![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to ipc_kmsg.c CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [GnuMach] / OSKit-Mach / ipc|
Return to ipc_kmsg.c CVS log | Up to [GnuMach] / OSKit-Mach / ipc |
1.1 root 1: /*
2: * Mach Operating System
3: * Copyright (c) 1991,1990,1989 Carnegie Mellon University.
4: * Copyright (c) 1993,1994 The University of Utah and
5: * the Computer Systems Laboratory (CSL).
6: * All rights reserved.
7: *
8: * Permission to use, copy, modify and distribute this software and its
9: * documentation is hereby granted, provided that both the copyright
10: * notice and this permission notice appear in all copies of the
11: * software, derivative works or modified versions, and any portions
12: * thereof, and that both notices appear in supporting documentation.
13: *
14: * CARNEGIE MELLON, THE UNIVERSITY OF UTAH AND CSL ALLOW FREE USE OF
15: * THIS SOFTWARE IN ITS "AS IS" CONDITION, AND DISCLAIM ANY LIABILITY
16: * OF ANY KIND FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF
17: * THIS SOFTWARE.
18: *
19: * Carnegie Mellon requests users of this software to return to
20: *
21: * Software Distribution Coordinator or [email protected]
22: * School of Computer Science
23: * Carnegie Mellon University
24: * Pittsburgh PA 15213-3890
25: *
26: * any improvements or extensions that they make and grant Carnegie Mellon
27: * the rights to redistribute these changes.
28: */
29: /*
30: * File: ipc/ipc_kmsg.c
31: * Author: Rich Draves
32: * Date: 1989
33: *
34: * Operations on kernel messages.
35: */
36:
37: #include <cpus.h>
38: #include <mach_ipc_compat.h>
39: #include <norma_ipc.h>
40: #include <norma_vm.h>
41:
42: #include <mach/boolean.h>
43: #include <mach/kern_return.h>
44: #include <mach/message.h>
45: #include <mach/port.h>
46: #include <kern/assert.h>
47: #include <kern/kalloc.h>
48: #include <vm/vm_map.h>
49: #include <vm/vm_object.h>
50: #include <vm/vm_kern.h>
51: #include <ipc/port.h>
52: #include <ipc/ipc_entry.h>
53: #include <ipc/ipc_kmsg.h>
54: #include <ipc/ipc_thread.h>
55: #include <ipc/ipc_marequest.h>
56: #include <ipc/ipc_notify.h>
57: #include <ipc/ipc_object.h>
58: #include <ipc/ipc_space.h>
59: #include <ipc/ipc_port.h>
60: #include <ipc/ipc_right.h>
61:
62: #include <ipc/ipc_machdep.h>
63:
64: extern int copyinmap();
65: extern int copyoutmap();
66: void ipc_msg_print(); /* forward */
67:
68: #define is_misaligned(x) ( ((vm_offset_t)(x)) & (sizeof(vm_offset_t)-1) )
69: #define ptr_align(x) \
70: ( ( ((vm_offset_t)(x)) + (sizeof(vm_offset_t)-1) ) & ~(sizeof(vm_offset_t)-1) )
71:
72: ipc_kmsg_t ipc_kmsg_cache[NCPUS];
73:
74: /*
75: * Routine: ipc_kmsg_enqueue
76: * Purpose:
77: * Enqueue a kmsg.
78: */
79:
80: void
81: ipc_kmsg_enqueue(
82: ipc_kmsg_queue_t queue,
83: ipc_kmsg_t kmsg)
84: {
85: ipc_kmsg_enqueue_macro(queue, kmsg);
86: }
87:
88: /*
89: * Routine: ipc_kmsg_dequeue
90: * Purpose:
91: * Dequeue and return a kmsg.
92: */
93:
94: ipc_kmsg_t
95: ipc_kmsg_dequeue(
96: ipc_kmsg_queue_t queue)
97: {
98: ipc_kmsg_t first;
99:
100: first = ipc_kmsg_queue_first(queue);
101:
102: if (first != IKM_NULL)
103: ipc_kmsg_rmqueue_first_macro(queue, first);
104:
105: return first;
106: }
107:
108: /*
109: * Routine: ipc_kmsg_rmqueue
110: * Purpose:
111: * Pull a kmsg out of a queue.
112: */
113:
114: void
115: ipc_kmsg_rmqueue(
116: ipc_kmsg_queue_t queue,
117: ipc_kmsg_t kmsg)
118: {
119: ipc_kmsg_t next, prev;
120:
121: assert(queue->ikmq_base != IKM_NULL);
122:
123: next = kmsg->ikm_next;
124: prev = kmsg->ikm_prev;
125:
126: if (next == kmsg) {
127: assert(prev == kmsg);
128: assert(queue->ikmq_base == kmsg);
129:
130: queue->ikmq_base = IKM_NULL;
131: } else {
132: if (queue->ikmq_base == kmsg)
133: queue->ikmq_base = next;
134:
135: next->ikm_prev = prev;
136: prev->ikm_next = next;
137: }
138: /* XXX Temporary debug logic */
139: kmsg->ikm_next = IKM_BOGUS;
140: kmsg->ikm_prev = IKM_BOGUS;
141: }
142:
143: /*
144: * Routine: ipc_kmsg_queue_next
145: * Purpose:
146: * Return the kmsg following the given kmsg.
147: * (Or IKM_NULL if it is the last one in the queue.)
148: */
149:
150: ipc_kmsg_t
151: ipc_kmsg_queue_next(
152: ipc_kmsg_queue_t queue,
153: ipc_kmsg_t kmsg)
154: {
155: ipc_kmsg_t next;
156:
157: assert(queue->ikmq_base != IKM_NULL);
158:
159: next = kmsg->ikm_next;
160: if (queue->ikmq_base == next)
161: next = IKM_NULL;
162:
163: return next;
164: }
165:
166: /*
167: * Routine: ipc_kmsg_destroy
168: * Purpose:
169: * Destroys a kernel message. Releases all rights,
170: * references, and memory held by the message.
171: * Frees the message.
172: * Conditions:
173: * No locks held.
174: */
175:
176: void
177: ipc_kmsg_destroy(
178: ipc_kmsg_t kmsg)
179: {
180: ipc_kmsg_queue_t queue;
181: boolean_t empty;
182:
183: /*
184: * ipc_kmsg_clean can cause more messages to be destroyed.
185: * Curtail recursion by queueing messages. If a message
186: * is already queued, then this is a recursive call.
187: */
188:
189: queue = ¤t_thread()->ith_messages;
190: empty = ipc_kmsg_queue_empty(queue);
191: ipc_kmsg_enqueue(queue, kmsg);
192:
193: if (empty) {
194: /* must leave kmsg in queue while cleaning it */
195:
196: while ((kmsg = ipc_kmsg_queue_first(queue)) != IKM_NULL) {
197: ipc_kmsg_clean(kmsg);
198: ipc_kmsg_rmqueue(queue, kmsg);
199: ikm_free(kmsg);
200: }
201: }
202: }
203:
204: /*
205: * Routine: ipc_kmsg_clean_body
206: * Purpose:
207: * Cleans the body of a kernel message.
208: * Releases all rights, references, and memory.
209: *
210: * The last type/data pair might stretch past eaddr.
211: * (See the usage in ipc_kmsg_copyout.)
212: * Conditions:
213: * No locks held.
214: */
215:
216: void
217: ipc_kmsg_clean_body(saddr, eaddr)
218: vm_offset_t saddr;
219: vm_offset_t eaddr;
220: {
221: while (saddr < eaddr) {
222: mach_msg_type_long_t *type;
223: mach_msg_type_name_t name;
224: mach_msg_type_size_t size;
225: mach_msg_type_number_t number;
226: boolean_t is_inline, is_port;
227: vm_size_t length;
228:
229: type = (mach_msg_type_long_t *) saddr;
230: is_inline = ((mach_msg_type_t*)type)->msgt_inline;
231: if (((mach_msg_type_t*)type)->msgt_longform) {
232: /* This must be aligned */
233: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
234: (is_misaligned(type))) {
235: saddr = ptr_align(saddr);
236: continue;
237: }
238: name = type->msgtl_name;
239: size = type->msgtl_size;
240: number = type->msgtl_number;
241: saddr += sizeof(mach_msg_type_long_t);
242: } else {
243: name = ((mach_msg_type_t*)type)->msgt_name;
244: size = ((mach_msg_type_t*)type)->msgt_size;
245: number = ((mach_msg_type_t*)type)->msgt_number;
246: saddr += sizeof(mach_msg_type_t);
247: }
248:
249: /* padding (ptrs and ports) ? */
250: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
251: ((size >> 3) == sizeof(natural_t)))
252: saddr = ptr_align(saddr);
253:
254: /* calculate length of data in bytes, rounding up */
255:
256: length = ((number * size) + 7) >> 3;
257:
258: is_port = MACH_MSG_TYPE_PORT_ANY(name);
259:
260: if (is_port) {
261: ipc_object_t *objects;
262: mach_msg_type_number_t i;
263:
264: if (is_inline) {
265: objects = (ipc_object_t *) saddr;
266: /* sanity check */
267: while (eaddr < (vm_offset_t)&objects[number]) number--;
268: } else {
269: objects = (ipc_object_t *)
270: * (vm_offset_t *) saddr;
271: }
272:
273: /* destroy port rights carried in the message */
274:
275: for (i = 0; i < number; i++) {
276: ipc_object_t object = objects[i];
277:
278: if (!IO_VALID(object))
279: continue;
280:
281: ipc_object_destroy(object, name);
282: }
283: }
284:
285: if (is_inline) {
286: /* inline data sizes round up to int boundaries */
287:
288: saddr += (length + 3) &~ 3;
289: } else {
290: vm_offset_t data = * (vm_offset_t *) saddr;
291:
292: /* destroy memory carried in the message */
293:
294: if (length == 0)
295: assert(data == 0);
296: else if (is_port)
297: kfree(data, length);
298: else
299: vm_map_copy_discard((vm_map_copy_t) data);
300:
301: saddr += sizeof(vm_offset_t);
302: }
303: }
304: }
305:
306: /*
307: * Routine: ipc_kmsg_clean
308: * Purpose:
309: * Cleans a kernel message. Releases all rights,
310: * references, and memory held by the message.
311: * Conditions:
312: * No locks held.
313: */
314:
315: void
316: ipc_kmsg_clean(kmsg)
317: ipc_kmsg_t kmsg;
318: {
319: ipc_marequest_t marequest;
320: ipc_object_t object;
321: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits;
322:
323: marequest = kmsg->ikm_marequest;
324: if (marequest != IMAR_NULL)
325: ipc_marequest_destroy(marequest);
326:
327: object = (ipc_object_t) kmsg->ikm_header.msgh_remote_port;
328: if (IO_VALID(object))
329: ipc_object_destroy(object, MACH_MSGH_BITS_REMOTE(mbits));
330:
331: object = (ipc_object_t) kmsg->ikm_header.msgh_local_port;
332: if (IO_VALID(object))
333: ipc_object_destroy(object, MACH_MSGH_BITS_LOCAL(mbits));
334:
335: if (mbits & MACH_MSGH_BITS_COMPLEX) {
336: vm_offset_t saddr, eaddr;
337:
338: saddr = (vm_offset_t) (&kmsg->ikm_header + 1);
339: eaddr = (vm_offset_t) &kmsg->ikm_header +
340: kmsg->ikm_header.msgh_size;
341:
342: ipc_kmsg_clean_body(saddr, eaddr);
343: }
344: }
345:
346: /*
347: * Routine: ipc_kmsg_clean_partial
348: * Purpose:
349: * Cleans a partially-acquired kernel message.
350: * eaddr is the address of the type specification
351: * in the body of the message that contained the error.
352: * If dolast, the memory and port rights in this last
353: * type spec are also cleaned. In that case, number
354: * specifies the number of port rights to clean.
355: * Conditions:
356: * Nothing locked.
357: */
358:
359: void
360: ipc_kmsg_clean_partial(kmsg, eaddr, dolast, number)
361: ipc_kmsg_t kmsg;
362: vm_offset_t eaddr;
363: boolean_t dolast;
364: mach_msg_type_number_t number;
365: {
366: ipc_object_t object;
367: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits;
368: vm_offset_t saddr;
369:
370: assert(kmsg->ikm_marequest == IMAR_NULL);
371:
372: object = (ipc_object_t) kmsg->ikm_header.msgh_remote_port;
373: assert(IO_VALID(object));
374: ipc_object_destroy(object, MACH_MSGH_BITS_REMOTE(mbits));
375:
376: object = (ipc_object_t) kmsg->ikm_header.msgh_local_port;
377: if (IO_VALID(object))
378: ipc_object_destroy(object, MACH_MSGH_BITS_LOCAL(mbits));
379:
380: saddr = (vm_offset_t) (&kmsg->ikm_header + 1);
381: ipc_kmsg_clean_body(saddr, eaddr);
382:
383: if (dolast) {
384: mach_msg_type_long_t *type;
385: mach_msg_type_name_t name;
386: mach_msg_type_size_t size;
387: mach_msg_type_number_t rnumber;
388: boolean_t is_inline, is_port;
389: vm_size_t length;
390:
391: xxx: type = (mach_msg_type_long_t *) eaddr;
392: is_inline = ((mach_msg_type_t*)type)->msgt_inline;
393: if (((mach_msg_type_t*)type)->msgt_longform) {
394: /* This must be aligned */
395: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
396: (is_misaligned(type))) {
397: eaddr = ptr_align(eaddr);
398: goto xxx;
399: }
400: name = type->msgtl_name;
401: size = type->msgtl_size;
402: rnumber = type->msgtl_number;
403: eaddr += sizeof(mach_msg_type_long_t);
404: } else {
405: name = ((mach_msg_type_t*)type)->msgt_name;
406: size = ((mach_msg_type_t*)type)->msgt_size;
407: rnumber = ((mach_msg_type_t*)type)->msgt_number;
408: eaddr += sizeof(mach_msg_type_t);
409: }
410:
411: /* padding (ptrs and ports) ? */
412: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
413: ((size >> 3) == sizeof(natural_t)))
414: eaddr = ptr_align(eaddr);
415:
416: /* calculate length of data in bytes, rounding up */
417:
418: length = ((rnumber * size) + 7) >> 3;
419:
420: is_port = MACH_MSG_TYPE_PORT_ANY(name);
421:
422: if (is_port) {
423: ipc_object_t *objects;
424: mach_msg_type_number_t i;
425:
426: objects = (ipc_object_t *)
427: (is_inline ? eaddr : * (vm_offset_t *) eaddr);
428:
429: /* destroy port rights carried in the message */
430:
431: for (i = 0; i < number; i++) {
432: ipc_object_t obj = objects[i];
433:
434: if (!IO_VALID(obj))
435: continue;
436:
437: ipc_object_destroy(obj, name);
438: }
439: }
440:
441: if (!is_inline) {
442: vm_offset_t data = * (vm_offset_t *) eaddr;
443:
444: /* destroy memory carried in the message */
445:
446: if (length == 0)
447: assert(data == 0);
448: else if (is_port)
449: kfree(data, length);
450: else
451: vm_map_copy_discard((vm_map_copy_t) data);
452: }
453: }
454: }
455:
456: /*
457: * Routine: ipc_kmsg_free
458: * Purpose:
459: * Free a kernel message buffer.
460: * Conditions:
461: * Nothing locked.
462: */
463:
464: void
465: ipc_kmsg_free(kmsg)
466: ipc_kmsg_t kmsg;
467: {
468: vm_size_t size = kmsg->ikm_size;
469:
470: switch (size) {
471: #if NORMA_IPC
472: case IKM_SIZE_NORMA:
473: /* return it to the norma ipc code */
474: norma_kmsg_put(kmsg);
475: break;
476: #endif /* NORMA_IPC */
477:
478: case IKM_SIZE_NETWORK:
479: /* return it to the network code */
480: net_kmsg_put(kmsg);
481: break;
482:
483: default:
484: kfree((vm_offset_t) kmsg, size);
485: break;
486: }
487: }
488:
489: /*
490: * Routine: ipc_kmsg_get
491: * Purpose:
492: * Allocates a kernel message buffer.
493: * Copies a user message to the message buffer.
494: * Conditions:
495: * Nothing locked.
496: * Returns:
497: * MACH_MSG_SUCCESS Acquired a message buffer.
498: * MACH_SEND_MSG_TOO_SMALL Message smaller than a header.
499: * MACH_SEND_MSG_TOO_SMALL Message size not long-word multiple.
500: * MACH_SEND_NO_BUFFER Couldn't allocate a message buffer.
501: * MACH_SEND_INVALID_DATA Couldn't copy message data.
502: */
503:
504: mach_msg_return_t
505: ipc_kmsg_get(msg, size, kmsgp)
506: mach_msg_header_t *msg;
507: mach_msg_size_t size;
508: ipc_kmsg_t *kmsgp;
509: {
510: ipc_kmsg_t kmsg;
511:
512: if ((size < sizeof(mach_msg_header_t)) || (size & 3))
513: return MACH_SEND_MSG_TOO_SMALL;
514:
515: if (size <= IKM_SAVED_MSG_SIZE) {
516: kmsg = ikm_cache();
517: if (kmsg != IKM_NULL) {
518: ikm_cache() = IKM_NULL;
519: ikm_check_initialized(kmsg, IKM_SAVED_KMSG_SIZE);
520: } else {
521: kmsg = ikm_alloc(IKM_SAVED_MSG_SIZE);
522: if (kmsg == IKM_NULL)
523: return MACH_SEND_NO_BUFFER;
524: ikm_init(kmsg, IKM_SAVED_MSG_SIZE);
525: }
526: } else {
527: kmsg = ikm_alloc(size);
528: if (kmsg == IKM_NULL)
529: return MACH_SEND_NO_BUFFER;
530: ikm_init(kmsg, size);
531: }
532:
533: if (copyinmsg((char *) msg, (char *) &kmsg->ikm_header, size)) {
534: ikm_free(kmsg);
535: return MACH_SEND_INVALID_DATA;
536: }
537:
538: kmsg->ikm_header.msgh_size = size;
539: *kmsgp = kmsg;
540: return MACH_MSG_SUCCESS;
541: }
542:
543: /*
544: * Routine: ipc_kmsg_get_from_kernel
545: * Purpose:
546: * Allocates a kernel message buffer.
547: * Copies a kernel message to the message buffer.
548: * Only resource errors are allowed.
549: * Conditions:
550: * Nothing locked.
551: * Returns:
552: * MACH_MSG_SUCCESS Acquired a message buffer.
553: * MACH_SEND_NO_BUFFER Couldn't allocate a message buffer.
554: */
555:
556: extern mach_msg_return_t
557: ipc_kmsg_get_from_kernel(msg, size, kmsgp)
558: mach_msg_header_t *msg;
559: mach_msg_size_t size;
560: ipc_kmsg_t *kmsgp;
561: {
562: ipc_kmsg_t kmsg;
563:
564: assert(size >= sizeof(mach_msg_header_t));
565: assert((size & 3) == 0);
566:
567: kmsg = ikm_alloc(size);
568: if (kmsg == IKM_NULL)
569: return MACH_SEND_NO_BUFFER;
570: ikm_init(kmsg, size);
571:
572: bcopy((char *) msg, (char *) &kmsg->ikm_header, size);
573:
574: kmsg->ikm_header.msgh_size = size;
575: *kmsgp = kmsg;
576: return MACH_MSG_SUCCESS;
577: }
578:
579: /*
580: * Routine: ipc_kmsg_put
581: * Purpose:
582: * Copies a message buffer to a user message.
583: * Copies only the specified number of bytes.
584: * Frees the message buffer.
585: * Conditions:
586: * Nothing locked. The message buffer must have clean
587: * header (ikm_marequest) fields.
588: * Returns:
589: * MACH_MSG_SUCCESS Copied data out of message buffer.
590: * MACH_RCV_INVALID_DATA Couldn't copy to user message.
591: */
592:
593: mach_msg_return_t
594: ipc_kmsg_put(msg, kmsg, size)
595: mach_msg_header_t *msg;
596: ipc_kmsg_t kmsg;
597: mach_msg_size_t size;
598: {
599: mach_msg_return_t mr;
600:
601: ikm_check_initialized(kmsg, kmsg->ikm_size);
602:
603: if (copyoutmsg((char *) &kmsg->ikm_header, (char *) msg, size))
604: mr = MACH_RCV_INVALID_DATA;
605: else
606: mr = MACH_MSG_SUCCESS;
607:
608: if ((kmsg->ikm_size == IKM_SAVED_KMSG_SIZE) &&
609: (ikm_cache() == IKM_NULL))
610: ikm_cache() = kmsg;
611: else
612: ikm_free(kmsg);
613:
614: return mr;
615: }
616:
617: /*
618: * Routine: ipc_kmsg_put_to_kernel
619: * Purpose:
620: * Copies a message buffer to a kernel message.
621: * Frees the message buffer.
622: * No errors allowed.
623: * Conditions:
624: * Nothing locked.
625: */
626:
627: void
628: ipc_kmsg_put_to_kernel(
629: mach_msg_header_t *msg,
630: ipc_kmsg_t kmsg,
631: mach_msg_size_t size)
632: {
633: #if DIPC
634: assert(!KMSG_IN_DIPC(kmsg));
635: #endif /* DIPC */
636:
637: (void) memcpy((void *) msg, (const void *) &kmsg->ikm_header, size);
638:
639: ikm_free(kmsg);
640: }
641:
642: /*
643: * Routine: ipc_kmsg_copyin_header
644: * Purpose:
645: * "Copy-in" port rights in the header of a message.
646: * Operates atomically; if it doesn't succeed the
647: * message header and the space are left untouched.
648: * If it does succeed the remote/local port fields
649: * contain object pointers instead of port names,
650: * and the bits field is updated. The destination port
651: * will be a valid port pointer.
652: *
653: * The notify argument implements the MACH_SEND_CANCEL option.
654: * If it is not MACH_PORT_NULL, it should name a receive right.
655: * If the processing of the destination port would generate
656: * a port-deleted notification (because the right for the
657: * destination port is destroyed and it had a request for
658: * a dead-name notification registered), and the port-deleted
659: * notification would be sent to the named receive right,
660: * then it isn't sent and the send-once right for the notify
661: * port is quietly destroyed.
662: *
663: * [MACH_IPC_COMPAT] There is an atomicity problem if the
664: * reply port is a compat entry and dies at an inopportune
665: * time. This doesn't have any serious consequences
666: * (an observant user task might conceivably notice that
667: * the destination and reply ports were handled inconsistently),
668: * only happens in compat mode, and is extremely unlikely.
669: * Conditions:
670: * Nothing locked.
671: * Returns:
672: * MACH_MSG_SUCCESS Successful copyin.
673: * MACH_SEND_INVALID_HEADER
674: * Illegal value in the message header bits.
675: * MACH_SEND_INVALID_DEST The space is dead.
676: * MACH_SEND_INVALID_NOTIFY
677: * Notify is non-null and doesn't name a receive right.
678: * (Either KERN_INVALID_NAME or KERN_INVALID_RIGHT.)
679: * MACH_SEND_INVALID_DEST Can't copyin destination port.
680: * (Either KERN_INVALID_NAME or KERN_INVALID_RIGHT.)
681: * MACH_SEND_INVALID_REPLY Can't copyin reply port.
682: * (Either KERN_INVALID_NAME or KERN_INVALID_RIGHT.)
683: */
684:
685: mach_msg_return_t
686: ipc_kmsg_copyin_header(msg, space, notify)
687: mach_msg_header_t *msg;
688: ipc_space_t space;
689: mach_port_t notify;
690: {
691: mach_msg_bits_t mbits = msg->msgh_bits &~ MACH_MSGH_BITS_CIRCULAR;
692: mach_port_t dest_name = msg->msgh_remote_port;
693: mach_port_t reply_name = msg->msgh_local_port;
694: kern_return_t kr;
695:
696: #ifndef MIGRATING_THREADS
697: /* first check for common cases */
698:
699: if (notify == MACH_PORT_NULL) switch (MACH_MSGH_BITS_PORTS(mbits)) {
700: case MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0): {
701: ipc_entry_t entry;
702: ipc_entry_bits_t bits;
703: ipc_port_t dest_port;
704:
705: /* sending an asynchronous message */
706:
707: if (reply_name != MACH_PORT_NULL)
708: break;
709:
710: is_read_lock(space);
711: if (!space->is_active)
712: goto abort_async;
713:
714: /* optimized ipc_entry_lookup */
715:
716: {
717: mach_port_index_t index = MACH_PORT_INDEX(dest_name);
718: mach_port_gen_t gen = MACH_PORT_GEN(dest_name);
719:
720: if (index >= space->is_table_size)
721: goto abort_async;
722:
723: entry = &space->is_table[index];
724: bits = entry->ie_bits;
725:
726: /* check generation number and type bit */
727:
728: if ((bits & (IE_BITS_GEN_MASK|MACH_PORT_TYPE_SEND)) !=
729: (gen | MACH_PORT_TYPE_SEND))
730: goto abort_async;
731: }
732:
733: /* optimized ipc_right_copyin */
734:
735: assert(IE_BITS_UREFS(bits) > 0);
736:
737: dest_port = (ipc_port_t) entry->ie_object;
738: assert(dest_port != IP_NULL);
739:
740: ip_lock(dest_port);
741: /* can unlock space now without compromising atomicity */
742: is_read_unlock(space);
743:
744: if (!ip_active(dest_port)) {
745: ip_unlock(dest_port);
746: break;
747: }
748:
749: assert(dest_port->ip_srights > 0);
750: dest_port->ip_srights++;
751: ip_reference(dest_port);
752: ip_unlock(dest_port);
753:
754: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
755: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, 0));
756: msg->msgh_remote_port = (mach_port_t) dest_port;
757: return MACH_MSG_SUCCESS;
758:
759: abort_async:
760: is_read_unlock(space);
761: break;
762: }
763:
764: case MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND,
765: MACH_MSG_TYPE_MAKE_SEND_ONCE): {
766: ipc_entry_num_t size;
767: ipc_entry_t table;
768: ipc_entry_t entry;
769: ipc_entry_bits_t bits;
770: ipc_port_t dest_port, reply_port;
771:
772: /* sending a request message */
773:
774: is_read_lock(space);
775: if (!space->is_active)
776: goto abort_request;
777:
778: size = space->is_table_size;
779: table = space->is_table;
780:
781: /* optimized ipc_entry_lookup of dest_name */
782:
783: {
784: mach_port_index_t index = MACH_PORT_INDEX(dest_name);
785: mach_port_gen_t gen = MACH_PORT_GEN(dest_name);
786:
787: if (index >= size)
788: goto abort_request;
789:
790: entry = &table[index];
791: bits = entry->ie_bits;
792:
793: /* check generation number and type bit */
794:
795: if ((bits & (IE_BITS_GEN_MASK|MACH_PORT_TYPE_SEND)) !=
796: (gen | MACH_PORT_TYPE_SEND))
797: goto abort_request;
798: }
799:
800: assert(IE_BITS_UREFS(bits) > 0);
801:
802: dest_port = (ipc_port_t) entry->ie_object;
803: assert(dest_port != IP_NULL);
804:
805: /* optimized ipc_entry_lookup of reply_name */
806:
807: {
808: mach_port_index_t index = MACH_PORT_INDEX(reply_name);
809: mach_port_gen_t gen = MACH_PORT_GEN(reply_name);
810:
811: if (index >= size)
812: goto abort_request;
813:
814: entry = &table[index];
815: bits = entry->ie_bits;
816:
817: /* check generation number and type bit */
818:
819: if ((bits & (IE_BITS_GEN_MASK|MACH_PORT_TYPE_RECEIVE)) !=
820: (gen | MACH_PORT_TYPE_RECEIVE))
821: goto abort_request;
822: }
823:
824: reply_port = (ipc_port_t) entry->ie_object;
825: assert(reply_port != IP_NULL);
826:
827: /*
828: * To do an atomic copyin, need simultaneous
829: * locks on both ports and the space. If
830: * dest_port == reply_port, and simple locking is
831: * enabled, then we will abort. Otherwise it's
832: * OK to unlock twice.
833: */
834:
835: ip_lock(dest_port);
836: if (!ip_active(dest_port) || !ip_lock_try(reply_port)) {
837: ip_unlock(dest_port);
838: goto abort_request;
839: }
840: /* can unlock space now without compromising atomicity */
841: is_read_unlock(space);
842:
843: assert(dest_port->ip_srights > 0);
844: dest_port->ip_srights++;
845: ip_reference(dest_port);
846: ip_unlock(dest_port);
847:
848: assert(ip_active(reply_port));
849: assert(reply_port->ip_receiver_name == reply_name);
850: assert(reply_port->ip_receiver == space);
851:
852: reply_port->ip_sorights++;
853: ip_reference(reply_port);
854: ip_unlock(reply_port);
855:
856: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
857: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND,
858: MACH_MSG_TYPE_PORT_SEND_ONCE));
859: msg->msgh_remote_port = (mach_port_t) dest_port;
860: msg->msgh_local_port = (mach_port_t) reply_port;
861: return MACH_MSG_SUCCESS;
862:
863: abort_request:
864: is_read_unlock(space);
865: break;
866: }
867:
868: case MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND_ONCE, 0): {
869: mach_port_index_t index;
870: mach_port_gen_t gen;
871: ipc_entry_t table;
872: ipc_entry_t entry;
873: ipc_entry_bits_t bits;
874: ipc_port_t dest_port;
875:
876: /* sending a reply message */
877:
878: if (reply_name != MACH_PORT_NULL)
879: break;
880:
881: is_write_lock(space);
882: if (!space->is_active)
883: goto abort_reply;
884:
885: /* optimized ipc_entry_lookup */
886:
887: table = space->is_table;
888:
889: index = MACH_PORT_INDEX(dest_name);
890: gen = MACH_PORT_GEN(dest_name);
891:
892: if (index >= space->is_table_size)
893: goto abort_reply;
894:
895: entry = &table[index];
896: bits = entry->ie_bits;
897:
898: /* check generation number, collision bit, and type bit */
899:
900: if ((bits & (IE_BITS_GEN_MASK|IE_BITS_COLLISION|
901: MACH_PORT_TYPE_SEND_ONCE)) !=
902: (gen | MACH_PORT_TYPE_SEND_ONCE))
903: goto abort_reply;
904:
905: /* optimized ipc_right_copyin */
906:
907: assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_ONCE);
908: assert(IE_BITS_UREFS(bits) == 1);
909: assert((bits & IE_BITS_MAREQUEST) == 0);
910:
911: if (entry->ie_request != 0)
912: goto abort_reply;
913:
914: dest_port = (ipc_port_t) entry->ie_object;
915: assert(dest_port != IP_NULL);
916:
917: ip_lock(dest_port);
918: if (!ip_active(dest_port)) {
919: ip_unlock(dest_port);
920: goto abort_reply;
921: }
922:
923: assert(dest_port->ip_sorights > 0);
924: ip_unlock(dest_port);
925:
926: /* optimized ipc_entry_dealloc */
927:
928: entry->ie_next = table->ie_next;
929: table->ie_next = index;
930: entry->ie_bits = gen;
931: entry->ie_object = IO_NULL;
932: is_write_unlock(space);
933:
934: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
935: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE,
936: 0));
937: msg->msgh_remote_port = (mach_port_t) dest_port;
938: return MACH_MSG_SUCCESS;
939:
940: abort_reply:
941: is_write_unlock(space);
942: break;
943: }
944:
945: default:
946: /* don't bother optimizing */
947: break;
948: }
949: #endif /* MIGRATING_THREADS */
950:
951: {
952: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits);
953: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits);
954: ipc_object_t dest_port, reply_port;
955: ipc_port_t dest_soright, reply_soright;
956: ipc_port_t notify_port = 0; /* '=0' to quiet gcc warnings */
957:
958: if (!MACH_MSG_TYPE_PORT_ANY_SEND(dest_type))
959: return MACH_SEND_INVALID_HEADER;
960:
961: if ((reply_type == 0) ?
962: (reply_name != MACH_PORT_NULL) :
963: !MACH_MSG_TYPE_PORT_ANY_SEND(reply_type))
964: return MACH_SEND_INVALID_HEADER;
965:
966: is_write_lock(space);
967: if (!space->is_active)
968: goto invalid_dest;
969:
970: if (notify != MACH_PORT_NULL) {
971: ipc_entry_t entry;
972:
973: if (((entry = ipc_entry_lookup(space, notify)) == IE_NULL) ||
974: ((entry->ie_bits & MACH_PORT_TYPE_RECEIVE) == 0)) {
975: is_write_unlock(space);
976: return MACH_SEND_INVALID_NOTIFY;
977: }
978:
979: notify_port = (ipc_port_t) entry->ie_object;
980: }
981:
982: if (dest_name == reply_name) {
983: ipc_entry_t entry;
984: mach_port_t name = dest_name;
985:
986: /*
987: * Destination and reply ports are the same!
988: * This is a little tedious to make atomic, because
989: * there are 25 combinations of dest_type/reply_type.
990: * However, most are easy. If either is move-sonce,
991: * then there must be an error. If either are
992: * make-send or make-sonce, then we must be looking
993: * at a receive right so the port can't die.
994: * The hard cases are the combinations of
995: * copy-send and make-send.
996: */
997:
998: entry = ipc_entry_lookup(space, name);
999: if (entry == IE_NULL)
1000: goto invalid_dest;
1001:
1002: assert(reply_type != 0); /* because name not null */
1003:
1004: if (!ipc_right_copyin_check(space, name, entry, reply_type))
1005: goto invalid_reply;
1006:
1007: if ((dest_type == MACH_MSG_TYPE_MOVE_SEND_ONCE) ||
1008: (reply_type == MACH_MSG_TYPE_MOVE_SEND_ONCE)) {
1009: /*
1010: * Why must there be an error? To get a valid
1011: * destination, this entry must name a live
1012: * port (not a dead name or dead port). However
1013: * a successful move-sonce will destroy a
1014: * live entry. Therefore the other copyin,
1015: * whatever it is, would fail. We've already
1016: * checked for reply port errors above,
1017: * so report a destination error.
1018: */
1019:
1020: goto invalid_dest;
1021: } else if ((dest_type == MACH_MSG_TYPE_MAKE_SEND) ||
1022: (dest_type == MACH_MSG_TYPE_MAKE_SEND_ONCE) ||
1023: (reply_type == MACH_MSG_TYPE_MAKE_SEND) ||
1024: (reply_type == MACH_MSG_TYPE_MAKE_SEND_ONCE)) {
1025: kr = ipc_right_copyin(space, name, entry,
1026: dest_type, FALSE,
1027: &dest_port, &dest_soright);
1028: if (kr != KERN_SUCCESS)
1029: goto invalid_dest;
1030:
1031: /*
1032: * Either dest or reply needs a receive right.
1033: * We know the receive right is there, because
1034: * of the copyin_check and copyin calls. Hence
1035: * the port is not in danger of dying. If dest
1036: * used the receive right, then the right needed
1037: * by reply (and verified by copyin_check) will
1038: * still be there.
1039: */
1040:
1041: assert(IO_VALID(dest_port));
1042: assert(entry->ie_bits & MACH_PORT_TYPE_RECEIVE);
1043: assert(dest_soright == IP_NULL);
1044:
1045: kr = ipc_right_copyin(space, name, entry,
1046: reply_type, TRUE,
1047: &reply_port, &reply_soright);
1048:
1049: assert(kr == KERN_SUCCESS);
1050: assert(reply_port == dest_port);
1051: assert(entry->ie_bits & MACH_PORT_TYPE_RECEIVE);
1052: assert(reply_soright == IP_NULL);
1053: } else if ((dest_type == MACH_MSG_TYPE_COPY_SEND) &&
1054: (reply_type == MACH_MSG_TYPE_COPY_SEND)) {
1055: /*
1056: * To make this atomic, just do one copy-send,
1057: * and dup the send right we get out.
1058: */
1059:
1060: kr = ipc_right_copyin(space, name, entry,
1061: dest_type, FALSE,
1062: &dest_port, &dest_soright);
1063: if (kr != KERN_SUCCESS)
1064: goto invalid_dest;
1065:
1066: assert(entry->ie_bits & MACH_PORT_TYPE_SEND);
1067: assert(dest_soright == IP_NULL);
1068:
1069: /*
1070: * It's OK if the port we got is dead now,
1071: * so reply_port is IP_DEAD, because the msg
1072: * won't go anywhere anyway.
1073: */
1074:
1075: reply_port = (ipc_object_t)
1076: ipc_port_copy_send((ipc_port_t) dest_port);
1077: reply_soright = IP_NULL;
1078: } else if ((dest_type == MACH_MSG_TYPE_MOVE_SEND) &&
1079: (reply_type == MACH_MSG_TYPE_MOVE_SEND)) {
1080: /*
1081: * This is an easy case. Just use our
1082: * handy-dandy special-purpose copyin call
1083: * to get two send rights for the price of one.
1084: */
1085:
1086: kr = ipc_right_copyin_two(space, name, entry,
1087: &dest_port, &dest_soright);
1088: if (kr != KERN_SUCCESS)
1089: goto invalid_dest;
1090:
1091: /* the entry might need to be deallocated */
1092:
1093: if (IE_BITS_TYPE(entry->ie_bits)
1094: == MACH_PORT_TYPE_NONE)
1095: ipc_entry_dealloc(space, name, entry);
1096:
1097: reply_port = dest_port;
1098: reply_soright = IP_NULL;
1099: } else {
1100: ipc_port_t soright;
1101:
1102: assert(((dest_type == MACH_MSG_TYPE_COPY_SEND) &&
1103: (reply_type == MACH_MSG_TYPE_MOVE_SEND)) ||
1104: ((dest_type == MACH_MSG_TYPE_MOVE_SEND) &&
1105: (reply_type == MACH_MSG_TYPE_COPY_SEND)));
1106:
1107: /*
1108: * To make this atomic, just do a move-send,
1109: * and dup the send right we get out.
1110: */
1111:
1112: kr = ipc_right_copyin(space, name, entry,
1113: MACH_MSG_TYPE_MOVE_SEND, FALSE,
1114: &dest_port, &soright);
1115: if (kr != KERN_SUCCESS)
1116: goto invalid_dest;
1117:
1118: /* the entry might need to be deallocated */
1119:
1120: if (IE_BITS_TYPE(entry->ie_bits)
1121: == MACH_PORT_TYPE_NONE)
1122: ipc_entry_dealloc(space, name, entry);
1123:
1124: /*
1125: * It's OK if the port we got is dead now,
1126: * so reply_port is IP_DEAD, because the msg
1127: * won't go anywhere anyway.
1128: */
1129:
1130: reply_port = (ipc_object_t)
1131: ipc_port_copy_send((ipc_port_t) dest_port);
1132:
1133: if (dest_type == MACH_MSG_TYPE_MOVE_SEND) {
1134: dest_soright = soright;
1135: reply_soright = IP_NULL;
1136: } else {
1137: dest_soright = IP_NULL;
1138: reply_soright = soright;
1139: }
1140: }
1141: } else if (!MACH_PORT_VALID(reply_name)) {
1142: ipc_entry_t entry;
1143:
1144: /*
1145: * No reply port! This is an easy case
1146: * to make atomic. Just copyin the destination.
1147: */
1148:
1149: entry = ipc_entry_lookup(space, dest_name);
1150: if (entry == IE_NULL)
1151: goto invalid_dest;
1152:
1153: kr = ipc_right_copyin(space, dest_name, entry,
1154: dest_type, FALSE,
1155: &dest_port, &dest_soright);
1156: if (kr != KERN_SUCCESS)
1157: goto invalid_dest;
1158:
1159: /* the entry might need to be deallocated */
1160:
1161: if (IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_NONE)
1162: ipc_entry_dealloc(space, dest_name, entry);
1163:
1164: reply_port = (ipc_object_t) reply_name;
1165: reply_soright = IP_NULL;
1166: } else {
1167: ipc_entry_t dest_entry, reply_entry;
1168: ipc_port_t saved_reply;
1169:
1170: /*
1171: * This is the tough case to make atomic.
1172: * The difficult problem is serializing with port death.
1173: * At the time we copyin dest_port, it must be alive.
1174: * If reply_port is alive when we copyin it, then
1175: * we are OK, because we serialize before the death
1176: * of both ports. Assume reply_port is dead at copyin.
1177: * Then if dest_port dies/died after reply_port died,
1178: * we are OK, because we serialize between the death
1179: * of the two ports. So the bad case is when dest_port
1180: * dies after its copyin, reply_port dies before its
1181: * copyin, and dest_port dies before reply_port. Then
1182: * the copyins operated as if dest_port was alive
1183: * and reply_port was dead, which shouldn't have happened
1184: * because they died in the other order.
1185: *
1186: * We handle the bad case by undoing the copyins
1187: * (which is only possible because the ports are dead)
1188: * and failing with MACH_SEND_INVALID_DEST, serializing
1189: * after the death of the ports.
1190: *
1191: * Note that it is easy for a user task to tell if
1192: * a copyin happened before or after a port died.
1193: * For example, suppose both dest and reply are
1194: * send-once rights (types are both move-sonce) and
1195: * both rights have dead-name requests registered.
1196: * If a port dies before copyin, a dead-name notification
1197: * is generated and the dead name's urefs are incremented,
1198: * and if the copyin happens first, a port-deleted
1199: * notification is generated.
1200: *
1201: * Note that although the entries are different,
1202: * dest_port and reply_port might still be the same.
1203: */
1204:
1205: dest_entry = ipc_entry_lookup(space, dest_name);
1206: if (dest_entry == IE_NULL)
1207: goto invalid_dest;
1208:
1209: reply_entry = ipc_entry_lookup(space, reply_name);
1210: if (reply_entry == IE_NULL)
1211: goto invalid_reply;
1212:
1213: assert(dest_entry != reply_entry); /* names are not equal */
1214: assert(reply_type != 0); /* because reply_name not null */
1215:
1216: if (!ipc_right_copyin_check(space, reply_name, reply_entry,
1217: reply_type))
1218: goto invalid_reply;
1219:
1220: kr = ipc_right_copyin(space, dest_name, dest_entry,
1221: dest_type, FALSE,
1222: &dest_port, &dest_soright);
1223: if (kr != KERN_SUCCESS)
1224: goto invalid_dest;
1225:
1226: assert(IO_VALID(dest_port));
1227:
1228: saved_reply = (ipc_port_t) reply_entry->ie_object;
1229: /* might be IP_NULL, if this is a dead name */
1230: if (saved_reply != IP_NULL)
1231: ipc_port_reference(saved_reply);
1232:
1233: kr = ipc_right_copyin(space, reply_name, reply_entry,
1234: reply_type, TRUE,
1235: &reply_port, &reply_soright);
1236: #if MACH_IPC_COMPAT
1237: if (kr != KERN_SUCCESS) {
1238: assert(kr == KERN_INVALID_NAME);
1239:
1240: /*
1241: * Oops. This must have been a compat entry
1242: * and the port died after the check above.
1243: * We should back out the copyin of dest_port,
1244: * and report MACH_SEND_INVALID_REPLY, but
1245: * if dest_port is alive we can't always do that.
1246: * Punt and pretend we got IO_DEAD, skipping
1247: * further hairy atomicity problems.
1248: */
1249:
1250: reply_port = IO_DEAD;
1251: reply_soright = IP_NULL;
1252: goto skip_reply_checks;
1253: }
1254: #else /* MACH_IPC_COMPAT */
1255: assert(kr == KERN_SUCCESS);
1256: #endif /* MACH_IPC_COMPAT */
1257:
1258: if ((saved_reply != IP_NULL) && (reply_port == IO_DEAD)) {
1259: ipc_port_t dest = (ipc_port_t) dest_port;
1260: ipc_port_timestamp_t timestamp;
1261: boolean_t must_undo;
1262:
1263: /*
1264: * The reply port died before copyin.
1265: * Check if dest port died before reply.
1266: */
1267:
1268: ip_lock(saved_reply);
1269: assert(!ip_active(saved_reply));
1270: timestamp = saved_reply->ip_timestamp;
1271: ip_unlock(saved_reply);
1272:
1273: ip_lock(dest);
1274: must_undo = (!ip_active(dest) &&
1275: IP_TIMESTAMP_ORDER(dest->ip_timestamp,
1276: timestamp));
1277: ip_unlock(dest);
1278:
1279: if (must_undo) {
1280: /*
1281: * Our worst nightmares are realized.
1282: * Both destination and reply ports
1283: * are dead, but in the wrong order,
1284: * so we must undo the copyins and
1285: * possibly generate a dead-name notif.
1286: */
1287:
1288: ipc_right_copyin_undo(
1289: space, dest_name, dest_entry,
1290: dest_type, dest_port,
1291: dest_soright);
1292: /* dest_entry may be deallocated now */
1293:
1294: ipc_right_copyin_undo(
1295: space, reply_name, reply_entry,
1296: reply_type, reply_port,
1297: reply_soright);
1298: /* reply_entry may be deallocated now */
1299:
1300: is_write_unlock(space);
1301:
1302: if (dest_soright != IP_NULL)
1303: ipc_notify_dead_name(dest_soright,
1304: dest_name);
1305: assert(reply_soright == IP_NULL);
1306:
1307: ipc_port_release(saved_reply);
1308: return MACH_SEND_INVALID_DEST;
1309: }
1310: }
1311:
1312: /* the entries might need to be deallocated */
1313:
1314: if (IE_BITS_TYPE(reply_entry->ie_bits) == MACH_PORT_TYPE_NONE)
1315: ipc_entry_dealloc(space, reply_name, reply_entry);
1316:
1317: #if MACH_IPC_COMPAT
1318: skip_reply_checks:
1319: /*
1320: * We jump here if the reply entry was a compat entry
1321: * and the port died on us. In this case, the copyin
1322: * code already deallocated reply_entry.
1323: */
1324: #endif /* MACH_IPC_COMPAT */
1325:
1326: if (IE_BITS_TYPE(dest_entry->ie_bits) == MACH_PORT_TYPE_NONE)
1327: ipc_entry_dealloc(space, dest_name, dest_entry);
1328:
1329: if (saved_reply != IP_NULL)
1330: ipc_port_release(saved_reply);
1331: }
1332:
1333: /*
1334: * At this point, dest_port, reply_port,
1335: * dest_soright, reply_soright are all initialized.
1336: * Any defunct entries have been deallocated.
1337: * The space is still write-locked, and we need to
1338: * make the MACH_SEND_CANCEL check. The notify_port pointer
1339: * is still usable, because the copyin code above won't ever
1340: * deallocate a receive right, so its entry still exists
1341: * and holds a ref. Note notify_port might even equal
1342: * dest_port or reply_port.
1343: */
1344:
1345: if ((notify != MACH_PORT_NULL) &&
1346: (dest_soright == notify_port)) {
1347: ipc_port_release_sonce(dest_soright);
1348: dest_soright = IP_NULL;
1349: }
1350:
1351: is_write_unlock(space);
1352:
1353: if (dest_soright != IP_NULL)
1354: ipc_notify_port_deleted(dest_soright, dest_name);
1355:
1356: if (reply_soright != IP_NULL)
1357: ipc_notify_port_deleted(reply_soright, reply_name);
1358:
1359: dest_type = ipc_object_copyin_type(dest_type);
1360: reply_type = ipc_object_copyin_type(reply_type);
1361:
1362: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
1363: MACH_MSGH_BITS(dest_type, reply_type));
1364: msg->msgh_remote_port = (mach_port_t) dest_port;
1365: msg->msgh_local_port = (mach_port_t) reply_port;
1366: }
1367:
1368: return MACH_MSG_SUCCESS;
1369:
1370: invalid_dest:
1371: is_write_unlock(space);
1372: return MACH_SEND_INVALID_DEST;
1373:
1374: invalid_reply:
1375: is_write_unlock(space);
1376: return MACH_SEND_INVALID_REPLY;
1377: }
1378:
1379: mach_msg_return_t
1380: ipc_kmsg_copyin_body(kmsg, space, map)
1381: ipc_kmsg_t kmsg;
1382: ipc_space_t space;
1383: vm_map_t map;
1384: {
1385: ipc_object_t dest;
1386: vm_offset_t saddr, eaddr;
1387: boolean_t complex;
1388: mach_msg_return_t mr;
1389: boolean_t use_page_lists, steal_pages;
1390:
1391: dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port;
1392: complex = FALSE;
1393: use_page_lists = ipc_kobject_vm_page_list(ip_kotype((ipc_port_t)dest));
1394: steal_pages = ipc_kobject_vm_page_steal(ip_kotype((ipc_port_t)dest));
1395:
1396: #if NORMA_IPC
1397: if (IP_NORMA_IS_PROXY((ipc_port_t) dest)) {
1398: use_page_lists = TRUE;
1399: steal_pages = TRUE;
1400: }
1401: #endif /* NORMA_IPC */
1402:
1403: saddr = (vm_offset_t) (&kmsg->ikm_header + 1);
1404: eaddr = (vm_offset_t) &kmsg->ikm_header + kmsg->ikm_header.msgh_size;
1405:
1406: while (saddr < eaddr) {
1407: vm_offset_t taddr = saddr;
1408: mach_msg_type_long_t *type;
1409: mach_msg_type_name_t name;
1410: mach_msg_type_size_t size;
1411: mach_msg_type_number_t number;
1412: boolean_t is_inline, longform, dealloc, is_port;
1413: vm_offset_t data;
1414: vm_size_t length;
1415: kern_return_t kr;
1416:
1417: type = (mach_msg_type_long_t *) saddr;
1418:
1419: if (((eaddr - saddr) < sizeof(mach_msg_type_t)) ||
1420: ((longform = ((mach_msg_type_t*)type)->msgt_longform) &&
1421: ((eaddr - saddr) < sizeof(mach_msg_type_long_t)))) {
1422: ipc_kmsg_clean_partial(kmsg, taddr, FALSE, 0);
1423: return MACH_SEND_MSG_TOO_SMALL;
1424: }
1425:
1426: is_inline = ((mach_msg_type_t*)type)->msgt_inline;
1427: dealloc = ((mach_msg_type_t*)type)->msgt_deallocate;
1428: if (longform) {
1429: /* This must be aligned */
1430: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
1431: (is_misaligned(type))) {
1432: saddr = ptr_align(saddr);
1433: continue;
1434: }
1435: name = type->msgtl_name;
1436: size = type->msgtl_size;
1437: number = type->msgtl_number;
1438: saddr += sizeof(mach_msg_type_long_t);
1439: } else {
1440: name = ((mach_msg_type_t*)type)->msgt_name;
1441: size = ((mach_msg_type_t*)type)->msgt_size;
1442: number = ((mach_msg_type_t*)type)->msgt_number;
1443: saddr += sizeof(mach_msg_type_t);
1444: }
1445:
1446: is_port = MACH_MSG_TYPE_PORT_ANY(name);
1447:
1448: if ((is_port && (size != PORT_T_SIZE_IN_BITS)) ||
1449: (longform && ((type->msgtl_header.msgt_name != 0) ||
1450: (type->msgtl_header.msgt_size != 0) ||
1451: (type->msgtl_header.msgt_number != 0))) ||
1452: (((mach_msg_type_t*)type)->msgt_unused != 0) ||
1453: (dealloc && is_inline)) {
1454: ipc_kmsg_clean_partial(kmsg, taddr, FALSE, 0);
1455: return MACH_SEND_INVALID_TYPE;
1456: }
1457:
1458: /* padding (ptrs and ports) ? */
1459: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
1460: ((size >> 3) == sizeof(natural_t)))
1461: saddr = ptr_align(saddr);
1462:
1463: /* calculate length of data in bytes, rounding up */
1464:
1465: length = ((number * size) + 7) >> 3;
1466:
1467: if (is_inline) {
1468: vm_size_t amount;
1469:
1470: /* inline data sizes round up to int boundaries */
1471:
1472: amount = (length + 3) &~ 3;
1473: if ((eaddr - saddr) < amount) {
1474: ipc_kmsg_clean_partial(kmsg, taddr, FALSE, 0);
1475: return MACH_SEND_MSG_TOO_SMALL;
1476: }
1477:
1478: data = saddr;
1479: saddr += amount;
1480: } else {
1481: vm_offset_t addr;
1482:
1483: if (sizeof(vm_offset_t) > sizeof(mach_msg_type_t))
1484: saddr = ptr_align(saddr);
1485:
1486: if ((eaddr - saddr) < sizeof(vm_offset_t)) {
1487: ipc_kmsg_clean_partial(kmsg, taddr, FALSE, 0);
1488: return MACH_SEND_MSG_TOO_SMALL;
1489: }
1490:
1491: /* grab the out-of-line data */
1492:
1493: addr = * (vm_offset_t *) saddr;
1494:
1495: if (length == 0)
1496: data = 0;
1497: else if (is_port) {
1498: data = kalloc(length);
1499: if (data == 0)
1500: goto invalid_memory;
1501:
1502: if (copyinmap(map, (char *) addr,
1503: (char *) data, length) ||
1504: (dealloc &&
1505: (vm_deallocate(map, addr, length) !=
1506: KERN_SUCCESS))) {
1507: kfree(data, length);
1508: goto invalid_memory;
1509: }
1510: } else {
1511: vm_map_copy_t copy;
1512:
1513: if (use_page_lists) {
1514: kr = vm_map_copyin_page_list(map,
1515: addr, length, dealloc,
1516: steal_pages, ©, FALSE);
1517: } else {
1518: kr = vm_map_copyin(map, addr, length,
1519: dealloc, ©);
1520: }
1521: if (kr != KERN_SUCCESS) {
1522: invalid_memory:
1523: ipc_kmsg_clean_partial(kmsg, taddr,
1524: FALSE, 0);
1525: return MACH_SEND_INVALID_MEMORY;
1526: }
1527:
1528: data = (vm_offset_t) copy;
1529: }
1530:
1531: * (vm_offset_t *) saddr = data;
1532: saddr += sizeof(vm_offset_t);
1533: complex = TRUE;
1534: }
1535:
1536: if (is_port) {
1537: mach_msg_type_name_t newname =
1538: ipc_object_copyin_type(name);
1539: ipc_object_t *objects = (ipc_object_t *) data;
1540: mach_msg_type_number_t i;
1541:
1542: if (longform)
1543: type->msgtl_name = newname;
1544: else
1545: ((mach_msg_type_t*)type)->msgt_name = newname;
1546:
1547: for (i = 0; i < number; i++) {
1548: mach_port_t port = (mach_port_t) objects[i];
1549: ipc_object_t object;
1550:
1551: if (!MACH_PORT_VALID(port))
1552: continue;
1553:
1554: kr = ipc_object_copyin(space, port,
1555: name, &object);
1556: if (kr != KERN_SUCCESS) {
1557: ipc_kmsg_clean_partial(kmsg, taddr,
1558: TRUE, i);
1559: return MACH_SEND_INVALID_RIGHT;
1560: }
1561:
1562: if ((newname == MACH_MSG_TYPE_PORT_RECEIVE) &&
1563: ipc_port_check_circularity(
1564: (ipc_port_t) object,
1565: (ipc_port_t) dest))
1566: kmsg->ikm_header.msgh_bits |=
1567: MACH_MSGH_BITS_CIRCULAR;
1568:
1569: objects[i] = object;
1570: }
1571:
1572: complex = TRUE;
1573: }
1574: }
1575:
1576: if (!complex)
1577: kmsg->ikm_header.msgh_bits &= ~MACH_MSGH_BITS_COMPLEX;
1578:
1579: return MACH_MSG_SUCCESS;
1580: }
1581:
1582: /*
1583: * Routine: ipc_kmsg_copyin
1584: * Purpose:
1585: * "Copy-in" port rights and out-of-line memory
1586: * in the message.
1587: *
1588: * In all failure cases, the message is left holding
1589: * no rights or memory. However, the message buffer
1590: * is not deallocated. If successful, the message
1591: * contains a valid destination port.
1592: * Conditions:
1593: * Nothing locked.
1594: * Returns:
1595: * MACH_MSG_SUCCESS Successful copyin.
1596: * MACH_SEND_INVALID_HEADER
1597: * Illegal value in the message header bits.
1598: * MACH_SEND_INVALID_NOTIFY Bad notify port.
1599: * MACH_SEND_INVALID_DEST Can't copyin destination port.
1600: * MACH_SEND_INVALID_REPLY Can't copyin reply port.
1601: * MACH_SEND_INVALID_MEMORY Can't grab out-of-line memory.
1602: * MACH_SEND_INVALID_RIGHT Can't copyin port right in body.
1603: * MACH_SEND_INVALID_TYPE Bad type specification.
1604: * MACH_SEND_MSG_TOO_SMALL Body is too small for types/data.
1605: */
1606:
1607: mach_msg_return_t
1608: ipc_kmsg_copyin(kmsg, space, map, notify)
1609: ipc_kmsg_t kmsg;
1610: ipc_space_t space;
1611: vm_map_t map;
1612: mach_port_t notify;
1613: {
1614: mach_msg_return_t mr;
1615:
1616: mr = ipc_kmsg_copyin_header(&kmsg->ikm_header, space, notify);
1617: if (mr != MACH_MSG_SUCCESS)
1618: return mr;
1619:
1620: if ((kmsg->ikm_header.msgh_bits & MACH_MSGH_BITS_COMPLEX) == 0)
1621: return MACH_MSG_SUCCESS;
1622:
1623: return ipc_kmsg_copyin_body(kmsg, space, map);
1624: }
1625:
1626: /*
1627: * Routine: ipc_kmsg_copyin_from_kernel
1628: * Purpose:
1629: * "Copy-in" port rights and out-of-line memory
1630: * in a message sent from the kernel.
1631: *
1632: * Because the message comes from the kernel,
1633: * the implementation assumes there are no errors
1634: * or peculiarities in the message.
1635: *
1636: * Returns TRUE if queueing the message
1637: * would result in a circularity.
1638: * Conditions:
1639: * Nothing locked.
1640: */
1641:
1642: void
1643: ipc_kmsg_copyin_from_kernel(
1644: ipc_kmsg_t kmsg)
1645: {
1646: mach_msg_bits_t bits = kmsg->ikm_header.msgh_bits;
1647: mach_msg_type_name_t rname = MACH_MSGH_BITS_REMOTE(bits);
1648: mach_msg_type_name_t lname = MACH_MSGH_BITS_LOCAL(bits);
1649: ipc_object_t remote = (ipc_object_t) kmsg->ikm_header.msgh_remote_port;
1650: ipc_object_t local = (ipc_object_t) kmsg->ikm_header.msgh_local_port;
1651: vm_offset_t saddr, eaddr;
1652:
1653: /* translate the destination and reply ports */
1654:
1655: ipc_object_copyin_from_kernel(remote, rname);
1656: if (IO_VALID(local))
1657: ipc_object_copyin_from_kernel(local, lname);
1658:
1659: /*
1660: * The common case is a complex message with no reply port,
1661: * because that is what the memory_object interface uses.
1662: */
1663:
1664: if (bits == (MACH_MSGH_BITS_COMPLEX |
1665: MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0))) {
1666: bits = (MACH_MSGH_BITS_COMPLEX |
1667: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, 0));
1668:
1669: kmsg->ikm_header.msgh_bits = bits;
1670: } else {
1671: bits = (MACH_MSGH_BITS_OTHER(bits) |
1672: MACH_MSGH_BITS(ipc_object_copyin_type(rname),
1673: ipc_object_copyin_type(lname)));
1674:
1675: kmsg->ikm_header.msgh_bits = bits;
1676: if ((bits & MACH_MSGH_BITS_COMPLEX) == 0)
1677: return;
1678: }
1679:
1680: saddr = (vm_offset_t) (&kmsg->ikm_header + 1);
1681: eaddr = (vm_offset_t) &kmsg->ikm_header + kmsg->ikm_header.msgh_size;
1682:
1683: while (saddr < eaddr) {
1684: mach_msg_type_long_t *type;
1685: mach_msg_type_name_t name;
1686: mach_msg_type_size_t size;
1687: mach_msg_type_number_t number;
1688: boolean_t is_inline, longform, is_port;
1689: vm_offset_t data;
1690: vm_size_t length;
1691:
1692: type = (mach_msg_type_long_t *) saddr;
1693: is_inline = ((mach_msg_type_t*)type)->msgt_inline;
1694: longform = ((mach_msg_type_t*)type)->msgt_longform;
1695: /* type->msgtl_header.msgt_deallocate not used */
1696: if (longform) {
1697: /* This must be aligned */
1698: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
1699: (is_misaligned(type))) {
1700: saddr = ptr_align(saddr);
1701: continue;
1702: }
1703: name = type->msgtl_name;
1704: size = type->msgtl_size;
1705: number = type->msgtl_number;
1706: saddr += sizeof(mach_msg_type_long_t);
1707: } else {
1708: name = ((mach_msg_type_t*)type)->msgt_name;
1709: size = ((mach_msg_type_t*)type)->msgt_size;
1710: number = ((mach_msg_type_t*)type)->msgt_number;
1711: saddr += sizeof(mach_msg_type_t);
1712: }
1713:
1714: /* padding (ptrs and ports) ? */
1715: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
1716: ((size >> 3) == sizeof(natural_t)))
1717: saddr = ptr_align(saddr);
1718:
1719: /* calculate length of data in bytes, rounding up */
1720:
1721: length = ((number * size) + 7) >> 3;
1722:
1723: is_port = MACH_MSG_TYPE_PORT_ANY(name);
1724:
1725: if (is_inline) {
1726: /* inline data sizes round up to int boundaries */
1727:
1728: data = saddr;
1729: saddr += (length + 3) &~ 3;
1730: } else {
1731: /*
1732: * The sender should supply ready-made memory
1733: * for us, so we don't need to do anything.
1734: */
1735:
1736: data = * (vm_offset_t *) saddr;
1737: saddr += sizeof(vm_offset_t);
1738: }
1739:
1740: if (is_port) {
1741: mach_msg_type_name_t newname =
1742: ipc_object_copyin_type(name);
1743: ipc_object_t *objects = (ipc_object_t *) data;
1744: mach_msg_type_number_t i;
1745:
1746: if (longform)
1747: type->msgtl_name = newname;
1748: else
1749: ((mach_msg_type_t*)type)->msgt_name = newname;
1750: for (i = 0; i < number; i++) {
1751: ipc_object_t object = objects[i];
1752:
1753: if (!IO_VALID(object))
1754: continue;
1755:
1756: ipc_object_copyin_from_kernel(object, name);
1757:
1758: if ((newname == MACH_MSG_TYPE_PORT_RECEIVE) &&
1759: ipc_port_check_circularity(
1760: (ipc_port_t) object,
1761: (ipc_port_t) remote))
1762: kmsg->ikm_header.msgh_bits |=
1763: MACH_MSGH_BITS_CIRCULAR;
1764: }
1765: }
1766: }
1767: }
1768:
1769: /*
1770: * Routine: ipc_kmsg_copyout_header
1771: * Purpose:
1772: * "Copy-out" port rights in the header of a message.
1773: * Operates atomically; if it doesn't succeed the
1774: * message header and the space are left untouched.
1775: * If it does succeed the remote/local port fields
1776: * contain port names instead of object pointers,
1777: * and the bits field is updated.
1778: *
1779: * The notify argument implements the MACH_RCV_NOTIFY option.
1780: * If it is not MACH_PORT_NULL, it should name a receive right.
1781: * If the process of receiving the reply port creates a
1782: * new right in the receiving task, then the new right is
1783: * automatically registered for a dead-name notification,
1784: * with the notify port supplying the send-once right.
1785: * Conditions:
1786: * Nothing locked.
1787: * Returns:
1788: * MACH_MSG_SUCCESS Copied out port rights.
1789: * MACH_RCV_INVALID_NOTIFY
1790: * Notify is non-null and doesn't name a receive right.
1791: * (Either KERN_INVALID_NAME or KERN_INVALID_RIGHT.)
1792: * MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_SPACE
1793: * The space is dead.
1794: * MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_SPACE
1795: * No room in space for another name.
1796: * MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_KERNEL
1797: * Couldn't allocate memory for the reply port.
1798: * MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_KERNEL
1799: * Couldn't allocate memory for the dead-name request.
1800: */
1801:
1802: mach_msg_return_t
1803: ipc_kmsg_copyout_header(msg, space, notify)
1804: mach_msg_header_t *msg;
1805: ipc_space_t space;
1806: mach_port_t notify;
1807: {
1808: mach_msg_bits_t mbits = msg->msgh_bits;
1809: ipc_port_t dest = (ipc_port_t) msg->msgh_remote_port;
1810:
1811: assert(IP_VALID(dest));
1812:
1813: #ifndef MIGRATING_THREADS
1814: /* first check for common cases */
1815:
1816: if (notify == MACH_PORT_NULL) switch (MACH_MSGH_BITS_PORTS(mbits)) {
1817: case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, 0): {
1818: mach_port_t dest_name;
1819: ipc_port_t nsrequest;
1820:
1821: /* receiving an asynchronous message */
1822:
1823: ip_lock(dest);
1824: if (!ip_active(dest)) {
1825: ip_unlock(dest);
1826: break;
1827: }
1828:
1829: /* optimized ipc_object_copyout_dest */
1830:
1831: assert(dest->ip_srights > 0);
1832: ip_release(dest);
1833:
1834: if (dest->ip_receiver == space)
1835: dest_name = dest->ip_receiver_name;
1836: else
1837: dest_name = MACH_PORT_NULL;
1838:
1839: if ((--dest->ip_srights == 0) &&
1840: ((nsrequest = dest->ip_nsrequest) != IP_NULL)) {
1841: mach_port_mscount_t mscount;
1842:
1843: dest->ip_nsrequest = IP_NULL;
1844: mscount = dest->ip_mscount;
1845: ip_unlock(dest);
1846:
1847: ipc_notify_no_senders(nsrequest, mscount);
1848: } else
1849: ip_unlock(dest);
1850:
1851: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
1852: MACH_MSGH_BITS(0, MACH_MSG_TYPE_PORT_SEND));
1853: msg->msgh_local_port = dest_name;
1854: msg->msgh_remote_port = MACH_PORT_NULL;
1855: return MACH_MSG_SUCCESS;
1856: }
1857:
1858: case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND,
1859: MACH_MSG_TYPE_PORT_SEND_ONCE): {
1860: ipc_entry_t table;
1861: mach_port_index_t index;
1862: ipc_entry_t entry;
1863: ipc_port_t reply = (ipc_port_t) msg->msgh_local_port;
1864: mach_port_t dest_name, reply_name;
1865: ipc_port_t nsrequest;
1866:
1867: /* receiving a request message */
1868:
1869: if (!IP_VALID(reply))
1870: break;
1871:
1872: is_write_lock(space);
1873: if (!space->is_active ||
1874: ((index = (table = space->is_table)->ie_next) == 0)) {
1875: is_write_unlock(space);
1876: break;
1877: }
1878:
1879: /*
1880: * To do an atomic copyout, need simultaneous
1881: * locks on both ports and the space. If
1882: * dest == reply, and simple locking is
1883: * enabled, then we will abort. Otherwise it's
1884: * OK to unlock twice.
1885: */
1886:
1887: ip_lock(dest);
1888: if (!ip_active(dest) || !ip_lock_try(reply)) {
1889: ip_unlock(dest);
1890: is_write_unlock(space);
1891: break;
1892: }
1893:
1894: if (!ip_active(reply)) {
1895: ip_unlock(reply);
1896: ip_unlock(dest);
1897: is_write_unlock(space);
1898: break;
1899: }
1900:
1901: assert(reply->ip_sorights > 0);
1902: ip_unlock(reply);
1903:
1904: /* optimized ipc_entry_get */
1905:
1906: entry = &table[index];
1907: table->ie_next = entry->ie_next;
1908: entry->ie_request = 0;
1909:
1910: {
1911: mach_port_gen_t gen;
1912:
1913: assert((entry->ie_bits &~ IE_BITS_GEN_MASK) == 0);
1914: gen = entry->ie_bits + IE_BITS_GEN_ONE;
1915:
1916: reply_name = MACH_PORT_MAKE(index, gen);
1917:
1918: /* optimized ipc_right_copyout */
1919:
1920: entry->ie_bits = gen | (MACH_PORT_TYPE_SEND_ONCE | 1);
1921: }
1922:
1923: assert(MACH_PORT_VALID(reply_name));
1924: entry->ie_object = (ipc_object_t) reply;
1925: is_write_unlock(space);
1926:
1927: /* optimized ipc_object_copyout_dest */
1928:
1929: assert(dest->ip_srights > 0);
1930: ip_release(dest);
1931:
1932: if (dest->ip_receiver == space)
1933: dest_name = dest->ip_receiver_name;
1934: else
1935: dest_name = MACH_PORT_NULL;
1936:
1937: if ((--dest->ip_srights == 0) &&
1938: ((nsrequest = dest->ip_nsrequest) != IP_NULL)) {
1939: mach_port_mscount_t mscount;
1940:
1941: dest->ip_nsrequest = IP_NULL;
1942: mscount = dest->ip_mscount;
1943: ip_unlock(dest);
1944:
1945: ipc_notify_no_senders(nsrequest, mscount);
1946: } else
1947: ip_unlock(dest);
1948:
1949: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
1950: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE,
1951: MACH_MSG_TYPE_PORT_SEND));
1952: msg->msgh_local_port = dest_name;
1953: msg->msgh_remote_port = reply_name;
1954: return MACH_MSG_SUCCESS;
1955: }
1956:
1957: case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, 0): {
1958: mach_port_t dest_name;
1959:
1960: /* receiving a reply message */
1961:
1962: ip_lock(dest);
1963: if (!ip_active(dest)) {
1964: ip_unlock(dest);
1965: break;
1966: }
1967:
1968: /* optimized ipc_object_copyout_dest */
1969:
1970: assert(dest->ip_sorights > 0);
1971:
1972: if (dest->ip_receiver == space) {
1973: ip_release(dest);
1974: dest->ip_sorights--;
1975: dest_name = dest->ip_receiver_name;
1976: ip_unlock(dest);
1977: } else {
1978: ip_unlock(dest);
1979:
1980: ipc_notify_send_once(dest);
1981: dest_name = MACH_PORT_NULL;
1982: }
1983:
1984: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
1985: MACH_MSGH_BITS(0, MACH_MSG_TYPE_PORT_SEND_ONCE));
1986: msg->msgh_local_port = dest_name;
1987: msg->msgh_remote_port = MACH_PORT_NULL;
1988: return MACH_MSG_SUCCESS;
1989: }
1990:
1991: default:
1992: /* don't bother optimizing */
1993: break;
1994: }
1995: #endif /* MIGRATING_THREADS */
1996:
1997: {
1998: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits);
1999: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits);
2000: ipc_port_t reply = (ipc_port_t) msg->msgh_local_port;
2001: mach_port_t dest_name, reply_name;
2002:
2003: if (IP_VALID(reply)) {
2004: ipc_port_t notify_port;
2005: ipc_entry_t entry;
2006: kern_return_t kr;
2007:
2008: /*
2009: * Handling notify (for MACH_RCV_NOTIFY) is tricky.
2010: * The problem is atomically making a send-once right
2011: * from the notify port and installing it for a
2012: * dead-name request in the new entry, because this
2013: * requires two port locks (on the notify port and
2014: * the reply port). However, we can safely make
2015: * and consume send-once rights for the notify port
2016: * as long as we hold the space locked. This isn't
2017: * an atomicity problem, because the only way
2018: * to detect that a send-once right has been created
2019: * and then consumed if it wasn't needed is by getting
2020: * at the receive right to look at ip_sorights, and
2021: * because the space is write-locked status calls can't
2022: * lookup the notify port receive right. When we make
2023: * the send-once right, we lock the notify port,
2024: * so any status calls in progress will be done.
2025: */
2026:
2027: is_write_lock(space);
2028:
2029: for (;;) {
2030: ipc_port_request_index_t request;
2031:
2032: if (!space->is_active) {
2033: is_write_unlock(space);
2034: return (MACH_RCV_HEADER_ERROR|
2035: MACH_MSG_IPC_SPACE);
2036: }
2037:
2038: if (notify != MACH_PORT_NULL) {
2039: notify_port = ipc_port_lookup_notify(space,
2040: notify);
2041: if (notify_port == IP_NULL) {
2042: is_write_unlock(space);
2043: return MACH_RCV_INVALID_NOTIFY;
2044: }
2045: } else
2046: notify_port = IP_NULL;
2047:
2048: if ((reply_type != MACH_MSG_TYPE_PORT_SEND_ONCE) &&
2049: ipc_right_reverse(space, (ipc_object_t) reply,
2050: &reply_name, &entry)) {
2051: /* reply port is locked and active */
2052:
2053: /*
2054: * We don't need the notify_port
2055: * send-once right, but we can't release
2056: * it here because reply port is locked.
2057: * Wait until after the copyout to
2058: * release the notify port right.
2059: */
2060:
2061: assert(entry->ie_bits &
2062: MACH_PORT_TYPE_SEND_RECEIVE);
2063: break;
2064: }
2065:
2066: ip_lock(reply);
2067: if (!ip_active(reply)) {
2068: ip_release(reply);
2069: ip_check_unlock(reply);
2070:
2071: if (notify_port != IP_NULL)
2072: ipc_port_release_sonce(notify_port);
2073:
2074: ip_lock(dest);
2075: is_write_unlock(space);
2076:
2077: reply = IP_DEAD;
2078: reply_name = MACH_PORT_DEAD;
2079: goto copyout_dest;
2080: }
2081:
2082: kr = ipc_entry_get(space, &reply_name, &entry);
2083: if (kr != KERN_SUCCESS) {
2084: ip_unlock(reply);
2085:
2086: if (notify_port != IP_NULL)
2087: ipc_port_release_sonce(notify_port);
2088:
2089: /* space is locked */
2090: kr = ipc_entry_grow_table(space);
2091: if (kr != KERN_SUCCESS) {
2092: /* space is unlocked */
2093:
2094: if (kr == KERN_RESOURCE_SHORTAGE)
2095: return (MACH_RCV_HEADER_ERROR|
2096: MACH_MSG_IPC_KERNEL);
2097: else
2098: return (MACH_RCV_HEADER_ERROR|
2099: MACH_MSG_IPC_SPACE);
2100: }
2101: /* space is locked again; start over */
2102:
2103: continue;
2104: }
2105:
2106: assert(IE_BITS_TYPE(entry->ie_bits)
2107: == MACH_PORT_TYPE_NONE);
2108: assert(entry->ie_object == IO_NULL);
2109:
2110: if (notify_port == IP_NULL) {
2111: /* not making a dead-name request */
2112:
2113: entry->ie_object = (ipc_object_t) reply;
2114: break;
2115: }
2116:
2117: kr = ipc_port_dnrequest(reply, reply_name,
2118: notify_port, &request);
2119: if (kr != KERN_SUCCESS) {
2120: ip_unlock(reply);
2121:
2122: ipc_port_release_sonce(notify_port);
2123:
2124: ipc_entry_dealloc(space, reply_name, entry);
2125: is_write_unlock(space);
2126:
2127: ip_lock(reply);
2128: if (!ip_active(reply)) {
2129: /* will fail next time around loop */
2130:
2131: ip_unlock(reply);
2132: is_write_lock(space);
2133: continue;
2134: }
2135:
2136: kr = ipc_port_dngrow(reply);
2137: /* port is unlocked */
2138: if (kr != KERN_SUCCESS)
2139: return (MACH_RCV_HEADER_ERROR|
2140: MACH_MSG_IPC_KERNEL);
2141:
2142: is_write_lock(space);
2143: continue;
2144: }
2145:
2146: notify_port = IP_NULL; /* don't release right below */
2147:
2148: entry->ie_object = (ipc_object_t) reply;
2149: entry->ie_request = request;
2150: break;
2151: }
2152:
2153: /* space and reply port are locked and active */
2154:
2155: ip_reference(reply); /* hold onto the reply port */
2156:
2157: kr = ipc_right_copyout(space, reply_name, entry,
2158: reply_type, TRUE, (ipc_object_t) reply);
2159: /* reply port is unlocked */
2160: assert(kr == KERN_SUCCESS);
2161:
2162: if (notify_port != IP_NULL)
2163: ipc_port_release_sonce(notify_port);
2164:
2165: ip_lock(dest);
2166: is_write_unlock(space);
2167: } else {
2168: /*
2169: * No reply port! This is an easy case.
2170: * We only need to have the space locked
2171: * when checking notify and when locking
2172: * the destination (to ensure atomicity).
2173: */
2174:
2175: is_read_lock(space);
2176: if (!space->is_active) {
2177: is_read_unlock(space);
2178: return MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_SPACE;
2179: }
2180:
2181: if (notify != MACH_PORT_NULL) {
2182: ipc_entry_t entry;
2183:
2184: /* must check notify even though it won't be used */
2185:
2186: if (((entry = ipc_entry_lookup(space, notify))
2187: == IE_NULL) ||
2188: ((entry->ie_bits & MACH_PORT_TYPE_RECEIVE) == 0)) {
2189: is_read_unlock(space);
2190: return MACH_RCV_INVALID_NOTIFY;
2191: }
2192: }
2193:
2194: ip_lock(dest);
2195: is_read_unlock(space);
2196:
2197: reply_name = (mach_port_t) reply;
2198: }
2199:
2200: /*
2201: * At this point, the space is unlocked and the destination
2202: * port is locked. (Lock taken while space was locked.)
2203: * reply_name is taken care of; we still need dest_name.
2204: * We still hold a ref for reply (if it is valid).
2205: *
2206: * If the space holds receive rights for the destination,
2207: * we return its name for the right. Otherwise the task
2208: * managed to destroy or give away the receive right between
2209: * receiving the message and this copyout. If the destination
2210: * is dead, return MACH_PORT_DEAD, and if the receive right
2211: * exists somewhere else (another space, in transit)
2212: * return MACH_PORT_NULL.
2213: *
2214: * Making this copyout operation atomic with the previous
2215: * copyout of the reply port is a bit tricky. If there was
2216: * no real reply port (it wasn't IP_VALID) then this isn't
2217: * an issue. If the reply port was dead at copyout time,
2218: * then we are OK, because if dest is dead we serialize
2219: * after the death of both ports and if dest is alive
2220: * we serialize after reply died but before dest's (later) death.
2221: * So assume reply was alive when we copied it out. If dest
2222: * is alive, then we are OK because we serialize before
2223: * the ports' deaths. So assume dest is dead when we look at it.
2224: * If reply dies/died after dest, then we are OK because
2225: * we serialize after dest died but before reply dies.
2226: * So the hard case is when reply is alive at copyout,
2227: * dest is dead at copyout, and reply died before dest died.
2228: * In this case pretend that dest is still alive, so
2229: * we serialize while both ports are alive.
2230: *
2231: * Because the space lock is held across the copyout of reply
2232: * and locking dest, the receive right for dest can't move
2233: * in or out of the space while the copyouts happen, so
2234: * that isn't an atomicity problem. In the last hard case
2235: * above, this implies that when dest is dead that the
2236: * space couldn't have had receive rights for dest at
2237: * the time reply was copied-out, so when we pretend
2238: * that dest is still alive, we can return MACH_PORT_NULL.
2239: *
2240: * If dest == reply, then we have to make it look like
2241: * either both copyouts happened before the port died,
2242: * or both happened after the port died. This special
2243: * case works naturally if the timestamp comparison
2244: * is done correctly.
2245: */
2246:
2247: copyout_dest:
2248:
2249: if (ip_active(dest)) {
2250: ipc_object_copyout_dest(space, (ipc_object_t) dest,
2251: dest_type, &dest_name);
2252: /* dest is unlocked */
2253: } else {
2254: ipc_port_timestamp_t timestamp;
2255:
2256: timestamp = dest->ip_timestamp;
2257: ip_release(dest);
2258: ip_check_unlock(dest);
2259:
2260: if (IP_VALID(reply)) {
2261: ip_lock(reply);
2262: if (ip_active(reply) ||
2263: IP_TIMESTAMP_ORDER(timestamp,
2264: reply->ip_timestamp))
2265: dest_name = MACH_PORT_DEAD;
2266: else
2267: dest_name = MACH_PORT_NULL;
2268: ip_unlock(reply);
2269: } else
2270: dest_name = MACH_PORT_DEAD;
2271: }
2272:
2273: if (IP_VALID(reply))
2274: ipc_port_release(reply);
2275:
2276: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
2277: MACH_MSGH_BITS(reply_type, dest_type));
2278: msg->msgh_local_port = dest_name;
2279: msg->msgh_remote_port = reply_name;
2280: }
2281:
2282: return MACH_MSG_SUCCESS;
2283: }
2284:
2285: /*
2286: * Routine: ipc_kmsg_copyout_object
2287: * Purpose:
2288: * Copy-out a port right. Always returns a name,
2289: * even for unsuccessful return codes. Always
2290: * consumes the supplied object.
2291: * Conditions:
2292: * Nothing locked.
2293: * Returns:
2294: * MACH_MSG_SUCCESS The space acquired the right
2295: * (name is valid) or the object is dead (MACH_PORT_DEAD).
2296: * MACH_MSG_IPC_SPACE No room in space for the right,
2297: * or the space is dead. (Name is MACH_PORT_NULL.)
2298: * MACH_MSG_IPC_KERNEL Kernel resource shortage.
2299: * (Name is MACH_PORT_NULL.)
2300: */
2301:
2302: mach_msg_return_t
2303: ipc_kmsg_copyout_object(space, object, msgt_name, namep)
2304: ipc_space_t space;
2305: ipc_object_t object;
2306: mach_msg_type_name_t msgt_name;
2307: mach_port_t *namep;
2308: {
2309: if (!IO_VALID(object)) {
2310: *namep = (mach_port_t) object;
2311: return MACH_MSG_SUCCESS;
2312: }
2313:
2314: #ifndef MIGRATING_THREADS
2315: /*
2316: * Attempt quick copyout of send rights. We optimize for a
2317: * live port for which the receiver holds send (and not
2318: * receive) rights in his local table.
2319: */
2320:
2321: if (msgt_name != MACH_MSG_TYPE_PORT_SEND)
2322: goto slow_copyout;
2323:
2324: {
2325: register ipc_port_t port = (ipc_port_t) object;
2326: ipc_entry_t entry;
2327:
2328: is_write_lock(space);
2329: if (!space->is_active) {
2330: is_write_unlock(space);
2331: goto slow_copyout;
2332: }
2333:
2334: ip_lock(port);
2335: if (!ip_active(port) ||
2336: !ipc_hash_local_lookup(space, (ipc_object_t) port,
2337: namep, &entry)) {
2338: ip_unlock(port);
2339: is_write_unlock(space);
2340: goto slow_copyout;
2341: }
2342:
2343: /*
2344: * Copyout the send right, incrementing urefs
2345: * unless it would overflow, and consume the right.
2346: */
2347:
2348: assert(port->ip_srights > 1);
2349: port->ip_srights--;
2350: ip_release(port);
2351: ip_unlock(port);
2352:
2353: assert(entry->ie_bits & MACH_PORT_TYPE_SEND);
2354: assert(IE_BITS_UREFS(entry->ie_bits) > 0);
2355: assert(IE_BITS_UREFS(entry->ie_bits) < MACH_PORT_UREFS_MAX);
2356:
2357: {
2358: register ipc_entry_bits_t bits = entry->ie_bits + 1;
2359:
2360: if (IE_BITS_UREFS(bits) < MACH_PORT_UREFS_MAX)
2361: entry->ie_bits = bits;
2362: }
2363:
2364: is_write_unlock(space);
2365: return MACH_MSG_SUCCESS;
2366: }
2367:
2368: slow_copyout:
2369: #endif /* MIGRATING_THREADS */
2370:
2371: {
2372: kern_return_t kr;
2373:
2374: kr = ipc_object_copyout(space, object, msgt_name, TRUE, namep);
2375: if (kr != KERN_SUCCESS) {
2376: ipc_object_destroy(object, msgt_name);
2377:
2378: if (kr == KERN_INVALID_CAPABILITY)
2379: *namep = MACH_PORT_DEAD;
2380: else {
2381: *namep = MACH_PORT_NULL;
2382:
2383: if (kr == KERN_RESOURCE_SHORTAGE)
2384: return MACH_MSG_IPC_KERNEL;
2385: else
2386: return MACH_MSG_IPC_SPACE;
2387: }
2388: }
2389:
2390: return MACH_MSG_SUCCESS;
2391: }
2392: }
2393:
2394: /*
2395: * Routine: ipc_kmsg_copyout_body
2396: * Purpose:
2397: * "Copy-out" port rights and out-of-line memory
2398: * in the body of a message.
2399: *
2400: * The error codes are a combination of special bits.
2401: * The copyout proceeds despite errors.
2402: * Conditions:
2403: * Nothing locked.
2404: * Returns:
2405: * MACH_MSG_SUCCESS Successful copyout.
2406: * MACH_MSG_IPC_SPACE No room for port right in name space.
2407: * MACH_MSG_VM_SPACE No room for memory in address space.
2408: * MACH_MSG_IPC_KERNEL Resource shortage handling port right.
2409: * MACH_MSG_VM_KERNEL Resource shortage handling memory.
2410: */
2411:
2412: mach_msg_return_t
2413: ipc_kmsg_copyout_body(saddr, eaddr, space, map)
2414: vm_offset_t saddr, eaddr;
2415: ipc_space_t space;
2416: vm_map_t map;
2417: {
2418: mach_msg_return_t mr = MACH_MSG_SUCCESS;
2419: kern_return_t kr;
2420:
2421: while (saddr < eaddr) {
2422: vm_offset_t taddr = saddr;
2423: mach_msg_type_long_t *type;
2424: mach_msg_type_name_t name;
2425: mach_msg_type_size_t size;
2426: mach_msg_type_number_t number;
2427: boolean_t is_inline, longform, is_port;
2428: vm_size_t length;
2429: vm_offset_t addr;
2430:
2431: type = (mach_msg_type_long_t *) saddr;
2432: is_inline = ((mach_msg_type_t*)type)->msgt_inline;
2433: longform = ((mach_msg_type_t*)type)->msgt_longform;
2434: if (longform) {
2435: /* This must be aligned */
2436: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
2437: (is_misaligned(type))) {
2438: saddr = ptr_align(saddr);
2439: continue;
2440: }
2441: name = type->msgtl_name;
2442: size = type->msgtl_size;
2443: number = type->msgtl_number;
2444: saddr += sizeof(mach_msg_type_long_t);
2445: } else {
2446: name = ((mach_msg_type_t*)type)->msgt_name;
2447: size = ((mach_msg_type_t*)type)->msgt_size;
2448: number = ((mach_msg_type_t*)type)->msgt_number;
2449: saddr += sizeof(mach_msg_type_t);
2450: }
2451:
2452: /* padding (ptrs and ports) ? */
2453: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
2454: ((size >> 3) == sizeof(natural_t)))
2455: saddr = ptr_align(saddr);
2456:
2457: /* calculate length of data in bytes, rounding up */
2458:
2459: length = ((number * size) + 7) >> 3;
2460:
2461: is_port = MACH_MSG_TYPE_PORT_ANY(name);
2462:
2463: if (is_port) {
2464: mach_port_t *objects;
2465: mach_msg_type_number_t i;
2466:
2467: if (!is_inline && (length != 0)) {
2468: /* first allocate memory in the map */
2469:
2470: kr = vm_allocate(map, &addr, length, TRUE);
2471: if (kr != KERN_SUCCESS) {
2472: ipc_kmsg_clean_body(taddr, saddr);
2473: goto vm_copyout_failure;
2474: }
2475: }
2476:
2477: objects = (mach_port_t *)
2478: (is_inline ? saddr : * (vm_offset_t *) saddr);
2479:
2480: /* copyout port rights carried in the message */
2481:
2482: for (i = 0; i < number; i++) {
2483: ipc_object_t object =
2484: (ipc_object_t) objects[i];
2485:
2486: mr |= ipc_kmsg_copyout_object(space, object,
2487: name, &objects[i]);
2488: }
2489: }
2490:
2491: if (is_inline) {
2492: /* inline data sizes round up to int boundaries */
2493:
2494: ((mach_msg_type_t*)type)->msgt_deallocate = FALSE;
2495: saddr += (length + 3) &~ 3;
2496: } else {
2497: vm_offset_t data;
2498:
2499: if (sizeof(vm_offset_t) > sizeof(mach_msg_type_t))
2500: saddr = ptr_align(saddr);
2501:
2502: data = * (vm_offset_t *) saddr;
2503:
2504: /* copyout memory carried in the message */
2505:
2506: if (length == 0) {
2507: assert(data == 0);
2508: addr = 0;
2509: } else if (is_port) {
2510: /* copyout to memory allocated above */
2511:
2512: (void) copyoutmap(map, (char *) data,
2513: (char *) addr, length);
2514: kfree(data, length);
2515: } else {
2516: vm_map_copy_t copy = (vm_map_copy_t) data;
2517:
2518: kr = vm_map_copyout(map, &addr, copy);
2519: if (kr != KERN_SUCCESS) {
2520: vm_map_copy_discard(copy);
2521:
2522: vm_copyout_failure:
2523:
2524: addr = 0;
2525: if (longform)
2526: type->msgtl_size = 0;
2527: else
2528: ((mach_msg_type_t*)type)->msgt_size = 0;
2529:
2530: if (kr == KERN_RESOURCE_SHORTAGE)
2531: mr |= MACH_MSG_VM_KERNEL;
2532: else
2533: mr |= MACH_MSG_VM_SPACE;
2534: }
2535: }
2536:
2537: ((mach_msg_type_t*)type)->msgt_deallocate = TRUE;
2538: * (vm_offset_t *) saddr = addr;
2539: saddr += sizeof(vm_offset_t);
2540: }
2541: }
2542:
2543: return mr;
2544: }
2545:
2546: /*
2547: * Routine: ipc_kmsg_copyout
2548: * Purpose:
2549: * "Copy-out" port rights and out-of-line memory
2550: * in the message.
2551: * Conditions:
2552: * Nothing locked.
2553: * Returns:
2554: * MACH_MSG_SUCCESS Copied out all rights and memory.
2555: * MACH_RCV_INVALID_NOTIFY Bad notify port.
2556: * Rights and memory in the message are intact.
2557: * MACH_RCV_HEADER_ERROR + special bits
2558: * Rights and memory in the message are intact.
2559: * MACH_RCV_BODY_ERROR + special bits
2560: * The message header was successfully copied out.
2561: * As much of the body was handled as possible.
2562: */
2563:
2564: mach_msg_return_t
2565: ipc_kmsg_copyout(kmsg, space, map, notify)
2566: ipc_kmsg_t kmsg;
2567: ipc_space_t space;
2568: vm_map_t map;
2569: mach_port_t notify;
2570: {
2571: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits;
2572: mach_msg_return_t mr;
2573:
2574: mr = ipc_kmsg_copyout_header(&kmsg->ikm_header, space, notify);
2575: if (mr != MACH_MSG_SUCCESS)
2576: return mr;
2577:
2578: if (mbits & MACH_MSGH_BITS_COMPLEX) {
2579: vm_offset_t saddr, eaddr;
2580:
2581: saddr = (vm_offset_t) (&kmsg->ikm_header + 1);
2582: eaddr = (vm_offset_t) &kmsg->ikm_header +
2583: kmsg->ikm_header.msgh_size;
2584:
2585: mr = ipc_kmsg_copyout_body(saddr, eaddr, space, map);
2586: if (mr != MACH_MSG_SUCCESS)
2587: mr |= MACH_RCV_BODY_ERROR;
2588: }
2589:
2590: return mr;
2591: }
2592:
2593: /*
2594: * Routine: ipc_kmsg_copyout_pseudo
2595: * Purpose:
2596: * Does a pseudo-copyout of the message.
2597: * This is like a regular copyout, except
2598: * that the ports in the header are handled
2599: * as if they are in the body. They aren't reversed.
2600: *
2601: * The error codes are a combination of special bits.
2602: * The copyout proceeds despite errors.
2603: * Conditions:
2604: * Nothing locked.
2605: * Returns:
2606: * MACH_MSG_SUCCESS Successful copyout.
2607: * MACH_MSG_IPC_SPACE No room for port right in name space.
2608: * MACH_MSG_VM_SPACE No room for memory in address space.
2609: * MACH_MSG_IPC_KERNEL Resource shortage handling port right.
2610: * MACH_MSG_VM_KERNEL Resource shortage handling memory.
2611: */
2612:
2613: mach_msg_return_t
2614: ipc_kmsg_copyout_pseudo(
2615: ipc_kmsg_t kmsg,
2616: ipc_space_t space,
2617: vm_map_t map)
2618: {
2619: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits;
2620: ipc_object_t dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port;
2621: ipc_object_t reply = (ipc_object_t) kmsg->ikm_header.msgh_local_port;
2622: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits);
2623: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits);
2624: mach_port_t dest_name, reply_name;
2625: mach_msg_return_t mr;
2626:
2627: assert(IO_VALID(dest));
2628:
2629: mr = (ipc_kmsg_copyout_object(space, dest, dest_type, &dest_name) |
2630: ipc_kmsg_copyout_object(space, reply, reply_type, &reply_name));
2631:
2632: kmsg->ikm_header.msgh_bits = mbits &~ MACH_MSGH_BITS_CIRCULAR;
2633: kmsg->ikm_header.msgh_remote_port = dest_name;
2634: kmsg->ikm_header.msgh_local_port = reply_name;
2635:
2636: if (mbits & MACH_MSGH_BITS_COMPLEX) {
2637: vm_offset_t saddr, eaddr;
2638:
2639: saddr = (vm_offset_t) (&kmsg->ikm_header + 1);
2640: eaddr = (vm_offset_t) &kmsg->ikm_header +
2641: kmsg->ikm_header.msgh_size;
2642:
2643: mr |= ipc_kmsg_copyout_body(saddr, eaddr, space, map);
2644: }
2645:
2646: return mr;
2647: }
2648:
2649: /*
2650: * Routine: ipc_kmsg_copyout_dest
2651: * Purpose:
2652: * Copies out the destination port in the message.
2653: * Destroys all other rights and memory in the message.
2654: * Conditions:
2655: * Nothing locked.
2656: */
2657:
2658: void
2659: ipc_kmsg_copyout_dest(kmsg, space)
2660: ipc_kmsg_t kmsg;
2661: ipc_space_t space;
2662: {
2663: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits;
2664: ipc_object_t dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port;
2665: ipc_object_t reply = (ipc_object_t) kmsg->ikm_header.msgh_local_port;
2666: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits);
2667: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits);
2668: mach_port_t dest_name, reply_name;
2669:
2670: assert(IO_VALID(dest));
2671:
2672: io_lock(dest);
2673: if (io_active(dest)) {
2674: ipc_object_copyout_dest(space, dest, dest_type, &dest_name);
2675: /* dest is unlocked */
2676: } else {
2677: io_release(dest);
2678: io_check_unlock(dest);
2679: dest_name = MACH_PORT_DEAD;
2680: }
2681:
2682: if (IO_VALID(reply)) {
2683: ipc_object_destroy(reply, reply_type);
2684: reply_name = MACH_PORT_NULL;
2685: } else
2686: reply_name = (mach_port_t) reply;
2687:
2688: kmsg->ikm_header.msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
2689: MACH_MSGH_BITS(reply_type, dest_type));
2690: kmsg->ikm_header.msgh_local_port = dest_name;
2691: kmsg->ikm_header.msgh_remote_port = reply_name;
2692:
2693: if (mbits & MACH_MSGH_BITS_COMPLEX) {
2694: vm_offset_t saddr, eaddr;
2695:
2696: saddr = (vm_offset_t) (&kmsg->ikm_header + 1);
2697: eaddr = (vm_offset_t) &kmsg->ikm_header +
2698: kmsg->ikm_header.msgh_size;
2699:
2700: ipc_kmsg_clean_body(saddr, eaddr);
2701: }
2702: }
2703:
2704: #if NORMA_IPC || NORMA_VM
2705: /*
2706: * Routine: ipc_kmsg_copyout_to_kernel
2707: * Purpose:
2708: * Copies out the destination and reply ports in the message.
2709: * Leaves all other rights and memory in the message alone.
2710: * Conditions:
2711: * Nothing locked.
2712: *
2713: * Derived from ipc_kmsg_copyout_dest.
2714: * Use by mach_msg_rpc_from_kernel (which used to use copyout_dest).
2715: * We really do want to save rights and memory.
2716: */
2717:
2718: void
2719: ipc_kmsg_copyout_to_kernel(kmsg, space)
2720: ipc_kmsg_t kmsg;
2721: ipc_space_t space;
2722: {
2723: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits;
2724: ipc_object_t dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port;
2725: ipc_object_t reply = (ipc_object_t) kmsg->ikm_header.msgh_local_port;
2726: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits);
2727: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits);
2728: mach_port_t dest_name, reply_name;
2729:
2730: assert(IO_VALID(dest));
2731:
2732: io_lock(dest);
2733: if (io_active(dest)) {
2734: ipc_object_copyout_dest(space, dest, dest_type, &dest_name);
2735: /* dest is unlocked */
2736: } else {
2737: io_release(dest);
2738: io_check_unlock(dest);
2739: dest_name = MACH_PORT_DEAD;
2740: }
2741:
2742: reply_name = (mach_port_t) reply;
2743:
2744: kmsg->ikm_header.msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) |
2745: MACH_MSGH_BITS(reply_type, dest_type));
2746: kmsg->ikm_header.msgh_local_port = dest_name;
2747: kmsg->ikm_header.msgh_remote_port = reply_name;
2748: }
2749: #endif /* NORMA_IPC || NORMA_VM */
2750:
2751: #if MACH_IPC_COMPAT
2752:
2753: /*
2754: * Routine: ipc_kmsg_copyin_compat
2755: * Purpose:
2756: * "Copy-in" port rights and out-of-line memory
2757: * in the message.
2758: *
2759: * In all failure cases, the message is left holding
2760: * no rights or memory. However, the message buffer
2761: * is not deallocated. If successful, the message
2762: * contains a valid destination port.
2763: * Conditions:
2764: * Nothing locked.
2765: * Returns:
2766: * MACH_MSG_SUCCESS Successful copyin.
2767: * MACH_SEND_INVALID_DEST Can't copyin destination port.
2768: * MACH_SEND_INVALID_REPLY Can't copyin reply port.
2769: * MACH_SEND_INVALID_MEMORY Can't grab out-of-line memory.
2770: * MACH_SEND_INVALID_RIGHT Can't copyin port right in body.
2771: * MACH_SEND_INVALID_TYPE Bad type specification.
2772: * MACH_SEND_MSG_TOO_SMALL Body is too small for types/data.
2773: */
2774:
2775: mach_msg_return_t
2776: ipc_kmsg_copyin_compat(kmsg, space, map)
2777: ipc_kmsg_t kmsg;
2778: ipc_space_t space;
2779: vm_map_t map;
2780: {
2781: msg_header_t msg;
2782: mach_port_t dest_name;
2783: mach_port_t reply_name;
2784: ipc_object_t dest, reply;
2785: mach_msg_type_name_t dest_type, reply_type;
2786: vm_offset_t saddr, eaddr;
2787: boolean_t complex;
2788: kern_return_t kr;
2789: boolean_t use_page_lists, steal_pages;
2790:
2791: msg = * (msg_header_t *) &kmsg->ikm_header;
2792: dest_name = (mach_port_t) msg.msg_remote_port;
2793: reply_name = (mach_port_t) msg.msg_local_port;
2794:
2795: /* translate the destination and reply ports */
2796:
2797: kr = ipc_object_copyin_header(space, dest_name, &dest, &dest_type);
2798: if (kr != KERN_SUCCESS)
2799: return MACH_SEND_INVALID_DEST;
2800:
2801: if (reply_name == MACH_PORT_NULL) {
2802: reply = IO_NULL;
2803: reply_type = 0;
2804: } else {
2805: kr = ipc_object_copyin_header(space, reply_name,
2806: &reply, &reply_type);
2807: if (kr != KERN_SUCCESS) {
2808: ipc_object_destroy(dest, dest_type);
2809: return MACH_SEND_INVALID_REPLY;
2810: }
2811: }
2812:
2813: kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS(dest_type, reply_type);
2814: kmsg->ikm_header.msgh_size = (mach_msg_size_t) msg.msg_size;
2815: kmsg->ikm_header.msgh_remote_port = (mach_port_t) dest;
2816: kmsg->ikm_header.msgh_local_port = (mach_port_t) reply;
2817: kmsg->ikm_header.msgh_seqno = (mach_msg_kind_t) msg.msg_type;
2818: kmsg->ikm_header.msgh_id = (mach_msg_id_t) msg.msg_id;
2819:
2820: if (msg.msg_simple)
2821: return MACH_MSG_SUCCESS;
2822:
2823: complex = FALSE;
2824: use_page_lists = ipc_kobject_vm_page_list(ip_kotype((ipc_port_t)dest));
2825: steal_pages = ipc_kobject_vm_page_steal(ip_kotype((ipc_port_t)dest));
2826:
2827: #if NORMA_IPC
2828: if (IP_NORMA_IS_PROXY((ipc_port_t) dest)) {
2829: use_page_lists = TRUE;
2830: steal_pages = TRUE;
2831: }
2832: #endif /* NORMA_IPC */
2833:
2834: saddr = (vm_offset_t) (&kmsg->ikm_header + 1);
2835: eaddr = (vm_offset_t) &kmsg->ikm_header + kmsg->ikm_header.msgh_size;
2836:
2837: while (saddr < eaddr) {
2838: vm_offset_t taddr = saddr;
2839: mach_msg_type_long_t *type;
2840: mach_msg_type_name_t name;
2841: mach_msg_type_size_t size;
2842: mach_msg_type_number_t number;
2843: boolean_t is_inline, longform, dealloc, is_port;
2844: vm_offset_t data;
2845: vm_size_t length;
2846:
2847: type = (mach_msg_type_long_t *) saddr;
2848:
2849: if (((eaddr - saddr) < sizeof(mach_msg_type_t)) ||
2850: ((longform = ((mach_msg_type_t*)type)->msgt_longform) &&
2851: ((eaddr - saddr) < sizeof(mach_msg_type_long_t)))) {
2852: ipc_kmsg_clean_partial(kmsg, taddr, FALSE, 0);
2853: return MACH_SEND_MSG_TOO_SMALL;
2854: }
2855:
2856: is_inline = ((mach_msg_type_t*)type)->msgt_inline;
2857: dealloc = ((mach_msg_type_t*)type)->msgt_deallocate;
2858: if (longform) {
2859: /* This must be aligned */
2860: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
2861: (is_misaligned(type))) {
2862: saddr = ptr_align(saddr);
2863: continue;
2864: }
2865: name = type->msgtl_name;
2866: size = type->msgtl_size;
2867: number = type->msgtl_number;
2868: saddr += sizeof(mach_msg_type_long_t);
2869: } else {
2870: name = ((mach_msg_type_t*)type)->msgt_name;
2871: size = ((mach_msg_type_t*)type)->msgt_size;
2872: number = ((mach_msg_type_t*)type)->msgt_number;
2873: saddr += sizeof(mach_msg_type_t);
2874: }
2875:
2876: is_port = MSG_TYPE_PORT_ANY(name);
2877:
2878: if (is_port && (size != PORT_T_SIZE_IN_BITS)) {
2879: ipc_kmsg_clean_partial(kmsg, taddr, FALSE, 0);
2880: return MACH_SEND_INVALID_TYPE;
2881: }
2882:
2883: /*
2884: * New IPC says these should be zero, but old IPC
2885: * tasks often leave them with random values. So
2886: * we have to clear them.
2887: */
2888:
2889: ((mach_msg_type_t*)type)->msgt_unused = 0;
2890: if (longform) {
2891: type->msgtl_header.msgt_name = 0;
2892: type->msgtl_header.msgt_size = 0;
2893: type->msgtl_header.msgt_number = 0;
2894: }
2895:
2896: /* padding (ptrs and ports) ? */
2897: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
2898: ((size >> 3) == sizeof(natural_t)))
2899: saddr = ptr_align(saddr);
2900:
2901: /* calculate length of data in bytes, rounding up */
2902:
2903: length = ((number * size) + 7) >> 3;
2904:
2905: if (is_inline) {
2906: vm_size_t amount;
2907:
2908: /* inline data sizes round up to int boundaries */
2909:
2910: amount = (length + 3) &~ 3;
2911: if ((eaddr - saddr) < amount) {
2912: ipc_kmsg_clean_partial(kmsg, taddr, FALSE, 0);
2913: return MACH_SEND_MSG_TOO_SMALL;
2914: }
2915:
2916: data = saddr;
2917: saddr += amount;
2918: } else {
2919: vm_offset_t addr;
2920:
2921: if ((eaddr - saddr) < sizeof(vm_offset_t)) {
2922: ipc_kmsg_clean_partial(kmsg, taddr, FALSE, 0);
2923: return MACH_SEND_MSG_TOO_SMALL;
2924: }
2925:
2926: /* grab the out-of-line data */
2927:
2928: addr = * (vm_offset_t *) saddr;
2929:
2930: if (length == 0)
2931: data = 0;
2932: else if (is_port) {
2933: data = kalloc(length);
2934: if (data == 0)
2935: goto invalid_memory;
2936:
2937: if (copyinmap(map, (char *) addr,
2938: (char *) data, length) ||
2939: (dealloc &&
2940: (vm_deallocate(map, addr, length) !=
2941: KERN_SUCCESS))) {
2942: kfree(data, length);
2943: goto invalid_memory;
2944: }
2945: } else {
2946: vm_map_copy_t copy;
2947:
2948: if (use_page_lists) {
2949: kr = vm_map_copyin_page_list(map,
2950: addr, length, dealloc,
2951: steal_pages, ©, FALSE);
2952: } else {
2953: kr = vm_map_copyin(map, addr, length,
2954: dealloc,
2955: ©);
2956: }
2957: if (kr != KERN_SUCCESS) {
2958: invalid_memory:
2959: ipc_kmsg_clean_partial(kmsg, taddr,
2960: FALSE, 0);
2961: return MACH_SEND_INVALID_MEMORY;
2962: }
2963:
2964: data = (vm_offset_t) copy;
2965: }
2966:
2967: * (vm_offset_t *) saddr = data;
2968: saddr += sizeof(vm_offset_t);
2969: complex = TRUE;
2970: }
2971:
2972: if (is_port) {
2973: mach_msg_type_name_t newname =
2974: ipc_object_copyin_type(name);
2975: ipc_object_t *objects = (ipc_object_t *) data;
2976: mach_msg_type_number_t i;
2977:
2978: if (longform)
2979: type->msgtl_name = newname;
2980: else
2981: ((mach_msg_type_t*)type)->msgt_name = newname;
2982:
2983: for (i = 0; i < number; i++) {
2984: mach_port_t port = (mach_port_t) objects[i];
2985: ipc_object_t object;
2986:
2987: if (!MACH_PORT_VALID(port))
2988: continue;
2989:
2990: kr = ipc_object_copyin_compat(space, port,
2991: name, dealloc, &object);
2992: if (kr != KERN_SUCCESS) {
2993: ipc_kmsg_clean_partial(kmsg, taddr,
2994: TRUE, i);
2995: return MACH_SEND_INVALID_RIGHT;
2996: }
2997:
2998: if ((newname == MACH_MSG_TYPE_PORT_RECEIVE) &&
2999: ipc_port_check_circularity(
3000: (ipc_port_t) object,
3001: (ipc_port_t) dest))
3002: kmsg->ikm_header.msgh_bits |=
3003: MACH_MSGH_BITS_CIRCULAR;
3004:
3005: objects[i] = object;
3006: }
3007:
3008: complex = TRUE;
3009: }
3010: }
3011:
3012: if (complex)
3013: kmsg->ikm_header.msgh_bits |= MACH_MSGH_BITS_COMPLEX;
3014:
3015: return MACH_MSG_SUCCESS;
3016: }
3017:
3018: /*
3019: * Routine: ipc_kmsg_copyout_compat
3020: * Purpose:
3021: * "Copy-out" port rights and out-of-line memory
3022: * in the message, producing an old IPC message.
3023: *
3024: * Doesn't bother to handle the header atomically.
3025: * Skips over errors. Problem ports produce MACH_PORT_NULL
3026: * (MACH_PORT_DEAD is never produced), and problem memory
3027: * produces a zero address.
3028: * Conditions:
3029: * Nothing locked.
3030: * Returns:
3031: * MACH_MSG_SUCCESS Copied out rights and memory.
3032: */
3033:
3034: mach_msg_return_t
3035: ipc_kmsg_copyout_compat(kmsg, space, map)
3036: ipc_kmsg_t kmsg;
3037: ipc_space_t space;
3038: vm_map_t map;
3039: {
3040: msg_header_t msg;
3041: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits;
3042: ipc_object_t dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port;
3043: ipc_object_t reply = (ipc_object_t) kmsg->ikm_header.msgh_local_port;
3044: mach_port_t dest_name, reply_name;
3045: vm_offset_t saddr, eaddr;
3046: kern_return_t kr;
3047:
3048: assert(IO_VALID(dest));
3049:
3050: io_lock(dest);
3051: if (io_active(dest)) {
3052: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits);
3053:
3054: ipc_object_copyout_dest(space, dest, dest_type, &dest_name);
3055: /* dest is unlocked */
3056: } else {
3057: io_release(dest);
3058: io_check_unlock(dest);
3059: dest_name = MACH_PORT_NULL;
3060: }
3061:
3062: if (IO_VALID(reply)) {
3063: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits);
3064:
3065: kr = ipc_object_copyout_compat(space, reply, reply_type,
3066: &reply_name);
3067: if (kr != KERN_SUCCESS) {
3068: ipc_object_destroy(reply, reply_type);
3069: reply_name = MACH_PORT_NULL;
3070: }
3071: } else
3072: reply_name = MACH_PORT_NULL;
3073:
3074: msg.msg_unused = 0;
3075: msg.msg_simple = (mbits & MACH_MSGH_BITS_COMPLEX) ? FALSE : TRUE;
3076: msg.msg_size = (msg_size_t) kmsg->ikm_header.msgh_size;
3077: msg.msg_type = (integer_t) kmsg->ikm_header.msgh_seqno;
3078: msg.msg_local_port = (port_name_t) dest_name;
3079: msg.msg_remote_port = (port_name_t) reply_name;
3080: msg.msg_id = (integer_t) kmsg->ikm_header.msgh_id;
3081: * (msg_header_t *) &kmsg->ikm_header = msg;
3082:
3083: if (msg.msg_simple)
3084: return MACH_MSG_SUCCESS;
3085:
3086: saddr = (vm_offset_t) (&kmsg->ikm_header + 1);
3087: eaddr = (vm_offset_t) &kmsg->ikm_header + kmsg->ikm_header.msgh_size;
3088:
3089: while (saddr < eaddr) {
3090: vm_offset_t taddr = saddr;
3091: mach_msg_type_long_t *type;
3092: mach_msg_type_name_t name;
3093: mach_msg_type_size_t size;
3094: mach_msg_type_number_t number;
3095: boolean_t is_inline, longform, is_port;
3096: vm_size_t length;
3097: vm_offset_t addr;
3098:
3099: type = (mach_msg_type_long_t *) saddr;
3100: is_inline = ((mach_msg_type_t*)type)->msgt_inline;
3101: longform = ((mach_msg_type_t*)type)->msgt_longform;
3102: if (longform) {
3103: /* This must be aligned */
3104: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
3105: (is_misaligned(type))) {
3106: saddr = ptr_align(saddr);
3107: continue;
3108: }
3109: name = type->msgtl_name;
3110: size = type->msgtl_size;
3111: number = type->msgtl_number;
3112: saddr += sizeof(mach_msg_type_long_t);
3113: } else {
3114: name = ((mach_msg_type_t*)type)->msgt_name;
3115: size = ((mach_msg_type_t*)type)->msgt_size;
3116: number = ((mach_msg_type_t*)type)->msgt_number;
3117: saddr += sizeof(mach_msg_type_t);
3118: }
3119:
3120: /* padding (ptrs and ports) ? */
3121: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
3122: ((size >> 3) == sizeof(natural_t)))
3123: saddr = ptr_align(saddr);
3124:
3125: /* calculate length of data in bytes, rounding up */
3126:
3127: length = ((number * size) + 7) >> 3;
3128:
3129: is_port = MACH_MSG_TYPE_PORT_ANY(name);
3130:
3131: if (is_port) {
3132: mach_port_t *objects;
3133: mach_msg_type_number_t i;
3134: mach_msg_type_name_t newname;
3135:
3136: if (!is_inline && (length != 0)) {
3137: /* first allocate memory in the map */
3138:
3139: kr = vm_allocate(map, &addr, length, TRUE);
3140: if (kr != KERN_SUCCESS) {
3141: ipc_kmsg_clean_body(taddr, saddr);
3142: goto vm_copyout_failure;
3143: }
3144: }
3145:
3146: newname = ipc_object_copyout_type_compat(name);
3147: if (longform)
3148: type->msgtl_name = newname;
3149: else
3150: ((mach_msg_type_t*)type)->msgt_name = newname;
3151:
3152: objects = (mach_port_t *)
3153: (is_inline ? saddr : * (vm_offset_t *) saddr);
3154:
3155: /* copyout port rights carried in the message */
3156:
3157: for (i = 0; i < number; i++) {
3158: ipc_object_t object =
3159: (ipc_object_t) objects[i];
3160:
3161: if (!IO_VALID(object)) {
3162: objects[i] = MACH_PORT_NULL;
3163: continue;
3164: }
3165:
3166: kr = ipc_object_copyout_compat(space, object,
3167: name, &objects[i]);
3168: if (kr != KERN_SUCCESS) {
3169: ipc_object_destroy(object, name);
3170: objects[i] = MACH_PORT_NULL;
3171: }
3172: }
3173: }
3174:
3175: if (is_inline) {
3176: /* inline data sizes round up to int boundaries */
3177:
3178: saddr += (length + 3) &~ 3;
3179: } else {
3180: vm_offset_t data = * (vm_offset_t *) saddr;
3181:
3182: /* copyout memory carried in the message */
3183:
3184: if (length == 0) {
3185: assert(data == 0);
3186: addr = 0;
3187: } else if (is_port) {
3188: /* copyout to memory allocated above */
3189:
3190: (void) copyoutmap(map, (char *) data,
3191: (char *) addr, length);
3192: kfree(data, length);
3193: } else {
3194: vm_map_copy_t copy = (vm_map_copy_t) data;
3195:
3196: kr = vm_map_copyout(map, &addr, copy);
3197: if (kr != KERN_SUCCESS) {
3198: vm_map_copy_discard(copy);
3199:
3200: vm_copyout_failure:
3201:
3202: addr = 0;
3203: }
3204: }
3205:
3206: * (vm_offset_t *) saddr = addr;
3207: saddr += sizeof(vm_offset_t);
3208: }
3209: }
3210:
3211: return MACH_MSG_SUCCESS;
3212: }
3213:
3214: #endif /* MACH_IPC_COMPAT */
3215:
3216: #include <mach_kdb.h>
3217: #if MACH_KDB
3218:
3219: char *
3220: ipc_type_name(type_name, received)
3221: int type_name;
3222: boolean_t received;
3223: {
3224: switch (type_name) {
3225: case MACH_MSG_TYPE_BOOLEAN:
3226: return "boolean";
3227:
3228: case MACH_MSG_TYPE_INTEGER_16:
3229: return "short";
3230:
3231: case MACH_MSG_TYPE_INTEGER_32:
3232: return "int32";
3233:
3234: case MACH_MSG_TYPE_INTEGER_64:
3235: return "int64";
3236:
3237: case MACH_MSG_TYPE_CHAR:
3238: return "char";
3239:
3240: case MACH_MSG_TYPE_BYTE:
3241: return "byte";
3242:
3243: case MACH_MSG_TYPE_REAL:
3244: return "real";
3245:
3246: case MACH_MSG_TYPE_STRING:
3247: return "string";
3248:
3249: case MACH_MSG_TYPE_PORT_NAME:
3250: return "port_name";
3251:
3252: case MACH_MSG_TYPE_MOVE_RECEIVE:
3253: if (received) {
3254: return "port_receive";
3255: } else {
3256: return "move_receive";
3257: }
3258:
3259: case MACH_MSG_TYPE_MOVE_SEND:
3260: if (received) {
3261: return "port_send";
3262: } else {
3263: return "move_send";
3264: }
3265:
3266: case MACH_MSG_TYPE_MOVE_SEND_ONCE:
3267: if (received) {
3268: return "port_send_once";
3269: } else {
3270: return "move_send_once";
3271: }
3272:
3273: case MACH_MSG_TYPE_COPY_SEND:
3274: return "copy_send";
3275:
3276: case MACH_MSG_TYPE_MAKE_SEND:
3277: return "make_send";
3278:
3279: case MACH_MSG_TYPE_MAKE_SEND_ONCE:
3280: return "make_send_once";
3281:
3282: default:
3283: return (char *) 0;
3284: }
3285: }
3286:
3287: void
3288: ipc_print_type_name(
3289: int type_name)
3290: {
3291: char *name = ipc_type_name(type_name, TRUE);
3292: if (name) {
3293: printf("%s", name);
3294: } else {
3295: printf("type%d", type_name);
3296: }
3297: }
3298:
3299: /*
3300: * ipc_kmsg_print [ debug ]
3301: */
3302: void
3303: ipc_kmsg_print(kmsg)
3304: ipc_kmsg_t kmsg;
3305: {
3306: db_printf("kmsg=0x%x\n", kmsg);
3307: db_printf("ikm_next=0x%x,prev=0x%x,size=%d,marequest=0x%x",
3308: kmsg->ikm_next,
3309: kmsg->ikm_prev,
3310: kmsg->ikm_size,
3311: kmsg->ikm_marequest);
3312: #if NORMA_IPC
3313: db_printf(",page=0x%x,copy=0x%x\n",
3314: kmsg->ikm_page,
3315: kmsg->ikm_copy);
3316: #else /* NORMA_IPC */
3317: db_printf("\n");
3318: #endif /* NORMA_IPC */
3319: ipc_msg_print(&kmsg->ikm_header);
3320: }
3321:
3322: /*
3323: * ipc_msg_print [ debug ]
3324: */
3325: void
3326: ipc_msg_print(msgh)
3327: mach_msg_header_t *msgh;
3328: {
3329: vm_offset_t saddr, eaddr;
3330:
3331: db_printf("msgh_bits=0x%x: ", msgh->msgh_bits);
3332: if (msgh->msgh_bits & MACH_MSGH_BITS_COMPLEX) {
3333: db_printf("complex,");
3334: }
3335: if (msgh->msgh_bits & MACH_MSGH_BITS_CIRCULAR) {
3336: db_printf("circular,");
3337: }
3338: if (msgh->msgh_bits & MACH_MSGH_BITS_COMPLEX_PORTS) {
3339: db_printf("complex_ports,");
3340: }
3341: if (msgh->msgh_bits & MACH_MSGH_BITS_COMPLEX_DATA) {
3342: db_printf("complex_data,");
3343: }
3344: if (msgh->msgh_bits & MACH_MSGH_BITS_MIGRATED) {
3345: db_printf("migrated,");
3346: }
3347: if (msgh->msgh_bits & MACH_MSGH_BITS_UNUSED) {
3348: db_printf("unused=0x%x,",
3349: msgh->msgh_bits & MACH_MSGH_BITS_UNUSED);
3350: }
3351: db_printf("l=0x%x,r=0x%x\n",
3352: MACH_MSGH_BITS_LOCAL(msgh->msgh_bits),
3353: MACH_MSGH_BITS_REMOTE(msgh->msgh_bits));
3354:
3355: db_printf("msgh_id=%d,size=%d,seqno=%d,",
3356: msgh->msgh_id,
3357: msgh->msgh_size,
3358: msgh->msgh_seqno);
3359:
3360: if (msgh->msgh_remote_port) {
3361: db_printf("remote=0x%x(", msgh->msgh_remote_port);
3362: ipc_print_type_name(MACH_MSGH_BITS_REMOTE(msgh->msgh_bits));
3363: db_printf("),");
3364: } else {
3365: db_printf("remote=null,\n");
3366: }
3367:
3368: if (msgh->msgh_local_port) {
3369: db_printf("local=0x%x(", msgh->msgh_local_port);
3370: ipc_print_type_name(MACH_MSGH_BITS_LOCAL(msgh->msgh_bits));
3371: db_printf(")\n");
3372: } else {
3373: db_printf("local=null\n");
3374: }
3375:
3376: saddr = (vm_offset_t) (msgh + 1);
3377: eaddr = (vm_offset_t) msgh + msgh->msgh_size;
3378:
3379: while (saddr < eaddr) {
3380: mach_msg_type_long_t *type;
3381: mach_msg_type_name_t name;
3382: mach_msg_type_size_t size;
3383: mach_msg_type_number_t number;
3384: boolean_t is_inline, longform, dealloc, is_port;
3385: vm_size_t length;
3386:
3387: type = (mach_msg_type_long_t *) saddr;
3388:
3389: if (((eaddr - saddr) < sizeof(mach_msg_type_t)) ||
3390: ((longform = ((mach_msg_type_t*)type)->msgt_longform) &&
3391: ((eaddr - saddr) < sizeof(mach_msg_type_long_t)))) {
3392: db_printf("*** msg too small\n");
3393: return;
3394: }
3395:
3396: is_inline = ((mach_msg_type_t*)type)->msgt_inline;
3397: dealloc = ((mach_msg_type_t*)type)->msgt_deallocate;
3398: if (longform) {
3399: /* This must be aligned */
3400: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
3401: (is_misaligned(type))) {
3402: saddr = ptr_align(saddr);
3403: continue;
3404: }
3405: name = type->msgtl_name;
3406: size = type->msgtl_size;
3407: number = type->msgtl_number;
3408: saddr += sizeof(mach_msg_type_long_t);
3409: } else {
3410: name = ((mach_msg_type_t*)type)->msgt_name;
3411: size = ((mach_msg_type_t*)type)->msgt_size;
3412: number = ((mach_msg_type_t*)type)->msgt_number;
3413: saddr += sizeof(mach_msg_type_t);
3414: }
3415:
3416: db_printf("-- type=");
3417: ipc_print_type_name(name);
3418: if (! is_inline) {
3419: db_printf(",ool");
3420: }
3421: if (dealloc) {
3422: db_printf(",dealloc");
3423: }
3424: if (longform) {
3425: db_printf(",longform");
3426: }
3427: db_printf(",size=%d,number=%d,addr=0x%x\n",
3428: size,
3429: number,
3430: saddr);
3431:
3432: is_port = MACH_MSG_TYPE_PORT_ANY(name);
3433:
3434: if ((is_port && (size != PORT_T_SIZE_IN_BITS)) ||
3435: (longform && ((type->msgtl_header.msgt_name != 0) ||
3436: (type->msgtl_header.msgt_size != 0) ||
3437: (type->msgtl_header.msgt_number != 0))) ||
3438: (((mach_msg_type_t*)type)->msgt_unused != 0) ||
3439: (dealloc && is_inline)) {
3440: db_printf("*** invalid type\n");
3441: return;
3442: }
3443:
3444: /* padding (ptrs and ports) ? */
3445: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) &&
3446: ((size >> 3) == sizeof(natural_t)))
3447: saddr = ptr_align(saddr);
3448:
3449: /* calculate length of data in bytes, rounding up */
3450:
3451: length = ((number * size) + 7) >> 3;
3452:
3453: if (is_inline) {
3454: vm_size_t amount;
3455: int i, numwords;
3456:
3457: /* inline data sizes round up to int boundaries */
3458: amount = (length + 3) &~ 3;
3459: if ((eaddr - saddr) < amount) {
3460: db_printf("*** too small\n");
3461: return;
3462: }
3463: numwords = amount / sizeof(int);
3464: if (numwords > 8) {
3465: numwords = 8;
3466: }
3467: for (i = 0; i < numwords; i++) {
3468: db_printf("0x%x\n", ((int *) saddr)[i]);
3469: }
3470: if (numwords < amount / sizeof(int)) {
3471: db_printf("...\n");
3472: }
3473: saddr += amount;
3474: } else {
3475: if ((eaddr - saddr) < sizeof(vm_offset_t)) {
3476: db_printf("*** too small\n");
3477: return;
3478: }
3479: db_printf("0x%x\n", * (vm_offset_t *) saddr);
3480: saddr += sizeof(vm_offset_t);
3481: }
3482: }
3483: }
3484: #endif /* MACH_KDB */
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.