1/*
2 * Copyright (c) 2000-2016 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * @OSF_COPYRIGHT@
30 */
31/*
32 * Mach Operating System
33 * Copyright (c) 1991,1990,1989 Carnegie Mellon University
34 * All Rights Reserved.
35 *
36 * Permission to use, copy, modify and distribute this software and its
37 * documentation is hereby granted, provided that both the copyright
38 * notice and this permission notice appear in all copies of the
39 * software, derivative works or modified versions, and any portions
40 * thereof, and that both notices appear in supporting documentation.
41 *
42 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
45 *
46 * Carnegie Mellon requests users of this software to return to
47 *
48 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU
49 * School of Computer Science
50 * Carnegie Mellon University
51 * Pittsburgh PA 15213-3890
52 *
53 * any improvements or extensions that they make and grant Carnegie Mellon
54 * the rights to redistribute these changes.
55 */
56/*
57 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
58 * support for mandatory and extensible security protections. This notice
59 * is included in support of clause 2.2 (b) of the Apple Public License,
60 * Version 2.0.
61 */
62/*
63 */
64/*
65 * File: ipc/ipc_port.h
66 * Author: Rich Draves
67 * Date: 1989
68 *
69 * Definitions for ports.
70 */
71
72#ifndef _IPC_IPC_PORT_H_
73#define _IPC_IPC_PORT_H_
74
75#ifdef MACH_KERNEL_PRIVATE
76
77#include <mach_assert.h>
78
79#include <mach/mach_types.h>
80#include <mach/boolean.h>
81#include <mach/kern_return.h>
82#include <mach/port.h>
83
84#include <kern/assert.h>
85#include <kern/kern_types.h>
86#include <kern/turnstile.h>
87
88#include <ipc/ipc_types.h>
89#include <ipc/ipc_object.h>
90#include <ipc/ipc_mqueue.h>
91#include <ipc/ipc_space.h>
92
93#include <security/_label.h>
94
95#include <ptrauth.h>
96
97extern int proc_isinitproc(struct proc *p);
98
99struct task_watchport_elem;
100
101typedef unsigned int ipc_port_timestamp_t;
102
103struct ipc_port_request {
104 union {
105 struct ipc_port *ipr_soright;
106 struct host_notify_entry *XNU_PTRAUTH_SIGNED_PTR("ipc_port_request.ipr_hnotify") ipr_hnotify;
107 struct ipc_port_request *XNU_PTRAUTH_SIGNED_PTR("ipc_port_request.ipr_hn_slot") ipr_hn_slot;
108 };
109
110 union {
111#define IPR_HOST_NOTIFY 0xfffffffeu
112 mach_port_name_t ipr_name;
113 ipc_port_request_index_t ipr_next;
114 };
115};
116
117KALLOC_ARRAY_TYPE_DECL(ipc_port_request_table, struct ipc_port_request);
118
119struct ipc_port {
120 struct ipc_object ip_object;
121 union {
122 /*
123 * The waitq_eventmask field is only used on the global queues.
124 * We hence repurpose all those bits for our own use.
125 *
126 * Note: if too many bits are added, compilation will fail
127 * with errors about "negative bitfield sizes"
128 */
129 WAITQ_FLAGS(ip_waitq
130 , ip_fullwaiters:1 /* Whether there are senders blocked on a full queue */
131 , ip_sprequests:1 /* send-possible requests outstanding */
132 , ip_spimportant:1 /* ... at least one is importance donating */
133 , ip_impdonation:1 /* port supports importance donation */
134 , ip_tempowner:1 /* dont give donations to current receiver */
135 , ip_guarded:1 /* port guarded (use context value as guard) */
136 , ip_strict_guard:1 /* Strict guarding; Prevents user manipulation of context values directly */
137 , ip_specialreply:1 /* port is a special reply port */
138 , ip_sync_link_state:3 /* link the port to destination port/ Workloop */
139 , ip_sync_bootstrap_checkin:1 /* port part of sync bootstrap checkin, push on thread doing the checkin */
140 , ip_immovable_receive:1 /* the receive right cannot be moved out of a space, until it is destroyed */
141 , ip_immovable_send:1 /* No send(once) rights to this port can be moved out of a space, never unset */
142 , ip_no_grant:1 /* Port wont accept complex messages containing (ool) port descriptors */
143 , ip_tg_block_tracking:1 /* Track blocking relationship between thread groups during sync IPC */
144 , ip_pinned:1 /* Can't deallocate the last send right from a space while the bit is set */
145 , ip_service_port:1 /* port is a service port */
146 , ip_has_watchport:1 /* port has an exec watchport */
147 , ip_kernel_iotier_override:2 /* kernel iotier override */
148 , ip_kernel_qos_override:3 /* kernel qos override */
149 , ip_reply_port_semantics:3 /* reply port defense in depth type */
150 );
151 struct waitq ip_waitq;
152 };
153
154 struct ipc_mqueue ip_messages;
155
156 /*
157 * IMPORTANT: Direct access of unionized fields are highly discouraged.
158 * Use accessor functions below and see header doc for possible states.
159 */
160 union {
161 struct ipc_space *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_receiver") ip_receiver;
162 struct ipc_port *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_destination") ip_destination;
163 ipc_port_timestamp_t ip_timestamp;
164 };
165
166 /* update ipc_kobject_upgrade_locked() if this union is changed */
167 union {
168 uintptr_t ip_kobject; /* manually PAC-ed, see ipc_kobject_get_raw() */
169 ipc_importance_task_t ip_imp_task; /* use accessor ip_get_imp_task() */
170 struct ipc_port *ip_sync_inheritor_port;
171 struct knote *ip_sync_inheritor_knote;
172 struct turnstile *ip_sync_inheritor_ts;
173 };
174
175 /*
176 * ip_specialreply: ip_pid
177 * ip_has_watchport: ip_twe
178 * else: ip_pdrequest
179 */
180 union {
181 int ip_pid;
182 struct task_watchport_elem *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_twe") ip_twe;
183 struct ipc_port *XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_pdrequest") ip_pdrequest;
184 };
185
186#define IP_KOBJECT_NSREQUEST_ARMED ((struct ipc_port *)1)
187 struct ipc_port *ip_nsrequest;
188 ipc_port_request_table_t XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_request") ip_requests;
189 union {
190 struct ipc_kmsg *XNU_PTRAUTH_SIGNED_PTR("ipc_port.premsg") ip_premsg;
191 struct turnstile *ip_send_turnstile;
192 };
193 mach_vm_address_t ip_context;
194
195#if DEVELOPMENT || DEBUG
196 natural_t ip_srp_lost_link : 1; /* special reply port turnstile link chain broken */
197 natural_t ip_srp_msg_sent : 1; /* special reply port msg sent */
198 natural_t ip_impcount : 30; /* number of importance donations in nested queue */
199#else
200 natural_t ip_impcount; /* number of importance donations in nested queue */
201#endif
202 mach_port_mscount_t ip_mscount;
203 mach_port_rights_t ip_srights;
204 mach_port_rights_t ip_sorights;
205
206 union {
207 ipc_kobject_label_t XNU_PTRAUTH_SIGNED_PTR("ipc_port.kolabel") ip_kolabel;
208 /* Union of service and connection ports' message filtering metadata */
209 void * XNU_PTRAUTH_SIGNED_PTR("ipc_port.ip_splabel") ip_splabel;
210 };
211
212#if MACH_ASSERT
213 unsigned long ip_timetrack; /* give an idea of "when" created */
214 uint32_t ip_made_bt; /* stack trace (btref_t) */
215 uint32_t ip_made_pid; /* for debugging */
216#endif /* MACH_ASSERT */
217};
218
219static inline bool
220ip_in_pset(ipc_port_t port)
221{
222 return !circle_queue_empty(cq: &port->ip_waitq.waitq_links);
223}
224
225#define ip_receiver_name ip_messages.imq_receiver_name
226#define ip_reply_context ip_messages.imq_context
227#define ip_klist ip_messages.imq_klist
228
229#define port_send_turnstile(port) \
230 (IP_PREALLOC(port) ? TURNSTILE_NULL : (port)->ip_send_turnstile)
231
232#define set_port_send_turnstile(port, value) \
233MACRO_BEGIN \
234if (!IP_PREALLOC(port)) { \
235 (port)->ip_send_turnstile = (value); \
236} \
237MACRO_END
238
239#define port_send_turnstile_address(port) \
240 (IP_PREALLOC(port) ? NULL : &((port)->ip_send_turnstile))
241
242#define port_rcv_turnstile_address(port) (&(port)->ip_waitq.waitq_ts)
243
244extern void __ipc_right_delta_overflow_panic(
245 ipc_port_t port,
246 natural_t *field,
247 int delta) __abortlike;
248
249#define ip_right_delta(port, field, delta) ({ \
250 ipc_port_t __port = (port); \
251 if (os_add_overflow(__port->field, delta, &__port->field)) { \
252 __ipc_right_delta_overflow_panic(__port, &__port->field, delta); \
253 } \
254})
255
256#define ip_srights_inc(port) ip_right_delta(port, ip_srights, 1)
257#define ip_srights_dec(port) ip_right_delta(port, ip_srights, -1)
258#define ip_sorights_inc(port) ip_right_delta(port, ip_sorights, 1)
259#define ip_sorights_dec(port) ip_right_delta(port, ip_sorights, -1)
260
261/*
262 * SYNC IPC state flags for special reply port/ rcv right.
263 *
264 * PORT_SYNC_LINK_ANY
265 * Special reply port is not linked to any other port
266 * or WL and linkage should be allowed.
267 *
268 * PORT_SYNC_LINK_PORT
269 * Special reply port is linked to the port and
270 * ip_sync_inheritor_port contains the inheritor
271 * port.
272 *
273 * PORT_SYNC_LINK_WORKLOOP_KNOTE
274 * Special reply port is linked to a WL (via a knote).
275 * ip_sync_inheritor_knote contains a pointer to the knote
276 * the port is stashed on.
277 *
278 * PORT_SYNC_LINK_WORKLOOP_STASH
279 * Special reply port is linked to a WL (via a knote stash).
280 * ip_sync_inheritor_ts contains a pointer to the turnstile with a +1
281 * the port is stashed on.
282 *
283 * PORT_SYNC_LINK_NO_LINKAGE
284 * Message sent to special reply port, do
285 * not allow any linkages till receive is
286 * complete.
287 *
288 * PORT_SYNC_LINK_RCV_THREAD
289 * Receive right copied out as a part of bootstrap check in,
290 * push on the thread which copied out the port.
291 */
292#define PORT_SYNC_LINK_ANY (0)
293#define PORT_SYNC_LINK_PORT (0x1)
294#define PORT_SYNC_LINK_WORKLOOP_KNOTE (0x2)
295#define PORT_SYNC_LINK_WORKLOOP_STASH (0x3)
296#define PORT_SYNC_LINK_NO_LINKAGE (0x4)
297#define PORT_SYNC_LINK_RCV_THREAD (0x5)
298
299#define IP_NULL IPC_PORT_NULL
300#define IP_DEAD IPC_PORT_DEAD
301#define IP_VALID(port) IPC_PORT_VALID(port)
302
303#define ip_object_to_port(io) __container_of(io, struct ipc_port, ip_object)
304#define ip_to_object(port) (&(port)->ip_object)
305#define ip_active(port) io_active(ip_to_object(port))
306#define ip_mq_lock_held(port) io_lock_held(ip_to_object(port))
307#define ip_mq_lock(port) ipc_object_lock(ip_to_object(port), IOT_PORT)
308#define ip_mq_lock_check_aligned(port) ipc_object_lock_check_aligned(ip_to_object(port), IOT_PORT)
309#define ip_mq_lock_try(port) ipc_object_lock_try(ip_to_object(port), IOT_PORT)
310#define ip_mq_lock_held_kdp(port) io_lock_held_kdp(ip_to_object(port))
311#define ip_mq_unlock(port) io_unlock(ip_to_object(port))
312
313#define ip_reference(port) io_reference(ip_to_object(port))
314#define ip_release(port) io_release(ip_to_object(port))
315#define ip_release_safe(port) io_release_safe(ip_to_object(port))
316#define ip_release_live(port) io_release_live(ip_to_object(port))
317#define ip_validate(port) \
318 zone_id_require(ZONE_ID_IPC_PORT, sizeof(struct ipc_port), port)
319#define ip_validate_aligned(port) \
320 zone_id_require_aligned(ZONE_ID_IPC_PORT, port)
321
322#define ip_from_waitq(wq) __container_of(wq, struct ipc_port, ip_waitq)
323#define ip_from_mq(mq) __container_of(mq, struct ipc_port, ip_messages)
324
325#define ip_kotype(port) io_kotype(ip_to_object(port))
326#define ip_is_kobject(port) io_is_kobject(ip_to_object(port))
327#define ip_is_control(port) \
328 (ip_kotype(port) == IKOT_TASK_CONTROL || ip_kotype(port) == IKOT_THREAD_CONTROL)
329#define ip_is_kolabeled(port) io_is_kolabeled(ip_to_object(port))
330
331#define ip_full_kernel(port) imq_full_kernel(&(port)->ip_messages)
332#define ip_full(port) imq_full(&(port)->ip_messages)
333
334/*
335 * IPC Port flags for reply port defense in depth
336 *
337 * PORT_MARK_REPLY_PORT
338 * Port is marked as a reply port.
339 *
340 * PORT_ENFORCE_REPLY_PORT_SEMANTICS
341 * When talking to this port, the local port of mach msg needs to be a reply port.
342 * Currrently service ports and libxpc connection ports adopt this.
343 *
344 * PORT_MARK_PROVISIONAL_REPLY_PORT
345 * Port is marked as a provisional reply port with an eventual goal of making it port as PORT_MARK_REPLY_PORT.
346 *
347 * PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS
348 * Same as PORT_ENFORCE_REPLY_PORT_SEMANTICS above, but does not allow for provisional reply ports.
349 * Once provisional reply ports no longer exist, this will be removed as "rigidness/strictness" will be irrelavant.
350 *
351 * PORT_ID_PROTECTED_OPT_OUT
352 * Port is opted out from identity protected enforcement for mach exceptions.
353 */
354#define PORT_MARK_REPLY_PORT 0x01
355#define PORT_ENFORCE_REPLY_PORT_SEMANTICS 0x02
356#define PORT_MARK_PROVISIONAL_REPLY_PORT 0x03
357#define PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS 0x04
358#define PORT_ID_PROTECTED_OPT_OUT 0x05
359
360/* ip_reply_port_semantics can be read without a lock as it is never unset after port creation. */
361#define ip_is_reply_port(port) (((port)->ip_reply_port_semantics) == PORT_MARK_REPLY_PORT)
362#define ip_require_reply_port_semantics(port) (((port)->ip_reply_port_semantics) == PORT_ENFORCE_REPLY_PORT_SEMANTICS)
363#define ip_is_provisional_reply_port(port) (((port)->ip_reply_port_semantics) == PORT_MARK_PROVISIONAL_REPLY_PORT)
364#define ip_require_rigid_reply_port_semantics(port) (((port)->ip_reply_port_semantics) == PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS)
365#define ip_is_id_prot_opted_out(port) (((port)->ip_reply_port_semantics) == PORT_ID_PROTECTED_OPT_OUT)
366
367#define ip_mark_reply_port(port) ((port)->ip_reply_port_semantics = PORT_MARK_REPLY_PORT)
368#define ip_enforce_reply_port_semantics(port) ((port)->ip_reply_port_semantics = PORT_ENFORCE_REPLY_PORT_SEMANTICS)
369#define ip_mark_provisional_reply_port(port) ((port)->ip_reply_port_semantics = PORT_MARK_PROVISIONAL_REPLY_PORT)
370#define ip_enforce_rigid_reply_port_semantics(port) ((port)->ip_reply_port_semantics = PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS)
371#define ip_mark_id_prot_opt_out(port) ((port)->ip_reply_port_semantics = PORT_ID_PROTECTED_OPT_OUT)
372
373#define ip_is_immovable_send(port) ((port)->ip_immovable_send)
374#define ip_is_pinned(port) ((port)->ip_pinned)
375
376#define ip_is_libxpc_connection_port(port) \
377 (!ip_is_kolabeled(port) && (!(port)->ip_service_port) && ((port)->ip_splabel != NULL))
378
379extern bool ip_violates_rigid_reply_port_semantics(ipc_port_t dest_port, ipc_port_t reply_port,
380 int *reply_port_semantics_violation);
381
382extern bool ip_violates_reply_port_semantics(ipc_port_t dest_port, ipc_port_t reply_port,
383 int *reply_port_semantics_violation);
384
385/* Rigid Reply Port and Move Reply Port violators */
386#define REPLY_PORT_SEMANTICS_VIOLATOR 1 /* normal reply port semantics violator */
387#define RRP_HARDENED_RUNTIME_VIOLATOR 2
388#define MRP_HARDENED_RUNTIME_VIOLATOR 3
389#define MRP_3P_VIOLATOR 4
390#define RRP_3P_VIOLATOR 5
391
392/* Bits reserved in IO_BITS_PORT_INFO are defined here */
393
394/*
395 * JMM - Preallocation flag
396 * This flag indicates that there is a message buffer preallocated for this
397 * port and we should use that when sending (from the kernel) rather than
398 * allocate a new one. This avoids deadlocks during notification message
399 * sends by critical system threads (which may be needed to free memory and
400 * therefore cannot be blocked waiting for memory themselves).
401 */
402#define IP_BIT_PREALLOC 0x00008000 /* preallocated mesg */
403#define IP_PREALLOC(port) (io_bits(ip_to_object(port)) & IP_BIT_PREALLOC)
404
405#define IP_SET_PREALLOC(port, kmsg) \
406MACRO_BEGIN \
407 io_bits_or(ip_to_object(port), IP_BIT_PREALLOC); \
408 (port)->ip_premsg = (kmsg); \
409MACRO_END
410
411/*
412 * This flag indicates that the port has opted into message filtering based
413 * on a policy defined in the Sandbox.
414 */
415#define IP_BIT_FILTER_MSG 0x00001000
416#define ip_enforce_msg_filtering(port) ((io_bits(ip_to_object(port)) & IP_BIT_FILTER_MSG) != 0)
417
418/*
419 * Use the low bits in the ipr_soright to specify the request type
420 */
421__enum_decl(ipc_port_request_opts_t, uintptr_t, {
422 IPR_SOR_SPARM_MASK = 0x01, /* send-possible armed */
423 IPR_SOR_SPREQ_MASK = 0x02, /* send-possible requested */
424});
425#define IPR_SOR_SPBIT_MASK 3 /* combo */
426#define IPR_SOR_SPARMED(sor) (((uintptr_t)(sor) & IPR_SOR_SPARM_MASK) != 0)
427#define IPR_SOR_SPREQ(sor) (((uintptr_t)(sor) & IPR_SOR_SPREQ_MASK) != 0)
428#define IPR_SOR_PORT(sor) ((ipc_port_t)((uintptr_t)(sor) & ~IPR_SOR_SPBIT_MASK))
429#define IPR_SOR_MAKE(p, m) ((ipc_port_t)((uintptr_t)(p) | (m)))
430
431extern lck_grp_t ipc_lck_grp;
432extern lck_attr_t ipc_lck_attr;
433
434/*
435 * Taking the ipc_port_multiple lock grants the privilege
436 * to lock multiple ports at once. No ports must locked
437 * when it is taken.
438 */
439
440extern lck_spin_t ipc_port_multiple_lock_data;
441
442#define ipc_port_multiple_lock() \
443 lck_spin_lock_grp(&ipc_port_multiple_lock_data, &ipc_lck_grp)
444
445#define ipc_port_multiple_unlock() \
446 lck_spin_unlock(&ipc_port_multiple_lock_data)
447
448/*
449 * Search for the end of the chain (a port not in transit),
450 * acquiring locks along the way.
451 */
452extern boolean_t ipc_port_destination_chain_lock(
453 ipc_port_t port,
454 ipc_port_t *base);
455
456/*
457 * The port timestamp facility provides timestamps
458 * for port destruction. It is used to serialize
459 * mach_port_names with port death.
460 */
461
462extern ipc_port_timestamp_t ipc_port_timestamp_data;
463
464/* Retrieve a port timestamp value */
465extern ipc_port_timestamp_t ipc_port_timestamp(void);
466
467/*
468 * Compares two timestamps, and returns TRUE if one
469 * happened before two. Note that this formulation
470 * works when the timestamp wraps around at 2^32,
471 * as long as one and two aren't too far apart.
472 */
473
474#define IP_TIMESTAMP_ORDER(one, two) ((int) ((one) - (two)) < 0)
475
476extern void __abortlike __ipc_port_inactive_panic(ipc_port_t port);
477
478static inline void
479require_ip_active(ipc_port_t port)
480{
481 if (!ip_active(port)) {
482 __ipc_port_inactive_panic(port);
483 }
484}
485
486/*
487 * A receive right (port) can be in ONE of the following four states:
488 *
489 * 1) INACTIVE: Dead
490 * 2) IN-SPACE: In a space
491 * 3) IN-TRANSIT: Enqueued in a message
492 * 4) IN-LIMBO
493 *
494 * If the port is active and ip_receiver_name != MACH_PORT_NULL, we can safely
495 * deference the union as ip_receiver, which points to the space that holds
496 * receive right (but doesn't hold a ref for it).
497 *
498 * If the port is active and ip_receiver_name == MACH_PORT_NULL, we can safely
499 * deference the union as ip_destination. The port is either IN-LIMBO (ip_destination == IP_NULL)
500 * or ip_destination points to the destination port and holds a ref for it.
501 *
502 * If the port is not active, we can safely deference the union as ip_timestamp,
503 * which contains a timestamp taken when the port was destroyed.
504 *
505 * If the port is in a space, ip_receiver_name denotes the port name its receive
506 * right occupies in the receiving space. The only exception, as an optimization trick,
507 * is task's self port (itk_self), whose ip_receiver_name actually denotes the name
508 * of mach_task_self() in owning task's space (a send right, with receive right in ipc_space_kernel).
509 */
510
511static inline bool
512ip_in_a_space(ipc_port_t port)
513{
514 /* IN-SPACE */
515 return ip_active(port) && port->ip_receiver_name != MACH_PORT_NULL;
516}
517
518static inline bool
519ip_in_space(ipc_port_t port, ipc_space_t space)
520{
521 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
522 return ip_in_a_space(port) && port->ip_receiver == space;
523}
524
525/* use sparsely when port lock is not possible, just compare raw pointer */
526static inline bool
527ip_in_space_noauth(ipc_port_t port, void* space)
528{
529 void *__single raw_ptr = ptrauth_strip(*(void **)&port->ip_receiver, ptrauth_key_process_independent_data);
530 return raw_ptr == space;
531}
532
533static inline bool
534ip_in_transit(ipc_port_t port)
535{
536 /* IN-TRANSIT */
537 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
538 return ip_active(port) && !ip_in_a_space(port) && port->ip_destination != IP_NULL;
539}
540
541static inline bool
542ip_in_limbo(ipc_port_t port)
543{
544 /* IN-LIMBO */
545 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
546 return ip_active(port) && !ip_in_a_space(port) && port->ip_destination == IP_NULL;
547}
548
549static inline ipc_space_t
550ip_get_receiver(ipc_port_t port)
551{
552 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
553 return ip_in_a_space(port) ? port->ip_receiver : NULL;
554}
555
556static inline void*
557ip_get_receiver_ptr_noauth(ipc_port_t port)
558{
559 void *__single raw_ptr = ptrauth_strip(*(void **)&port->ip_receiver, ptrauth_key_process_independent_data);
560 return raw_ptr;
561}
562
563static inline mach_port_name_t
564ip_get_receiver_name(ipc_port_t port)
565{
566 return ip_in_a_space(port) ? port->ip_receiver_name : MACH_PORT_NULL;
567}
568
569static inline ipc_port_t
570ip_get_destination(ipc_port_t port)
571{
572 ip_mq_lock_held(port); /* port must be locked, otherwise PAC could fail */
573 return ip_active(port) && !ip_in_a_space(port) ? port->ip_destination : IP_NULL;
574}
575
576static inline ipc_port_timestamp_t
577ip_get_death_time(ipc_port_t port)
578{
579 assert(!ip_active(port));
580 return port->ip_timestamp;
581}
582
583static inline ipc_importance_task_t
584ip_get_imp_task(ipc_port_t port)
585{
586 return (!ip_is_kobject(port) && !port->ip_specialreply && port->ip_tempowner) ? port->ip_imp_task : IIT_NULL;
587}
588
589extern kern_return_t ipc_port_translate_send(
590 ipc_space_t space,
591 mach_port_name_t name,
592 ipc_port_t *portp);
593
594extern kern_return_t ipc_port_translate_receive(
595 ipc_space_t space,
596 mach_port_name_t name,
597 ipc_port_t *portp);
598
599/* Allocate a notification request slot */
600extern kern_return_t ipc_port_request_alloc(
601 ipc_port_t port,
602 mach_port_name_t name,
603 ipc_port_t soright,
604 ipc_port_request_opts_t options,
605 ipc_port_request_index_t *indexp);
606
607extern kern_return_t ipc_port_request_hnotify_alloc(
608 ipc_port_t port,
609 struct host_notify_entry *hnotify,
610 ipc_port_request_index_t *indexp);
611
612/* Grow one of a port's tables of notifcation requests */
613extern kern_return_t ipc_port_request_grow(
614 ipc_port_t port);
615
616/* Return the type(s) of notification requests outstanding */
617extern mach_port_type_t ipc_port_request_type(
618 ipc_port_t port,
619 mach_port_name_t name,
620 ipc_port_request_index_t index);
621
622/* Cancel a notification request and return the send-once right */
623extern ipc_port_t ipc_port_request_cancel(
624 ipc_port_t port,
625 mach_port_name_t name,
626 ipc_port_request_index_t index);
627
628/* Arm any delayed send-possible notification */
629extern boolean_t ipc_port_request_sparm(
630 ipc_port_t port,
631 mach_port_name_t name,
632 ipc_port_request_index_t index,
633 mach_msg_option_t option,
634 mach_msg_priority_t priority);
635
636/* Make a no-senders request */
637extern void ipc_port_nsrequest(
638 ipc_port_t port,
639 mach_port_mscount_t sync,
640 ipc_port_t notify,
641 ipc_port_t *previousp);
642
643/* Prepare a receive right for transmission/destruction */
644extern boolean_t ipc_port_clear_receiver(
645 ipc_port_t port,
646 boolean_t should_destroy,
647 waitq_link_list_t *free_l);
648
649__options_decl(ipc_port_init_flags_t, uint32_t, {
650 IPC_PORT_INIT_NONE = 0x00000000,
651 IPC_PORT_INIT_MAKE_SEND_RIGHT = 0x00000001,
652 IPC_PORT_INIT_MESSAGE_QUEUE = 0x00000002,
653 IPC_PORT_INIT_SPECIAL_REPLY = 0x00000004,
654 IPC_PORT_INIT_FILTER_MESSAGE = 0x00000008,
655 IPC_PORT_INIT_TG_BLOCK_TRACKING = 0x00000010,
656 IPC_PORT_INIT_LOCKED = 0x00000020,
657 IPC_PORT_INIT_REPLY = 0x00000040,
658 IPC_PORT_ENFORCE_REPLY_PORT_SEMANTICS = 0x00000080,
659 IPC_PORT_INIT_PROVISIONAL_REPLY = 0x00000100,
660 IPC_PORT_INIT_PROVISIONAL_ID_PROT_OPTOUT = 0x00000200,
661 IPC_PORT_ENFORCE_RIGID_REPLY_PORT_SEMANTICS = 0x00000400,
662});
663
664/* Initialize a newly-allocated port */
665extern void ipc_port_init(
666 ipc_port_t port,
667 ipc_space_t space,
668 ipc_port_init_flags_t flags,
669 mach_port_name_t name);
670
671/* Allocate a port */
672extern kern_return_t ipc_port_alloc(
673 ipc_space_t space,
674 ipc_port_init_flags_t flags,
675 mach_port_name_t *namep,
676 ipc_port_t *portp);
677
678/* Allocate a port, with a specific name */
679extern kern_return_t ipc_port_alloc_name(
680 ipc_space_t space,
681 ipc_port_init_flags_t flags,
682 mach_port_name_t name,
683 ipc_port_t *portp);
684
685/* Attach a label to the port */
686extern void ipc_port_set_label(
687 ipc_port_t port,
688 ipc_label_t label);
689
690/* Generate dead name notifications */
691extern void ipc_port_dnnotify(
692 ipc_port_t port);
693
694/* Generate send-possible notifications */
695extern void ipc_port_spnotify(
696 ipc_port_t port);
697
698/* Destroy a port */
699extern void ipc_port_destroy(
700 ipc_port_t port);
701
702/* Check if queueing "port" in a message for "dest" would create a circular
703 * group of ports and messages */
704extern boolean_t
705ipc_port_check_circularity(
706 ipc_port_t port,
707 ipc_port_t dest);
708
709#if IMPORTANCE_INHERITANCE
710
711enum {
712 IPID_OPTION_NORMAL = 0, /* normal boost */
713 IPID_OPTION_SENDPOSSIBLE = 1, /* send-possible induced boost */
714};
715
716/* link the destination port with special reply port */
717void
718ipc_port_link_special_reply_port(
719 ipc_port_t special_reply_port,
720 ipc_port_t dest_port,
721 boolean_t sync_bootstrap_checkin);
722
723#define IPC_PORT_ADJUST_SR_NONE 0
724#define IPC_PORT_ADJUST_SR_ALLOW_SYNC_LINKAGE 0x1
725#define IPC_PORT_ADJUST_SR_LINK_WORKLOOP 0x2
726#define IPC_PORT_ADJUST_UNLINK_THREAD 0x4
727#define IPC_PORT_ADJUST_SR_RECEIVED_MSG 0x8
728#define IPC_PORT_ADJUST_SR_ENABLE_EVENT 0x10
729#define IPC_PORT_ADJUST_RESET_BOOSTRAP_CHECKIN 0x20
730
731void
732ipc_special_reply_port_bits_reset(ipc_port_t special_reply_port);
733
734void
735ipc_special_reply_port_msg_sent(ipc_port_t special_reply_port);
736
737void
738ipc_special_reply_port_msg_sent(ipc_port_t special_reply_port);
739
740/* Adjust special reply port linkage */
741void
742ipc_port_adjust_special_reply_port_locked(
743 ipc_port_t special_reply_port,
744 struct knote *kn,
745 uint8_t flags,
746 boolean_t get_turnstile);
747
748void
749ipc_port_adjust_sync_link_state_locked(
750 ipc_port_t port,
751 int sync_link_state,
752 turnstile_inheritor_t inheritor);
753
754/* Adjust special reply port linkage */
755void
756ipc_port_adjust_special_reply_port(
757 ipc_port_t special_reply_port,
758 uint8_t flags);
759
760void
761ipc_port_adjust_port_locked(
762 ipc_port_t port,
763 struct knote *kn,
764 boolean_t sync_bootstrap_checkin);
765
766void
767ipc_port_clear_sync_rcv_thread_boost_locked(
768 ipc_port_t port);
769
770bool
771ipc_port_has_prdrequest(
772 ipc_port_t port);
773
774kern_return_t
775ipc_port_add_watchport_elem_locked(
776 ipc_port_t port,
777 struct task_watchport_elem *watchport_elem,
778 struct task_watchport_elem **old_elem);
779
780kern_return_t
781ipc_port_clear_watchport_elem_internal_conditional_locked(
782 ipc_port_t port,
783 struct task_watchport_elem *watchport_elem);
784
785kern_return_t
786ipc_port_replace_watchport_elem_conditional_locked(
787 ipc_port_t port,
788 struct task_watchport_elem *old_watchport_elem,
789 struct task_watchport_elem *new_watchport_elem);
790
791struct task_watchport_elem *
792ipc_port_clear_watchport_elem_internal(
793 ipc_port_t port);
794
795void
796ipc_port_send_turnstile_prepare(ipc_port_t port);
797
798void
799ipc_port_send_turnstile_complete(ipc_port_t port);
800
801struct waitq *
802ipc_port_rcv_turnstile_waitq(struct waitq *waitq);
803
804/* apply importance delta to port only */
805extern mach_port_delta_t
806ipc_port_impcount_delta(
807 ipc_port_t port,
808 mach_port_delta_t delta,
809 ipc_port_t base);
810
811/* apply importance delta to port, and return task importance for update */
812extern boolean_t
813ipc_port_importance_delta_internal(
814 ipc_port_t port,
815 natural_t options,
816 mach_port_delta_t *deltap,
817 ipc_importance_task_t *imp_task);
818
819/* Apply an importance delta to a port and reflect change in receiver task */
820extern boolean_t
821ipc_port_importance_delta(
822 ipc_port_t port,
823 natural_t options,
824 mach_port_delta_t delta);
825#endif /* IMPORTANCE_INHERITANCE */
826
827/*!
828 * @function ipc_port_make_send_any_locked()
829 *
830 * @brief
831 * Makes a naked send right for a locked and active port.
832 *
833 * @decription
834 * @c ipc_port_make_send_*() should not be used in any generic IPC
835 * plumbing, as this is an operation that subsystem owners need
836 * to be able to synchronize against with the make-send-count
837 * and no-senders notifications.
838 *
839 * It is especially important for kobject types, and in general MIG upcalls
840 * or replies from the kernel should never use MAKE_SEND dispositions,
841 * and prefer COPY_SEND or MOVE_SEND, so that subsystems can control
842 * where that send right comes from.
843 *
844 * This function doesn't perform any validation on the type of port,
845 * this duty is left to the caller.
846 *
847 * @param port An active and locked port.
848 */
849extern ipc_port_t ipc_port_make_send_any_locked(
850 ipc_port_t port);
851
852/*!
853 * @function ipc_port_make_send_any()
854 *
855 * @brief
856 * Makes a naked send right for the specified port.
857 *
858 * @decription
859 * @see ipc_port_make_send_any_locked() for a general warning about
860 * making send rights.
861 *
862 * This function doesn't perform any validation on the type of port,
863 * this duty is left to the caller.
864 *
865 * Using @c ipc_port_make_send_mqueue() or @c ipc_kobject_make_send()
866 * is preferred.
867 *
868 * @param port The target port.
869 *
870 * @returns
871 * - IP_DEAD if @c port was dead.
872 * - @c port if @c port was valid, in which case
873 * a naked send right was made.
874 */
875extern ipc_port_t ipc_port_make_send_any(
876 ipc_port_t port) __result_use_check;
877
878/*!
879 * @function ipc_port_make_send_mqueue()
880 *
881 * @brief
882 * Makes a naked send right for the specified port.
883 *
884 * @decription
885 * @see ipc_port_make_send_any_locked() for a general warning about
886 * making send rights.
887 *
888 * This function will return IP_NULL if the port wasn't a message queue.
889 *
890 * This avoids confusions where kobject ports are being set in places
891 * where the system expects message queues.
892 *
893 * @param port The target port.
894 *
895 * @returns
896 * - IP_NULL if @c port was not a message queue port
897 * (IKOT_NONE, or IKOT_TIMER), or @c port was IP_NULL.
898 * - IP_DEAD if @c port was dead.
899 * - @c port if @c port was valid, in which case
900 * a naked send right was made.
901 */
902extern ipc_port_t ipc_port_make_send_mqueue(
903 ipc_port_t port) __result_use_check;
904
905/*!
906 * @function ipc_port_copy_send_any_locked()
907 *
908 * @brief
909 * Copies a naked send right for a locked and active port.
910 *
911 * @decription
912 * This function doesn't perform any validation on the type of port,
913 * this duty is left to the caller.
914 *
915 * @param port An active and locked port.
916 */
917extern void ipc_port_copy_send_any_locked(
918 ipc_port_t port);
919
920/*!
921 * @function ipc_port_make_send_any()
922 *
923 * @brief
924 * Copies a naked send right for the specified port.
925 *
926 * @decription
927 * This function doesn't perform any validation on the type of port,
928 * this duty is left to the caller.
929 *
930 * Using @c ipc_port_copy_send_mqueue() or @c ipc_kobject_copy_send()
931 * is preferred.
932 *
933 * @param port The target port.
934 *
935 * @returns
936 * - IP_DEAD if @c port was dead.
937 * - @c port if @c port was valid, in which case
938 * a naked send right was made.
939 */
940extern ipc_port_t ipc_port_copy_send_any(
941 ipc_port_t port) __result_use_check;
942
943/*!
944 * @function ipc_port_copy_send_mqueue()
945 *
946 * @brief
947 * Copies a naked send right for the specified port.
948 *
949 * @decription
950 * This function will return IP_NULL if the port wasn't a message queue.
951 *
952 * This avoids confusions where kobject ports are being set in places
953 * where the system expects message queues.
954 *
955 * @param port The target port.
956 *
957 * @returns
958 * - IP_NULL if @c port was not a message queue port
959 * (IKOT_NONE, or IKOT_TIMER), or @c port was IP_NULL.
960 * - IP_DEAD if @c port was dead.
961 * - @c port if @c port was valid, in which case
962 * a naked send right was made.
963 */
964extern ipc_port_t ipc_port_copy_send_mqueue(
965 ipc_port_t port) __result_use_check;
966
967/* Copyout a naked send right */
968extern mach_port_name_t ipc_port_copyout_send(
969 ipc_port_t sright,
970 ipc_space_t space);
971
972extern mach_port_name_t ipc_port_copyout_send_pinned(
973 ipc_port_t sright,
974 ipc_space_t space);
975
976extern void ipc_port_thread_group_blocked(
977 ipc_port_t port);
978
979extern void ipc_port_thread_group_unblocked(void);
980
981extern void ipc_port_release_send_and_unlock(
982 ipc_port_t port);
983#endif /* MACH_KERNEL_PRIVATE */
984
985#if KERNEL_PRIVATE
986
987/* Release a (valid) naked send right */
988extern void ipc_port_release_send(
989 ipc_port_t port);
990
991extern void ipc_port_reference(
992 ipc_port_t port);
993
994extern void ipc_port_release(
995 ipc_port_t port);
996
997struct thread_attr_for_ipc_propagation {
998 union {
999 struct {
1000 uint64_t tafip_iotier:2,
1001 tafip_qos:3;
1002 };
1003 uint64_t tafip_value;
1004 };
1005 uint64_t tafip_reserved;
1006};
1007
1008extern kern_return_t
1009ipc_port_propagate_thread_attr(
1010 ipc_port_t port,
1011 struct thread_attr_for_ipc_propagation attr);
1012
1013extern kern_return_t
1014ipc_port_reset_thread_attr(ipc_port_t port);
1015#endif /* KERNEL_PRIVATE */
1016
1017#ifdef MACH_KERNEL_PRIVATE
1018
1019/* Make a naked send-once right from a locked and active receive right */
1020extern ipc_port_t ipc_port_make_sonce_locked(
1021 ipc_port_t port);
1022
1023/* Make a naked send-once right from a receive right */
1024extern ipc_port_t ipc_port_make_sonce(
1025 ipc_port_t port);
1026
1027/* Release a naked send-once right */
1028extern void ipc_port_release_sonce(
1029 ipc_port_t port);
1030
1031/* Release a naked send-once right */
1032extern void ipc_port_release_sonce_and_unlock(
1033 ipc_port_t port);
1034
1035/* Release a naked (in limbo or in transit) receive right */
1036extern void ipc_port_release_receive(
1037 ipc_port_t port);
1038
1039/* Finalize the destruction of a port before it gets freed */
1040extern void ipc_port_finalize(
1041 ipc_port_t port);
1042
1043/* Get receiver task and its pid (if any) for port. Assumes port is locked. */
1044extern pid_t ipc_port_get_receiver_task_locked(ipc_port_t port, uintptr_t *task);
1045
1046/* Get receiver task and its pid (if any) for port. */
1047extern pid_t ipc_port_get_receiver_task(ipc_port_t port, uintptr_t *task);
1048
1049/* Allocate a port in a special space */
1050extern ipc_port_t ipc_port_alloc_special(
1051 ipc_space_t space,
1052 ipc_port_init_flags_t flags);
1053
1054/* Deallocate a port in a special space */
1055extern void ipc_port_dealloc_special_and_unlock(
1056 ipc_port_t port,
1057 ipc_space_t space);
1058
1059/* Deallocate a port in a special space */
1060extern void ipc_port_dealloc_special(
1061 ipc_port_t port,
1062 ipc_space_t space);
1063
1064extern void ipc_port_recv_update_inheritor(ipc_port_t port,
1065 struct turnstile *turnstile,
1066 turnstile_update_flags_t flags);
1067
1068extern void ipc_port_send_update_inheritor(ipc_port_t port,
1069 struct turnstile *turnstile,
1070 turnstile_update_flags_t flags);
1071
1072extern int
1073ipc_special_reply_get_pid_locked(ipc_port_t port);
1074
1075#define ipc_port_alloc_reply() \
1076 ipc_port_alloc_special(ipc_space_reply, IPC_PORT_INIT_MESSAGE_QUEUE | IPC_PORT_INIT_SPECIAL_REPLY)
1077#define ipc_port_dealloc_reply(port) \
1078 ipc_port_dealloc_special((port), ipc_space_reply)
1079
1080#endif /* MACH_KERNEL_PRIVATE */
1081
1082#endif /* _IPC_IPC_PORT_H_ */
1083