1 /*
2 * Copyright (c) 2000-2016 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * @OSF_COPYRIGHT@
30 */
31 /*
32 * Mach Operating System
33 * Copyright (c) 1991,1990,1989 Carnegie Mellon University
34 * All Rights Reserved.
35 *
36 * Permission to use, copy, modify and distribute this software and its
37 * documentation is hereby granted, provided that both the copyright
38 * notice and this permission notice appear in all copies of the
39 * software, derivative works or modified versions, and any portions
40 * thereof, and that both notices appear in supporting documentation.
41 *
42 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
45 *
46 * Carnegie Mellon requests users of this software to return to
47 *
48 * Software Distribution Coordinator or [email protected]
49 * School of Computer Science
50 * Carnegie Mellon University
51 * Pittsburgh PA 15213-3890
52 *
53 * any improvements or extensions that they make and grant Carnegie Mellon
54 * the rights to redistribute these changes.
55 */
56 /*
57 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
58 * support for mandatory and extensible security protections. This notice
59 * is included in support of clause 2.2 (b) of the Apple Public License,
60 * Version 2.0.
61 */
62 /*
63 */
64 /*
65 * File: ipc/ipc_port.h
66 * Author: Rich Draves
67 * Date: 1989
68 *
69 * Definitions for ports.
70 */
71
72 #ifndef _IPC_IPC_PORT_H_
73 #define _IPC_IPC_PORT_H_
74
75 #ifdef MACH_KERNEL_PRIVATE
76
77 #include <mach_assert.h>
78
79 #include <mach/mach_types.h>
80 #include <mach/boolean.h>
81 #include <mach/kern_return.h>
82 #include <mach/port.h>
83
84 #include <kern/assert.h>
85 #include <kern/kern_types.h>
86 #include <kern/turnstile.h>
87
88 #include <ipc/ipc_types.h>
89 #include <ipc/ipc_object.h>
90 #include <ipc/ipc_mqueue.h>
91 #include <ipc/ipc_space.h>
92
93 #include <security/_label.h>
94
95 #include <ptrauth.h>
96
97 extern int proc_isinitproc(struct proc *p);
98
99 struct task_watchport_elem;
100
101 typedef unsigned int ipc_port_timestamp_t;
102
103 struct ipc_port_request {
104 union {
105 struct ipc_port *ipr_soright;
106 struct host_notify_entry *XNU_PTRAUTH_SIGNED_PTR("ipc_port_request.ipr_hnotify") ipr_hnotify;
107 struct ipc_port_request *XNU_PTRAUTH_SIGNED_PTR("ipc_port_request.ipr_hn_slot") ipr_hn_slot;
108 };
109
110 union {
111 #define IPR_HOST_NOTIFY 0xfffffffeu
112 mach_port_name_t ipr_name;
113 ipc_port_request_index_t ipr_next;
114 };
115 };
116
117 KALLOC_ARRAY_TYPE_DECL(ipc_port_request_table, struct ipc_port_request);
118
119 struct ipc_port {
120 struct ipc_object ip_object;
121 union {
122 /*
123 * The waitq_eventmask field is only used on the global queues.
124 * We hence repurpose all those bits for our own use.
125 *
126 * Note: if too many bits are added, compilation will fail
127 * with errors about "negative bitfield sizes"
128 */
129 WAITQ_FLAGS(ip_waitq
130 , ip_fullwaiters:1 /* Whether there are senders blocked on a full queue */
131 , ip_sprequests:1 /* send-possible requests outstanding */
132 , ip_spimportant:1 /* ... at least one is importance donating */
133 , ip_impdonation:1 /* port supports importance donation */
134 , ip_tempowner:1 /* dont give donations to current receiver */
135 , ip_guarded:1 /* port guarded (use context value as guard) */
136 , ip_strict_guard:1 /* Strict guarding; Prevents user manipulation of context values directly */
137 , ip_specialreply:1 /* port is a special reply port */
138 , ip_sync_link_state:3 /* link the port to destination port/ Workloop */
139 , ip_sync_bootstrap_checkin:1 /* port part of sync bootstrap checkin, push on thread doing the checkin */
140 , ip_immovable_receive:1 /* the receive right cannot be moved out of a space, until it is destroyed */
141 , ip_immovable_send:1 /* No send(once) rights to this port can be moved out of a space, never unset */
142 , ip_no_grant:1 /* Port wont accept complex messages containing (ool) port descriptors */
143 , ip_tg_block_tracking:1 /* Track blocking relationship between thread groups during sync IPC */
144 , ip_pinned:1 /* Can't deallocate the last send right from a space while the bit is set */
145 , ip_service_port:1 /* port is a service port */
146 , ip_has_watchport:1 /* port has an exec watchport */
147 , ip_kernel_iotier_override:2 /* kernel iotier override */
148 , ip_kernel_qos_override:3 /* kernel qos override */
149 , ip_reply_port_semantics:3 /* reply port defense in depth type */
150 );
151 struct waitq ip_waitq;
152 };
153
154 struct ipc_mqueue ip_messages;
155
156 /*
157 * IMPORTANT: Direct access of unionized fields are highly discouraged.
158 * Use accessor functions below and see header doc for possible states.
159 */
160 union {
161 struct ipc_space *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_receiver") ip_receiver;
162 struct ipc_port *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_destination") ip_destination;
163 ipc_port_timestamp_t ip_timestamp;
164 };
165
166 /* update ipc_kobject_upgrade_locked() if this union is changed */
167 union {
168 uintptr_t ip_kobject; /* manually PAC-ed, see ipc_kobject_get_raw() */
169 ipc_importance_task_t ip_imp_task; /* use accessor ip_get_imp_task() */
170 struct ipc_port *ip_sync_inheritor_port;
171 struct knote *ip_sync_inheritor_knote;
172 struct turnstile *ip_sync_inheritor_ts;
173 };
174
175 /*
176 * ip_specialreply: ip_pid
177 * ip_has_watchport: ip_twe
178 * else: ip_pdrequest
179 */
180 union {
181 int ip_pid;
182 struct task_watchport_elem *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_twe") ip_twe;
183 struct ipc_port *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_pdrequest") ip_pdrequest;
184 };
185
186 #define IP_KOBJECT_NSREQUEST_ARMED ((struct ipc_port *)1)
187 struct ipc_port *ip_nsrequest;
188 ipc_port_request_table_t XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_request") ip_requests;
189 struct turnstile *ip_send_turnstile;
190 mach_vm_address_t ip_context;
191
192 #if DEVELOPMENT || DEBUG
193 natural_t ip_srp_lost_link : 1; /* special reply port turnstile link chain broken */
194 natural_t ip_srp_msg_sent : 1; /* special reply port msg sent */
195 natural_t ip_impcount : 30; /* number of importance donations in nested queue */
196 #else
197 natural_t ip_impcount; /* number of importance donations in nested queue */
198 #endif
199 mach_port_mscount_t ip_mscount;
200 mach_port_rights_t ip_srights;
201 mach_port_rights_t ip_sorights;
202
203 union {
204 ipc_kobject_label_t XNU_PTRAUTH_SIGNED_PTR("ipc_port.kolabel") ip_kolabel;
205 /* Union of service and connection ports' message filtering metadata */
206 void * XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_splabel") ip_splabel;
207 };
208
209 #if MACH_ASSERT
210 unsigned long ip_timetrack; /* give an idea of "when" created */
211 uint32_t ip_made_bt; /* stack trace (btref_t) */
212 uint32_t ip_made_pid; /* for debugging */
213 #endif /* MACH_ASSERT */
214 };
215
216 static inline bool
ip_in_pset(ipc_port_t port)217 ip_in_pset(ipc_port_t port)
218 {
219 return !circle_queue_empty(&port->ip_waitq.waitq_links);
220 }
221
222 #define ip_receiver_name ip_messages.imq_receiver_name
223 #define ip_reply_context ip_messages.imq_context
224 #define ip_klist ip_messages.imq_klist
225
226 #define port_send_turnstile(port) \
227 ((port)->ip_send_turnstile)
228
229 #define set_port_send_turnstile(port, value) \
230 MACRO_BEGIN \
231 (port)->ip_send_turnstile = (value); \
232 MACRO_END
233
234 #define port_send_turnstile_address(port) \
235 (&((port)->ip_send_turnstile))
236
237 #define port_rcv_turnstile_address(port) (&(port)->ip_waitq.waitq_ts)
238
239 extern void __ipc_right_delta_overflow_panic(
240 ipc_port_t port,
241 natural_t *field,
242 int delta) __abortlike;
243
244 #define ip_right_delta(port, field, delta) ({ \
245 ipc_port_t __port = (port); \
246 if (os_add_overflow(__port->field, delta, &__port->field)) { \
247 __ipc_right_delta_overflow_panic(__port, &__port->field, delta); \
248 } \
249 })
250
251 #define ip_srights_inc(port) ip_right_delta(port, ip_srights, 1)
252 #define ip_srights_dec(port) ip_right_delta(port, ip_srights, -1)
253 #define ip_sorights_inc(port) ip_right_delta(port, ip_sorights, 1)
254 #define ip_sorights_dec(port) ip_right_delta(port, ip_sorights, -1)
255
256 /*
257 * SYNC IPC state flags for special reply port/ rcv right.
258 *
259 * PORT_SYNC_LINK_ANY
260 * Special reply port is not linked to any other port
261 * or WL and linkage should be allowed.
262 *
263 * PORT_SYNC_LINK_PORT
264 * Special reply port is linked to the port and
265 * ip_sync_inheritor_port contains the inheritor
266 * port.
267 *
268 * PORT_SYNC_LINK_WORKLOOP_KNOTE
269 * Special reply port is linked to a WL (via a knote).
270 * ip_sync_inheritor_knote contains a pointer to the knote
271 * the port is stashed on.
272 *
273 * PORT_SYNC_LINK_WORKLOOP_STASH
274 * Special reply port is linked to a WL (via a knote stash).
275 * ip_sync_inheritor_ts contains a pointer to the turnstile with a +1
276 * the port is stashed on.
277 *
278 * PORT_SYNC_LINK_NO_LINKAGE
279 * Message sent to special reply port, do
280 * not allow any linkages till receive is
281 * complete.
282 *
283 * PORT_SYNC_LINK_RCV_THREAD
284 * Receive right copied out as a part of bootstrap check in,
285 * push on the thread which copied out the port.
286 */
287 #define PORT_SYNC_LINK_ANY (0)
288 #define PORT_SYNC_LINK_PORT (0x1)
289 #define PORT_SYNC_LINK_WORKLOOP_KNOTE (0x2)
290 #define PORT_SYNC_LINK_WORKLOOP_STASH (0x3)
291 #define PORT_SYNC_LINK_NO_LINKAGE (0x4)
292 #define PORT_SYNC_LINK_RCV_THREAD (0x5)
293
294 #define IP_NULL IPC_PORT_NULL
295 #define IP_DEAD IPC_PORT_DEAD
296 #define IP_VALID(port) IPC_PORT_VALID(port)
297
298 #define ip_object_to_port(io) __container_of(io, struct ipc_port, ip_object)
299 #define ip_to_object(port) (&(port)->ip_object)
300 #define ip_active(port) io_active(ip_to_object(port))
301 #define ip_mq_lock_held(port) io_lock_held(ip_to_object(port))
302 #define ip_mq_lock(port) ipc_object_lock(ip_to_object(port), IOT_PORT)
303 #define ip_mq_lock_check_aligned(port) ipc_object_lock_check_aligned(ip_to_object(port), IOT_PORT)
304 #define ip_mq_lock_try(port) ipc_object_lock_try(ip_to_object(port), IOT_PORT)
305 #define ip_mq_lock_held_kdp(port) io_lock_held_kdp(ip_to_object(port))
306 #define ip_mq_unlock(port) io_unlock(ip_to_object(port))
307
308 #define ip_reference(port) io_reference(ip_to_object(port))
309 #define ip_release(port) io_release(ip_to_object(port))
310 #define ip_release_safe(port) io_release_safe(ip_to_object(port))
311 #define ip_release_live(port) io_release_live(ip_to_object(port))
312 #define ip_validate(port) \
313 zone_id_require(ZONE_ID_IPC_PORT, sizeof(struct ipc_port), port)
314 #define ip_validate_aligned(port) \
315 zone_id_require_aligned(ZONE_ID_IPC_PORT, port)
316
317 #define ip_from_waitq(wq) __container_of(wq, struct ipc_port, ip_waitq)
318 #define ip_from_mq(mq) __container_of(mq, struct ipc_port, ip_messages)
319
320 #define ip_kotype(port) io_kotype(ip_to_object(port))
321 #define ip_is_kobject(port) io_is_kobject(ip_to_object(port))
322 #define ip_is_control(port) \
323 (ip_kotype(port) == IKOT_TASK_CONTROL || ip_kotype(port) == IKOT_THREAD_CONTROL)
324 #define ip_is_kolabeled(port) io_is_kolabeled(ip_to_object(port))
325
326 #define ip_full_kernel(port) imq_full_kernel(&(port)->ip_messages)
327 #define ip_full(port) imq_full(&(port)->ip_messages)
328
329 /*
330 * IPC Port flags for reply port defense in depth
331 *
332 * PORT_MARK_REPLY_PORT
333 * Port is marked as a reply port.
334 *
335 * PORT_ENFORCE_REPLY_PORT_SEMANTICS
336 * When talking to this port, the local port of mach msg needs to be a reply port.
337 * Currrently service ports and libxpc connection ports adopt this.
338 *
339 * PORT_MARK_PROVISIONAL_REPLY_PORT
340 * Port is marked as a provisional reply port with an eventual goal of making it port as PORT_MARK_REPLY_PORT.
341 *
342 * PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS
343 * Same as PORT_ENFORCE_REPLY_PORT_SEMANTICS above, but does not allow for provisional reply ports.
344 * Once provisional reply ports no longer exist, this will be removed as "rigidness/strictness" will be irrelavant.
345 *
346 * PORT_MARK_EXCEPTION_PORT
347 * Port is used as a mach exception port. It has an immovable receive right and can be used in the
348 * hardened exception flow provided by `task_register_hardened_exception_handler`
349 */
350 #define PORT_MARK_REPLY_PORT 0x01
351 #define PORT_ENFORCE_REPLY_PORT_SEMANTICS 0x02
352 #define PORT_MARK_PROVISIONAL_REPLY_PORT 0x03
353 #define PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS 0x04
354 #define PORT_MARK_EXCEPTION_PORT 0x05
355
356 /* ip_reply_port_semantics can be read without a lock as it is never unset after port creation. */
357 #define ip_is_reply_port(port) (((port)->ip_reply_port_semantics) == PORT_MARK_REPLY_PORT)
358 #define ip_require_reply_port_semantics(port) (((port)->ip_reply_port_semantics) == PORT_ENFORCE_REPLY_PORT_SEMANTICS)
359 #define ip_is_provisional_reply_port(port) (((port)->ip_reply_port_semantics) == PORT_MARK_PROVISIONAL_REPLY_PORT)
360 #define ip_require_rigid_reply_port_semantics(port) (((port)->ip_reply_port_semantics) == PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS)
361 #define ip_is_exception_port(port) (((port)->ip_reply_port_semantics) == PORT_MARK_EXCEPTION_PORT)
362
363 #define ip_mark_reply_port(port) ((port)->ip_reply_port_semantics = PORT_MARK_REPLY_PORT)
364 #define ip_enforce_reply_port_semantics(port) ((port)->ip_reply_port_semantics = PORT_ENFORCE_REPLY_PORT_SEMANTICS)
365 #define ip_mark_provisional_reply_port(port) ((port)->ip_reply_port_semantics = PORT_MARK_PROVISIONAL_REPLY_PORT)
366 #define ip_enforce_rigid_reply_port_semantics(port) ((port)->ip_reply_port_semantics = PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS)
367 #define ip_mark_exception_port(port) ((port)->ip_reply_port_semantics = PORT_MARK_EXCEPTION_PORT)
368
369 #define ip_is_immovable_send(port) ((port)->ip_immovable_send)
370 #define ip_is_pinned(port) ((port)->ip_pinned)
371
372 #define ip_is_libxpc_connection_port(port) \
373 (!ip_is_kolabeled(port) && (!(port)->ip_service_port) && ((port)->ip_splabel != NULL))
374
375 extern bool ip_violates_rigid_reply_port_semantics(ipc_port_t dest_port, ipc_port_t reply_port,
376 int *reply_port_semantics_violation);
377
378 extern bool ip_violates_reply_port_semantics(ipc_port_t dest_port, ipc_port_t reply_port,
379 int *reply_port_semantics_violation);
380
381 /* Rigid Reply Port and Move Reply Port violators */
382 #define REPLY_PORT_SEMANTICS_VIOLATOR 1 /* normal reply port semantics violator */
383 #define RRP_HARDENED_RUNTIME_VIOLATOR 2
384 #define MRP_HARDENED_RUNTIME_VIOLATOR 3
385 #define MRP_3P_VIOLATOR 4
386 #define RRP_3P_VIOLATOR 5
387
388 /* Bits reserved in IO_BITS_PORT_INFO are defined here */
389
390 /*
391 * This flag indicates that the port has opted into message filtering based
392 * on a policy defined in the Sandbox.
393 */
394 #define IP_BIT_FILTER_MSG 0x00001000
395 #define ip_enforce_msg_filtering(port) ((io_bits(ip_to_object(port)) & IP_BIT_FILTER_MSG) != 0)
396
397 /*
398 * Use the low bits in the ipr_soright to specify the request type
399 */
400 __enum_decl(ipc_port_request_opts_t, uintptr_t, {
401 IPR_SOR_SPARM_MASK = 0x01, /* send-possible armed */
402 IPR_SOR_SPREQ_MASK = 0x02, /* send-possible requested */
403 });
404 #define IPR_SOR_SPBIT_MASK 3 /* combo */
405 #define IPR_SOR_SPARMED(sor) (((uintptr_t)(sor) & IPR_SOR_SPARM_MASK) != 0)
406 #define IPR_SOR_SPREQ(sor) (((uintptr_t)(sor) & IPR_SOR_SPREQ_MASK) != 0)
407 #define IPR_SOR_PORT(sor) ((ipc_port_t)((uintptr_t)(sor) & ~IPR_SOR_SPBIT_MASK))
408 #define IPR_SOR_MAKE(p, m) ((ipc_port_t)((uintptr_t)(p) | (m)))
409
410 extern lck_grp_t ipc_lck_grp;
411 extern lck_attr_t ipc_lck_attr;
412
413 /*
414 * Taking the ipc_port_multiple lock grants the privilege
415 * to lock multiple ports at once. No ports must locked
416 * when it is taken.
417 */
418
419 extern lck_spin_t ipc_port_multiple_lock_data;
420
421 #define ipc_port_multiple_lock() \
422 lck_spin_lock_grp(&ipc_port_multiple_lock_data, &ipc_lck_grp)
423
424 #define ipc_port_multiple_unlock() \
425 lck_spin_unlock(&ipc_port_multiple_lock_data)
426
427 /*
428 * Search for the end of the chain (a port not in transit),
429 * acquiring locks along the way.
430 */
431 extern boolean_t ipc_port_destination_chain_lock(
432 ipc_port_t port,
433 ipc_port_t *base);
434
435 /*
436 * The port timestamp facility provides timestamps
437 * for port destruction. It is used to serialize
438 * mach_port_names with port death.
439 */
440
441 extern ipc_port_timestamp_t ipc_port_timestamp_data;
442
443 /* Retrieve a port timestamp value */
444 extern ipc_port_timestamp_t ipc_port_timestamp(void);
445
446 /*
447 * Compares two timestamps, and returns TRUE if one
448 * happened before two. Note that this formulation
449 * works when the timestamp wraps around at 2^32,
450 * as long as one and two aren't too far apart.
451 */
452
453 #define IP_TIMESTAMP_ORDER(one, two) ((int) ((one) - (two)) < 0)
454
455 extern void __abortlike __ipc_port_inactive_panic(ipc_port_t port);
456
457 static inline void
require_ip_active(ipc_port_t port)458 require_ip_active(ipc_port_t port)
459 {
460 if (!ip_active(port)) {
461 __ipc_port_inactive_panic(port);
462 }
463 }
464
465 /*
466 * A receive right (port) can be in ONE of the following four states:
467 *
468 * 1) INACTIVE: Dead
469 * 2) IN-SPACE: In a space
470 * 3) IN-TRANSIT: Enqueued in a message
471 * 4) IN-LIMBO
472 *
473 * If the port is active and ip_receiver_name != MACH_PORT_NULL, we can safely
474 * deference the union as ip_receiver, which points to the space that holds
475 * receive right (but doesn't hold a ref for it).
476 *
477 * If the port is active and ip_receiver_name == MACH_PORT_NULL, we can safely
478 * deference the union as ip_destination. The port is either IN-LIMBO (ip_destination == IP_NULL)
479 * or ip_destination points to the destination port and holds a ref for it.
480 *
481 * If the port is not active, we can safely deference the union as ip_timestamp,
482 * which contains a timestamp taken when the port was destroyed.
483 *
484 * If the port is in a space, ip_receiver_name denotes the port name its receive
485 * right occupies in the receiving space. The only exception, as an optimization trick,
486 * is task's self port (itk_self), whose ip_receiver_name actually denotes the name
487 * of mach_task_self() in owning task's space (a send right, with receive right in ipc_space_kernel).
488 */
489
490 static inline bool
ip_in_a_space(ipc_port_t port)491 ip_in_a_space(ipc_port_t port)
492 {
493 /* IN-SPACE */
494 return ip_active(port) && port->ip_receiver_name != MACH_PORT_NULL;
495 }
496
497 static inline bool
ip_in_space(ipc_port_t port,ipc_space_t space)498 ip_in_space(ipc_port_t port, ipc_space_t space)
499 {
500 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
501 return ip_in_a_space(port) && port->ip_receiver == space;
502 }
503
504 /* use sparsely when port lock is not possible, just compare raw pointer */
505 static inline bool
ip_in_space_noauth(ipc_port_t port,void * space)506 ip_in_space_noauth(ipc_port_t port, void* space)
507 {
508 void *__single raw_ptr = ptrauth_strip(*(void **)&port->ip_receiver, ptrauth_key_process_independent_data);
509 return raw_ptr == space;
510 }
511
512 static inline bool
ip_in_transit(ipc_port_t port)513 ip_in_transit(ipc_port_t port)
514 {
515 /* IN-TRANSIT */
516 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
517 return ip_active(port) && !ip_in_a_space(port) && port->ip_destination != IP_NULL;
518 }
519
520 static inline bool
ip_in_limbo(ipc_port_t port)521 ip_in_limbo(ipc_port_t port)
522 {
523 /* IN-LIMBO */
524 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
525 return ip_active(port) && !ip_in_a_space(port) && port->ip_destination == IP_NULL;
526 }
527
528 static inline ipc_space_t
ip_get_receiver(ipc_port_t port)529 ip_get_receiver(ipc_port_t port)
530 {
531 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
532 return ip_in_a_space(port) ? port->ip_receiver : NULL;
533 }
534
535 static inline void*
ip_get_receiver_ptr_noauth(ipc_port_t port)536 ip_get_receiver_ptr_noauth(ipc_port_t port)
537 {
538 void *__single raw_ptr = ptrauth_strip(*(void **)&port->ip_receiver, ptrauth_key_process_independent_data);
539 return raw_ptr;
540 }
541
542 static inline mach_port_name_t
ip_get_receiver_name(ipc_port_t port)543 ip_get_receiver_name(ipc_port_t port)
544 {
545 return ip_in_a_space(port) ? port->ip_receiver_name : MACH_PORT_NULL;
546 }
547
548 static inline ipc_port_t
ip_get_destination(ipc_port_t port)549 ip_get_destination(ipc_port_t port)
550 {
551 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
552 return ip_active(port) && !ip_in_a_space(port) ? port->ip_destination : IP_NULL;
553 }
554
555 static inline ipc_port_timestamp_t
ip_get_death_time(ipc_port_t port)556 ip_get_death_time(ipc_port_t port)
557 {
558 assert(!ip_active(port));
559 return port->ip_timestamp;
560 }
561
562 static inline ipc_importance_task_t
ip_get_imp_task(ipc_port_t port)563 ip_get_imp_task(ipc_port_t port)
564 {
565 return (!ip_is_kobject(port) && !port->ip_specialreply && port->ip_tempowner) ? port->ip_imp_task : IIT_NULL;
566 }
567
568 extern kern_return_t ipc_port_translate_send(
569 ipc_space_t space,
570 mach_port_name_t name,
571 ipc_port_t *portp);
572
573 extern kern_return_t ipc_port_translate_receive(
574 ipc_space_t space,
575 mach_port_name_t name,
576 ipc_port_t *portp);
577
578 /* Allocate a notification request slot */
579 extern kern_return_t ipc_port_request_alloc(
580 ipc_port_t port,
581 mach_port_name_t name,
582 ipc_port_t soright,
583 ipc_port_request_opts_t options,
584 ipc_port_request_index_t *indexp);
585
586 extern kern_return_t ipc_port_request_hnotify_alloc(
587 ipc_port_t port,
588 struct host_notify_entry *hnotify,
589 ipc_port_request_index_t *indexp);
590
591 /* Grow one of a port's tables of notifcation requests */
592 extern kern_return_t ipc_port_request_grow(
593 ipc_port_t port);
594
595 /* Return the type(s) of notification requests outstanding */
596 extern mach_port_type_t ipc_port_request_type(
597 ipc_port_t port,
598 mach_port_name_t name,
599 ipc_port_request_index_t index);
600
601 /* Cancel a notification request and return the send-once right */
602 extern ipc_port_t ipc_port_request_cancel(
603 ipc_port_t port,
604 mach_port_name_t name,
605 ipc_port_request_index_t index);
606
607 /* Arm any delayed send-possible notification */
608 extern boolean_t ipc_port_request_sparm(
609 ipc_port_t port,
610 mach_port_name_t name,
611 ipc_port_request_index_t index,
612 mach_msg_option64_t option,
613 mach_msg_priority_t priority);
614
615 /* Make a no-senders request */
616 extern void ipc_port_nsrequest(
617 ipc_port_t port,
618 mach_port_mscount_t sync,
619 ipc_port_t notify,
620 ipc_port_t *previousp);
621
622 /* Prepare a receive right for transmission/destruction */
623 extern boolean_t ipc_port_clear_receiver(
624 ipc_port_t port,
625 boolean_t should_destroy,
626 waitq_link_list_t *free_l);
627
628 __options_decl(ipc_port_init_flags_t, uint32_t, {
629 IPC_PORT_INIT_NONE = 0x00000000,
630 IPC_PORT_INIT_MAKE_SEND_RIGHT = 0x00000001,
631 IPC_PORT_INIT_MESSAGE_QUEUE = 0x00000002,
632 IPC_PORT_INIT_SPECIAL_REPLY = 0x00000004,
633 IPC_PORT_INIT_FILTER_MESSAGE = 0x00000008,
634 IPC_PORT_INIT_TG_BLOCK_TRACKING = 0x00000010,
635 IPC_PORT_INIT_LOCKED = 0x00000020,
636 IPC_PORT_INIT_REPLY = 0x00000040,
637 IPC_PORT_ENFORCE_REPLY_PORT_SEMANTICS = 0x00000080,
638 IPC_PORT_INIT_PROVISIONAL_REPLY = 0x00000100,
639 IPC_PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS = 0x00000400,
640 IPC_PORT_INIT_EXCEPTION_PORT = 0x00000800,
641 });
642
643 /* Initialize a newly-allocated port */
644 extern void ipc_port_init(
645 ipc_port_t port,
646 ipc_space_t space,
647 ipc_port_init_flags_t flags,
648 mach_port_name_t name);
649
650 /* Allocate a port */
651 extern kern_return_t ipc_port_alloc(
652 ipc_space_t space,
653 ipc_port_init_flags_t flags,
654 mach_port_name_t *namep,
655 ipc_port_t *portp);
656
657 /* Allocate a port, with a specific name */
658 extern kern_return_t ipc_port_alloc_name(
659 ipc_space_t space,
660 ipc_port_init_flags_t flags,
661 mach_port_name_t name,
662 ipc_port_t *portp);
663
664 /* Attach a label to the port */
665 extern void ipc_port_set_label(
666 ipc_port_t port,
667 ipc_label_t label);
668
669 /* Generate dead name notifications */
670 extern void ipc_port_dnnotify(
671 ipc_port_t port);
672
673 /* Generate send-possible notifications */
674 extern void ipc_port_spnotify(
675 ipc_port_t port);
676
677 /* Destroy a port */
678 extern void ipc_port_destroy(
679 ipc_port_t port);
680
681 /* Check if queueing "port" in a message for "dest" would create a circular
682 * group of ports and messages */
683 extern boolean_t
684 ipc_port_check_circularity(
685 ipc_port_t port,
686 ipc_port_t dest);
687
688 #if IMPORTANCE_INHERITANCE
689
690 enum {
691 IPID_OPTION_NORMAL = 0, /* normal boost */
692 IPID_OPTION_SENDPOSSIBLE = 1, /* send-possible induced boost */
693 };
694
695 /* link the destination port with special reply port */
696 void
697 ipc_port_link_special_reply_port(
698 ipc_port_t special_reply_port,
699 ipc_port_t dest_port,
700 boolean_t sync_bootstrap_checkin);
701
702 #define IPC_PORT_ADJUST_SR_NONE 0
703 #define IPC_PORT_ADJUST_SR_ALLOW_SYNC_LINKAGE 0x1
704 #define IPC_PORT_ADJUST_SR_LINK_WORKLOOP 0x2
705 #define IPC_PORT_ADJUST_UNLINK_THREAD 0x4
706 #define IPC_PORT_ADJUST_SR_RECEIVED_MSG 0x8
707 #define IPC_PORT_ADJUST_SR_ENABLE_EVENT 0x10
708 #define IPC_PORT_ADJUST_RESET_BOOSTRAP_CHECKIN 0x20
709
710 void
711 ipc_special_reply_port_bits_reset(ipc_port_t special_reply_port);
712
713 void
714 ipc_special_reply_port_msg_sent(ipc_port_t special_reply_port);
715
716 void
717 ipc_special_reply_port_msg_sent(ipc_port_t special_reply_port);
718
719 /* Adjust special reply port linkage */
720 void
721 ipc_port_adjust_special_reply_port_locked(
722 ipc_port_t special_reply_port,
723 struct knote *kn,
724 uint8_t flags,
725 boolean_t get_turnstile);
726
727 void
728 ipc_port_adjust_sync_link_state_locked(
729 ipc_port_t port,
730 int sync_link_state,
731 turnstile_inheritor_t inheritor);
732
733 /* Adjust special reply port linkage */
734 void
735 ipc_port_adjust_special_reply_port(
736 ipc_port_t special_reply_port,
737 uint8_t flags);
738
739 void
740 ipc_port_adjust_port_locked(
741 ipc_port_t port,
742 struct knote *kn,
743 boolean_t sync_bootstrap_checkin);
744
745 void
746 ipc_port_clear_sync_rcv_thread_boost_locked(
747 ipc_port_t port);
748
749 bool
750 ipc_port_has_prdrequest(
751 ipc_port_t port);
752
753 kern_return_t
754 ipc_port_add_watchport_elem_locked(
755 ipc_port_t port,
756 struct task_watchport_elem *watchport_elem,
757 struct task_watchport_elem **old_elem);
758
759 kern_return_t
760 ipc_port_clear_watchport_elem_internal_conditional_locked(
761 ipc_port_t port,
762 struct task_watchport_elem *watchport_elem);
763
764 kern_return_t
765 ipc_port_replace_watchport_elem_conditional_locked(
766 ipc_port_t port,
767 struct task_watchport_elem *old_watchport_elem,
768 struct task_watchport_elem *new_watchport_elem);
769
770 struct task_watchport_elem *
771 ipc_port_clear_watchport_elem_internal(
772 ipc_port_t port);
773
774 void
775 ipc_port_send_turnstile_prepare(ipc_port_t port);
776
777 void
778 ipc_port_send_turnstile_complete(ipc_port_t port);
779
780 struct waitq *
781 ipc_port_rcv_turnstile_waitq(struct waitq *waitq);
782
783 /* apply importance delta to port only */
784 extern mach_port_delta_t
785 ipc_port_impcount_delta(
786 ipc_port_t port,
787 mach_port_delta_t delta,
788 ipc_port_t base);
789
790 /* apply importance delta to port, and return task importance for update */
791 extern boolean_t
792 ipc_port_importance_delta_internal(
793 ipc_port_t port,
794 natural_t options,
795 mach_port_delta_t *deltap,
796 ipc_importance_task_t *imp_task);
797
798 /* Apply an importance delta to a port and reflect change in receiver task */
799 extern boolean_t
800 ipc_port_importance_delta(
801 ipc_port_t port,
802 natural_t options,
803 mach_port_delta_t delta);
804 #endif /* IMPORTANCE_INHERITANCE */
805
806 /*!
807 * @function ipc_port_make_send_any_locked()
808 *
809 * @brief
810 * Makes a naked send right for a locked and active port.
811 *
812 * @decription
813 * @c ipc_port_make_send_*() should not be used in any generic IPC
814 * plumbing, as this is an operation that subsystem owners need
815 * to be able to synchronize against with the make-send-count
816 * and no-senders notifications.
817 *
818 * It is especially important for kobject types, and in general MIG upcalls
819 * or replies from the kernel should never use MAKE_SEND dispositions,
820 * and prefer COPY_SEND or MOVE_SEND, so that subsystems can control
821 * where that send right comes from.
822 *
823 * This function doesn't perform any validation on the type of port,
824 * this duty is left to the caller.
825 *
826 * @param port An active and locked port.
827 */
828 extern ipc_port_t ipc_port_make_send_any_locked(
829 ipc_port_t port);
830
831 /*!
832 * @function ipc_port_make_send_any()
833 *
834 * @brief
835 * Makes a naked send right for the specified port.
836 *
837 * @decription
838 * @see ipc_port_make_send_any_locked() for a general warning about
839 * making send rights.
840 *
841 * This function doesn't perform any validation on the type of port,
842 * this duty is left to the caller.
843 *
844 * Using @c ipc_port_make_send_mqueue() or @c ipc_kobject_make_send()
845 * is preferred.
846 *
847 * @param port The target port.
848 *
849 * @returns
850 * - IP_DEAD if @c port was dead.
851 * - @c port if @c port was valid, in which case
852 * a naked send right was made.
853 */
854 extern ipc_port_t ipc_port_make_send_any(
855 ipc_port_t port) __result_use_check;
856
857 /*!
858 * @function ipc_port_make_send_mqueue()
859 *
860 * @brief
861 * Makes a naked send right for the specified port.
862 *
863 * @decription
864 * @see ipc_port_make_send_any_locked() for a general warning about
865 * making send rights.
866 *
867 * This function will return IP_NULL if the port wasn't a message queue.
868 *
869 * This avoids confusions where kobject ports are being set in places
870 * where the system expects message queues.
871 *
872 * @param port The target port.
873 *
874 * @returns
875 * - IP_NULL if @c port was not a message queue port
876 * (IKOT_NONE), or @c port was IP_NULL.
877 * - IP_DEAD if @c port was dead.
878 * - @c port if @c port was valid, in which case
879 * a naked send right was made.
880 */
881 extern ipc_port_t ipc_port_make_send_mqueue(
882 ipc_port_t port) __result_use_check;
883
884 /*!
885 * @function ipc_port_copy_send_any_locked()
886 *
887 * @brief
888 * Copies a naked send right for a locked and active port.
889 *
890 * @decription
891 * This function doesn't perform any validation on the type of port,
892 * this duty is left to the caller.
893 *
894 * @param port An active and locked port.
895 */
896 extern void ipc_port_copy_send_any_locked(
897 ipc_port_t port);
898
899 /*!
900 * @function ipc_port_make_send_any()
901 *
902 * @brief
903 * Copies a naked send right for the specified port.
904 *
905 * @decription
906 * This function doesn't perform any validation on the type of port,
907 * this duty is left to the caller.
908 *
909 * Using @c ipc_port_copy_send_mqueue() or @c ipc_kobject_copy_send()
910 * is preferred.
911 *
912 * @param port The target port.
913 *
914 * @returns
915 * - IP_DEAD if @c port was dead.
916 * - @c port if @c port was valid, in which case
917 * a naked send right was made.
918 */
919 extern ipc_port_t ipc_port_copy_send_any(
920 ipc_port_t port) __result_use_check;
921
922 /*!
923 * @function ipc_port_copy_send_mqueue()
924 *
925 * @brief
926 * Copies a naked send right for the specified port.
927 *
928 * @decription
929 * This function will return IP_NULL if the port wasn't a message queue.
930 *
931 * This avoids confusions where kobject ports are being set in places
932 * where the system expects message queues.
933 *
934 * @param port The target port.
935 *
936 * @returns
937 * - IP_NULL if @c port was not a message queue port
938 * (IKOT_NONE), or @c port was IP_NULL.
939 * - IP_DEAD if @c port was dead.
940 * - @c port if @c port was valid, in which case
941 * a naked send right was made.
942 */
943 extern ipc_port_t ipc_port_copy_send_mqueue(
944 ipc_port_t port) __result_use_check;
945
946 /* Copyout a naked send right */
947 extern mach_port_name_t ipc_port_copyout_send(
948 ipc_port_t sright,
949 ipc_space_t space);
950
951 extern mach_port_name_t ipc_port_copyout_send_pinned(
952 ipc_port_t sright,
953 ipc_space_t space);
954
955 extern void ipc_port_thread_group_blocked(
956 ipc_port_t port);
957
958 extern void ipc_port_thread_group_unblocked(void);
959
960 extern void ipc_port_release_send_and_unlock(
961 ipc_port_t port);
962
963 extern kern_return_t mach_port_deallocate_kernel(
964 ipc_space_t space,
965 mach_port_name_t name,
966 natural_t kotype);
967
968 #endif /* MACH_KERNEL_PRIVATE */
969 #if KERNEL_PRIVATE
970
971 /* Release a (valid) naked send right */
972 extern void ipc_port_release_send(
973 ipc_port_t port);
974
975 extern void ipc_port_reference(
976 ipc_port_t port);
977
978 extern void ipc_port_release(
979 ipc_port_t port);
980
981 struct thread_attr_for_ipc_propagation {
982 union {
983 struct {
984 uint64_t tafip_iotier:2,
985 tafip_qos:3;
986 };
987 uint64_t tafip_value;
988 };
989 uint64_t tafip_reserved;
990 };
991
992 extern kern_return_t
993 ipc_port_propagate_thread_attr(
994 ipc_port_t port,
995 struct thread_attr_for_ipc_propagation attr);
996
997 extern kern_return_t
998 ipc_port_reset_thread_attr(ipc_port_t port);
999 #endif /* KERNEL_PRIVATE */
1000
1001 #ifdef MACH_KERNEL_PRIVATE
1002
1003 /* Make a naked send-once right from a locked and active receive right */
1004 extern ipc_port_t ipc_port_make_sonce_locked(
1005 ipc_port_t port);
1006
1007 /* Make a naked send-once right from a receive right */
1008 extern ipc_port_t ipc_port_make_sonce(
1009 ipc_port_t port);
1010
1011 /* Release a naked send-once right */
1012 extern void ipc_port_release_sonce(
1013 ipc_port_t port);
1014
1015 /* Release a naked send-once right */
1016 extern void ipc_port_release_sonce_and_unlock(
1017 ipc_port_t port);
1018
1019 /* Release a naked (in limbo or in transit) receive right */
1020 extern void ipc_port_release_receive(
1021 ipc_port_t port);
1022
1023 /* Finalize the destruction of a port before it gets freed */
1024 extern void ipc_port_finalize(
1025 ipc_port_t port);
1026
1027 /* Get receiver task and its pid (if any) for port. Assumes port is locked. */
1028 extern pid_t ipc_port_get_receiver_task_locked(ipc_port_t port, uintptr_t *task);
1029
1030 /* Get receiver task and its pid (if any) for port. */
1031 extern pid_t ipc_port_get_receiver_task(ipc_port_t port, uintptr_t *task);
1032
1033 /* Allocate a port in a special space */
1034 extern ipc_port_t ipc_port_alloc_special(
1035 ipc_space_t space,
1036 ipc_port_init_flags_t flags);
1037
1038 /* Deallocate a port in a special space */
1039 extern void ipc_port_dealloc_special_and_unlock(
1040 ipc_port_t port,
1041 ipc_space_t space);
1042
1043 /* Deallocate a port in a special space */
1044 extern void ipc_port_dealloc_special(
1045 ipc_port_t port,
1046 ipc_space_t space);
1047
1048 extern void ipc_port_recv_update_inheritor(ipc_port_t port,
1049 struct turnstile *turnstile,
1050 turnstile_update_flags_t flags);
1051
1052 extern void ipc_port_send_update_inheritor(ipc_port_t port,
1053 struct turnstile *turnstile,
1054 turnstile_update_flags_t flags);
1055
1056 extern int
1057 ipc_special_reply_get_pid_locked(ipc_port_t port);
1058
1059 #define ipc_port_alloc_reply() \
1060 ipc_port_alloc_special(ipc_space_reply, IPC_PORT_INIT_MESSAGE_QUEUE | IPC_PORT_INIT_SPECIAL_REPLY)
1061 #define ipc_port_dealloc_reply(port) \
1062 ipc_port_dealloc_special((port), ipc_space_reply)
1063
1064 #endif /* MACH_KERNEL_PRIVATE */
1065
1066 #endif /* _IPC_IPC_PORT_H_ */
1067