/*
* ipc_pset_terminate:
*
* Processor set is dead. Deallocate the ipc control structures.
*/
void
ipc_pset_terminate(
processor_set_t pset)
{
ipc_port_dealloc_kernel(pset->pset_self);
ipc_port_dealloc_kernel(pset->pset_name_self);
}
void
ipc_task_reset(
task_t task)
{
ipc_port_t old_kport, new_kport;
ipc_port_t old_sself;
ipc_port_t old_exc_actions[EXC_TYPES_COUNT];
int i;
new_kport = ipc_port_alloc_kernel();
if (new_kport == IP_NULL)
panic("ipc_task_reset");
itk_lock(task);
old_kport = task->itk_self;
if (old_kport == IP_NULL) {
/* the task is already terminated (can this happen?) */
itk_unlock(task);
ipc_port_dealloc_kernel(new_kport);
return;
}
task->itk_self = new_kport;
old_sself = task->itk_sself;
task->itk_sself = ipc_port_make_send(new_kport);
ipc_kobject_set(old_kport, IKO_NULL, IKOT_NONE);
ipc_kobject_set(new_kport, (ipc_kobject_t) task, IKOT_TASK);
for (i = FIRST_EXCEPTION; i < EXC_TYPES_COUNT; i++) {
if (!task->exc_actions[i].privileged) {
old_exc_actions[i] = task->exc_actions[i].port;
task->exc_actions[i].port = IP_NULL;
} else {
old_exc_actions[i] = IP_NULL;
}
}/* for */
if (IP_VALID(task->itk_debug_control)) {
ipc_port_release_send(task->itk_debug_control);
}
task->itk_debug_control = IP_NULL;
itk_unlock(task);
/* release the naked send rights */
if (IP_VALID(old_sself))
ipc_port_release_send(old_sself);
for (i = FIRST_EXCEPTION; i < EXC_TYPES_COUNT; i++) {
if (IP_VALID(old_exc_actions[i])) {
ipc_port_release_send(old_exc_actions[i]);
}
}/* for */
/* destroy the kernel port */
ipc_port_dealloc_kernel(old_kport);
}
void
ipc_thread_terminate(thread_t thread)
{
ipc_port_t kport;
ith_lock(thread);
kport = thread->ith_self;
if (kport == IP_NULL) {
/* the thread is already terminated (can this happen?) */
ith_unlock(thread);
return;
}
thread->ith_self = IP_NULL;
ith_unlock(thread);
assert(ipc_kmsg_queue_empty(&thread->ith_messages));
/* release the naked send rights */
if (IP_VALID(thread->ith_sself))
ipc_port_release_send(thread->ith_sself);
if (IP_VALID(thread->ith_exception))
ipc_port_release_send(thread->ith_exception);
/* destroy the kernel port */
ipc_port_dealloc_kernel(kport);
}
void
ipc_thread_terminate(
thread_t thread)
{
ipc_port_t kport = thread->ith_self;
if (kport != IP_NULL) {
int i;
if (IP_VALID(thread->ith_sself))
ipc_port_release_send(thread->ith_sself);
thread->ith_sself = thread->ith_self = IP_NULL;
for (i = FIRST_EXCEPTION; i < EXC_TYPES_COUNT; ++i) {
if (IP_VALID(thread->exc_actions[i].port))
ipc_port_release_send(thread->exc_actions[i].port);
}
ipc_port_dealloc_kernel(kport);
}
assert(ipc_kmsg_queue_empty(&thread->ith_messages));
if (thread->ith_rpc_reply != IP_NULL)
ipc_port_dealloc_reply(thread->ith_rpc_reply);
thread->ith_rpc_reply = IP_NULL;
}
/*
* Routine: semaphore_destroy
*
* Destroys a semaphore. This call will only succeed if the
* specified task is the SAME task name specified at the semaphore's
* creation.
*
* All threads currently blocked on the semaphore are awoken. These
* threads will return with the KERN_TERMINATED error.
*/
kern_return_t
semaphore_destroy(
task_t task,
semaphore_t semaphore)
{
int old_count;
spl_t spl_level;
if (task == TASK_NULL || semaphore == SEMAPHORE_NULL)
return KERN_INVALID_ARGUMENT;
/*
* Disown semaphore
*/
task_lock(task);
if (semaphore->owner != task) {
task_unlock(task);
return KERN_INVALID_ARGUMENT;
}
remqueue(&task->semaphore_list, (queue_entry_t) semaphore);
semaphore->owner = TASK_NULL;
task->semaphores_owned--;
task_unlock(task);
spl_level = splsched();
semaphore_lock(semaphore);
/*
* Deactivate semaphore
*/
assert(semaphore->active);
semaphore->active = FALSE;
/*
* Wakeup blocked threads
*/
old_count = semaphore->count;
semaphore->count = 0;
if (old_count < 0) {
wait_queue_wakeup64_all_locked(&semaphore->wait_queue,
SEMAPHORE_EVENT,
THREAD_RESTART,
TRUE); /* unlock? */
} else {
semaphore_unlock(semaphore);
}
splx(spl_level);
/*
* Deallocate
*
* Drop the semaphore reference, which in turn deallocates the
* semaphore structure if the reference count goes to zero.
*/
ipc_port_dealloc_kernel(semaphore->port);
semaphore_dereference(semaphore);
return KERN_SUCCESS;
}
/*
* fileport_notify
*
* Description: Handle a no-senders notification for a fileport. Unless
* the message is spoofed, destroys the port and releases
* its reference on the fileglob.
*
* Parameters: msg A Mach no-senders notification message.
*/
void
fileport_notify(mach_msg_header_t *msg)
{
mach_no_senders_notification_t *notification = (void *)msg;
ipc_port_t port = notification->not_header.msgh_remote_port;
struct fileglob *fg = NULL;
if (!IP_VALID(port))
panic("Invalid port passed to fileport_notify()\n");
ip_lock(port);
fg = (struct fileglob *)port->ip_kobject;
if (!ip_active(port))
panic("Inactive port passed to fileport_notify()\n");
if (ip_kotype(port) != IKOT_FILEPORT)
panic("Port of type other than IKOT_FILEPORT passed to fileport_notify()\n");
if (fg == NULL)
panic("fileport without an assocated fileglob\n");
if (port->ip_srights == 0) {
ip_unlock(port);
fileport_releasefg(fg);
ipc_port_dealloc_kernel(port);
} else {
ip_unlock(port);
}
return;
}
/*
* Routine: semaphore_dereference
*
* Release a reference on a semaphore. If this is the last reference,
* the semaphore data structure is deallocated.
*/
void
semaphore_dereference(
semaphore_t semaphore)
{
uint32_t collisions;
spl_t spl_level;
if (semaphore == NULL)
return;
if (hw_atomic_sub(&semaphore->ref_count, 1) != 0)
return;
/*
* Last ref, clean up the port [if any]
* associated with the semaphore, destroy
* it (if still active) and then free
* the semaphore.
*/
ipc_port_t port = semaphore->port;
if (IP_VALID(port)) {
assert(!port->ip_srights);
ipc_port_dealloc_kernel(port);
}
/*
* Lock the semaphore to lock in the owner task reference.
* Then continue to try to lock the task (inverse order).
*/
spl_level = splsched();
semaphore_lock(semaphore);
for (collisions = 0; semaphore->active; collisions++) {
task_t task = semaphore->owner;
assert(task != TASK_NULL);
if (task_lock_try(task)) {
semaphore_destroy_internal(task, semaphore);
/* semaphore unlocked */
splx(spl_level);
task_unlock(task);
goto out;
}
/* failed to get out-of-order locks */
semaphore_unlock(semaphore);
splx(spl_level);
mutex_pause(collisions);
spl_level = splsched();
semaphore_lock(semaphore);
}
semaphore_unlock(semaphore);
splx(spl_level);
out:
zfree(semaphore_zone, semaphore);
}
/* Utility routine to destroy a ledger */
static void
ledger_deallocate(
ledger_t ledger)
{
/* XXX can be many send rights (copies) of this */
ipc_port_dealloc_kernel(ledger->ledger_self);
/* XXX release send right on service port */
kfree((vm_offset_t)ledger, sizeof(*ledger));
}
/*
* Routine: convert_mig_object_to_port [interface]
* Purpose:
* Base implementation of MIG outtrans routine to convert from
* a mig object reference to a new send right on the object's
* port. The object reference is consumed.
* Returns:
* IP_NULL - Null MIG object supplied
* Otherwise, a newly made send right for the port
* Conditions:
* Nothing locked.
*/
ipc_port_t
convert_mig_object_to_port(
mig_object_t mig_object)
{
ipc_port_t port;
boolean_t deallocate = TRUE;
if (mig_object == MIG_OBJECT_NULL)
return IP_NULL;
port = mig_object->port;
while ((port == IP_NULL) ||
((port = ipc_port_make_send(port)) == IP_NULL)) {
ipc_port_t previous;
/*
* Either the port was never set up, or it was just
* deallocated out from under us by the no-senders
* processing. In either case, we must:
* Attempt to make one
* Arrange for no senders
* Try to atomically register it with the object
* Destroy it if we are raced.
*/
port = ipc_port_alloc_kernel();
ip_lock(port);
ipc_kobject_set_atomically(port,
(ipc_kobject_t) mig_object,
IKOT_MIG);
/* make a sonce right for the notification */
port->ip_sorights++;
ip_reference(port);
ipc_port_nsrequest(port, 1, port, &previous);
/* port unlocked */
assert(previous == IP_NULL);
if (OSCompareAndSwapPtr((void *)IP_NULL, (void *)port,
(void * volatile *)&mig_object->port)) {
deallocate = FALSE;
} else {
ipc_port_dealloc_kernel(port);
port = mig_object->port;
}
}
if (deallocate)
mig_object->pVtbl->Release((IMIGObject *)mig_object);
return (port);
}
/*
* Routine: lock_set_dereference
*
* Release a reference on a lock set. If this is the last reference,
* the lock set data structure is deallocated.
*/
void
lock_set_dereference(lock_set_t lock_set)
{
int size;
if (1 == OSDecrementAtomic(&((lock_set)->ref_count))) {
ipc_port_dealloc_kernel(lock_set->port);
size = (int)(sizeof(struct lock_set) +
(sizeof(struct ulock) * (lock_set->n_ulocks - 1)));
kfree(lock_set, size);
}
}
EXTERN kern_return_t
iokit_destroy_object_port( ipc_port_t port )
{
iokit_lock_port(port);
ipc_kobject_set( port, IKO_NULL, IKOT_NONE);
// iokit_remove_reference( obj );
iokit_unlock_port(port);
ipc_port_dealloc_kernel( port);
gIOKitPortCount--;
return( KERN_SUCCESS);
}
/*
* Called when we lose a race to associate a newly created xmm object
* with a memory object. Also called by xmm_object_nuke.
*/
void
xmm_object_destroy(
ipc_port_t xmm_object,
xmm_obj_t mobj)
{
/*
* Destroy xmm object port.
*/
ipc_port_release_send(xmm_object);
ipc_port_dealloc_kernel(xmm_object);
/*
* Lose reference to mobj, and explicitly destroy it.
*/
xmm_obj_lock(mobj);
xmm_obj_release_quick(mobj);
xmm_svm_destroy(mobj); /* consumes lock */
}
/*
* Routine: convert_semaphore_to_port
* Purpose:
* Convert a semaphore reference to a send right to a
* semaphore port.
*
* Consumes the semaphore reference. If the semaphore
* port currently has no send rights (or doesn't exist
* yet), the reference is donated to the port to represent
* all extant send rights collectively.
*/
ipc_port_t
convert_semaphore_to_port (semaphore_t semaphore)
{
ipc_port_t port, send;
if (semaphore == SEMAPHORE_NULL)
return (IP_NULL);
/* caller is donating a reference */
port = semaphore->port;
if (!IP_VALID(port)) {
port = ipc_port_alloc_kernel();
assert(IP_VALID(port));
ipc_kobject_set_atomically(port, (ipc_kobject_t) semaphore, IKOT_SEMAPHORE);
/* If we lose the race, deallocate and pick up the other guy's port */
if (!OSCompareAndSwapPtr(IP_NULL, port, &semaphore->port)) {
ipc_port_dealloc_kernel(port);
port = semaphore->port;
assert(ip_kotype(port) == IKOT_SEMAPHORE);
assert(port->ip_kobject == (ipc_kobject_t)semaphore);
}
}
ip_lock(port);
assert(ip_active(port));
send = ipc_port_make_send_locked(port);
if (1 == port->ip_srights) {
ipc_port_t old_notify;
/* transfer our ref to the port, and arm the no-senders notification */
assert(IP_NULL == port->ip_nsrequest);
ipc_port_nsrequest(port, port->ip_mscount, ipc_port_make_sonce_locked(port), &old_notify);
/* port unlocked */
assert(IP_NULL == old_notify);
} else {
/* piggyback on the existing port reference, so consume ours */
ip_unlock(port);
semaphore_dereference(semaphore);
}
return (send);
}
void
ipc_task_terminate(
task_t task)
{
ipc_port_t kport;
int i;
itk_lock(task);
kport = task->itk_self;
if (kport == IP_NULL) {
/* the task is already terminated (can this happen?) */
itk_unlock(task);
return;
}
task->itk_self = IP_NULL;
itk_unlock(task);
/* release the naked send rights */
if (IP_VALID(task->itk_sself))
ipc_port_release_send(task->itk_sself);
if (IP_VALID(task->itk_exception))
ipc_port_release_send(task->itk_exception);
if (IP_VALID(task->itk_bootstrap))
ipc_port_release_send(task->itk_bootstrap);
for (i = 0; i < TASK_PORT_REGISTER_MAX; i++)
if (IP_VALID(task->itk_registered[i]))
ipc_port_release_send(task->itk_registered[i]);
/* destroy the space, leaving just a reference for it */
ipc_space_destroy(task->itk_space);
/* destroy the kernel port */
ipc_port_dealloc_kernel(kport);
}
/*
* ipc_processor_terminate:
*
* Processor is off-line. Destroy ipc control port.
*/
void
ipc_processor_terminate(
processor_t processor)
{
ipc_port_t myport;
spl_t s;
s = splsched();
processor_lock(processor);
myport = processor->processor_self;
if (myport == IP_NULL) {
processor_unlock(processor);
splx(s);
return;
}
processor->processor_self = IP_NULL;
processor_unlock(processor);
splx(s);
ipc_port_dealloc_kernel(myport);
}
void
ipc_thread_terminate(
thread_t thread)
{
ipc_port_t kport = thread->ith_self;
if (kport != IP_NULL) {
int i;
if (IP_VALID(thread->ith_sself))
ipc_port_release_send(thread->ith_sself);
thread->ith_sself = thread->ith_self = IP_NULL;
if (thread->exc_actions != NULL) {
for (i = FIRST_EXCEPTION; i < EXC_TYPES_COUNT; ++i) {
if (IP_VALID(thread->exc_actions[i].port))
ipc_port_release_send(thread->exc_actions[i].port);
}
ipc_thread_destroy_exc_actions(thread);
}
ipc_port_dealloc_kernel(kport);
}
#if IMPORTANCE_INHERITANCE
assert(thread->ith_assertions == 0);
#endif
assert(ipc_kmsg_queue_empty(&thread->ith_messages));
if (thread->ith_rpc_reply != IP_NULL)
ipc_port_dealloc_reply(thread->ith_rpc_reply);
thread->ith_rpc_reply = IP_NULL;
}
static io_return_t
device_open (ipc_port_t reply_port, mach_msg_type_name_t reply_port_type,
dev_mode_t mode, char *name, device_t *devp)
{
io_return_t err = D_SUCCESS;
ipc_port_t notify;
struct ifnet *ifp;
struct linux_device *dev;
struct net_data *nd;
/* Search for the device. */
for (dev = dev_base; dev; dev = dev->next)
if (dev->base_addr
&& dev->base_addr != 0xffe0
&& !strcmp (name, dev->name))
break;
if (!dev)
return D_NO_SUCH_DEVICE;
/* Allocate and initialize device data if this is the first open. */
nd = dev->net_data;
if (!nd)
{
dev->net_data = nd = ((struct net_data *)
kalloc (sizeof (struct net_data)));
if (!nd)
{
err = D_NO_MEMORY;
goto out;
}
nd->dev = dev;
nd->device.emul_data = nd;
nd->device.emul_ops = &linux_net_emulation_ops;
nd->port = ipc_port_alloc_kernel ();
if (nd->port == IP_NULL)
{
err = KERN_RESOURCE_SHORTAGE;
goto out;
}
ipc_kobject_set (nd->port, (ipc_kobject_t) & nd->device, IKOT_DEVICE);
notify = ipc_port_make_sonce (nd->port);
ip_lock (nd->port);
ipc_port_nsrequest (nd->port, 1, notify, ¬ify);
assert (notify == IP_NULL);
ifp = &nd->ifnet;
ifp->if_unit = dev->name[strlen (dev->name) - 1] - '0';
ifp->if_flags = IFF_UP | IFF_RUNNING;
ifp->if_mtu = dev->mtu;
ifp->if_header_size = dev->hard_header_len;
ifp->if_header_format = dev->type;
ifp->if_address_size = dev->addr_len;
ifp->if_address = dev->dev_addr;
if_init_queues (ifp);
if (dev->open)
{
linux_intr_pri = SPL6;
if ((*dev->open) (dev))
err = D_NO_SUCH_DEVICE;
}
out:
if (err)
{
if (nd)
{
if (nd->port != IP_NULL)
{
ipc_kobject_set (nd->port, IKO_NULL, IKOT_NONE);
ipc_port_dealloc_kernel (nd->port);
}
kfree ((vm_offset_t) nd, sizeof (struct net_data));
nd = NULL;
dev->net_data = NULL;
}
}
else
{
/* IPv6 heavily relies on multicasting (especially router and
neighbor solicits and advertisements), so enable reception of
those multicast packets by setting `LINUX_IFF_ALLMULTI'. */
dev->flags |= LINUX_IFF_UP | LINUX_IFF_RUNNING | LINUX_IFF_ALLMULTI;
skb_queue_head_init (&dev->buffs[0]);
if (dev->set_multicast_list)
dev->set_multicast_list (dev);
}
if (IP_VALID (reply_port))
ds_device_open_reply (reply_port, reply_port_type,
err, dev_to_port (nd));
return MIG_NO_REPLY;
}
*devp = &nd->device;
return D_SUCCESS;
}
/*
* ROUTINE: lock_set_destroy [exported]
*
* Destroys a lock set. This call will only succeed if the
* specified task is the SAME task name specified at the lock set's
* creation.
*
* NOTES:
* - All threads currently blocked on the lock set's ulocks are awoken.
* - These threads will return with the KERN_LOCK_SET_DESTROYED error.
*/
kern_return_t
lock_set_destroy (task_t task, lock_set_t lock_set)
{
ulock_t ulock;
int i;
if (task == TASK_NULL || lock_set == LOCK_SET_NULL)
return KERN_INVALID_ARGUMENT;
if (lock_set->owner != task)
return KERN_INVALID_RIGHT;
lock_set_lock(lock_set);
if (!lock_set->active) {
lock_set_unlock(lock_set);
return KERN_LOCK_SET_DESTROYED;
}
/*
* Deactivate lock set
*/
lock_set->active = FALSE;
/*
* If a ulock is currently held in the target lock set:
*
* 1) Wakeup all threads blocked on the ulock (if any). Threads
* may be blocked waiting normally, or waiting for a handoff.
* Blocked threads will return with KERN_LOCK_SET_DESTROYED.
*
* 2) ulock ownership is cleared.
* The thread currently holding the ulock is revoked of its
* ownership.
*/
for (i = 0; i < lock_set->n_ulocks; i++) {
ulock = &lock_set->ulock_list[i];
ulock_lock(ulock);
if (ulock->accept_wait) {
ulock->accept_wait = FALSE;
wait_queue_wakeup64_one(&ulock->wait_queue,
LOCK_SET_HANDOFF,
THREAD_RESTART);
}
if (ulock->holder) {
if (ulock->blocked) {
ulock->blocked = FALSE;
wait_queue_wakeup64_all(&ulock->wait_queue,
LOCK_SET_EVENT,
THREAD_RESTART);
}
if (ulock->ho_wait) {
ulock->ho_wait = FALSE;
wait_queue_wakeup64_one(&ulock->wait_queue,
LOCK_SET_HANDOFF,
THREAD_RESTART);
}
ulock_ownership_clear(ulock);
}
ulock_unlock(ulock);
}
lock_set_unlock(lock_set);
lock_set_ownership_clear(lock_set, task);
/*
* Deallocate
*
* Drop the lock set reference, which inturn destroys the
* lock set structure if the reference count goes to zero.
*/
ipc_port_dealloc_kernel(lock_set->port);
lock_set_dereference(lock_set);
return KERN_SUCCESS;
}
void
ipc_thread_reset(
thread_t thread)
{
ipc_port_t old_kport, new_kport;
ipc_port_t old_sself;
ipc_port_t old_exc_actions[EXC_TYPES_COUNT];
boolean_t has_old_exc_actions = FALSE;
int i;
new_kport = ipc_port_alloc_kernel();
if (new_kport == IP_NULL)
panic("ipc_task_reset");
thread_mtx_lock(thread);
old_kport = thread->ith_self;
if (old_kport == IP_NULL) {
/* the is already terminated (can this happen?) */
thread_mtx_unlock(thread);
ipc_port_dealloc_kernel(new_kport);
return;
}
thread->ith_self = new_kport;
old_sself = thread->ith_sself;
thread->ith_sself = ipc_port_make_send(new_kport);
ipc_kobject_set(old_kport, IKO_NULL, IKOT_NONE);
ipc_kobject_set(new_kport, (ipc_kobject_t) thread, IKOT_THREAD);
/*
* Only ports that were set by root-owned processes
* (privileged ports) should survive
*/
if (thread->exc_actions != NULL) {
has_old_exc_actions = TRUE;
for (i = FIRST_EXCEPTION; i < EXC_TYPES_COUNT; i++) {
if (thread->exc_actions[i].privileged) {
old_exc_actions[i] = IP_NULL;
} else {
old_exc_actions[i] = thread->exc_actions[i].port;
thread->exc_actions[i].port = IP_NULL;
}
}
}
thread_mtx_unlock(thread);
/* release the naked send rights */
if (IP_VALID(old_sself))
ipc_port_release_send(old_sself);
if (has_old_exc_actions) {
for (i = FIRST_EXCEPTION; i < EXC_TYPES_COUNT; i++) {
ipc_port_release_send(old_exc_actions[i]);
}
}
/* destroy the kernel port */
ipc_port_dealloc_kernel(old_kport);
}
void
ipc_task_terminate(
task_t task)
{
ipc_port_t kport;
ipc_port_t nport;
ipc_port_t rport;
int i;
itk_lock(task);
kport = task->itk_self;
if (kport == IP_NULL) {
/* the task is already terminated (can this happen?) */
itk_unlock(task);
return;
}
task->itk_self = IP_NULL;
nport = task->itk_nself;
assert(nport != IP_NULL);
task->itk_nself = IP_NULL;
rport = task->itk_resume;
task->itk_resume = IP_NULL;
itk_unlock(task);
/* release the naked send rights */
if (IP_VALID(task->itk_sself))
ipc_port_release_send(task->itk_sself);
for (i = FIRST_EXCEPTION; i < EXC_TYPES_COUNT; i++) {
if (IP_VALID(task->exc_actions[i].port)) {
ipc_port_release_send(task->exc_actions[i].port);
}
}
if (IP_VALID(task->itk_host))
ipc_port_release_send(task->itk_host);
if (IP_VALID(task->itk_bootstrap))
ipc_port_release_send(task->itk_bootstrap);
if (IP_VALID(task->itk_seatbelt))
ipc_port_release_send(task->itk_seatbelt);
if (IP_VALID(task->itk_gssd))
ipc_port_release_send(task->itk_gssd);
if (IP_VALID(task->itk_task_access))
ipc_port_release_send(task->itk_task_access);
if (IP_VALID(task->itk_debug_control))
ipc_port_release_send(task->itk_debug_control);
for (i = 0; i < TASK_PORT_REGISTER_MAX; i++)
if (IP_VALID(task->itk_registered[i]))
ipc_port_release_send(task->itk_registered[i]);
/* destroy the kernel ports */
ipc_port_dealloc_kernel(kport);
ipc_port_dealloc_kernel(nport);
if (rport != IP_NULL)
ipc_port_dealloc_kernel(rport);
itk_lock_destroy(task);
}
