![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to ipc_kmsg.c CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [Apple Darwin 0.x] / kernel / ipc|
Return to ipc_kmsg.c CVS log | Up to [Apple Darwin 0.x] / kernel / ipc |
1.1 ! root 1: /* ! 2: * Copyright (c) 1999 Apple Computer, Inc. All rights reserved. ! 3: * ! 4: * @APPLE_LICENSE_HEADER_START@ ! 5: * ! 6: * Portions Copyright (c) 1999 Apple Computer, Inc. All Rights ! 7: * Reserved. This file contains Original Code and/or Modifications of ! 8: * Original Code as defined in and that are subject to the Apple Public ! 9: * Source License Version 1.1 (the "License"). You may not use this file ! 10: * except in compliance with the License. Please obtain a copy of the ! 11: * License at http://www.apple.com/publicsource and read it before using ! 12: * this file. ! 13: * ! 14: * The Original Code and all software distributed under the License are ! 15: * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER ! 16: * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, ! 17: * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, ! 18: * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the ! 19: * License for the specific language governing rights and limitations ! 20: * under the License. ! 21: * ! 22: * @APPLE_LICENSE_HEADER_END@ ! 23: */ ! 24: ! 25: /* ! 26: * Copyright (c) 1995, 1994, 1993, 1992, 1991, 1990 ! 27: * Open Software Foundation, Inc. ! 28: * ! 29: * Permission to use, copy, modify, and distribute this software and ! 30: * its documentation for any purpose and without fee is hereby granted, ! 31: * provided that the above copyright notice appears in all copies and ! 32: * that both the copyright notice and this permission notice appear in ! 33: * supporting documentation, and that the name of ("OSF") or Open Software ! 34: * Foundation not be used in advertising or publicity pertaining to ! 35: * distribution of the software without specific, written prior permission. ! 36: * ! 37: * OSF DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE ! 38: * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS ! 39: * FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL OSF BE LIABLE FOR ANY ! 40: * SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ! 41: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN ! 42: * ACTION OF CONTRACT, NEGLIGENCE, OR OTHER TORTIOUS ACTION, ARISING ! 43: * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE ! 44: */ ! 45: /* ! 46: * OSF Research Institute MK6.1 (unencumbered) 1/31/1995 ! 47: */ ! 48: /* ! 49: * Mach Operating System ! 50: * Copyright (c) 1991,1990,1989 Carnegie Mellon University ! 51: * All Rights Reserved. ! 52: * ! 53: * Permission to use, copy, modify and distribute this software and its ! 54: * documentation is hereby granted, provided that both the copyright ! 55: * notice and this permission notice appear in all copies of the ! 56: * software, derivative works or modified versions, and any portions ! 57: * thereof, and that both notices appear in supporting documentation. ! 58: * ! 59: * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" ! 60: * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR ! 61: * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. ! 62: * ! 63: * Carnegie Mellon requests users of this software to return to ! 64: * ! 65: * Software Distribution Coordinator or [email protected] ! 66: * School of Computer Science ! 67: * Carnegie Mellon University ! 68: * Pittsburgh PA 15213-3890 ! 69: * ! 70: * any improvements or extensions that they make and grant Carnegie Mellon ! 71: * the rights to redistribute these changes. ! 72: */ ! 73: /* ! 74: * File: ipc/ipc_kmsg.c ! 75: * Author: Rich Draves ! 76: * Date: 1989 ! 77: * ! 78: * Operations on kernel messages. ! 79: */ ! 80: ! 81: #import <mach/features.h> ! 82: ! 83: #include <mach/boolean.h> ! 84: #include <mach/kern_return.h> ! 85: #include <mach/message.h> ! 86: #include <mach/port.h> ! 87: #include <kern/assert.h> ! 88: #include <kern/kalloc.h> ! 89: #include <vm/vm_map.h> ! 90: #include <vm/vm_object.h> ! 91: #include <vm/vm_kern.h> ! 92: #include <ipc/port.h> ! 93: #include <ipc/ipc_entry.h> ! 94: #include <ipc/ipc_kmsg.h> ! 95: #include <ipc/ipc_thread.h> ! 96: #include <ipc/ipc_marequest.h> ! 97: #include <ipc/ipc_notify.h> ! 98: #include <ipc/ipc_object.h> ! 99: #include <ipc/ipc_space.h> ! 100: #include <ipc/ipc_port.h> ! 101: #include <ipc/ipc_right.h> ! 102: ! 103: #include <ipc/ipc_machdep.h> ! 104: ! 105: #define MSG_OOL_SIZE_SMALL (PAGE_SIZE >> 2) ! 106: ! 107: extern int copyinmap(); ! 108: extern int copyoutmap(); ! 109: ! 110: #define is_misaligned(x) \ ! 111: ( ((vm_offset_t)(x)) & (sizeof(vm_offset_t)-1) ) ! 112: #define ptr_align(x) \ ! 113: ( ( ((vm_offset_t)(x)) + (sizeof(vm_offset_t)-1) ) & \ ! 114: ~(sizeof(vm_offset_t)-1) ) ! 115: ! 116: ipc_kmsg_t ipc_kmsg_cache[NCPUS]; ! 117: ! 118: /* ! 119: * Forward declarations ! 120: */ ! 121: ! 122: void ipc_kmsg_clean( ! 123: ipc_kmsg_t kmsg); ! 124: ! 125: void ipc_kmsg_clean_body( ! 126: ipc_kmsg_t kmsg, ! 127: int number); ! 128: ! 129: void ipc_kmsg_clean_partial( ! 130: ipc_kmsg_t kmsg, ! 131: mach_msg_type_number_t number, ! 132: vm_offset_t paddr, ! 133: vm_size_t length); ! 134: ! 135: mach_msg_return_t ipc_kmsg_copyout_body( ! 136: ipc_kmsg_t kmsg, ! 137: ipc_space_t space, ! 138: vm_map_t map, ! 139: ipc_kmsg_t list); ! 140: ! 141: mach_msg_return_t ipc_kmsg_copyin_body( ! 142: ipc_kmsg_t kmsg, ! 143: ipc_space_t space, ! 144: vm_map_t map); ! 145: ! 146: /* ! 147: * Routine: ipc_kmsg_enqueue ! 148: * Purpose: ! 149: * Enqueue a kmsg. ! 150: */ ! 151: ! 152: void ! 153: ipc_kmsg_enqueue( ! 154: ipc_kmsg_queue_t queue, ! 155: ipc_kmsg_t kmsg) ! 156: { ! 157: ipc_kmsg_enqueue_macro(queue, kmsg); ! 158: } ! 159: ! 160: /* ! 161: * Routine: ipc_kmsg_dequeue ! 162: * Purpose: ! 163: * Dequeue and return a kmsg. ! 164: */ ! 165: ! 166: ipc_kmsg_t ! 167: ipc_kmsg_dequeue( ! 168: ipc_kmsg_queue_t queue) ! 169: { ! 170: ipc_kmsg_t first; ! 171: ! 172: first = ipc_kmsg_queue_first(queue); ! 173: ! 174: if (first != IKM_NULL) ! 175: ipc_kmsg_rmqueue_first_macro(queue, first); ! 176: ! 177: return first; ! 178: } ! 179: ! 180: /* ! 181: * Routine: ipc_kmsg_rmqueue ! 182: * Purpose: ! 183: * Pull a kmsg out of a queue. ! 184: */ ! 185: ! 186: void ! 187: ipc_kmsg_rmqueue( ! 188: ipc_kmsg_queue_t queue, ! 189: ipc_kmsg_t kmsg) ! 190: { ! 191: ipc_kmsg_t next, prev; ! 192: ! 193: assert(queue->ikmq_base != IKM_NULL); ! 194: ! 195: next = kmsg->ikm_next; ! 196: prev = kmsg->ikm_prev; ! 197: ! 198: if (next == kmsg) { ! 199: assert(prev == kmsg); ! 200: assert(queue->ikmq_base == kmsg); ! 201: ! 202: queue->ikmq_base = IKM_NULL; ! 203: } else { ! 204: if (queue->ikmq_base == kmsg) ! 205: queue->ikmq_base = next; ! 206: ! 207: next->ikm_prev = prev; ! 208: prev->ikm_next = next; ! 209: } ! 210: } ! 211: ! 212: /* ! 213: * Routine: ipc_kmsg_queue_next ! 214: * Purpose: ! 215: * Return the kmsg following the given kmsg. ! 216: * (Or IKM_NULL if it is the last one in the queue.) ! 217: */ ! 218: ! 219: ipc_kmsg_t ! 220: ipc_kmsg_queue_next( ! 221: ipc_kmsg_queue_t queue, ! 222: ipc_kmsg_t kmsg) ! 223: { ! 224: ipc_kmsg_t next; ! 225: ! 226: assert(queue->ikmq_base != IKM_NULL); ! 227: ! 228: next = kmsg->ikm_next; ! 229: if (queue->ikmq_base == next) ! 230: next = IKM_NULL; ! 231: ! 232: return next; ! 233: } ! 234: ! 235: /* ! 236: * Routine: ipc_kmsg_destroy ! 237: * Purpose: ! 238: * Destroys a kernel message. Releases all rights, ! 239: * references, and memory held by the message. ! 240: * Frees the message. ! 241: * Conditions: ! 242: * No locks held. ! 243: */ ! 244: ! 245: void ! 246: ipc_kmsg_destroy( ! 247: ipc_kmsg_t kmsg) ! 248: { ! 249: ipc_kmsg_queue_t queue; ! 250: boolean_t empty; ! 251: ! 252: /* ! 253: * ipc_kmsg_clean can cause more messages to be destroyed. ! 254: * Curtail recursion by queueing messages. If a message ! 255: * is already queued, then this is a recursive call. ! 256: */ ! 257: ! 258: queue = ¤t_thread()->ith_messages; ! 259: empty = ipc_kmsg_queue_empty(queue); ! 260: ipc_kmsg_enqueue(queue, kmsg); ! 261: ! 262: if (empty) { ! 263: /* must leave kmsg in queue while cleaning it */ ! 264: ! 265: while ((kmsg = ipc_kmsg_queue_first(queue)) != IKM_NULL) { ! 266: ipc_kmsg_clean(kmsg); ! 267: ipc_kmsg_rmqueue(queue, kmsg); ! 268: ikm_free(kmsg); ! 269: } ! 270: } ! 271: } ! 272: ! 273: /* ! 274: * Routine: ipc_kmsg_clean_body ! 275: * Purpose: ! 276: * Cleans the body of a kernel message. ! 277: * Releases all rights, references, and memory. ! 278: * ! 279: * Conditions: ! 280: * No locks held. ! 281: */ ! 282: ! 283: void ! 284: ipc_kmsg_clean_body( ! 285: ipc_kmsg_t kmsg, ! 286: int number) ! 287: { ! 288: mach_msg_descriptor_t *saddr, *eaddr; ! 289: ! 290: if ( number == 0 ) ! 291: return; ! 292: ! 293: saddr = (mach_msg_descriptor_t *) ! 294: ((mach_msg_base_t *) &kmsg->ikm_header + 1); ! 295: eaddr = saddr + number; ! 296: ! 297: for ( ; saddr < eaddr; saddr++ ) { ! 298: ! 299: switch (saddr->type.type) { ! 300: ! 301: case MACH_MSG_PORT_DESCRIPTOR: { ! 302: mach_msg_port_descriptor_t *dsc; ! 303: ! 304: dsc = &saddr->port; ! 305: ! 306: /* ! 307: * Destroy port rights carried in the message ! 308: */ ! 309: if (!IO_VALID((ipc_object_t) dsc->name)) ! 310: continue; ! 311: ipc_object_destroy((ipc_object_t) dsc->name, dsc->disposition); ! 312: break; ! 313: } ! 314: case MACH_MSG_OOL_DESCRIPTOR : { ! 315: mach_msg_ool_descriptor_t *dsc; ! 316: ! 317: dsc = &saddr->out_of_line; ! 318: ! 319: /* ! 320: * Destroy memory carried in the message ! 321: */ ! 322: if (dsc->size == 0) { ! 323: assert(dsc->address == (void *) 0); ! 324: } else { ! 325: #if MACH_OLD_VM_COPY ! 326: (void) vm_deallocate( ! 327: ipc_soft_map, ! 328: (vm_offset_t)dsc->address, ! 329: (vm_size_t)dsc->size); ! 330: #else ! 331: if (dsc->copy == MACH_MSG_PHYSICAL_COPY && ! 332: dsc->size <= MSG_OOL_SIZE_SMALL) { ! 333: kfree((vm_offset_t)dsc->address, ! 334: (vm_size_t)dsc->size); ! 335: } else { ! 336: vm_map_copy_discard((vm_map_copy_t) dsc->address); ! 337: } ! 338: #endif ! 339: } ! 340: break; ! 341: } ! 342: case MACH_MSG_OOL_PORTS_DESCRIPTOR : { ! 343: ipc_object_t *objects; ! 344: mach_msg_type_number_t j; ! 345: mach_msg_ool_ports_descriptor_t *dsc; ! 346: ! 347: dsc = &saddr->ool_ports; ! 348: objects = (ipc_object_t *) dsc->address; ! 349: ! 350: if (dsc->count == 0) { ! 351: break; ! 352: } ! 353: ! 354: assert(objects != (ipc_object_t *) 0); ! 355: ! 356: /* destroy port rights carried in the message */ ! 357: ! 358: for (j = 0; j < dsc->count; j++) { ! 359: ipc_object_t object = objects[j]; ! 360: ! 361: if (!IO_VALID(object)) ! 362: continue; ! 363: ! 364: ipc_object_destroy(object, dsc->disposition); ! 365: } ! 366: ! 367: /* destroy memory carried in the message */ ! 368: ! 369: assert(dsc->count != 0); ! 370: ! 371: kfree((vm_offset_t) dsc->address, ! 372: (vm_size_t) dsc->count * sizeof(mach_port_t)); ! 373: break; ! 374: } ! 375: default : { ! 376: panic("ipc_kmsg_clean_body: bad descriptor type %d", ! 377: saddr->type.type); ! 378: } ! 379: } ! 380: } ! 381: } ! 382: ! 383: void ! 384: ipc_kmsg_clean_body_compat( ! 385: vm_offset_t saddr, ! 386: vm_offset_t eaddr) ! 387: { ! 388: while (saddr < eaddr) { ! 389: mach_msg_type_long_t *type; ! 390: mach_msg_type_name_t name; ! 391: mach_msg_type_size_t size; ! 392: mach_msg_type_number_t number; ! 393: boolean_t is_inline, is_port; ! 394: vm_size_t length; ! 395: ! 396: type = (mach_msg_type_long_t *) saddr; ! 397: is_inline = ((mach_msg_type_t*)type)->msgt_inline; ! 398: if (((mach_msg_type_t*)type)->msgt_longform) { ! 399: /* This must be aligned */ ! 400: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 401: (is_misaligned(type))) { ! 402: saddr = ptr_align(saddr); ! 403: continue; ! 404: } ! 405: name = type->msgtl_name; ! 406: size = type->msgtl_size; ! 407: number = type->msgtl_number; ! 408: saddr += sizeof(mach_msg_type_long_t); ! 409: } else { ! 410: name = ((mach_msg_type_t*)type)->msgt_name; ! 411: size = ((mach_msg_type_t*)type)->msgt_size; ! 412: number = ((mach_msg_type_t*)type)->msgt_number; ! 413: saddr += sizeof(mach_msg_type_t); ! 414: } ! 415: ! 416: /* padding (ptrs and ports) ? */ ! 417: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 418: ((size >> 3) == sizeof(natural_t))) ! 419: saddr = ptr_align(saddr); ! 420: ! 421: /* calculate length of data in bytes, rounding up */ ! 422: ! 423: length = ((number * size) + 7) >> 3; ! 424: ! 425: is_port = MACH_MSG_TYPE_PORT_ANY(name); ! 426: ! 427: if (is_port) { ! 428: ipc_object_t *objects; ! 429: mach_msg_type_number_t i; ! 430: ! 431: if (is_inline) { ! 432: objects = (ipc_object_t *) saddr; ! 433: /* sanity check */ ! 434: while (eaddr < (vm_offset_t)&objects[number]) number--; ! 435: } else { ! 436: objects = (ipc_object_t *) ! 437: * (vm_offset_t *) saddr; ! 438: } ! 439: ! 440: /* destroy port rights carried in the message */ ! 441: ! 442: for (i = 0; i < number; i++) { ! 443: ipc_object_t object = objects[i]; ! 444: ! 445: if (!IO_VALID(object)) ! 446: continue; ! 447: ! 448: ipc_object_destroy(object, name); ! 449: } ! 450: } ! 451: ! 452: if (is_inline) { ! 453: /* inline data sizes round up to int boundaries */ ! 454: ! 455: saddr += (length + 3) &~ 3; ! 456: } else { ! 457: vm_offset_t data = * (vm_offset_t *) saddr; ! 458: ! 459: /* destroy memory carried in the message */ ! 460: ! 461: if (length == 0) ! 462: assert(data == 0); ! 463: else if (is_port) ! 464: kfree(data, length); ! 465: else ! 466: #if MACH_OLD_VM_COPY ! 467: (void) vm_deallocate( ! 468: ipc_soft_map, data, length); ! 469: #else ! 470: vm_map_copy_discard((vm_map_copy_t) data); ! 471: #endif ! 472: ! 473: saddr += sizeof(vm_offset_t); ! 474: } ! 475: } ! 476: } ! 477: ! 478: /* ! 479: * Routine: ipc_kmsg_clean_partial ! 480: * Purpose: ! 481: * Cleans a partially-acquired kernel message. ! 482: * Conditions: ! 483: * Nothing locked. ! 484: */ ! 485: ! 486: void ! 487: ipc_kmsg_clean_partial( ! 488: ipc_kmsg_t kmsg, ! 489: mach_msg_type_number_t number, ! 490: vm_offset_t paddr, ! 491: vm_size_t length) ! 492: { ! 493: ipc_object_t object; ! 494: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits; ! 495: ! 496: object = (ipc_object_t) kmsg->ikm_header.msgh_remote_port; ! 497: assert(IO_VALID(object)); ! 498: ipc_object_destroy(object, MACH_MSGH_BITS_REMOTE(mbits)); ! 499: ! 500: object = (ipc_object_t) kmsg->ikm_header.msgh_local_port; ! 501: if (IO_VALID(object)) ! 502: ipc_object_destroy(object, MACH_MSGH_BITS_LOCAL(mbits)); ! 503: ! 504: if (paddr) { ! 505: (void) vm_deallocate(ipc_kernel_copy_map, paddr, length); ! 506: } ! 507: ! 508: ipc_kmsg_clean_body(kmsg, number); ! 509: } ! 510: ! 511: void ! 512: ipc_kmsg_clean_partial_compat( ! 513: ipc_kmsg_t kmsg, ! 514: vm_offset_t eaddr, ! 515: boolean_t dolast, ! 516: mach_msg_type_number_t number) ! 517: { ! 518: ipc_object_t object; ! 519: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits; ! 520: vm_offset_t saddr; ! 521: ! 522: assert(kmsg->ikm_marequest == IMAR_NULL); ! 523: ! 524: object = (ipc_object_t) kmsg->ikm_header.msgh_remote_port; ! 525: assert(IO_VALID(object)); ! 526: ipc_object_destroy(object, MACH_MSGH_BITS_REMOTE(mbits)); ! 527: ! 528: object = (ipc_object_t) kmsg->ikm_header.msgh_local_port; ! 529: if (IO_VALID(object)) ! 530: ipc_object_destroy(object, MACH_MSGH_BITS_LOCAL(mbits)); ! 531: ! 532: saddr = (vm_offset_t) (&kmsg->ikm_header + 1); ! 533: ipc_kmsg_clean_body_compat(saddr, eaddr); ! 534: ! 535: if (dolast) { ! 536: mach_msg_type_long_t *type; ! 537: mach_msg_type_name_t name; ! 538: mach_msg_type_size_t size; ! 539: mach_msg_type_number_t rnumber; ! 540: boolean_t is_inline, is_port; ! 541: vm_size_t length; ! 542: ! 543: xxx: type = (mach_msg_type_long_t *) eaddr; ! 544: is_inline = ((mach_msg_type_t*)type)->msgt_inline; ! 545: if (((mach_msg_type_t*)type)->msgt_longform) { ! 546: /* This must be aligned */ ! 547: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 548: (is_misaligned(type))) { ! 549: eaddr = ptr_align(eaddr); ! 550: goto xxx; ! 551: } ! 552: name = type->msgtl_name; ! 553: size = type->msgtl_size; ! 554: rnumber = type->msgtl_number; ! 555: eaddr += sizeof(mach_msg_type_long_t); ! 556: } else { ! 557: name = ((mach_msg_type_t*)type)->msgt_name; ! 558: size = ((mach_msg_type_t*)type)->msgt_size; ! 559: rnumber = ((mach_msg_type_t*)type)->msgt_number; ! 560: eaddr += sizeof(mach_msg_type_t); ! 561: } ! 562: ! 563: /* padding (ptrs and ports) ? */ ! 564: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 565: ((size >> 3) == sizeof(natural_t))) ! 566: eaddr = ptr_align(eaddr); ! 567: ! 568: /* calculate length of data in bytes, rounding up */ ! 569: ! 570: length = ((rnumber * size) + 7) >> 3; ! 571: ! 572: is_port = MACH_MSG_TYPE_PORT_ANY(name); ! 573: ! 574: if (is_port) { ! 575: ipc_object_t *objects; ! 576: mach_msg_type_number_t i; ! 577: ! 578: objects = (ipc_object_t *) ! 579: (is_inline ? eaddr : * (vm_offset_t *) eaddr); ! 580: ! 581: /* destroy port rights carried in the message */ ! 582: ! 583: for (i = 0; i < number; i++) { ! 584: ipc_object_t obj = objects[i]; ! 585: ! 586: if (!IO_VALID(obj)) ! 587: continue; ! 588: ! 589: ipc_object_destroy(obj, name); ! 590: } ! 591: } ! 592: ! 593: if (!is_inline) { ! 594: vm_offset_t data = * (vm_offset_t *) eaddr; ! 595: ! 596: /* destroy memory carried in the message */ ! 597: ! 598: if (length == 0) ! 599: assert(data == 0); ! 600: else if (is_port) ! 601: kfree(data, length); ! 602: else ! 603: #if MACH_OLD_VM_COPY ! 604: (void) vm_deallocate( ! 605: ipc_soft_map, data, length); ! 606: #else ! 607: vm_map_copy_discard((vm_map_copy_t) data); ! 608: #endif ! 609: } ! 610: } ! 611: } ! 612: ! 613: /* ! 614: * Routine: ipc_kmsg_clean ! 615: * Purpose: ! 616: * Cleans a kernel message. Releases all rights, ! 617: * references, and memory held by the message. ! 618: * Conditions: ! 619: * No locks held. ! 620: */ ! 621: ! 622: void ! 623: ipc_kmsg_clean( ! 624: ipc_kmsg_t kmsg) ! 625: { ! 626: ipc_marequest_t marequest; ! 627: ipc_object_t object; ! 628: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits; ! 629: ! 630: marequest = kmsg->ikm_marequest; ! 631: if (marequest != IMAR_NULL) ! 632: ipc_marequest_destroy(marequest); ! 633: ! 634: object = (ipc_object_t) kmsg->ikm_header.msgh_remote_port; ! 635: if (IO_VALID(object)) ! 636: ipc_object_destroy(object, MACH_MSGH_BITS_REMOTE(mbits)); ! 637: ! 638: object = (ipc_object_t) kmsg->ikm_header.msgh_local_port; ! 639: if (IO_VALID(object)) ! 640: ipc_object_destroy(object, MACH_MSGH_BITS_LOCAL(mbits)); ! 641: ! 642: if (mbits & MACH_MSGH_BITS_COMPLEX) { ! 643: if (mbits & MACH_MSGH_BITS_OLD_FORMAT) { ! 644: vm_offset_t saddr, eaddr; ! 645: ! 646: saddr = (vm_offset_t) (&kmsg->ikm_header + 1); ! 647: eaddr = (vm_offset_t) &kmsg->ikm_header + ! 648: kmsg->ikm_header.msgh_size; ! 649: ! 650: ipc_kmsg_clean_body_compat(saddr, eaddr); ! 651: } ! 652: else { ! 653: mach_msg_body_t *body; ! 654: ! 655: body = (mach_msg_body_t *) (&kmsg->ikm_header + 1); ! 656: ipc_kmsg_clean_body(kmsg, body->msgh_descriptor_count); ! 657: } ! 658: } ! 659: } ! 660: ! 661: /* ! 662: * Routine: ipc_kmsg_free ! 663: * Purpose: ! 664: * Free a kernel message buffer. ! 665: * Conditions: ! 666: * Nothing locked. ! 667: */ ! 668: ! 669: void ! 670: ipc_kmsg_free( ! 671: ipc_kmsg_t kmsg) ! 672: { ! 673: vm_size_t size = kmsg->ikm_size; ! 674: ! 675: switch (size) { ! 676: case IKM_SIZE_NETWORK: ! 677: /* return it to the network code */ ! 678: break; ! 679: ! 680: #if DRIVERKIT ! 681: case IKM_SIZE_DEVICE: ! 682: KernDeviceInterruptMsgRelease(kmsg); ! 683: break; ! 684: #endif ! 685: ! 686: #if MACH_NET ! 687: case IKM_SIZE_NETIPC: ! 688: netipc_msg_release(kmsg); ! 689: break; ! 690: #endif ! 691: ! 692: default: ! 693: kfree((vm_offset_t) kmsg, size); ! 694: break; ! 695: } ! 696: } ! 697: ! 698: /* ! 699: * Routine: ipc_kmsg_get ! 700: * Purpose: ! 701: * Allocates a kernel message buffer. ! 702: * Copies a user message to the message buffer. ! 703: * Conditions: ! 704: * Nothing locked. ! 705: * Returns: ! 706: * MACH_MSG_SUCCESS Acquired a message buffer. ! 707: * MACH_SEND_MSG_TOO_SMALL Message smaller than a header. ! 708: * MACH_SEND_MSG_TOO_SMALL Message size not long-word multiple. ! 709: * MACH_SEND_NO_BUFFER Couldn't allocate a message buffer. ! 710: * MACH_SEND_INVALID_DATA Couldn't copy message data. ! 711: */ ! 712: ! 713: mach_msg_return_t ! 714: ipc_kmsg_get( ! 715: mach_msg_header_t *msg, ! 716: mach_msg_option_t option, ! 717: mach_msg_size_t size, ! 718: integer_t delta, ! 719: ipc_kmsg_t *kmsgp) ! 720: { ! 721: ipc_kmsg_t kmsg; ! 722: mach_msg_size_t send_size, msg_size; ! 723: ! 724: if ((size < sizeof(mach_msg_header_t)) || (size & 3)) ! 725: return MACH_SEND_MSG_TOO_SMALL; ! 726: ! 727: /* ! 728: * Three different notions of message size: ! 729: * 1) 'size' is the value passed through the API, ! 730: * which is the actual size of the message to the ! 731: * sender. In the case of the old API, this value ! 732: * will have been rounded up to a 4 byte boundary, ! 733: * and delta will be set to a negative value such ! 734: * that (size + delta) is the original value passed ! 735: * through the API. ! 736: * 2) 'msg_size' is the minimum sized kmsg needed to ! 737: * hold the message. This is equal to the size of ! 738: * the message plus the *maximum* sized trailer which ! 739: * can be generated by this kernel. In the case of ! 740: * the old API, this will be equal to 'size'. ! 741: * 3) 'send_size' is the actual amount of data which ! 742: * will be copied from the sender. In the case of ! 743: * MACH_SEND_TRAILER, this will include a *minimum* ! 744: * sized trailer in order to acquire the size and ! 745: * type fields of the entire trailer. The actual ! 746: * trailer data will then be fetched using a separate ! 747: * copy operation. ! 748: */ ! 749: if (delta <= 0) { ! 750: msg_size = size; ! 751: send_size = size + delta; ! 752: } ! 753: else { ! 754: if ((delta & 3) || ! 755: delta < MACH_MSG_TRAILER_MINIMUM_SIZE || ! 756: delta > MAX_TRAILER_SIZE) ! 757: return MACH_SEND_INVALID_TRAILER; ! 758: ! 759: msg_size = size + delta; ! 760: send_size = size + ((option & MACH_SEND_TRAILER) ? ! 761: sizeof (mach_msg_trailer_t) : 0); ! 762: } ! 763: ! 764: if (msg_size <= IKM_SAVED_MSG_SIZE) { ! 765: kmsg = ikm_cache(); ! 766: if (kmsg != IKM_NULL) { ! 767: ikm_cache() = IKM_NULL; ! 768: ikm_check_initialized(kmsg, IKM_SAVED_KMSG_SIZE); ! 769: } else { ! 770: kmsg = ikm_alloc(IKM_SAVED_MSG_SIZE); ! 771: if (kmsg == IKM_NULL) ! 772: return MACH_SEND_NO_BUFFER; ! 773: ikm_init(kmsg, IKM_SAVED_MSG_SIZE); ! 774: } ! 775: } else { ! 776: kmsg = ikm_alloc(msg_size); ! 777: if (kmsg == IKM_NULL) ! 778: return MACH_SEND_NO_BUFFER; ! 779: ikm_init(kmsg, msg_size); ! 780: } ! 781: ! 782: if (copyinmsg( ! 783: (char *) msg, (char *) &kmsg->ikm_header, send_size)) { ! 784: ikm_free(kmsg); ! 785: return MACH_SEND_INVALID_DATA; ! 786: } ! 787: ! 788: /* ! 789: * Process trailers, excepting old ! 790: * message format. ! 791: */ ! 792: if (delta > 0) { ! 793: if (option & MACH_SEND_TRAILER) { ! 794: /* ! 795: * The send operation includes the ! 796: * MACH_SEND_TRAILER option. ! 797: */ ! 798: mach_msg_trailer_t *trailer; ! 799: mach_msg_trailer_size_t trailer_size; ! 800: ! 801: trailer = (mach_msg_trailer_t *) ! 802: ((vm_offset_t)&kmsg->ikm_header + size); ! 803: ! 804: if (trailer->msgh_trailer_type != 0) { ! 805: ikm_free(kmsg); ! 806: return MACH_SEND_INVALID_TRAILER; ! 807: } ! 808: ! 809: trailer_size = trailer->msgh_trailer_size; ! 810: if (trailer_size > delta || (trailer_size & 3) || ! 811: trailer_size < MACH_MSG_TRAILER_MINIMUM_SIZE || ! 812: trailer_size > MACH_MSG_TRAILER_FORMAT_0_SIZE) { ! 813: ikm_free(kmsg); ! 814: return MACH_SEND_INVALID_TRAILER; ! 815: } ! 816: ! 817: if (trailer_size > sizeof (*trailer) && ! 818: copyinmsg( ! 819: (char *)((vm_offset_t)msg + size + ! 820: sizeof (*trailer)), ! 821: (char *)((vm_offset_t)trailer + ! 822: sizeof (*trailer)), ! 823: trailer_size - sizeof (*trailer))) { ! 824: ikm_free(kmsg); ! 825: return MACH_SEND_INVALID_TRAILER; ! 826: } ! 827: ! 828: delta = trailer_size; ! 829: } ! 830: else ! 831: delta = 0; ! 832: } ! 833: ! 834: kmsg->ikm_delta = delta; ! 835: kmsg->ikm_header.msgh_size = size; ! 836: ! 837: *kmsgp = kmsg; ! 838: return MACH_MSG_SUCCESS; ! 839: } ! 840: ! 841: /* ! 842: * Routine: ipc_kmsg_get_from_kernel ! 843: * Purpose: ! 844: * Allocates a kernel message buffer. ! 845: * Copies a kernel message to the message buffer. ! 846: * Only resource errors are allowed. ! 847: * Conditions: ! 848: * Nothing locked. ! 849: * Returns: ! 850: * MACH_MSG_SUCCESS Acquired a message buffer. ! 851: * MACH_SEND_NO_BUFFER Couldn't allocate a message buffer. ! 852: */ ! 853: ! 854: extern mach_msg_return_t ! 855: ipc_kmsg_get_from_kernel( ! 856: mach_msg_header_t *msg, ! 857: mach_msg_option_t option, ! 858: mach_msg_size_t size, ! 859: integer_t delta, ! 860: ipc_kmsg_t *kmsgp) ! 861: { ! 862: ipc_kmsg_t kmsg; ! 863: mach_msg_size_t send_size, msg_size; ! 864: ! 865: assert(size >= sizeof(mach_msg_header_t)); ! 866: assert((size & 3) == 0 && (delta <= 0)); ! 867: ! 868: if (delta <= 0) { ! 869: msg_size = size; ! 870: send_size = size + delta; ! 871: } ! 872: else { ! 873: if ((delta & 3) || ! 874: delta < MACH_MSG_TRAILER_MINIMUM_SIZE || ! 875: delta > MAX_TRAILER_SIZE) ! 876: return MACH_SEND_INVALID_TRAILER; ! 877: ! 878: msg_size = size + delta; ! 879: send_size = size + ((option & MACH_SEND_TRAILER) ? ! 880: sizeof (mach_msg_trailer_t) : 0); ! 881: } ! 882: ! 883: kmsg = ikm_alloc(msg_size); ! 884: ! 885: if (kmsg == IKM_NULL) ! 886: return MACH_SEND_NO_BUFFER; ! 887: ikm_init(kmsg, msg_size); ! 888: kmsg->ikm_sender = KERNEL_SECURITY_ID_VALUE; ! 889: ! 890: bcopy((char *) msg, (char *) &kmsg->ikm_header, send_size); ! 891: ! 892: /* ! 893: * Process trailers, excepting old ! 894: * message format. ! 895: */ ! 896: if (delta > 0) { ! 897: if (option & MACH_SEND_TRAILER) { ! 898: /* ! 899: * The send operation includes the ! 900: * MACH_SEND_TRAILER option. ! 901: */ ! 902: mach_msg_trailer_t *trailer; ! 903: mach_msg_trailer_size_t trailer_size; ! 904: ! 905: trailer = (mach_msg_trailer_t *) ! 906: ((vm_offset_t)&kmsg->ikm_header + size); ! 907: ! 908: if (trailer->msgh_trailer_type != 0) { ! 909: ikm_free(kmsg); ! 910: return MACH_SEND_INVALID_TRAILER; ! 911: } ! 912: ! 913: trailer_size = trailer->msgh_trailer_size; ! 914: if (trailer_size > delta || (trailer_size & 3) || ! 915: trailer_size < MACH_MSG_TRAILER_MINIMUM_SIZE || ! 916: trailer_size > MACH_MSG_TRAILER_FORMAT_0_SIZE) { ! 917: ikm_free(kmsg); ! 918: return MACH_SEND_INVALID_TRAILER; ! 919: } ! 920: ! 921: if (trailer_size > sizeof (*trailer)) { ! 922: bcopy( ! 923: (char *)((vm_offset_t)msg + size + ! 924: sizeof (*trailer)), ! 925: (char *)((vm_offset_t)trailer + ! 926: sizeof (*trailer)), ! 927: trailer_size - sizeof (*trailer)); ! 928: } ! 929: ! 930: delta = trailer_size; ! 931: } ! 932: else ! 933: delta = 0; ! 934: } ! 935: ! 936: kmsg->ikm_delta = delta; ! 937: kmsg->ikm_header.msgh_size = size; ! 938: ! 939: *kmsgp = kmsg; ! 940: return MACH_MSG_SUCCESS; ! 941: } ! 942: ! 943: /* ! 944: * Routine: ipc_kmsg_put ! 945: * Purpose: ! 946: * Copies a message buffer to a user message. ! 947: * Copies only the specified number of bytes. ! 948: * Frees the message buffer. ! 949: * Conditions: ! 950: * Nothing locked. The message buffer must have clean ! 951: * header (ikm_marequest) fields. ! 952: * Returns: ! 953: * MACH_MSG_SUCCESS Copied data out of message buffer. ! 954: * MACH_RCV_INVALID_DATA Couldn't copy to user message. ! 955: */ ! 956: ! 957: mach_msg_return_t ! 958: ipc_kmsg_put( ! 959: mach_msg_header_t *msg, ! 960: ipc_kmsg_t kmsg, ! 961: mach_msg_size_t size) ! 962: { ! 963: mach_msg_return_t mr; ! 964: ! 965: ikm_check_initialized(kmsg, kmsg->ikm_size); ! 966: ! 967: if (copyoutmsg((const char *) &kmsg->ikm_header, (char *) msg, size)) ! 968: mr = MACH_RCV_INVALID_DATA; ! 969: else ! 970: mr = MACH_MSG_SUCCESS; ! 971: ! 972: if ((kmsg->ikm_size == IKM_SAVED_KMSG_SIZE) && ! 973: (ikm_cache() == IKM_NULL)) ! 974: ikm_cache() = kmsg; ! 975: else ! 976: ikm_free(kmsg); ! 977: ! 978: return mr; ! 979: } ! 980: ! 981: /* ! 982: * Routine: ipc_kmsg_put_to_kernel ! 983: * Purpose: ! 984: * Copies a message buffer to a kernel message. ! 985: * Frees the message buffer. ! 986: * No errors allowed. ! 987: * Conditions: ! 988: * Nothing locked. ! 989: */ ! 990: ! 991: void ! 992: ipc_kmsg_put_to_kernel( ! 993: mach_msg_header_t *msg, ! 994: ipc_kmsg_t kmsg, ! 995: mach_msg_size_t size) ! 996: { ! 997: bcopy((char *) &kmsg->ikm_header, (char *) msg, size); ! 998: ! 999: ikm_free(kmsg); ! 1000: } ! 1001: ! 1002: /* ! 1003: * Routine: ipc_kmsg_copyin_header ! 1004: * Purpose: ! 1005: * "Copy-in" port rights in the header of a message. ! 1006: * Operates atomically; if it doesn't succeed the ! 1007: * message header and the space are left untouched. ! 1008: * If it does succeed the remote/local port fields ! 1009: * contain object pointers instead of port names, ! 1010: * and the bits field is updated. The destination port ! 1011: * will be a valid port pointer. ! 1012: * ! 1013: * The notify argument implements the MACH_SEND_CANCEL option. ! 1014: * If it is not MACH_PORT_NULL, it should name a receive right. ! 1015: * If the processing of the destination port would generate ! 1016: * a port-deleted notification (because the right for the ! 1017: * destination port is destroyed and it had a request for ! 1018: * a dead-name notification registered), and the port-deleted ! 1019: * notification would be sent to the named receive right, ! 1020: * then it isn't sent and the send-once right for the notify ! 1021: * port is quietly destroyed. ! 1022: * ! 1023: * [MACH_IPC_COMPAT] There is an atomicity problem if the ! 1024: * reply port is a compat entry and dies at an inopportune ! 1025: * time. This doesn't have any serious consequences ! 1026: * (an observant user task might conceivably notice that ! 1027: * the destination and reply ports were handled inconsistently), ! 1028: * only happens in compat mode, and is extremely unlikely. ! 1029: * Conditions: ! 1030: * Nothing locked. ! 1031: * Returns: ! 1032: * MACH_MSG_SUCCESS Successful copyin. ! 1033: * MACH_SEND_INVALID_HEADER ! 1034: * Illegal value in the message header bits. ! 1035: * MACH_SEND_INVALID_DEST The space is dead. ! 1036: * MACH_SEND_INVALID_NOTIFY ! 1037: * Notify is non-null and doesn't name a receive right. ! 1038: * (Either KERN_INVALID_NAME or KERN_INVALID_RIGHT.) ! 1039: * MACH_SEND_INVALID_DEST Can't copyin destination port. ! 1040: * (Either KERN_INVALID_NAME or KERN_INVALID_RIGHT.) ! 1041: * MACH_SEND_INVALID_REPLY Can't copyin reply port. ! 1042: * (Either KERN_INVALID_NAME or KERN_INVALID_RIGHT.) ! 1043: */ ! 1044: ! 1045: mach_msg_return_t ! 1046: ipc_kmsg_copyin_header( ! 1047: mach_msg_header_t *msg, ! 1048: ipc_space_t space, ! 1049: mach_port_t notify) ! 1050: { ! 1051: mach_msg_bits_t mbits = msg->msgh_bits &~ ! 1052: (MACH_MSGH_BITS_CIRCULAR | MACH_MSGH_BITS_OLD_FORMAT); ! 1053: mach_port_t dest_name = msg->msgh_remote_port; ! 1054: mach_port_t reply_name = msg->msgh_local_port; ! 1055: kern_return_t kr; ! 1056: ! 1057: /* first check for common cases */ ! 1058: ! 1059: if (notify == MACH_PORT_NULL) switch (MACH_MSGH_BITS_PORTS(mbits)) { ! 1060: case MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0): { ! 1061: ipc_entry_t entry; ! 1062: ipc_entry_bits_t bits; ! 1063: ipc_port_t dest_port; ! 1064: ! 1065: /* sending an asynchronous message */ ! 1066: ! 1067: if (reply_name != MACH_PORT_NULL) ! 1068: break; ! 1069: ! 1070: is_read_lock(space); ! 1071: if (!space->is_active) ! 1072: goto abort_async; ! 1073: ! 1074: /* optimized ipc_entry_lookup */ ! 1075: ! 1076: { ! 1077: mach_port_index_t index = MACH_PORT_INDEX(dest_name); ! 1078: mach_port_gen_t gen = MACH_PORT_GEN(dest_name); ! 1079: ! 1080: if (index >= space->is_table_size) ! 1081: goto abort_async; ! 1082: ! 1083: entry = &space->is_table[index]; ! 1084: bits = entry->ie_bits; ! 1085: ! 1086: /* check generation number and type bit */ ! 1087: ! 1088: if ((bits & (IE_BITS_GEN_MASK|MACH_PORT_TYPE_SEND)) != ! 1089: (gen | MACH_PORT_TYPE_SEND)) ! 1090: goto abort_async; ! 1091: } ! 1092: ! 1093: /* optimized ipc_right_copyin */ ! 1094: ! 1095: assert(IE_BITS_UREFS(bits) > 0); ! 1096: ! 1097: dest_port = (ipc_port_t) entry->ie_object; ! 1098: assert(dest_port != IP_NULL); ! 1099: ! 1100: ip_lock(dest_port); ! 1101: /* can unlock space now without compromising atomicity */ ! 1102: is_read_unlock(space); ! 1103: ! 1104: if (!ip_active(dest_port)) { ! 1105: ip_unlock(dest_port); ! 1106: break; ! 1107: } ! 1108: ! 1109: assert(dest_port->ip_srights > 0); ! 1110: dest_port->ip_srights++; ! 1111: ip_reference(dest_port); ! 1112: ip_unlock(dest_port); ! 1113: ! 1114: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 1115: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, 0)); ! 1116: msg->msgh_remote_port = (mach_port_t) dest_port; ! 1117: return MACH_MSG_SUCCESS; ! 1118: ! 1119: abort_async: ! 1120: is_read_unlock(space); ! 1121: break; ! 1122: } ! 1123: ! 1124: case MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, ! 1125: MACH_MSG_TYPE_MAKE_SEND_ONCE): { ! 1126: ipc_entry_num_t size; ! 1127: ipc_entry_t table; ! 1128: ipc_entry_t entry; ! 1129: ipc_entry_bits_t bits; ! 1130: ipc_port_t dest_port, reply_port; ! 1131: ! 1132: /* sending a request message */ ! 1133: ! 1134: is_read_lock(space); ! 1135: if (!space->is_active) ! 1136: goto abort_request; ! 1137: ! 1138: size = space->is_table_size; ! 1139: table = space->is_table; ! 1140: ! 1141: /* optimized ipc_entry_lookup of dest_name */ ! 1142: ! 1143: { ! 1144: mach_port_index_t index = MACH_PORT_INDEX(dest_name); ! 1145: mach_port_gen_t gen = MACH_PORT_GEN(dest_name); ! 1146: ! 1147: if (index >= size) ! 1148: goto abort_request; ! 1149: ! 1150: entry = &table[index]; ! 1151: bits = entry->ie_bits; ! 1152: ! 1153: /* check generation number and type bit */ ! 1154: ! 1155: if ((bits & (IE_BITS_GEN_MASK|MACH_PORT_TYPE_SEND)) != ! 1156: (gen | MACH_PORT_TYPE_SEND)) ! 1157: goto abort_request; ! 1158: } ! 1159: ! 1160: assert(IE_BITS_UREFS(bits) > 0); ! 1161: ! 1162: dest_port = (ipc_port_t) entry->ie_object; ! 1163: assert(dest_port != IP_NULL); ! 1164: ! 1165: /* optimized ipc_entry_lookup of reply_name */ ! 1166: ! 1167: { ! 1168: mach_port_index_t index = MACH_PORT_INDEX(reply_name); ! 1169: mach_port_gen_t gen = MACH_PORT_GEN(reply_name); ! 1170: ! 1171: if (index >= size) ! 1172: goto abort_request; ! 1173: ! 1174: entry = &table[index]; ! 1175: bits = entry->ie_bits; ! 1176: ! 1177: /* check generation number and type bit */ ! 1178: ! 1179: if ((bits & (IE_BITS_GEN_MASK|MACH_PORT_TYPE_RECEIVE)) != ! 1180: (gen | MACH_PORT_TYPE_RECEIVE)) ! 1181: goto abort_request; ! 1182: } ! 1183: ! 1184: reply_port = (ipc_port_t) entry->ie_object; ! 1185: assert(reply_port != IP_NULL); ! 1186: ! 1187: /* ! 1188: * To do an atomic copyin, need simultaneous ! 1189: * locks on both ports and the space. If ! 1190: * dest_port == reply_port, and simple locking is ! 1191: * enabled, then we will abort. Otherwise it's ! 1192: * OK to unlock twice. ! 1193: */ ! 1194: ! 1195: ip_lock(dest_port); ! 1196: if (!ip_active(dest_port) || !ip_lock_try(reply_port)) { ! 1197: ip_unlock(dest_port); ! 1198: goto abort_request; ! 1199: } ! 1200: /* can unlock space now without compromising atomicity */ ! 1201: is_read_unlock(space); ! 1202: ! 1203: assert(dest_port->ip_srights > 0); ! 1204: dest_port->ip_srights++; ! 1205: ip_reference(dest_port); ! 1206: ip_unlock(dest_port); ! 1207: ! 1208: assert(ip_active(reply_port)); ! 1209: assert(reply_port->ip_receiver_name == reply_name); ! 1210: assert(reply_port->ip_receiver == space); ! 1211: ! 1212: reply_port->ip_sorights++; ! 1213: ip_reference(reply_port); ! 1214: ip_unlock(reply_port); ! 1215: ! 1216: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 1217: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, ! 1218: MACH_MSG_TYPE_PORT_SEND_ONCE)); ! 1219: msg->msgh_remote_port = (mach_port_t) dest_port; ! 1220: msg->msgh_local_port = (mach_port_t) reply_port; ! 1221: return MACH_MSG_SUCCESS; ! 1222: ! 1223: abort_request: ! 1224: is_read_unlock(space); ! 1225: break; ! 1226: } ! 1227: ! 1228: case MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND_ONCE, 0): { ! 1229: mach_port_index_t index; ! 1230: mach_port_gen_t gen; ! 1231: ipc_entry_t table; ! 1232: ipc_entry_t entry; ! 1233: ipc_entry_bits_t bits; ! 1234: ipc_port_t dest_port; ! 1235: ! 1236: /* sending a reply message */ ! 1237: ! 1238: if (reply_name != MACH_PORT_NULL) ! 1239: break; ! 1240: ! 1241: is_write_lock(space); ! 1242: if (!space->is_active) ! 1243: goto abort_reply; ! 1244: ! 1245: /* optimized ipc_entry_lookup */ ! 1246: ! 1247: table = space->is_table; ! 1248: ! 1249: index = MACH_PORT_INDEX(dest_name); ! 1250: gen = MACH_PORT_GEN(dest_name); ! 1251: ! 1252: if (index >= space->is_table_size) ! 1253: goto abort_reply; ! 1254: ! 1255: entry = &table[index]; ! 1256: bits = entry->ie_bits; ! 1257: ! 1258: /* check generation number, collision bit, and type bit */ ! 1259: ! 1260: if ((bits & (IE_BITS_GEN_MASK|IE_BITS_COLLISION| ! 1261: MACH_PORT_TYPE_SEND_ONCE)) != ! 1262: (gen | MACH_PORT_TYPE_SEND_ONCE)) ! 1263: goto abort_reply; ! 1264: ! 1265: /* optimized ipc_right_copyin */ ! 1266: ! 1267: assert(IE_BITS_TYPE(bits) == MACH_PORT_TYPE_SEND_ONCE); ! 1268: assert(IE_BITS_UREFS(bits) == 1); ! 1269: assert((bits & IE_BITS_MAREQUEST) == 0); ! 1270: ! 1271: if (entry->ie_request != 0) ! 1272: goto abort_reply; ! 1273: ! 1274: dest_port = (ipc_port_t) entry->ie_object; ! 1275: assert(dest_port != IP_NULL); ! 1276: ! 1277: ip_lock(dest_port); ! 1278: if (!ip_active(dest_port)) { ! 1279: ip_unlock(dest_port); ! 1280: goto abort_reply; ! 1281: } ! 1282: ! 1283: assert(dest_port->ip_sorights > 0); ! 1284: ip_unlock(dest_port); ! 1285: ! 1286: /* optimized ipc_entry_dealloc */ ! 1287: ! 1288: entry->ie_next = table->ie_next; ! 1289: table->ie_next = index; ! 1290: entry->ie_bits = gen; ! 1291: entry->ie_object = IO_NULL; ! 1292: is_write_unlock(space); ! 1293: ! 1294: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 1295: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, ! 1296: 0)); ! 1297: msg->msgh_remote_port = (mach_port_t) dest_port; ! 1298: return MACH_MSG_SUCCESS; ! 1299: ! 1300: abort_reply: ! 1301: is_write_unlock(space); ! 1302: break; ! 1303: } ! 1304: ! 1305: default: ! 1306: /* don't bother optimizing */ ! 1307: break; ! 1308: } ! 1309: ! 1310: { ! 1311: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits); ! 1312: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits); ! 1313: ipc_object_t dest_port, reply_port; ! 1314: ipc_port_t dest_soright, reply_soright; ! 1315: ipc_port_t notify_port = 0; /* '=0' to quiet gcc warnings */ ! 1316: ! 1317: if (!MACH_MSG_TYPE_PORT_ANY_SEND(dest_type)) ! 1318: return MACH_SEND_INVALID_HEADER; ! 1319: ! 1320: if ((reply_type == 0) ? ! 1321: (reply_name != MACH_PORT_NULL) : ! 1322: !MACH_MSG_TYPE_PORT_ANY_SEND(reply_type)) ! 1323: return MACH_SEND_INVALID_HEADER; ! 1324: ! 1325: is_write_lock(space); ! 1326: if (!space->is_active) ! 1327: goto invalid_dest; ! 1328: ! 1329: if (notify != MACH_PORT_NULL) { ! 1330: ipc_entry_t entry; ! 1331: ! 1332: if (((entry = ipc_entry_lookup(space, notify)) == IE_NULL) || ! 1333: ((entry->ie_bits & MACH_PORT_TYPE_RECEIVE) == 0)) { ! 1334: is_write_unlock(space); ! 1335: return MACH_SEND_INVALID_NOTIFY; ! 1336: } ! 1337: ! 1338: notify_port = (ipc_port_t) entry->ie_object; ! 1339: } ! 1340: ! 1341: if (dest_name == reply_name) { ! 1342: ipc_entry_t entry; ! 1343: mach_port_t name = dest_name; ! 1344: ! 1345: /* ! 1346: * Destination and reply ports are the same! ! 1347: * This is a little tedious to make atomic, because ! 1348: * there are 25 combinations of dest_type/reply_type. ! 1349: * However, most are easy. If either is move-sonce, ! 1350: * then there must be an error. If either are ! 1351: * make-send or make-sonce, then we must be looking ! 1352: * at a receive right so the port can't die. ! 1353: * The hard cases are the combinations of ! 1354: * copy-send and make-send. ! 1355: */ ! 1356: ! 1357: entry = ipc_entry_lookup(space, name); ! 1358: if (entry == IE_NULL) ! 1359: goto invalid_dest; ! 1360: ! 1361: assert(reply_type != 0); /* because name not null */ ! 1362: ! 1363: if (!ipc_right_copyin_check(space, name, entry, reply_type)) ! 1364: goto invalid_reply; ! 1365: ! 1366: if ((dest_type == MACH_MSG_TYPE_MOVE_SEND_ONCE) || ! 1367: (reply_type == MACH_MSG_TYPE_MOVE_SEND_ONCE)) { ! 1368: /* ! 1369: * Why must there be an error? To get a valid ! 1370: * destination, this entry must name a live ! 1371: * port (not a dead name or dead port). However ! 1372: * a successful move-sonce will destroy a ! 1373: * live entry. Therefore the other copyin, ! 1374: * whatever it is, would fail. We've already ! 1375: * checked for reply port errors above, ! 1376: * so report a destination error. ! 1377: */ ! 1378: ! 1379: goto invalid_dest; ! 1380: } else if ((dest_type == MACH_MSG_TYPE_MAKE_SEND) || ! 1381: (dest_type == MACH_MSG_TYPE_MAKE_SEND_ONCE) || ! 1382: (reply_type == MACH_MSG_TYPE_MAKE_SEND) || ! 1383: (reply_type == MACH_MSG_TYPE_MAKE_SEND_ONCE)) { ! 1384: kr = ipc_right_copyin(space, name, entry, ! 1385: dest_type, FALSE, ! 1386: &dest_port, &dest_soright); ! 1387: if (kr != KERN_SUCCESS) ! 1388: goto invalid_dest; ! 1389: ! 1390: /* ! 1391: * Either dest or reply needs a receive right. ! 1392: * We know the receive right is there, because ! 1393: * of the copyin_check and copyin calls. Hence ! 1394: * the port is not in danger of dying. If dest ! 1395: * used the receive right, then the right needed ! 1396: * by reply (and verified by copyin_check) will ! 1397: * still be there. ! 1398: */ ! 1399: ! 1400: assert(IO_VALID(dest_port)); ! 1401: assert(entry->ie_bits & MACH_PORT_TYPE_RECEIVE); ! 1402: assert(dest_soright == IP_NULL); ! 1403: ! 1404: kr = ipc_right_copyin(space, name, entry, ! 1405: reply_type, TRUE, ! 1406: &reply_port, &reply_soright); ! 1407: ! 1408: assert(kr == KERN_SUCCESS); ! 1409: assert(reply_port == dest_port); ! 1410: assert(entry->ie_bits & MACH_PORT_TYPE_RECEIVE); ! 1411: assert(reply_soright == IP_NULL); ! 1412: } else if ((dest_type == MACH_MSG_TYPE_COPY_SEND) && ! 1413: (reply_type == MACH_MSG_TYPE_COPY_SEND)) { ! 1414: /* ! 1415: * To make this atomic, just do one copy-send, ! 1416: * and dup the send right we get out. ! 1417: */ ! 1418: ! 1419: kr = ipc_right_copyin(space, name, entry, ! 1420: dest_type, FALSE, ! 1421: &dest_port, &dest_soright); ! 1422: if (kr != KERN_SUCCESS) ! 1423: goto invalid_dest; ! 1424: ! 1425: assert(entry->ie_bits & MACH_PORT_TYPE_SEND); ! 1426: assert(dest_soright == IP_NULL); ! 1427: ! 1428: /* ! 1429: * It's OK if the port we got is dead now, ! 1430: * so reply_port is IP_DEAD, because the msg ! 1431: * won't go anywhere anyway. ! 1432: */ ! 1433: ! 1434: reply_port = (ipc_object_t) ! 1435: ipc_port_copy_send((ipc_port_t) dest_port); ! 1436: reply_soright = IP_NULL; ! 1437: } else if ((dest_type == MACH_MSG_TYPE_MOVE_SEND) && ! 1438: (reply_type == MACH_MSG_TYPE_MOVE_SEND)) { ! 1439: /* ! 1440: * This is an easy case. Just use our ! 1441: * handy-dandy special-purpose copyin call ! 1442: * to get two send rights for the price of one. ! 1443: */ ! 1444: ! 1445: kr = ipc_right_copyin_two(space, name, entry, ! 1446: &dest_port, &dest_soright); ! 1447: if (kr != KERN_SUCCESS) ! 1448: goto invalid_dest; ! 1449: ! 1450: /* the entry might need to be deallocated */ ! 1451: ! 1452: if (IE_BITS_TYPE(entry->ie_bits) ! 1453: == MACH_PORT_TYPE_NONE) ! 1454: ipc_entry_dealloc(space, name, entry); ! 1455: ! 1456: reply_port = dest_port; ! 1457: reply_soright = IP_NULL; ! 1458: } else { ! 1459: ipc_port_t soright; ! 1460: ! 1461: assert(((dest_type == MACH_MSG_TYPE_COPY_SEND) && ! 1462: (reply_type == MACH_MSG_TYPE_MOVE_SEND)) || ! 1463: ((dest_type == MACH_MSG_TYPE_MOVE_SEND) && ! 1464: (reply_type == MACH_MSG_TYPE_COPY_SEND))); ! 1465: ! 1466: /* ! 1467: * To make this atomic, just do a move-send, ! 1468: * and dup the send right we get out. ! 1469: */ ! 1470: ! 1471: kr = ipc_right_copyin(space, name, entry, ! 1472: MACH_MSG_TYPE_MOVE_SEND, FALSE, ! 1473: &dest_port, &soright); ! 1474: if (kr != KERN_SUCCESS) ! 1475: goto invalid_dest; ! 1476: ! 1477: /* the entry might need to be deallocated */ ! 1478: ! 1479: if (IE_BITS_TYPE(entry->ie_bits) ! 1480: == MACH_PORT_TYPE_NONE) ! 1481: ipc_entry_dealloc(space, name, entry); ! 1482: ! 1483: /* ! 1484: * It's OK if the port we got is dead now, ! 1485: * so reply_port is IP_DEAD, because the msg ! 1486: * won't go anywhere anyway. ! 1487: */ ! 1488: ! 1489: reply_port = (ipc_object_t) ! 1490: ipc_port_copy_send((ipc_port_t) dest_port); ! 1491: ! 1492: if (dest_type == MACH_MSG_TYPE_MOVE_SEND) { ! 1493: dest_soright = soright; ! 1494: reply_soright = IP_NULL; ! 1495: } else { ! 1496: dest_soright = IP_NULL; ! 1497: reply_soright = soright; ! 1498: } ! 1499: } ! 1500: } else if (!MACH_PORT_VALID(reply_name)) { ! 1501: ipc_entry_t entry; ! 1502: ! 1503: /* ! 1504: * No reply port! This is an easy case ! 1505: * to make atomic. Just copyin the destination. ! 1506: */ ! 1507: ! 1508: entry = ipc_entry_lookup(space, dest_name); ! 1509: if (entry == IE_NULL) ! 1510: goto invalid_dest; ! 1511: ! 1512: kr = ipc_right_copyin(space, dest_name, entry, ! 1513: dest_type, FALSE, ! 1514: &dest_port, &dest_soright); ! 1515: if (kr != KERN_SUCCESS) ! 1516: goto invalid_dest; ! 1517: ! 1518: /* the entry might need to be deallocated */ ! 1519: ! 1520: if (IE_BITS_TYPE(entry->ie_bits) == MACH_PORT_TYPE_NONE) ! 1521: ipc_entry_dealloc(space, dest_name, entry); ! 1522: ! 1523: reply_port = (ipc_object_t) reply_name; ! 1524: reply_soright = IP_NULL; ! 1525: } else { ! 1526: ipc_entry_t dest_entry, reply_entry; ! 1527: ipc_port_t saved_reply; ! 1528: ! 1529: /* ! 1530: * This is the tough case to make atomic. ! 1531: * The difficult problem is serializing with port death. ! 1532: * At the time we copyin dest_port, it must be alive. ! 1533: * If reply_port is alive when we copyin it, then ! 1534: * we are OK, because we serialize before the death ! 1535: * of both ports. Assume reply_port is dead at copyin. ! 1536: * Then if dest_port dies/died after reply_port died, ! 1537: * we are OK, because we serialize between the death ! 1538: * of the two ports. So the bad case is when dest_port ! 1539: * dies after its copyin, reply_port dies before its ! 1540: * copyin, and dest_port dies before reply_port. Then ! 1541: * the copyins operated as if dest_port was alive ! 1542: * and reply_port was dead, which shouldn't have happened ! 1543: * because they died in the other order. ! 1544: * ! 1545: * We handle the bad case by undoing the copyins ! 1546: * (which is only possible because the ports are dead) ! 1547: * and failing with MACH_SEND_INVALID_DEST, serializing ! 1548: * after the death of the ports. ! 1549: * ! 1550: * Note that it is easy for a user task to tell if ! 1551: * a copyin happened before or after a port died. ! 1552: * For example, suppose both dest and reply are ! 1553: * send-once rights (types are both move-sonce) and ! 1554: * both rights have dead-name requests registered. ! 1555: * If a port dies before copyin, a dead-name notification ! 1556: * is generated and the dead name's urefs are incremented, ! 1557: * and if the copyin happens first, a port-deleted ! 1558: * notification is generated. ! 1559: * ! 1560: * Note that although the entries are different, ! 1561: * dest_port and reply_port might still be the same. ! 1562: */ ! 1563: ! 1564: dest_entry = ipc_entry_lookup(space, dest_name); ! 1565: if (dest_entry == IE_NULL) ! 1566: goto invalid_dest; ! 1567: ! 1568: reply_entry = ipc_entry_lookup(space, reply_name); ! 1569: if (reply_entry == IE_NULL) ! 1570: goto invalid_reply; ! 1571: ! 1572: assert(dest_entry != reply_entry); /* names are not equal */ ! 1573: assert(reply_type != 0); /* because reply_name not null */ ! 1574: ! 1575: if (!ipc_right_copyin_check(space, reply_name, reply_entry, ! 1576: reply_type)) ! 1577: goto invalid_reply; ! 1578: ! 1579: kr = ipc_right_copyin(space, dest_name, dest_entry, ! 1580: dest_type, FALSE, ! 1581: &dest_port, &dest_soright); ! 1582: if (kr != KERN_SUCCESS) ! 1583: goto invalid_dest; ! 1584: ! 1585: assert(IO_VALID(dest_port)); ! 1586: ! 1587: saved_reply = (ipc_port_t) reply_entry->ie_object; ! 1588: /* might be IP_NULL, if this is a dead name */ ! 1589: if (saved_reply != IP_NULL) ! 1590: ipc_port_reference(saved_reply); ! 1591: ! 1592: kr = ipc_right_copyin(space, reply_name, reply_entry, ! 1593: reply_type, TRUE, ! 1594: &reply_port, &reply_soright); ! 1595: #if MACH_IPC_COMPAT ! 1596: if (kr != KERN_SUCCESS) { ! 1597: assert(kr == KERN_INVALID_NAME); ! 1598: ! 1599: /* ! 1600: * Oops. This must have been a compat entry ! 1601: * and the port died after the check above. ! 1602: * We should back out the copyin of dest_port, ! 1603: * and report MACH_SEND_INVALID_REPLY, but ! 1604: * if dest_port is alive we can't always do that. ! 1605: * Punt and pretend we got IO_DEAD, skipping ! 1606: * further hairy atomicity problems. ! 1607: */ ! 1608: ! 1609: reply_port = IO_DEAD; ! 1610: reply_soright = IP_NULL; ! 1611: goto skip_reply_checks; ! 1612: } ! 1613: #else MACH_IPC_COMPAT ! 1614: assert(kr == KERN_SUCCESS); ! 1615: #endif MACH_IPC_COMPAT ! 1616: ! 1617: if ((saved_reply != IP_NULL) && (reply_port == IO_DEAD)) { ! 1618: ipc_port_t dest = (ipc_port_t) dest_port; ! 1619: ipc_port_timestamp_t timestamp; ! 1620: boolean_t must_undo; ! 1621: ! 1622: /* ! 1623: * The reply port died before copyin. ! 1624: * Check if dest port died before reply. ! 1625: */ ! 1626: ! 1627: ip_lock(saved_reply); ! 1628: assert(!ip_active(saved_reply)); ! 1629: timestamp = saved_reply->ip_timestamp; ! 1630: ip_unlock(saved_reply); ! 1631: ! 1632: ip_lock(dest); ! 1633: must_undo = (!ip_active(dest) && ! 1634: IP_TIMESTAMP_ORDER(dest->ip_timestamp, ! 1635: timestamp)); ! 1636: ip_unlock(dest); ! 1637: ! 1638: if (must_undo) { ! 1639: /* ! 1640: * Our worst nightmares are realized. ! 1641: * Both destination and reply ports ! 1642: * are dead, but in the wrong order, ! 1643: * so we must undo the copyins and ! 1644: * possibly generate a dead-name notif. ! 1645: */ ! 1646: ! 1647: ipc_right_copyin_undo( ! 1648: space, dest_name, dest_entry, ! 1649: dest_type, dest_port, ! 1650: dest_soright); ! 1651: /* dest_entry may be deallocated now */ ! 1652: ! 1653: ipc_right_copyin_undo( ! 1654: space, reply_name, reply_entry, ! 1655: reply_type, reply_port, ! 1656: reply_soright); ! 1657: /* reply_entry may be deallocated now */ ! 1658: ! 1659: is_write_unlock(space); ! 1660: ! 1661: if (dest_soright != IP_NULL) ! 1662: ipc_notify_dead_name(dest_soright, ! 1663: dest_name); ! 1664: assert(reply_soright == IP_NULL); ! 1665: ! 1666: ipc_port_release(saved_reply); ! 1667: return MACH_SEND_INVALID_DEST; ! 1668: } ! 1669: } ! 1670: ! 1671: /* the entries might need to be deallocated */ ! 1672: ! 1673: if (IE_BITS_TYPE(reply_entry->ie_bits) == MACH_PORT_TYPE_NONE) ! 1674: ipc_entry_dealloc(space, reply_name, reply_entry); ! 1675: ! 1676: #if MACH_IPC_COMPAT ! 1677: skip_reply_checks: ! 1678: /* ! 1679: * We jump here if the reply entry was a compat entry ! 1680: * and the port died on us. In this case, the copyin ! 1681: * code already deallocated reply_entry. ! 1682: */ ! 1683: #endif MACH_IPC_COMPAT ! 1684: ! 1685: if (IE_BITS_TYPE(dest_entry->ie_bits) == MACH_PORT_TYPE_NONE) ! 1686: ipc_entry_dealloc(space, dest_name, dest_entry); ! 1687: ! 1688: if (saved_reply != IP_NULL) ! 1689: ipc_port_release(saved_reply); ! 1690: } ! 1691: ! 1692: /* ! 1693: * At this point, dest_port, reply_port, ! 1694: * dest_soright, reply_soright are all initialized. ! 1695: * Any defunct entries have been deallocated. ! 1696: * The space is still write-locked, and we need to ! 1697: * make the MACH_SEND_CANCEL check. The notify_port pointer ! 1698: * is still usable, because the copyin code above won't ever ! 1699: * deallocate a receive right, so its entry still exists ! 1700: * and holds a ref. Note notify_port might even equal ! 1701: * dest_port or reply_port. ! 1702: */ ! 1703: ! 1704: if ((notify != MACH_PORT_NULL) && ! 1705: (dest_soright == notify_port)) { ! 1706: ipc_port_release_sonce(dest_soright); ! 1707: dest_soright = IP_NULL; ! 1708: } ! 1709: ! 1710: is_write_unlock(space); ! 1711: ! 1712: if (dest_soright != IP_NULL) ! 1713: ipc_notify_port_deleted(dest_soright, dest_name); ! 1714: ! 1715: if (reply_soright != IP_NULL) ! 1716: ipc_notify_port_deleted(reply_soright, reply_name); ! 1717: ! 1718: dest_type = ipc_object_copyin_type(dest_type); ! 1719: reply_type = ipc_object_copyin_type(reply_type); ! 1720: ! 1721: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 1722: MACH_MSGH_BITS(dest_type, reply_type)); ! 1723: msg->msgh_remote_port = (mach_port_t) dest_port; ! 1724: msg->msgh_local_port = (mach_port_t) reply_port; ! 1725: } ! 1726: ! 1727: return MACH_MSG_SUCCESS; ! 1728: ! 1729: invalid_dest: ! 1730: is_write_unlock(space); ! 1731: return MACH_SEND_INVALID_DEST; ! 1732: ! 1733: invalid_reply: ! 1734: is_write_unlock(space); ! 1735: return MACH_SEND_INVALID_REPLY; ! 1736: } ! 1737: ! 1738: /* ! 1739: * Routine: ipc_kmsg_copyin_body ! 1740: * Purpose: ! 1741: * "Copy-in" port rights and out-of-line memory ! 1742: * in the message body. ! 1743: * ! 1744: * In all failure cases, the message is left holding ! 1745: * no rights or memory. However, the message buffer ! 1746: * is not deallocated. If successful, the message ! 1747: * contains a valid destination port. ! 1748: * Conditions: ! 1749: * Nothing locked. ! 1750: * Returns: ! 1751: * MACH_MSG_SUCCESS Successful copyin. ! 1752: * MACH_SEND_INVALID_MEMORY Can't grab out-of-line memory. ! 1753: * MACH_SEND_INVALID_RIGHT Can't copyin port right in body. ! 1754: * MACH_SEND_INVALID_TYPE Bad type specification. ! 1755: * MACH_SEND_MSG_TOO_SMALL Body is too small for types/data. ! 1756: */ ! 1757: ! 1758: mach_msg_return_t ! 1759: ipc_kmsg_copyin_body( ! 1760: ipc_kmsg_t kmsg, ! 1761: ipc_space_t space, ! 1762: vm_map_t map) ! 1763: { ! 1764: ipc_object_t dest; ! 1765: mach_msg_body_t *body; ! 1766: mach_msg_descriptor_t *saddr, *eaddr; ! 1767: boolean_t complex; ! 1768: boolean_t use_page_lists, steal_pages; ! 1769: int i; ! 1770: kern_return_t kr; ! 1771: vm_size_t space_needed = 0; ! 1772: vm_offset_t paddr = 0; ! 1773: mach_msg_descriptor_t *sstart; ! 1774: vm_map_copy_t copy = VM_MAP_COPY_NULL; ! 1775: ! 1776: /* ! 1777: * Determine if the target is a kernel port. ! 1778: */ ! 1779: dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port; ! 1780: complex = FALSE; ! 1781: use_page_lists = ipc_kobject_vm_page_list(ip_kotype((ipc_port_t)dest)); ! 1782: steal_pages = ipc_kobject_vm_page_steal(ip_kotype((ipc_port_t)dest)); ! 1783: ! 1784: body = (mach_msg_body_t *) (&kmsg->ikm_header + 1); ! 1785: saddr = (mach_msg_descriptor_t *) (body + 1); ! 1786: eaddr = saddr + body->msgh_descriptor_count; ! 1787: ! 1788: /* make sure the message does not ask for more msg descriptors ! 1789: * than the message can hold. ! 1790: */ ! 1791: ! 1792: if (eaddr <= saddr || ! 1793: eaddr > (mach_msg_descriptor_t *) (&kmsg->ikm_header + ! 1794: kmsg->ikm_header.msgh_size)) { ! 1795: ipc_kmsg_clean_partial(kmsg, 0, 0, 0); ! 1796: return MACH_SEND_MSG_TOO_SMALL; ! 1797: } ! 1798: ! 1799: /* ! 1800: * Make an initial pass to determine kernal VM space requirements for ! 1801: * physical copies. ! 1802: */ ! 1803: for (sstart = saddr; sstart < eaddr; sstart++) { ! 1804: ! 1805: if (sstart->type.type == MACH_MSG_OOL_DESCRIPTOR) { ! 1806: ! 1807: assert(!(sstart->out_of_line.copy == MACH_MSG_PHYSICAL_COPY && ! 1808: (use_page_lists || steal_pages))); ! 1809: ! 1810: if (sstart->out_of_line.copy != MACH_MSG_PHYSICAL_COPY && ! 1811: sstart->out_of_line.copy != MACH_MSG_VIRTUAL_COPY) { ! 1812: /* ! 1813: * Invalid copy option ! 1814: */ ! 1815: ipc_kmsg_clean_partial(kmsg, 0, 0, 0); ! 1816: return MACH_SEND_INVALID_TYPE; ! 1817: } ! 1818: ! 1819: if (sstart->out_of_line.copy == MACH_MSG_PHYSICAL_COPY && ! 1820: #if MACH_OLD_VM_COPY ! 1821: #else ! 1822: sstart->out_of_line.size > MSG_OOL_SIZE_SMALL && ! 1823: #endif ! 1824: !sstart->out_of_line.deallocate) { ! 1825: ! 1826: /* ! 1827: * Out-of-line memory descriptor, accumulate kernel ! 1828: * memory requirements ! 1829: */ ! 1830: space_needed += round_page(sstart->out_of_line.size); ! 1831: } ! 1832: } ! 1833: } ! 1834: ! 1835: /* ! 1836: * Allocate space in the pageable kernel ipc copy map for all the ! 1837: * ool data that is to be physically copied. Map is marked wait for ! 1838: * space. ! 1839: */ ! 1840: if (space_needed > 0) { ! 1841: if (vm_allocate(ipc_kernel_copy_map, &paddr, space_needed, ! 1842: TRUE) != KERN_SUCCESS) { ! 1843: ipc_kmsg_clean_partial(kmsg, 0, 0, 0); ! 1844: return MACH_MSG_VM_KERNEL; ! 1845: } ! 1846: } ! 1847: ! 1848: /* ! 1849: * handle the OOL regions and port descriptors. ! 1850: * the check for complex messages was done earlier. ! 1851: */ ! 1852: ! 1853: for (i = 0, sstart = saddr; sstart < eaddr; sstart++) { ! 1854: ! 1855: switch (sstart->type.type) { ! 1856: ! 1857: case MACH_MSG_PORT_DESCRIPTOR: { ! 1858: mach_msg_type_name_t name; ! 1859: ipc_object_t object; ! 1860: mach_msg_port_descriptor_t *dsc; ! 1861: ! 1862: dsc = &sstart->port; ! 1863: ! 1864: /* this is really the type SEND, SEND_ONCE, etc. */ ! 1865: name = dsc->disposition; ! 1866: if (!MACH_MSG_TYPE_PORT_ANY(name)) { ! 1867: ipc_kmsg_clean_partial(kmsg, i, paddr, space_needed); ! 1868: return MACH_SEND_INVALID_TYPE; ! 1869: } ! 1870: dsc->disposition = ipc_object_copyin_type(name); ! 1871: ! 1872: if (!MACH_PORT_VALID(dsc->name)) { ! 1873: complex = TRUE; ! 1874: break; ! 1875: } ! 1876: kr = ipc_object_copyin(space, dsc->name, name, &object); ! 1877: if (kr != KERN_SUCCESS) { ! 1878: ipc_kmsg_clean_partial(kmsg, i, paddr, space_needed); ! 1879: return MACH_SEND_INVALID_RIGHT; ! 1880: } ! 1881: if ((dsc->disposition == MACH_MSG_TYPE_PORT_RECEIVE) && ! 1882: ipc_port_check_circularity((ipc_port_t) object, ! 1883: (ipc_port_t) dest)) { ! 1884: kmsg->ikm_header.msgh_bits |= MACH_MSGH_BITS_CIRCULAR; ! 1885: } ! 1886: dsc->name = (mach_port_t) object; ! 1887: complex = TRUE; ! 1888: break; ! 1889: } ! 1890: case MACH_MSG_OOL_DESCRIPTOR: { ! 1891: vm_size_t length; ! 1892: boolean_t dealloc; ! 1893: vm_offset_t addr; ! 1894: vm_offset_t kaddr; ! 1895: mach_msg_ool_descriptor_t *dsc; ! 1896: ! 1897: dsc = &sstart->out_of_line; ! 1898: dealloc = dsc->deallocate; ! 1899: addr = (vm_offset_t) dsc->address; ! 1900: ! 1901: length = dsc->size; ! 1902: ! 1903: if (length == 0) { ! 1904: dsc->address = 0; ! 1905: #if OLD_VM_CODE ! 1906: #else ! 1907: } else if (use_page_lists) { ! 1908: int options; ! 1909: ! 1910: /* ! 1911: * Use page list copy mechanism if specified. Since the ! 1912: * destination is a kernel port, no RT handling is ! 1913: * necessary. ! 1914: */ ! 1915: if (steal_pages == FALSE) { ! 1916: /* ! 1917: * XXX Temporary Hackaround. ! 1918: * XXX Because the same page ! 1919: * XXX might be in more than one ! 1920: * XXX out of line region, steal ! 1921: * XXX (busy) pages from previous ! 1922: * XXX region so that this copyin ! 1923: * XXX won't block (permanently). ! 1924: */ ! 1925: if (copy != VM_MAP_COPY_NULL) ! 1926: vm_map_copy_steal_pages(copy); ! 1927: } ! 1928: ! 1929: /* ! 1930: * Set up options for copying in page list. ! 1931: * If deallocating, steal pages to prevent ! 1932: * vm code from lazy evaluating deallocation. ! 1933: */ ! 1934: options = VM_PROT_READ; ! 1935: if (dealloc) { ! 1936: options |= VM_MAP_COPYIN_OPT_SRC_DESTROY | ! 1937: VM_MAP_COPYIN_OPT_STEAL_PAGES; ! 1938: } ! 1939: else if (steal_pages) { ! 1940: options |= VM_MAP_COPYIN_OPT_STEAL_PAGES; ! 1941: } ! 1942: ! 1943: if (vm_map_copyin_page_list(map, addr, length, options, ! 1944: ©, FALSE) ! 1945: != KERN_SUCCESS) { ! 1946: ! 1947: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 1948: space_needed); ! 1949: return MACH_SEND_INVALID_MEMORY; ! 1950: } ! 1951: ! 1952: dsc->address = (void *) copy; ! 1953: dsc->copy = MACH_MSG_PAGE_LIST_COPY_T; ! 1954: #endif ! 1955: #if MACH_OLD_VM_COPY ! 1956: #else ! 1957: } else if (length <= MSG_OOL_SIZE_SMALL && ! 1958: dsc->copy == MACH_MSG_PHYSICAL_COPY) { ! 1959: ! 1960: /* ! 1961: * If the data is 'small' enough, always kalloc space for ! 1962: * it and copy it in. The data will be copied out ! 1963: * on the message receive. This is a performance ! 1964: * optimization that assumes the cost of VM operations ! 1965: * dominates the copyin/copyout overhead for 'small' ! 1966: * regions. ! 1967: * If the kernel is the message target, a consistent data ! 1968: * repesentation is needed for ool data since kernel ! 1969: * functions may deallocate the ool data. In this case ! 1970: * a vm_map_copy_t is allocated along with the space for ! 1971: * the data as an optimization. No RT handling is needed. ! 1972: */ ! 1973: if (is_ipc_kobject(ip_kotype((ipc_port_t)dest))) { ! 1974: vm_map_copy_t copy; ! 1975: ! 1976: copy = (vm_map_copy_t) kalloc( ! 1977: sizeof(struct vm_map_copy) + length); ! 1978: if (copy == VM_MAP_COPY_NULL) { ! 1979: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 1980: space_needed); ! 1981: return MACH_MSG_VM_KERNEL; ! 1982: } ! 1983: copy->type = VM_MAP_COPY_KERNEL_BUFFER; ! 1984: if (copyin((const char *) addr, (char *) (copy + 1), ! 1985: length)) { ! 1986: kfree((vm_offset_t) copy, ! 1987: sizeof(struct vm_map_copy) + length); ! 1988: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 1989: space_needed); ! 1990: return MACH_SEND_INVALID_MEMORY; ! 1991: } ! 1992: dsc->address = (void *) copy; ! 1993: dsc->copy = MACH_MSG_KALLOC_COPY_T; ! 1994: copy->size = length; ! 1995: copy->offset = 0; ! 1996: copy->cpy_data = (vm_offset_t) (copy + 1); ! 1997: } else { ! 1998: if ((kaddr = kalloc(length)) == (vm_offset_t) 0) { ! 1999: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 2000: space_needed); ! 2001: return MACH_MSG_VM_KERNEL; ! 2002: } ! 2003: ! 2004: if (copyin((const char *) addr, (char *) kaddr, ! 2005: length)) { ! 2006: kfree(kaddr, length); ! 2007: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 2008: space_needed); ! 2009: return MACH_SEND_INVALID_MEMORY; ! 2010: } ! 2011: dsc->address = (void *) kaddr; ! 2012: } ! 2013: if (dealloc) { ! 2014: #if OLD_VM_CODE ! 2015: (void) vm_deallocate(map, addr, length); ! 2016: #else ! 2017: (void) vm_map_remove(map, trunc_page(addr), ! 2018: round_page(addr + length), ! 2019: VM_MAP_REMOVE_WAIT_FOR_KWIRE| ! 2020: VM_MAP_REMOVE_INTERRUPTIBLE); ! 2021: #endif ! 2022: } ! 2023: #endif ! 2024: } else { ! 2025: if ((dsc->copy == MACH_MSG_PHYSICAL_COPY) && !dealloc) { ! 2026: ! 2027: /* ! 2028: * If the request is a physical copy and the source ! 2029: * is not being deallocated, then allocate space ! 2030: * in the kernel's pageable ipc copy map and copy ! 2031: * the data in. The semantics guarantee that the ! 2032: * data will have been physically copied before ! 2033: * the send operation terminates. Thus if the data ! 2034: * is not being deallocated, we must be prepared ! 2035: * to page if the region is sufficiently large. ! 2036: */ ! 2037: if (copyin((const char *) addr, (char *) paddr, ! 2038: length)) { ! 2039: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 2040: space_needed); ! 2041: return MACH_SEND_INVALID_MEMORY; ! 2042: } ! 2043: ! 2044: /* ! 2045: * The kernel ipc copy map is marked no_zero_fill. ! 2046: * If the transfer is not a page multiple, we need ! 2047: * to zero fill the balance. ! 2048: */ ! 2049: if (!page_aligned(length)) { ! 2050: (void) bzero((void *) (paddr + length), ! 2051: round_page(length) - length); ! 2052: } ! 2053: #if MACH_OLD_VM_COPY ! 2054: if (vm_move( ! 2055: ipc_kernel_copy_map, paddr, ! 2056: ipc_soft_map, length, FALSE, ! 2057: (vm_offset_t *)©) != KERN_SUCCESS) { ! 2058: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 2059: space_needed); ! 2060: return MACH_MSG_VM_KERNEL; ! 2061: } ! 2062: (void) vm_deallocate( ! 2063: ipc_kernel_copy_map, paddr, length); ! 2064: #else ! 2065: if (vm_map_copyin(ipc_kernel_copy_map, paddr, length, ! 2066: TRUE, ©) != KERN_SUCCESS) { ! 2067: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 2068: space_needed); ! 2069: return MACH_MSG_VM_KERNEL; ! 2070: } ! 2071: #endif ! 2072: paddr += round_page(length); ! 2073: space_needed -= round_page(length); ! 2074: } else { ! 2075: ! 2076: /* ! 2077: * Make a virtual copy of the of the data if requested ! 2078: * or if a physical copy was requested but the source ! 2079: * is being deallocated. ! 2080: */ ! 2081: #if MACH_OLD_VM_COPY ! 2082: if (vm_move( ! 2083: map, addr, ! 2084: ipc_soft_map, length, FALSE, ! 2085: (vm_offset_t *)©) != KERN_SUCCESS) { ! 2086: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 2087: space_needed); ! 2088: return MACH_SEND_INVALID_MEMORY; ! 2089: } ! 2090: if (dealloc) ! 2091: (void) vm_deallocate( ! 2092: map, addr, length); ! 2093: #else ! 2094: if (vm_map_copyin(map, addr, length, ! 2095: dealloc, ©) != KERN_SUCCESS) { ! 2096: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 2097: space_needed); ! 2098: return MACH_SEND_INVALID_MEMORY; ! 2099: } ! 2100: #endif ! 2101: } ! 2102: dsc->address = (void *) copy; ! 2103: } ! 2104: complex = TRUE; ! 2105: break; ! 2106: } ! 2107: case MACH_MSG_OOL_PORTS_DESCRIPTOR: { ! 2108: vm_size_t length; ! 2109: vm_offset_t data; ! 2110: vm_offset_t addr; ! 2111: ipc_object_t *objects; ! 2112: int j; ! 2113: mach_msg_type_name_t name; ! 2114: mach_msg_ool_ports_descriptor_t *dsc; ! 2115: ! 2116: dsc = &sstart->ool_ports; ! 2117: addr = (vm_offset_t) dsc->address; ! 2118: ! 2119: /* calculate length of data in bytes, rounding up */ ! 2120: length = dsc->count * sizeof(mach_port_t); ! 2121: ! 2122: if (length == 0) { ! 2123: complex = TRUE; ! 2124: dsc->address = (void *) 0; ! 2125: break; ! 2126: } ! 2127: ! 2128: data = kalloc(length); ! 2129: ! 2130: if (data == 0) { ! 2131: ipc_kmsg_clean_partial(kmsg, i, paddr, space_needed); ! 2132: return MACH_SEND_NO_BUFFER; ! 2133: } ! 2134: ! 2135: if (copyinmap(map, addr, data, length)) { ! 2136: kfree(data, length); ! 2137: ipc_kmsg_clean_partial(kmsg, i, paddr, space_needed); ! 2138: return MACH_SEND_INVALID_MEMORY; ! 2139: } ! 2140: ! 2141: /* this is really the type SEND, SEND_ONCE, etc. */ ! 2142: name = dsc->disposition; ! 2143: if (!MACH_MSG_TYPE_PORT_ANY(name)) { ! 2144: kfree(data, length); ! 2145: ipc_kmsg_clean_partial(kmsg, i, paddr, space_needed); ! 2146: return MACH_SEND_INVALID_TYPE; ! 2147: } ! 2148: dsc->disposition = ipc_object_copyin_type(name); ! 2149: ! 2150: if (dsc->deallocate) { ! 2151: (void) vm_deallocate(map, addr, length); ! 2152: } ! 2153: ! 2154: dsc->address = (void *) data; ! 2155: objects = (ipc_object_t *) data; ! 2156: ! 2157: for ( j = 0; j < dsc->count; j++) { ! 2158: mach_port_t port = (mach_port_t) objects[j]; ! 2159: ipc_object_t object; ! 2160: ! 2161: if (!MACH_PORT_VALID(port)) ! 2162: continue; ! 2163: ! 2164: kr = ipc_object_copyin(space, port, name, &object); ! 2165: ! 2166: if (kr != KERN_SUCCESS) { ! 2167: int k; ! 2168: ! 2169: for(k = 0; k < j; k++) { ! 2170: object = objects[k]; ! 2171: if (!MACH_PORT_VALID(port)) ! 2172: continue; ! 2173: ipc_object_destroy(object, dsc->disposition); ! 2174: } ! 2175: kfree(data, length); ! 2176: ipc_kmsg_clean_partial(kmsg, i, paddr, ! 2177: space_needed); ! 2178: return MACH_SEND_INVALID_RIGHT; ! 2179: } ! 2180: ! 2181: if ((dsc->disposition == MACH_MSG_TYPE_PORT_RECEIVE) && ! 2182: ipc_port_check_circularity( ! 2183: (ipc_port_t) object, ! 2184: (ipc_port_t) dest)) ! 2185: kmsg->ikm_header.msgh_bits |= MACH_MSGH_BITS_CIRCULAR; ! 2186: ! 2187: objects[j] = object; ! 2188: } ! 2189: ! 2190: complex = TRUE; ! 2191: break; ! 2192: } ! 2193: default: { ! 2194: /* ! 2195: * Invalid descriptor ! 2196: */ ! 2197: ipc_kmsg_clean_partial(kmsg, i, paddr, space_needed); ! 2198: return MACH_SEND_INVALID_TYPE; ! 2199: } ! 2200: } ! 2201: i++ ; ! 2202: } ! 2203: ! 2204: if (!complex) ! 2205: kmsg->ikm_header.msgh_bits &= ~MACH_MSGH_BITS_COMPLEX; ! 2206: ! 2207: return MACH_MSG_SUCCESS; ! 2208: } ! 2209: ! 2210: ! 2211: /* ! 2212: * Routine: ipc_kmsg_copyin ! 2213: * Purpose: ! 2214: * "Copy-in" port rights and out-of-line memory ! 2215: * in the message. ! 2216: * ! 2217: * In all failure cases, the message is left holding ! 2218: * no rights or memory. However, the message buffer ! 2219: * is not deallocated. If successful, the message ! 2220: * contains a valid destination port. ! 2221: * Conditions: ! 2222: * Nothing locked. ! 2223: * Returns: ! 2224: * MACH_MSG_SUCCESS Successful copyin. ! 2225: * MACH_SEND_INVALID_HEADER ! 2226: * Illegal value in the message header bits. ! 2227: * MACH_SEND_INVALID_NOTIFY Bad notify port. ! 2228: * MACH_SEND_INVALID_DEST Can't copyin destination port. ! 2229: * MACH_SEND_INVALID_REPLY Can't copyin reply port. ! 2230: * MACH_SEND_INVALID_MEMORY Can't grab out-of-line memory. ! 2231: * MACH_SEND_INVALID_RIGHT Can't copyin port right in body. ! 2232: * MACH_SEND_INVALID_TYPE Bad type specification. ! 2233: * MACH_SEND_MSG_TOO_SMALL Body is too small for types/data. ! 2234: */ ! 2235: ! 2236: mach_msg_return_t ! 2237: ipc_kmsg_copyin( ! 2238: ipc_kmsg_t kmsg, ! 2239: ipc_space_t space, ! 2240: vm_map_t map, ! 2241: mach_port_t notify) ! 2242: { ! 2243: mach_msg_return_t mr; ! 2244: ! 2245: mr = ipc_kmsg_copyin_header(&kmsg->ikm_header, space, notify); ! 2246: if (mr != MACH_MSG_SUCCESS) ! 2247: return mr; ! 2248: ! 2249: if ((kmsg->ikm_header.msgh_bits & MACH_MSGH_BITS_COMPLEX) == 0) ! 2250: return MACH_MSG_SUCCESS; ! 2251: ! 2252: return( ipc_kmsg_copyin_body( kmsg, space, map ) ); ! 2253: } ! 2254: ! 2255: /* ! 2256: * Routine: ipc_kmsg_copyin_from_kernel ! 2257: * Purpose: ! 2258: * "Copy-in" port rights and out-of-line memory ! 2259: * in a message sent from the kernel. ! 2260: * ! 2261: * Because the message comes from the kernel, ! 2262: * the implementation assumes there are no errors ! 2263: * or peculiarities in the message. ! 2264: * ! 2265: * Returns TRUE if queueing the message ! 2266: * would result in a circularity. ! 2267: * Conditions: ! 2268: * Nothing locked. ! 2269: */ ! 2270: ! 2271: void ! 2272: ipc_kmsg_copyin_from_kernel( ! 2273: ipc_kmsg_t kmsg) ! 2274: { ! 2275: mach_msg_bits_t bits = kmsg->ikm_header.msgh_bits &~ ! 2276: MACH_MSGH_BITS_OLD_FORMAT; ! 2277: mach_msg_type_name_t rname = MACH_MSGH_BITS_REMOTE(bits); ! 2278: mach_msg_type_name_t lname = MACH_MSGH_BITS_LOCAL(bits); ! 2279: ipc_object_t remote = (ipc_object_t) kmsg->ikm_header.msgh_remote_port; ! 2280: ipc_object_t local = (ipc_object_t) kmsg->ikm_header.msgh_local_port; ! 2281: ! 2282: /* translate the destination and reply ports */ ! 2283: ! 2284: ipc_object_copyin_from_kernel(remote, rname); ! 2285: if (IO_VALID(local)) ! 2286: ipc_object_copyin_from_kernel(local, lname); ! 2287: ! 2288: /* ! 2289: * The common case is a complex message with no reply port, ! 2290: * because that is what the memory_object interface uses. ! 2291: */ ! 2292: ! 2293: if (bits == (MACH_MSGH_BITS_COMPLEX | ! 2294: MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0))) { ! 2295: bits = (MACH_MSGH_BITS_COMPLEX | ! 2296: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, 0)); ! 2297: ! 2298: kmsg->ikm_header.msgh_bits = bits; ! 2299: } else { ! 2300: bits = (MACH_MSGH_BITS_OTHER(bits) | ! 2301: MACH_MSGH_BITS(ipc_object_copyin_type(rname), ! 2302: ipc_object_copyin_type(lname))); ! 2303: ! 2304: kmsg->ikm_header.msgh_bits = bits; ! 2305: if ((bits & MACH_MSGH_BITS_COMPLEX) == 0) ! 2306: return; ! 2307: } ! 2308: { ! 2309: mach_msg_descriptor_t *saddr, *eaddr; ! 2310: mach_msg_body_t *body; ! 2311: ! 2312: body = (mach_msg_body_t *) (&kmsg->ikm_header + 1); ! 2313: saddr = (mach_msg_descriptor_t *) (body + 1); ! 2314: eaddr = (mach_msg_descriptor_t *) saddr + body->msgh_descriptor_count; ! 2315: ! 2316: for ( ; saddr < eaddr; saddr++) { ! 2317: ! 2318: switch (saddr->type.type) { ! 2319: ! 2320: case MACH_MSG_PORT_DESCRIPTOR: { ! 2321: mach_msg_type_name_t name; ! 2322: ipc_object_t object; ! 2323: mach_msg_port_descriptor_t *dsc; ! 2324: ! 2325: dsc = &saddr->port; ! 2326: ! 2327: /* this is really the type SEND, SEND_ONCE, etc. */ ! 2328: name = dsc->disposition; ! 2329: object = (ipc_object_t) dsc->name; ! 2330: dsc->disposition = ipc_object_copyin_type(name); ! 2331: ! 2332: if (!IO_VALID(object)) { ! 2333: break; ! 2334: } ! 2335: ! 2336: ipc_object_copyin_from_kernel(object, name); ! 2337: ! 2338: if ((dsc->disposition == MACH_MSG_TYPE_PORT_RECEIVE) && ! 2339: ipc_port_check_circularity((ipc_port_t) object, ! 2340: (ipc_port_t) remote)) { ! 2341: kmsg->ikm_header.msgh_bits |= MACH_MSGH_BITS_CIRCULAR; ! 2342: } ! 2343: break; ! 2344: } ! 2345: case MACH_MSG_OOL_DESCRIPTOR: { ! 2346: /* ! 2347: * The sender should supply ready-made memory, i.e. ! 2348: * a vm_map_copy_t, so we don't need to do anything. ! 2349: */ ! 2350: break; ! 2351: } ! 2352: case MACH_MSG_OOL_PORTS_DESCRIPTOR: { ! 2353: ipc_object_t *objects; ! 2354: int j; ! 2355: mach_msg_type_name_t name; ! 2356: mach_msg_ool_ports_descriptor_t *dsc; ! 2357: ! 2358: dsc = &saddr->ool_ports; ! 2359: ! 2360: /* this is really the type SEND, SEND_ONCE, etc. */ ! 2361: name = dsc->disposition; ! 2362: dsc->disposition = ipc_object_copyin_type(name); ! 2363: ! 2364: objects = (ipc_object_t *) dsc->address; ! 2365: ! 2366: for ( j = 0; j < dsc->count; j++) { ! 2367: ipc_object_t object = objects[j]; ! 2368: ! 2369: if (!IO_VALID(object)) ! 2370: continue; ! 2371: ! 2372: ipc_object_copyin_from_kernel(object, name); ! 2373: ! 2374: if ((dsc->disposition == MACH_MSG_TYPE_PORT_RECEIVE) && ! 2375: ipc_port_check_circularity( ! 2376: (ipc_port_t) object, ! 2377: (ipc_port_t) remote)) ! 2378: kmsg->ikm_header.msgh_bits |= MACH_MSGH_BITS_CIRCULAR; ! 2379: } ! 2380: break; ! 2381: } ! 2382: default: { ! 2383: #if MACH_ASSERT ! 2384: panic("ipc_kmsg_copyin_from_kernel: bad descriptor type %d", ! 2385: saddr->type.type); ! 2386: #endif /* MACH_ASSERT */ ! 2387: } ! 2388: } ! 2389: } ! 2390: } ! 2391: } ! 2392: ! 2393: /* ! 2394: * Routine: ipc_kmsg_copyout_header ! 2395: * Purpose: ! 2396: * "Copy-out" port rights in the header of a message. ! 2397: * Operates atomically; if it doesn't succeed the ! 2398: * message header and the space are left untouched. ! 2399: * If it does succeed the remote/local port fields ! 2400: * contain port names instead of object pointers, ! 2401: * and the bits field is updated. ! 2402: * ! 2403: * The notify argument implements the MACH_RCV_NOTIFY option. ! 2404: * If it is not MACH_PORT_NULL, it should name a receive right. ! 2405: * If the process of receiving the reply port creates a ! 2406: * new right in the receiving task, then the new right is ! 2407: * automatically registered for a dead-name notification, ! 2408: * with the notify port supplying the send-once right. ! 2409: * Conditions: ! 2410: * Nothing locked. ! 2411: * Returns: ! 2412: * MACH_MSG_SUCCESS Copied out port rights. ! 2413: * MACH_RCV_INVALID_NOTIFY ! 2414: * Notify is non-null and doesn't name a receive right. ! 2415: * (Either KERN_INVALID_NAME or KERN_INVALID_RIGHT.) ! 2416: * MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_SPACE ! 2417: * The space is dead. ! 2418: * MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_SPACE ! 2419: * No room in space for another name. ! 2420: * MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_KERNEL ! 2421: * Couldn't allocate memory for the reply port. ! 2422: * MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_KERNEL ! 2423: * Couldn't allocate memory for the dead-name request. ! 2424: */ ! 2425: ! 2426: mach_msg_return_t ! 2427: ipc_kmsg_copyout_header( ! 2428: mach_msg_header_t *msg, ! 2429: ipc_space_t space, ! 2430: mach_port_t notify) ! 2431: { ! 2432: mach_msg_bits_t mbits = msg->msgh_bits; ! 2433: ipc_port_t dest = (ipc_port_t) msg->msgh_remote_port; ! 2434: ! 2435: assert(IP_VALID(dest)); ! 2436: ! 2437: /* first check for common cases */ ! 2438: ! 2439: if (notify == MACH_PORT_NULL) switch (MACH_MSGH_BITS_PORTS(mbits)) { ! 2440: case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, 0): { ! 2441: mach_port_t dest_name; ! 2442: ipc_port_t nsrequest; ! 2443: ! 2444: /* receiving an asynchronous message */ ! 2445: ! 2446: ip_lock(dest); ! 2447: if (!ip_active(dest)) { ! 2448: ip_unlock(dest); ! 2449: break; ! 2450: } ! 2451: ! 2452: /* optimized ipc_object_copyout_dest */ ! 2453: ! 2454: assert(dest->ip_srights > 0); ! 2455: ip_release(dest); ! 2456: ! 2457: if (dest->ip_receiver == space) ! 2458: dest_name = dest->ip_receiver_name; ! 2459: else ! 2460: dest_name = MACH_PORT_NULL; ! 2461: ! 2462: if ((--dest->ip_srights == 0) && ! 2463: ((nsrequest = dest->ip_nsrequest) != IP_NULL)) { ! 2464: mach_port_mscount_t mscount; ! 2465: ! 2466: dest->ip_nsrequest = IP_NULL; ! 2467: mscount = dest->ip_mscount; ! 2468: ip_unlock(dest); ! 2469: ! 2470: ipc_notify_no_senders(nsrequest, mscount); ! 2471: } else ! 2472: ip_unlock(dest); ! 2473: ! 2474: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 2475: MACH_MSGH_BITS(0, MACH_MSG_TYPE_PORT_SEND)); ! 2476: msg->msgh_local_port = dest_name; ! 2477: msg->msgh_remote_port = MACH_PORT_NULL; ! 2478: return MACH_MSG_SUCCESS; ! 2479: } ! 2480: ! 2481: case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND, ! 2482: MACH_MSG_TYPE_PORT_SEND_ONCE): { ! 2483: ipc_entry_t table; ! 2484: mach_port_index_t index; ! 2485: ipc_entry_t entry; ! 2486: ipc_port_t reply = (ipc_port_t) msg->msgh_local_port; ! 2487: mach_port_t dest_name, reply_name; ! 2488: ipc_port_t nsrequest; ! 2489: ! 2490: /* receiving a request message */ ! 2491: ! 2492: if (!IP_VALID(reply)) ! 2493: break; ! 2494: ! 2495: is_write_lock(space); ! 2496: if (!space->is_active || ! 2497: ((index = (table = space->is_table)->ie_next) == 0)) { ! 2498: is_write_unlock(space); ! 2499: break; ! 2500: } ! 2501: ! 2502: /* ! 2503: * To do an atomic copyout, need simultaneous ! 2504: * locks on both ports and the space. If ! 2505: * dest == reply, and simple locking is ! 2506: * enabled, then we will abort. Otherwise it's ! 2507: * OK to unlock twice. ! 2508: */ ! 2509: ! 2510: ip_lock(dest); ! 2511: if (!ip_active(dest) || !ip_lock_try(reply)) { ! 2512: ip_unlock(dest); ! 2513: is_write_unlock(space); ! 2514: break; ! 2515: } ! 2516: ! 2517: if (!ip_active(reply)) { ! 2518: ip_unlock(reply); ! 2519: ip_unlock(dest); ! 2520: is_write_unlock(space); ! 2521: break; ! 2522: } ! 2523: ! 2524: assert(reply->ip_sorights > 0); ! 2525: ip_unlock(reply); ! 2526: ! 2527: /* optimized ipc_entry_get */ ! 2528: ! 2529: entry = &table[index]; ! 2530: table->ie_next = entry->ie_next; ! 2531: entry->ie_request = 0; ! 2532: ! 2533: { ! 2534: mach_port_gen_t gen; ! 2535: ! 2536: assert((entry->ie_bits &~ IE_BITS_GEN_MASK) == 0); ! 2537: gen = entry->ie_bits + IE_BITS_GEN_ONE; ! 2538: ! 2539: reply_name = MACH_PORT_MAKE(index, gen); ! 2540: ! 2541: /* optimized ipc_right_copyout */ ! 2542: ! 2543: entry->ie_bits = gen | (MACH_PORT_TYPE_SEND_ONCE | 1); ! 2544: } ! 2545: ! 2546: assert(MACH_PORT_VALID(reply_name)); ! 2547: entry->ie_object = (ipc_object_t) reply; ! 2548: is_write_unlock(space); ! 2549: ! 2550: /* optimized ipc_object_copyout_dest */ ! 2551: ! 2552: assert(dest->ip_srights > 0); ! 2553: ip_release(dest); ! 2554: ! 2555: if (dest->ip_receiver == space) ! 2556: dest_name = dest->ip_receiver_name; ! 2557: else ! 2558: dest_name = MACH_PORT_NULL; ! 2559: ! 2560: if ((--dest->ip_srights == 0) && ! 2561: ((nsrequest = dest->ip_nsrequest) != IP_NULL)) { ! 2562: mach_port_mscount_t mscount; ! 2563: ! 2564: dest->ip_nsrequest = IP_NULL; ! 2565: mscount = dest->ip_mscount; ! 2566: ip_unlock(dest); ! 2567: ! 2568: ipc_notify_no_senders(nsrequest, mscount); ! 2569: } else ! 2570: ip_unlock(dest); ! 2571: ! 2572: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 2573: MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, ! 2574: MACH_MSG_TYPE_PORT_SEND)); ! 2575: msg->msgh_local_port = dest_name; ! 2576: msg->msgh_remote_port = reply_name; ! 2577: return MACH_MSG_SUCCESS; ! 2578: } ! 2579: ! 2580: case MACH_MSGH_BITS(MACH_MSG_TYPE_PORT_SEND_ONCE, 0): { ! 2581: mach_port_t dest_name; ! 2582: ! 2583: /* receiving a reply message */ ! 2584: ! 2585: ip_lock(dest); ! 2586: if (!ip_active(dest)) { ! 2587: ip_unlock(dest); ! 2588: break; ! 2589: } ! 2590: ! 2591: /* optimized ipc_object_copyout_dest */ ! 2592: ! 2593: assert(dest->ip_sorights > 0); ! 2594: ! 2595: if (dest->ip_receiver == space) { ! 2596: ip_release(dest); ! 2597: dest->ip_sorights--; ! 2598: dest_name = dest->ip_receiver_name; ! 2599: ip_unlock(dest); ! 2600: } else { ! 2601: ip_unlock(dest); ! 2602: ! 2603: ipc_notify_send_once(dest); ! 2604: dest_name = MACH_PORT_NULL; ! 2605: } ! 2606: ! 2607: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 2608: MACH_MSGH_BITS(0, MACH_MSG_TYPE_PORT_SEND_ONCE)); ! 2609: msg->msgh_local_port = dest_name; ! 2610: msg->msgh_remote_port = MACH_PORT_NULL; ! 2611: return MACH_MSG_SUCCESS; ! 2612: } ! 2613: ! 2614: default: ! 2615: /* don't bother optimizing */ ! 2616: break; ! 2617: } ! 2618: ! 2619: { ! 2620: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits); ! 2621: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits); ! 2622: ipc_port_t reply = (ipc_port_t) msg->msgh_local_port; ! 2623: mach_port_t dest_name, reply_name; ! 2624: ! 2625: if (IP_VALID(reply)) { ! 2626: ipc_port_t notify_port; ! 2627: ipc_entry_t entry; ! 2628: kern_return_t kr; ! 2629: ! 2630: /* ! 2631: * Handling notify (for MACH_RCV_NOTIFY) is tricky. ! 2632: * The problem is atomically making a send-once right ! 2633: * from the notify port and installing it for a ! 2634: * dead-name request in the new entry, because this ! 2635: * requires two port locks (on the notify port and ! 2636: * the reply port). However, we can safely make ! 2637: * and consume send-once rights for the notify port ! 2638: * as long as we hold the space locked. This isn't ! 2639: * an atomicity problem, because the only way ! 2640: * to detect that a send-once right has been created ! 2641: * and then consumed if it wasn't needed is by getting ! 2642: * at the receive right to look at ip_sorights, and ! 2643: * because the space is write-locked status calls can't ! 2644: * lookup the notify port receive right. When we make ! 2645: * the send-once right, we lock the notify port, ! 2646: * so any status calls in progress will be done. ! 2647: */ ! 2648: ! 2649: is_write_lock(space); ! 2650: ! 2651: for (;;) { ! 2652: ipc_port_request_index_t request; ! 2653: ! 2654: if (!space->is_active) { ! 2655: is_write_unlock(space); ! 2656: return (MACH_RCV_HEADER_ERROR| ! 2657: MACH_MSG_IPC_SPACE); ! 2658: } ! 2659: ! 2660: if (notify != MACH_PORT_NULL) { ! 2661: notify_port = ipc_port_lookup_notify(space, ! 2662: notify); ! 2663: if (notify_port == IP_NULL) { ! 2664: is_write_unlock(space); ! 2665: return MACH_RCV_INVALID_NOTIFY; ! 2666: } ! 2667: } else ! 2668: notify_port = IP_NULL; ! 2669: ! 2670: if ((reply_type != MACH_MSG_TYPE_PORT_SEND_ONCE) && ! 2671: ipc_right_reverse(space, (ipc_object_t) reply, ! 2672: &reply_name, &entry)) { ! 2673: /* reply port is locked and active */ ! 2674: ! 2675: /* ! 2676: * We don't need the notify_port ! 2677: * send-once right, but we can't release ! 2678: * it here because reply port is locked. ! 2679: * Wait until after the copyout to ! 2680: * release the notify port right. ! 2681: */ ! 2682: ! 2683: assert(entry->ie_bits & ! 2684: MACH_PORT_TYPE_SEND_RECEIVE); ! 2685: break; ! 2686: } ! 2687: ! 2688: ip_lock(reply); ! 2689: if (!ip_active(reply)) { ! 2690: ip_release(reply); ! 2691: ip_check_unlock(reply); ! 2692: ! 2693: if (notify_port != IP_NULL) ! 2694: ipc_port_release_sonce(notify_port); ! 2695: ! 2696: ip_lock(dest); ! 2697: is_write_unlock(space); ! 2698: ! 2699: reply = IP_DEAD; ! 2700: reply_name = MACH_PORT_DEAD; ! 2701: goto copyout_dest; ! 2702: } ! 2703: ! 2704: kr = ipc_entry_get(space, &reply_name, &entry); ! 2705: if (kr != KERN_SUCCESS) { ! 2706: ip_unlock(reply); ! 2707: ! 2708: if (notify_port != IP_NULL) ! 2709: ipc_port_release_sonce(notify_port); ! 2710: ! 2711: /* space is locked */ ! 2712: kr = ipc_entry_grow_table(space, ! 2713: ITS_SIZE_NONE); ! 2714: if (kr != KERN_SUCCESS) { ! 2715: /* space is unlocked */ ! 2716: ! 2717: if (kr == KERN_RESOURCE_SHORTAGE) ! 2718: return (MACH_RCV_HEADER_ERROR| ! 2719: MACH_MSG_IPC_KERNEL); ! 2720: else ! 2721: return (MACH_RCV_HEADER_ERROR| ! 2722: MACH_MSG_IPC_SPACE); ! 2723: } ! 2724: /* space is locked again; start over */ ! 2725: ! 2726: continue; ! 2727: } ! 2728: ! 2729: assert(IE_BITS_TYPE(entry->ie_bits) ! 2730: == MACH_PORT_TYPE_NONE); ! 2731: assert(entry->ie_object == IO_NULL); ! 2732: ! 2733: if (notify_port == IP_NULL) { ! 2734: /* not making a dead-name request */ ! 2735: ! 2736: entry->ie_object = (ipc_object_t) reply; ! 2737: break; ! 2738: } ! 2739: ! 2740: kr = ipc_port_dnrequest(reply, reply_name, ! 2741: notify_port, &request); ! 2742: if (kr != KERN_SUCCESS) { ! 2743: ip_unlock(reply); ! 2744: ! 2745: ipc_port_release_sonce(notify_port); ! 2746: ! 2747: ipc_entry_dealloc(space, reply_name, entry); ! 2748: is_write_unlock(space); ! 2749: ! 2750: ip_lock(reply); ! 2751: if (!ip_active(reply)) { ! 2752: /* will fail next time around loop */ ! 2753: ! 2754: ip_unlock(reply); ! 2755: is_write_lock(space); ! 2756: continue; ! 2757: } ! 2758: ! 2759: kr = ipc_port_dngrow(reply, ITS_SIZE_NONE); ! 2760: /* port is unlocked */ ! 2761: if (kr != KERN_SUCCESS) ! 2762: return (MACH_RCV_HEADER_ERROR| ! 2763: MACH_MSG_IPC_KERNEL); ! 2764: ! 2765: is_write_lock(space); ! 2766: continue; ! 2767: } ! 2768: ! 2769: notify_port = IP_NULL; /* don't release right below */ ! 2770: ! 2771: entry->ie_object = (ipc_object_t) reply; ! 2772: entry->ie_request = request; ! 2773: break; ! 2774: } ! 2775: ! 2776: /* space and reply port are locked and active */ ! 2777: ! 2778: ip_reference(reply); /* hold onto the reply port */ ! 2779: ! 2780: kr = ipc_right_copyout(space, reply_name, entry, ! 2781: reply_type, TRUE, (ipc_object_t) reply); ! 2782: /* reply port is unlocked */ ! 2783: assert(kr == KERN_SUCCESS); ! 2784: ! 2785: if (notify_port != IP_NULL) ! 2786: ipc_port_release_sonce(notify_port); ! 2787: ! 2788: ip_lock(dest); ! 2789: is_write_unlock(space); ! 2790: } else { ! 2791: /* ! 2792: * No reply port! This is an easy case. ! 2793: * We only need to have the space locked ! 2794: * when checking notify and when locking ! 2795: * the destination (to ensure atomicity). ! 2796: */ ! 2797: ! 2798: is_read_lock(space); ! 2799: if (!space->is_active) { ! 2800: is_read_unlock(space); ! 2801: return MACH_RCV_HEADER_ERROR|MACH_MSG_IPC_SPACE; ! 2802: } ! 2803: ! 2804: if (notify != MACH_PORT_NULL) { ! 2805: ipc_entry_t entry; ! 2806: ! 2807: /* must check notify even though it won't be used */ ! 2808: ! 2809: if (((entry = ipc_entry_lookup(space, notify)) ! 2810: == IE_NULL) || ! 2811: ((entry->ie_bits & MACH_PORT_TYPE_RECEIVE) == 0)) { ! 2812: is_read_unlock(space); ! 2813: return MACH_RCV_INVALID_NOTIFY; ! 2814: } ! 2815: } ! 2816: ! 2817: ip_lock(dest); ! 2818: is_read_unlock(space); ! 2819: ! 2820: reply_name = (mach_port_t) reply; ! 2821: } ! 2822: ! 2823: /* ! 2824: * At this point, the space is unlocked and the destination ! 2825: * port is locked. (Lock taken while space was locked.) ! 2826: * reply_name is taken care of; we still need dest_name. ! 2827: * We still hold a ref for reply (if it is valid). ! 2828: * ! 2829: * If the space holds receive rights for the destination, ! 2830: * we return its name for the right. Otherwise the task ! 2831: * managed to destroy or give away the receive right between ! 2832: * receiving the message and this copyout. If the destination ! 2833: * is dead, return MACH_PORT_DEAD, and if the receive right ! 2834: * exists somewhere else (another space, in transit) ! 2835: * return MACH_PORT_NULL. ! 2836: * ! 2837: * Making this copyout operation atomic with the previous ! 2838: * copyout of the reply port is a bit tricky. If there was ! 2839: * no real reply port (it wasn't IP_VALID) then this isn't ! 2840: * an issue. If the reply port was dead at copyout time, ! 2841: * then we are OK, because if dest is dead we serialize ! 2842: * after the death of both ports and if dest is alive ! 2843: * we serialize after reply died but before dest's (later) death. ! 2844: * So assume reply was alive when we copied it out. If dest ! 2845: * is alive, then we are OK because we serialize before ! 2846: * the ports' deaths. So assume dest is dead when we look at it. ! 2847: * If reply dies/died after dest, then we are OK because ! 2848: * we serialize after dest died but before reply dies. ! 2849: * So the hard case is when reply is alive at copyout, ! 2850: * dest is dead at copyout, and reply died before dest died. ! 2851: * In this case pretend that dest is still alive, so ! 2852: * we serialize while both ports are alive. ! 2853: * ! 2854: * Because the space lock is held across the copyout of reply ! 2855: * and locking dest, the receive right for dest can't move ! 2856: * in or out of the space while the copyouts happen, so ! 2857: * that isn't an atomicity problem. In the last hard case ! 2858: * above, this implies that when dest is dead that the ! 2859: * space couldn't have had receive rights for dest at ! 2860: * the time reply was copied-out, so when we pretend ! 2861: * that dest is still alive, we can return MACH_PORT_NULL. ! 2862: * ! 2863: * If dest == reply, then we have to make it look like ! 2864: * either both copyouts happened before the port died, ! 2865: * or both happened after the port died. This special ! 2866: * case works naturally if the timestamp comparison ! 2867: * is done correctly. ! 2868: */ ! 2869: ! 2870: copyout_dest: ! 2871: ! 2872: if (ip_active(dest)) { ! 2873: ipc_object_copyout_dest(space, (ipc_object_t) dest, ! 2874: dest_type, &dest_name); ! 2875: /* dest is unlocked */ ! 2876: } else { ! 2877: ipc_port_timestamp_t timestamp; ! 2878: ! 2879: timestamp = dest->ip_timestamp; ! 2880: ip_release(dest); ! 2881: ip_check_unlock(dest); ! 2882: ! 2883: if (IP_VALID(reply)) { ! 2884: ip_lock(reply); ! 2885: if (ip_active(reply) || ! 2886: IP_TIMESTAMP_ORDER(timestamp, ! 2887: reply->ip_timestamp)) ! 2888: dest_name = MACH_PORT_DEAD; ! 2889: else ! 2890: dest_name = MACH_PORT_NULL; ! 2891: ip_unlock(reply); ! 2892: } else ! 2893: dest_name = MACH_PORT_DEAD; ! 2894: } ! 2895: ! 2896: if (IP_VALID(reply)) ! 2897: ipc_port_release(reply); ! 2898: ! 2899: msg->msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 2900: MACH_MSGH_BITS(reply_type, dest_type)); ! 2901: msg->msgh_local_port = dest_name; ! 2902: msg->msgh_remote_port = reply_name; ! 2903: } ! 2904: ! 2905: return MACH_MSG_SUCCESS; ! 2906: } ! 2907: ! 2908: /* ! 2909: * Routine: ipc_kmsg_copyout_object ! 2910: * Purpose: ! 2911: * Copy-out a port right. Always returns a name, ! 2912: * even for unsuccessful return codes. Always ! 2913: * consumes the supplied object. ! 2914: * Conditions: ! 2915: * Nothing locked. ! 2916: * Returns: ! 2917: * MACH_MSG_SUCCESS The space acquired the right ! 2918: * (name is valid) or the object is dead (MACH_PORT_DEAD). ! 2919: * MACH_MSG_IPC_SPACE No room in space for the right, ! 2920: * or the space is dead. (Name is MACH_PORT_NULL.) ! 2921: * MACH_MSG_IPC_KERNEL Kernel resource shortage. ! 2922: * (Name is MACH_PORT_NULL.) ! 2923: */ ! 2924: ! 2925: mach_msg_return_t ! 2926: ipc_kmsg_copyout_object( ! 2927: ipc_space_t space, ! 2928: ipc_object_t object, ! 2929: mach_msg_type_name_t msgt_name, ! 2930: mach_port_t *namep) ! 2931: { ! 2932: if (!IO_VALID(object)) { ! 2933: *namep = (mach_port_t) object; ! 2934: return MACH_MSG_SUCCESS; ! 2935: } ! 2936: ! 2937: /* ! 2938: * Attempt quick copyout of send rights. We optimize for a ! 2939: * live port for which the receiver holds send (and not ! 2940: * receive) rights in his local table. ! 2941: */ ! 2942: ! 2943: if (msgt_name != MACH_MSG_TYPE_PORT_SEND) ! 2944: goto slow_copyout; ! 2945: ! 2946: { ! 2947: register ipc_port_t port = (ipc_port_t) object; ! 2948: ipc_entry_t entry; ! 2949: ! 2950: is_write_lock(space); ! 2951: if (!space->is_active) { ! 2952: is_write_unlock(space); ! 2953: goto slow_copyout; ! 2954: } ! 2955: ! 2956: ip_lock(port); ! 2957: if (!ip_active(port) || ! 2958: !ipc_hash_local_lookup(space, (ipc_object_t) port, ! 2959: namep, &entry)) { ! 2960: ip_unlock(port); ! 2961: is_write_unlock(space); ! 2962: goto slow_copyout; ! 2963: } ! 2964: ! 2965: /* ! 2966: * Copyout the send right, incrementing urefs ! 2967: * unless it would overflow, and consume the right. ! 2968: */ ! 2969: ! 2970: assert(port->ip_srights > 1); ! 2971: port->ip_srights--; ! 2972: ip_release(port); ! 2973: ip_unlock(port); ! 2974: ! 2975: assert(entry->ie_bits & MACH_PORT_TYPE_SEND); ! 2976: assert(IE_BITS_UREFS(entry->ie_bits) > 0); ! 2977: assert(IE_BITS_UREFS(entry->ie_bits) < MACH_PORT_UREFS_MAX); ! 2978: ! 2979: { ! 2980: register ipc_entry_bits_t bits = entry->ie_bits + 1; ! 2981: ! 2982: if (IE_BITS_UREFS(bits) < MACH_PORT_UREFS_MAX) ! 2983: entry->ie_bits = bits; ! 2984: } ! 2985: ! 2986: is_write_unlock(space); ! 2987: return MACH_MSG_SUCCESS; ! 2988: } ! 2989: ! 2990: slow_copyout: { ! 2991: kern_return_t kr; ! 2992: ! 2993: kr = ipc_object_copyout(space, object, msgt_name, TRUE, namep); ! 2994: if (kr != KERN_SUCCESS) { ! 2995: ipc_object_destroy(object, msgt_name); ! 2996: ! 2997: if (kr == KERN_INVALID_CAPABILITY) ! 2998: *namep = MACH_PORT_DEAD; ! 2999: else { ! 3000: *namep = MACH_PORT_NULL; ! 3001: ! 3002: if (kr == KERN_RESOURCE_SHORTAGE) ! 3003: return MACH_MSG_IPC_KERNEL; ! 3004: else ! 3005: return MACH_MSG_IPC_SPACE; ! 3006: } ! 3007: } ! 3008: ! 3009: return MACH_MSG_SUCCESS; ! 3010: } ! 3011: } ! 3012: ! 3013: #define SKIP_PORT_DESCRIPTORS(s, e) \ ! 3014: MACRO_BEGIN \ ! 3015: if ((s) != MACH_MSG_DESCRIPTOR_NULL) { \ ! 3016: while ((s) < (e)) { \ ! 3017: if ((s)->type.type != MACH_MSG_PORT_DESCRIPTOR) \ ! 3018: break; \ ! 3019: (s)++; \ ! 3020: } \ ! 3021: if ((s) >= (e)) \ ! 3022: (s) = MACH_MSG_DESCRIPTOR_NULL; \ ! 3023: } \ ! 3024: MACRO_END ! 3025: ! 3026: #define INCREMENT_SCATTER(s) \ ! 3027: MACRO_BEGIN \ ! 3028: if ((s) != MACH_MSG_DESCRIPTOR_NULL) { \ ! 3029: (s)++; \ ! 3030: } \ ! 3031: MACRO_END ! 3032: ! 3033: /* ! 3034: * Routine: ipc_kmsg_copyout_body ! 3035: * Purpose: ! 3036: * "Copy-out" port rights and out-of-line memory ! 3037: * in the body of a message. ! 3038: * ! 3039: * The error codes are a combination of special bits. ! 3040: * The copyout proceeds despite errors. ! 3041: * Conditions: ! 3042: * Nothing locked. ! 3043: * Returns: ! 3044: * MACH_MSG_SUCCESS Successfull copyout. ! 3045: * MACH_MSG_IPC_SPACE No room for port right in name space. ! 3046: * MACH_MSG_VM_SPACE No room for memory in address space. ! 3047: * MACH_MSG_IPC_KERNEL Resource shortage handling port right. ! 3048: * MACH_MSG_VM_KERNEL Resource shortage handling memory. ! 3049: */ ! 3050: ! 3051: mach_msg_return_t ! 3052: ipc_kmsg_copyout_body( ! 3053: ipc_kmsg_t kmsg, ! 3054: ipc_space_t space, ! 3055: vm_map_t map, ! 3056: ipc_kmsg_t list) ! 3057: { ! 3058: mach_msg_body_t *body; ! 3059: mach_msg_descriptor_t *saddr, *eaddr; ! 3060: mach_msg_return_t mr = MACH_MSG_SUCCESS; ! 3061: kern_return_t kr; ! 3062: vm_offset_t data; ! 3063: mach_msg_descriptor_t *sstart, *send; ! 3064: ! 3065: body = (mach_msg_body_t *) (&kmsg->ikm_header + 1); ! 3066: saddr = (mach_msg_descriptor_t *) (body + 1); ! 3067: eaddr = saddr + body->msgh_descriptor_count; ! 3068: ! 3069: /* ! 3070: * Do scatter list setup ! 3071: */ ! 3072: if (list != IKM_NULL) { ! 3073: mach_msg_body_t *sbody = ! 3074: (mach_msg_body_t *)(&list->ikm_header + 1); ! 3075: ! 3076: sstart = (mach_msg_descriptor_t *) (sbody + 1); ! 3077: send = sstart + sbody->msgh_descriptor_count; ! 3078: } ! 3079: else ! 3080: sstart = MACH_MSG_DESCRIPTOR_NULL; ! 3081: ! 3082: for ( ; saddr < eaddr; saddr++ ) { ! 3083: ! 3084: switch (saddr->type.type) { ! 3085: ! 3086: case MACH_MSG_PORT_DESCRIPTOR: { ! 3087: mach_msg_port_descriptor_t *dsc; ! 3088: ! 3089: /* ! 3090: * Copyout port right carried in the message ! 3091: */ ! 3092: dsc = &saddr->port; ! 3093: mr |= ipc_kmsg_copyout_object(space, ! 3094: (ipc_object_t) dsc->name, ! 3095: dsc->disposition, ! 3096: (mach_port_t *) &dsc->name); ! 3097: ! 3098: break; ! 3099: } ! 3100: case MACH_MSG_OOL_DESCRIPTOR : { ! 3101: vm_offset_t rcv_addr; ! 3102: vm_offset_t snd_addr; ! 3103: mach_msg_ool_descriptor_t *dsc; ! 3104: mach_msg_copy_options_t copy_option; ! 3105: ! 3106: SKIP_PORT_DESCRIPTORS(sstart, send); ! 3107: ! 3108: dsc = &saddr->out_of_line; ! 3109: ! 3110: assert(dsc->copy != MACH_MSG_KALLOC_COPY_T); ! 3111: assert(dsc->copy != MACH_MSG_PAGE_LIST_COPY_T); ! 3112: ! 3113: copy_option = dsc->copy; ! 3114: ! 3115: if ((snd_addr = (vm_offset_t) dsc->address) != 0) { ! 3116: if (sstart != MACH_MSG_DESCRIPTOR_NULL && ! 3117: sstart->out_of_line.copy == MACH_MSG_OVERWRITE) { ! 3118: ! 3119: /* ! 3120: * There is an overwrite descriptor specified in the ! 3121: * scatter list for this ool data. The descriptor ! 3122: * has already been verified ! 3123: */ ! 3124: rcv_addr = (vm_offset_t) sstart->out_of_line.address; ! 3125: dsc->copy = MACH_MSG_OVERWRITE; ! 3126: } else { ! 3127: dsc->copy = MACH_MSG_ALLOCATE; ! 3128: } ! 3129: ! 3130: #if MACH_OLD_VM_COPY ! 3131: if (dsc->copy == MACH_MSG_OVERWRITE) { ! 3132: kr = vm_map_copy( ! 3133: map, ipc_soft_map, ! 3134: rcv_addr, dsc->size, snd_addr, ! 3135: FALSE, FALSE); ! 3136: } ! 3137: else { ! 3138: kr = vm_move( ! 3139: ipc_soft_map, snd_addr, ! 3140: map, dsc->size, FALSE, &rcv_addr); ! 3141: } ! 3142: (void) vm_deallocate(ipc_soft_map, snd_addr, dsc->size); ! 3143: if (kr != KERN_SUCCESS) { ! 3144: if (kr == KERN_RESOURCE_SHORTAGE) ! 3145: mr |= MACH_MSG_VM_KERNEL; ! 3146: else ! 3147: mr |= MACH_MSG_VM_SPACE; ! 3148: dsc->address = 0; ! 3149: INCREMENT_SCATTER(sstart); ! 3150: break; ! 3151: } ! 3152: #else ! 3153: if (copy_option == MACH_MSG_PHYSICAL_COPY && ! 3154: dsc->size <= MSG_OOL_SIZE_SMALL(rt)) { ! 3155: ! 3156: /* ! 3157: * Sufficiently 'small' data was copied into a kalloc'ed ! 3158: * buffer copy was requested. Just copy it out and ! 3159: * free the buffer. ! 3160: */ ! 3161: if (dsc->copy == MACH_MSG_ALLOCATE) { ! 3162: ! 3163: /* ! 3164: * If there is no overwrite region, allocate ! 3165: * space in receiver's address space for the ! 3166: * data ! 3167: */ ! 3168: if ((kr = vm_allocate(map, &rcv_addr, dsc->size, ! 3169: TRUE)) != KERN_SUCCESS) { ! 3170: if (kr == KERN_RESOURCE_SHORTAGE) ! 3171: mr |= MACH_MSG_VM_KERNEL; ! 3172: else ! 3173: mr |= MACH_MSG_VM_SPACE; ! 3174: kfree(snd_addr, dsc->size); ! 3175: dsc->address = (void *) 0; ! 3176: INCREMENT_SCATTER(sstart); ! 3177: break; ! 3178: } ! 3179: } ! 3180: (void) copyoutmap(map, snd_addr, rcv_addr, dsc->size); ! 3181: kfree(snd_addr, dsc->size); ! 3182: } else { ! 3183: ! 3184: /* ! 3185: * Whether the data was virtually or physically ! 3186: * copied we have a vm_map_copy_t for it. ! 3187: * If there's an overwrite region specified ! 3188: * overwrite it, otherwise do a virtual copy out. ! 3189: */ ! 3190: if (dsc->copy == MACH_MSG_OVERWRITE) { ! 3191: kr = vm_map_copy_overwrite(map, rcv_addr, ! 3192: (vm_map_copy_t) dsc->address, TRUE); ! 3193: } else { ! 3194: kr = vm_map_copyout(map, &rcv_addr, ! 3195: (vm_map_copy_t) dsc->address); ! 3196: } ! 3197: if (kr != KERN_SUCCESS) { ! 3198: if (kr == KERN_RESOURCE_SHORTAGE) ! 3199: mr |= MACH_MSG_VM_KERNEL; ! 3200: else ! 3201: mr |= MACH_MSG_VM_SPACE; ! 3202: vm_map_copy_discard((vm_map_copy_t) dsc->address); ! 3203: dsc->address = 0; ! 3204: INCREMENT_SCATTER(sstart); ! 3205: break; ! 3206: } ! 3207: } ! 3208: #endif ! 3209: dsc->address = (void *) rcv_addr; ! 3210: } ! 3211: INCREMENT_SCATTER(sstart); ! 3212: break; ! 3213: } ! 3214: case MACH_MSG_OOL_PORTS_DESCRIPTOR : { ! 3215: vm_offset_t addr; ! 3216: mach_port_t *objects; ! 3217: mach_msg_type_number_t j; ! 3218: vm_size_t length; ! 3219: mach_msg_ool_ports_descriptor_t *dsc; ! 3220: ! 3221: SKIP_PORT_DESCRIPTORS(sstart, send); ! 3222: ! 3223: dsc = &saddr->ool_ports; ! 3224: ! 3225: length = dsc->count * sizeof(mach_port_t); ! 3226: ! 3227: if (length != 0) { ! 3228: if (sstart != MACH_MSG_DESCRIPTOR_NULL && ! 3229: sstart->ool_ports.copy == MACH_MSG_OVERWRITE) { ! 3230: ! 3231: /* ! 3232: * There is an overwrite descriptor specified in the ! 3233: * scatter list for this ool data. The descriptor ! 3234: * has already been verified ! 3235: */ ! 3236: addr = (vm_offset_t) sstart->out_of_line.address; ! 3237: dsc->copy = MACH_MSG_OVERWRITE; ! 3238: } ! 3239: else { ! 3240: ! 3241: /* ! 3242: * Dynamically allocate the region ! 3243: */ ! 3244: dsc->copy = MACH_MSG_ALLOCATE; ! 3245: if ((kr = vm_allocate(map, &addr, length, TRUE)) != ! 3246: KERN_SUCCESS) { ! 3247: ipc_kmsg_clean_body(kmsg, ! 3248: body->msgh_descriptor_count); ! 3249: dsc->address = 0; ! 3250: ! 3251: if (kr == KERN_RESOURCE_SHORTAGE){ ! 3252: mr |= MACH_MSG_VM_KERNEL; ! 3253: } else { ! 3254: mr |= MACH_MSG_VM_SPACE; ! 3255: } ! 3256: INCREMENT_SCATTER(sstart); ! 3257: break; ! 3258: } ! 3259: } ! 3260: } else { ! 3261: assert(dsc->address == 0); ! 3262: INCREMENT_SCATTER(sstart); ! 3263: break; ! 3264: } ! 3265: ! 3266: ! 3267: objects = (mach_port_t *) dsc->address ; ! 3268: ! 3269: /* copyout port rights carried in the message */ ! 3270: ! 3271: for ( j = 0; j < dsc->count ; j++) { ! 3272: ipc_object_t object = ! 3273: (ipc_object_t) objects[j]; ! 3274: ! 3275: mr |= ipc_kmsg_copyout_object(space, object, ! 3276: dsc->disposition, &objects[j]); ! 3277: } ! 3278: ! 3279: /* copyout to memory allocated above */ ! 3280: ! 3281: data = (vm_offset_t) dsc->address; ! 3282: (void) copyoutmap(map, data, addr, length); ! 3283: kfree(data, length); ! 3284: ! 3285: dsc->address = (void *) addr; ! 3286: INCREMENT_SCATTER(sstart); ! 3287: break; ! 3288: } ! 3289: default : { ! 3290: panic("ipc_kmsg_copyout_body: bad descriptor type %d", ! 3291: saddr->type.type); ! 3292: } ! 3293: } ! 3294: } ! 3295: return mr; ! 3296: } ! 3297: ! 3298: /* ! 3299: * Routine: ipc_kmsg_copyout ! 3300: * Purpose: ! 3301: * "Copy-out" port rights and out-of-line memory ! 3302: * in the message. ! 3303: * Conditions: ! 3304: * Nothing locked. ! 3305: * Returns: ! 3306: * MACH_MSG_SUCCESS Copied out all rights and memory. ! 3307: * MACH_RCV_INVALID_NOTIFY Bad notify port. ! 3308: * Rights and memory in the message are intact. ! 3309: * MACH_RCV_HEADER_ERROR + special bits ! 3310: * Rights and memory in the message are intact. ! 3311: * MACH_RCV_BODY_ERROR + special bits ! 3312: * The message header was successfully copied out. ! 3313: * As much of the body was handled as possible. ! 3314: */ ! 3315: ! 3316: mach_msg_return_t ! 3317: ipc_kmsg_copyout( ! 3318: ipc_kmsg_t kmsg, ! 3319: ipc_space_t space, ! 3320: vm_map_t map, ! 3321: mach_port_t notify, ! 3322: ipc_kmsg_t list) ! 3323: { ! 3324: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits; ! 3325: mach_msg_return_t mr; ! 3326: ! 3327: mr = ipc_kmsg_copyout_header(&kmsg->ikm_header, space, notify); ! 3328: if (mr != MACH_MSG_SUCCESS) ! 3329: return mr; ! 3330: ! 3331: if (mbits & MACH_MSGH_BITS_COMPLEX) { ! 3332: mr = ipc_kmsg_copyout_body(kmsg, space, map, list); ! 3333: ! 3334: if (mr != MACH_MSG_SUCCESS) ! 3335: mr |= MACH_RCV_BODY_ERROR; ! 3336: } ! 3337: ! 3338: return mr; ! 3339: } ! 3340: ! 3341: /* ! 3342: * Routine: ipc_kmsg_copyout_pseudo ! 3343: * Purpose: ! 3344: * Does a pseudo-copyout of the message. ! 3345: * This is like a regular copyout, except ! 3346: * that the ports in the header are handled ! 3347: * as if they are in the body. They aren't reversed. ! 3348: * ! 3349: * The error codes are a combination of special bits. ! 3350: * The copyout proceeds despite errors. ! 3351: * Conditions: ! 3352: * Nothing locked. ! 3353: * Returns: ! 3354: * MACH_MSG_SUCCESS Successful copyout. ! 3355: * MACH_MSG_IPC_SPACE No room for port right in name space. ! 3356: * MACH_MSG_VM_SPACE No room for memory in address space. ! 3357: * MACH_MSG_IPC_KERNEL Resource shortage handling port right. ! 3358: * MACH_MSG_VM_KERNEL Resource shortage handling memory. ! 3359: */ ! 3360: ! 3361: mach_msg_return_t ! 3362: ipc_kmsg_copyout_pseudo( ! 3363: ipc_kmsg_t kmsg, ! 3364: ipc_space_t space, ! 3365: vm_map_t map, ! 3366: ipc_kmsg_t list) ! 3367: { ! 3368: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits; ! 3369: ipc_object_t dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port; ! 3370: ipc_object_t reply = (ipc_object_t) kmsg->ikm_header.msgh_local_port; ! 3371: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits); ! 3372: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits); ! 3373: mach_port_t dest_name, reply_name; ! 3374: mach_msg_return_t mr; ! 3375: ! 3376: assert(IO_VALID(dest)); ! 3377: ! 3378: mr = (ipc_kmsg_copyout_object(space, dest, dest_type, &dest_name) | ! 3379: ipc_kmsg_copyout_object(space, reply, reply_type, &reply_name)); ! 3380: ! 3381: kmsg->ikm_header.msgh_bits = mbits &~ MACH_MSGH_BITS_CIRCULAR; ! 3382: kmsg->ikm_header.msgh_remote_port = dest_name; ! 3383: kmsg->ikm_header.msgh_local_port = reply_name; ! 3384: ! 3385: if (mbits & MACH_MSGH_BITS_COMPLEX) { ! 3386: mr |= ipc_kmsg_copyout_body(kmsg, space, map, list); ! 3387: } ! 3388: ! 3389: return mr; ! 3390: } ! 3391: ! 3392: /* ! 3393: * Routine: ipc_kmsg_copyout_dest ! 3394: * Purpose: ! 3395: * Copies out the destination port in the message. ! 3396: * Destroys all other rights and memory in the message. ! 3397: * Conditions: ! 3398: * Nothing locked. ! 3399: */ ! 3400: ! 3401: void ! 3402: ipc_kmsg_copyout_dest( ! 3403: ipc_kmsg_t kmsg, ! 3404: ipc_space_t space) ! 3405: { ! 3406: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits; ! 3407: ipc_object_t dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port; ! 3408: ipc_object_t reply = (ipc_object_t) kmsg->ikm_header.msgh_local_port; ! 3409: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits); ! 3410: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits); ! 3411: mach_port_t dest_name, reply_name; ! 3412: ! 3413: assert(IO_VALID(dest)); ! 3414: ! 3415: io_lock(dest); ! 3416: if (io_active(dest)) { ! 3417: ipc_object_copyout_dest(space, dest, dest_type, &dest_name); ! 3418: /* dest is unlocked */ ! 3419: } else { ! 3420: io_release(dest); ! 3421: io_check_unlock(dest); ! 3422: dest_name = MACH_PORT_DEAD; ! 3423: } ! 3424: ! 3425: if (IO_VALID(reply)) { ! 3426: ipc_object_destroy(reply, reply_type); ! 3427: reply_name = MACH_PORT_NULL; ! 3428: } else ! 3429: reply_name = (mach_port_t) reply; ! 3430: ! 3431: kmsg->ikm_header.msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 3432: MACH_MSGH_BITS(reply_type, dest_type)); ! 3433: kmsg->ikm_header.msgh_local_port = dest_name; ! 3434: kmsg->ikm_header.msgh_remote_port = reply_name; ! 3435: ! 3436: if (mbits & MACH_MSGH_BITS_COMPLEX) { ! 3437: if (mbits & MACH_MSGH_BITS_OLD_FORMAT) { ! 3438: vm_offset_t saddr, eaddr; ! 3439: ! 3440: saddr = (vm_offset_t) (&kmsg->ikm_header + 1); ! 3441: eaddr = (vm_offset_t) &kmsg->ikm_header + ! 3442: kmsg->ikm_header.msgh_size; ! 3443: ! 3444: ipc_kmsg_clean_body_compat(saddr, eaddr); ! 3445: } ! 3446: else { ! 3447: mach_msg_body_t *body; ! 3448: ! 3449: body = (mach_msg_body_t *) (&kmsg->ikm_header + 1); ! 3450: ipc_kmsg_clean_body(kmsg, body->msgh_descriptor_count); ! 3451: } ! 3452: } ! 3453: } ! 3454: ! 3455: /* ! 3456: * Routine: ipc_kmsg_check_scatter ! 3457: * Purpose: ! 3458: * Checks scatter and gather lists for consistency. ! 3459: * ! 3460: * Algorithm: ! 3461: * The gather is assumed valid since it has been copied in. ! 3462: * The scatter list has only been range checked. ! 3463: * Gather list descriptors are sequentially paired with scatter ! 3464: * list descriptors, with port descriptors in either list ignored. ! 3465: * Descriptors are consistent if the type fileds match and size ! 3466: * of the scatter descriptor is less than or equal to the ! 3467: * size of the gather descriptor. A MACH_MSG_ALLOCATE copy ! 3468: * strategy in a scatter descriptor matches any size in the ! 3469: * corresponding gather descriptor assuming they are the same type. ! 3470: * Either list may be larger than the other. During the ! 3471: * subsequent copy out, excess scatter descriptors are ignored ! 3472: * and excess gather descriptors default to dynamic allocation. ! 3473: * ! 3474: * In the case of a size error, a new scatter list is formed ! 3475: * from the gather list copying only the size and type fields. ! 3476: * ! 3477: * Conditions: ! 3478: * Nothing locked. ! 3479: * Returns: ! 3480: * MACH_MSG_SUCCESS Lists are consistent ! 3481: * MACH_RCV_INVALID_TYPE Scatter type does not match ! 3482: * gather type ! 3483: * MACH_RCV_SCATTER_SMALL Scatter size less than gather ! 3484: * size ! 3485: */ ! 3486: ! 3487: mach_msg_return_t ! 3488: ipc_kmsg_check_scatter( ! 3489: ipc_kmsg_t kmsg, ! 3490: mach_msg_option_t option, ! 3491: ipc_kmsg_t *list) ! 3492: { ! 3493: mach_msg_body_t *gbody, *sbody; ! 3494: mach_msg_descriptor_t *gstart, *gend; ! 3495: mach_msg_descriptor_t *sstart, *send; ! 3496: boolean_t size_error = FALSE; ! 3497: ! 3498: assert(*list != IKM_NULL); ! 3499: ! 3500: gbody = (mach_msg_body_t *) (&kmsg->ikm_header + 1); ! 3501: gstart = (mach_msg_descriptor_t *) (gbody + 1); ! 3502: gend = gstart + gbody->msgh_descriptor_count; ! 3503: ! 3504: sbody = (mach_msg_body_t *) (&(*list)->ikm_header + 1); ! 3505: sstart = (mach_msg_descriptor_t *) (sbody + 1); ! 3506: send = sstart + sbody->msgh_descriptor_count; ! 3507: ! 3508: while (gstart < gend) { ! 3509: ! 3510: /* ! 3511: * Skip port descriptors in gather list. ! 3512: */ ! 3513: if (gstart->type.type != MACH_MSG_PORT_DESCRIPTOR) { ! 3514: ! 3515: /* ! 3516: * A scatter list with a 0 descriptor count is treated as an ! 3517: * automatic size mismatch. ! 3518: */ ! 3519: if (sbody->msgh_descriptor_count == 0) { ! 3520: if ((option & MACH_RCV_LARGE) == 0) ! 3521: return MACH_RCV_SCATTER_SMALL; ! 3522: size_error = TRUE; ! 3523: break; ! 3524: } ! 3525: ! 3526: /* ! 3527: * Skip port descriptors in scatter list. ! 3528: */ ! 3529: while (sstart < send) { ! 3530: if (sstart->type.type != MACH_MSG_PORT_DESCRIPTOR) ! 3531: break; ! 3532: sstart++; ! 3533: } ! 3534: ! 3535: /* ! 3536: * No more scatter descriptors, we're done ! 3537: */ ! 3538: if (sstart >= send) ! 3539: break; ! 3540: ! 3541: /* ! 3542: * Check type, copy and size fields ! 3543: */ ! 3544: if (gstart->type.type == MACH_MSG_OOL_DESCRIPTOR) { ! 3545: if (sstart->type.type != MACH_MSG_OOL_DESCRIPTOR) ! 3546: return MACH_RCV_INVALID_TYPE; ! 3547: ! 3548: if (sstart->out_of_line.copy == MACH_MSG_OVERWRITE && ! 3549: gstart->out_of_line.size > sstart->out_of_line.size) { ! 3550: if ((option & MACH_RCV_LARGE) == 0) ! 3551: return MACH_RCV_SCATTER_SMALL; ! 3552: size_error = TRUE; ! 3553: } ! 3554: } ! 3555: else { ! 3556: if (sstart->type.type != MACH_MSG_OOL_PORTS_DESCRIPTOR) ! 3557: return MACH_RCV_INVALID_TYPE; ! 3558: ! 3559: if (sstart->ool_ports.copy == MACH_MSG_OVERWRITE && ! 3560: gstart->ool_ports.count > sstart->ool_ports.count) { ! 3561: if ((option & MACH_RCV_LARGE) == 0) ! 3562: return MACH_RCV_SCATTER_SMALL; ! 3563: size_error = TRUE; ! 3564: } ! 3565: } ! 3566: sstart++; ! 3567: } ! 3568: gstart++; ! 3569: } ! 3570: ! 3571: /* ! 3572: * If there is a size error, form a new scatter list from the ! 3573: * gather list. ! 3574: */ ! 3575: if (size_error) { ! 3576: ipc_kmsg_t new_list; ! 3577: mach_msg_size_t new_size = (unsigned)gend - (unsigned)gbody; ! 3578: ! 3579: new_list = ikm_alloc(new_size); ! 3580: if (new_list == IKM_NULL) ! 3581: return MACH_MSG_VM_KERNEL|MACH_RCV_BODY_ERROR; ! 3582: ! 3583: new_list->ikm_header = (*list)->ikm_header; ! 3584: new_list->ikm_header.msgh_size = new_size; ! 3585: ! 3586: ikm_free(*list); (*list) = new_list; ! 3587: ! 3588: /* ! 3589: * Now fill in the descriptor count and the type and size ! 3590: * fields for each descriptor ! 3591: */ ! 3592: sbody = (mach_msg_body_t *)(&new_list->ikm_header + 1); ! 3593: sbody->msgh_descriptor_count = gbody->msgh_descriptor_count; ! 3594: sstart = (mach_msg_descriptor_t *) (sbody + 1); ! 3595: ! 3596: gstart = (mach_msg_descriptor_t *) (gbody + 1); ! 3597: gend = gstart + gbody->msgh_descriptor_count; ! 3598: ! 3599: for (; gstart < gend; gstart++, sstart++) { ! 3600: sstart->type.type = gstart->type.type; ! 3601: switch (gstart->type.type) { ! 3602: case MACH_MSG_PORT_DESCRIPTOR: ! 3603: break; ! 3604: case MACH_MSG_OOL_DESCRIPTOR: ! 3605: sstart->out_of_line.size = gstart->out_of_line.size; ! 3606: break; ! 3607: case MACH_MSG_OOL_PORTS_DESCRIPTOR: ! 3608: sstart->ool_ports.count = gstart->ool_ports.count; ! 3609: break; ! 3610: } ! 3611: } ! 3612: ! 3613: return MACH_RCV_SCATTER_SMALL; ! 3614: } ! 3615: ! 3616: return MACH_MSG_SUCCESS; ! 3617: } ! 3618: ! 3619: /* ! 3620: * Routine: ipc_kmsg_copyout_to_kernel ! 3621: * Purpose: ! 3622: * Copies out the destination and reply ports in the message. ! 3623: * Leaves all other rights and memory in the message alone. ! 3624: * Conditions: ! 3625: * Nothing locked. ! 3626: * ! 3627: * Derived from ipc_kmsg_copyout_dest. ! 3628: * Use by mach_msg_rpc_from_kernel (which used to use copyout_dest). ! 3629: * We really do want to save rights and memory. ! 3630: */ ! 3631: ! 3632: void ! 3633: ipc_kmsg_copyout_to_kernel( ! 3634: ipc_kmsg_t kmsg, ! 3635: ipc_space_t space) ! 3636: { ! 3637: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits; ! 3638: ipc_object_t dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port; ! 3639: ipc_object_t reply = (ipc_object_t) kmsg->ikm_header.msgh_local_port; ! 3640: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits); ! 3641: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits); ! 3642: mach_port_t dest_name, reply_name; ! 3643: ! 3644: assert(IO_VALID(dest)); ! 3645: ! 3646: io_lock(dest); ! 3647: if (io_active(dest)) { ! 3648: ipc_object_copyout_dest(space, dest, dest_type, &dest_name); ! 3649: /* dest is unlocked */ ! 3650: } else { ! 3651: io_release(dest); ! 3652: io_check_unlock(dest); ! 3653: dest_name = MACH_PORT_DEAD; ! 3654: } ! 3655: ! 3656: reply_name = (mach_port_t) reply; ! 3657: ! 3658: kmsg->ikm_header.msgh_bits = (MACH_MSGH_BITS_OTHER(mbits) | ! 3659: MACH_MSGH_BITS(reply_type, dest_type)); ! 3660: kmsg->ikm_header.msgh_local_port = dest_name; ! 3661: kmsg->ikm_header.msgh_remote_port = reply_name; ! 3662: } ! 3663: ! 3664: #if MACH_IPC_COMPAT ! 3665: ! 3666: /* ! 3667: * Routine: ipc_kmsg_copyin_compat ! 3668: * Purpose: ! 3669: * "Copy-in" port rights and out-of-line memory ! 3670: * in the message. ! 3671: * ! 3672: * In all failure cases, the message is left holding ! 3673: * no rights or memory. However, the message buffer ! 3674: * is not deallocated. If successful, the message ! 3675: * contains a valid destination port. ! 3676: * Conditions: ! 3677: * Nothing locked. ! 3678: * Returns: ! 3679: * MACH_MSG_SUCCESS Successful copyin. ! 3680: * MACH_SEND_INVALID_DEST Can't copyin destination port. ! 3681: * MACH_SEND_INVALID_REPLY Can't copyin reply port. ! 3682: * MACH_SEND_INVALID_MEMORY Can't grab out-of-line memory. ! 3683: * MACH_SEND_INVALID_RIGHT Can't copyin port right in body. ! 3684: * MACH_SEND_INVALID_TYPE Bad type specification. ! 3685: * MACH_SEND_MSG_TOO_SMALL Body is too small for types/data. ! 3686: */ ! 3687: ! 3688: mach_msg_return_t ! 3689: ipc_kmsg_copyin_compat(kmsg, space, map) ! 3690: ipc_kmsg_t kmsg; ! 3691: ipc_space_t space; ! 3692: vm_map_t map; ! 3693: { ! 3694: msg_header_t msg; ! 3695: mach_port_t dest_name; ! 3696: mach_port_t reply_name; ! 3697: ipc_object_t dest, reply; ! 3698: mach_msg_type_name_t dest_type, reply_type; ! 3699: vm_offset_t saddr, eaddr; ! 3700: boolean_t complex; ! 3701: kern_return_t kr; ! 3702: boolean_t use_page_lists, steal_pages; ! 3703: ! 3704: msg = * (msg_header_t *) &kmsg->ikm_header; ! 3705: dest_name = (mach_port_t) msg.msg_remote_port; ! 3706: reply_name = (mach_port_t) msg.msg_local_port; ! 3707: ! 3708: /* translate the destination and reply ports */ ! 3709: ! 3710: kr = ipc_object_copyin_header(space, dest_name, &dest, &dest_type); ! 3711: if (kr != KERN_SUCCESS) ! 3712: return MACH_SEND_INVALID_DEST; ! 3713: ! 3714: if (reply_name == MACH_PORT_NULL) { ! 3715: reply = IO_NULL; ! 3716: reply_type = 0; ! 3717: } else { ! 3718: kr = ipc_object_copyin_header(space, reply_name, ! 3719: &reply, &reply_type); ! 3720: if (kr != KERN_SUCCESS) { ! 3721: ipc_object_destroy(dest, dest_type); ! 3722: return MACH_SEND_INVALID_REPLY; ! 3723: } ! 3724: } ! 3725: ! 3726: kmsg->ikm_header.msgh_bits = MACH_MSGH_BITS(dest_type, reply_type) | ! 3727: MACH_MSGH_BITS_OLD_FORMAT; ! 3728: kmsg->ikm_header.msgh_size = (mach_msg_size_t) msg.msg_size; ! 3729: kmsg->ikm_header.msgh_remote_port = (mach_port_t) dest; ! 3730: kmsg->ikm_header.msgh_local_port = (mach_port_t) reply; ! 3731: kmsg->ikm_header.msgh_reserved = (mach_port_seqno_t) msg.msg_type; ! 3732: kmsg->ikm_header.msgh_id = (mach_msg_id_t) msg.msg_id; ! 3733: ! 3734: if (msg.msg_simple) ! 3735: return MACH_MSG_SUCCESS; ! 3736: ! 3737: complex = FALSE; ! 3738: use_page_lists = ipc_kobject_vm_page_list(ip_kotype((ipc_port_t)dest)); ! 3739: steal_pages = ipc_kobject_vm_page_steal(ip_kotype((ipc_port_t)dest)); ! 3740: ! 3741: saddr = (vm_offset_t) (&kmsg->ikm_header + 1); ! 3742: eaddr = (vm_offset_t) &kmsg->ikm_header + kmsg->ikm_header.msgh_size; ! 3743: ! 3744: while (saddr < eaddr) { ! 3745: vm_offset_t taddr = saddr; ! 3746: mach_msg_type_long_t *type; ! 3747: mach_msg_type_name_t name; ! 3748: mach_msg_type_size_t size; ! 3749: mach_msg_type_number_t number; ! 3750: boolean_t is_inline, longform, dealloc, is_port; ! 3751: vm_offset_t data; ! 3752: vm_size_t length; ! 3753: ! 3754: type = (mach_msg_type_long_t *) saddr; ! 3755: ! 3756: if (((eaddr - saddr) < sizeof(mach_msg_type_t)) || ! 3757: ((longform = ((mach_msg_type_t*)type)->msgt_longform) && ! 3758: ((eaddr - saddr) < sizeof(mach_msg_type_long_t)))) { ! 3759: ipc_kmsg_clean_partial_compat(kmsg, taddr, FALSE, 0); ! 3760: return MACH_SEND_MSG_TOO_SMALL; ! 3761: } ! 3762: ! 3763: is_inline = ((mach_msg_type_t*)type)->msgt_inline; ! 3764: dealloc = ((mach_msg_type_t*)type)->msgt_deallocate; ! 3765: if (longform) { ! 3766: /* This must be aligned */ ! 3767: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 3768: (is_misaligned(type))) { ! 3769: saddr = ptr_align(saddr); ! 3770: continue; ! 3771: } ! 3772: name = type->msgtl_name; ! 3773: size = type->msgtl_size; ! 3774: number = type->msgtl_number; ! 3775: saddr += sizeof(mach_msg_type_long_t); ! 3776: } else { ! 3777: name = ((mach_msg_type_t*)type)->msgt_name; ! 3778: size = ((mach_msg_type_t*)type)->msgt_size; ! 3779: number = ((mach_msg_type_t*)type)->msgt_number; ! 3780: saddr += sizeof(mach_msg_type_t); ! 3781: } ! 3782: ! 3783: is_port = MSG_TYPE_PORT_ANY(name); ! 3784: ! 3785: if (is_port && (size != PORT_T_SIZE_IN_BITS)) { ! 3786: ipc_kmsg_clean_partial_compat(kmsg, taddr, FALSE, 0); ! 3787: return MACH_SEND_INVALID_TYPE; ! 3788: } ! 3789: ! 3790: /* ! 3791: * New IPC says these should be zero, but old IPC ! 3792: * tasks often leave them with random values. So ! 3793: * we have to clear them. ! 3794: */ ! 3795: ! 3796: ((mach_msg_type_t*)type)->msgt_unused = 0; ! 3797: if (longform) { ! 3798: type->msgtl_header.msgt_name = 0; ! 3799: type->msgtl_header.msgt_size = 0; ! 3800: type->msgtl_header.msgt_number = 0; ! 3801: } ! 3802: ! 3803: /* padding (ptrs and ports) ? */ ! 3804: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 3805: ((size >> 3) == sizeof(natural_t))) ! 3806: saddr = ptr_align(saddr); ! 3807: ! 3808: /* calculate length of data in bytes, rounding up */ ! 3809: ! 3810: length = ((number * size) + 7) >> 3; ! 3811: ! 3812: if (is_inline) { ! 3813: vm_size_t amount; ! 3814: ! 3815: /* inline data sizes round up to int boundaries */ ! 3816: ! 3817: amount = (length + 3) &~ 3; ! 3818: if ((eaddr - saddr) < amount) { ! 3819: ipc_kmsg_clean_partial_compat( ! 3820: kmsg, taddr, FALSE, 0); ! 3821: return MACH_SEND_MSG_TOO_SMALL; ! 3822: } ! 3823: ! 3824: data = saddr; ! 3825: saddr += amount; ! 3826: } else { ! 3827: vm_offset_t addr; ! 3828: ! 3829: if ((eaddr - saddr) < sizeof(vm_offset_t)) { ! 3830: ipc_kmsg_clean_partial_compat( ! 3831: kmsg, taddr, FALSE, 0); ! 3832: return MACH_SEND_MSG_TOO_SMALL; ! 3833: } ! 3834: ! 3835: /* grab the out-of-line data */ ! 3836: ! 3837: addr = * (vm_offset_t *) saddr; ! 3838: ! 3839: if (length == 0) ! 3840: data = 0; ! 3841: else if (is_port) { ! 3842: data = kalloc(length); ! 3843: if (data == 0) ! 3844: goto invalid_memory; ! 3845: ! 3846: if (copyinmap(map, (char *) addr, ! 3847: (char *) data, length) || ! 3848: (dealloc && ! 3849: (vm_deallocate(map, addr, length) != ! 3850: KERN_SUCCESS))) { ! 3851: kfree(data, length); ! 3852: goto invalid_memory; ! 3853: } ! 3854: } else { ! 3855: #if MACH_OLD_VM_COPY ! 3856: vm_offset_t copy; ! 3857: ! 3858: kr = vm_move(map, addr, ! 3859: ipc_soft_map, length, ! 3860: dealloc, ©); ! 3861: #else ! 3862: vm_map_copy_t copy; ! 3863: ! 3864: if (use_page_lists) { ! 3865: kr = vm_map_copyin_page_list(map, ! 3866: addr, length, dealloc, ! 3867: steal_pages, ©, FALSE); ! 3868: } else { ! 3869: kr = vm_map_copyin(map, addr, length, ! 3870: dealloc, ! 3871: ©); ! 3872: } ! 3873: #endif ! 3874: if (kr != KERN_SUCCESS) { ! 3875: invalid_memory: ! 3876: ipc_kmsg_clean_partial_compat( ! 3877: kmsg, taddr, FALSE, 0); ! 3878: return MACH_SEND_INVALID_MEMORY; ! 3879: } ! 3880: ! 3881: data = (vm_offset_t) copy; ! 3882: } ! 3883: ! 3884: * (vm_offset_t *) saddr = data; ! 3885: saddr += sizeof(vm_offset_t); ! 3886: complex = TRUE; ! 3887: } ! 3888: ! 3889: if (is_port) { ! 3890: mach_msg_type_name_t newname = ! 3891: ipc_object_copyin_type(name); ! 3892: ipc_object_t *objects = (ipc_object_t *) data; ! 3893: mach_msg_type_number_t i; ! 3894: ! 3895: if (longform) ! 3896: type->msgtl_name = newname; ! 3897: else ! 3898: ((mach_msg_type_t*)type)->msgt_name = newname; ! 3899: ! 3900: for (i = 0; i < number; i++) { ! 3901: mach_port_t port = (mach_port_t) objects[i]; ! 3902: ipc_object_t object; ! 3903: ! 3904: if (!MACH_PORT_VALID(port)) ! 3905: continue; ! 3906: ! 3907: kr = ipc_object_copyin_compat(space, port, ! 3908: name, dealloc, &object); ! 3909: if (kr != KERN_SUCCESS) { ! 3910: ipc_kmsg_clean_partial_compat( ! 3911: kmsg, taddr, TRUE, i); ! 3912: return MACH_SEND_INVALID_RIGHT; ! 3913: } ! 3914: ! 3915: if ((newname == MACH_MSG_TYPE_PORT_RECEIVE) && ! 3916: ipc_port_check_circularity( ! 3917: (ipc_port_t) object, ! 3918: (ipc_port_t) dest)) ! 3919: kmsg->ikm_header.msgh_bits |= ! 3920: MACH_MSGH_BITS_CIRCULAR; ! 3921: ! 3922: objects[i] = object; ! 3923: } ! 3924: ! 3925: complex = TRUE; ! 3926: } ! 3927: } ! 3928: ! 3929: if (complex) ! 3930: kmsg->ikm_header.msgh_bits |= MACH_MSGH_BITS_COMPLEX; ! 3931: ! 3932: return MACH_MSG_SUCCESS; ! 3933: } ! 3934: ! 3935: void ! 3936: ipc_kmsg_copyin_compat_from_kernel(kmsg) ! 3937: ipc_kmsg_t kmsg; ! 3938: { ! 3939: msg_header_t msg; ! 3940: ipc_object_t remote, local; ! 3941: mach_msg_type_name_t rname, lname; ! 3942: vm_offset_t saddr, eaddr; ! 3943: boolean_t complex; ! 3944: ! 3945: msg = * (msg_header_t *) &kmsg->ikm_header; ! 3946: remote = (ipc_object_t) msg.msg_remote_port; ! 3947: rname = MACH_MSG_TYPE_COPY_SEND; ! 3948: local = (ipc_object_t) msg.msg_local_port; ! 3949: lname = MACH_MSG_TYPE_MAKE_SEND; ! 3950: ! 3951: /* translate the destination and reply ports */ ! 3952: ! 3953: ipc_object_copyin_from_kernel(remote, rname); ! 3954: if (IO_VALID(local)) ! 3955: ipc_object_copyin_from_kernel(local, lname); ! 3956: ! 3957: kmsg->ikm_header.msgh_bits = ! 3958: MACH_MSGH_BITS( ! 3959: ipc_object_copyin_type(rname), ! 3960: ipc_object_copyin_type(lname)) | ! 3961: MACH_MSGH_BITS_OLD_FORMAT; ! 3962: kmsg->ikm_header.msgh_size = (mach_msg_size_t) msg.msg_size; ! 3963: kmsg->ikm_header.msgh_remote_port = (mach_port_t) remote; ! 3964: kmsg->ikm_header.msgh_local_port = (mach_port_t) local; ! 3965: kmsg->ikm_header.msgh_reserved = (mach_port_seqno_t) msg.msg_type; ! 3966: kmsg->ikm_header.msgh_id = (mach_msg_id_t) msg.msg_id; ! 3967: ! 3968: if (msg.msg_simple) ! 3969: return; ! 3970: ! 3971: complex = FALSE; ! 3972: ! 3973: saddr = (vm_offset_t) (&kmsg->ikm_header + 1); ! 3974: eaddr = (vm_offset_t) &kmsg->ikm_header + kmsg->ikm_header.msgh_size; ! 3975: ! 3976: while (saddr < eaddr) { ! 3977: mach_msg_type_long_t *type; ! 3978: mach_msg_type_name_t name; ! 3979: mach_msg_type_size_t size; ! 3980: mach_msg_type_number_t number; ! 3981: boolean_t is_inline, longform, is_port; ! 3982: vm_offset_t data; ! 3983: vm_size_t length; ! 3984: ! 3985: type = (mach_msg_type_long_t *) saddr; ! 3986: is_inline = ((mach_msg_type_t*)type)->msgt_inline; ! 3987: longform = ((mach_msg_type_t*)type)->msgt_longform; ! 3988: /* type->msgtl_header.msgt_deallocate not used */ ! 3989: if (longform) { ! 3990: /* This must be aligned */ ! 3991: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 3992: (is_misaligned(type))) { ! 3993: saddr = ptr_align(saddr); ! 3994: continue; ! 3995: } ! 3996: name = type->msgtl_name; ! 3997: size = type->msgtl_size; ! 3998: number = type->msgtl_number; ! 3999: saddr += sizeof(mach_msg_type_long_t); ! 4000: } else { ! 4001: name = ((mach_msg_type_t*)type)->msgt_name; ! 4002: size = ((mach_msg_type_t*)type)->msgt_size; ! 4003: number = ((mach_msg_type_t*)type)->msgt_number; ! 4004: saddr += sizeof(mach_msg_type_t); ! 4005: } ! 4006: ! 4007: is_port = MSG_TYPE_PORT_ANY(name); ! 4008: ! 4009: /* ! 4010: * New IPC says these should be zero, but old IPC ! 4011: * tasks often leave them with random values. So ! 4012: * we have to clear them. ! 4013: */ ! 4014: ! 4015: ((mach_msg_type_t*)type)->msgt_unused = 0; ! 4016: if (longform) { ! 4017: type->msgtl_header.msgt_name = 0; ! 4018: type->msgtl_header.msgt_size = 0; ! 4019: type->msgtl_header.msgt_number = 0; ! 4020: } ! 4021: ! 4022: /* padding (ptrs and ports) ? */ ! 4023: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 4024: ((size >> 3) == sizeof(natural_t))) ! 4025: saddr = ptr_align(saddr); ! 4026: ! 4027: /* calculate length of data in bytes, rounding up */ ! 4028: ! 4029: length = ((number * size) + 7) >> 3; ! 4030: ! 4031: if (is_inline) { ! 4032: /* inline data sizes round up to int boundaries */ ! 4033: ! 4034: data = saddr; ! 4035: saddr += (length + 3) &~ 3; ! 4036: } else { ! 4037: /* ! 4038: * The sender should supply ready-made memory ! 4039: * for us, so we don't need to do anything. ! 4040: */ ! 4041: ! 4042: data = * (vm_offset_t *) saddr; ! 4043: saddr += sizeof(vm_offset_t); ! 4044: complex = TRUE; ! 4045: } ! 4046: ! 4047: if (is_port) { ! 4048: mach_msg_type_name_t newname = ! 4049: ipc_object_copyin_type(name); ! 4050: ipc_object_t *objects = (ipc_object_t *) data; ! 4051: mach_msg_type_number_t i; ! 4052: ! 4053: if (longform) ! 4054: type->msgtl_name = newname; ! 4055: else ! 4056: ((mach_msg_type_t*)type)->msgt_name = newname; ! 4057: ! 4058: for (i = 0; i < number; i++) { ! 4059: ipc_object_t object = objects[i]; ! 4060: ! 4061: if (!IO_VALID(object)) ! 4062: continue; ! 4063: ! 4064: ipc_object_copyin_from_kernel(object, name); ! 4065: ! 4066: if ((newname == MACH_MSG_TYPE_PORT_RECEIVE) && ! 4067: ipc_port_check_circularity( ! 4068: (ipc_port_t) object, ! 4069: (ipc_port_t) remote)) ! 4070: kmsg->ikm_header.msgh_bits |= ! 4071: MACH_MSGH_BITS_CIRCULAR; ! 4072: } ! 4073: ! 4074: complex = TRUE; ! 4075: } ! 4076: } ! 4077: ! 4078: if (complex) ! 4079: kmsg->ikm_header.msgh_bits |= MACH_MSGH_BITS_COMPLEX; ! 4080: } ! 4081: ! 4082: /* ! 4083: * Routine: ipc_kmsg_copyout_compat ! 4084: * Purpose: ! 4085: * "Copy-out" port rights and out-of-line memory ! 4086: * in the message, producing an old IPC message. ! 4087: * ! 4088: * Doesn't bother to handle the header atomically. ! 4089: * Skips over errors. Problem ports produce MACH_PORT_NULL ! 4090: * (MACH_PORT_DEAD is never produced), and problem memory ! 4091: * produces a zero address. ! 4092: * Conditions: ! 4093: * Nothing locked. ! 4094: * Returns: ! 4095: * MACH_MSG_SUCCESS Copied out rights and memory. ! 4096: */ ! 4097: ! 4098: mach_msg_return_t ! 4099: ipc_kmsg_copyout_compat(kmsg, space, map) ! 4100: ipc_kmsg_t kmsg; ! 4101: ipc_space_t space; ! 4102: vm_map_t map; ! 4103: { ! 4104: msg_header_t msg; ! 4105: mach_msg_bits_t mbits = kmsg->ikm_header.msgh_bits; ! 4106: ipc_object_t dest = (ipc_object_t) kmsg->ikm_header.msgh_remote_port; ! 4107: ipc_object_t reply = (ipc_object_t) kmsg->ikm_header.msgh_local_port; ! 4108: mach_port_t dest_name, reply_name; ! 4109: vm_offset_t saddr, eaddr; ! 4110: kern_return_t kr; ! 4111: ! 4112: assert(IO_VALID(dest)); ! 4113: ! 4114: io_lock(dest); ! 4115: if (io_active(dest)) { ! 4116: mach_msg_type_name_t dest_type = MACH_MSGH_BITS_REMOTE(mbits); ! 4117: ! 4118: ipc_object_copyout_dest(space, dest, dest_type, &dest_name); ! 4119: /* dest is unlocked */ ! 4120: } else { ! 4121: io_release(dest); ! 4122: io_check_unlock(dest); ! 4123: dest_name = MACH_PORT_NULL; ! 4124: } ! 4125: ! 4126: if (IO_VALID(reply)) { ! 4127: mach_msg_type_name_t reply_type = MACH_MSGH_BITS_LOCAL(mbits); ! 4128: ! 4129: kr = ipc_object_copyout_compat(space, reply, reply_type, ! 4130: &reply_name); ! 4131: if (kr != KERN_SUCCESS) { ! 4132: ipc_object_destroy(reply, reply_type); ! 4133: reply_name = MACH_PORT_NULL; ! 4134: } ! 4135: } else ! 4136: reply_name = MACH_PORT_NULL; ! 4137: ! 4138: msg.msg_unused = 0; ! 4139: msg.msg_simple = (mbits & MACH_MSGH_BITS_COMPLEX) ? FALSE : TRUE; ! 4140: msg.msg_size = (msg_size_t) kmsg->ikm_header.msgh_size; ! 4141: msg.msg_type = (integer_t) kmsg->ikm_header.msgh_reserved; ! 4142: msg.msg_local_port = (port_name_t) dest_name; ! 4143: msg.msg_remote_port = (port_name_t) reply_name; ! 4144: msg.msg_id = (integer_t) kmsg->ikm_header.msgh_id; ! 4145: * (msg_header_t *) &kmsg->ikm_header = msg; ! 4146: ! 4147: if (msg.msg_simple) ! 4148: return MACH_MSG_SUCCESS; ! 4149: ! 4150: saddr = (vm_offset_t) (&kmsg->ikm_header + 1); ! 4151: eaddr = (vm_offset_t) &kmsg->ikm_header + kmsg->ikm_header.msgh_size; ! 4152: ! 4153: while (saddr < eaddr) { ! 4154: vm_offset_t taddr = saddr; ! 4155: mach_msg_type_long_t *type; ! 4156: mach_msg_type_name_t name; ! 4157: mach_msg_type_size_t size; ! 4158: mach_msg_type_number_t number; ! 4159: boolean_t is_inline, longform, is_port; ! 4160: vm_size_t length; ! 4161: vm_offset_t addr; ! 4162: ! 4163: type = (mach_msg_type_long_t *) saddr; ! 4164: is_inline = ((mach_msg_type_t*)type)->msgt_inline; ! 4165: longform = ((mach_msg_type_t*)type)->msgt_longform; ! 4166: if (longform) { ! 4167: /* This must be aligned */ ! 4168: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 4169: (is_misaligned(type))) { ! 4170: saddr = ptr_align(saddr); ! 4171: continue; ! 4172: } ! 4173: name = type->msgtl_name; ! 4174: size = type->msgtl_size; ! 4175: number = type->msgtl_number; ! 4176: saddr += sizeof(mach_msg_type_long_t); ! 4177: } else { ! 4178: name = ((mach_msg_type_t*)type)->msgt_name; ! 4179: size = ((mach_msg_type_t*)type)->msgt_size; ! 4180: number = ((mach_msg_type_t*)type)->msgt_number; ! 4181: saddr += sizeof(mach_msg_type_t); ! 4182: } ! 4183: ! 4184: /* padding (ptrs and ports) ? */ ! 4185: if ((sizeof(natural_t) > sizeof(mach_msg_type_t)) && ! 4186: ((size >> 3) == sizeof(natural_t))) ! 4187: saddr = ptr_align(saddr); ! 4188: ! 4189: /* calculate length of data in bytes, rounding up */ ! 4190: ! 4191: length = ((number * size) + 7) >> 3; ! 4192: ! 4193: is_port = MACH_MSG_TYPE_PORT_ANY(name); ! 4194: ! 4195: if (is_port) { ! 4196: mach_port_t *objects; ! 4197: mach_msg_type_number_t i; ! 4198: mach_msg_type_name_t newname; ! 4199: ! 4200: if (!is_inline && (length != 0)) { ! 4201: /* first allocate memory in the map */ ! 4202: ! 4203: kr = vm_allocate(map, &addr, length, TRUE); ! 4204: if (kr != KERN_SUCCESS) { ! 4205: ipc_kmsg_clean_body_compat( ! 4206: taddr, saddr); ! 4207: goto vm_copyout_failure; ! 4208: } ! 4209: } ! 4210: ! 4211: newname = ipc_object_copyout_type_compat(name); ! 4212: if (longform) ! 4213: type->msgtl_name = newname; ! 4214: else ! 4215: ((mach_msg_type_t*)type)->msgt_name = newname; ! 4216: ! 4217: objects = (mach_port_t *) ! 4218: (is_inline ? saddr : * (vm_offset_t *) saddr); ! 4219: ! 4220: /* copyout port rights carried in the message */ ! 4221: ! 4222: for (i = 0; i < number; i++) { ! 4223: ipc_object_t object = ! 4224: (ipc_object_t) objects[i]; ! 4225: ! 4226: if (!IO_VALID(object)) { ! 4227: objects[i] = MACH_PORT_NULL; ! 4228: continue; ! 4229: } ! 4230: ! 4231: kr = ipc_object_copyout_compat(space, object, ! 4232: name, &objects[i]); ! 4233: if (kr != KERN_SUCCESS) { ! 4234: ipc_object_destroy(object, name); ! 4235: objects[i] = MACH_PORT_NULL; ! 4236: } ! 4237: } ! 4238: } ! 4239: ! 4240: if (is_inline) { ! 4241: /* inline data sizes round up to int boundaries */ ! 4242: ! 4243: saddr += (length + 3) &~ 3; ! 4244: } else { ! 4245: vm_offset_t data = * (vm_offset_t *) saddr; ! 4246: ! 4247: /* copyout memory carried in the message */ ! 4248: ! 4249: if (length == 0) { ! 4250: assert(data == 0); ! 4251: addr = 0; ! 4252: } else if (is_port) { ! 4253: /* copyout to memory allocated above */ ! 4254: ! 4255: (void) copyoutmap(map, (char *) data, ! 4256: (char *) addr, length); ! 4257: kfree(data, length); ! 4258: } else { ! 4259: #if MACH_OLD_VM_COPY ! 4260: kr = vm_move( ! 4261: ipc_soft_map, data, ! 4262: map, length, ! 4263: FALSE, &addr); ! 4264: (void) vm_deallocate( ! 4265: ipc_soft_map, data, length); ! 4266: if (kr != KERN_SUCCESS) { ! 4267: #else ! 4268: vm_map_copy_t copy = (vm_map_copy_t) data; ! 4269: ! 4270: kr = vm_map_copyout(map, &addr, copy); ! 4271: if (kr != KERN_SUCCESS) { ! 4272: vm_map_copy_discard(copy); ! 4273: #endif ! 4274: ! 4275: vm_copyout_failure: ! 4276: ! 4277: addr = 0; ! 4278: } ! 4279: } ! 4280: ! 4281: * (vm_offset_t *) saddr = addr; ! 4282: saddr += sizeof(vm_offset_t); ! 4283: } ! 4284: } ! 4285: ! 4286: return MACH_MSG_SUCCESS; ! 4287: } ! 4288: ! 4289: #endif MACH_IPC_COMPAT
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.