Server/driver protocols: no longer allow third-party copies.

Before safecopies, the IO_ENDPT and DL_ENDPT message fields were needed
to know which actual process to copy data from/to, as that process may
not always be the caller. Now that we have full safecopy support, these
fields have become useless for that purpose: the owner of the grant is
*always* the caller. Allowing the caller to supply another endpoint is
in fact dangerous, because the callee may then end up using a grant
from a third party. One could call this a variant of the confused
deputy problem.

From now on, safecopy calls should always use the caller's endpoint as
grant owner. This fully obsoletes the DL_ENDPT field in the
inet/ethernet protocol. IO_ENDPT has other uses besides identifying the
grant owner though. This patch renames IO_ENDPT to USER_ENDPT, not only
because that is a more fitting name (it should never be used for I/O
after all), but also in order to intentionally break any old system
source code outside the base system. If this patch breaks your code,
fixing it is fairly simple:

- DL_ENDPT should be replaced with m_source;
- IO_ENDPT should be replaced with m_source when used for safecopies;
- IO_ENDPT should be replaced with USER_ENDPT for any other use, e.g.
  when setting REP_ENDPT, matching requests in CANCEL calls, getting
  DEV_SELECT flags, and retrieving of the real user process's endpoint
  in DEV_OPEN.

The changes in this patch are binary backward compatible.

drivers/filter/driver.c

@@ -31,7 +31,7 @@ static int driver_open(int which)
 
 	msg.m_type = DEV_OPEN;
 	msg.DEVICE = driver[which].minor;
-	msg.IO_ENDPT = self_ep;
+	msg.USER_ENDPT = self_ep;
 	r = sendrec(driver[which].endpt, &msg);
 
 	if (r != OK) {
@@ -57,7 +57,7 @@ static int driver_open(int which)
 	msg.m_type = DEV_IOCTL_S;
 	msg.REQUEST = DIOCGETP;
 	msg.DEVICE = driver[which].minor;
-	msg.IO_ENDPT = self_ep;
+	msg.USER_ENDPT = self_ep;
 	msg.IO_GRANT = (char *) gid;
 
 	r = sendrec(driver[which].endpt, &msg);
@@ -107,7 +107,7 @@ static int driver_close(int which)
 
 	msg.m_type = DEV_CLOSE;
 	msg.DEVICE = driver[which].minor;
-	msg.IO_ENDPT = self_ep;
+	msg.USER_ENDPT = self_ep;
 	r = sendrec(driver[which].endpt, &msg);
 
 	if (r != OK) {
@@ -521,7 +521,7 @@ static int flt_senda(message *mess, int which)
 
 	/* Fill in the last bits of the message. */
 	mess->DEVICE = driver[which].minor;
-	mess->IO_ENDPT = self_ep;
+	mess->USER_ENDPT = self_ep;
 
 	/* Send the message asynchronously. */
 	amp = &amsgtable[which];

drivers/filter/main.c

@@ -67,7 +67,7 @@ PRIVATE struct optset optset_table[] = {
 /* Request message. */
 static message m_in;
 static endpoint_t who_e;			/* m_source */
-static endpoint_t proc_e;			/* IO_ENDPT */
+static endpoint_t proc_e;			/* USER_ENDPT */
 static cp_grant_id_t grant_id;			/* IO_GRANT */
 
 /* Data buffers. */
@@ -87,10 +87,10 @@ static int carry(size_t size, int flag_rw)
 	 */
 
 	if (flag_rw == FLT_WRITE)
-		return sys_safecopyfrom(proc_e, grant_id, 0,
+		return sys_safecopyfrom(who_e, grant_id, 0,
 			(vir_bytes) buffer, size, D);
 	else
-		return sys_safecopyto(proc_e, grant_id, 0,
+		return sys_safecopyto(who_e, grant_id, 0,
 			(vir_bytes) buffer, size, D);
 }
 
@@ -110,11 +110,11 @@ static int vcarry(int grants, iovec_t *iov, int flag_rw, size_t size)
 		bytes = MIN(size, iov[i].iov_size);
 
 		if (flag_rw == FLT_WRITE)
-			r = sys_safecopyfrom(proc_e,
+			r = sys_safecopyfrom(who_e,
 				(vir_bytes) iov[i].iov_addr, 0,
 				(vir_bytes) bufp, bytes, D);
 		else
-			r = sys_safecopyto(proc_e,
+			r = sys_safecopyto(who_e,
 				(vir_bytes) iov[i].iov_addr, 0,
 				(vir_bytes) bufp, bytes, D);
 
@@ -268,7 +268,7 @@ static int do_ioctl(message *m)
 		 */
 		sizepart.size = convert(get_raw_size());
 
-		if(sys_safecopyto(proc_e, (vir_bytes) grant_id, 0,
+		if(sys_safecopyto(who_e, (vir_bytes) grant_id, 0,
 				(vir_bytes) &sizepart,
 				sizeof(struct partition), D) != OK) {
 			printf("Filter: DIOCGETP safecopyto failed\n");
@@ -397,7 +397,7 @@ int main(int argc, char *argv[])
 		}
 
 		who_e = m_in.m_source;
-		proc_e = m_in.IO_ENDPT;
+		proc_e = m_in.USER_ENDPT;
 		grant_id = (cp_grant_id_t) m_in.IO_GRANT;
 
 		/* Forword the request message to the drivers. */