]> git.saurik.com Git - apple/xnu.git/blame - osfmk/ipc/mach_msg.c
xnu-6153.61.1.tar.gz
[apple/xnu.git] / osfmk / ipc / mach_msg.c
CommitLineData
1c79356b 1/*
2d21ac55 2 * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
1c79356b 3 *
2d21ac55 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
0a7de745 5 *
2d21ac55
A
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
0a7de745 14 *
2d21ac55
A
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
0a7de745 17 *
2d21ac55
A
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
8f6c56a5
A
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
2d21ac55
A
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
0a7de745 25 *
2d21ac55 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
1c79356b
A
27 */
28/*
29 * @OSF_COPYRIGHT@
30 */
0a7de745 31/*
1c79356b
A
32 * Mach Operating System
33 * Copyright (c) 1991,1990,1989 Carnegie Mellon University
34 * All Rights Reserved.
0a7de745 35 *
1c79356b
A
36 * Permission to use, copy, modify and distribute this software and its
37 * documentation is hereby granted, provided that both the copyright
38 * notice and this permission notice appear in all copies of the
39 * software, derivative works or modified versions, and any portions
40 * thereof, and that both notices appear in supporting documentation.
0a7de745 41 *
1c79356b
A
42 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
0a7de745 45 *
1c79356b 46 * Carnegie Mellon requests users of this software to return to
0a7de745 47 *
1c79356b
A
48 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU
49 * School of Computer Science
50 * Carnegie Mellon University
51 * Pittsburgh PA 15213-3890
0a7de745 52 *
1c79356b
A
53 * any improvements or extensions that they make and grant Carnegie Mellon
54 * the rights to redistribute these changes.
55 */
2d21ac55
A
56/*
57 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
58 * support for mandatory and extensible security protections. This notice
59 * is included in support of clause 2.2 (b) of the Apple Public License,
60 * Version 2.0.
61 * Copyright (c) 2005 SPARTA, Inc.
62 */
1c79356b
A
63/*
64 */
65/*
66 * File: ipc/mach_msg.c
67 * Author: Rich Draves
68 * Date: 1989
69 *
70 * Exported message traps. See mach/message.h.
71 */
72
91447636 73#include <mach/mach_types.h>
1c79356b
A
74#include <mach/kern_return.h>
75#include <mach/port.h>
76#include <mach/message.h>
77#include <mach/mig_errors.h>
91447636
A
78#include <mach/mach_traps.h>
79
80#include <kern/kern_types.h>
1c79356b
A
81#include <kern/assert.h>
82#include <kern/counters.h>
83#include <kern/cpu_number.h>
91447636
A
84#include <kern/ipc_kobject.h>
85#include <kern/ipc_mig.h>
1c79356b
A
86#include <kern/task.h>
87#include <kern/thread.h>
1c79356b
A
88#include <kern/sched_prim.h>
89#include <kern/exception.h>
90#include <kern/misc_protos.h>
91447636
A
91#include <kern/kalloc.h>
92#include <kern/processor.h>
93#include <kern/syscall_subr.h>
5ba3f43e 94#include <kern/policy_internal.h>
91447636 95
1c79356b 96#include <vm/vm_map.h>
91447636 97
d9a64523 98#include <ipc/port.h>
91447636 99#include <ipc/ipc_types.h>
1c79356b
A
100#include <ipc/ipc_kmsg.h>
101#include <ipc/ipc_mqueue.h>
102#include <ipc/ipc_object.h>
103#include <ipc/ipc_notify.h>
104#include <ipc/ipc_port.h>
105#include <ipc/ipc_pset.h>
106#include <ipc/ipc_space.h>
107#include <ipc/ipc_entry.h>
fe8ab488 108#include <ipc/ipc_importance.h>
490019cf 109#include <ipc/ipc_voucher.h>
0b4e3aa0 110
1c79356b 111#include <machine/machine_routines.h>
2d21ac55 112#include <security/mac_mach_internal.h>
91447636 113
1c79356b
A
114#include <sys/kdebug.h>
115
91447636
A
116#ifndef offsetof
117#define offsetof(type, member) ((size_t)(&((type *)0)->member))
118#endif /* offsetof */
119
1c79356b 120/*
91447636 121 * Forward declarations - kernel internal routines
1c79356b
A
122 */
123
124mach_msg_return_t mach_msg_send(
0a7de745
A
125 mach_msg_header_t *msg,
126 mach_msg_option_t option,
127 mach_msg_size_t send_size,
128 mach_msg_timeout_t send_timeout,
129 mach_port_name_t notify);
1c79356b
A
130
131mach_msg_return_t mach_msg_receive(
0a7de745
A
132 mach_msg_header_t *msg,
133 mach_msg_option_t option,
134 mach_msg_size_t rcv_size,
135 mach_port_name_t rcv_name,
136 mach_msg_timeout_t rcv_timeout,
137 void (*continuation)(mach_msg_return_t),
138 mach_msg_size_t slist_size);
1c79356b
A
139
140
141mach_msg_return_t msg_receive_error(
0a7de745
A
142 ipc_kmsg_t kmsg,
143 mach_msg_option_t option,
144 mach_vm_address_t rcv_addr,
145 mach_msg_size_t rcv_size,
146 mach_port_seqno_t seqno,
147 ipc_space_t space,
148 mach_msg_size_t *out_size);
1c79356b 149
5ba3f43e
A
150static mach_msg_return_t
151mach_msg_rcv_link_special_reply_port(
152 ipc_port_t special_reply_port,
153 mach_port_name_t dest_name_port);
154
d9a64523
A
155void
156mach_msg_receive_results_complete(ipc_object_t object);
5ba3f43e 157
cb323159
A
158const security_token_t KERNEL_SECURITY_TOKEN = KERNEL_SECURITY_TOKEN_VALUE;
159const audit_token_t KERNEL_AUDIT_TOKEN = KERNEL_AUDIT_TOKEN_VALUE;
1c79356b
A
160
161mach_msg_format_0_trailer_t trailer_template = {
162 /* mach_msg_trailer_type_t */ MACH_MSG_TRAILER_FORMAT_0,
163 /* mach_msg_trailer_size_t */ MACH_MSG_TRAILER_MINIMUM_SIZE,
0a7de745
A
164 /* mach_port_seqno_t */ 0,
165 /* security_token_t */ KERNEL_SECURITY_TOKEN_VALUE
1c79356b
A
166};
167
168/*
39236c6e 169 * Routine: mach_msg_send [Kernel Internal]
1c79356b 170 * Purpose:
39236c6e
A
171 * Routine for kernel-task threads to send a message.
172 *
173 * Unlike mach_msg_send_from_kernel(), this routine
174 * looks port names up in the kernel's port namespace
175 * and copies in the kernel virtual memory (instead
176 * of taking a vm_map_copy_t pointer for OOL descriptors).
1c79356b
A
177 * Conditions:
178 * Nothing locked.
179 * Returns:
180 * MACH_MSG_SUCCESS Sent the message.
181 * MACH_SEND_MSG_TOO_SMALL Message smaller than a header.
182 * MACH_SEND_NO_BUFFER Couldn't allocate buffer.
183 * MACH_SEND_INVALID_DATA Couldn't copy message data.
184 * MACH_SEND_INVALID_HEADER
185 * Illegal value in the message header bits.
186 * MACH_SEND_INVALID_DEST The space is dead.
187 * MACH_SEND_INVALID_NOTIFY Bad notify port.
188 * MACH_SEND_INVALID_DEST Can't copyin destination port.
189 * MACH_SEND_INVALID_REPLY Can't copyin reply port.
190 * MACH_SEND_TIMED_OUT Timeout expired without delivery.
191 * MACH_SEND_INTERRUPTED Delivery interrupted.
1c79356b
A
192 */
193
194mach_msg_return_t
195mach_msg_send(
0a7de745
A
196 mach_msg_header_t *msg,
197 mach_msg_option_t option,
198 mach_msg_size_t send_size,
199 mach_msg_timeout_t send_timeout,
200 mach_msg_priority_t override)
1c79356b
A
201{
202 ipc_space_t space = current_space();
203 vm_map_t map = current_map();
204 ipc_kmsg_t kmsg;
205 mach_msg_return_t mr;
0a7de745
A
206 mach_msg_size_t msg_and_trailer_size;
207 mach_msg_max_trailer_t *trailer;
1c79356b 208
d9a64523
A
209 option |= MACH_SEND_KERNEL;
210
5ba3f43e
A
211 if ((send_size & 3) ||
212 send_size < sizeof(mach_msg_header_t) ||
0a7de745 213 (send_size < sizeof(mach_msg_base_t) && (msg->msgh_bits & MACH_MSGH_BITS_COMPLEX))) {
91447636 214 return MACH_SEND_MSG_TOO_SMALL;
0a7de745 215 }
1c79356b 216
0a7de745 217 if (send_size > MACH_MSG_SIZE_MAX - MAX_TRAILER_SIZE) {
8ad349bb 218 return MACH_SEND_TOO_LARGE;
0a7de745
A
219 }
220
221 KDBG(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_INFO) | DBG_FUNC_START);
39037602 222
91447636
A
223 msg_and_trailer_size = send_size + MAX_TRAILER_SIZE;
224
225 kmsg = ipc_kmsg_alloc(msg_and_trailer_size);
226
39037602 227 if (kmsg == IKM_NULL) {
0a7de745 228 KDBG(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_INFO) | DBG_FUNC_END, MACH_SEND_NO_BUFFER);
91447636 229 return MACH_SEND_NO_BUFFER;
39037602 230 }
91447636 231
0a7de745
A
232 KERNEL_DEBUG_CONSTANT(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_LINK) | DBG_FUNC_NONE,
233 (uintptr_t)0, /* this should only be called from the kernel! */
234 VM_KERNEL_ADDRPERM((uintptr_t)kmsg),
235 0, 0,
236 0);
91447636 237 (void) memcpy((void *) kmsg->ikm_header, (const void *) msg, send_size);
1c79356b 238
91447636
A
239 kmsg->ikm_header->msgh_size = send_size;
240
0a7de745 241 /*
91447636
A
242 * reserve for the trailer the largest space (MAX_TRAILER_SIZE)
243 * However, the internal size field of the trailer (msgh_trailer_size)
244 * is initialized to the minimum (sizeof(mach_msg_trailer_t)), to optimize
245 * the cases where no implicit data is requested.
246 */
247 trailer = (mach_msg_max_trailer_t *) ((vm_offset_t)kmsg->ikm_header + send_size);
248 trailer->msgh_sender = current_thread()->task->sec_token;
249 trailer->msgh_audit = current_thread()->task->audit_token;
250 trailer->msgh_trailer_type = MACH_MSG_TRAILER_FORMAT_0;
251 trailer->msgh_trailer_size = MACH_MSG_TRAILER_MINIMUM_SIZE;
39236c6e 252
39037602 253 mr = ipc_kmsg_copyin(kmsg, space, map, override, &option);
39236c6e 254
1c79356b
A
255 if (mr != MACH_MSG_SUCCESS) {
256 ipc_kmsg_free(kmsg);
0a7de745 257 KDBG(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_INFO) | DBG_FUNC_END, mr);
1c79356b
A
258 return mr;
259 }
260
39236c6e
A
261 mr = ipc_kmsg_send(kmsg, option, send_timeout);
262
1c79356b 263 if (mr != MACH_MSG_SUCCESS) {
0a7de745
A
264 mr |= ipc_kmsg_copyout_pseudo(kmsg, space, map, MACH_MSG_BODY_NULL);
265 (void) memcpy((void *) msg, (const void *) kmsg->ikm_header,
266 kmsg->ikm_header->msgh_size);
267 ipc_kmsg_free(kmsg);
268 KDBG(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_INFO) | DBG_FUNC_END, mr);
1c79356b
A
269 }
270
271 return mr;
272}
273
0a7de745 274/*
39236c6e
A
275 * message header as seen at user-space
276 * (for MACH_RCV_LARGE/IDENTITY updating)
277 */
0a7de745
A
278typedef struct{
279 mach_msg_bits_t msgh_bits;
280 mach_msg_size_t msgh_size;
281 mach_port_name_t msgh_remote_port;
282 mach_port_name_t msgh_local_port;
283 mach_msg_size_t msgh_reserved;
284 mach_msg_id_t msgh_id;
39236c6e
A
285} mach_msg_user_header_t;
286
1c79356b 287/*
6d2010ae 288 * Routine: mach_msg_receive_results
1c79356b
A
289 * Purpose:
290 * Receive a message.
291 * Conditions:
292 * Nothing locked.
293 * Returns:
294 * MACH_MSG_SUCCESS Received a message.
295 * MACH_RCV_INVALID_NAME The name doesn't denote a right,
296 * or the denoted right is not receive or port set.
297 * MACH_RCV_IN_SET Receive right is a member of a set.
298 * MACH_RCV_TOO_LARGE Message wouldn't fit into buffer.
299 * MACH_RCV_TIMED_OUT Timeout expired without a message.
300 * MACH_RCV_INTERRUPTED Reception interrupted.
301 * MACH_RCV_PORT_DIED Port/set died while receiving.
302 * MACH_RCV_PORT_CHANGED Port moved into set while receiving.
303 * MACH_RCV_INVALID_DATA Couldn't copy to user buffer.
304 * MACH_RCV_INVALID_NOTIFY Bad notify port.
305 * MACH_RCV_HEADER_ERROR
306 */
307
308mach_msg_return_t
39037602
A
309mach_msg_receive_results(
310 mach_msg_size_t *sizep)
1c79356b
A
311{
312 thread_t self = current_thread();
313 ipc_space_t space = current_space();
316670eb 314 vm_map_t map = current_map();
1c79356b
A
315
316 ipc_object_t object = self->ith_object;
317 mach_msg_return_t mr = self->ith_state;
39037602
A
318 mach_vm_address_t rcv_addr = self->ith_msg_addr;
319 mach_msg_size_t rcv_size = self->ith_rsize;
1c79356b
A
320 mach_msg_option_t option = self->ith_option;
321 ipc_kmsg_t kmsg = self->ith_kmsg;
322 mach_port_seqno_t seqno = self->ith_seqno;
39037602 323
316670eb 324 mach_msg_trailer_size_t trailer_size;
39037602 325 mach_msg_size_t size = 0;
1c79356b 326
d9a64523
A
327 /*
328 * unlink the special_reply_port before releasing reference to object.
329 * get the thread's turnstile, if the thread donated it's turnstile to the port
330 */
331 mach_msg_receive_results_complete(object);
316670eb 332 io_release(object);
1c79356b
A
333
334 if (mr != MACH_MSG_SUCCESS) {
39037602 335 if (mr == MACH_RCV_TOO_LARGE) {
39037602
A
336 /*
337 * If the receive operation occurs with MACH_RCV_LARGE set
338 * then no message was extracted from the queue, and the size
339 * and (optionally) receiver names were the only thing captured.
340 * Just copyout the size (and optional port name) in a fake
341 * header.
342 */
343 if (option & MACH_RCV_LARGE) {
39037602
A
344 if ((option & MACH_RCV_STACK) == 0 &&
345 rcv_size >= offsetof(mach_msg_user_header_t, msgh_reserved)) {
39037602
A
346 /*
347 * We need to inform the user-level code that it needs more
348 * space. The value for how much space was returned in the
349 * msize save area instead of the message (which was left on
350 * the queue).
351 */
352 if (option & MACH_RCV_LARGE_IDENTITY) {
353 if (copyout((char *) &self->ith_receiver_name,
0a7de745
A
354 rcv_addr + offsetof(mach_msg_user_header_t, msgh_local_port),
355 sizeof(mach_port_name_t))) {
39037602 356 mr = MACH_RCV_INVALID_DATA;
0a7de745 357 }
39037602
A
358 }
359 if (copyout((char *) &self->ith_msize,
0a7de745
A
360 rcv_addr + offsetof(mach_msg_user_header_t, msgh_size),
361 sizeof(mach_msg_size_t))) {
39037602 362 mr = MACH_RCV_INVALID_DATA;
0a7de745 363 }
39037602
A
364 }
365 } else {
39037602
A
366 /* discard importance in message */
367 ipc_importance_clean(kmsg);
368
369 if (msg_receive_error(kmsg, option, rcv_addr, rcv_size, seqno, space, &size)
0a7de745 370 == MACH_RCV_INVALID_DATA) {
39037602 371 mr = MACH_RCV_INVALID_DATA;
0a7de745 372 }
39037602
A
373 }
374 }
375
0a7de745 376 if (sizep) {
39037602 377 *sizep = size;
0a7de745 378 }
39037602 379 return mr;
1c79356b
A
380 }
381
39037602
A
382 /* MACH_MSG_SUCCESS */
383
39236c6e 384#if IMPORTANCE_INHERITANCE
39236c6e 385
fe8ab488
A
386 /* adopt/transform any importance attributes carried in the message */
387 ipc_importance_receive(kmsg, option);
388
39236c6e
A
389#endif /* IMPORTANCE_INHERITANCE */
390
490019cf
A
391 /* auto redeem the voucher in the message */
392 ipc_voucher_receive_postprocessing(kmsg, option);
393
0a7de745
A
394 trailer_size = ipc_kmsg_add_trailer(kmsg, space, option, self, seqno, FALSE,
395 kmsg->ikm_header->msgh_remote_port->ip_context);
396
3e170ce0 397 mr = ipc_kmsg_copyout(kmsg, space, map, MACH_MSG_BODY_NULL, option);
1c79356b
A
398
399 if (mr != MACH_MSG_SUCCESS) {
fe8ab488
A
400 /* already received importance, so have to undo that here */
401 ipc_importance_unreceive(kmsg, option);
402
39037602 403 /* if we had a body error copyout what we have, otherwise a simple header/trailer */
0a7de745
A
404 if ((mr & ~MACH_MSG_MASK) == MACH_RCV_BODY_ERROR) {
405 if (ipc_kmsg_put(kmsg, option, rcv_addr, rcv_size, trailer_size, &size) == MACH_RCV_INVALID_DATA) {
1c79356b 406 mr = MACH_RCV_INVALID_DATA;
0a7de745 407 }
39037602 408 } else {
0a7de745
A
409 if (msg_receive_error(kmsg, option, rcv_addr, rcv_size, seqno, space, &size)
410 == MACH_RCV_INVALID_DATA) {
1c79356b 411 mr = MACH_RCV_INVALID_DATA;
0a7de745 412 }
1c79356b 413 }
fe8ab488 414 } else {
39037602
A
415 /* capture ksmg QoS values to the thread continuation state */
416 self->ith_qos = kmsg->ikm_qos;
417 self->ith_qos_override = kmsg->ikm_qos_override;
418 mr = ipc_kmsg_put(kmsg, option, rcv_addr, rcv_size, trailer_size, &size);
1c79356b 419 }
fe8ab488 420
0a7de745 421 if (sizep) {
39037602 422 *sizep = size;
0a7de745 423 }
1c79356b
A
424 return mr;
425}
426
39236c6e
A
427/*
428 * Routine: mach_msg_receive [Kernel Internal]
429 * Purpose:
430 * Routine for kernel-task threads to actively receive a message.
431 *
432 * Unlike being dispatched to by ipc_kobject_server() or the
433 * reply part of mach_msg_rpc_from_kernel(), this routine
434 * looks up the receive port name in the kernel's port
d9a64523 435 * namespace and copies out received port rights to that namespace
39236c6e
A
436 * as well. Out-of-line memory is copied out the kernel's
437 * address space (rather than just providing the vm_map_copy_t).
438 * Conditions:
439 * Nothing locked.
440 * Returns:
441 * MACH_MSG_SUCCESS Received a message.
442 * See <mach/message.h> for list of MACH_RCV_XXX errors.
443 */
1c79356b
A
444mach_msg_return_t
445mach_msg_receive(
0a7de745
A
446 mach_msg_header_t *msg,
447 mach_msg_option_t option,
448 mach_msg_size_t rcv_size,
449 mach_port_name_t rcv_name,
450 mach_msg_timeout_t rcv_timeout,
451 void (*continuation)(mach_msg_return_t),
3e170ce0 452 __unused mach_msg_size_t slist_size)
1c79356b
A
453{
454 thread_t self = current_thread();
455 ipc_space_t space = current_space();
1c79356b
A
456 ipc_object_t object;
457 ipc_mqueue_t mqueue;
1c79356b 458 mach_msg_return_t mr;
1c79356b
A
459
460 mr = ipc_mqueue_copyin(space, rcv_name, &mqueue, &object);
0a7de745 461 if (mr != MACH_MSG_SUCCESS) {
1c79356b
A
462 return mr;
463 }
464 /* hold ref for object */
465
91447636 466 self->ith_msg_addr = CAST_DOWN(mach_vm_address_t, msg);
1c79356b 467 self->ith_object = object;
39037602
A
468 self->ith_rsize = rcv_size;
469 self->ith_msize = 0;
1c79356b 470 self->ith_option = option;
1c79356b 471 self->ith_continuation = continuation;
5ba3f43e 472 self->ith_knote = ITH_KNOTE_NULL;
1c79356b 473
91447636 474 ipc_mqueue_receive(mqueue, option, rcv_size, rcv_timeout, THREAD_ABORTSAFE);
0a7de745 475 if ((option & MACH_RCV_TIMEOUT) && rcv_timeout == 0) {
91447636 476 thread_poll_yield(self);
0a7de745 477 }
39037602 478 return mach_msg_receive_results(NULL);
1c79356b
A
479}
480
481void
482mach_msg_receive_continue(void)
483{
39037602 484 mach_msg_return_t mr;
1c79356b
A
485 thread_t self = current_thread();
486
0a7de745 487 if (self->ith_state == MACH_PEEK_READY) {
39037602 488 mr = MACH_PEEK_READY;
0a7de745 489 } else {
39037602 490 mr = mach_msg_receive_results(NULL);
0a7de745 491 }
39037602 492 (*self->ith_continuation)(mr);
1c79356b
A
493}
494
1c79356b
A
495
496/*
497 * Routine: mach_msg_overwrite_trap [mach trap]
498 * Purpose:
499 * Possibly send a message; possibly receive a message.
500 * Conditions:
501 * Nothing locked.
502 * Returns:
503 * All of mach_msg_send and mach_msg_receive error codes.
504 */
505
506mach_msg_return_t
507mach_msg_overwrite_trap(
91447636 508 struct mach_msg_overwrite_trap_args *args)
1c79356b 509{
0a7de745
A
510 mach_vm_address_t msg_addr = args->msg;
511 mach_msg_option_t option = args->option;
512 mach_msg_size_t send_size = args->send_size;
513 mach_msg_size_t rcv_size = args->rcv_size;
514 mach_port_name_t rcv_name = args->rcv_name;
515 mach_msg_timeout_t msg_timeout = args->timeout;
39037602 516 mach_msg_priority_t override = args->override;
0a7de745 517 mach_vm_address_t rcv_msg_addr = args->rcv_msg;
2d21ac55 518 __unused mach_port_seqno_t temp_seqno = 0;
91447636 519
1c79356b 520 mach_msg_return_t mr = MACH_MSG_SUCCESS;
b0d623f7 521 vm_map_t map = current_map();
39236c6e
A
522
523 /* Only accept options allowed by the user */
524 option &= MACH_MSG_OPTION_USER;
525
1c79356b 526 if (option & MACH_SEND_MSG) {
91447636 527 ipc_space_t space = current_space();
91447636
A
528 ipc_kmsg_t kmsg;
529
0a7de745 530 KDBG(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_INFO) | DBG_FUNC_START);
39037602 531
91447636
A
532 mr = ipc_kmsg_get(msg_addr, send_size, &kmsg);
533
39037602 534 if (mr != MACH_MSG_SUCCESS) {
0a7de745 535 KDBG(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_INFO) | DBG_FUNC_END, mr);
91447636 536 return mr;
39037602 537 }
91447636 538
0a7de745
A
539 KERNEL_DEBUG_CONSTANT(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_LINK) | DBG_FUNC_NONE,
540 (uintptr_t)msg_addr,
541 VM_KERNEL_ADDRPERM((uintptr_t)kmsg),
542 0, 0,
543 0);
39037602
A
544
545 mr = ipc_kmsg_copyin(kmsg, space, map, override, &option);
39236c6e 546
1c79356b 547 if (mr != MACH_MSG_SUCCESS) {
91447636 548 ipc_kmsg_free(kmsg);
0a7de745 549 KDBG(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_INFO) | DBG_FUNC_END, mr);
1c79356b
A
550 return mr;
551 }
91447636 552
39236c6e 553 mr = ipc_kmsg_send(kmsg, option, msg_timeout);
91447636
A
554
555 if (mr != MACH_MSG_SUCCESS) {
556 mr |= ipc_kmsg_copyout_pseudo(kmsg, space, map, MACH_MSG_BODY_NULL);
39037602 557 (void) ipc_kmsg_put(kmsg, option, msg_addr, send_size, 0, NULL);
0a7de745 558 KDBG(MACHDBG_CODE(DBG_MACH_IPC, MACH_IPC_KMSG_INFO) | DBG_FUNC_END, mr);
91447636
A
559 return mr;
560 }
1c79356b
A
561 }
562
563 if (option & MACH_RCV_MSG) {
91447636
A
564 thread_t self = current_thread();
565 ipc_space_t space = current_space();
566 ipc_object_t object;
567 ipc_mqueue_t mqueue;
568
569 mr = ipc_mqueue_copyin(space, rcv_name, &mqueue, &object);
570 if (mr != MACH_MSG_SUCCESS) {
571 return mr;
572 }
573 /* hold ref for object */
1c79356b 574
5ba3f43e
A
575 if ((option & MACH_RCV_SYNC_WAIT) && !(option & MACH_SEND_SYNC_OVERRIDE)) {
576 ipc_port_t special_reply_port;
cb323159 577 special_reply_port = ip_object_to_port(object);
5ba3f43e
A
578 /* link the special reply port to the destination */
579 mr = mach_msg_rcv_link_special_reply_port(special_reply_port,
0a7de745 580 (mach_port_name_t)override);
5ba3f43e
A
581 if (mr != MACH_MSG_SUCCESS) {
582 io_release(object);
583 return mr;
584 }
585 }
586
0a7de745 587 if (rcv_msg_addr != (mach_vm_address_t)0) {
91447636 588 self->ith_msg_addr = rcv_msg_addr;
0a7de745 589 } else {
91447636 590 self->ith_msg_addr = msg_addr;
0a7de745 591 }
91447636 592 self->ith_object = object;
39037602
A
593 self->ith_rsize = rcv_size;
594 self->ith_msize = 0;
91447636 595 self->ith_option = option;
b0d623f7 596 self->ith_receiver_name = MACH_PORT_NULL;
91447636 597 self->ith_continuation = thread_syscall_return;
5ba3f43e 598 self->ith_knote = ITH_KNOTE_NULL;
91447636
A
599
600 ipc_mqueue_receive(mqueue, option, rcv_size, msg_timeout, THREAD_ABORTSAFE);
0a7de745 601 if ((option & MACH_RCV_TIMEOUT) && msg_timeout == 0) {
91447636 602 thread_poll_yield(self);
0a7de745 603 }
39037602 604 return mach_msg_receive_results(NULL);
1c79356b
A
605 }
606
607 return MACH_MSG_SUCCESS;
608}
609
5ba3f43e
A
610/*
611 * Routine: mach_msg_rcv_link_special_reply_port
612 * Purpose:
613 * Link the special reply port(rcv right) to the
614 * other end of the sync ipc channel.
615 * Conditions:
616 * Nothing locked.
617 * Returns:
618 * None.
619 */
620static mach_msg_return_t
621mach_msg_rcv_link_special_reply_port(
622 ipc_port_t special_reply_port,
623 mach_port_name_t dest_name_port)
624{
625 ipc_port_t dest_port = IP_NULL;
626 kern_return_t kr;
5ba3f43e
A
627
628 if (current_thread()->ith_special_reply_port != special_reply_port) {
629 return MACH_RCV_INVALID_NOTIFY;
630 }
631
632 /* Copyin the destination port */
633 if (!MACH_PORT_VALID(dest_name_port)) {
634 return MACH_RCV_INVALID_NOTIFY;
635 }
636
cb323159
A
637 kr = ipc_port_translate_send(current_space(), dest_name_port, &dest_port);
638 if (kr == KERN_SUCCESS) {
639 ip_reference(dest_port);
640 ip_unlock(dest_port);
5ba3f43e 641
cb323159
A
642 /*
643 * The receive right of dest port might have gone away,
644 * do not fail the receive in that case.
645 */
d9a64523 646 ipc_port_link_special_reply_port(special_reply_port,
cb323159 647 dest_port, FALSE);
5ba3f43e 648
cb323159 649 ip_release(dest_port);
5ba3f43e
A
650 }
651 return MACH_MSG_SUCCESS;
652}
653
654/*
d9a64523 655 * Routine: mach_msg_receive_results_complete
5ba3f43e 656 * Purpose:
d9a64523
A
657 * Get thread's turnstile back from the object and
658 * if object is a special reply port then reset its
659 * linkage.
5ba3f43e
A
660 * Condition:
661 * Nothing locked.
662 * Returns:
663 * None.
664 */
d9a64523
A
665void
666mach_msg_receive_results_complete(ipc_object_t object)
5ba3f43e
A
667{
668 thread_t self = current_thread();
d9a64523 669 ipc_port_t port = IPC_PORT_NULL;
94ff46dc 670 boolean_t get_turnstile = (self->turnstile == TURNSTILE_NULL);
5ba3f43e 671
d9a64523 672 if (io_otype(object) == IOT_PORT) {
cb323159 673 port = ip_object_to_port(object);
d9a64523
A
674 } else {
675 assert(self->turnstile != TURNSTILE_NULL);
5ba3f43e
A
676 return;
677 }
678
d9a64523
A
679 uint8_t flags = IPC_PORT_ADJUST_SR_ALLOW_SYNC_LINKAGE;
680
681 /*
682 * Don't clear the ip_srp_msg_sent bit if...
683 */
684 if (!((self->ith_state == MACH_RCV_TOO_LARGE && self->ith_option & MACH_RCV_LARGE) || //msg was too large and the next receive will get it
0a7de745
A
685 self->ith_state == MACH_RCV_INTERRUPTED ||
686 self->ith_state == MACH_RCV_TIMED_OUT ||
687 self->ith_state == MACH_RCV_PORT_CHANGED ||
688 self->ith_state == MACH_PEEK_READY)) {
d9a64523
A
689 flags |= IPC_PORT_ADJUST_SR_RECEIVED_MSG;
690 }
691
94ff46dc
A
692 if (port->ip_specialreply || get_turnstile) {
693 ip_lock(port);
694 ipc_port_adjust_special_reply_port_locked(port, NULL,
695 flags, get_turnstile);
696 }
697 assert(self->turnstile != TURNSTILE_NULL);
d9a64523 698 /* thread now has a turnstile */
5ba3f43e
A
699}
700
9bccf70c
A
701/*
702 * Routine: mach_msg_trap [mach trap]
703 * Purpose:
704 * Possibly send a message; possibly receive a message.
705 * Conditions:
706 * Nothing locked.
707 * Returns:
708 * All of mach_msg_send and mach_msg_receive error codes.
709 */
710
711mach_msg_return_t
712mach_msg_trap(
91447636 713 struct mach_msg_overwrite_trap_args *args)
9bccf70c 714{
91447636
A
715 kern_return_t kr;
716 args->rcv_msg = (mach_vm_address_t)0;
717
0a7de745 718 kr = mach_msg_overwrite_trap(args);
91447636 719 return kr;
9bccf70c 720}
0a7de745 721
9bccf70c 722
1c79356b
A
723/*
724 * Routine: msg_receive_error [internal]
725 * Purpose:
726 * Builds a minimal header/trailer and copies it to
727 * the user message buffer. Invoked when in the case of a
728 * MACH_RCV_TOO_LARGE or MACH_RCV_BODY_ERROR error.
729 * Conditions:
730 * Nothing locked.
39037602
A
731 * size - maximum buffer size on input,
732 * actual copied-out size on output
1c79356b
A
733 * Returns:
734 * MACH_MSG_SUCCESS minimal header/trailer copied
735 * MACH_RCV_INVALID_DATA copyout to user buffer failed
736 */
0a7de745 737
1c79356b
A
738mach_msg_return_t
739msg_receive_error(
0a7de745
A
740 ipc_kmsg_t kmsg,
741 mach_msg_option_t option,
742 mach_vm_address_t rcv_addr,
743 mach_msg_size_t rcv_size,
744 mach_port_seqno_t seqno,
745 ipc_space_t space,
746 mach_msg_size_t *sizep)
1c79356b 747{
0a7de745 748 mach_vm_address_t context;
316670eb 749 mach_msg_trailer_size_t trailer_size;
0a7de745 750 mach_msg_max_trailer_t *trailer;
b0d623f7
A
751
752 context = kmsg->ikm_header->msgh_remote_port->ip_context;
1c79356b
A
753
754 /*
755 * Copy out the destination port in the message.
0a7de745 756 * Destroy all other rights and memory in the message.
1c79356b
A
757 */
758 ipc_kmsg_copyout_dest(kmsg, space);
759
760 /*
761 * Build a minimal message with the requested trailer.
762 */
0a7de745
A
763 trailer = (mach_msg_max_trailer_t *)
764 ((vm_offset_t)kmsg->ikm_header +
765 round_msg(sizeof(mach_msg_header_t)));
91447636 766 kmsg->ikm_header->msgh_size = sizeof(mach_msg_header_t);
0a7de745
A
767 bcopy((char *)&trailer_template,
768 (char *)trailer,
769 sizeof(trailer_template));
316670eb 770
0a7de745
A
771 trailer_size = ipc_kmsg_add_trailer(kmsg, space,
772 option, current_thread(), seqno,
773 TRUE, context);
1c79356b
A
774
775 /*
39037602
A
776 * Copy the message to user space and return the size
777 * (note that ipc_kmsg_put may also adjust the actual
778 * size copied out to user-space).
1c79356b 779 */
0a7de745
A
780 if (ipc_kmsg_put(kmsg, option, rcv_addr, rcv_size, trailer_size, sizep) == MACH_RCV_INVALID_DATA) {
781 return MACH_RCV_INVALID_DATA;
782 } else {
783 return MACH_MSG_SUCCESS;
784 }
1c79356b 785}