xref: /xnu-10002.61.3/osfmk/ipc/ipc_object.c (revision 0f4c859e951fba394238ab619495c4e1d54d0f34)
1 /*
2  * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 /*
29  * @OSF_COPYRIGHT@
30  */
31 /*
32  * Mach Operating System
33  * Copyright (c) 1991,1990,1989 Carnegie Mellon University
34  * All Rights Reserved.
35  *
36  * Permission to use, copy, modify and distribute this software and its
37  * documentation is hereby granted, provided that both the copyright
38  * notice and this permission notice appear in all copies of the
39  * software, derivative works or modified versions, and any portions
40  * thereof, and that both notices appear in supporting documentation.
41  *
42  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44  * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
45  *
46  * Carnegie Mellon requests users of this software to return to
47  *
48  *  Software Distribution Coordinator  or  [email protected]
49  *  School of Computer Science
50  *  Carnegie Mellon University
51  *  Pittsburgh PA 15213-3890
52  *
53  * any improvements or extensions that they make and grant Carnegie Mellon
54  * the rights to redistribute these changes.
55  */
56 /*
57  * NOTICE: This file was modified by McAfee Research in 2004 to introduce
58  * support for mandatory and extensible security protections.  This notice
59  * is included in support of clause 2.2 (b) of the Apple Public License,
60  * Version 2.0.
61  * Copyright (c) 2005-2006 SPARTA, Inc.
62  */
63 /*
64  */
65 /*
66  *	File:	ipc/ipc_object.c
67  *	Author:	Rich Draves
68  *	Date:	1989
69  *
70  *	Functions to manipulate IPC objects.
71  */
72 
73 #include <mach/mach_types.h>
74 #include <mach/boolean.h>
75 #include <mach/kern_return.h>
76 #include <mach/port.h>
77 #include <mach/message.h>
78 
79 #include <kern/kern_types.h>
80 #include <kern/misc_protos.h>
81 #include <kern/ipc_kobject.h>
82 #include <kern/zalloc_internal.h> // zone_id_for_element
83 
84 #include <ipc/ipc_types.h>
85 #include <ipc/ipc_importance.h>
86 #include <ipc/port.h>
87 #include <ipc/ipc_space.h>
88 #include <ipc/ipc_entry.h>
89 #include <ipc/ipc_object.h>
90 #include <ipc/ipc_hash.h>
91 #include <ipc/ipc_kmsg.h>
92 #include <ipc/ipc_right.h>
93 #include <ipc/ipc_notify.h>
94 #include <ipc/ipc_port.h>
95 #include <ipc/ipc_pset.h>
96 
97 #include <security/mac_mach_internal.h>
98 
99 static struct mpsc_daemon_queue ipc_object_deallocate_queue;
100 SECURITY_READ_ONLY_LATE(zone_t) ipc_object_zones[IOT_NUMBER];
101 
102 /*
103  * In order to do lockfree lookups in the IPC space, we combine two schemes:
104  *
105  * - the ipc table pointer is protected with hazard pointers to allow
106  *   dereferencing it with only holding a ref on a task or space;
107  *
108  * - we use ipc_object_lock_allow_invalid in order to lock locks and validate
109  *   that they are the droid we're looking for.
110  *
111  * The second half requires that virtual addresses assigned that ever held
112  * a port, either hold a port, or nothing, forever. To get this property,
113  * we just piggy back on the zone sequestering security feature which gives
114  * us exactly that.
115  *
116  * However, sequestering really only "works" on a sufficiently large address
117  * space, especially for a resource that can be made by userspace at will,
118  * so we can't do lockless lookups on ILP32.
119  *
120  * Note: this scheme is incompatible with kasan quarantines
121  *       (because it uses elements to store backtraces in them
122  *       which lets the waitq lock appear "valid" by accident when
123  *       elements are freed).
124  */
125 #define IPC_OBJECT_ZC_BASE (ZC_ZFREE_CLEARMEM | ZC_SEQUESTER)
126 
127 ZONE_INIT(&ipc_object_zones[IOT_PORT],
128     "ipc ports", sizeof(struct ipc_port),
129     IPC_OBJECT_ZC_BASE | ZC_CACHING, ZONE_ID_IPC_PORT, NULL);
130 
131 ZONE_INIT(&ipc_object_zones[IOT_PORT_SET],
132     "ipc port sets", sizeof(struct ipc_pset),
133     IPC_OBJECT_ZC_BASE, ZONE_ID_IPC_PORT_SET, NULL);
134 
135 __attribute__((noinline))
136 static void
ipc_object_free(unsigned int otype,ipc_object_t object,bool last_ref)137 ipc_object_free(unsigned int otype, ipc_object_t object, bool last_ref)
138 {
139 	if (last_ref) {
140 		if (otype == IOT_PORT) {
141 			ipc_port_finalize(ip_object_to_port(object));
142 		} else {
143 			ipc_pset_finalize(ips_object_to_pset(object));
144 		}
145 	}
146 	zfree(ipc_object_zones[otype], object);
147 }
148 
149 __attribute__((noinline))
150 static void
ipc_object_free_safe(ipc_object_t object)151 ipc_object_free_safe(ipc_object_t object)
152 {
153 	struct waitq *wq = io_waitq(object);
154 
155 	assert(!waitq_is_valid(wq));
156 	assert(os_atomic_load(&wq->waitq_defer.mpqc_next, relaxed) == NULL);
157 	mpsc_daemon_enqueue(&ipc_object_deallocate_queue,
158 	    &wq->waitq_defer, MPSC_QUEUE_NONE);
159 }
160 
161 static void
ipc_object_deallocate_queue_invoke(mpsc_queue_chain_t e,__assert_only mpsc_daemon_queue_t dq)162 ipc_object_deallocate_queue_invoke(mpsc_queue_chain_t e,
163     __assert_only mpsc_daemon_queue_t dq)
164 {
165 	struct waitq *wq = __container_of(e, struct waitq, waitq_defer);
166 	ipc_object_t  io = io_from_waitq(wq);
167 
168 	assert(dq == &ipc_object_deallocate_queue);
169 
170 	os_atomic_store(&wq->waitq_defer.mpqc_next, NULL, relaxed);
171 	ipc_object_free(io_otype(io), io, true);
172 }
173 
174 void
ipc_object_deallocate_register_queue(void)175 ipc_object_deallocate_register_queue(void)
176 {
177 	thread_deallocate_daemon_register_queue(&ipc_object_deallocate_queue,
178 	    ipc_object_deallocate_queue_invoke);
179 }
180 
181 /*
182  *	Routine:	ipc_object_reference
183  *	Purpose:
184  *		Take a reference to an object.
185  */
186 
187 void
ipc_object_reference(ipc_object_t io)188 ipc_object_reference(
189 	ipc_object_t    io)
190 {
191 	static_assert(sizeof(os_ref_atomic_t) == sizeof(io->io_references));
192 	os_ref_retain_raw((os_ref_atomic_t *)&io->io_references, NULL);
193 }
194 
195 /*
196  *	Routine:	ipc_object_release
197  *	Purpose:
198  *		Release a reference to an object.
199  */
200 
201 void
ipc_object_release(ipc_object_t io)202 ipc_object_release(
203 	ipc_object_t    io)
204 {
205 #if DEBUG
206 	assert(get_preemption_level() == 0);
207 #endif
208 
209 	if (os_ref_release_raw((os_ref_atomic_t *)&io->io_references, NULL) == 0) {
210 		/* Free the object */
211 		ipc_object_free(io_otype(io), io, true);
212 	}
213 }
214 
215 /*
216  *	Routine:	ipc_object_release_safe
217  *	Purpose:
218  *		Release a reference to an object safely
219  */
220 
221 void
ipc_object_release_safe(ipc_object_t io)222 ipc_object_release_safe(
223 	ipc_object_t    io)
224 {
225 	if (os_ref_release_raw((os_ref_atomic_t *)&io->io_references, NULL) == 0) {
226 		if (get_preemption_level() == 0) {
227 			ipc_object_free(io_otype(io), io, true);
228 		} else {
229 			ipc_object_free_safe(io);
230 		}
231 	}
232 }
233 
234 /*
235  *	Routine:	ipc_object_release_live
236  *	Purpose:
237  *		Release a reference to an object that isn't the last one.
238  */
239 
240 void
ipc_object_release_live(ipc_object_t io)241 ipc_object_release_live(
242 	ipc_object_t    io)
243 {
244 	os_ref_release_live_raw((os_ref_atomic_t *)&io->io_references, NULL);
245 }
246 
247 /*
248  *	Routine:	ipc_object_translate
249  *	Purpose:
250  *		Look up an object in a space.
251  *	Conditions:
252  *		Nothing locked before.  If successful, the object
253  *		is returned active and locked.  The caller doesn't get a ref.
254  *	Returns:
255  *		KERN_SUCCESS		Object returned locked.
256  *		KERN_INVALID_TASK	The space is dead.
257  *		KERN_INVALID_NAME	The name doesn't denote a right
258  *		KERN_INVALID_RIGHT	Name doesn't denote the correct right
259  */
260 kern_return_t
ipc_object_translate(ipc_space_t space,mach_port_name_t name,mach_port_right_t right,ipc_object_t * objectp)261 ipc_object_translate(
262 	ipc_space_t             space,
263 	mach_port_name_t        name,
264 	mach_port_right_t       right,
265 	ipc_object_t            *objectp)
266 {
267 	ipc_entry_bits_t bits;
268 	ipc_object_t object;
269 	kern_return_t kr;
270 
271 	if (!MACH_PORT_RIGHT_VALID_TRANSLATE(right)) {
272 		return KERN_INVALID_RIGHT;
273 	}
274 
275 	kr = ipc_right_lookup_read(space, name, &bits, &object);
276 	if (kr != KERN_SUCCESS) {
277 		return kr;
278 	}
279 	/* object is locked and active */
280 
281 	if ((bits & MACH_PORT_TYPE(right)) == MACH_PORT_TYPE_NONE) {
282 		io_unlock(object);
283 		return KERN_INVALID_RIGHT;
284 	}
285 
286 	*objectp = object;
287 	return KERN_SUCCESS;
288 }
289 
290 /*
291  *	Routine:	ipc_object_translate_two
292  *	Purpose:
293  *		Look up two objects in a space.
294  *	Conditions:
295  *		Nothing locked before.  If successful, the objects
296  *		are returned locked.  The caller doesn't get a ref.
297  *	Returns:
298  *		KERN_SUCCESS		Objects returned locked.
299  *		KERN_INVALID_TASK	The space is dead.
300  *		KERN_INVALID_NAME	A name doesn't denote a right.
301  *		KERN_INVALID_RIGHT	A name doesn't denote the correct right.
302  */
303 
304 kern_return_t
ipc_object_translate_two(ipc_space_t space,mach_port_name_t name1,mach_port_right_t right1,ipc_object_t * objectp1,mach_port_name_t name2,mach_port_right_t right2,ipc_object_t * objectp2)305 ipc_object_translate_two(
306 	ipc_space_t             space,
307 	mach_port_name_t        name1,
308 	mach_port_right_t       right1,
309 	ipc_object_t            *objectp1,
310 	mach_port_name_t        name2,
311 	mach_port_right_t       right2,
312 	ipc_object_t            *objectp2)
313 {
314 	ipc_entry_t entry1;
315 	ipc_entry_t entry2;
316 	ipc_object_t object1, object2;
317 	kern_return_t kr;
318 	boolean_t doguard = TRUE;
319 
320 	kr = ipc_right_lookup_two_read(space, name1, &entry1, name2, &entry2);
321 	if (kr != KERN_SUCCESS) {
322 		return kr;
323 	}
324 	/* space is read-locked and active */
325 
326 	if ((entry1->ie_bits & MACH_PORT_TYPE(right1)) == MACH_PORT_TYPE_NONE) {
327 		/* If looking for receive, and the entry used to hold one, give a pass on EXC_GUARD */
328 		if ((right1 & MACH_PORT_RIGHT_RECEIVE) == MACH_PORT_RIGHT_RECEIVE &&
329 		    (entry1->ie_bits & MACH_PORT_TYPE_EX_RECEIVE) == MACH_PORT_TYPE_EX_RECEIVE) {
330 			doguard = FALSE;
331 		}
332 		is_read_unlock(space);
333 		if (doguard) {
334 			mach_port_guard_exception(name1, 0, 0, kGUARD_EXC_INVALID_RIGHT);
335 		}
336 		return KERN_INVALID_RIGHT;
337 	}
338 
339 	if ((entry2->ie_bits & MACH_PORT_TYPE(right2)) == MACH_PORT_TYPE_NONE) {
340 		/* If looking for receive, and the entry used to hold one, give a pass on EXC_GUARD */
341 		if ((right2 & MACH_PORT_RIGHT_RECEIVE) == MACH_PORT_RIGHT_RECEIVE &&
342 		    (entry2->ie_bits & MACH_PORT_TYPE_EX_RECEIVE) == MACH_PORT_TYPE_EX_RECEIVE) {
343 			doguard = FALSE;
344 		}
345 		is_read_unlock(space);
346 		if (doguard) {
347 			mach_port_guard_exception(name2, 0, 0, kGUARD_EXC_INVALID_RIGHT);
348 		}
349 		return KERN_INVALID_RIGHT;
350 	}
351 
352 	object1 = entry1->ie_object;
353 	assert(object1 != IO_NULL);
354 	io_lock(object1);
355 	if (!io_active(object1)) {
356 		io_unlock(object1);
357 		is_read_unlock(space);
358 		return KERN_INVALID_NAME;
359 	}
360 
361 	object2 = entry2->ie_object;
362 	assert(object2 != IO_NULL);
363 	io_lock(object2);
364 	if (!io_active(object2)) {
365 		io_unlock(object1);
366 		io_unlock(object2);
367 		is_read_unlock(space);
368 		return KERN_INVALID_NAME;
369 	}
370 
371 	*objectp1 = object1;
372 	*objectp2 = object2;
373 
374 	is_read_unlock(space);
375 	return KERN_SUCCESS;
376 }
377 
378 /*
379  *	Routine:	ipc_object_alloc_dead
380  *	Purpose:
381  *		Allocate a dead-name entry.
382  *	Conditions:
383  *		Nothing locked.
384  *	Returns:
385  *		KERN_SUCCESS		The dead name is allocated.
386  *		KERN_INVALID_TASK	The space is dead.
387  *		KERN_NO_SPACE		No room for an entry in the space.
388  */
389 
390 kern_return_t
ipc_object_alloc_dead(ipc_space_t space,mach_port_name_t * namep)391 ipc_object_alloc_dead(
392 	ipc_space_t             space,
393 	mach_port_name_t        *namep)
394 {
395 	ipc_entry_t entry;
396 	kern_return_t kr;
397 
398 	kr = ipc_entry_alloc(space, IO_NULL, namep, &entry);
399 	if (kr != KERN_SUCCESS) {
400 		return kr;
401 	}
402 	/* space is write-locked */
403 
404 	/* null object, MACH_PORT_TYPE_DEAD_NAME, 1 uref */
405 
406 	entry->ie_bits |= MACH_PORT_TYPE_DEAD_NAME | 1;
407 	ipc_entry_modified(space, *namep, entry);
408 	is_write_unlock(space);
409 	return KERN_SUCCESS;
410 }
411 
412 /*
413  *	Routine:	ipc_object_alloc
414  *	Purpose:
415  *		Allocate an object.
416  *	Conditions:
417  *		Nothing locked.
418  *		The space is write locked on successful return.
419  *		The caller doesn't get a reference for the object.
420  *	Returns:
421  *		KERN_SUCCESS		The object is allocated.
422  *		KERN_INVALID_TASK	The space is dead.
423  *		KERN_NO_SPACE		No room for an entry in the space.
424  */
425 
426 kern_return_t
ipc_object_alloc(ipc_space_t space,ipc_object_type_t otype,mach_port_type_t type,mach_port_urefs_t urefs,mach_port_name_t * namep,ipc_object_t * objectp)427 ipc_object_alloc(
428 	ipc_space_t             space,
429 	ipc_object_type_t       otype,
430 	mach_port_type_t        type,
431 	mach_port_urefs_t       urefs,
432 	mach_port_name_t        *namep,
433 	ipc_object_t            *objectp)
434 {
435 	ipc_object_t object;
436 	ipc_entry_t entry;
437 	kern_return_t kr;
438 
439 	assert(otype < IOT_NUMBER);
440 	assert((type & MACH_PORT_TYPE_ALL_RIGHTS) == type);
441 	assert(type != MACH_PORT_TYPE_NONE);
442 	assert(urefs <= MACH_PORT_UREFS_MAX);
443 
444 	object = io_alloc(otype, Z_WAITOK | Z_ZERO | Z_NOFAIL);
445 	os_atomic_init(&object->io_bits, io_makebits(otype));
446 	os_atomic_init(&object->io_references, 1); /* for entry, not caller */
447 
448 	*namep = CAST_MACH_PORT_TO_NAME(object);
449 	kr = ipc_entry_alloc(space, object, namep, &entry);
450 	if (kr != KERN_SUCCESS) {
451 		ipc_object_free(otype, object, false);
452 		return kr;
453 	}
454 	/* space is write-locked */
455 
456 	entry->ie_bits |= type | urefs;
457 	ipc_entry_modified(space, *namep, entry);
458 
459 	*objectp = object;
460 	return KERN_SUCCESS;
461 }
462 
463 /*
464  *	Routine:	ipc_object_alloc_name
465  *	Purpose:
466  *		Allocate an object, with a specific name.
467  *	Conditions:
468  *		Nothing locked.  If successful, the object is returned locked.
469  *		The caller doesn't get a reference for the object.
470  *
471  *		finish_init() must call an ipc_*_init function
472  *		that will return the object locked (using IPC_PORT_INIT_LOCKED,
473  *		or SYNC_POLICY_INIT_LOCKED, or equivalent).
474  *
475  *	Returns:
476  *		KERN_SUCCESS		The object is allocated.
477  *		KERN_INVALID_TASK	The space is dead.
478  *		KERN_NAME_EXISTS	The name already denotes a right.
479  */
480 
481 kern_return_t
482 ipc_object_alloc_name(
483 	ipc_space_t             space,
484 	ipc_object_type_t       otype,
485 	mach_port_type_t        type,
486 	mach_port_urefs_t       urefs,
487 	mach_port_name_t        name,
488 	ipc_object_t            *objectp,
489 	void                    (^finish_init)(ipc_object_t))
490 {
491 	ipc_object_t object;
492 	ipc_entry_t entry;
493 	kern_return_t kr;
494 
495 	assert(otype < IOT_NUMBER);
496 	assert((type & MACH_PORT_TYPE_ALL_RIGHTS) == type);
497 	assert(type != MACH_PORT_TYPE_NONE);
498 	assert(urefs <= MACH_PORT_UREFS_MAX);
499 
500 	object = io_alloc(otype, Z_WAITOK | Z_ZERO | Z_NOFAIL);
501 	os_atomic_init(&object->io_bits, io_makebits(otype));
502 	os_atomic_init(&object->io_references, 1); /* for entry, not caller */
503 
504 	kr = ipc_entry_alloc_name(space, name, &entry);
505 	if (kr != KERN_SUCCESS) {
506 		ipc_object_free(otype, object, false);
507 		return kr;
508 	}
509 	/* space is write-locked */
510 
511 	if (ipc_right_inuse(entry)) {
512 		is_write_unlock(space);
513 		ipc_object_free(otype, object, false);
514 		return KERN_NAME_EXISTS;
515 	}
516 
517 	entry->ie_bits |= type | urefs;
518 	entry->ie_object = object;
519 
520 	finish_init(object);
521 	/* object is locked */
522 	io_lock_held(object);
523 
524 	ipc_entry_modified(space, name, entry);
525 	is_write_unlock(space);
526 
527 	*objectp = object;
528 	return KERN_SUCCESS;
529 }
530 
531 /*	Routine:	ipc_object_validate
532  *	Purpose:
533  *		Validates an ipc port or port set as belonging to the correct
534  *		zone.
535  */
536 
537 void
ipc_object_validate(ipc_object_t object)538 ipc_object_validate(
539 	ipc_object_t    object)
540 {
541 	if (io_otype(object) != IOT_PORT_SET) {
542 		ip_validate(object);
543 	} else {
544 		ips_validate(object);
545 	}
546 }
547 
548 /*
549  *	Routine:	ipc_object_copyin_type
550  *	Purpose:
551  *		Convert a send type name to a received type name.
552  */
553 
554 mach_msg_type_name_t
ipc_object_copyin_type(mach_msg_type_name_t msgt_name)555 ipc_object_copyin_type(
556 	mach_msg_type_name_t    msgt_name)
557 {
558 	switch (msgt_name) {
559 	case MACH_MSG_TYPE_MOVE_RECEIVE:
560 		return MACH_MSG_TYPE_PORT_RECEIVE;
561 
562 	case MACH_MSG_TYPE_MOVE_SEND_ONCE:
563 	case MACH_MSG_TYPE_MAKE_SEND_ONCE:
564 		return MACH_MSG_TYPE_PORT_SEND_ONCE;
565 
566 	case MACH_MSG_TYPE_MOVE_SEND:
567 	case MACH_MSG_TYPE_MAKE_SEND:
568 	case MACH_MSG_TYPE_COPY_SEND:
569 		return MACH_MSG_TYPE_PORT_SEND;
570 
571 	case MACH_MSG_TYPE_DISPOSE_RECEIVE:
572 	case MACH_MSG_TYPE_DISPOSE_SEND:
573 	case MACH_MSG_TYPE_DISPOSE_SEND_ONCE:
574 	/* fall thru */
575 	default:
576 		return MACH_MSG_TYPE_PORT_NONE;
577 	}
578 }
579 
580 /*
581  *	Routine:	ipc_object_copyin
582  *	Purpose:
583  *		Copyin a capability from a space.
584  *		If successful, the caller gets a ref
585  *		for the resulting object, unless it is IO_DEAD.
586  *	Conditions:
587  *		Nothing locked.
588  *	Returns:
589  *		KERN_SUCCESS		Acquired an object, possibly IO_DEAD.
590  *		KERN_INVALID_TASK	The space is dead.
591  *		KERN_INVALID_NAME	Name doesn't exist in space.
592  *		KERN_INVALID_RIGHT	Name doesn't denote correct right.
593  */
594 
595 kern_return_t
ipc_object_copyin(ipc_space_t space,mach_port_name_t name,mach_msg_type_name_t msgt_name,ipc_object_t * objectp,mach_port_context_t context,mach_msg_guard_flags_t * guard_flags,ipc_object_copyin_flags_t copyin_flags)596 ipc_object_copyin(
597 	ipc_space_t                space,
598 	mach_port_name_t           name,
599 	mach_msg_type_name_t       msgt_name,
600 	ipc_object_t               *objectp,
601 	mach_port_context_t        context,
602 	mach_msg_guard_flags_t     *guard_flags,
603 	ipc_object_copyin_flags_t  copyin_flags)
604 {
605 	ipc_entry_t entry;
606 	ipc_port_t soright;
607 	ipc_port_t release_port;
608 	kern_return_t kr;
609 	int assertcnt = 0;
610 
611 	ipc_object_copyin_flags_t copyin_mask = IPC_OBJECT_COPYIN_FLAGS_ALLOW_IMMOVABLE_SEND
612 	    | IPC_OBJECT_COPYIN_FLAGS_ALLOW_CONN_IMMOVABLE_RECEIVE;
613 	copyin_mask = (copyin_flags & copyin_mask) | IPC_OBJECT_COPYIN_FLAGS_DEADOK;
614 
615 	/*
616 	 * We allow moving of immovable receive right of a service port when it is from launchd.
617 	 */
618 	task_t task = current_task_early();
619 #ifdef MACH_BSD
620 	if (task && proc_isinitproc(get_bsdtask_info(task))) {
621 		copyin_mask |= IPC_OBJECT_COPYIN_FLAGS_ALLOW_IMMOVABLE_RECEIVE;
622 	}
623 #endif
624 
625 	/*
626 	 *	Could first try a read lock when doing
627 	 *	MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND,
628 	 *	and MACH_MSG_TYPE_MAKE_SEND_ONCE.
629 	 */
630 
631 	kr = ipc_right_lookup_write(space, name, &entry);
632 	if (kr != KERN_SUCCESS) {
633 		return kr;
634 	}
635 	/* space is write-locked and active */
636 
637 	release_port = IP_NULL;
638 	kr = ipc_right_copyin(space, name, entry,
639 	    msgt_name, copyin_mask,
640 	    objectp, &soright,
641 	    &release_port,
642 	    &assertcnt,
643 	    context,
644 	    guard_flags);
645 	is_write_unlock(space);
646 
647 	if (moved_provisional_reply_port(msgt_name, soright)) {
648 		send_prp_telemetry(-1);
649 	}
650 
651 
652 #if IMPORTANCE_INHERITANCE
653 	if (0 < assertcnt && ipc_importance_task_is_any_receiver_type(current_task()->task_imp_base)) {
654 		ipc_importance_task_drop_internal_assertion(current_task()->task_imp_base, assertcnt);
655 	}
656 #endif /* IMPORTANCE_INHERITANCE */
657 
658 	if (release_port != IP_NULL) {
659 		ip_release(release_port);
660 	}
661 
662 	if ((kr == KERN_SUCCESS) && (soright != IP_NULL)) {
663 		ipc_notify_port_deleted(soright, name);
664 	}
665 
666 	return kr;
667 }
668 
669 /*
670  *	Routine:	ipc_object_copyin_from_kernel
671  *	Purpose:
672  *		Copyin a naked capability from the kernel.
673  *
674  *		MACH_MSG_TYPE_MOVE_RECEIVE
675  *			The receiver must be ipc_space_kernel
676  *			or the receive right must already be in limbo.
677  *			Consumes the naked receive right.
678  *		MACH_MSG_TYPE_COPY_SEND
679  *			A naked send right must be supplied.
680  *			The port gains a reference, and a send right
681  *			if the port is still active.
682  *		MACH_MSG_TYPE_MAKE_SEND
683  *			The receiver must be ipc_space_kernel.
684  *			The port gains a reference and a send right.
685  *		MACH_MSG_TYPE_MOVE_SEND
686  *			Consumes a naked send right.
687  *		MACH_MSG_TYPE_MAKE_SEND_ONCE
688  *			The port gains a reference and a send-once right.
689  *			Receiver also be the caller of device subsystem,
690  *			so no assertion.
691  *		MACH_MSG_TYPE_MOVE_SEND_ONCE
692  *			Consumes a naked send-once right.
693  *	Conditions:
694  *		Nothing locked.
695  */
696 
697 void
ipc_object_copyin_from_kernel(ipc_object_t object,mach_msg_type_name_t msgt_name)698 ipc_object_copyin_from_kernel(
699 	ipc_object_t            object,
700 	mach_msg_type_name_t    msgt_name)
701 {
702 	assert(IO_VALID(object));
703 
704 	switch (msgt_name) {
705 	case MACH_MSG_TYPE_MOVE_RECEIVE: {
706 		ipc_port_t port = ip_object_to_port(object);
707 
708 		ip_mq_lock(port);
709 		require_ip_active(port);
710 		if (ip_in_a_space(port)) {
711 			assert(ip_in_space(port, ipc_space_kernel));
712 			assert(port->ip_immovable_receive == 0);
713 
714 			/* relevant part of ipc_port_clear_receiver */
715 			port->ip_mscount = 0;
716 
717 			/* port transtions to IN-LIMBO state */
718 			port->ip_receiver_name = MACH_PORT_NULL;
719 			port->ip_destination = IP_NULL;
720 		}
721 		ip_mq_unlock(port);
722 		break;
723 	}
724 
725 	case MACH_MSG_TYPE_COPY_SEND: {
726 		ipc_port_t port = ip_object_to_port(object);
727 
728 		ip_mq_lock(port);
729 		if (ip_active(port)) {
730 			assert(port->ip_srights > 0);
731 		}
732 		ip_srights_inc(port);
733 		ip_reference(port);
734 		ip_mq_unlock(port);
735 		break;
736 	}
737 
738 	case MACH_MSG_TYPE_MAKE_SEND: {
739 		ipc_port_t port = ip_object_to_port(object);
740 
741 		ip_mq_lock(port);
742 		if (ip_active(port)) {
743 			assert(ip_in_a_space(port));
744 			assert((ip_in_space(port, ipc_space_kernel)) ||
745 			    (port->ip_receiver->is_node_id != HOST_LOCAL_NODE));
746 			port->ip_mscount++;
747 		}
748 
749 		ip_srights_inc(port);
750 		ip_reference(port);
751 		ip_mq_unlock(port);
752 		break;
753 	}
754 
755 	case MACH_MSG_TYPE_MOVE_SEND: {
756 		/* move naked send right into the message */
757 		assert(ip_object_to_port(object)->ip_srights);
758 		break;
759 	}
760 
761 	case MACH_MSG_TYPE_MAKE_SEND_ONCE: {
762 		ipc_port_t port = ip_object_to_port(object);
763 
764 		ip_mq_lock(port);
765 		if (ip_active(port)) {
766 			assert(ip_in_a_space(port));
767 		}
768 		ipc_port_make_sonce_locked(port);
769 		ip_mq_unlock(port);
770 		break;
771 	}
772 
773 	case MACH_MSG_TYPE_MOVE_SEND_ONCE: {
774 		/* move naked send-once right into the message */
775 		assert(ip_object_to_port(object)->ip_sorights);
776 		break;
777 	}
778 
779 	default:
780 		panic("ipc_object_copyin_from_kernel: strange rights");
781 	}
782 }
783 
784 /*
785  *	Routine:	ipc_object_destroy
786  *	Purpose:
787  *		Destroys a naked capability.
788  *		Consumes a ref for the object.
789  *
790  *		A receive right should be in limbo or in transit.
791  *	Conditions:
792  *		Nothing locked.
793  */
794 
795 void
ipc_object_destroy(ipc_object_t object,mach_msg_type_name_t msgt_name)796 ipc_object_destroy(
797 	ipc_object_t            object,
798 	mach_msg_type_name_t    msgt_name)
799 {
800 	assert(IO_VALID(object));
801 	assert(io_otype(object) == IOT_PORT);
802 
803 	switch (msgt_name) {
804 	case MACH_MSG_TYPE_PORT_SEND:
805 		ipc_port_release_send(ip_object_to_port(object));
806 		break;
807 
808 	case MACH_MSG_TYPE_PORT_SEND_ONCE:
809 		io_lock(object);
810 		ipc_notify_send_once_and_unlock(ip_object_to_port(object));
811 		break;
812 
813 	case MACH_MSG_TYPE_PORT_RECEIVE:
814 		ipc_port_release_receive(ip_object_to_port(object));
815 		break;
816 
817 	default:
818 		panic("ipc_object_destroy: strange rights");
819 	}
820 }
821 
822 /*
823  *	Routine:	ipc_object_destroy_dest
824  *	Purpose:
825  *		Destroys a naked capability for the destination of
826  *		of a message. Consumes a ref for the object.
827  *
828  *	Conditions:
829  *		Nothing locked.
830  */
831 
832 void
ipc_object_destroy_dest(ipc_object_t object,mach_msg_type_name_t msgt_name)833 ipc_object_destroy_dest(
834 	ipc_object_t            object,
835 	mach_msg_type_name_t    msgt_name)
836 {
837 	ipc_port_t port = ip_object_to_port(object);
838 
839 	assert(IO_VALID(object));
840 	assert(io_otype(object) == IOT_PORT);
841 
842 	switch (msgt_name) {
843 	case MACH_MSG_TYPE_PORT_SEND:
844 		ipc_port_release_send(port);
845 		break;
846 
847 	case MACH_MSG_TYPE_PORT_SEND_ONCE:
848 		ip_mq_lock(port);
849 		ipc_notify_send_once_and_unlock(port);
850 		break;
851 
852 	default:
853 		panic("ipc_object_destroy_dest: strange rights");
854 	}
855 }
856 
857 /*
858  *	Routine:	ipc_object_insert_send_right
859  *	Purpose:
860  *		Insert a send right into an object already in the space.
861  *		The specified name must already point to a valid object.
862  *
863  *		Note: This really is a combined copyin()/copyout(),
864  *		that avoids most of the overhead of being implemented that way.
865  *
866  *		This is the fastpath for mach_port_insert_right.
867  *
868  *	Conditions:
869  *		Nothing locked.
870  *
871  *		msgt_name must be MACH_MSG_TYPE_MAKE_SEND_ONCE or
872  *		MACH_MSG_TYPE_MOVE_SEND_ONCE.
873  *
874  *	Returns:
875  *		KERN_SUCCESS		Copied out object, consumed ref.
876  *		KERN_INVALID_TASK	The space is dead.
877  *		KERN_INVALID_NAME	Name doesn't exist in space.
878  *		KERN_INVALID_CAPABILITY	The object is dead.
879  *		KERN_RIGHT_EXISTS	Space has rights under another name.
880  */
881 kern_return_t
ipc_object_insert_send_right(ipc_space_t space,mach_port_name_t name,mach_msg_type_name_t msgt_name)882 ipc_object_insert_send_right(
883 	ipc_space_t             space,
884 	mach_port_name_t        name,
885 	mach_msg_type_name_t    msgt_name)
886 {
887 	ipc_entry_bits_t bits;
888 	ipc_object_t object;
889 	ipc_entry_t entry;
890 	kern_return_t kr;
891 
892 	assert(msgt_name == MACH_MSG_TYPE_MAKE_SEND ||
893 	    msgt_name == MACH_MSG_TYPE_COPY_SEND);
894 
895 	kr = ipc_right_lookup_write(space, name, &entry);
896 	if (kr != KERN_SUCCESS) {
897 		return kr;
898 	}
899 	/* space is write-locked and active */
900 
901 	if (!IO_VALID(entry->ie_object)) {
902 		is_write_unlock(space);
903 		return KERN_INVALID_CAPABILITY;
904 	}
905 
906 	bits = entry->ie_bits;
907 	object = entry->ie_object;
908 
909 	io_lock(object);
910 	if (!io_active(object)) {
911 		kr = KERN_INVALID_CAPABILITY;
912 	} else if (msgt_name == MACH_MSG_TYPE_MAKE_SEND) {
913 		if (bits & MACH_PORT_TYPE_RECEIVE) {
914 			ipc_port_t port = ip_object_to_port(object);
915 			port->ip_mscount++;
916 			if ((bits & MACH_PORT_TYPE_SEND) == 0) {
917 				ip_srights_inc(port);
918 				bits |= MACH_PORT_TYPE_SEND;
919 			}
920 			/* leave urefs pegged to maximum if it overflowed */
921 			if (IE_BITS_UREFS(bits) < MACH_PORT_UREFS_MAX) {
922 				bits += 1; /* increment urefs */
923 			}
924 			entry->ie_bits = bits;
925 			ipc_entry_modified(space, name, entry);
926 			kr = KERN_SUCCESS;
927 		} else {
928 			kr = KERN_INVALID_RIGHT;
929 		}
930 	} else { // MACH_MSG_TYPE_COPY_SEND
931 		if (bits & MACH_PORT_TYPE_SEND) {
932 			/* leave urefs pegged to maximum if it overflowed */
933 			if (IE_BITS_UREFS(bits) < MACH_PORT_UREFS_MAX) {
934 				entry->ie_bits = bits + 1; /* increment urefs */
935 			}
936 			ipc_entry_modified(space, name, entry);
937 			kr = KERN_SUCCESS;
938 		} else {
939 			kr = KERN_INVALID_RIGHT;
940 		}
941 	}
942 
943 	io_unlock(object);
944 	is_write_unlock(space);
945 
946 	return kr;
947 }
948 
949 /*
950  *	Routine:	ipc_object_copyout
951  *	Purpose:
952  *		Copyout a capability, placing it into a space.
953  *		Always consumes a ref for the object.
954  *	Conditions:
955  *		Nothing locked.
956  *	Returns:
957  *		KERN_SUCCESS		Copied out object, consumed ref.
958  *		KERN_INVALID_TASK	The space is dead.
959  *		KERN_INVALID_CAPABILITY	The object is dead.
960  *		KERN_NO_SPACE		No room in space for another right.
961  *		KERN_UREFS_OVERFLOW	Urefs limit exceeded
962  *			and overflow wasn't specified.
963  */
964 
965 kern_return_t
ipc_object_copyout(ipc_space_t space,ipc_object_t object,mach_msg_type_name_t msgt_name,ipc_object_copyout_flags_t flags,mach_port_context_t * context,mach_msg_guard_flags_t * guard_flags,mach_port_name_t * namep)966 ipc_object_copyout(
967 	ipc_space_t             space,
968 	ipc_object_t            object,
969 	mach_msg_type_name_t    msgt_name,
970 	ipc_object_copyout_flags_t flags,
971 	mach_port_context_t     *context,
972 	mach_msg_guard_flags_t  *guard_flags,
973 	mach_port_name_t        *namep)
974 {
975 	struct knote *kn = current_thread()->ith_knote;
976 	mach_port_name_t name;
977 	ipc_port_t port = ip_object_to_port(object);
978 	ipc_entry_t entry;
979 	kern_return_t kr;
980 
981 	assert(IO_VALID(object));
982 	assert(io_otype(object) == IOT_PORT);
983 
984 	if (ITH_KNOTE_VALID(kn, msgt_name)) {
985 		filt_machport_turnstile_prepare_lazily(kn, msgt_name, port);
986 	}
987 
988 	is_write_lock(space);
989 
990 	for (;;) {
991 		ipc_port_t port_subst = IP_NULL;
992 
993 		if (!is_active(space)) {
994 			is_write_unlock(space);
995 			kr = KERN_INVALID_TASK;
996 			goto out;
997 		}
998 
999 		kr = ipc_entries_hold(space, 1);
1000 		if (kr != KERN_SUCCESS) {
1001 			/* unlocks/locks space, so must start again */
1002 
1003 			kr = ipc_entry_grow_table(space, ITS_SIZE_NONE);
1004 			if (kr != KERN_SUCCESS) {
1005 				/* space is unlocked */
1006 				goto out;
1007 			}
1008 			continue;
1009 		}
1010 
1011 		io_lock(object);
1012 		if (!io_active(object)) {
1013 			io_unlock(object);
1014 			is_write_unlock(space);
1015 			kr = KERN_INVALID_CAPABILITY;
1016 			goto out;
1017 		}
1018 
1019 		/* Don't actually copyout rights we aren't allowed to */
1020 		if (!ip_label_check(space, port, msgt_name, &flags, &port_subst)) {
1021 			io_unlock(object);
1022 			is_write_unlock(space);
1023 			assert(port_subst == IP_NULL);
1024 			kr = KERN_INVALID_CAPABILITY;
1025 			goto out;
1026 		}
1027 
1028 		/* is the kolabel requesting a substitution */
1029 		if (port_subst != IP_NULL) {
1030 			/*
1031 			 * port is unlocked, its right consumed
1032 			 * space is unlocked
1033 			 */
1034 			assert(msgt_name == MACH_MSG_TYPE_PORT_SEND);
1035 			port = port_subst;
1036 			if (!IP_VALID(port)) {
1037 				object = IO_DEAD;
1038 				kr = KERN_INVALID_CAPABILITY;
1039 				goto out;
1040 			}
1041 
1042 			object = ip_to_object(port);
1043 			is_write_lock(space);
1044 			continue;
1045 		}
1046 
1047 		break;
1048 	}
1049 
1050 	/* space is write-locked and active, object is locked and active */
1051 
1052 	if ((msgt_name != MACH_MSG_TYPE_PORT_SEND_ONCE) &&
1053 	    ipc_right_reverse(space, object, &name, &entry)) {
1054 		assert(entry->ie_bits & MACH_PORT_TYPE_SEND_RECEIVE);
1055 	} else {
1056 		ipc_entry_claim(space, object, &name, &entry);
1057 	}
1058 
1059 	kr = ipc_right_copyout(space, name, entry,
1060 	    msgt_name, flags, context, guard_flags, object);
1061 
1062 	/* object is unlocked */
1063 	is_write_unlock(space);
1064 
1065 out:
1066 	if (kr == KERN_SUCCESS) {
1067 		*namep = name;
1068 	} else if (IO_VALID(object)) {
1069 		ipc_object_destroy(object, msgt_name);
1070 	}
1071 
1072 	return kr;
1073 }
1074 
1075 /*
1076  *	Routine:	ipc_object_copyout_name
1077  *	Purpose:
1078  *		Copyout a capability, placing it into a space.
1079  *		The specified name is used for the capability.
1080  *		If successful, consumes a ref for the object.
1081  *	Conditions:
1082  *		Nothing locked.
1083  *	Returns:
1084  *		KERN_SUCCESS		Copied out object, consumed ref.
1085  *		KERN_INVALID_TASK	The space is dead.
1086  *		KERN_INVALID_CAPABILITY	The object is dead.
1087  *		KERN_UREFS_OVERFLOW	Urefs limit exceeded
1088  *			and overflow wasn't specified.
1089  *		KERN_RIGHT_EXISTS	Space has rights under another name.
1090  *		KERN_NAME_EXISTS	Name is already used.
1091  *      KERN_INVALID_VALUE  Supplied port name is invalid.
1092  */
1093 
1094 kern_return_t
ipc_object_copyout_name(ipc_space_t space,ipc_object_t object,mach_msg_type_name_t msgt_name,mach_port_name_t name)1095 ipc_object_copyout_name(
1096 	ipc_space_t             space,
1097 	ipc_object_t            object,
1098 	mach_msg_type_name_t    msgt_name,
1099 	mach_port_name_t        name)
1100 {
1101 	ipc_port_t port = ip_object_to_port(object);
1102 	mach_port_name_t oname;
1103 	ipc_entry_t oentry;
1104 	ipc_entry_t entry;
1105 	kern_return_t kr;
1106 
1107 #if IMPORTANCE_INHERITANCE
1108 	int assertcnt = 0;
1109 	ipc_importance_task_t task_imp = IIT_NULL;
1110 #endif /* IMPORTANCE_INHERITANCE */
1111 
1112 	assert(IO_VALID(object));
1113 	assert(io_otype(object) == IOT_PORT);
1114 
1115 	kr = ipc_entry_alloc_name(space, name, &entry);
1116 	if (kr != KERN_SUCCESS) {
1117 		return kr;
1118 	}
1119 	/* space is write-locked and active */
1120 
1121 	io_lock(object);
1122 
1123 	/*
1124 	 * Don't actually copyout rights we aren't allowed to
1125 	 *
1126 	 * In particular, kolabel-ed objects do not allow callers
1127 	 * to pick the name they end up with.
1128 	 */
1129 	if (!io_active(object) || ip_is_kolabeled(port)) {
1130 		io_unlock(object);
1131 		if (!ipc_right_inuse(entry)) {
1132 			ipc_entry_dealloc(space, IO_NULL, name, entry);
1133 		}
1134 		is_write_unlock(space);
1135 		return KERN_INVALID_CAPABILITY;
1136 	}
1137 
1138 	/* space is write-locked and active, object is locked and active */
1139 
1140 	if ((msgt_name != MACH_MSG_TYPE_PORT_SEND_ONCE) &&
1141 	    ipc_right_reverse(space, object, &oname, &oentry)) {
1142 		if (name != oname) {
1143 			io_unlock(object);
1144 			if (!ipc_right_inuse(entry)) {
1145 				ipc_entry_dealloc(space, IO_NULL, name, entry);
1146 			}
1147 			is_write_unlock(space);
1148 			return KERN_RIGHT_EXISTS;
1149 		}
1150 
1151 		assert(entry == oentry);
1152 		assert(entry->ie_bits & MACH_PORT_TYPE_SEND_RECEIVE);
1153 	} else if (ipc_right_inuse(entry)) {
1154 		io_unlock(object);
1155 		is_write_unlock(space);
1156 		return KERN_NAME_EXISTS;
1157 	} else {
1158 		assert(entry->ie_object == IO_NULL);
1159 
1160 		entry->ie_object = object;
1161 	}
1162 
1163 #if IMPORTANCE_INHERITANCE
1164 	/*
1165 	 * We are slamming a receive right into the space, without
1166 	 * first having been enqueued on a port destined there.  So,
1167 	 * we have to arrange to boost the task appropriately if this
1168 	 * port has assertions (and the task wants them).
1169 	 */
1170 	if (msgt_name == MACH_MSG_TYPE_PORT_RECEIVE) {
1171 		if (space->is_task != TASK_NULL) {
1172 			task_imp = space->is_task->task_imp_base;
1173 			if (ipc_importance_task_is_any_receiver_type(task_imp)) {
1174 				assertcnt = port->ip_impcount;
1175 				ipc_importance_task_reference(task_imp);
1176 			} else {
1177 				task_imp = IIT_NULL;
1178 			}
1179 		}
1180 
1181 		/* take port out of limbo */
1182 		port->ip_tempowner = 0;
1183 	}
1184 
1185 #endif /* IMPORTANCE_INHERITANCE */
1186 
1187 	kr = ipc_right_copyout(space, name, entry,
1188 	    msgt_name, IPC_OBJECT_COPYOUT_FLAGS_NONE, NULL, NULL, object);
1189 
1190 	/* object is unlocked */
1191 	is_write_unlock(space);
1192 
1193 #if IMPORTANCE_INHERITANCE
1194 	/*
1195 	 * Add the assertions to the task that we captured before
1196 	 */
1197 	if (task_imp != IIT_NULL) {
1198 		ipc_importance_task_hold_internal_assertion(task_imp, assertcnt);
1199 		ipc_importance_task_release(task_imp);
1200 	}
1201 #endif /* IMPORTANCE_INHERITANCE */
1202 
1203 	return kr;
1204 }
1205 
1206 /*
1207  *	Routine:	ipc_object_copyout_dest
1208  *	Purpose:
1209  *		Translates/consumes the destination right of a message.
1210  *		This is unlike normal copyout because the right is consumed
1211  *		in a funny way instead of being given to the receiving space.
1212  *		The receiver gets his name for the port, if he has receive
1213  *		rights, otherwise MACH_PORT_NULL.
1214  *	Conditions:
1215  *		The object is locked and active.  Nothing else locked.
1216  *		The object is unlocked and loses a reference.
1217  */
1218 
1219 void
ipc_object_copyout_dest(ipc_space_t space,ipc_object_t object,mach_msg_type_name_t msgt_name,mach_port_name_t * namep)1220 ipc_object_copyout_dest(
1221 	ipc_space_t             space,
1222 	ipc_object_t            object,
1223 	mach_msg_type_name_t    msgt_name,
1224 	mach_port_name_t        *namep)
1225 {
1226 	mach_port_name_t name;
1227 
1228 	assert(IO_VALID(object));
1229 	assert(io_active(object));
1230 
1231 	/*
1232 	 *	If the space is the receiver/owner of the object,
1233 	 *	then we quietly consume the right and return
1234 	 *	the space's name for the object.  Otherwise
1235 	 *	we destroy the right and return MACH_PORT_NULL.
1236 	 */
1237 
1238 	switch (msgt_name) {
1239 	case MACH_MSG_TYPE_PORT_SEND: {
1240 		ipc_port_t port = ip_object_to_port(object);
1241 		ipc_notify_nsenders_t nsrequest = { };
1242 
1243 		if (ip_in_space(port, space)) {
1244 			name = ip_get_receiver_name(port);
1245 		} else {
1246 			name = MACH_PORT_NULL;
1247 		}
1248 		ip_srights_dec(port);
1249 		if (port->ip_srights == 0) {
1250 			nsrequest = ipc_notify_no_senders_prepare(port);
1251 		}
1252 		ipc_port_clear_sync_rcv_thread_boost_locked(port);
1253 		/* port unlocked */
1254 
1255 		ipc_notify_no_senders_emit(nsrequest);
1256 
1257 		ip_release(port);
1258 		break;
1259 	}
1260 
1261 	case MACH_MSG_TYPE_PORT_SEND_ONCE: {
1262 		ipc_port_t port = ip_object_to_port(object);
1263 
1264 		assert(port->ip_sorights > 0);
1265 
1266 		if (ip_in_space(port, space)) {
1267 			/* quietly consume the send-once right */
1268 			ip_sorights_dec(port);
1269 			name = ip_get_receiver_name(port);
1270 			ipc_port_clear_sync_rcv_thread_boost_locked(port);
1271 			/* port unlocked */
1272 			ip_release(port);
1273 		} else {
1274 			/*
1275 			 *	A very bizarre case.  The message
1276 			 *	was received, but before this copyout
1277 			 *	happened the space lost receive rights.
1278 			 *	We can't quietly consume the soright
1279 			 *	out from underneath some other task,
1280 			 *	so generate a send-once notification.
1281 			 */
1282 
1283 			ipc_notify_send_once_and_unlock(port);
1284 			name = MACH_PORT_NULL;
1285 		}
1286 
1287 		break;
1288 	}
1289 
1290 	default:
1291 		panic("ipc_object_copyout_dest: strange rights");
1292 		name = MACH_PORT_DEAD;
1293 	}
1294 
1295 	*namep = name;
1296 }
1297 
1298 static_assert(offsetof(struct ipc_object_waitq, iowq_waitq) ==
1299     offsetof(struct ipc_port, ip_waitq));
1300 static_assert(offsetof(struct ipc_object_waitq, iowq_waitq) ==
1301     offsetof(struct ipc_pset, ips_wqset));
1302 
1303 /*
1304  *	Routine:        ipc_object_lock
1305  *	Purpose:
1306  *		Validate, then acquire a lock on an ipc object
1307  */
1308 void
ipc_object_lock(ipc_object_t io)1309 ipc_object_lock(ipc_object_t io)
1310 {
1311 	ipc_object_validate(io);
1312 	waitq_lock(io_waitq(io));
1313 }
1314 
1315 __abortlike
1316 static void
ipc_object_validate_preflight_panic(ipc_object_t io)1317 ipc_object_validate_preflight_panic(ipc_object_t io)
1318 {
1319 	panic("ipc object %p is neither a port or a port-set", io);
1320 }
1321 
1322 /*
1323  *	Routine:	ipc_object_lock_allow_invalid
1324  *	Purpose:
1325  *		Speculatively try to lock an object in an undefined state.
1326  *
1327  *		This relies on the fact that IPC object memory is allocated
1328  *		from sequestered zones, so at a given address, one can find:
1329  *		1. a valid object,
1330  *		2. a freed or invalid (uninitialized) object,
1331  *		3. unmapped memory.
1332  *
1333  *		(2) is possible because the zone is made with ZC_ZFREE_CLEARMEM which
1334  *		    ensures freed elements are always zeroed.
1335  *
1336  *		(3) is a direct courtesy of waitq_lock_allow_invalid().
1337  *
1338  *		In order to disambiguate (1) from (2), we use the "waitq valid"
1339  *		bit which is part of the lock. When that bit is absent,
1340  *		waitq_lock() will function as expected, but
1341  *		waitq_lock_allow_invalid() will not.
1342  *
1343  *		Objects are then initialized and destroyed carefully so that
1344  *		this "valid bit" is only set when the object invariants are
1345  *		respected.
1346  *
1347  *	Returns:
1348  *		true:  the lock was acquired
1349  *		false: the object was freed or not initialized.
1350  */
1351 bool
ipc_object_lock_allow_invalid(ipc_object_t orig_io)1352 ipc_object_lock_allow_invalid(ipc_object_t orig_io)
1353 {
1354 	struct waitq *orig_wq = io_waitq(orig_io);
1355 	struct waitq *wq = pgz_decode_allow_invalid(orig_wq, ZONE_ID_ANY);
1356 
1357 	switch (zone_id_for_element(wq, sizeof(*wq))) {
1358 	case ZONE_ID_IPC_PORT:
1359 	case ZONE_ID_IPC_PORT_SET:
1360 		break;
1361 	default:
1362 #if CONFIG_PROB_GZALLOC
1363 		if (orig_wq != wq) {
1364 			/*
1365 			 * The element was PGZ protected, and the translation
1366 			 * returned another type than port or port-set, or
1367 			 * ZONE_ID_INVALID (wq is NULL).
1368 			 *
1369 			 * We have to allow this skew, and assumed the slot
1370 			 * has held a now freed port/port-set.
1371 			 */
1372 			return false;
1373 		}
1374 #endif /* CONFIG_PROB_GZALLOC */
1375 		ipc_object_validate_preflight_panic(orig_io);
1376 	}
1377 
1378 	if (__probable(waitq_lock_allow_invalid(wq))) {
1379 		ipc_object_validate(io_from_waitq(wq));
1380 #if CONFIG_PROB_GZALLOC
1381 		if (__improbable(wq != orig_wq &&
1382 		    wq != pgz_decode_allow_invalid(orig_wq, ZONE_ID_ANY))) {
1383 			/*
1384 			 * This object is no longer held in the slot,
1385 			 * whatever this object is, it's not the droid
1386 			 * we're looking for. Pretend we failed the lock.
1387 			 */
1388 			waitq_unlock(wq);
1389 			return false;
1390 		}
1391 #endif /* CONFIG_PROB_GZALLOC */
1392 		return true;
1393 	}
1394 	return false;
1395 }
1396 
1397 /*
1398  *	Routine:	ipc_object_lock_try
1399  *	Purpose:
1400  *		Validate, then try to acquire a lock on an object,
1401  *		fail if there is an existing busy lock
1402  */
1403 bool
ipc_object_lock_try(ipc_object_t io)1404 ipc_object_lock_try(ipc_object_t io)
1405 {
1406 	ipc_object_validate(io);
1407 	return waitq_lock_try(io_waitq(io));
1408 }
1409 
1410 /*
1411  *	Routine:        ipc_object_unlock
1412  *	Purpose:
1413  *	    Unlocks the given object.
1414  */
1415 void
ipc_object_unlock(ipc_object_t io)1416 ipc_object_unlock(ipc_object_t io)
1417 {
1418 	waitq_unlock(io_waitq(io));
1419 }
1420