osfmk/kern/ipc_kobject.c

   1 /*
   2  * Copyright (c) 2000-2016 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * @OSF_COPYRIGHT@
  30  */
  31 /*
  32  * Mach Operating System
  33  * Copyright (c) 1991,1990,1989 Carnegie Mellon University
  34  * All Rights Reserved.
  35  *
  36  * Permission to use, copy, modify and distribute this software and its
  37  * documentation is hereby granted, provided that both the copyright
  38  * notice and this permission notice appear in all copies of the
  39  * software, derivative works or modified versions, and any portions
  40  * thereof, and that both notices appear in supporting documentation.
  41  *
  42  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
  43  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
  44  * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
  45  *
  46  * Carnegie Mellon requests users of this software to return to
  47  *
  48  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
  49  *  School of Computer Science
  50  *  Carnegie Mellon University
  51  *  Pittsburgh PA 15213-3890
  52  *
  53  * any improvements or extensions that they make and grant Carnegie Mellon
  54  * the rights to redistribute these changes.
  55  */
  56 /*
  57  * NOTICE: This file was modified by McAfee Research in 2004 to introduce
  58  * support for mandatory and extensible security protections.  This notice
  59  * is included in support of clause 2.2 (b) of the Apple Public License,
  60  * Version 2.0.
  61  * Copyright (c) 2005 SPARTA, Inc.
  62  */
  63 /*
  64  */
  65 /*
  66  *      File:   kern/ipc_kobject.c
  67  *      Author: Rich Draves
  68  *      Date:   1989
  69  *
  70  *      Functions for letting a port represent a kernel object.
  71  */
  72
  73 #include <mach_debug.h>
  74 #include <mach_ipc_test.h>
  75 #include <mach/mig.h>
  76 #include <mach/port.h>
  77 #include <mach/kern_return.h>
  78 #include <mach/message.h>
  79 #include <mach/mig_errors.h>
  80 #include <mach/notify.h>
  81 #include <mach/ndr.h>
  82 #include <mach/vm_param.h>
  83
  84 #include <mach/mach_vm_server.h>
  85 #include <mach/mach_port_server.h>
  86 #include <mach/mach_host_server.h>
  87 #include <mach/host_priv_server.h>
  88 #include <mach/host_security_server.h>
  89 #include <mach/clock_server.h>
  90 #include <mach/clock_priv_server.h>
  91 #include <mach/lock_set_server.h>
  92 #include <mach/memory_object_control_server.h>
  93 #include <mach/memory_object_default_server.h>
  94 #include <mach/processor_server.h>
  95 #include <mach/processor_set_server.h>
  96 #include <mach/task_server.h>
  97 #include <mach/mach_voucher_server.h>
  98 #include <mach/mach_voucher_attr_control_server.h>
  99 #ifdef VM32_SUPPORT
 100 #include <mach/vm32_map_server.h>
 101 #endif
 102 #include <mach/thread_act_server.h>
 103
 104 #include <device/device_types.h>
 105 #include <device/device_server.h>
 106
 107 #include <UserNotification/UNDReplyServer.h>
 108
 109 #if     CONFIG_AUDIT
 110 #include <kern/audit_sessionport.h>
 111 #endif
 112
 113 #if     MACH_MACHINE_ROUTINES
 114 #include <machine/machine_routines.h>
 115 #endif  /* MACH_MACHINE_ROUTINES */
 116 #if     XK_PROXY
 117 #include <uk_xkern/xk_uproxy_server.h>
 118 #endif  /* XK_PROXY */
 119
 120 #include <kern/ipc_tt.h>
 121 #include <kern/ipc_mig.h>
 122 #include <kern/ipc_misc.h>
 123 #include <kern/ipc_kobject.h>
 124 #include <kern/host_notify.h>
 125 #include <kern/mk_timer.h>
 126 #include <kern/misc_protos.h>
 127 #include <ipc/ipc_kmsg.h>
 128 #include <ipc/ipc_port.h>
 129 #include <ipc/ipc_voucher.h>
 130 #include <kern/sync_sema.h>
 131 #include <kern/counters.h>
 132 #include <kern/work_interval.h>
 133
 134 #include <vm/vm_protos.h>
 135
 136 #include <security/mac_mach_internal.h>
 137
 138 extern char *proc_name_address(void *p);
 139 extern int proc_pid(void *p);
 140
 141 /*
 142  *      Routine:        ipc_kobject_notify
 143  *      Purpose:
 144  *              Deliver notifications to kobjects that care about them.
 145  */
 146 boolean_t
 147 ipc_kobject_notify(
 148         mach_msg_header_t *request_header,
 149         mach_msg_header_t *reply_header);
 150
 151 typedef struct {
 152         mach_msg_id_t num;
 153         mig_routine_t routine;
 154         int size;
 155 #if     MACH_COUNTERS
 156         mach_counter_t callcount;
 157 #endif
 158 } mig_hash_t;
 159
 160 #define MAX_MIG_ENTRIES 1031
 161 #define MIG_HASH(x) (x)
 162
 163 #ifndef max
 164 #define max(a,b)        (((a) > (b)) ? (a) : (b))
 165 #endif /* max */
 166
 167 static mig_hash_t mig_buckets[MAX_MIG_ENTRIES];
 168 static int mig_table_max_displ;
 169 static mach_msg_size_t mig_reply_size = sizeof(mig_reply_error_t);
 170
 171
 172
 173 const struct mig_subsystem *mig_e[] = {
 174         (const struct mig_subsystem *)&mach_vm_subsystem,
 175         (const struct mig_subsystem *)&mach_port_subsystem,
 176         (const struct mig_subsystem *)&mach_host_subsystem,
 177         (const struct mig_subsystem *)&host_priv_subsystem,
 178         (const struct mig_subsystem *)&host_security_subsystem,
 179         (const struct mig_subsystem *)&clock_subsystem,
 180         (const struct mig_subsystem *)&clock_priv_subsystem,
 181         (const struct mig_subsystem *)&processor_subsystem,
 182         (const struct mig_subsystem *)&processor_set_subsystem,
 183         (const struct mig_subsystem *)&is_iokit_subsystem,
 184         (const struct mig_subsystem *)&lock_set_subsystem,
 185         (const struct mig_subsystem *)&task_subsystem,
 186         (const struct mig_subsystem *)&thread_act_subsystem,
 187 #ifdef VM32_SUPPORT
 188         (const struct mig_subsystem *)&vm32_map_subsystem,
 189 #endif
 190         (const struct mig_subsystem *)&UNDReply_subsystem,
 191         (const struct mig_subsystem *)&mach_voucher_subsystem,
 192         (const struct mig_subsystem *)&mach_voucher_attr_control_subsystem,
 193
 194 #if     XK_PROXY
 195         (const struct mig_subsystem *)&do_uproxy_xk_uproxy_subsystem,
 196 #endif /* XK_PROXY */
 197 #if     MACH_MACHINE_ROUTINES
 198         (const struct mig_subsystem *)&MACHINE_SUBSYSTEM,
 199 #endif  /* MACH_MACHINE_ROUTINES */
 200 #if     MCMSG && iPSC860
 201         (const struct mig_subsystem *)&mcmsg_info_subsystem,
 202 #endif  /* MCMSG && iPSC860 */
 203 };
 204
 205 void
 206 mig_init(void)
 207 {
 208     unsigned int i, n = sizeof(mig_e)/sizeof(const struct mig_subsystem *);
 209     int howmany;
 210     mach_msg_id_t j, pos, nentry, range;
 211
 212     for (i = 0; i < n; i++) {
 213         range = mig_e[i]->end - mig_e[i]->start;
 214         if (!mig_e[i]->start || range < 0)
 215             panic("the msgh_ids in mig_e[] aren't valid!");
 216
 217         for  (j = 0; j < range; j++) {
 218           if (mig_e[i]->routine[j].stub_routine) {
 219             /* Only put real entries in the table */
 220             nentry = j + mig_e[i]->start;
 221             for (pos = MIG_HASH(nentry) % MAX_MIG_ENTRIES, howmany = 1;
 222                  mig_buckets[pos].num;
 223                  pos++, pos = pos % MAX_MIG_ENTRIES, howmany++) {
 224                  if (mig_buckets[pos].num == nentry) {
 225                         printf("message id = %d\n", nentry);
 226                         panic("multiple entries with the same msgh_id");
 227                  }
 228                  if (howmany == MAX_MIG_ENTRIES)
 229                        panic("the mig dispatch table is too small");
 230             }
 231
 232             mig_buckets[pos].num = nentry;
 233             mig_buckets[pos].routine = mig_e[i]->routine[j].stub_routine;
 234             if (mig_e[i]->routine[j].max_reply_msg)
 235                     mig_buckets[pos].size = mig_e[i]->routine[j].max_reply_msg;
 236             else
 237                     mig_buckets[pos].size = mig_e[i]->maxsize;
 238
 239             mig_table_max_displ = max(howmany, mig_table_max_displ);
 240           }
 241         }
 242     }
 243     printf("mig_table_max_displ = %d\n", mig_table_max_displ);
 244 }
 245
 246
 247 /*
 248  *      Routine:        ipc_kobject_server
 249  *      Purpose:
 250  *              Handle a message sent to the kernel.
 251  *              Generates a reply message.
 252  *              Version for Untyped IPC.
 253  *      Conditions:
 254  *              Nothing locked.
 255  */
 256
 257 ipc_kmsg_t
 258 ipc_kobject_server(
 259         ipc_kmsg_t      request,
 260         mach_msg_option_t __unused option)
 261 {
 262         mach_msg_size_t reply_size;
 263         ipc_kmsg_t reply;
 264         kern_return_t kr;
 265         ipc_port_t *destp;
 266         ipc_port_t  replyp = IPC_PORT_NULL;
 267         mach_msg_format_0_trailer_t *trailer;
 268         mig_hash_t *ptr;
 269         task_t task = TASK_NULL;
 270         uint32_t exec_token;
 271         boolean_t exec_token_changed = FALSE;
 272
 273         /*
 274          * Find out corresponding mig_hash entry if any
 275          */
 276         {
 277             int key = request->ikm_header->msgh_id;
 278             unsigned int i = (unsigned int)MIG_HASH(key);
 279             int max_iter = mig_table_max_displ;
 280
 281             do {
 282                 ptr = &mig_buckets[i++ % MAX_MIG_ENTRIES];
 283             } while (key != ptr->num && ptr->num && --max_iter);
 284
 285             if (!ptr->routine || key != ptr->num) {
 286                 ptr = (mig_hash_t *)0;
 287                 reply_size = mig_reply_size;
 288             } else {
 289                 reply_size = ptr->size;
 290 #if     MACH_COUNTER
 291                 ptr->callcount++;
 292 #endif
 293             }
 294         }
 295
 296         /* round up for trailer size */
 297         reply_size += MAX_TRAILER_SIZE;
 298         reply = ipc_kmsg_alloc(reply_size);
 299
 300         if (reply == IKM_NULL) {
 301                 printf("ipc_kobject_server: dropping request\n");
 302                 ipc_kmsg_trace_send(request, option);
 303                 ipc_kmsg_destroy(request);
 304                 return IKM_NULL;
 305         }
 306
 307         /*
 308          * Initialize reply message.
 309          */
 310         {
 311 #define InP     ((mach_msg_header_t *) request->ikm_header)
 312 #define OutP    ((mig_reply_error_t *) reply->ikm_header)
 313
 314             /*
 315              * MIG should really assure no data leakage -
 316              * but until it does, pessimistically zero the
 317              * whole reply buffer.
 318              */
 319             bzero((void *)OutP, reply_size);
 320
 321             OutP->NDR = NDR_record;
 322             OutP->Head.msgh_size = sizeof(mig_reply_error_t);
 323
 324             OutP->Head.msgh_bits =
 325                 MACH_MSGH_BITS_SET(MACH_MSGH_BITS_LOCAL(InP->msgh_bits), 0, 0, 0);
 326             OutP->Head.msgh_remote_port = InP->msgh_local_port;
 327             OutP->Head.msgh_local_port = MACH_PORT_NULL;
 328             OutP->Head.msgh_voucher_port = MACH_PORT_NULL;
 329             OutP->Head.msgh_id = InP->msgh_id + 100;
 330
 331 #undef  InP
 332 #undef  OutP
 333         }
 334
 335         /*
 336          * Find the routine to call, and call it
 337          * to perform the kernel function
 338          */
 339         ipc_kmsg_trace_send(request, option);
 340         {
 341             if (ptr) {
 342                 /*
 343                  * Check if the port is a task port, if its a task port then
 344                  * snapshot the task exec token before the mig routine call.
 345                  */
 346                 ipc_port_t port = request->ikm_header->msgh_remote_port;
 347                 if (IP_VALID(port) && ip_kotype(port) == IKOT_TASK) {
 348                         task = convert_port_to_task_with_exec_token(port, &exec_token);
 349                 }
 350
 351                 (*ptr->routine)(request->ikm_header, reply->ikm_header);
 352
 353                 /* Check if the exec token changed during the mig routine */
 354                 if (task != TASK_NULL) {
 355                         if (exec_token != task->exec_token) {
 356                                 exec_token_changed = TRUE;
 357                         }
 358                         task_deallocate(task);
 359                 }
 360
 361                 kernel_task->messages_received++;
 362             }
 363             else {
 364                 if (!ipc_kobject_notify(request->ikm_header, reply->ikm_header)){
 365 #if DEVELOPMENT || DEBUG
 366                     printf("ipc_kobject_server: bogus kernel message, id=%d\n",
 367                         request->ikm_header->msgh_id);
 368 #endif  /* DEVELOPMENT || DEBUG */
 369                     _MIG_MSGID_INVALID(request->ikm_header->msgh_id);
 370
 371                     ((mig_reply_error_t *) reply->ikm_header)->RetCode
 372                         = MIG_BAD_ID;
 373                 }
 374                 else
 375                   kernel_task->messages_received++;
 376             }
 377             kernel_task->messages_sent++;
 378         }
 379
 380         /*
 381          *      Destroy destination. The following code differs from
 382          *      ipc_object_destroy in that we release the send-once
 383          *      right instead of generating a send-once notification
 384          *      (which would bring us here again, creating a loop).
 385          *      It also differs in that we only expect send or
 386          *      send-once rights, never receive rights.
 387          *
 388          *      We set msgh_remote_port to IP_NULL so that the kmsg
 389          *      destroy routines don't try to destroy the port twice.
 390          */
 391         destp = (ipc_port_t *) &request->ikm_header->msgh_remote_port;
 392         switch (MACH_MSGH_BITS_REMOTE(request->ikm_header->msgh_bits)) {
 393                 case MACH_MSG_TYPE_PORT_SEND:
 394                     ipc_port_release_send(*destp);
 395                     break;
 396
 397                 case MACH_MSG_TYPE_PORT_SEND_ONCE:
 398                     ipc_port_release_sonce(*destp);
 399                     break;
 400
 401                 default:
 402                     panic("ipc_kobject_server: strange destination rights");
 403         }
 404         *destp = IP_NULL;
 405
 406         /*
 407          *      Destroy voucher.  The kernel MIG servers never take ownership
 408          *      of vouchers sent in messages.  Swallow any such rights here.
 409          */
 410         if (IP_VALID(request->ikm_voucher)) {
 411                 assert(MACH_MSG_TYPE_PORT_SEND ==
 412                        MACH_MSGH_BITS_VOUCHER(request->ikm_header->msgh_bits));
 413                 ipc_port_release_send(request->ikm_voucher);
 414                 request->ikm_voucher = IP_NULL;
 415         }
 416
 417         if (!(reply->ikm_header->msgh_bits & MACH_MSGH_BITS_COMPLEX) &&
 418            ((mig_reply_error_t *) reply->ikm_header)->RetCode != KERN_SUCCESS)
 419                 kr = ((mig_reply_error_t *) reply->ikm_header)->RetCode;
 420         else
 421                 kr = KERN_SUCCESS;
 422
 423         if ((kr == KERN_SUCCESS) || (kr == MIG_NO_REPLY)) {
 424                 /*
 425                  *      The server function is responsible for the contents
 426                  *      of the message.  The reply port right is moved
 427                  *      to the reply message, and we have deallocated
 428                  *      the destination port right, so we just need
 429                  *      to free the kmsg.
 430                  */
 431                 ipc_kmsg_free(request);
 432
 433         } else {
 434                 /*
 435                  *      The message contents of the request are intact.
 436                  *      Destroy everthing except the reply port right,
 437                  *      which is needed in the reply message.
 438                  */
 439                 request->ikm_header->msgh_local_port = MACH_PORT_NULL;
 440                 ipc_kmsg_destroy(request);
 441         }
 442
 443         replyp = (ipc_port_t)reply->ikm_header->msgh_remote_port;
 444
 445         if (kr == MIG_NO_REPLY) {
 446                 /*
 447                  *      The server function will send a reply message
 448                  *      using the reply port right, which it has saved.
 449                  */
 450
 451                 ipc_kmsg_free(reply);
 452
 453                 return IKM_NULL;
 454         } else if (!IP_VALID(replyp)) {
 455                 /*
 456                  *      Can't queue the reply message if the destination
 457                  *      (the reply port) isn't valid.
 458                  */
 459
 460                 ipc_kmsg_destroy(reply);
 461
 462                 return IKM_NULL;
 463         } else if (replyp->ip_receiver == ipc_space_kernel) {
 464                 /*
 465                  * Don't send replies to kobject kernel ports
 466                  */
 467 #if DEVELOPMENT || DEBUG
 468                 printf("%s: refusing to send reply to kobject %d port (id:%d)\n",
 469                        __func__, ip_kotype(replyp),
 470                        request->ikm_header->msgh_id);
 471 #endif  /* DEVELOPMENT || DEBUG */
 472                 ipc_kmsg_destroy(reply);
 473                 return IKM_NULL;
 474         }
 475
 476         /* Fail the MIG call if the task exec token changed during the call */
 477         if (kr == KERN_SUCCESS && exec_token_changed) {
 478                 /*
 479                  *      Create a new reply msg with error and destroy the old reply msg.
 480                  */
 481                 ipc_kmsg_t new_reply = ipc_kmsg_alloc(reply_size);
 482
 483                 if (new_reply == IKM_NULL) {
 484                         printf("ipc_kobject_server: dropping request\n");
 485                         ipc_kmsg_destroy(reply);
 486                         return IKM_NULL;
 487                 }
 488                 /*
 489                  *      Initialize the new reply message.
 490                  */
 491                 {
 492 #define OutP_new        ((mig_reply_error_t *) new_reply->ikm_header)
 493 #define OutP_old        ((mig_reply_error_t *) reply->ikm_header)
 494
 495                     bzero((void *)OutP_new, reply_size);
 496
 497                     OutP_new->NDR = OutP_old->NDR;
 498                     OutP_new->Head.msgh_size = sizeof(mig_reply_error_t);
 499                     OutP_new->Head.msgh_bits = OutP_old->Head.msgh_bits & ~MACH_MSGH_BITS_COMPLEX;
 500                     OutP_new->Head.msgh_remote_port = OutP_old->Head.msgh_remote_port;
 501                     OutP_new->Head.msgh_local_port = MACH_PORT_NULL;
 502                     OutP_new->Head.msgh_voucher_port = MACH_PORT_NULL;
 503                     OutP_new->Head.msgh_id = OutP_old->Head.msgh_id;
 504
 505                     /* Set the error as KERN_INVALID_TASK */
 506                     OutP_new->RetCode = KERN_INVALID_TASK;
 507
 508 #undef  OutP_new
 509 #undef  OutP_old
 510                 }
 511
 512                 /*
 513                  *      Destroy everything in reply except the reply port right,
 514                  *      which is needed in the new reply message.
 515                  */
 516                 reply->ikm_header->msgh_remote_port = MACH_PORT_NULL;
 517                 ipc_kmsg_destroy(reply);
 518
 519                 reply = new_reply;
 520         }
 521
 522         trailer = (mach_msg_format_0_trailer_t *)
 523                 ((vm_offset_t)reply->ikm_header + (int)reply->ikm_header->msgh_size);
 524
 525         trailer->msgh_sender = KERNEL_SECURITY_TOKEN;
 526         trailer->msgh_trailer_type = MACH_MSG_TRAILER_FORMAT_0;
 527         trailer->msgh_trailer_size = MACH_MSG_TRAILER_MINIMUM_SIZE;
 528
 529         return reply;
 530 }
 531
 532 /*
 533  *      Routine:        ipc_kobject_set
 534  *      Purpose:
 535  *              Make a port represent a kernel object of the given type.
 536  *              The caller is responsible for handling refs for the
 537  *              kernel object, if necessary.
 538  *      Conditions:
 539  *              Nothing locked.  The port must be active if setting
 540  *              a kobject linkage.  Clearing a linkage is OK on an
 541  *              inactive port.
 542  */
 543 void
 544 ipc_kobject_set(
 545         ipc_port_t                      port,
 546         ipc_kobject_t           kobject,
 547         ipc_kobject_type_t      type)
 548 {
 549         ip_lock(port);
 550         ipc_kobject_set_atomically(port, kobject, type);
 551         ip_unlock(port);
 552 }
 553
 554 void
 555 ipc_kobject_set_atomically(
 556         ipc_port_t                      port,
 557         ipc_kobject_t           kobject,
 558         ipc_kobject_type_t      type)
 559 {
 560         assert(type == IKOT_NONE || ip_active(port));
 561 #if     MACH_ASSERT
 562         port->ip_spares[2] = (port->ip_bits & IO_BITS_KOTYPE);
 563 #endif  /* MACH_ASSERT */
 564         port->ip_bits = (port->ip_bits &~ IO_BITS_KOTYPE) | type;
 565         port->ip_kobject = kobject;
 566 }
 567
 568 /*
 569  *      Routine:        ipc_kobject_destroy
 570  *      Purpose:
 571  *              Release any kernel object resources associated
 572  *              with the port, which is being destroyed.
 573  *
 574  *              This should only be needed when resources are
 575  *              associated with a user's port.  In the normal case,
 576  *              when the kernel is the receiver, the code calling
 577  *              ipc_port_dealloc_kernel should clean up the resources.
 578  *      Conditions:
 579  *              The port is not locked, but it is dead.
 580  */
 581
 582 void
 583 ipc_kobject_destroy(
 584         ipc_port_t              port)
 585 {
 586         switch (ip_kotype(port)) {
 587
 588         case IKOT_TIMER:
 589                 mk_timer_port_destroy(port);
 590                 break;
 591
 592         case IKOT_NAMED_ENTRY:
 593                 mach_destroy_memory_entry(port);
 594                 break;
 595
 596         case IKOT_HOST_NOTIFY:
 597                 host_notify_port_destroy(port);
 598                 break;
 599
 600         default:
 601                 break;
 602         }
 603 }
 604
 605
 606 boolean_t
 607 ipc_kobject_notify(
 608         mach_msg_header_t *request_header,
 609         mach_msg_header_t *reply_header)
 610 {
 611         mach_msg_max_trailer_t * trailer;
 612         ipc_port_t port = (ipc_port_t) request_header->msgh_remote_port;
 613
 614         ((mig_reply_error_t *) reply_header)->RetCode = MIG_NO_REPLY;
 615
 616         trailer = (mach_msg_max_trailer_t *)
 617                   ((vm_offset_t)request_header + request_header->msgh_size);
 618
 619         /*
 620          * The kobject notification is privileged and can change the
 621          * refcount on kernel-internal objects - make sure
 622          * that the message wasn't faked!
 623          */
 624         if (0 != bcmp(&trailer->msgh_audit, &KERNEL_AUDIT_TOKEN,
 625                         sizeof(trailer->msgh_audit))) {
 626                 return FALSE;
 627         }
 628         if (0 != bcmp(&trailer->msgh_sender, &KERNEL_SECURITY_TOKEN,
 629                         sizeof(trailer->msgh_sender))) {
 630                 return FALSE;
 631         }
 632
 633         switch (request_header->msgh_id) {
 634                 case MACH_NOTIFY_NO_SENDERS:
 635                         switch (ip_kotype(port)) {
 636                         case IKOT_VOUCHER:
 637                                 ipc_voucher_notify(request_header);
 638                                 return TRUE;
 639
 640                         case IKOT_VOUCHER_ATTR_CONTROL:
 641                                 ipc_voucher_attr_control_notify(request_header);
 642                                 return TRUE;
 643
 644                         case IKOT_SEMAPHORE:
 645                                 semaphore_notify(request_header);
 646                                 return TRUE;
 647
 648                         case IKOT_TASK:
 649                                 task_port_notify(request_header);
 650                                 return TRUE;
 651
 652                         case IKOT_NAMED_ENTRY:
 653                                 ip_lock(port);
 654
 655                                 /*
 656                                  * Bring the sequence number and mscount in
 657                                  * line with ipc_port_destroy assertion.
 658                                  */
 659                                 port->ip_mscount = 0;
 660                                 port->ip_messages.imq_seqno = 0;
 661                                 ipc_port_destroy(port); /* releases lock */
 662                                 return TRUE;
 663
 664                         case IKOT_UPL:
 665                                 upl_no_senders(
 666                                         request_header->msgh_remote_port,
 667                                         (mach_port_mscount_t)
 668                                         ((mach_no_senders_notification_t *)
 669                                          request_header)->not_count);
 670                                 reply_header->msgh_remote_port = MACH_PORT_NULL;
 671                                 return TRUE;
 672
 673 #if     CONFIG_AUDIT
 674                         case IKOT_AU_SESSIONPORT:
 675                                 audit_session_nosenders(request_header);
 676                                 return TRUE;
 677 #endif
 678                         case IKOT_FILEPORT:
 679                                 fileport_notify(request_header);
 680                                 return TRUE;
 681
 682                         case IKOT_WORK_INTERVAL:
 683                                 work_interval_port_notify(request_header);
 684                                 return TRUE;
 685
 686                         }
 687                 break;
 688
 689                 case MACH_NOTIFY_PORT_DELETED:
 690                 case MACH_NOTIFY_PORT_DESTROYED:
 691                 case MACH_NOTIFY_SEND_ONCE:
 692                 case MACH_NOTIFY_DEAD_NAME:
 693                 break;
 694
 695                 default:
 696                 return FALSE;
 697         }
 698         switch (ip_kotype(port)) {
 699
 700 #ifdef IOKIT
 701                 case IKOT_IOKIT_OBJECT:
 702                 case IKOT_IOKIT_CONNECT:
 703                 case IKOT_IOKIT_IDENT:
 704                 {
 705                 return iokit_notify(request_header);
 706                 }
 707 #endif
 708                 case IKOT_TASK_RESUME:
 709                 {
 710                         return task_suspension_notify(request_header);
 711                 }
 712
 713                 default:
 714                 return FALSE;
 715         }
 716 }