#include <mach/mach_types.h>
#include <mach/boolean.h>
#include <mach/kern_return.h>
#include <mach/port.h>
#include <mach/message.h>
#include <kern/kern_types.h>
#include <kern/misc_protos.h>
#include <kern/ipc_kobject.h>
#include <ipc/ipc_types.h>
#include <ipc/ipc_importance.h>
#include <ipc/port.h>
#include <ipc/ipc_space.h>
#include <ipc/ipc_entry.h>
#include <ipc/ipc_object.h>
#include <ipc/ipc_hash.h>
#include <ipc/ipc_right.h>
#include <ipc/ipc_notify.h>
#include <ipc/ipc_port.h>
#include <ipc/ipc_pset.h>
#include <security/mac_mach_internal.h>
zone_t ipc_object_zones[IOT_NUMBER];
void
ipc_object_reference(
ipc_object_t object)
{
io_reference(object);
}
void
ipc_object_release(
ipc_object_t object)
{
io_release(object);
}
kern_return_t
ipc_object_translate(
ipc_space_t space,
mach_port_name_t name,
mach_port_right_t right,
ipc_object_t *objectp)
{
ipc_entry_t entry;
ipc_object_t object;
kern_return_t kr;
kr = ipc_right_lookup_read(space, name, &entry);
if (kr != KERN_SUCCESS)
return kr;
if ((entry->ie_bits & MACH_PORT_TYPE(right)) == MACH_PORT_TYPE_NONE) {
is_read_unlock(space);
return KERN_INVALID_RIGHT;
}
object = entry->ie_object;
assert(object != IO_NULL);
io_lock(object);
is_read_unlock(space);
*objectp = object;
return KERN_SUCCESS;
}
kern_return_t
ipc_object_translate_two(
ipc_space_t space,
mach_port_name_t name1,
mach_port_right_t right1,
ipc_object_t *objectp1,
mach_port_name_t name2,
mach_port_right_t right2,
ipc_object_t *objectp2)
{
ipc_entry_t entry1;
ipc_entry_t entry2;
ipc_object_t object;
kern_return_t kr;
kr = ipc_right_lookup_two_read(space, name1, &entry1, name2, &entry2);
if (kr != KERN_SUCCESS)
return kr;
if ((entry1->ie_bits & MACH_PORT_TYPE(right1)) == MACH_PORT_TYPE_NONE) {
is_read_unlock(space);
return KERN_INVALID_RIGHT;
}
if ((entry2->ie_bits & MACH_PORT_TYPE(right2)) == MACH_PORT_TYPE_NONE) {
is_read_unlock(space);
return KERN_INVALID_RIGHT;
}
object = entry1->ie_object;
assert(object != IO_NULL);
io_lock(object);
*objectp1 = object;
object = entry2->ie_object;
assert(object != IO_NULL);
io_lock(object);
*objectp2 = object;
is_read_unlock(space);
return KERN_SUCCESS;
}
kern_return_t
ipc_object_alloc_dead(
ipc_space_t space,
mach_port_name_t *namep)
{
ipc_entry_t entry;
kern_return_t kr;
kr = ipc_entry_alloc(space, namep, &entry);
if (kr != KERN_SUCCESS)
return kr;
assert(entry->ie_object == IO_NULL);
entry->ie_bits |= MACH_PORT_TYPE_DEAD_NAME | 1;
ipc_entry_modified(space, *namep, entry);
is_write_unlock(space);
return KERN_SUCCESS;
}
kern_return_t
ipc_object_alloc_dead_name(
ipc_space_t space,
mach_port_name_t name)
{
ipc_entry_t entry;
kern_return_t kr;
kr = ipc_entry_alloc_name(space, name, &entry);
if (kr != KERN_SUCCESS)
return kr;
if (ipc_right_inuse(space, name, entry))
return KERN_NAME_EXISTS;
assert(entry->ie_object == IO_NULL);
entry->ie_bits |= MACH_PORT_TYPE_DEAD_NAME | 1;
ipc_entry_modified(space, name, entry);
is_write_unlock(space);
return KERN_SUCCESS;
}
kern_return_t
ipc_object_alloc(
ipc_space_t space,
ipc_object_type_t otype,
mach_port_type_t type,
mach_port_urefs_t urefs,
mach_port_name_t *namep,
ipc_object_t *objectp)
{
ipc_object_t object;
ipc_entry_t entry;
kern_return_t kr;
assert(otype < IOT_NUMBER);
assert((type & MACH_PORT_TYPE_ALL_RIGHTS) == type);
assert(type != MACH_PORT_TYPE_NONE);
assert(urefs <= MACH_PORT_UREFS_MAX);
object = io_alloc(otype);
if (object == IO_NULL)
return KERN_RESOURCE_SHORTAGE;
if (otype == IOT_PORT) {
ipc_port_t port = (ipc_port_t)object;
bzero((char *)port, sizeof(*port));
} else if (otype == IOT_PORT_SET) {
ipc_pset_t pset = (ipc_pset_t)object;
bzero((char *)pset, sizeof(*pset));
}
io_lock_init(object);
*namep = CAST_MACH_PORT_TO_NAME(object);
kr = ipc_entry_alloc(space, namep, &entry);
if (kr != KERN_SUCCESS) {
io_free(otype, object);
return kr;
}
entry->ie_bits |= type | urefs;
entry->ie_object = object;
ipc_entry_modified(space, *namep, entry);
io_lock(object);
object->io_references = 1;
object->io_bits = io_makebits(TRUE, otype, 0);
*objectp = object;
return KERN_SUCCESS;
}
kern_return_t
ipc_object_alloc_name(
ipc_space_t space,
ipc_object_type_t otype,
mach_port_type_t type,
mach_port_urefs_t urefs,
mach_port_name_t name,
ipc_object_t *objectp)
{
ipc_object_t object;
ipc_entry_t entry;
kern_return_t kr;
assert(otype < IOT_NUMBER);
assert((type & MACH_PORT_TYPE_ALL_RIGHTS) == type);
assert(type != MACH_PORT_TYPE_NONE);
assert(urefs <= MACH_PORT_UREFS_MAX);
object = io_alloc(otype);
if (object == IO_NULL)
return KERN_RESOURCE_SHORTAGE;
if (otype == IOT_PORT) {
ipc_port_t port = (ipc_port_t)object;
bzero((char *)port, sizeof(*port));
} else if (otype == IOT_PORT_SET) {
ipc_pset_t pset = (ipc_pset_t)object;
bzero((char *)pset, sizeof(*pset));
}
io_lock_init(object);
kr = ipc_entry_alloc_name(space, name, &entry);
if (kr != KERN_SUCCESS) {
io_free(otype, object);
return kr;
}
if (ipc_right_inuse(space, name, entry)) {
io_free(otype, object);
return KERN_NAME_EXISTS;
}
entry->ie_bits |= type | urefs;
entry->ie_object = object;
ipc_entry_modified(space, name, entry);
io_lock(object);
is_write_unlock(space);
object->io_references = 1;
object->io_bits = io_makebits(TRUE, otype, 0);
*objectp = object;
return KERN_SUCCESS;
}
mach_msg_type_name_t
ipc_object_copyin_type(
mach_msg_type_name_t msgt_name)
{
switch (msgt_name) {
case MACH_MSG_TYPE_MOVE_RECEIVE:
return MACH_MSG_TYPE_PORT_RECEIVE;
case MACH_MSG_TYPE_MOVE_SEND_ONCE:
case MACH_MSG_TYPE_MAKE_SEND_ONCE:
return MACH_MSG_TYPE_PORT_SEND_ONCE;
case MACH_MSG_TYPE_MOVE_SEND:
case MACH_MSG_TYPE_MAKE_SEND:
case MACH_MSG_TYPE_COPY_SEND:
return MACH_MSG_TYPE_PORT_SEND;
case MACH_MSG_TYPE_DISPOSE_RECEIVE:
case MACH_MSG_TYPE_DISPOSE_SEND:
case MACH_MSG_TYPE_DISPOSE_SEND_ONCE:
default:
return MACH_MSG_TYPE_PORT_NONE;
}
}
kern_return_t
ipc_object_copyin(
ipc_space_t space,
mach_port_name_t name,
mach_msg_type_name_t msgt_name,
ipc_object_t *objectp)
{
ipc_entry_t entry;
ipc_port_t soright;
ipc_port_t release_port;
kern_return_t kr;
int assertcnt = 0;
kr = ipc_right_lookup_write(space, name, &entry);
if (kr != KERN_SUCCESS)
return kr;
release_port = IP_NULL;
kr = ipc_right_copyin(space, name, entry,
msgt_name, TRUE,
objectp, &soright,
&release_port,
&assertcnt);
if (IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_NONE)
ipc_entry_dealloc(space, name, entry);
is_write_unlock(space);
#if IMPORTANCE_INHERITANCE
if (0 < assertcnt && ipc_importance_task_is_any_receiver_type(current_task()->task_imp_base)) {
ipc_importance_task_drop_internal_assertion(current_task()->task_imp_base, assertcnt);
}
#endif
if (release_port != IP_NULL)
ip_release(release_port);
if ((kr == KERN_SUCCESS) && (soright != IP_NULL))
ipc_notify_port_deleted(soright, name);
return kr;
}
void
ipc_object_copyin_from_kernel(
ipc_object_t object,
mach_msg_type_name_t msgt_name)
{
assert(IO_VALID(object));
switch (msgt_name) {
case MACH_MSG_TYPE_MOVE_RECEIVE: {
ipc_port_t port = (ipc_port_t) object;
ip_lock(port);
assert(ip_active(port));
if (port->ip_destination != IP_NULL) {
assert(port->ip_receiver == ipc_space_kernel);
ipc_port_set_mscount(port, 0);
port->ip_receiver_name = MACH_PORT_NULL;
port->ip_destination = IP_NULL;
}
ip_unlock(port);
break;
}
case MACH_MSG_TYPE_COPY_SEND: {
ipc_port_t port = (ipc_port_t) object;
ip_lock(port);
if (ip_active(port)) {
assert(port->ip_srights > 0);
port->ip_srights++;
}
ip_reference(port);
ip_unlock(port);
break;
}
case MACH_MSG_TYPE_MAKE_SEND: {
ipc_port_t port = (ipc_port_t) object;
ip_lock(port);
if (ip_active(port)) {
assert(port->ip_receiver_name != MACH_PORT_NULL);
assert((port->ip_receiver == ipc_space_kernel) ||
(port->ip_receiver->is_node_id != HOST_LOCAL_NODE));
port->ip_mscount++;
}
port->ip_srights++;
ip_reference(port);
ip_unlock(port);
break;
}
case MACH_MSG_TYPE_MOVE_SEND: {
assert(((ipc_port_t)object)->ip_srights);
break;
}
case MACH_MSG_TYPE_MAKE_SEND_ONCE: {
ipc_port_t port = (ipc_port_t) object;
ip_lock(port);
if (ip_active(port)) {
assert(port->ip_receiver_name != MACH_PORT_NULL);
}
port->ip_sorights++;
ip_reference(port);
ip_unlock(port);
break;
}
case MACH_MSG_TYPE_MOVE_SEND_ONCE: {
assert(((ipc_port_t)object)->ip_sorights);
break;
}
default:
panic("ipc_object_copyin_from_kernel: strange rights");
}
}
void
ipc_object_destroy(
ipc_object_t object,
mach_msg_type_name_t msgt_name)
{
assert(IO_VALID(object));
assert(io_otype(object) == IOT_PORT);
switch (msgt_name) {
case MACH_MSG_TYPE_PORT_SEND:
ipc_port_release_send((ipc_port_t) object);
break;
case MACH_MSG_TYPE_PORT_SEND_ONCE:
ipc_notify_send_once((ipc_port_t) object);
break;
case MACH_MSG_TYPE_PORT_RECEIVE:
ipc_port_release_receive((ipc_port_t) object);
break;
default:
panic("ipc_object_destroy: strange rights");
}
}
void
ipc_object_destroy_dest(
ipc_object_t object,
mach_msg_type_name_t msgt_name)
{
assert(IO_VALID(object));
assert(io_otype(object) == IOT_PORT);
switch (msgt_name) {
case MACH_MSG_TYPE_PORT_SEND:
ipc_port_release_send((ipc_port_t) object);
break;
case MACH_MSG_TYPE_PORT_SEND_ONCE:
if (io_active(object) &&
!ip_full_kernel((ipc_port_t) object))
ipc_notify_send_once((ipc_port_t) object);
else
ipc_port_release_sonce((ipc_port_t) object);
break;
default:
panic("ipc_object_destroy_dest: strange rights");
}
}
kern_return_t
ipc_object_copyout(
ipc_space_t space,
ipc_object_t object,
mach_msg_type_name_t msgt_name,
boolean_t overflow,
mach_port_name_t *namep)
{
mach_port_name_t name;
ipc_entry_t entry;
kern_return_t kr;
assert(IO_VALID(object));
assert(io_otype(object) == IOT_PORT);
is_write_lock(space);
for (;;) {
if (!is_active(space)) {
is_write_unlock(space);
return KERN_INVALID_TASK;
}
if ((msgt_name != MACH_MSG_TYPE_PORT_SEND_ONCE) &&
ipc_right_reverse(space, object, &name, &entry)) {
assert(entry->ie_bits & MACH_PORT_TYPE_SEND_RECEIVE);
break;
}
name = CAST_MACH_PORT_TO_NAME(object);
kr = ipc_entry_get(space, &name, &entry);
if (kr != KERN_SUCCESS) {
kr = ipc_entry_grow_table(space, ITS_SIZE_NONE);
if (kr != KERN_SUCCESS)
return kr;
continue;
}
assert(IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_NONE);
assert(entry->ie_object == IO_NULL);
io_lock(object);
if (!io_active(object)) {
io_unlock(object);
ipc_entry_dealloc(space, name, entry);
is_write_unlock(space);
return KERN_INVALID_CAPABILITY;
}
entry->ie_object = object;
break;
}
kr = ipc_right_copyout(space, name, entry,
msgt_name, overflow, object);
is_write_unlock(space);
if (kr == KERN_SUCCESS)
*namep = name;
return kr;
}
kern_return_t
ipc_object_copyout_name(
ipc_space_t space,
ipc_object_t object,
mach_msg_type_name_t msgt_name,
boolean_t overflow,
mach_port_name_t name)
{
mach_port_name_t oname;
ipc_entry_t oentry;
ipc_entry_t entry;
kern_return_t kr;
#if IMPORTANCE_INHERITANCE
int assertcnt = 0;
ipc_importance_task_t task_imp = IIT_NULL;
#endif
assert(IO_VALID(object));
assert(io_otype(object) == IOT_PORT);
kr = ipc_entry_alloc_name(space, name, &entry);
if (kr != KERN_SUCCESS)
return kr;
if ((msgt_name != MACH_MSG_TYPE_PORT_SEND_ONCE) &&
ipc_right_reverse(space, object, &oname, &oentry)) {
if (name != oname) {
io_unlock(object);
if (IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_NONE)
ipc_entry_dealloc(space, name, entry);
is_write_unlock(space);
return KERN_RIGHT_EXISTS;
}
assert(entry == oentry);
assert(entry->ie_bits & MACH_PORT_TYPE_SEND_RECEIVE);
} else {
if (ipc_right_inuse(space, name, entry))
return KERN_NAME_EXISTS;
assert(IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_NONE);
assert(entry->ie_object == IO_NULL);
io_lock(object);
if (!io_active(object)) {
io_unlock(object);
ipc_entry_dealloc(space, name, entry);
is_write_unlock(space);
return KERN_INVALID_CAPABILITY;
}
entry->ie_object = object;
}
#if IMPORTANCE_INHERITANCE
if (msgt_name == MACH_MSG_TYPE_PORT_RECEIVE) {
ipc_port_t port = (ipc_port_t)object;
if (space->is_task != TASK_NULL) {
task_imp = space->is_task->task_imp_base;
if (ipc_importance_task_is_any_receiver_type(task_imp)) {
assertcnt = port->ip_impcount;
ipc_importance_task_reference(task_imp);
} else {
task_imp = IIT_NULL;
}
}
assert(port->ip_tempowner != 0);
port->ip_tempowner = 0;
}
#endif
kr = ipc_right_copyout(space, name, entry,
msgt_name, overflow, object);
is_write_unlock(space);
#if IMPORTANCE_INHERITANCE
if (task_imp != IIT_NULL) {
ipc_importance_task_hold_internal_assertion(task_imp, assertcnt);
ipc_importance_task_release(task_imp);
}
#endif
return kr;
}
void
ipc_object_copyout_dest(
ipc_space_t space,
ipc_object_t object,
mach_msg_type_name_t msgt_name,
mach_port_name_t *namep)
{
mach_port_name_t name;
assert(IO_VALID(object));
assert(io_active(object));
io_release(object);
switch (msgt_name) {
case MACH_MSG_TYPE_PORT_SEND: {
ipc_port_t port = (ipc_port_t) object;
ipc_port_t nsrequest = IP_NULL;
mach_port_mscount_t mscount;
if (port->ip_receiver == space)
name = port->ip_receiver_name;
else
name = MACH_PORT_NULL;
assert(port->ip_srights > 0);
if (--port->ip_srights == 0 &&
port->ip_nsrequest != IP_NULL) {
nsrequest = port->ip_nsrequest;
port->ip_nsrequest = IP_NULL;
mscount = port->ip_mscount;
ip_unlock(port);
ipc_notify_no_senders(nsrequest, mscount);
} else
ip_unlock(port);
break;
}
case MACH_MSG_TYPE_PORT_SEND_ONCE: {
ipc_port_t port = (ipc_port_t) object;
assert(port->ip_sorights > 0);
if (port->ip_receiver == space) {
port->ip_sorights--;
name = port->ip_receiver_name;
ip_unlock(port);
} else {
ip_reference(port);
ip_unlock(port);
ipc_notify_send_once(port);
name = MACH_PORT_NULL;
}
break;
}
default:
panic("ipc_object_copyout_dest: strange rights");
name = MACH_PORT_DEAD;
}
*namep = name;
}
kern_return_t
ipc_object_rename(
ipc_space_t space,
mach_port_name_t oname,
mach_port_name_t nname)
{
ipc_entry_t oentry, nentry;
kern_return_t kr;
kr = ipc_entry_alloc_name(space, nname, &nentry);
if (kr != KERN_SUCCESS)
return kr;
if (ipc_right_inuse(space, nname, nentry)) {
return KERN_NAME_EXISTS;
}
if ((oname == nname) ||
((oentry = ipc_entry_lookup(space, oname)) == IE_NULL)) {
ipc_entry_dealloc(space, nname, nentry);
is_write_unlock(space);
return KERN_INVALID_NAME;
}
kr = ipc_right_rename(space, oname, oentry, nname, nentry);
return kr;
}
void
io_free(
unsigned int otype,
ipc_object_t object)
{
ipc_port_t port;
if (otype == IOT_PORT) {
port = (ipc_port_t) object;
ipc_port_finalize(port);
}
io_lock_destroy(object);
zfree(ipc_object_zones[otype], object);
}