[apple/xnu.git] / osfmk / ipc / ipc_object.h

/*
 * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */
/*
 * @OSF_COPYRIGHT@
 */
/*
 * Mach Operating System
 * Copyright (c) 1991,1990,1989 Carnegie Mellon University
 * All Rights Reserved.
 *
 * Permission to use, copy, modify and distribute this software and its
 * documentation is hereby granted, provided that both the copyright
 * notice and this permission notice appear in all copies of the
 * software, derivative works or modified versions, and any portions
 * thereof, and that both notices appear in supporting documentation.
 *
 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
 * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
 *
 * Carnegie Mellon requests users of this software to return to
 *
 *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
 *  School of Computer Science
 *  Carnegie Mellon University
 *  Pittsburgh PA 15213-3890
 *
 * any improvements or extensions that they make and grant Carnegie Mellon
 * the rights to redistribute these changes.
 */
/*
 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
 * support for mandatory and extensible security protections.  This notice
 * is included in support of clause 2.2 (b) of the Apple Public License,
 * Version 2.0.
 */
/*
 */
/*
 *	File:	ipc/ipc_object.h
 *	Author:	Rich Draves
 *	Date:	1989
 *
 *	Definitions for IPC objects, for which tasks have capabilities.
 */

#ifndef _IPC_IPC_OBJECT_H_
#define _IPC_IPC_OBJECT_H_

#include <mach/kern_return.h>
#include <mach/message.h>
#include <kern/locks.h>
#include <kern/macro_help.h>
#include <kern/assert.h>
#include <kern/zalloc.h>
#include <ipc/ipc_types.h>
#include <libkern/OSAtomic.h>

typedef natural_t ipc_object_refs_t;    /* for ipc/ipc_object.h		*/
typedef natural_t ipc_object_bits_t;
typedef natural_t ipc_object_type_t;

/*
 * The ipc_object is used to both tag and reference count these two data
 * structures, and (Noto Bene!) pointers to either of these or the
 * ipc_object at the head of these are freely cast back and forth; hence
 * the ipc_object MUST BE FIRST in the ipc_common_data.
 *
 * If the RPC implementation enabled user-mode code to use kernel-level
 * data structures (as ours used to), this peculiar structuring would
 * avoid having anything in user code depend on the kernel configuration
 * (with which lock size varies).
 */
struct ipc_object {
	ipc_object_bits_t io_bits;
	ipc_object_refs_t io_references;
	lck_spin_t        io_lock_data;
} __attribute__((aligned(8)));

/*
 * If another object type needs to participate in io_kotype()-based
 * dispatching, it must include a stub structure as the first
 * element
 */
struct ipc_object_header {
	ipc_object_bits_t io_bits;
#ifdef __LP64__
	natural_t         io_padding; /* pad to natural boundary */
#endif
};

/*
 * Legacy defines.  Should use IPC_OBJECT_NULL, etc...
 */
#define IO_NULL                 ((ipc_object_t) 0)
#define IO_DEAD                 ((ipc_object_t) ~0UL)
#define IO_VALID(io)            (((io) != IO_NULL) && ((io) != IO_DEAD))

/*
 *	IPC steals the high-order bits from the kotype to use
 *	for its own purposes.  This allows IPC to record facts
 *	about ports that aren't otherwise obvious from the
 *	existing port fields.  In particular, IPC can optionally
 *	mark a port for no more senders detection.  Any change
 *	to IO_BITS_PORT_INFO must be coordinated with bitfield
 *	definitions in ipc_port.h.
 */
#define IO_BITS_PORT_INFO       0x0000f000      /* stupid port tricks */
#define IO_BITS_KOTYPE          0x000003ff      /* used by the object */
#define IO_BITS_KOBJECT         0x00000800      /* port belongs to a kobject */
#define IO_BITS_KOLABEL         0x00000400      /* The kobject has a label */
#define IO_BITS_OTYPE           0x7fff0000      /* determines a zone */
#define IO_BITS_ACTIVE          0x80000000      /* is object alive? */

#define io_active(io)           (((io)->io_bits & IO_BITS_ACTIVE) != 0)

#define io_otype(io)            (((io)->io_bits & IO_BITS_OTYPE) >> 16)
#define io_kotype(io)           ((io)->io_bits & IO_BITS_KOTYPE)
#define io_is_kobject(io)       (((io)->io_bits & IO_BITS_KOBJECT) != IKOT_NONE)
#define io_is_kolabeled(io)     (((io)->io_bits & IO_BITS_KOLABEL) != 0)
#define io_makebits(active, otype, kotype)      \
	(((active) ? IO_BITS_ACTIVE : 0) | ((otype) << 16) | (kotype))

/*
 * Object types: ports, port sets, kernel-loaded ports
 */
#define IOT_PORT                0
#define IOT_PORT_SET            1
#define IOT_NUMBER              2               /* number of types used */

extern zone_t ipc_object_zones[IOT_NUMBER];
extern lck_grp_t        ipc_lck_grp;

#define io_alloc(otype)         \
	        ((ipc_object_t) zalloc(ipc_object_zones[(otype)]))

extern void     io_free(
	unsigned int    otype,
	ipc_object_t    object);

/*
 * Here we depend on the ipc_object being first within the kernel struct
 * (ipc_port and ipc_pset).
 */
#define io_lock_init(io) \
	lck_spin_init(&(io)->io_lock_data, &ipc_lck_grp, &ipc_lck_attr)
#define io_lock_destroy(io) \
	lck_spin_destroy(&(io)->io_lock_data, &ipc_lck_grp)
#define io_lock_held(io) \
	LCK_SPIN_ASSERT(&(io)->io_lock_data, LCK_ASSERT_OWNED)
#define io_lock_held_kdp(io) \
	kdp_lck_spin_is_acquired(&(io)->io_lock_data)
#define io_unlock(io) \
	lck_spin_unlock(&(io)->io_lock_data)

extern void io_lock(
	ipc_object_t io);
extern boolean_t io_lock_try(
	ipc_object_t io);

#define _VOLATILE_ volatile

/* Sanity check the ref count.  If it is 0, we may be doubly zfreeing.
 * If it is larger than max int, it has been corrupted or leaked,
 * probably by being modified into an address (this is architecture
 * dependent, but it's safe to assume there cannot really be max int
 * references unless some code is leaking the io_reference without leaking
 * object). Saturate the io_reference on release kernel if it reaches
 * max int to avoid use after free.
 *
 * NOTE: The 0 test alone will not catch double zfreeing of ipc_port
 * structs, because the io_references field is the first word of the struct,
 * and zfree modifies that to point to the next free zone element.
 */
#define IO_MAX_REFERENCES                                               \
	(unsigned)(~0 ^ (1U << (sizeof(int)*BYTE_SIZE - 1)))

static inline void
io_reference(ipc_object_t io)
{
	ipc_object_refs_t new_io_references;
	ipc_object_refs_t old_io_references;

	if ((io)->io_references == 0 ||
	    (io)->io_references >= IO_MAX_REFERENCES) {
		panic("%s: reference count %u is invalid\n", __func__, (io)->io_references);
	}

	do {
		old_io_references = (io)->io_references;
		new_io_references = old_io_references + 1;
		if (old_io_references == IO_MAX_REFERENCES) {
			break;
		}
	} while (OSCompareAndSwap(old_io_references, new_io_references,
	    &((io)->io_references)) == FALSE);
}


static inline void
io_release(ipc_object_t io)
{
	ipc_object_refs_t new_io_references;
	ipc_object_refs_t old_io_references;

	if ((io)->io_references == 0 ||
	    (io)->io_references >= IO_MAX_REFERENCES) {
		panic("%s: reference count %u is invalid\n", __func__, (io)->io_references);
	}

	do {
		old_io_references = (io)->io_references;
		new_io_references = old_io_references - 1;
		if (old_io_references == IO_MAX_REFERENCES) {
			break;
		}
	} while (OSCompareAndSwap(old_io_references, new_io_references,
	    &((io)->io_references)) == FALSE);

	/* If we just removed the last reference count */
	if (1 == old_io_references) {
		/* Free the object */
		io_free(io_otype((io)), (io));
	}
}

/*
 * Retrieve a label for use in a kernel call that takes a security
 * label as a parameter. If necessary, io_getlabel acquires internal
 * (not io_lock) locks, and io_unlocklabel releases them.
 */

struct label;
extern struct label *io_getlabel(ipc_object_t obj);
#define io_unlocklabel(obj)

/*
 * Exported interfaces
 */

/* Take a reference to an object */
extern void ipc_object_reference(
	ipc_object_t    object);

/* Release a reference to an object */
extern void ipc_object_release(
	ipc_object_t    object);

/* Look up an object in a space */
extern kern_return_t ipc_object_translate(
	ipc_space_t             space,
	mach_port_name_t        name,
	mach_port_right_t       right,
	ipc_object_t            *objectp);

/* Look up two objects in a space, locking them in the order described */
extern kern_return_t ipc_object_translate_two(
	ipc_space_t             space,
	mach_port_name_t        name1,
	mach_port_right_t       right1,
	ipc_object_t            *objectp1,
	mach_port_name_t        name2,
	mach_port_right_t       right2,
	ipc_object_t            *objectp2);

/* Validate an object as belonging to the correct zone */
extern void ipc_object_validate(
	ipc_object_t object);

/* Allocate a dead-name entry */
extern kern_return_t
ipc_object_alloc_dead(
	ipc_space_t             space,
	mach_port_name_t        *namep);

/*  Allocate a dead-name entry, with a specific name */
extern kern_return_t ipc_object_alloc_dead_name(
	ipc_space_t             space,
	mach_port_name_t        name);

/* Allocate an object */
extern kern_return_t ipc_object_alloc(
	ipc_space_t             space,
	ipc_object_type_t       otype,
	mach_port_type_t        type,
	mach_port_urefs_t       urefs,
	mach_port_name_t        *namep,
	ipc_object_t            *objectp);

/* Allocate an object, with a specific name */
extern kern_return_t ipc_object_alloc_name(
	ipc_space_t             space,
	ipc_object_type_t       otype,
	mach_port_type_t        type,
	mach_port_urefs_t       urefs,
	mach_port_name_t        name,
	ipc_object_t            *objectp);

/* Convert a send type name to a received type name */
extern mach_msg_type_name_t ipc_object_copyin_type(
	mach_msg_type_name_t    msgt_name);

/* Copyin a capability from a space */
extern kern_return_t ipc_object_copyin(
	ipc_space_t             space,
	mach_port_name_t        name,
	mach_msg_type_name_t    msgt_name,
	ipc_object_t            *objectp,
	mach_port_context_t     context,
	mach_msg_guard_flags_t  *guard_flags,
	uint32_t                kmsg_flags);

/* Copyin a naked capability from the kernel */
extern void ipc_object_copyin_from_kernel(
	ipc_object_t            object,
	mach_msg_type_name_t    msgt_name);

/* Destroy a naked capability */
extern void ipc_object_destroy(
	ipc_object_t            object,
	mach_msg_type_name_t    msgt_name);

/* Destroy a naked destination capability */
extern void ipc_object_destroy_dest(
	ipc_object_t            object,
	mach_msg_type_name_t    msgt_name);

/* Insert a send right into an object already in the current space */
extern kern_return_t ipc_object_insert_send_right(
	ipc_space_t             space,
	mach_port_name_t        name,
	mach_msg_type_name_t    msgt_name);

/* Copyout a capability, placing it into a space */
extern kern_return_t ipc_object_copyout(
	ipc_space_t             space,
	ipc_object_t            object,
	mach_msg_type_name_t    msgt_name,
	mach_port_context_t     *context,
	mach_msg_guard_flags_t  *guard_flags,
	mach_port_name_t        *namep);

/* Copyout a capability with a name, placing it into a space */
extern kern_return_t ipc_object_copyout_name(
	ipc_space_t             space,
	ipc_object_t            object,
	mach_msg_type_name_t    msgt_name,
	mach_port_name_t        name);

/* Translate/consume the destination right of a message */
extern void ipc_object_copyout_dest(
	ipc_space_t             space,
	ipc_object_t            object,
	mach_msg_type_name_t    msgt_name,
	mach_port_name_t        *namep);

#endif  /* _IPC_IPC_OBJECT_H_ */
Commit	Line	Data
1c79356b	1	/*
2d21ac55	2	* Copyright (c) 2000-2007 Apple Inc. All rights reserved.
1c79356b	3	*
2d21ac55	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
0a7de745	5	*
2d21ac55 A	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
0a7de745	14	*
2d21ac55 A	15	* Please obtain a copy of the License at
2d21ac55 A	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
0a7de745	17	*
2d21ac55 A	18	* The Original Code and all software distributed under the License are
2d21ac55 A	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
8f6c56a5 A	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
8f6c56a5 A	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
2d21ac55 A	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
0a7de745	25	*
2d21ac55	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
1c79356b A	27	*/
	28	/*
	29	* @OSF_COPYRIGHT@
	30	*/
0a7de745	31	/*
1c79356b A	32	* Mach Operating System
	33	* Copyright (c) 1991,1990,1989 Carnegie Mellon University
	34	* All Rights Reserved.
0a7de745	35	*
1c79356b A	36	* Permission to use, copy, modify and distribute this software and its
	37	* documentation is hereby granted, provided that both the copyright
	38	* notice and this permission notice appear in all copies of the
	39	* software, derivative works or modified versions, and any portions
	40	* thereof, and that both notices appear in supporting documentation.
0a7de745	41	*
1c79356b A	42	* CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
	43	* CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
	44	* ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
0a7de745	45	*
1c79356b	46	* Carnegie Mellon requests users of this software to return to
0a7de745	47	*
1c79356b A	48	* Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU
	49	* School of Computer Science
	50	* Carnegie Mellon University
	51	* Pittsburgh PA 15213-3890
0a7de745	52	*
1c79356b A	53	* any improvements or extensions that they make and grant Carnegie Mellon
	54	* the rights to redistribute these changes.
	55	*/
2d21ac55 A	56	/*
	57	* NOTICE: This file was modified by McAfee Research in 2004 to introduce
	58	* support for mandatory and extensible security protections. This notice
	59	* is included in support of clause 2.2 (b) of the Apple Public License,
	60	* Version 2.0.
	61	*/
1c79356b A	62	/*
	63	*/
	64	/*
	65	* File: ipc/ipc_object.h
	66	* Author: Rich Draves
	67	* Date: 1989
	68	*
	69	* Definitions for IPC objects, for which tasks have capabilities.
	70	*/
	71
0a7de745	72	#ifndef _IPC_IPC_OBJECT_H_
1c79356b A	73	#define _IPC_IPC_OBJECT_H_
1c79356b A	74
1c79356b A	75	#include <mach/kern_return.h>
1c79356b A	76	#include <mach/message.h>
fe8ab488	77	#include <kern/locks.h>
1c79356b	78	#include <kern/macro_help.h>
fe8ab488	79	#include <kern/assert.h>
1c79356b A	80	#include <kern/zalloc.h>
1c79356b A	81	#include <ipc/ipc_types.h>
316670eb	82	#include <libkern/OSAtomic.h>
1c79356b	83
0a7de745	84	typedef natural_t ipc_object_refs_t; /* for ipc/ipc_object.h */
1c79356b A	85	typedef natural_t ipc_object_bits_t;
	86	typedef natural_t ipc_object_type_t;
	87
	88	/*
1c79356b A	89	* The ipc_object is used to both tag and reference count these two data
	90	* structures, and (Noto Bene!) pointers to either of these or the
	91	* ipc_object at the head of these are freely cast back and forth; hence
	92	* the ipc_object MUST BE FIRST in the ipc_common_data.
0a7de745	93	*
1c79356b A	94	* If the RPC implementation enabled user-mode code to use kernel-level
	95	* data structures (as ours used to), this peculiar structuring would
	96	* avoid having anything in user code depend on the kernel configuration
	97	* (with which lock size varies).
	98	*/
	99	struct ipc_object {
b0d623f7	100	ipc_object_bits_t io_bits;
1c79356b	101	ipc_object_refs_t io_references;
cb323159 A	102	lck_spin_t io_lock_data;
cb323159 A	103	} __attribute__((aligned(8)));
b0d623f7 A	104
	105	/*
	106	* If another object type needs to participate in io_kotype()-based
	107	* dispatching, it must include a stub structure as the first
	108	* element
	109	*/
	110	struct ipc_object_header {
1c79356b	111	ipc_object_bits_t io_bits;
b0d623f7 A	112	#ifdef __LP64__
	113	natural_t io_padding; /* pad to natural boundary */
	114	#endif
1c79356b A	115	};
	116
	117	/*
	118	* Legacy defines. Should use IPC_OBJECT_NULL, etc...
	119	*/
0a7de745 A	120	#define IO_NULL ((ipc_object_t) 0)
	121	#define IO_DEAD ((ipc_object_t) ~0UL)
	122	#define IO_VALID(io) (((io) != IO_NULL) && ((io) != IO_DEAD))
1c79356b A	123
	124	/*
	125	* IPC steals the high-order bits from the kotype to use
	126	* for its own purposes. This allows IPC to record facts
	127	* about ports that aren't otherwise obvious from the
	128	* existing port fields. In particular, IPC can optionally
	129	* mark a port for no more senders detection. Any change
	130	* to IO_BITS_PORT_INFO must be coordinated with bitfield
	131	* definitions in ipc_port.h.
	132	*/
0a7de745	133	#define IO_BITS_PORT_INFO 0x0000f000 /* stupid port tricks */
ea3f0419	134	#define IO_BITS_KOTYPE 0x000003ff /* used by the object */
cb323159	135	#define IO_BITS_KOBJECT 0x00000800 /* port belongs to a kobject */
ea3f0419	136	#define IO_BITS_KOLABEL 0x00000400 /* The kobject has a label */
0a7de745 A	137	#define IO_BITS_OTYPE 0x7fff0000 /* determines a zone */
0a7de745 A	138	#define IO_BITS_ACTIVE 0x80000000 /* is object alive? */
1c79356b	139
0a7de745	140	#define io_active(io) (((io)->io_bits & IO_BITS_ACTIVE) != 0)
1c79356b	141
0a7de745 A	142	#define io_otype(io) (((io)->io_bits & IO_BITS_OTYPE) >> 16)
0a7de745 A	143	#define io_kotype(io) ((io)->io_bits & IO_BITS_KOTYPE)
cb323159	144	#define io_is_kobject(io) (((io)->io_bits & IO_BITS_KOBJECT) != IKOT_NONE)
ea3f0419	145	#define io_is_kolabeled(io) (((io)->io_bits & IO_BITS_KOLABEL) != 0)
0a7de745	146	#define io_makebits(active, otype, kotype) \
1c79356b A	147	(((active) ? IO_BITS_ACTIVE : 0) \| ((otype) << 16) \| (kotype))
	148
	149	/*
	150	* Object types: ports, port sets, kernel-loaded ports
	151	*/
0a7de745 A	152	#define IOT_PORT 0
	153	#define IOT_PORT_SET 1
	154	#define IOT_NUMBER 2 /* number of types used */
1c79356b A	155
1c79356b A	156	extern zone_t ipc_object_zones[IOT_NUMBER];
cb323159	157	extern lck_grp_t ipc_lck_grp;
1c79356b	158
0a7de745 A	159	#define io_alloc(otype) \
0a7de745 A	160	((ipc_object_t) zalloc(ipc_object_zones[(otype)]))
1c79356b	161
0a7de745 A	162	extern void io_free(
	163	unsigned int otype,
	164	ipc_object_t object);
1c79356b	165
1c79356b	166	/*
b0d623f7	167	* Here we depend on the ipc_object being first within the kernel struct
1c79356b A	168	* (ipc_port and ipc_pset).
1c79356b A	169	*/
1c79356b	170	#define io_lock_init(io) \
316670eb	171	lck_spin_init(&(io)->io_lock_data, &ipc_lck_grp, &ipc_lck_attr)
b0d623f7	172	#define io_lock_destroy(io) \
316670eb	173	lck_spin_destroy(&(io)->io_lock_data, &ipc_lck_grp)
cb323159 A	174	#define io_lock_held(io) \
cb323159 A	175	LCK_SPIN_ASSERT(&(io)->io_lock_data, LCK_ASSERT_OWNED)
813fb2f6 A	176	#define io_lock_held_kdp(io) \
813fb2f6 A	177	kdp_lck_spin_is_acquired(&(io)->io_lock_data)
0a7de745	178	#define io_unlock(io) \
316670eb	179	lck_spin_unlock(&(io)->io_lock_data)
1c79356b	180
cb323159 A	181	extern void io_lock(
	182	ipc_object_t io);
	183	extern boolean_t io_lock_try(
	184	ipc_object_t io);
	185
1c79356b	186	#define _VOLATILE_ volatile
1c79356b	187
1c79356b	188	/* Sanity check the ref count. If it is 0, we may be doubly zfreeing.
d190cdc3 A	189	* If it is larger than max int, it has been corrupted or leaked,
	190	* probably by being modified into an address (this is architecture
	191	* dependent, but it's safe to assume there cannot really be max int
	192	* references unless some code is leaking the io_reference without leaking
	193	* object). Saturate the io_reference on release kernel if it reaches
	194	* max int to avoid use after free.
1c79356b A	195	*
	196	* NOTE: The 0 test alone will not catch double zfreeing of ipc_port
	197	* structs, because the io_references field is the first word of the struct,
	198	* and zfree modifies that to point to the next free zone element.
	199	*/
0a7de745	200	#define IO_MAX_REFERENCES \
cb323159	201	(unsigned)(~0 ^ (1U << (sizeof(int)*BYTE_SIZE - 1)))
1c79356b	202
316670eb	203	static inline void
0a7de745 A	204	io_reference(ipc_object_t io)
0a7de745 A	205	{
d190cdc3 A	206	ipc_object_refs_t new_io_references;
	207	ipc_object_refs_t old_io_references;
	208
cb323159 A	209	if ((io)->io_references == 0 \|\|
	210	(io)->io_references >= IO_MAX_REFERENCES) {
	211	panic("%s: reference count %u is invalid\n", __func__, (io)->io_references);
	212	}
d190cdc3 A	213
	214	do {
	215	old_io_references = (io)->io_references;
	216	new_io_references = old_io_references + 1;
	217	if (old_io_references == IO_MAX_REFERENCES) {
	218	break;
	219	}
	220	} while (OSCompareAndSwap(old_io_references, new_io_references,
0a7de745	221	&((io)->io_references)) == FALSE);
316670eb A	222	}
	223
	224
	225	static inline void
0a7de745 A	226	io_release(ipc_object_t io)
0a7de745 A	227	{
d190cdc3 A	228	ipc_object_refs_t new_io_references;
	229	ipc_object_refs_t old_io_references;
	230
cb323159 A	231	if ((io)->io_references == 0 \|\|
	232	(io)->io_references >= IO_MAX_REFERENCES) {
	233	panic("%s: reference count %u is invalid\n", __func__, (io)->io_references);
	234	}
d190cdc3 A	235
	236	do {
	237	old_io_references = (io)->io_references;
	238	new_io_references = old_io_references - 1;
	239	if (old_io_references == IO_MAX_REFERENCES) {
	240	break;
	241	}
	242	} while (OSCompareAndSwap(old_io_references, new_io_references,
0a7de745	243	&((io)->io_references)) == FALSE);
d190cdc3	244
0a7de745	245	/* If we just removed the last reference count */
d190cdc3	246	if (1 == old_io_references) {
316670eb A	247	/* Free the object */
	248	io_free(io_otype((io)), (io));
	249	}
	250	}
1c79356b	251
d9a64523	252	/*
2d21ac55 A	253	* Retrieve a label for use in a kernel call that takes a security
	254	* label as a parameter. If necessary, io_getlabel acquires internal
	255	* (not io_lock) locks, and io_unlocklabel releases them.
	256	*/
	257
	258	struct label;
0a7de745	259	extern struct label *io_getlabel(ipc_object_t obj);
2d21ac55 A	260	#define io_unlocklabel(obj)
2d21ac55 A	261
1c79356b A	262	/*
	263	* Exported interfaces
	264	*/
	265
	266	/* Take a reference to an object */
	267	extern void ipc_object_reference(
0a7de745	268	ipc_object_t object);
1c79356b A	269
	270	/* Release a reference to an object */
	271	extern void ipc_object_release(
0a7de745	272	ipc_object_t object);
1c79356b A	273
	274	/* Look up an object in a space */
	275	extern kern_return_t ipc_object_translate(
0a7de745 A	276	ipc_space_t space,
	277	mach_port_name_t name,
	278	mach_port_right_t right,
	279	ipc_object_t *objectp);
1c79356b A	280
	281	/* Look up two objects in a space, locking them in the order described */
	282	extern kern_return_t ipc_object_translate_two(
0a7de745 A	283	ipc_space_t space,
	284	mach_port_name_t name1,
	285	mach_port_right_t right1,
	286	ipc_object_t *objectp1,
	287	mach_port_name_t name2,
	288	mach_port_right_t right2,
	289	ipc_object_t *objectp2);
1c79356b	290
cb323159 A	291	/* Validate an object as belonging to the correct zone */
	292	extern void ipc_object_validate(
	293	ipc_object_t object);
	294
1c79356b A	295	/* Allocate a dead-name entry */
	296	extern kern_return_t
	297	ipc_object_alloc_dead(
0a7de745 A	298	ipc_space_t space,
0a7de745 A	299	mach_port_name_t *namep);
1c79356b A	300
	301	/* Allocate a dead-name entry, with a specific name */
	302	extern kern_return_t ipc_object_alloc_dead_name(
0a7de745 A	303	ipc_space_t space,
0a7de745 A	304	mach_port_name_t name);
1c79356b A	305
	306	/* Allocate an object */
	307	extern kern_return_t ipc_object_alloc(
0a7de745 A	308	ipc_space_t space,
	309	ipc_object_type_t otype,
	310	mach_port_type_t type,
	311	mach_port_urefs_t urefs,
	312	mach_port_name_t *namep,
	313	ipc_object_t *objectp);
1c79356b A	314
	315	/* Allocate an object, with a specific name */
	316	extern kern_return_t ipc_object_alloc_name(
0a7de745 A	317	ipc_space_t space,
	318	ipc_object_type_t otype,
	319	mach_port_type_t type,
	320	mach_port_urefs_t urefs,
	321	mach_port_name_t name,
	322	ipc_object_t *objectp);
1c79356b A	323
	324	/* Convert a send type name to a received type name */
	325	extern mach_msg_type_name_t ipc_object_copyin_type(
0a7de745	326	mach_msg_type_name_t msgt_name);
1c79356b A	327
	328	/* Copyin a capability from a space */
	329	extern kern_return_t ipc_object_copyin(
0a7de745 A	330	ipc_space_t space,
	331	mach_port_name_t name,
	332	mach_msg_type_name_t msgt_name,
cb323159 A	333	ipc_object_t *objectp,
	334	mach_port_context_t context,
	335	mach_msg_guard_flags_t *guard_flags,
	336	uint32_t kmsg_flags);
1c79356b A	337
	338	/* Copyin a naked capability from the kernel */
	339	extern void ipc_object_copyin_from_kernel(
0a7de745 A	340	ipc_object_t object,
0a7de745 A	341	mach_msg_type_name_t msgt_name);
1c79356b A	342
	343	/* Destroy a naked capability */
	344	extern void ipc_object_destroy(
0a7de745 A	345	ipc_object_t object,
0a7de745 A	346	mach_msg_type_name_t msgt_name);
1c79356b	347
6d2010ae A	348	/* Destroy a naked destination capability */
6d2010ae A	349	extern void ipc_object_destroy_dest(
0a7de745 A	350	ipc_object_t object,
0a7de745 A	351	mach_msg_type_name_t msgt_name);
6d2010ae	352
cb323159 A	353	/* Insert a send right into an object already in the current space */
	354	extern kern_return_t ipc_object_insert_send_right(
	355	ipc_space_t space,
	356	mach_port_name_t name,
	357	mach_msg_type_name_t msgt_name);
	358
1c79356b A	359	/* Copyout a capability, placing it into a space */
1c79356b A	360	extern kern_return_t ipc_object_copyout(
0a7de745 A	361	ipc_space_t space,
	362	ipc_object_t object,
	363	mach_msg_type_name_t msgt_name,
cb323159 A	364	mach_port_context_t *context,
cb323159 A	365	mach_msg_guard_flags_t *guard_flags,
0a7de745	366	mach_port_name_t *namep);
1c79356b A	367
	368	/* Copyout a capability with a name, placing it into a space */
	369	extern kern_return_t ipc_object_copyout_name(
0a7de745 A	370	ipc_space_t space,
	371	ipc_object_t object,
	372	mach_msg_type_name_t msgt_name,
0a7de745	373	mach_port_name_t name);
1c79356b A	374
	375	/* Translate/consume the destination right of a message */
	376	extern void ipc_object_copyout_dest(
0a7de745 A	377	ipc_space_t space,
	378	ipc_object_t object,
	379	mach_msg_type_name_t msgt_name,
	380	mach_port_name_t *namep);
1c79356b	381
0a7de745	382	#endif /* _IPC_IPC_OBJECT_H_ */