xref: /xnu-8796.121.2/osfmk/ipc/ipc_port.h (revision c54f35ca767986246321eb901baf8f5ff7923f6a)
1 /*
2  * Copyright (c) 2000-2016 Apple Computer, Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 /*
29  * @OSF_COPYRIGHT@
30  */
31 /*
32  * Mach Operating System
33  * Copyright (c) 1991,1990,1989 Carnegie Mellon University
34  * All Rights Reserved.
35  *
36  * Permission to use, copy, modify and distribute this software and its
37  * documentation is hereby granted, provided that both the copyright
38  * notice and this permission notice appear in all copies of the
39  * software, derivative works or modified versions, and any portions
40  * thereof, and that both notices appear in supporting documentation.
41  *
42  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44  * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
45  *
46  * Carnegie Mellon requests users of this software to return to
47  *
48  *  Software Distribution Coordinator  or  [email protected]
49  *  School of Computer Science
50  *  Carnegie Mellon University
51  *  Pittsburgh PA 15213-3890
52  *
53  * any improvements or extensions that they make and grant Carnegie Mellon
54  * the rights to redistribute these changes.
55  */
56 /*
57  * NOTICE: This file was modified by McAfee Research in 2004 to introduce
58  * support for mandatory and extensible security protections.  This notice
59  * is included in support of clause 2.2 (b) of the Apple Public License,
60  * Version 2.0.
61  */
62 /*
63  */
64 /*
65  *	File:	ipc/ipc_port.h
66  *	Author:	Rich Draves
67  *	Date:	1989
68  *
69  *	Definitions for ports.
70  */
71 
72 #ifndef _IPC_IPC_PORT_H_
73 #define _IPC_IPC_PORT_H_
74 
75 #ifdef MACH_KERNEL_PRIVATE
76 
77 #include <mach_assert.h>
78 
79 #include <mach/mach_types.h>
80 #include <mach/boolean.h>
81 #include <mach/kern_return.h>
82 #include <mach/port.h>
83 
84 #include <kern/assert.h>
85 #include <kern/kern_types.h>
86 #include <kern/turnstile.h>
87 
88 #include <ipc/ipc_types.h>
89 #include <ipc/ipc_object.h>
90 #include <ipc/ipc_mqueue.h>
91 #include <ipc/ipc_space.h>
92 
93 #include <security/_label.h>
94 
95 #include <ptrauth.h>
96 
97 extern int proc_isinitproc(struct proc *p);
98 
99 struct task_watchport_elem;
100 
101 typedef unsigned int ipc_port_timestamp_t;
102 
103 struct ipc_port_request {
104 	union {
105 		struct ipc_port                *ipr_soright;
106 		struct host_notify_entry       *ipr_hnotify;
107 	};
108 
109 	union {
110 #define IPR_HOST_NOTIFY                         0xfffffffeu
111 		mach_port_name_t                ipr_name;
112 		ipc_port_request_index_t        ipr_next;
113 	};
114 };
115 
116 KALLOC_ARRAY_TYPE_DECL(ipc_port_request_table, struct ipc_port_request);
117 
118 struct ipc_port {
119 	struct ipc_object               ip_object;
120 	union {
121 		/*
122 		 * The waitq_eventmask field is only used on the global queues.
123 		 * We hence repurpose all those bits for our own use.
124 		 *
125 		 * Note: if too many bits are added, compilation will fail
126 		 *       with errors about "negative bitfield sizes"
127 		 */
128 		WAITQ_FLAGS(ip_waitq
129 		    , ip_fullwaiters:1            /* Whether there are senders blocked on a full queue */
130 		    , ip_sprequests:1             /* send-possible requests outstanding */
131 		    , ip_spimportant:1            /* ... at least one is importance donating */
132 		    , ip_impdonation:1            /* port supports importance donation */
133 		    , ip_tempowner:1              /* dont give donations to current receiver */
134 		    , ip_guarded:1                /* port guarded (use context value as guard) */
135 		    , ip_strict_guard:1           /* Strict guarding; Prevents user manipulation of context values directly */
136 		    , ip_specialreply:1           /* port is a special reply port */
137 		    , ip_sync_link_state:3        /* link the port to destination port/ Workloop */
138 		    , ip_sync_bootstrap_checkin:1 /* port part of sync bootstrap checkin, push on thread doing the checkin */
139 		    , ip_immovable_receive:1      /* the receive right cannot be moved out of a space, until it is destroyed */
140 		    , ip_immovable_send:1         /* No send(once) rights to this port can be moved out of a space, never unset */
141 		    , ip_no_grant:1               /* Port wont accept complex messages containing (ool) port descriptors */
142 		    , ip_tg_block_tracking:1      /* Track blocking relationship between thread groups during sync IPC */
143 		    , ip_pinned:1                 /* Can't deallocate the last send right from a space while the bit is set */
144 		    , ip_service_port:1           /* port is a service port */
145 		    , ip_has_watchport:1          /* port has an exec watchport */
146 		    , ip_kernel_iotier_override:2 /* kernel iotier override */
147 		    , ip_kernel_qos_override:3    /* kernel qos override */
148 		    , ip_reply_port_semantics:2   /* reply port defense in depth type */
149 		    );
150 		struct waitq            ip_waitq;
151 	};
152 
153 	struct ipc_mqueue               ip_messages;
154 
155 	/*
156 	 * IMPORTANT: Direct access of unionized fields are highly discouraged.
157 	 * Use accessor functions below and see header doc for possible states.
158 	 */
159 	union {
160 		struct ipc_space       *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_receiver") ip_receiver;
161 		struct ipc_port        *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_destination") ip_destination;
162 		ipc_port_timestamp_t    ip_timestamp;
163 	};
164 
165 	/* update ipc_kobject_upgrade_locked() if this union is changed */
166 	union {
167 		uintptr_t               ip_kobject; /* manually PAC-ed, see ipc_kobject_get_raw() */
168 		ipc_importance_task_t   ip_imp_task; /* use accessor ip_get_imp_task() */
169 		struct ipc_port        *ip_sync_inheritor_port;
170 		struct knote           *ip_sync_inheritor_knote;
171 		struct turnstile       *ip_sync_inheritor_ts;
172 	};
173 
174 	/*
175 	 * ip_specialreply:  ip_pid
176 	 * ip_has_watchport: ip_twe
177 	 * else:             ip_pdrequest
178 	 */
179 	union {
180 		int                     ip_pid;
181 		struct task_watchport_elem *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_twe") ip_twe;
182 		struct ipc_port *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_pdrequest") ip_pdrequest;
183 	};
184 
185 #define IP_KOBJECT_NSREQUEST_ARMED      ((struct ipc_port *)1)
186 	struct ipc_port                *ip_nsrequest;
187 	ipc_port_request_table_t XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_request") ip_requests;
188 	union {
189 		struct ipc_kmsg *XNU_PTRAUTH_SIGNED_PTR("ipc_port.premsg") ip_premsg;
190 		struct turnstile       *ip_send_turnstile;
191 	};
192 	mach_vm_address_t               ip_context;
193 
194 #if DEVELOPMENT || DEBUG
195 	natural_t                       ip_srp_lost_link : 1;   /* special reply port turnstile link chain broken */
196 	natural_t                       ip_srp_msg_sent : 1;    /* special reply port msg sent */
197 	natural_t                       ip_impcount : 30;       /* number of importance donations in nested queue */
198 #else
199 	natural_t                       ip_impcount;            /* number of importance donations in nested queue */
200 #endif
201 	mach_port_mscount_t             ip_mscount;
202 	mach_port_rights_t              ip_srights;
203 	mach_port_rights_t              ip_sorights;
204 
205 	union {
206 		ipc_kobject_label_t XNU_PTRAUTH_SIGNED_PTR("ipc_port.kolabel") ip_kolabel;
207 		/* Union of service and connection ports' message filtering metadata */
208 		void * XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_splabel") ip_splabel;
209 	};
210 
211 #if MACH_ASSERT
212 	unsigned long                   ip_timetrack;   /* give an idea of "when" created */
213 	uint32_t                        ip_made_bt;     /* stack trace (btref_t) */
214 	uint32_t                        ip_made_pid;    /* for debugging */
215 #endif  /* MACH_ASSERT */
216 };
217 
218 static inline bool
ip_in_pset(ipc_port_t port)219 ip_in_pset(ipc_port_t port)
220 {
221 	return !circle_queue_empty(&port->ip_waitq.waitq_links);
222 }
223 
224 #define ip_receiver_name        ip_messages.imq_receiver_name
225 #define ip_reply_context        ip_messages.imq_context
226 #define ip_klist                ip_messages.imq_klist
227 
228 #define port_send_turnstile(port)                            \
229 	(IP_PREALLOC(port) ? TURNSTILE_NULL : (port)->ip_send_turnstile)
230 
231 #define set_port_send_turnstile(port, value)                 \
232 MACRO_BEGIN                                                  \
233 if (!IP_PREALLOC(port)) {                                     \
234 	(port)->ip_send_turnstile = (value);           \
235 }                                                         \
236 MACRO_END
237 
238 #define port_send_turnstile_address(port)                    \
239 	(IP_PREALLOC(port) ? NULL : &((port)->ip_send_turnstile))
240 
241 #define port_rcv_turnstile_address(port)   (&(port)->ip_waitq.waitq_ts)
242 
243 extern void __ipc_right_delta_overflow_panic(
244 	ipc_port_t          port,
245 	natural_t          *field,
246 	int                 delta) __abortlike;
247 
248 #define ip_right_delta(port, field, delta)  ({ \
249     ipc_port_t __port = (port);                                  \
250     if (os_add_overflow(__port->field, delta, &__port->field)) { \
251 	__ipc_right_delta_overflow_panic(__port, &__port->field, delta);  \
252     }                                                            \
253 })
254 
255 #define ip_srights_inc(port)  ip_right_delta(port, ip_srights, 1)
256 #define ip_srights_dec(port)  ip_right_delta(port, ip_srights, -1)
257 #define ip_sorights_inc(port) ip_right_delta(port, ip_sorights, 1)
258 #define ip_sorights_dec(port) ip_right_delta(port, ip_sorights, -1)
259 
260 /*
261  * SYNC IPC state flags for special reply port/ rcv right.
262  *
263  * PORT_SYNC_LINK_ANY
264  *    Special reply port is not linked to any other port
265  *    or WL and linkage should be allowed.
266  *
267  * PORT_SYNC_LINK_PORT
268  *    Special reply port is linked to the port and
269  *    ip_sync_inheritor_port contains the inheritor
270  *    port.
271  *
272  * PORT_SYNC_LINK_WORKLOOP_KNOTE
273  *    Special reply port is linked to a WL (via a knote).
274  *    ip_sync_inheritor_knote contains a pointer to the knote
275  *    the port is stashed on.
276  *
277  * PORT_SYNC_LINK_WORKLOOP_STASH
278  *    Special reply port is linked to a WL (via a knote stash).
279  *    ip_sync_inheritor_ts contains a pointer to the turnstile with a +1
280  *    the port is stashed on.
281  *
282  * PORT_SYNC_LINK_NO_LINKAGE
283  *    Message sent to special reply port, do
284  *    not allow any linkages till receive is
285  *    complete.
286  *
287  * PORT_SYNC_LINK_RCV_THREAD
288  *    Receive right copied out as a part of bootstrap check in,
289  *    push on the thread which copied out the port.
290  */
291 #define PORT_SYNC_LINK_ANY              (0)
292 #define PORT_SYNC_LINK_PORT             (0x1)
293 #define PORT_SYNC_LINK_WORKLOOP_KNOTE   (0x2)
294 #define PORT_SYNC_LINK_WORKLOOP_STASH   (0x3)
295 #define PORT_SYNC_LINK_NO_LINKAGE       (0x4)
296 #define PORT_SYNC_LINK_RCV_THREAD       (0x5)
297 
298 #define IP_NULL                         IPC_PORT_NULL
299 #define IP_DEAD                         IPC_PORT_DEAD
300 #define IP_VALID(port)                  IPC_PORT_VALID(port)
301 
302 #define ip_object_to_port(io)           __container_of(io, struct ipc_port, ip_object)
303 #define ip_to_object(port)              (&(port)->ip_object)
304 #define ip_active(port)                 io_active(ip_to_object(port))
305 #define ip_mq_lock_held(port)           io_lock_held(ip_to_object(port))
306 #define ip_mq_lock(port)                io_lock(ip_to_object(port))
307 #define ip_mq_lock_try(port)            io_lock_try(ip_to_object(port))
308 #define ip_mq_lock_held_kdp(port)       io_lock_held_kdp(ip_to_object(port))
309 #define ip_mq_unlock(port)              io_unlock(ip_to_object(port))
310 
311 #define ip_reference(port)              io_reference(ip_to_object(port))
312 #define ip_release(port)                io_release(ip_to_object(port))
313 #define ip_release_safe(port)           io_release_safe(ip_to_object(port))
314 #define ip_release_live(port)           io_release_live(ip_to_object(port))
315 #define ip_validate(port) \
316 	zone_id_require(ZONE_ID_IPC_PORT, sizeof(struct ipc_port), port)
317 
318 #define ip_from_waitq(wq)               __container_of(wq, struct ipc_port, ip_waitq)
319 #define ip_from_mq(mq)                  __container_of(mq, struct ipc_port, ip_messages)
320 
321 #define ip_kotype(port)                 io_kotype(ip_to_object(port))
322 #define ip_is_kobject(port)             io_is_kobject(ip_to_object(port))
323 #define ip_is_control(port) \
324 	(ip_kotype(port) == IKOT_TASK_CONTROL || ip_kotype(port) == IKOT_THREAD_CONTROL)
325 #define ip_is_kolabeled(port)           io_is_kolabeled(ip_to_object(port))
326 
327 #define ip_full_kernel(port)            imq_full_kernel(&(port)->ip_messages)
328 #define ip_full(port)                   imq_full(&(port)->ip_messages)
329 
330 /*
331  * IPC Port flags for reply port defense in depth
332  *
333  * PORT_MARK_REPLY_PORT
334  *   Port is marked as a reply port.
335  *
336  * PORT_ENFORCE_REPLY_PORT_SEMANTICS
337  *   When talking to this port, the local port of mach msg needs to be a reply port.
338  *   Currrently service ports and libxpc connection ports adopt this.
339  *
340  * PORT_MARK_PROVISIONAL_REPLY_PORT
341  *   Port is marked as a provisional reply port with an eventual goal of making it port as PORT_MARK_REPLY_PORT.
342  *
343  */
344 #define PORT_MARK_REPLY_PORT              0x01
345 #define PORT_ENFORCE_REPLY_PORT_SEMANTICS 0x02
346 #define PORT_MARK_PROVISIONAL_REPLY_PORT  0x03
347 
348 /* ip_reply_port_semantics can be read without a lock as it is never unset after port creation. */
349 #define ip_is_reply_port(port)                 (((port)->ip_reply_port_semantics) == PORT_MARK_REPLY_PORT)
350 #define ip_require_reply_port_semantics(port)  (((port)->ip_reply_port_semantics) == PORT_ENFORCE_REPLY_PORT_SEMANTICS)
351 #define ip_is_provisional_reply_port(port)     (((port)->ip_reply_port_semantics) == PORT_MARK_PROVISIONAL_REPLY_PORT)
352 
353 #define ip_mark_reply_port(port)               ((port)->ip_reply_port_semantics = PORT_MARK_REPLY_PORT)
354 #define ip_enforce_reply_port_semantics(port)  ((port)->ip_reply_port_semantics = PORT_ENFORCE_REPLY_PORT_SEMANTICS)
355 #define ip_mark_provisional_reply_port(port)   ((port)->ip_reply_port_semantics = PORT_MARK_PROVISIONAL_REPLY_PORT)
356 
357 #define ip_is_immovable_send(port)      ((port)->ip_immovable_send)
358 #define ip_is_pinned(port)              ((port)->ip_pinned)
359 
360 #define ip_is_libxpc_connection_port(port) \
361 	(!ip_is_kolabeled(port) && (!(port)->ip_service_port) && ((port)->ip_splabel != NULL))
362 
363 /* Bits reserved in IO_BITS_PORT_INFO are defined here */
364 
365 /*
366  * JMM - Preallocation flag
367  * This flag indicates that there is a message buffer preallocated for this
368  * port and we should use that when sending (from the kernel) rather than
369  * allocate a new one.  This avoids deadlocks during notification message
370  * sends by critical system threads (which may be needed to free memory and
371  * therefore cannot be blocked waiting for memory themselves).
372  */
373 #define IP_BIT_PREALLOC         0x00008000      /* preallocated mesg */
374 #define IP_PREALLOC(port)       (io_bits(ip_to_object(port)) & IP_BIT_PREALLOC)
375 
376 #define IP_SET_PREALLOC(port, kmsg)                                     \
377 MACRO_BEGIN                                                             \
378 	io_bits_or(ip_to_object(port), IP_BIT_PREALLOC);                \
379 	(port)->ip_premsg = (kmsg);                                     \
380 MACRO_END
381 
382 /*
383  * This flag indicates that the port has opted into message filtering based
384  * on a policy defined in the Sandbox.
385  */
386 #define IP_BIT_FILTER_MSG               0x00001000
387 #define ip_enforce_msg_filtering(port)  ((io_bits(ip_to_object(port)) & IP_BIT_FILTER_MSG) != 0)
388 
389 /*
390  * Use the low bits in the ipr_soright to specify the request type
391  */
392 __enum_decl(ipc_port_request_opts_t, uintptr_t, {
393 	IPR_SOR_SPARM_MASK = 0x01,              /* send-possible armed */
394 	IPR_SOR_SPREQ_MASK = 0x02,              /* send-possible requested */
395 });
396 #define IPR_SOR_SPBIT_MASK      3               /* combo */
397 #define IPR_SOR_SPARMED(sor)    (((uintptr_t)(sor) & IPR_SOR_SPARM_MASK) != 0)
398 #define IPR_SOR_SPREQ(sor)      (((uintptr_t)(sor) & IPR_SOR_SPREQ_MASK) != 0)
399 #define IPR_SOR_PORT(sor)       ((ipc_port_t)((uintptr_t)(sor) & ~IPR_SOR_SPBIT_MASK))
400 #define IPR_SOR_MAKE(p, m)      ((ipc_port_t)((uintptr_t)(p) | (m)))
401 
402 extern lck_grp_t        ipc_lck_grp;
403 extern lck_attr_t       ipc_lck_attr;
404 
405 /*
406  *	Taking the ipc_port_multiple lock grants the privilege
407  *	to lock multiple ports at once.  No ports must locked
408  *	when it is taken.
409  */
410 
411 extern lck_spin_t ipc_port_multiple_lock_data;
412 
413 #define ipc_port_multiple_lock()                                        \
414 	lck_spin_lock_grp(&ipc_port_multiple_lock_data, &ipc_lck_grp)
415 
416 #define ipc_port_multiple_unlock()                                      \
417 	lck_spin_unlock(&ipc_port_multiple_lock_data)
418 
419 /*
420  *	Search for the end of the chain (a port not in transit),
421  *	acquiring locks along the way.
422  */
423 extern boolean_t ipc_port_destination_chain_lock(
424 	ipc_port_t port,
425 	ipc_port_t *base);
426 
427 /*
428  *	The port timestamp facility provides timestamps
429  *	for port destruction.  It is used to serialize
430  *	mach_port_names with port death.
431  */
432 
433 extern ipc_port_timestamp_t ipc_port_timestamp_data;
434 
435 /* Retrieve a port timestamp value */
436 extern ipc_port_timestamp_t ipc_port_timestamp(void);
437 
438 /*
439  *	Compares two timestamps, and returns TRUE if one
440  *	happened before two.  Note that this formulation
441  *	works when the timestamp wraps around at 2^32,
442  *	as long as one and two aren't too far apart.
443  */
444 
445 #define IP_TIMESTAMP_ORDER(one, two)    ((int) ((one) - (two)) < 0)
446 
447 extern void __abortlike __ipc_port_inactive_panic(ipc_port_t port);
448 
449 static inline void
require_ip_active(ipc_port_t port)450 require_ip_active(ipc_port_t port)
451 {
452 	if (!ip_active(port)) {
453 		__ipc_port_inactive_panic(port);
454 	}
455 }
456 
457 /*
458  *  A receive right (port) can be in ONE of the following four states:
459  *
460  *  1) INACTIVE: Dead
461  *  2) IN-SPACE: In a space
462  *  3) IN-TRANSIT: Enqueued in a message
463  *  4) IN-LIMBO
464  *
465  *  If the port is active and ip_receiver_name != MACH_PORT_NULL, we can safely
466  *  deference the union as ip_receiver, which points to the space that holds
467  *  receive right (but doesn't hold a ref for it).
468  *
469  *  If the port is active and ip_receiver_name == MACH_PORT_NULL, we can safely
470  *  deference the union as ip_destination. The port is either IN-LIMBO (ip_destination == IP_NULL)
471  *  or ip_destination points to the destination port and holds a ref for it.
472  *
473  *  If the port is not active, we can safely deference the union as ip_timestamp,
474  *  which contains a timestamp taken when the port was destroyed.
475  *
476  *  If the port is in a space, ip_receiver_name denotes the port name its receive
477  *  right occupies in the receiving space. The only exception, as an optimization trick,
478  *  is task's self port (itk_self), whose ip_receiver_name actually denotes the name
479  *  of mach_task_self() in owning task's space (a send right, with receive right in ipc_space_kernel).
480  */
481 
482 static inline bool
ip_in_a_space(ipc_port_t port)483 ip_in_a_space(ipc_port_t port)
484 {
485 	/* IN-SPACE */
486 	return ip_active(port) && port->ip_receiver_name != MACH_PORT_NULL;
487 }
488 
489 static inline bool
ip_in_space(ipc_port_t port,ipc_space_t space)490 ip_in_space(ipc_port_t port, ipc_space_t space)
491 {
492 	ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
493 	return ip_in_a_space(port) && port->ip_receiver == space;
494 }
495 
496 /* use sparsely when port lock is not possible, just compare raw pointer */
497 static inline bool
ip_in_space_noauth(ipc_port_t port,void * space)498 ip_in_space_noauth(ipc_port_t port, void* space)
499 {
500 	void *__single raw_ptr = ptrauth_strip(*(void **)&port->ip_receiver, ptrauth_key_process_independent_data);
501 	return raw_ptr == space;
502 }
503 
504 static inline bool
ip_in_transit(ipc_port_t port)505 ip_in_transit(ipc_port_t port)
506 {
507 	/* IN-TRANSIT */
508 	ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
509 	return ip_active(port) && !ip_in_a_space(port) && port->ip_destination != IP_NULL;
510 }
511 
512 static inline bool
ip_in_limbo(ipc_port_t port)513 ip_in_limbo(ipc_port_t port)
514 {
515 	/* IN-LIMBO */
516 	ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
517 	return ip_active(port) && !ip_in_a_space(port) && port->ip_destination == IP_NULL;
518 }
519 
520 static inline ipc_space_t
ip_get_receiver(ipc_port_t port)521 ip_get_receiver(ipc_port_t port)
522 {
523 	ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
524 	return ip_in_a_space(port) ? port->ip_receiver : NULL;
525 }
526 
527 static inline void*
ip_get_receiver_ptr_noauth(ipc_port_t port)528 ip_get_receiver_ptr_noauth(ipc_port_t port)
529 {
530 	void *__single raw_ptr = ptrauth_strip(*(void **)&port->ip_receiver, ptrauth_key_process_independent_data);
531 	return raw_ptr;
532 }
533 
534 static inline mach_port_name_t
ip_get_receiver_name(ipc_port_t port)535 ip_get_receiver_name(ipc_port_t port)
536 {
537 	return ip_in_a_space(port) ? port->ip_receiver_name : MACH_PORT_NULL;
538 }
539 
540 static inline ipc_port_t
ip_get_destination(ipc_port_t port)541 ip_get_destination(ipc_port_t port)
542 {
543 	ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
544 	return ip_active(port) && !ip_in_a_space(port) ? port->ip_destination : IP_NULL;
545 }
546 
547 static inline ipc_port_timestamp_t
ip_get_death_time(ipc_port_t port)548 ip_get_death_time(ipc_port_t port)
549 {
550 	assert(!ip_active(port));
551 	return port->ip_timestamp;
552 }
553 
554 static inline ipc_importance_task_t
ip_get_imp_task(ipc_port_t port)555 ip_get_imp_task(ipc_port_t port)
556 {
557 	return (!ip_is_kobject(port) && !port->ip_specialreply && port->ip_tempowner) ? port->ip_imp_task : IIT_NULL;
558 }
559 
560 extern kern_return_t ipc_port_translate_send(
561 	ipc_space_t                     space,
562 	mach_port_name_t                name,
563 	ipc_port_t                     *portp);
564 
565 extern kern_return_t ipc_port_translate_receive(
566 	ipc_space_t                     space,
567 	mach_port_name_t                name,
568 	ipc_port_t                     *portp);
569 
570 /* Allocate a notification request slot */
571 extern kern_return_t ipc_port_request_alloc(
572 	ipc_port_t                      port,
573 	mach_port_name_t                name,
574 	ipc_port_t                      soright,
575 	ipc_port_request_opts_t         options,
576 	ipc_port_request_index_t       *indexp);
577 
578 extern kern_return_t ipc_port_request_hnotify_alloc(
579 	ipc_port_t                      port,
580 	struct host_notify_entry       *hnotify,
581 	ipc_port_request_index_t       *indexp);
582 
583 /* Grow one of a port's tables of notifcation requests */
584 extern kern_return_t ipc_port_request_grow(
585 	ipc_port_t                      port);
586 
587 /* Return the type(s) of notification requests outstanding */
588 extern mach_port_type_t ipc_port_request_type(
589 	ipc_port_t                      port,
590 	mach_port_name_t                name,
591 	ipc_port_request_index_t        index);
592 
593 /* Cancel a notification request and return the send-once right */
594 extern ipc_port_t ipc_port_request_cancel(
595 	ipc_port_t                      port,
596 	mach_port_name_t                name,
597 	ipc_port_request_index_t        index);
598 
599 /* Arm any delayed send-possible notification */
600 extern boolean_t ipc_port_request_sparm(
601 	ipc_port_t                port,
602 	mach_port_name_t          name,
603 	ipc_port_request_index_t  index,
604 	mach_msg_option_t         option,
605 	mach_msg_priority_t       priority);
606 
607 /* Make a no-senders request */
608 extern void ipc_port_nsrequest(
609 	ipc_port_t              port,
610 	mach_port_mscount_t     sync,
611 	ipc_port_t              notify,
612 	ipc_port_t              *previousp);
613 
614 /* Prepare a receive right for transmission/destruction */
615 extern boolean_t ipc_port_clear_receiver(
616 	ipc_port_t              port,
617 	boolean_t               should_destroy,
618 	waitq_link_list_t      *free_l);
619 
620 __options_decl(ipc_port_init_flags_t, uint32_t, {
621 	IPC_PORT_INIT_NONE                    = 0x00000000,
622 	IPC_PORT_INIT_MAKE_SEND_RIGHT         = 0x00000001,
623 	IPC_PORT_INIT_MESSAGE_QUEUE           = 0x00000002,
624 	IPC_PORT_INIT_SPECIAL_REPLY           = 0x00000004,
625 	IPC_PORT_INIT_FILTER_MESSAGE          = 0x00000008,
626 	IPC_PORT_INIT_TG_BLOCK_TRACKING       = 0x00000010,
627 	IPC_PORT_INIT_LOCKED                  = 0x00000020,
628 	IPC_PORT_INIT_REPLY                   = 0x00000040,
629 	IPC_PORT_ENFORCE_REPLY_PORT_SEMANTICS = 0x00000080,
630 	IPC_PORT_INIT_PROVISIONAL_REPLY       = 0x00000100,
631 });
632 
633 /* Initialize a newly-allocated port */
634 extern void ipc_port_init(
635 	ipc_port_t              port,
636 	ipc_space_t             space,
637 	ipc_port_init_flags_t   flags,
638 	mach_port_name_t        name);
639 
640 /* Allocate a port */
641 extern kern_return_t ipc_port_alloc(
642 	ipc_space_t             space,
643 	ipc_port_init_flags_t   flags,
644 	mach_port_name_t        *namep,
645 	ipc_port_t              *portp);
646 
647 /* Allocate a port, with a specific name */
648 extern kern_return_t ipc_port_alloc_name(
649 	ipc_space_t             space,
650 	ipc_port_init_flags_t   flags,
651 	mach_port_name_t        name,
652 	ipc_port_t              *portp);
653 
654 /* Attach a label to the port */
655 extern void ipc_port_set_label(
656 	ipc_port_t              port,
657 	ipc_label_t             label);
658 
659 /* Generate dead name notifications */
660 extern void ipc_port_dnnotify(
661 	ipc_port_t              port);
662 
663 /* Generate send-possible notifications */
664 extern void ipc_port_spnotify(
665 	ipc_port_t              port);
666 
667 /* Destroy a port */
668 extern void ipc_port_destroy(
669 	ipc_port_t      port);
670 
671 /* Check if queueing "port" in a message for "dest" would create a circular
672  *  group of ports and messages */
673 extern boolean_t
674 ipc_port_check_circularity(
675 	ipc_port_t      port,
676 	ipc_port_t      dest);
677 
678 #if IMPORTANCE_INHERITANCE
679 
680 enum {
681 	IPID_OPTION_NORMAL       = 0, /* normal boost */
682 	IPID_OPTION_SENDPOSSIBLE = 1, /* send-possible induced boost */
683 };
684 
685 /* link the destination port with special reply port */
686 void
687 ipc_port_link_special_reply_port(
688 	ipc_port_t special_reply_port,
689 	ipc_port_t dest_port,
690 	boolean_t sync_bootstrap_checkin);
691 
692 #define IPC_PORT_ADJUST_SR_NONE                      0
693 #define IPC_PORT_ADJUST_SR_ALLOW_SYNC_LINKAGE        0x1
694 #define IPC_PORT_ADJUST_SR_LINK_WORKLOOP             0x2
695 #define IPC_PORT_ADJUST_UNLINK_THREAD                0x4
696 #define IPC_PORT_ADJUST_SR_RECEIVED_MSG              0x8
697 #define IPC_PORT_ADJUST_SR_ENABLE_EVENT              0x10
698 #define IPC_PORT_ADJUST_RESET_BOOSTRAP_CHECKIN       0x20
699 
700 void
701 ipc_special_reply_port_bits_reset(ipc_port_t special_reply_port);
702 
703 void
704 ipc_special_reply_port_msg_sent(ipc_port_t special_reply_port);
705 
706 void
707 ipc_special_reply_port_msg_sent(ipc_port_t special_reply_port);
708 
709 /* Adjust special reply port linkage */
710 void
711 ipc_port_adjust_special_reply_port_locked(
712 	ipc_port_t special_reply_port,
713 	struct knote *kn,
714 	uint8_t flags,
715 	boolean_t get_turnstile);
716 
717 void
718 ipc_port_adjust_sync_link_state_locked(
719 	ipc_port_t port,
720 	int sync_link_state,
721 	turnstile_inheritor_t inheritor);
722 
723 /* Adjust special reply port linkage */
724 void
725 ipc_port_adjust_special_reply_port(
726 	ipc_port_t special_reply_port,
727 	uint8_t flags);
728 
729 void
730 ipc_port_adjust_port_locked(
731 	ipc_port_t port,
732 	struct knote *kn,
733 	boolean_t sync_bootstrap_checkin);
734 
735 void
736 ipc_port_clear_sync_rcv_thread_boost_locked(
737 	ipc_port_t port);
738 
739 bool
740 ipc_port_has_prdrequest(
741 	ipc_port_t port);
742 
743 kern_return_t
744 ipc_port_add_watchport_elem_locked(
745 	ipc_port_t                 port,
746 	struct task_watchport_elem *watchport_elem,
747 	struct task_watchport_elem **old_elem);
748 
749 kern_return_t
750 ipc_port_clear_watchport_elem_internal_conditional_locked(
751 	ipc_port_t                 port,
752 	struct task_watchport_elem *watchport_elem);
753 
754 kern_return_t
755 ipc_port_replace_watchport_elem_conditional_locked(
756 	ipc_port_t                 port,
757 	struct task_watchport_elem *old_watchport_elem,
758 	struct task_watchport_elem *new_watchport_elem);
759 
760 struct task_watchport_elem *
761 ipc_port_clear_watchport_elem_internal(
762 	ipc_port_t                 port);
763 
764 void
765 ipc_port_send_turnstile_prepare(ipc_port_t port);
766 
767 void
768 ipc_port_send_turnstile_complete(ipc_port_t port);
769 
770 struct waitq *
771 ipc_port_rcv_turnstile_waitq(struct waitq *waitq);
772 
773 /* apply importance delta to port only */
774 extern mach_port_delta_t
775 ipc_port_impcount_delta(
776 	ipc_port_t              port,
777 	mach_port_delta_t       delta,
778 	ipc_port_t              base);
779 
780 /* apply importance delta to port, and return task importance for update */
781 extern boolean_t
782 ipc_port_importance_delta_internal(
783 	ipc_port_t              port,
784 	natural_t               options,
785 	mach_port_delta_t       *deltap,
786 	ipc_importance_task_t   *imp_task);
787 
788 /* Apply an importance delta to a port and reflect change in receiver task */
789 extern boolean_t
790 ipc_port_importance_delta(
791 	ipc_port_t              port,
792 	natural_t               options,
793 	mach_port_delta_t       delta);
794 #endif /* IMPORTANCE_INHERITANCE */
795 
796 /*!
797  * @function ipc_port_make_send_any_locked()
798  *
799  * @brief
800  * Makes a naked send right for a locked and active port.
801  *
802  * @decription
803  * @c ipc_port_make_send_*() should not be used in any generic IPC
804  * plumbing, as this is an operation that subsystem owners need
805  * to be able to synchronize against with the make-send-count
806  * and no-senders notifications.
807  *
808  * It is especially important for kobject types, and in general MIG upcalls
809  * or replies from the kernel should never use MAKE_SEND dispositions,
810  * and prefer COPY_SEND or MOVE_SEND, so that subsystems can control
811  * where that send right comes from.
812  *
813  * This function doesn't perform any validation on the type of port,
814  * this duty is left to the caller.
815  *
816  * @param port          An active and locked port.
817  */
818 extern ipc_port_t ipc_port_make_send_any_locked(
819 	ipc_port_t      port);
820 
821 /*!
822  * @function ipc_port_make_send_any()
823  *
824  * @brief
825  * Makes a naked send right for the specified port.
826  *
827  * @decription
828  * @see ipc_port_make_send_any_locked() for a general warning about
829  * making send rights.
830  *
831  * This function doesn't perform any validation on the type of port,
832  * this duty is left to the caller.
833  *
834  * Using @c ipc_port_make_send_mqueue() or @c ipc_kobject_make_send()
835  * is preferred.
836  *
837  * @param port          The target port.
838  *
839  * @returns
840  * - IP_DEAD            if @c port was dead.
841  * - @c port            if @c port was valid, in which case
842  *                      a naked send right was made.
843  */
844 extern ipc_port_t ipc_port_make_send_any(
845 	ipc_port_t      port) __result_use_check;
846 
847 /*!
848  * @function ipc_port_make_send_mqueue()
849  *
850  * @brief
851  * Makes a naked send right for the specified port.
852  *
853  * @decription
854  * @see ipc_port_make_send_any_locked() for a general warning about
855  * making send rights.
856  *
857  * This function will return IP_NULL if the port wasn't a message queue.
858  *
859  * This avoids confusions where kobject ports are being set in places
860  * where the system expects message queues.
861  *
862  * @param port          The target port.
863  *
864  * @returns
865  * - IP_NULL            if @c port was not a message queue port
866  *                      (IKOT_NONE, or IKOT_TIMER), or @c port was IP_NULL.
867  * - IP_DEAD            if @c port was dead.
868  * - @c port            if @c port was valid, in which case
869  *                      a naked send right was made.
870  */
871 extern ipc_port_t ipc_port_make_send_mqueue(
872 	ipc_port_t      port) __result_use_check;
873 
874 /*!
875  * @function ipc_port_copy_send_any_locked()
876  *
877  * @brief
878  * Copies a naked send right for a locked and active port.
879  *
880  * @decription
881  * This function doesn't perform any validation on the type of port,
882  * this duty is left to the caller.
883  *
884  * @param port          An active and locked port.
885  */
886 extern void ipc_port_copy_send_any_locked(
887 	ipc_port_t      port);
888 
889 /*!
890  * @function ipc_port_make_send_any()
891  *
892  * @brief
893  * Copies a naked send right for the specified port.
894  *
895  * @decription
896  * This function doesn't perform any validation on the type of port,
897  * this duty is left to the caller.
898  *
899  * Using @c ipc_port_copy_send_mqueue() or @c ipc_kobject_copy_send()
900  * is preferred.
901  *
902  * @param port          The target port.
903  *
904  * @returns
905  * - IP_DEAD            if @c port was dead.
906  * - @c port            if @c port was valid, in which case
907  *                      a naked send right was made.
908  */
909 extern ipc_port_t ipc_port_copy_send_any(
910 	ipc_port_t      port) __result_use_check;
911 
912 /*!
913  * @function ipc_port_copy_send_mqueue()
914  *
915  * @brief
916  * Copies a naked send right for the specified port.
917  *
918  * @decription
919  * This function will return IP_NULL if the port wasn't a message queue.
920  *
921  * This avoids confusions where kobject ports are being set in places
922  * where the system expects message queues.
923  *
924  * @param port          The target port.
925  *
926  * @returns
927  * - IP_NULL            if @c port was not a message queue port
928  *                      (IKOT_NONE, or IKOT_TIMER), or @c port was IP_NULL.
929  * - IP_DEAD            if @c port was dead.
930  * - @c port            if @c port was valid, in which case
931  *                      a naked send right was made.
932  */
933 extern ipc_port_t ipc_port_copy_send_mqueue(
934 	ipc_port_t      port) __result_use_check;
935 
936 /* Copyout a naked send right */
937 extern mach_port_name_t ipc_port_copyout_send(
938 	ipc_port_t      sright,
939 	ipc_space_t     space);
940 
941 extern mach_port_name_t ipc_port_copyout_send_pinned(
942 	ipc_port_t      sright,
943 	ipc_space_t     space);
944 
945 extern void ipc_port_thread_group_blocked(
946 	ipc_port_t      port);
947 
948 extern void ipc_port_thread_group_unblocked(void);
949 
950 extern void ipc_port_release_send_and_unlock(
951 	ipc_port_t      port);
952 #endif /* MACH_KERNEL_PRIVATE */
953 
954 #if KERNEL_PRIVATE
955 
956 /* Release a (valid) naked send right */
957 extern void ipc_port_release_send(
958 	ipc_port_t      port);
959 
960 extern void ipc_port_reference(
961 	ipc_port_t port);
962 
963 extern void ipc_port_release(
964 	ipc_port_t port);
965 
966 struct thread_attr_for_ipc_propagation {
967 	union {
968 		struct {
969 			uint64_t tafip_iotier:2,
970 			    tafip_qos:3;
971 		};
972 		uint64_t tafip_value;
973 	};
974 	uint64_t tafip_reserved;
975 };
976 
977 extern kern_return_t
978 ipc_port_propagate_thread_attr(
979 	ipc_port_t port,
980 	struct thread_attr_for_ipc_propagation attr);
981 
982 extern kern_return_t
983 ipc_port_reset_thread_attr(ipc_port_t port);
984 #endif /* KERNEL_PRIVATE */
985 
986 #ifdef MACH_KERNEL_PRIVATE
987 
988 /* Make a naked send-once right from a locked and active receive right */
989 extern ipc_port_t ipc_port_make_sonce_locked(
990 	ipc_port_t      port);
991 
992 /* Make a naked send-once right from a receive right */
993 extern ipc_port_t ipc_port_make_sonce(
994 	ipc_port_t      port);
995 
996 /* Release a naked send-once right */
997 extern void ipc_port_release_sonce(
998 	ipc_port_t      port);
999 
1000 /* Release a naked send-once right */
1001 extern void ipc_port_release_sonce_and_unlock(
1002 	ipc_port_t      port);
1003 
1004 /* Release a naked (in limbo or in transit) receive right */
1005 extern void ipc_port_release_receive(
1006 	ipc_port_t      port);
1007 
1008 /* Finalize the destruction of a port before it gets freed */
1009 extern void ipc_port_finalize(
1010 	ipc_port_t      port);
1011 
1012 /* Get receiver task and its pid (if any) for port. Assumes port is locked. */
1013 extern pid_t ipc_port_get_receiver_task_locked(ipc_port_t port, uintptr_t *task);
1014 
1015 /* Get receiver task and its pid (if any) for port. */
1016 extern pid_t ipc_port_get_receiver_task(ipc_port_t port, uintptr_t *task);
1017 
1018 /* Allocate a port in a special space */
1019 extern ipc_port_t ipc_port_alloc_special(
1020 	ipc_space_t             space,
1021 	ipc_port_init_flags_t   flags);
1022 
1023 /* Deallocate a port in a special space */
1024 extern void ipc_port_dealloc_special_and_unlock(
1025 	ipc_port_t      port,
1026 	ipc_space_t     space);
1027 
1028 /* Deallocate a port in a special space */
1029 extern void ipc_port_dealloc_special(
1030 	ipc_port_t      port,
1031 	ipc_space_t     space);
1032 
1033 extern void ipc_port_recv_update_inheritor(ipc_port_t port,
1034     struct turnstile *turnstile,
1035     turnstile_update_flags_t flags);
1036 
1037 extern void ipc_port_send_update_inheritor(ipc_port_t port,
1038     struct turnstile *turnstile,
1039     turnstile_update_flags_t flags);
1040 
1041 extern int
1042 ipc_special_reply_get_pid_locked(ipc_port_t port);
1043 
1044 #define ipc_port_alloc_reply()          \
1045 	ipc_port_alloc_special(ipc_space_reply, IPC_PORT_INIT_MESSAGE_QUEUE | IPC_PORT_INIT_SPECIAL_REPLY)
1046 #define ipc_port_dealloc_reply(port)    \
1047 	ipc_port_dealloc_special((port), ipc_space_reply)
1048 
1049 #endif /* MACH_KERNEL_PRIVATE */
1050 
1051 #endif  /* _IPC_IPC_PORT_H_ */
1052