2 * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
32 * Mach Operating System
33 * Copyright (c) 1991,1990,1989 Carnegie Mellon University
34 * All Rights Reserved.
36 * Permission to use, copy, modify and distribute this software and its
37 * documentation is hereby granted, provided that both the copyright
38 * notice and this permission notice appear in all copies of the
39 * software, derivative works or modified versions, and any portions
40 * thereof, and that both notices appear in supporting documentation.
42 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
46 * Carnegie Mellon requests users of this software to return to
48 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU
49 * School of Computer Science
50 * Carnegie Mellon University
51 * Pittsburgh PA 15213-3890
53 * any improvements or extensions that they make and grant Carnegie Mellon
54 * the rights to redistribute these changes.
57 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
58 * support for mandatory and extensible security protections. This notice
59 * is included in support of clause 2.2 (b) of the Apple Public License,
61 * Copyright (c) 2005 SPARTA, Inc.
66 * File: ipc/mach_msg.c
70 * Exported message traps. See mach/message.h.
73 #include <mach/mach_types.h>
74 #include <mach/kern_return.h>
75 #include <mach/port.h>
76 #include <mach/message.h>
77 #include <mach/mig_errors.h>
78 #include <mach/mach_traps.h>
80 #include <kern/kern_types.h>
81 #include <kern/assert.h>
82 #include <kern/counters.h>
83 #include <kern/cpu_number.h>
84 #include <kern/ipc_kobject.h>
85 #include <kern/ipc_mig.h>
86 #include <kern/task.h>
87 #include <kern/thread.h>
88 #include <kern/lock.h>
89 #include <kern/sched_prim.h>
90 #include <kern/exception.h>
91 #include <kern/misc_protos.h>
92 #include <kern/kalloc.h>
93 #include <kern/processor.h>
94 #include <kern/syscall_subr.h>
96 #include <vm/vm_map.h>
98 #include <ipc/ipc_types.h>
99 #include <ipc/ipc_kmsg.h>
100 #include <ipc/ipc_mqueue.h>
101 #include <ipc/ipc_object.h>
102 #include <ipc/ipc_notify.h>
103 #include <ipc/ipc_port.h>
104 #include <ipc/ipc_pset.h>
105 #include <ipc/ipc_space.h>
106 #include <ipc/ipc_entry.h>
108 #include <machine/machine_routines.h>
109 #include <security/mac_mach_internal.h>
111 #include <sys/kdebug.h>
115 #define offsetof(type, member) ((size_t)(&((type *)0)->member))
116 #endif /* offsetof */
119 * Forward declarations - kernel internal routines
122 mach_msg_return_t
mach_msg_send(
123 mach_msg_header_t
*msg
,
124 mach_msg_option_t option
,
125 mach_msg_size_t send_size
,
126 mach_msg_timeout_t send_timeout
,
127 mach_port_name_t notify
);
129 mach_msg_return_t
mach_msg_receive(
130 mach_msg_header_t
*msg
,
131 mach_msg_option_t option
,
132 mach_msg_size_t rcv_size
,
133 mach_port_name_t rcv_name
,
134 mach_msg_timeout_t rcv_timeout
,
135 void (*continuation
)(mach_msg_return_t
),
136 mach_msg_size_t slist_size
);
139 mach_msg_return_t
msg_receive_error(
141 mach_vm_address_t msg_addr
,
142 mach_msg_option_t option
,
143 mach_port_seqno_t seqno
,
146 security_token_t KERNEL_SECURITY_TOKEN
= KERNEL_SECURITY_TOKEN_VALUE
;
147 audit_token_t KERNEL_AUDIT_TOKEN
= KERNEL_AUDIT_TOKEN_VALUE
;
149 mach_msg_format_0_trailer_t trailer_template
= {
150 /* mach_msg_trailer_type_t */ MACH_MSG_TRAILER_FORMAT_0
,
151 /* mach_msg_trailer_size_t */ MACH_MSG_TRAILER_MINIMUM_SIZE
,
152 /* mach_port_seqno_t */ 0,
153 /* security_token_t */ KERNEL_SECURITY_TOKEN_VALUE
157 * Routine: mach_msg_send
163 * MACH_MSG_SUCCESS Sent the message.
164 * MACH_SEND_MSG_TOO_SMALL Message smaller than a header.
165 * MACH_SEND_NO_BUFFER Couldn't allocate buffer.
166 * MACH_SEND_INVALID_DATA Couldn't copy message data.
167 * MACH_SEND_INVALID_HEADER
168 * Illegal value in the message header bits.
169 * MACH_SEND_INVALID_DEST The space is dead.
170 * MACH_SEND_INVALID_NOTIFY Bad notify port.
171 * MACH_SEND_INVALID_DEST Can't copyin destination port.
172 * MACH_SEND_INVALID_REPLY Can't copyin reply port.
173 * MACH_SEND_TIMED_OUT Timeout expired without delivery.
174 * MACH_SEND_INTERRUPTED Delivery interrupted.
175 * MACH_SEND_NO_NOTIFY Can't allocate a msg-accepted request.
176 * MACH_SEND_WILL_NOTIFY Msg-accepted notif. requested.
177 * MACH_SEND_NOTIFY_IN_PROGRESS
178 * This space has already forced a message to this port.
183 mach_msg_header_t
*msg
,
184 mach_msg_option_t option
,
185 mach_msg_size_t send_size
,
186 mach_msg_timeout_t send_timeout
,
187 mach_port_name_t notify
)
189 ipc_space_t space
= current_space();
190 vm_map_t map
= current_map();
192 mach_msg_return_t mr
;
193 mach_msg_size_t msg_and_trailer_size
;
194 mach_msg_max_trailer_t
*trailer
;
196 if ((send_size
< sizeof(mach_msg_header_t
)) || (send_size
& 3))
197 return MACH_SEND_MSG_TOO_SMALL
;
199 if (send_size
> MACH_MSG_SIZE_MAX
- MAX_TRAILER_SIZE
)
200 return MACH_SEND_TOO_LARGE
;
202 msg_and_trailer_size
= send_size
+ MAX_TRAILER_SIZE
;
204 kmsg
= ipc_kmsg_alloc(msg_and_trailer_size
);
206 if (kmsg
== IKM_NULL
)
207 return MACH_SEND_NO_BUFFER
;
209 (void) memcpy((void *) kmsg
->ikm_header
, (const void *) msg
, send_size
);
211 kmsg
->ikm_header
->msgh_size
= send_size
;
214 * reserve for the trailer the largest space (MAX_TRAILER_SIZE)
215 * However, the internal size field of the trailer (msgh_trailer_size)
216 * is initialized to the minimum (sizeof(mach_msg_trailer_t)), to optimize
217 * the cases where no implicit data is requested.
219 trailer
= (mach_msg_max_trailer_t
*) ((vm_offset_t
)kmsg
->ikm_header
+ send_size
);
220 trailer
->msgh_sender
= current_thread()->task
->sec_token
;
221 trailer
->msgh_audit
= current_thread()->task
->audit_token
;
222 trailer
->msgh_trailer_type
= MACH_MSG_TRAILER_FORMAT_0
;
223 trailer
->msgh_trailer_size
= MACH_MSG_TRAILER_MINIMUM_SIZE
;
225 if (option
& MACH_SEND_CANCEL
) {
226 if (notify
== MACH_PORT_NULL
)
227 mr
= MACH_SEND_INVALID_NOTIFY
;
229 mr
= ipc_kmsg_copyin(kmsg
, space
, map
, notify
);
231 mr
= ipc_kmsg_copyin(kmsg
, space
, map
, MACH_PORT_NULL
);
232 if (mr
!= MACH_MSG_SUCCESS
) {
237 mr
= ipc_kmsg_send(kmsg
, option
& MACH_SEND_TIMEOUT
, send_timeout
);
239 if (mr
!= MACH_MSG_SUCCESS
) {
240 mr
|= ipc_kmsg_copyout_pseudo(kmsg
, space
, map
, MACH_MSG_BODY_NULL
);
241 (void) memcpy((void *) msg
, (const void *) kmsg
->ikm_header
,
242 kmsg
->ikm_header
->msgh_size
);
250 * Routine: mach_msg_receive
256 * MACH_MSG_SUCCESS Received a message.
257 * MACH_RCV_INVALID_NAME The name doesn't denote a right,
258 * or the denoted right is not receive or port set.
259 * MACH_RCV_IN_SET Receive right is a member of a set.
260 * MACH_RCV_TOO_LARGE Message wouldn't fit into buffer.
261 * MACH_RCV_TIMED_OUT Timeout expired without a message.
262 * MACH_RCV_INTERRUPTED Reception interrupted.
263 * MACH_RCV_PORT_DIED Port/set died while receiving.
264 * MACH_RCV_PORT_CHANGED Port moved into set while receiving.
265 * MACH_RCV_INVALID_DATA Couldn't copy to user buffer.
266 * MACH_RCV_INVALID_NOTIFY Bad notify port.
267 * MACH_RCV_HEADER_ERROR
271 mach_msg_receive_results(void)
273 thread_t self
= current_thread();
274 ipc_space_t space
= current_space();
275 vm_map_t map
= current_map();
277 ipc_object_t object
= self
->ith_object
;
278 mach_msg_return_t mr
= self
->ith_state
;
279 mach_vm_address_t msg_addr
= self
->ith_msg_addr
;
280 mach_msg_option_t option
= self
->ith_option
;
281 ipc_kmsg_t kmsg
= self
->ith_kmsg
;
282 mach_port_seqno_t seqno
= self
->ith_seqno
;
284 mach_msg_max_trailer_t
*trailer
;
286 ipc_object_release(object
);
288 if (mr
!= MACH_MSG_SUCCESS
) {
290 if (mr
== MACH_RCV_TOO_LARGE
) {
291 if (option
& MACH_RCV_LARGE
) {
293 * We need to inform the user-level code that it needs more
294 * space. The value for how much space was returned in the
295 * msize save area instead of the message (which was left on
298 if (copyout((char *) &self
->ith_msize
,
299 msg_addr
+ offsetof(mach_msg_header_t
, msgh_size
),
300 sizeof(mach_msg_size_t
)))
301 mr
= MACH_RCV_INVALID_DATA
;
305 if (msg_receive_error(kmsg
, msg_addr
, option
, seqno
, space
)
306 == MACH_RCV_INVALID_DATA
)
307 mr
= MACH_RCV_INVALID_DATA
;
312 trailer
= (mach_msg_max_trailer_t
*)
313 ((vm_offset_t
)kmsg
->ikm_header
+
314 round_msg(kmsg
->ikm_header
->msgh_size
));
315 if (option
& MACH_RCV_TRAILER_MASK
) {
316 trailer
->msgh_seqno
= seqno
;
317 trailer
->msgh_context
=
318 kmsg
->ikm_header
->msgh_remote_port
->ip_context
;
319 trailer
->msgh_trailer_size
= REQUESTED_TRAILER_SIZE(option
);
321 if (MACH_RCV_TRAILER_ELEMENTS(option
) >=
322 MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_AV
)){
324 if (kmsg
->ikm_sender
!= NULL
&&
325 IP_VALID(kmsg
->ikm_header
->msgh_remote_port
) &&
326 mac_port_check_method(kmsg
->ikm_sender
,
327 &kmsg
->ikm_sender
->maclabel
,
328 &kmsg
->ikm_header
->msgh_remote_port
->ip_label
,
329 kmsg
->ikm_header
->msgh_id
) == 0)
330 trailer
->msgh_ad
= 1;
333 trailer
->msgh_ad
= 0;
337 * The ipc_kmsg_t holds a reference to the label of a label
338 * handle, not the port. We must get a reference to the port
339 * and a send right to copyout to the receiver.
342 if (option
& MACH_RCV_TRAILER_ELEMENTS (MACH_RCV_TRAILER_LABELS
)) {
344 if (kmsg
->ikm_sender
!= NULL
) {
345 ipc_labelh_t lh
= kmsg
->ikm_sender
->label
;
348 ip_lock(lh
->lh_port
);
349 lh
->lh_port
->ip_mscount
++;
350 lh
->lh_port
->ip_srights
++;
351 ip_reference(lh
->lh_port
);
352 ip_unlock(lh
->lh_port
);
354 kr
= ipc_object_copyout(space
, (ipc_object_t
)lh
->lh_port
,
355 MACH_MSG_TYPE_PORT_SEND
, 0,
356 &trailer
->msgh_labels
.sender
);
357 if (kr
!= KERN_SUCCESS
) {
358 ip_lock(lh
->lh_port
);
359 ip_release(lh
->lh_port
);
360 ip_check_unlock(lh
->lh_port
);
362 trailer
->msgh_labels
.sender
= 0;
365 trailer
->msgh_labels
.sender
= 0;
368 trailer
->msgh_labels
.sender
= 0;
374 * If MACH_RCV_OVERWRITE was specified, try to get the scatter
375 * list and verify it against the contents of the message. If
376 * there is any problem with it, we will continue without it as
379 if (option
& MACH_RCV_OVERWRITE
) {
380 mach_msg_size_t slist_size
= self
->ith_scatter_list_size
;
381 mach_msg_body_t
*slist
;
383 slist
= ipc_kmsg_get_scatter(msg_addr
, slist_size
, kmsg
);
384 mr
= ipc_kmsg_copyout(kmsg
, space
, map
, MACH_PORT_NULL
, slist
);
385 ipc_kmsg_free_scatter(slist
, slist_size
);
387 mr
= ipc_kmsg_copyout(kmsg
, space
, map
,
388 MACH_PORT_NULL
, MACH_MSG_BODY_NULL
);
391 if (mr
!= MACH_MSG_SUCCESS
) {
392 if ((mr
&~ MACH_MSG_MASK
) == MACH_RCV_BODY_ERROR
) {
393 if (ipc_kmsg_put(msg_addr
, kmsg
, kmsg
->ikm_header
->msgh_size
+
394 trailer
->msgh_trailer_size
) == MACH_RCV_INVALID_DATA
)
395 mr
= MACH_RCV_INVALID_DATA
;
398 if (msg_receive_error(kmsg
, msg_addr
, option
, seqno
, space
)
399 == MACH_RCV_INVALID_DATA
)
400 mr
= MACH_RCV_INVALID_DATA
;
404 mr
= ipc_kmsg_put(msg_addr
,
406 kmsg
->ikm_header
->msgh_size
+
407 trailer
->msgh_trailer_size
);
414 mach_msg_header_t
*msg
,
415 mach_msg_option_t option
,
416 mach_msg_size_t rcv_size
,
417 mach_port_name_t rcv_name
,
418 mach_msg_timeout_t rcv_timeout
,
419 void (*continuation
)(mach_msg_return_t
),
420 mach_msg_size_t slist_size
)
422 thread_t self
= current_thread();
423 ipc_space_t space
= current_space();
426 mach_msg_return_t mr
;
428 mr
= ipc_mqueue_copyin(space
, rcv_name
, &mqueue
, &object
);
429 if (mr
!= MACH_MSG_SUCCESS
) {
432 /* hold ref for object */
434 self
->ith_msg_addr
= CAST_DOWN(mach_vm_address_t
, msg
);
435 self
->ith_object
= object
;
436 self
->ith_msize
= rcv_size
;
437 self
->ith_option
= option
;
438 self
->ith_scatter_list_size
= slist_size
;
439 self
->ith_continuation
= continuation
;
441 ipc_mqueue_receive(mqueue
, option
, rcv_size
, rcv_timeout
, THREAD_ABORTSAFE
);
442 if ((option
& MACH_RCV_TIMEOUT
) && rcv_timeout
== 0)
443 thread_poll_yield(self
);
444 return mach_msg_receive_results();
448 mach_msg_receive_continue(void)
450 thread_t self
= current_thread();
452 (*self
->ith_continuation
)(mach_msg_receive_results());
457 * Routine: mach_msg_overwrite_trap [mach trap]
459 * Possibly send a message; possibly receive a message.
463 * All of mach_msg_send and mach_msg_receive error codes.
467 mach_msg_overwrite_trap(
468 struct mach_msg_overwrite_trap_args
*args
)
470 mach_vm_address_t msg_addr
= args
->msg
;
471 mach_msg_option_t option
= args
->option
;
472 mach_msg_size_t send_size
= args
->send_size
;
473 mach_msg_size_t rcv_size
= args
->rcv_size
;
474 mach_port_name_t rcv_name
= args
->rcv_name
;
475 mach_msg_timeout_t msg_timeout
= args
->timeout
;
476 mach_port_name_t notify
= args
->notify
;
477 mach_vm_address_t rcv_msg_addr
= args
->rcv_msg
;
478 mach_msg_size_t scatter_list_size
= 0; /* NOT INITIALIZED - but not used in pactice */
479 __unused mach_port_seqno_t temp_seqno
= 0;
481 mach_msg_return_t mr
= MACH_MSG_SUCCESS
;
482 vm_map_t map
= current_map();
484 if (option
& MACH_SEND_MSG
) {
485 ipc_space_t space
= current_space();
488 mr
= ipc_kmsg_get(msg_addr
, send_size
, &kmsg
);
490 if (mr
!= MACH_MSG_SUCCESS
)
493 if (option
& MACH_SEND_CANCEL
) {
494 if (notify
== MACH_PORT_NULL
)
495 mr
= MACH_SEND_INVALID_NOTIFY
;
497 mr
= ipc_kmsg_copyin(kmsg
, space
, map
, notify
);
499 mr
= ipc_kmsg_copyin(kmsg
, space
, map
, MACH_PORT_NULL
);
500 if (mr
!= MACH_MSG_SUCCESS
) {
505 mr
= ipc_kmsg_send(kmsg
, option
& MACH_SEND_TIMEOUT
, msg_timeout
);
507 if (mr
!= MACH_MSG_SUCCESS
) {
508 mr
|= ipc_kmsg_copyout_pseudo(kmsg
, space
, map
, MACH_MSG_BODY_NULL
);
509 (void) ipc_kmsg_put(msg_addr
, kmsg
, kmsg
->ikm_header
->msgh_size
);
515 if (option
& MACH_RCV_MSG
) {
516 thread_t self
= current_thread();
517 ipc_space_t space
= current_space();
521 mr
= ipc_mqueue_copyin(space
, rcv_name
, &mqueue
, &object
);
522 if (mr
!= MACH_MSG_SUCCESS
) {
525 /* hold ref for object */
528 * 1. MACH_RCV_OVERWRITE is on, and rcv_msg is our scatter list
530 * 2. MACH_RCV_OVERWRITE is off, and rcv_msg might be the
531 * alternate receive buffer (separate send and receive buffers).
533 if (option
& MACH_RCV_OVERWRITE
)
534 self
->ith_msg_addr
= rcv_msg_addr
;
535 else if (rcv_msg_addr
!= (mach_vm_address_t
)0)
536 self
->ith_msg_addr
= rcv_msg_addr
;
538 self
->ith_msg_addr
= msg_addr
;
539 self
->ith_object
= object
;
540 self
->ith_msize
= rcv_size
;
541 self
->ith_option
= option
;
542 self
->ith_scatter_list_size
= scatter_list_size
;
543 self
->ith_receiver_name
= MACH_PORT_NULL
;
544 self
->ith_continuation
= thread_syscall_return
;
546 ipc_mqueue_receive(mqueue
, option
, rcv_size
, msg_timeout
, THREAD_ABORTSAFE
);
547 if ((option
& MACH_RCV_TIMEOUT
) && msg_timeout
== 0)
548 thread_poll_yield(self
);
549 return mach_msg_receive_results();
552 return MACH_MSG_SUCCESS
;
556 * Routine: mach_msg_trap [mach trap]
558 * Possibly send a message; possibly receive a message.
562 * All of mach_msg_send and mach_msg_receive error codes.
567 struct mach_msg_overwrite_trap_args
*args
)
570 args
->rcv_msg
= (mach_vm_address_t
)0;
572 kr
= mach_msg_overwrite_trap(args
);
578 * Routine: msg_receive_error [internal]
580 * Builds a minimal header/trailer and copies it to
581 * the user message buffer. Invoked when in the case of a
582 * MACH_RCV_TOO_LARGE or MACH_RCV_BODY_ERROR error.
586 * MACH_MSG_SUCCESS minimal header/trailer copied
587 * MACH_RCV_INVALID_DATA copyout to user buffer failed
593 mach_vm_address_t msg_addr
,
594 mach_msg_option_t option
,
595 mach_port_seqno_t seqno
,
598 mach_msg_max_trailer_t
*trailer
;
599 mach_vm_address_t context
;
601 context
= kmsg
->ikm_header
->msgh_remote_port
->ip_context
;
604 * Copy out the destination port in the message.
605 * Destroy all other rights and memory in the message.
607 ipc_kmsg_copyout_dest(kmsg
, space
);
610 * Build a minimal message with the requested trailer.
612 trailer
= (mach_msg_max_trailer_t
*)
613 ((vm_offset_t
)kmsg
->ikm_header
+
614 round_msg(sizeof(mach_msg_header_t
)));
615 kmsg
->ikm_header
->msgh_size
= sizeof(mach_msg_header_t
);
616 bcopy( (char *)&trailer_template
,
618 sizeof(trailer_template
));
619 if (option
& MACH_RCV_TRAILER_MASK
) {
620 trailer
->msgh_context
= context
;
621 trailer
->msgh_seqno
= seqno
;
622 trailer
->msgh_trailer_size
= REQUESTED_TRAILER_SIZE(option
);
626 * Copy the message to user space
628 if (ipc_kmsg_put(msg_addr
, kmsg
, kmsg
->ikm_header
->msgh_size
+
629 trailer
->msgh_trailer_size
) == MACH_RCV_INVALID_DATA
)
630 return(MACH_RCV_INVALID_DATA
);
632 return(MACH_MSG_SUCCESS
);