_release(port); /* consume caller's ref */ drop_assertions: #if IMPORTANCE_INHERITANCE if (release_imp_task != TASK_NULL) { if (assertcnt > 0) { assert(top); self->ith_assertions = 0; assert(release_imp_task->imp_receiver != 0); task_importance_drop_internal_assertion(release_imp_task, assertcnt); } task_deallocate(release_imp_task); } else if (assertcnt > 0) { if (top) { self->ith_assertions = 0; release_imp_task = current_task(); if (release_imp_task->imp_receiver != 0) { task_importance_drop_internal_assertion(release_imp_task, assertcnt); } } else { /* the port chain we are enqueued on should cover our assertions */ assert(assertcnt <= self->ith_assertions); } } #endif /* IMPORTANCE_INHERITANCE */ }
kern_return_t ipc_right_destroy( ipc_space_t space, mach_port_t name, ipc_entry_t entry) { ipc_entry_bits_t bits = entry->ie_bits; mach_port_type_t type = IE_BITS_TYPE(bits); assert(space->is_active); switch (type) { case MACH_PORT_TYPE_DEAD_NAME: assert(entry->ie_request == 0); assert(entry->ie_object == IO_NULL); assert((bits & IE_BITS_MAREQUEST) == 0); ipc_entry_dealloc(space, name, entry); is_write_unlock(space); break; case MACH_PORT_TYPE_PORT_SET: { ipc_pset_t pset = (ipc_pset_t) entry->ie_object; assert(entry->ie_request == 0); assert(pset != IPS_NULL); entry->ie_object = IO_NULL; ipc_entry_dealloc(space, name, entry); ips_lock(pset); assert(ips_active(pset)); is_write_unlock(space); ipc_pset_destroy(pset); /* consumes ref, unlocks */ break; } case MACH_PORT_TYPE_SEND: case MACH_PORT_TYPE_RECEIVE: case MACH_PORT_TYPE_SEND_RECEIVE: case MACH_PORT_TYPE_SEND_ONCE: { ipc_port_t port = (ipc_port_t) entry->ie_object; ipc_port_t nsrequest = IP_NULL; mach_port_mscount_t mscount = 0; /* '=0' to shut up lint */ ipc_port_t dnrequest; assert(port != IP_NULL); if (bits & IE_BITS_MAREQUEST) { assert(type & MACH_PORT_TYPE_SEND_RECEIVE); ipc_marequest_cancel(space, name); } if (type == MACH_PORT_TYPE_SEND) ipc_reverse_remove(space, (ipc_object_t) port); ip_lock(port); if (!ip_active(port)) { assert((type & MACH_PORT_TYPE_RECEIVE) == 0); ip_release(port); ip_check_unlock(port); entry->ie_request = 0; entry->ie_object = IO_NULL; ipc_entry_dealloc(space, name, entry); is_write_unlock(space); break; } dnrequest = ipc_right_dncancel_macro(space, port, name, entry); entry->ie_object = IO_NULL; ipc_entry_dealloc(space, name, entry); is_write_unlock(space); if (type & MACH_PORT_TYPE_SEND) { assert(port->ip_srights > 0); if (--port->ip_srights == 0) { nsrequest = port->ip_nsrequest; if (nsrequest != IP_NULL) { port->ip_nsrequest = IP_NULL; mscount = port->ip_mscount; } } } if (type & MACH_PORT_TYPE_RECEIVE) { assert(ip_active(port)); assert(port->ip_receiver == space); ipc_port_clear_receiver(port); ipc_port_destroy(port); /* consumes our ref, unlocks */ } else if (type & MACH_PORT_TYPE_SEND_ONCE) { assert(port->ip_sorights > 0); ip_unlock(port); ipc_notify_send_once(port); /* consumes our ref */ } else { assert(port->ip_receiver != space); ip_release(port); ip_unlock(port); } if (nsrequest != IP_NULL) ipc_notify_no_senders(nsrequest, mscount); if (dnrequest != IP_NULL) ipc_notify_port_deleted(dnrequest, name); break; } default: #if MACH_ASSERT assert(!"ipc_right_destroy: strange type"); #else panic("ipc_right_destroy: strange type"); #endif } return KERN_SUCCESS; }
kern_return_t ipc_right_delta( ipc_space_t space, mach_port_t name, ipc_entry_t entry, mach_port_right_t right, mach_port_delta_t delta) { ipc_entry_bits_t bits = entry->ie_bits; assert(space->is_active); assert(right < MACH_PORT_RIGHT_NUMBER); /* Rights-specific restrictions and operations. */ switch (right) { case MACH_PORT_RIGHT_PORT_SET: { ipc_pset_t pset; if ((bits & MACH_PORT_TYPE_PORT_SET) == 0) goto invalid_right; assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_PORT_SET); assert(IE_BITS_UREFS(bits) == 0); assert((bits & IE_BITS_MAREQUEST) == 0); assert(entry->ie_request == 0); if (delta == 0) goto success; if (delta != -1) goto invalid_value; pset = (ipc_pset_t) entry->ie_object; assert(pset != IPS_NULL); entry->ie_object = IO_NULL; ipc_entry_dealloc(space, name, entry); ips_lock(pset); assert(ips_active(pset)); is_write_unlock(space); ipc_pset_destroy(pset); /* consumes ref, unlocks */ break; } case MACH_PORT_RIGHT_RECEIVE: { ipc_port_t port; ipc_port_t dnrequest = IP_NULL; if ((bits & MACH_PORT_TYPE_RECEIVE) == 0) goto invalid_right; if (delta == 0) goto success; if (delta != -1) goto invalid_value; if (bits & IE_BITS_MAREQUEST) { bits &= ~IE_BITS_MAREQUEST; ipc_marequest_cancel(space, name); } port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); /* * The port lock is needed for ipc_right_dncancel; * otherwise, we wouldn't have to take the lock * until just before dropping the space lock. */ ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); if (bits & MACH_PORT_TYPE_SEND) { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_RECEIVE); assert(IE_BITS_UREFS(bits) > 0); assert(IE_BITS_UREFS(bits) < MACH_PORT_UREFS_MAX); assert(port->ip_srights > 0); /* * The remaining send right turns into a * dead name. Notice we don't decrement * ip_srights, generate a no-senders notif, * or use ipc_right_dncancel, because the * port is destroyed "first". */ bits &= ~IE_BITS_TYPE_MASK; bits |= MACH_PORT_TYPE_DEAD_NAME; if (entry->ie_request != 0) { entry->ie_request = 0; bits++; /* increment urefs */ } entry->ie_bits = bits; entry->ie_object = IO_NULL; } else { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_RECEIVE); assert(IE_BITS_UREFS(bits) == 0); dnrequest = ipc_right_dncancel_macro(space, port, name, entry); entry->ie_object = IO_NULL; ipc_entry_dealloc(space, name, entry); } is_write_unlock(space); ipc_port_clear_receiver(port); ipc_port_destroy(port); /* consumes ref, unlocks */ if (dnrequest != IP_NULL) ipc_notify_port_deleted(dnrequest, name); break; } case MACH_PORT_RIGHT_SEND_ONCE: { ipc_port_t port, dnrequest; if ((bits & MACH_PORT_TYPE_SEND_ONCE) == 0) goto invalid_right; assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_ONCE); assert(IE_BITS_UREFS(bits) == 1); assert((bits & IE_BITS_MAREQUEST) == 0); if ((delta > 0) || (delta < -1)) goto invalid_value; port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); if (ipc_right_check(space, port, name, entry)) { assert(!(entry->ie_bits & MACH_PORT_TYPE_SEND_ONCE)); goto invalid_right; } /* port is locked and active */ assert(port->ip_sorights > 0); if (delta == 0) { ip_unlock(port); goto success; } dnrequest = ipc_right_dncancel_macro(space, port, name, entry); ip_unlock(port); entry->ie_object = IO_NULL; ipc_entry_dealloc(space, name, entry); is_write_unlock(space); ipc_notify_send_once(port); if (dnrequest != IP_NULL) ipc_notify_port_deleted(dnrequest, name); break; } case MACH_PORT_RIGHT_DEAD_NAME: { mach_port_urefs_t urefs; if (bits & MACH_PORT_TYPE_SEND_RIGHTS) { ipc_port_t port; port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); if (!ipc_right_check(space, port, name, entry)) { /* port is locked and active */ ip_unlock(port); goto invalid_right; } bits = entry->ie_bits; } else if ((bits & MACH_PORT_TYPE_DEAD_NAME) == 0) goto invalid_right; assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_DEAD_NAME); assert(IE_BITS_UREFS(bits) > 0); assert((bits & IE_BITS_MAREQUEST) == 0); assert(entry->ie_object == IO_NULL); assert(entry->ie_request == 0); urefs = IE_BITS_UREFS(bits); if (MACH_PORT_UREFS_UNDERFLOW(urefs, delta)) goto invalid_value; if (MACH_PORT_UREFS_OVERFLOW(urefs, delta)) goto urefs_overflow; if ((urefs + delta) == 0) ipc_entry_dealloc(space, name, entry); else entry->ie_bits = bits + delta; is_write_unlock(space); break; } case MACH_PORT_RIGHT_SEND: { mach_port_urefs_t urefs; ipc_port_t port; ipc_port_t dnrequest = IP_NULL; ipc_port_t nsrequest = IP_NULL; mach_port_mscount_t mscount = 0; /* '=0' to shut up lint */ if ((bits & MACH_PORT_TYPE_SEND) == 0) goto invalid_right; /* maximum urefs for send is MACH_PORT_UREFS_MAX-1 */ urefs = IE_BITS_UREFS(bits); if (MACH_PORT_UREFS_UNDERFLOW(urefs, delta)) goto invalid_value; if (MACH_PORT_UREFS_OVERFLOW(urefs+1, delta)) goto urefs_overflow; port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); if (ipc_right_check(space, port, name, entry)) { assert((entry->ie_bits & MACH_PORT_TYPE_SEND) == 0); goto invalid_right; } /* port is locked and active */ assert(port->ip_srights > 0); if ((urefs + delta) == 0) { if (--port->ip_srights == 0) { nsrequest = port->ip_nsrequest; if (nsrequest != IP_NULL) { port->ip_nsrequest = IP_NULL; mscount = port->ip_mscount; } } if (bits & MACH_PORT_TYPE_RECEIVE) { assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_RECEIVE); entry->ie_bits = bits &~ (IE_BITS_UREFS_MASK| MACH_PORT_TYPE_SEND); } else { assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND); dnrequest = ipc_right_dncancel_macro( space, port, name, entry); ipc_reverse_remove(space, (ipc_object_t) port); if (bits & IE_BITS_MAREQUEST) ipc_marequest_cancel(space, name); ip_release(port); entry->ie_object = IO_NULL; ipc_entry_dealloc(space, name, entry); } } else entry->ie_bits = bits + delta; ip_unlock(port); /* even if dropped a ref, port is active */ is_write_unlock(space); if (nsrequest != IP_NULL) ipc_notify_no_senders(nsrequest, mscount); if (dnrequest != IP_NULL) ipc_notify_port_deleted(dnrequest, name); break; } default: #if MACH_ASSERT assert(!"ipc_right_delta: strange right"); #else panic("ipc_right_delta: strange right"); #endif } return KERN_SUCCESS; success: is_write_unlock(space); return KERN_SUCCESS; invalid_right: is_write_unlock(space); return KERN_INVALID_RIGHT; invalid_value: is_write_unlock(space); return KERN_INVALID_VALUE; urefs_overflow: is_write_unlock(space); return KERN_UREFS_OVERFLOW; }
kern_return_t ipc_right_dealloc( ipc_space_t space, mach_port_t name, ipc_entry_t entry) { ipc_entry_bits_t bits = entry->ie_bits; mach_port_type_t type = IE_BITS_TYPE(bits); assert(space->is_active); switch (type) { case MACH_PORT_TYPE_DEAD_NAME: { dead_name: assert(IE_BITS_UREFS(bits) > 0); assert(entry->ie_request == 0); assert(entry->ie_object == IO_NULL); assert((bits & IE_BITS_MAREQUEST) == 0); if (IE_BITS_UREFS(bits) == 1) ipc_entry_dealloc(space, name, entry); else entry->ie_bits = bits-1; /* decrement urefs */ is_write_unlock(space); break; } case MACH_PORT_TYPE_SEND_ONCE: { ipc_port_t port, dnrequest; assert(IE_BITS_UREFS(bits) == 1); assert((bits & IE_BITS_MAREQUEST) == 0); port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); if (ipc_right_check(space, port, name, entry)) { bits = entry->ie_bits; assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_DEAD_NAME); goto dead_name; } /* port is locked and active */ assert(port->ip_sorights > 0); dnrequest = ipc_right_dncancel_macro(space, port, name, entry); ip_unlock(port); entry->ie_object = IO_NULL; ipc_entry_dealloc(space, name, entry); is_write_unlock(space); ipc_notify_send_once(port); if (dnrequest != IP_NULL) ipc_notify_port_deleted(dnrequest, name); break; } case MACH_PORT_TYPE_SEND: { ipc_port_t port; ipc_port_t dnrequest = IP_NULL; ipc_port_t nsrequest = IP_NULL; mach_port_mscount_t mscount = 0; /* '=0' to shut up lint */ assert(IE_BITS_UREFS(bits) > 0); port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); if (ipc_right_check(space, port, name, entry)) { bits = entry->ie_bits; assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_DEAD_NAME); goto dead_name; } /* port is locked and active */ assert(port->ip_srights > 0); if (IE_BITS_UREFS(bits) == 1) { if (--port->ip_srights == 0) { nsrequest = port->ip_nsrequest; if (nsrequest != IP_NULL) { port->ip_nsrequest = IP_NULL; mscount = port->ip_mscount; } } dnrequest = ipc_right_dncancel_macro(space, port, name, entry); ipc_reverse_remove(space, (ipc_object_t) port); if (bits & IE_BITS_MAREQUEST) ipc_marequest_cancel(space, name); ip_release(port); entry->ie_object = IO_NULL; ipc_entry_dealloc(space, name, entry); } else entry->ie_bits = bits-1; /* decrement urefs */ ip_unlock(port); /* even if dropped a ref, port is active */ is_write_unlock(space); if (nsrequest != IP_NULL) ipc_notify_no_senders(nsrequest, mscount); if (dnrequest != IP_NULL) ipc_notify_port_deleted(dnrequest, name); break; } case MACH_PORT_TYPE_SEND_RECEIVE: { ipc_port_t port; ipc_port_t nsrequest = IP_NULL; mach_port_mscount_t mscount = 0; /* '=0' to shut up lint */ assert(IE_BITS_UREFS(bits) > 0); port = (ipc_port_t) entry->ie_object; assert(port != IP_NULL); ip_lock(port); assert(ip_active(port)); assert(port->ip_receiver_name == name); assert(port->ip_receiver == space); assert(port->ip_srights > 0); if (IE_BITS_UREFS(bits) == 1) { if (--port->ip_srights == 0) { nsrequest = port->ip_nsrequest; if (nsrequest != IP_NULL) { port->ip_nsrequest = IP_NULL; mscount = port->ip_mscount; } } entry->ie_bits = bits &~ (IE_BITS_UREFS_MASK| MACH_PORT_TYPE_SEND); } else entry->ie_bits = bits-1; /* decrement urefs */ ip_unlock(port); is_write_unlock(space); if (nsrequest != IP_NULL) ipc_notify_no_senders(nsrequest, mscount); break; } default: is_write_unlock(space); return KERN_INVALID_RIGHT; } return KERN_SUCCESS; }
mach_msg_return_t mach_msg_trap( mach_msg_header_t *msg, mach_msg_option_t option, mach_msg_size_t send_size, mach_msg_size_t rcv_size, mach_port_t rcv_name, mach_msg_timeout_t time_out, mach_port_t notify) { mach_msg_return_t mr; /* first check for common cases */ if (option == (MACH_SEND_MSG|MACH_RCV_MSG)) { ipc_thread_t self = current_thread(); ipc_space_t space = self->task->itk_space; ipc_kmsg_t kmsg; ipc_port_t dest_port; ipc_object_t rcv_object; ipc_mqueue_t rcv_mqueue; mach_msg_size_t reply_size; /* * This case is divided into ten sections, each * with a label. There are five optimized * sections and six unoptimized sections, which * do the same thing but handle all possible * cases and are slower. * * The five sections for an RPC are * 1) Get request message into a buffer. * (fast_get or slow_get) * 2) Copyin request message and rcv_name. * (fast_copyin or slow_copyin) * 3) Enqueue request and dequeue reply. * (fast_send_receive or * slow_send and slow_receive) * 4) Copyout reply message. * (fast_copyout or slow_copyout) * 5) Put reply message to user's buffer. * (fast_put or slow_put) * * Keep the locking hierarchy firmly in mind. * (First spaces, then ports, then port sets, * then message queues.) Only a non-blocking * attempt can be made to acquire locks out of * order, or acquire two locks on the same level. * Acquiring two locks on the same level will * fail if the objects are really the same, * unless simple locking is disabled. This is OK, * because then the extra unlock does nothing. * * There are two major reasons these RPCs can't use * ipc_thread_switch, and use slow_send/slow_receive: * 1) Kernel RPCs. * 2) Servers fall behind clients, so * client doesn't find a blocked server thread and * server finds waiting messages and can't block. */ /* fast_get: */ /* * optimized ipc_kmsg_get * * No locks, references, or messages held. * We must clear ikm_cache before copyinmsg. */ if ((send_size > IKM_SAVED_MSG_SIZE) || (send_size < sizeof(mach_msg_header_t)) || (send_size & 3) || ((kmsg = ikm_cache()) == IKM_NULL)) goto slow_get; ikm_cache() = IKM_NULL; ikm_check_initialized(kmsg, IKM_SAVED_KMSG_SIZE); if (copyinmsg(msg, &kmsg->ikm_header, send_size)) { ikm_free(kmsg); goto slow_get; } kmsg->ikm_header.msgh_size = send_size; fast_copyin: /* * optimized ipc_kmsg_copyin/ipc_mqueue_copyin * * We have the request message data in kmsg. * Must still do copyin, send, receive, etc. * * If the message isn't simple, we can't combine * ipc_kmsg_copyin_header and ipc_mqueue_copyin, * because copyin of the message body might * affect rcv_name. */ switch (kmsg->ikm_header.msgh_bits) { case MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE): { ipc_entry_t table; ipc_entry_num_t size; ipc_port_t reply_port; /* sending a request message */ { mach_port_index_t index; mach_port_gen_t gen; { mach_port_t reply_name = kmsg->ikm_header.msgh_local_port; if (reply_name != rcv_name) goto slow_copyin; /* optimized ipc_entry_lookup of reply_name */ index = MACH_PORT_INDEX(reply_name); gen = MACH_PORT_GEN(reply_name); } is_read_lock(space); assert(space->is_active); size = space->is_table_size; table = space->is_table; if (index >= size) goto abort_request_copyin; { ipc_entry_t entry; ipc_entry_bits_t bits; entry = &table[index]; bits = entry->ie_bits; /* check generation number and type bit */ if ((bits & (IE_BITS_GEN_MASK| MACH_PORT_TYPE_RECEIVE)) != (gen | MACH_PORT_TYPE_RECEIVE)) goto abort_request_copyin; reply_port = (ipc_port_t) entry->ie_object; assert(reply_port != IP_NULL); } } /* optimized ipc_entry_lookup of dest_name */ { mach_port_index_t index; mach_port_gen_t gen; { mach_port_t dest_name = kmsg->ikm_header.msgh_remote_port; index = MACH_PORT_INDEX(dest_name); gen = MACH_PORT_GEN(dest_name); } if (index >= size) goto abort_request_copyin; { ipc_entry_t entry; ipc_entry_bits_t bits; entry = &table[index]; bits = entry->ie_bits; /* check generation number and type bit */ if ((bits & (IE_BITS_GEN_MASK|MACH_PORT_TYPE_SEND)) != (gen | MACH_PORT_TYPE_SEND)) goto abort_request_copyin; assert(IE_BITS_UREFS(bits) > 0); dest_port = (ipc_port_t) entry->ie_object; assert(dest_port != IP_NULL); } } /* * To do an atomic copyin, need simultaneous * locks on both ports and the space. If * dest_port == reply_port, and simple locking is * enabled, then we will abort. Otherwise it's * OK to unlock twice. */ ip_lock(dest_port); if (!ip_active(dest_port) || !ip_lock_try(reply_port)) { ip_unlock(dest_port); goto abort_request_copyin; } is_read_unlock(space); assert(dest_port->ip_srights > 0); dest_port->ip_srights++; ip_reference(dest_port); assert(ip_active(reply_port)); assert(reply_port->ip_receiver_name == kmsg->ikm_header.msgh_local_port); assert(reply_port->ip_receiver == space); reply_port->ip_sorights++; ip_reference(reply_port); kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE); kmsg->ikm_header.msgh_remote_port = (mach_port_t) dest_port; kmsg->ikm_header.msgh_local_port = (mach_port_t) reply_port; /* make sure we can queue to the destination */ if (dest_port->ip_receiver == ipc_space_kernel) { /* * The kernel server has a reference to * the reply port, which it hands back * to us in the reply message. We do * not need to keep another reference to * it. */ ip_unlock(reply_port); assert(ip_active(dest_port)); ip_unlock(dest_port); goto kernel_send; } if (dest_port->ip_msgcount >= dest_port->ip_qlimit) goto abort_request_send_receive; /* optimized ipc_mqueue_copyin */ if (reply_port->ip_pset != IPS_NULL) goto abort_request_send_receive; rcv_object = (ipc_object_t) reply_port; io_reference(rcv_object); rcv_mqueue = &reply_port->ip_messages; imq_lock(rcv_mqueue); io_unlock(rcv_object); goto fast_send_receive; abort_request_copyin: is_read_unlock(space); goto slow_copyin; abort_request_send_receive: ip_unlock(dest_port); ip_unlock(reply_port); goto slow_send; } case MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND_ONCE, 0): { ipc_entry_num_t size; ipc_entry_t table; /* sending a reply message */ { mach_port_t reply_name = kmsg->ikm_header.msgh_local_port; if (reply_name != MACH_PORT_NULL) goto slow_copyin; } is_write_lock(space); assert(space->is_active); /* optimized ipc_entry_lookup */ size = space->is_table_size; table = space->is_table; { ipc_entry_t entry; mach_port_gen_t gen; mach_port_index_t index; { mach_port_t dest_name = kmsg->ikm_header.msgh_remote_port; index = MACH_PORT_INDEX(dest_name); gen = MACH_PORT_GEN(dest_name); } if (index >= size) goto abort_reply_dest_copyin; entry = &table[index]; /* check generation, collision bit, and type bit */ if ((entry->ie_bits & (IE_BITS_GEN_MASK| IE_BITS_COLLISION| MACH_PORT_TYPE_SEND_ONCE)) != (gen | MACH_PORT_TYPE_SEND_ONCE)) goto abort_reply_dest_copyin; /* optimized ipc_right_copyin */ assert(IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_SEND_ONCE); assert(IE_BITS_UREFS(entry->ie_bits) == 1); assert((entry->ie_bits & IE_BITS_MAREQUEST) == 0); if (entry->ie_request != 0) goto abort_reply_dest_copyin; dest_port = (ipc_port_t) entry->ie_object; assert(dest_port != IP_NULL); ip_lock(dest_port); if (!ip_active(dest_port)) { ip_unlock(dest_port); goto abort_reply_dest_copyin; } assert(dest_port->ip_sorights > 0); /* optimized ipc_entry_dealloc */ entry->ie_next = table->ie_next; table->ie_next = index; entry->ie_bits = gen; entry->ie_object = IO_NULL; } kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, 0); kmsg->ikm_header.msgh_remote_port = (mach_port_t) dest_port; /* make sure we can queue to the destination */ assert(dest_port->ip_receiver != ipc_space_kernel); /* optimized ipc_entry_lookup/ipc_mqueue_copyin */ { ipc_entry_t entry; ipc_entry_bits_t bits; { mach_port_index_t index; mach_port_gen_t gen; index = MACH_PORT_INDEX(rcv_name); gen = MACH_PORT_GEN(rcv_name); if (index >= size) goto abort_reply_rcv_copyin; entry = &table[index]; bits = entry->ie_bits; /* check generation number */ if ((bits & IE_BITS_GEN_MASK) != gen) goto abort_reply_rcv_copyin; } /* check type bits; looking for receive or set */ if (bits & MACH_PORT_TYPE_PORT_SET) { ipc_pset_t rcv_pset; rcv_pset = (ipc_pset_t) entry->ie_object; assert(rcv_pset != IPS_NULL); ips_lock(rcv_pset); assert(ips_active(rcv_pset)); rcv_object = (ipc_object_t) rcv_pset; rcv_mqueue = &rcv_pset->ips_messages; } else if (bits & MACH_PORT_TYPE_RECEIVE) { ipc_port_t rcv_port; rcv_port = (ipc_port_t) entry->ie_object; assert(rcv_port != IP_NULL); if (!ip_lock_try(rcv_port)) goto abort_reply_rcv_copyin; assert(ip_active(rcv_port)); if (rcv_port->ip_pset != IPS_NULL) { ip_unlock(rcv_port); goto abort_reply_rcv_copyin; } rcv_object = (ipc_object_t) rcv_port; rcv_mqueue = &rcv_port->ip_messages; } else goto abort_reply_rcv_copyin; } is_write_unlock(space); io_reference(rcv_object); imq_lock(rcv_mqueue); io_unlock(rcv_object); goto fast_send_receive; abort_reply_dest_copyin: is_write_unlock(space); goto slow_copyin; abort_reply_rcv_copyin: ip_unlock(dest_port); is_write_unlock(space); goto slow_send; } default: goto slow_copyin; } /*NOTREACHED*/ fast_send_receive: /* * optimized ipc_mqueue_send/ipc_mqueue_receive * * Finished get/copyin of kmsg and copyin of rcv_name. * space is unlocked, dest_port is locked, * we can queue kmsg to dest_port, * rcv_mqueue is locked, rcv_object holds a ref, * if rcv_object is a port it isn't in a port set * * Note that if simple locking is turned off, * then we could have dest_mqueue == rcv_mqueue * and not abort when we try to lock dest_mqueue. */ assert(ip_active(dest_port)); assert(dest_port->ip_receiver != ipc_space_kernel); assert((dest_port->ip_msgcount < dest_port->ip_qlimit) || (MACH_MSGH_BITS_REMOTE(kmsg->ikm_header.msgh_bits) == MACH_MSG_TYPE_PORT_SEND_ONCE)); assert((kmsg->ikm_header.msgh_bits & MACH_MSGH_BITS_CIRCULAR) == 0); { ipc_mqueue_t dest_mqueue; ipc_thread_t receiver; { ipc_pset_t dest_pset; dest_pset = dest_port->ip_pset; if (dest_pset == IPS_NULL) dest_mqueue = &dest_port->ip_messages; else dest_mqueue = &dest_pset->ips_messages; } if (!imq_lock_try(dest_mqueue)) { abort_send_receive: ip_unlock(dest_port); imq_unlock(rcv_mqueue); ipc_object_release(rcv_object); goto slow_send; } receiver = ipc_thread_queue_first(&dest_mqueue->imq_threads); if ((receiver == ITH_NULL) || (ipc_kmsg_queue_first(&rcv_mqueue->imq_messages) != IKM_NULL)) { imq_unlock(dest_mqueue); goto abort_send_receive; } /* * There is a receiver thread waiting, and * there is no reply message for us to pick up. * We have hope of hand-off, so save state. */ self->ith_msg = msg; self->ith_rcv_size = rcv_size; self->ith_object = rcv_object; self->ith_mqueue = rcv_mqueue; if ((receiver->swap_func == (void (*)()) mach_msg_continue) && thread_handoff(self, mach_msg_continue, receiver)) { assert(current_thread() == receiver); /* * We can use the optimized receive code, * because the receiver is using no options. */ } else if ((receiver->swap_func == (void (*)()) exception_raise_continue) && thread_handoff(self, mach_msg_continue, receiver)) { counter(c_mach_msg_trap_block_exc++); assert(current_thread() == receiver); /* * We are a reply message coming back through * the optimized exception-handling path. * Finish with rcv_mqueue and dest_mqueue, * and then jump to exception code with * dest_port still locked. We don't bother * with a sequence number in this case. */ ipc_thread_enqueue_macro( &rcv_mqueue->imq_threads, self); self->ith_state = MACH_RCV_IN_PROGRESS; self->ith_msize = MACH_MSG_SIZE_MAX; imq_unlock(rcv_mqueue); ipc_thread_rmqueue_first_macro( &dest_mqueue->imq_threads, receiver); imq_unlock(dest_mqueue); exception_raise_continue_fast(dest_port, kmsg); /*NOTREACHED*/ return MACH_MSG_SUCCESS; } else if ((send_size <= receiver->ith_msize) && thread_handoff(self, mach_msg_continue, receiver)) { assert(current_thread() == receiver); if ((receiver->swap_func == (void (*)()) mach_msg_receive_continue) && ((receiver->ith_option & MACH_RCV_NOTIFY) == 0)) { /* * We can still use the optimized code. */ } else { counter(c_mach_msg_trap_block_slow++); /* * We are running as the receiver, * but we can't use the optimized code. * Finish send/receive processing. */ dest_port->ip_msgcount++; ip_unlock(dest_port); ipc_thread_enqueue_macro( &rcv_mqueue->imq_threads, self); self->ith_state = MACH_RCV_IN_PROGRESS; self->ith_msize = MACH_MSG_SIZE_MAX; imq_unlock(rcv_mqueue); ipc_thread_rmqueue_first_macro( &dest_mqueue->imq_threads, receiver); receiver->ith_state = MACH_MSG_SUCCESS; receiver->ith_kmsg = kmsg; receiver->ith_seqno = dest_port->ip_seqno++; imq_unlock(dest_mqueue); /* * Call the receiver's continuation. */ receiver->wait_result = THREAD_AWAKENED; (*receiver->swap_func)(); /*NOTREACHED*/ return MACH_MSG_SUCCESS; } } else { /* * The receiver can't accept the message, * or we can't switch to the receiver. */ imq_unlock(dest_mqueue); goto abort_send_receive; } counter(c_mach_msg_trap_block_fast++); /* * Safe to unlock dest_port now that we are * committed to this path, because we hold * dest_mqueue locked. We never bother changing * dest_port->ip_msgcount. */ ip_unlock(dest_port); /* * We need to finish preparing self for its * time asleep in rcv_mqueue. */ ipc_thread_enqueue_macro(&rcv_mqueue->imq_threads, self); self->ith_state = MACH_RCV_IN_PROGRESS; self->ith_msize = MACH_MSG_SIZE_MAX; imq_unlock(rcv_mqueue); /* * Finish extracting receiver from dest_mqueue. */ ipc_thread_rmqueue_first_macro( &dest_mqueue->imq_threads, receiver); kmsg->ikm_header.msgh_seqno = dest_port->ip_seqno++; imq_unlock(dest_mqueue); /* * We don't have to do any post-dequeue processing of * the message. We never incremented ip_msgcount, we * know it has no msg-accepted request, and blocked * senders aren't a worry because we found the port * with a receiver waiting. */ self = receiver; space = self->task->itk_space; msg = self->ith_msg; rcv_size = self->ith_rcv_size; rcv_object = self->ith_object; /* inline ipc_object_release */ io_lock(rcv_object); io_release(rcv_object); io_check_unlock(rcv_object); } fast_copyout: /* * Nothing locked and no references held, except * we have kmsg with msgh_seqno filled in. Must * still check against rcv_size and do * ipc_kmsg_copyout/ipc_kmsg_put. */ assert((ipc_port_t) kmsg->ikm_header.msgh_remote_port == dest_port); reply_size = kmsg->ikm_header.msgh_size; if (rcv_size < reply_size) goto slow_copyout; /* optimized ipc_kmsg_copyout/ipc_kmsg_copyout_header */ switch (kmsg->ikm_header.msgh_bits) { case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, MACH_MSG_TYPE_PORT_SEND_ONCE): { ipc_port_t reply_port = (ipc_port_t) kmsg->ikm_header.msgh_local_port; mach_port_t dest_name, reply_name; /* receiving a request message */ if (!IP_VALID(reply_port)) goto slow_copyout; is_write_lock(space); assert(space->is_active); /* * To do an atomic copyout, need simultaneous * locks on both ports and the space. If * dest_port == reply_port, and simple locking is * enabled, then we will abort. Otherwise it's * OK to unlock twice. */ ip_lock(dest_port); if (!ip_active(dest_port) || !ip_lock_try(reply_port)) goto abort_request_copyout; if (!ip_active(reply_port)) { ip_unlock(reply_port); goto abort_request_copyout; } assert(reply_port->ip_sorights > 0); ip_unlock(reply_port); { ipc_entry_t table; ipc_entry_t entry; mach_port_index_t index; /* optimized ipc_entry_get */ table = space->is_table; index = table->ie_next; if (index == 0) goto abort_request_copyout; entry = &table[index]; table->ie_next = entry->ie_next; entry->ie_request = 0; { mach_port_gen_t gen; assert((entry->ie_bits &~ IE_BITS_GEN_MASK) == 0); gen = entry->ie_bits + IE_BITS_GEN_ONE; reply_name = MACH_PORT_MAKE(index, gen); /* optimized ipc_right_copyout */ entry->ie_bits = gen | (MACH_PORT_TYPE_SEND_ONCE | 1); } assert(MACH_PORT_VALID(reply_name)); entry->ie_object = (ipc_object_t) reply_port; is_write_unlock(space); } /* optimized ipc_object_copyout_dest */ assert(dest_port->ip_srights > 0); ip_release(dest_port); if (dest_port->ip_receiver == space) dest_name = dest_port->ip_receiver_name; else dest_name = MACH_PORT_NULL; if ((--dest_port->ip_srights == 0) && (dest_port->ip_nsrequest != IP_NULL)) { ipc_port_t nsrequest; mach_port_mscount_t mscount; /* a rather rare case */ nsrequest = dest_port->ip_nsrequest; mscount = dest_port->ip_mscount; dest_port->ip_nsrequest = IP_NULL; ip_unlock(dest_port); ipc_notify_no_senders(nsrequest, mscount); } else ip_unlock(dest_port); if (! ipc_port_flag_protected_payload(dest_port)) { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS( MACH_MSG_TYPE_PORT_SEND_ONCE, MACH_MSG_TYPE_PORT_SEND); kmsg->ikm_header.msgh_local_port = dest_name; } else { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS( MACH_MSG_TYPE_PORT_SEND_ONCE, MACH_MSG_TYPE_PROTECTED_PAYLOAD); kmsg->ikm_header.msgh_protected_payload = dest_port->ip_protected_payload; } kmsg->ikm_header.msgh_remote_port = reply_name; goto fast_put; abort_request_copyout: ip_unlock(dest_port); is_write_unlock(space); goto slow_copyout; } case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, 0): { mach_port_t dest_name; /* receiving a reply message */ ip_lock(dest_port); if (!ip_active(dest_port)) goto slow_copyout; /* optimized ipc_object_copyout_dest */ assert(dest_port->ip_sorights > 0); if (dest_port->ip_receiver == space) { ip_release(dest_port); dest_port->ip_sorights--; dest_name = dest_port->ip_receiver_name; ip_unlock(dest_port); } else { ip_unlock(dest_port); ipc_notify_send_once(dest_port); dest_name = MACH_PORT_NULL; } if (! ipc_port_flag_protected_payload(dest_port)) { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS( 0, MACH_MSG_TYPE_PORT_SEND_ONCE); kmsg->ikm_header.msgh_local_port = dest_name; } else { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS( 0, MACH_MSG_TYPE_PROTECTED_PAYLOAD); kmsg->ikm_header.msgh_protected_payload = dest_port->ip_protected_payload; } kmsg->ikm_header.msgh_remote_port = MACH_PORT_NULL; goto fast_put; } case MACH_MSGH_BITS_COMPLEX| MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, 0): { mach_port_t dest_name; /* receiving a complex reply message */ ip_lock(dest_port); if (!ip_active(dest_port)) goto slow_copyout; /* optimized ipc_object_copyout_dest */ assert(dest_port->ip_sorights > 0); if (dest_port->ip_receiver == space) { ip_release(dest_port); dest_port->ip_sorights--; dest_name = dest_port->ip_receiver_name; ip_unlock(dest_port); } else { ip_unlock(dest_port); ipc_notify_send_once(dest_port); dest_name = MACH_PORT_NULL; } if (! ipc_port_flag_protected_payload(dest_port)) { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS( 0, MACH_MSG_TYPE_PORT_SEND_ONCE); kmsg->ikm_header.msgh_local_port = dest_name; } else { kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS( 0, MACH_MSG_TYPE_PROTECTED_PAYLOAD); kmsg->ikm_header.msgh_protected_payload = dest_port->ip_protected_payload; } kmsg->ikm_header.msgh_remote_port = MACH_PORT_NULL; mr = ipc_kmsg_copyout_body( (vm_offset_t) (&kmsg->ikm_header + 1), (vm_offset_t) &kmsg->ikm_header + kmsg->ikm_header.msgh_size, space, current_map()); if (mr != MACH_MSG_SUCCESS) { (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); return mr | MACH_RCV_BODY_ERROR; } goto fast_put; } default: goto slow_copyout; } /*NOTREACHED*/ fast_put: /* * We have the reply message data in kmsg, * and the reply message size in reply_size. * Just need to copy it out to the user and free kmsg. * We must check ikm_cache after copyoutmsg. */ ikm_check_initialized(kmsg, kmsg->ikm_size); if ((kmsg->ikm_size != IKM_SAVED_KMSG_SIZE) || copyoutmsg(&kmsg->ikm_header, msg, reply_size) || (ikm_cache() != IKM_NULL)) goto slow_put; ikm_cache() = kmsg; thread_syscall_return(MACH_MSG_SUCCESS); /*NOTREACHED*/ return MACH_MSG_SUCCESS; /* help for the compiler */ /* * The slow path has a few non-register temporary * variables used only for call-by-reference. */ { ipc_kmsg_t temp_kmsg; mach_port_seqno_t temp_seqno; ipc_object_t temp_rcv_object; ipc_mqueue_t temp_rcv_mqueue; slow_get: /* * No locks, references, or messages held. * Still have to get the request, send it, * receive reply, etc. */ mr = ipc_kmsg_get(msg, send_size, &temp_kmsg); if (mr != MACH_MSG_SUCCESS) { thread_syscall_return(mr); /*NOTREACHED*/ } kmsg = temp_kmsg; /* try to get back on optimized path */ goto fast_copyin; slow_copyin: /* * We have the message data in kmsg, but * we still need to copyin, send it, * receive a reply, and do copyout. */ mr = ipc_kmsg_copyin(kmsg, space, current_map(), MACH_PORT_NULL); if (mr != MACH_MSG_SUCCESS) { ikm_free(kmsg); thread_syscall_return(mr); /*NOTREACHED*/ } /* try to get back on optimized path */ if (kmsg->ikm_header.msgh_bits & MACH_MSGH_BITS_CIRCULAR) goto slow_send; dest_port = (ipc_port_t) kmsg->ikm_header.msgh_remote_port; assert(IP_VALID(dest_port)); ip_lock(dest_port); if (dest_port->ip_receiver == ipc_space_kernel) { assert(ip_active(dest_port)); ip_unlock(dest_port); goto kernel_send; } if (ip_active(dest_port) && ((dest_port->ip_msgcount < dest_port->ip_qlimit) || (MACH_MSGH_BITS_REMOTE(kmsg->ikm_header.msgh_bits) == MACH_MSG_TYPE_PORT_SEND_ONCE))) { /* * Try an optimized ipc_mqueue_copyin. * It will work if this is a request message. */ ipc_port_t reply_port; reply_port = (ipc_port_t) kmsg->ikm_header.msgh_local_port; if (IP_VALID(reply_port)) { if (ip_lock_try(reply_port)) { if (ip_active(reply_port) && reply_port->ip_receiver == space && reply_port->ip_receiver_name == rcv_name && reply_port->ip_pset == IPS_NULL) { /* Grab a reference to the reply port. */ rcv_object = (ipc_object_t) reply_port; io_reference(rcv_object); rcv_mqueue = &reply_port->ip_messages; imq_lock(rcv_mqueue); io_unlock(rcv_object); goto fast_send_receive; } ip_unlock(reply_port); } } } ip_unlock(dest_port); goto slow_send; kernel_send: /* * Special case: send message to kernel services. * The request message has been copied into the * kmsg. Nothing is locked. */ { ipc_port_t reply_port; /* * Perform the kernel function. */ kmsg = ipc_kobject_server(kmsg); if (kmsg == IKM_NULL) { /* * No reply. Take the * slow receive path. */ goto slow_get_rcv_port; } /* * Check that: * the reply port is alive * we hold the receive right * the name has not changed. * the port is not in a set * If any of these are not true, * we cannot directly receive the reply * message. */ reply_port = (ipc_port_t) kmsg->ikm_header.msgh_remote_port; ip_lock(reply_port); if ((!ip_active(reply_port)) || (reply_port->ip_receiver != space) || (reply_port->ip_receiver_name != rcv_name) || (reply_port->ip_pset != IPS_NULL)) { ip_unlock(reply_port); ipc_mqueue_send_always(kmsg); goto slow_get_rcv_port; } rcv_mqueue = &reply_port->ip_messages; imq_lock(rcv_mqueue); /* keep port locked, and don`t change ref count yet */ /* * If there are messages on the port * or other threads waiting for a message, * we cannot directly receive the reply. */ if ((ipc_thread_queue_first(&rcv_mqueue->imq_threads) != ITH_NULL) || (ipc_kmsg_queue_first(&rcv_mqueue->imq_messages) != IKM_NULL)) { imq_unlock(rcv_mqueue); ip_unlock(reply_port); ipc_mqueue_send_always(kmsg); goto slow_get_rcv_port; } /* * We can directly receive this reply. * Since the kernel reply never blocks, * it holds no message_accepted request. * Since there were no messages queued * on the reply port, there should be * no threads blocked waiting to send. */ assert(kmsg->ikm_marequest == IMAR_NULL); assert(ipc_thread_queue_first(&reply_port->ip_blocked) == ITH_NULL); dest_port = reply_port; kmsg->ikm_header.msgh_seqno = dest_port->ip_seqno++; imq_unlock(rcv_mqueue); /* * inline ipc_object_release. * Port is still locked. * Reference count was not incremented. */ ip_check_unlock(reply_port); /* copy out the kernel reply */ goto fast_copyout; } slow_send: /* * Nothing is locked. We have acquired kmsg, but * we still need to send it and receive a reply. */ mr = ipc_mqueue_send(kmsg, MACH_MSG_OPTION_NONE, MACH_MSG_TIMEOUT_NONE); if (mr != MACH_MSG_SUCCESS) { mr |= ipc_kmsg_copyout_pseudo(kmsg, space, current_map()); assert(kmsg->ikm_marequest == IMAR_NULL); (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); thread_syscall_return(mr); /*NOTREACHED*/ } slow_get_rcv_port: /* * We have sent the message. Copy in the receive port. */ mr = ipc_mqueue_copyin(space, rcv_name, &temp_rcv_mqueue, &temp_rcv_object); if (mr != MACH_MSG_SUCCESS) { thread_syscall_return(mr); /*NOTREACHED*/ } rcv_mqueue = temp_rcv_mqueue; rcv_object = temp_rcv_object; /* hold ref for rcv_object; rcv_mqueue is locked */ /* slow_receive: */ /* * Now we have sent the request and copied in rcv_name, * so rcv_mqueue is locked and hold ref for rcv_object. * Just receive a reply and try to get back to fast path. * * ipc_mqueue_receive may not return, because if we block * then our kernel stack may be discarded. So we save * state here for mach_msg_continue to pick up. */ self->ith_msg = msg; self->ith_rcv_size = rcv_size; self->ith_object = rcv_object; self->ith_mqueue = rcv_mqueue; mr = ipc_mqueue_receive(rcv_mqueue, MACH_MSG_OPTION_NONE, MACH_MSG_SIZE_MAX, MACH_MSG_TIMEOUT_NONE, FALSE, mach_msg_continue, &temp_kmsg, &temp_seqno); /* rcv_mqueue is unlocked */ ipc_object_release(rcv_object); if (mr != MACH_MSG_SUCCESS) { thread_syscall_return(mr); /*NOTREACHED*/ } (kmsg = temp_kmsg)->ikm_header.msgh_seqno = temp_seqno; dest_port = (ipc_port_t) kmsg->ikm_header.msgh_remote_port; goto fast_copyout; slow_copyout: /* * Nothing locked and no references held, except * we have kmsg with msgh_seqno filled in. Must * still check against rcv_size and do * ipc_kmsg_copyout/ipc_kmsg_put. */ reply_size = kmsg->ikm_header.msgh_size; if (rcv_size < reply_size) { ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(msg, kmsg, sizeof *msg); thread_syscall_return(MACH_RCV_TOO_LARGE); /*NOTREACHED*/ } mr = ipc_kmsg_copyout(kmsg, space, current_map(), MACH_PORT_NULL); if (mr != MACH_MSG_SUCCESS) { if ((mr &~ MACH_MSG_MASK) == MACH_RCV_BODY_ERROR) { (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); } else { ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(msg, kmsg, sizeof *msg); } thread_syscall_return(mr); /*NOTREACHED*/ } /* try to get back on optimized path */ goto fast_put; slow_put: mr = ipc_kmsg_put(msg, kmsg, reply_size); thread_syscall_return(mr); /*NOTREACHED*/ } } else if (option == MACH_SEND_MSG) { ipc_space_t space = current_space(); vm_map_t map = current_map(); ipc_kmsg_t kmsg; mr = ipc_kmsg_get(msg, send_size, &kmsg); if (mr != MACH_MSG_SUCCESS) return mr; mr = ipc_kmsg_copyin(kmsg, space, map, MACH_PORT_NULL); if (mr != MACH_MSG_SUCCESS) { ikm_free(kmsg); return mr; } mr = ipc_mqueue_send(kmsg, MACH_MSG_OPTION_NONE, MACH_MSG_TIMEOUT_NONE); if (mr != MACH_MSG_SUCCESS) { mr |= ipc_kmsg_copyout_pseudo(kmsg, space, map); assert(kmsg->ikm_marequest == IMAR_NULL); (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); } return mr; } else if (option == MACH_RCV_MSG) { ipc_thread_t self = current_thread(); ipc_space_t space = current_space(); vm_map_t map = current_map(); ipc_object_t object; ipc_mqueue_t mqueue; ipc_kmsg_t kmsg; mach_port_seqno_t seqno; mr = ipc_mqueue_copyin(space, rcv_name, &mqueue, &object); if (mr != MACH_MSG_SUCCESS) return mr; /* hold ref for object; mqueue is locked */ /* * ipc_mqueue_receive may not return, because if we block * then our kernel stack may be discarded. So we save * state here for mach_msg_continue to pick up. */ self->ith_msg = msg; self->ith_rcv_size = rcv_size; self->ith_object = object; self->ith_mqueue = mqueue; mr = ipc_mqueue_receive(mqueue, MACH_MSG_OPTION_NONE, MACH_MSG_SIZE_MAX, MACH_MSG_TIMEOUT_NONE, FALSE, mach_msg_continue, &kmsg, &seqno); /* mqueue is unlocked */ ipc_object_release(object); if (mr != MACH_MSG_SUCCESS) return mr; kmsg->ikm_header.msgh_seqno = seqno; if (rcv_size < kmsg->ikm_header.msgh_size) { ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(msg, kmsg, sizeof *msg); return MACH_RCV_TOO_LARGE; } mr = ipc_kmsg_copyout(kmsg, space, map, MACH_PORT_NULL); if (mr != MACH_MSG_SUCCESS) { if ((mr &~ MACH_MSG_MASK) == MACH_RCV_BODY_ERROR) { (void) ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); } else { ipc_kmsg_copyout_dest(kmsg, space); (void) ipc_kmsg_put(msg, kmsg, sizeof *msg); } return mr; } return ipc_kmsg_put(msg, kmsg, kmsg->ikm_header.msgh_size); } else if (option == MACH_MSG_OPTION_NONE) { /* * We can measure the "null mach_msg_trap" * (syscall entry and thread_syscall_return exit) * with this path. */ thread_syscall_return(MACH_MSG_SUCCESS); /*NOTREACHED*/ } if (option & MACH_SEND_MSG) { mr = mach_msg_send(msg, option, send_size, time_out, notify); if (mr != MACH_MSG_SUCCESS) return mr; } if (option & MACH_RCV_MSG) { mr = mach_msg_receive(msg, option, rcv_size, rcv_name, time_out, notify); if (mr != MACH_MSG_SUCCESS) return mr; } return MACH_MSG_SUCCESS; }
mach_msg_return_t ipc_mqueue_send( ipc_kmsg_t kmsg, mach_msg_option_t option, mach_msg_timeout_t time_out) { ipc_port_t port; port = (ipc_port_t) kmsg->ikm_header.msgh_remote_port; assert(IP_VALID(port)); ip_lock(port); if (port->ip_receiver == ipc_space_kernel) { ipc_kmsg_t reply; /* * We can check ip_receiver == ipc_space_kernel * before checking that the port is active because * ipc_port_dealloc_kernel clears ip_receiver * before destroying a kernel port. */ assert(ip_active(port)); ip_unlock(port); reply = ipc_kobject_server(kmsg); if (reply != IKM_NULL) ipc_mqueue_send_always(reply); return MACH_MSG_SUCCESS; } for (;;) { ipc_thread_t self; /* * Can't deliver to a dead port. * However, we can pretend it got sent * and was then immediately destroyed. */ if (!ip_active(port)) { /* * We can't let ipc_kmsg_destroy deallocate * the port right, because we might end up * in an infinite loop trying to deliver * a send-once notification. */ ip_release(port); ip_check_unlock(port); kmsg->ikm_header.msgh_remote_port = MACH_PORT_NULL; ipc_kmsg_destroy(kmsg); return MACH_MSG_SUCCESS; } /* * Don't block if: * 1) We're under the queue limit. * 2) Caller used the MACH_SEND_ALWAYS internal option. * 3) Message is sent to a send-once right. */ if ((port->ip_msgcount < port->ip_qlimit) || (option & MACH_SEND_ALWAYS) || (MACH_MSGH_BITS_REMOTE(kmsg->ikm_header.msgh_bits) == MACH_MSG_TYPE_PORT_SEND_ONCE)) break; /* must block waiting for queue to clear */ self = current_thread(); if (option & MACH_SEND_TIMEOUT) { if (time_out == 0) { ip_unlock(port); return MACH_SEND_TIMED_OUT; } thread_will_wait_with_timeout(self, time_out); } else thread_will_wait(self); ipc_thread_enqueue(&port->ip_blocked, self); self->ith_state = MACH_SEND_IN_PROGRESS; ip_unlock(port); counter(c_ipc_mqueue_send_block++); thread_block((void (*)(void)) 0); ip_lock(port); /* why did we wake up? */ if (self->ith_state == MACH_MSG_SUCCESS) continue; assert(self->ith_state == MACH_SEND_IN_PROGRESS); /* take ourselves off blocked queue */ ipc_thread_rmqueue(&port->ip_blocked, self); /* * Thread wakeup-reason field tells us why * the wait was interrupted. */ switch (self->ith_wait_result) { case THREAD_INTERRUPTED: /* send was interrupted - give up */ ip_unlock(port); return MACH_SEND_INTERRUPTED; case THREAD_TIMED_OUT: /* timeout expired */ assert(option & MACH_SEND_TIMEOUT); time_out = 0; break; case THREAD_RESTART: default: #if MACH_ASSERT assert(!"ipc_mqueue_send"); #else panic("ipc_mqueue_send"); #endif } } if (kmsg->ikm_header.msgh_bits & MACH_MSGH_BITS_CIRCULAR) { ip_unlock(port); /* don't allow the creation of a circular loop */ ipc_kmsg_destroy(kmsg); return MACH_MSG_SUCCESS; } { ipc_mqueue_t mqueue; ipc_pset_t pset; ipc_thread_t receiver; ipc_thread_queue_t receivers; port->ip_msgcount++; assert(port->ip_msgcount > 0); pset = port->ip_pset; if (pset == IPS_NULL) mqueue = &port->ip_messages; else mqueue = &pset->ips_messages; imq_lock(mqueue); receivers = &mqueue->imq_threads; /* * Can unlock the port now that the msg queue is locked * and we know the port is active. While the msg queue * is locked, we have control of the kmsg, so the ref in * it for the port is still good. If the msg queue is in * a set (dead or alive), then we're OK because the port * is still a member of the set and the set won't go away * until the port is taken out, which tries to lock the * set's msg queue to remove the port's msgs. */ ip_unlock(port); /* check for a receiver for the message */ for (;;) { receiver = ipc_thread_queue_first(receivers); if (receiver == ITH_NULL) { /* no receivers; queue kmsg */ ipc_kmsg_enqueue_macro(&mqueue->imq_messages, kmsg); imq_unlock(mqueue); break; } ipc_thread_rmqueue_first_macro(receivers, receiver); assert(ipc_kmsg_queue_empty(&mqueue->imq_messages)); if (kmsg->ikm_header.msgh_size <= receiver->ith_msize) { /* got a successful receiver */ receiver->ith_state = MACH_MSG_SUCCESS; receiver->ith_kmsg = kmsg; receiver->ith_seqno = port->ip_seqno++; imq_unlock(mqueue); thread_go(receiver); break; } receiver->ith_state = MACH_RCV_TOO_LARGE; receiver->ith_msize = kmsg->ikm_header.msgh_size; thread_go(receiver); } } current_task()->messages_sent++; return MACH_MSG_SUCCESS; }