add protected payload patches

1 files changed, 1451 insertions, 0 deletions

diff --git a/debian/patches/pp.patch b/debian/patches/pp.patch
new file mode 100644
index 00000000..2c3d7bdd
--- /dev/null
+++ b/debian/patches/pp.patch
@@ -0,0 +1,1451 @@
+diff --git a/auth/mig-decls.h b/auth/mig-decls.h
+index 09c7c70..fa7b06d 100644
+--- a/auth/mig-decls.h
++++ b/auth/mig-decls.h
+@@ -32,6 +32,12 @@ auth_port_to_handle (mach_port_t auth)
+   return ports_lookup_port (auth_bucket, auth, authhandle_portclass);
+ }
+ 
++static inline struct authhandle * __attribute__ ((unused))
++auth_payload_to_handle (unsigned long payload)
++{
++  return ports_lookup_payload (auth_bucket, payload, authhandle_portclass);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_authhandle (struct authhandle *auth)
+ {
+diff --git a/auth/mig-mutate.h b/auth/mig-mutate.h
+index ea40c70..5cc8914 100644
+--- a/auth/mig-mutate.h
++++ b/auth/mig-mutate.h
+@@ -20,5 +20,6 @@
+ /* CPP definitions for MiG processing of auth.defs for auth server.  */
+ 
+ #define AUTH_INTRAN authhandle_t auth_port_to_handle (auth_t)
++#define AUTH_INTRAN_PAYLOAD authhandle_t auth_payload_to_handle
+ #define AUTH_DESTRUCTOR end_using_authhandle (authhandle_t)
+ #define AUTH_IMPORTS import "mig-decls.h";
+diff --git a/console-client/trans.c b/console-client/trans.c
+index 67cd149..59e8463 100644
+--- a/console-client/trans.c
++++ b/console-client/trans.c
+@@ -63,8 +63,16 @@ console_demuxer (mach_msg_header_t *inp,
+   ret = netfs_demuxer (inp, outp);
+   if (ret)
+     return ret;
+-  
+-  user = ports_lookup_port (netfs_port_bucket, inop->msgh_local_port, netfs_protid_class);
++
++  if (MACH_MSGH_BITS_LOCAL (inp->msgh_bits) ==
++      MACH_MSG_TYPE_PROTECTED_PAYLOAD)
++    user = ports_lookup_payload (netfs_port_bucket,
++                                 inop->msgh_protected_payload,
++                                 netfs_protid_class);
++  else
++    user = ports_lookup_port (netfs_port_bucket,
++                              inop->msgh_local_port,
++                              netfs_protid_class);
+   if (!user)
+     return ret;
+   
+diff --git a/console/mutations.h b/console/mutations.h
+index 4e1cc7e..87906cc 100644
+--- a/console/mutations.h
++++ b/console/mutations.h
+@@ -21,12 +21,15 @@
+ /* Only CPP macro definitions should go in this file. */
+ 
+ #define IO_INTRAN protid_t begin_using_protid_port (io_t)
++#define IO_INTRAN_PAYLOAD protid_t begin_using_protid_payload
+ #define IO_DESTRUCTOR end_using_protid_port (protid_t)
+ 
+ #define TIOCTL_IMPORTS import "libnetfs/priv.h";
+ 
+ #define NOTIFY_INTRAN						\
+   port_info_t begin_using_port_info_port (mach_port_t)
++#define NOTIFY_INTRAN_PAYLOAD					\
++  port_info_t begin_using_port_info_payload
+ #define NOTIFY_DESTRUCTOR					\
+   end_using_port_info (port_info_t)
+ #define NOTIFY_IMPORTS						\
+diff --git a/exec/execmutations.h b/exec/execmutations.h
+index 2acca7a..0b5b8bb 100644
+--- a/exec/execmutations.h
++++ b/exec/execmutations.h
+@@ -1,6 +1,7 @@
+ /* CPP definitions for MiG processing of exec.defs for exec server.  */
+ 
+ #define FILE_INTRAN trivfs_protid_t trivfs_begin_using_protid (file_t)
++#define FILE_INTRAN_PAYLOAD trivfs_protid_t trivfs_begin_using_protid_payload
+ #define FILE_DESTRUCTOR trivfs_end_using_protid (trivfs_protid_t)
+ 
+ #define EXEC_IMPORTS					\
+@@ -9,6 +10,8 @@
+ 
+ #define EXEC_STARTUP_INTRAN                             \
+   bootinfo_t begin_using_bootinfo_port (exec_startup_t)
++#define EXEC_STARTUP_INTRAN_PAYLOAD                     \
++  bootinfo_t begin_using_bootinfo_payload
+ #define EXEC_STARTUP_DESTRUCTOR                         \
+   end_using_bootinfo (bootinfo_t)
+ #define EXEC_STARTUP_IMPORTS                            \
+diff --git a/exec/mig-decls.h b/exec/mig-decls.h
+index 0437414..cf3e17d 100644
+--- a/exec/mig-decls.h
++++ b/exec/mig-decls.h
+@@ -30,6 +30,12 @@ begin_using_bootinfo_port (mach_port_t port)
+     return ports_lookup_port (port_bucket, port, execboot_portclass);
+ }
+ 
++static inline struct bootinfo * __attribute__ ((unused))
++begin_using_bootinfo_payload (unsigned long payload)
++{
++    return ports_lookup_payload (port_bucket, payload, execboot_portclass);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_bootinfo (struct bootinfo *b)
+ {
+diff --git a/hurd/hurd_types.defs b/hurd/hurd_types.defs
+index 129a68c..bd56df0 100644
+--- a/hurd/hurd_types.defs
++++ b/hurd/hurd_types.defs
+@@ -22,9 +22,64 @@ the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.  */
+ #include <mach/mach_types.defs>
+ #include <device/device_types.defs>
+ 
++/* The Hurd uses protected payloads to quickly look up the object
++   receiving a message.  Looking up objects is optimized at the cost
++   of having to translate payloads back to port names if the server
++   function expect a port name rather than an object.
++
++   Support for this is implemented in libports.  Almost all of Hurd's
++   servers use libports.  For servers using libports, the optimized
++   lookup is completely transparent.
++
++   Servers not using libports are not using protected payloads
++   automatically.  Define HURD_DEFAULT_PAYLOAD_TO_PORT to 1 (1 like
++   the identity function) for programs not using libports to avoid
++   injecting the default payload-to-port translation function which is
++   in libports.  If you want to use protected payloads without
++   libports, you can use HURD_DEFAULT_PAYLOAD_TO_PORT to inject a
++   custom translation function.  */
++
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++#  if HURD_DEFAULT_PAYLOAD_TO_PORT
++/* Any non-numeric value will fail this test.  If 1 (or any number) is
++   given, do not inject the default translator function.  */
++#    undef HURD_DEFAULT_PAYLOAD_TO_PORT
++#  endif
++#else
++   import <hurd/ports.h>;
++#  define HURD_DEFAULT_PAYLOAD_TO_PORT ports_payload_get_name
++#endif
++
++/* Override the mach_port_t.  Use the default payload to port
++   translation function to convert payloads back to port names for
++   this type.  */
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++type mach_port_t = MACH_MSG_TYPE_COPY_SEND
++	intranpayload: mach_port_t HURD_DEFAULT_PAYLOAD_TO_PORT;
++#endif
++
++/* The Hurd types.  You can inject translation functions for type X
++   using the X_INTRAN, X_INTRAN_PAYLOAD, X_OUTTRAN, and X_DESTRUCTOR.
++
++   If you define X_INTRAN and your server is using libports, you also
++   have to define X_INTRAN_PAYLOAD.
++
++   If you do not use libports, and do not want to use the protected
++   payload mechanism, but you do want to use X_INTRAN, you must
++   provide a X_INTRAN_PAYLOAD that either ignores the message by
++   returning NULL, or indicates an error condition in some appropriate
++   way.  If you do want to use the protected payload mechanism, make
++   sure you also define an appropriate HURD_DEFAULT_PAYLOAD_TO_PORT
++   translation function.  */
++
+ type file_t = mach_port_copy_send_t
+ #ifdef FILE_INTRAN
+ intran: FILE_INTRAN
++intranpayload: FILE_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: file_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef FILE_OUTTRAN
+ outtran: FILE_OUTTRAN
+@@ -37,6 +92,11 @@ destructor: FILE_DESTRUCTOR
+ type fsys_t = mach_port_copy_send_t
+ #ifdef FSYS_INTRAN
+ intran: FSYS_INTRAN
++intranpayload: FSYS_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: fsys_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef FSYS_OUTTRAN
+ outtran: FSYS_OUTTRAN
+@@ -50,6 +110,11 @@ destructor: FSYS_DESTRUCTOR
+ type io_t = mach_port_copy_send_t
+ #ifdef IO_INTRAN
+ intran: IO_INTRAN
++intranpayload: IO_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: io_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef IO_OUTTRAN
+ outtran: IO_OUTTRAN
+@@ -62,6 +127,11 @@ destructor: IO_DESTRUCTOR
+ type process_t = mach_port_copy_send_t
+ #ifdef PROCESS_INTRAN
+ intran: PROCESS_INTRAN
++intranpayload: PROCESS_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: process_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef PROCESS_OUTTRAN
+ outtran: PROCESS_OUTTRAN
+@@ -74,6 +144,11 @@ destructor: PROCESS_DESTRUCTOR
+ type auth_t = mach_port_copy_send_t
+ #ifdef AUTH_INTRAN
+ intran: AUTH_INTRAN
++intranpayload: AUTH_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: auth_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef AUTH_OUTTRAN
+ outtran: AUTH_OUTTRAN
+@@ -86,6 +161,11 @@ destructor: AUTH_DESTRUCTOR
+ type socket_t = mach_port_copy_send_t
+ #ifdef SOCKET_INTRAN
+ intran: SOCKET_INTRAN
++intranpayload: SOCKET_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: socket_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef SOCKET_OUTTRAN
+ outtran: SOCKET_OUTTRAN
+@@ -99,6 +179,11 @@ destructor: SOCKET_DESTRUCTOR
+ type pf_t = mach_port_copy_send_t
+ #ifdef PF_INTRAN
+ intran: PF_INTRAN
++intranpayload: PF_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: pf_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef PF_OUTTRAN
+ outtran: PF_OUTTRAN
+@@ -111,6 +196,11 @@ destructor: PF_DESTRUCTOR
+ type addr_port_t = mach_port_copy_send_t
+ #ifdef ADDRPORT_INTRAN
+ intran: ADDRPORT_INTRAN
++intranpayload: ADDRPORT_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: addr_port_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef ADDRPORT_OUTTRAN
+ outtran: ADDRPORT_OUTTRAN
+@@ -123,6 +213,11 @@ destructor: ADDRPORT_DESTRUCTOR
+ type term_t = mach_port_copy_send_t
+ #ifdef TERM_INTRAN
+ intran: TERM_INTRAN
++intranpayload: TERM_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: term_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef TERM_OUTTRAN
+ outtran: TERM_OUTTRAN
+@@ -135,6 +230,11 @@ destructor: TERM_DESTRUCTOR
+ type startup_t = mach_port_copy_send_t
+ #ifdef STARTUP_INTRAN
+ intran: STARTUP_INTRAN
++intranpayload: STARTUP_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: startup_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef STARTUP_OUTTRAN
+ outtran: STARTUP_OUTTRAN
+@@ -147,6 +247,11 @@ destructor: STARTUP_DESTRUCTOR
+ type fs_notify_t = mach_port_copy_send_t
+ #ifdef FS_NOTIFY_INTRAN
+ intran: FS_NOTIFY_INTRAN
++intranpayload: FS_NOTIFY_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: fs_notify_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef FS_NOTIFY_OUTTRAN
+ outtran: FS_NOTIFY_OUTTRAN
+@@ -159,6 +264,11 @@ destructor: FS_NOTIFY_DESTRUCTOR
+ type exec_startup_t = mach_port_copy_send_t
+ #ifdef EXEC_STARTUP_INTRAN
+ intran: EXEC_STARTUP_INTRAN
++intranpayload: EXEC_STARTUP_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: exec_startup_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef EXEC_STARTUP_OUTTRAN
+ outtran: EXEC_STARTUP_OUTTRAN
+@@ -171,6 +281,11 @@ destructor: EXEC_STARTUP_DESTRUCTOR
+ type interrupt_t = mach_port_copy_send_t
+ #ifdef INTERRUPT_INTRAN
+ intran: INTERRUPT_INTRAN
++intranpayload: INTERRUPT_INTRAN_PAYLOAD
++#else
++#ifdef HURD_DEFAULT_PAYLOAD_TO_PORT
++intranpayload: exec_startup_t HURD_DEFAULT_PAYLOAD_TO_PORT
++#endif
+ #endif
+ #ifdef INTERRUPT_OUTTRAN
+ outtran: INTERRUPT_OUTTRAN
+diff --git a/init/Makefile b/init/Makefile
+index ffb82ff..055b377 100644
+--- a/init/Makefile
++++ b/init/Makefile
+@@ -25,6 +25,10 @@ OBJS = $(SRCS:.c=.o) \
+ target = init
+ HURDLIBS = shouldbeinlibc
+ 
++# init does not use libports.  Disable the default payload to port
++# conversion.
++MIGSFLAGS="-DHURD_DEFAULT_PAYLOAD_TO_PORT=1"
++
+ include ../Makeconf
+ 
+ mung_msg_S.h: msg_S.h
+diff --git a/libcons/mutations.h b/libcons/mutations.h
+index c895447..4751340 100644
+--- a/libcons/mutations.h
++++ b/libcons/mutations.h
+@@ -21,6 +21,7 @@
+ /* Only CPP macro definitions should go in this file. */
+ 
+ #define FS_NOTIFY_INTRAN cons_notify_t begin_using_notify_port (fs_notify_t)
++#define FS_NOTIFY_INTRAN_PAYLOAD cons_notify_t begin_using_notify_payload
+ #define FS_NOTIFY_DESTRUCTOR end_using_notify_port (cons_notify_t)
+ 
+ #define FS_NOTIFY_IMPORTS import "priv.h";
+diff --git a/libcons/priv.h b/libcons/priv.h
+index 38971ff..6cdf3db 100644
+--- a/libcons/priv.h
++++ b/libcons/priv.h
+@@ -80,6 +80,12 @@ begin_using_notify_port (fs_notify_t port)
+   return ports_lookup_port (cons_port_bucket, port, cons_port_class);
+ }
+ 
++static inline cons_notify_t
++begin_using_notify_payload (unsigned long payload)
++{
++  return ports_lookup_payload (cons_port_bucket, payload, cons_port_class);
++}
++
+ /* Called by MiG after server routines have been run; this balances
+    begin_using_notify_port, and is arranged for the fs_notify
+    interfaces by mutations.h. */
+diff --git a/libdiskfs/diskfs.h b/libdiskfs/diskfs.h
+index 2c68aa3..5b4ae85 100644
+--- a/libdiskfs/diskfs.h
++++ b/libdiskfs/diskfs.h
+@@ -833,8 +833,14 @@ error_t diskfs_start_protid (struct peropen *po, struct protid **cred);
+ void diskfs_finish_protid (struct protid *cred, struct iouser *user);
+ 
+ extern struct protid * diskfs_begin_using_protid_port (file_t port);
++extern struct protid *
++diskfs_begin_using_protid_payload (unsigned long payload);
+ extern struct diskfs_control * diskfs_begin_using_control_port (fsys_t port);
++extern struct diskfs_control *
++diskfs_begin_using_control_port_payload (unsigned long payload);
+ extern struct bootinfo *diskfs_begin_using_bootinfo_port (exec_startup_t port);
++struct bootinfo *
++diskfs_begin_using_bootinfo_payload (unsigned long payload);
+ 
+ extern void diskfs_end_using_protid_port (struct protid *cred);
+ extern void diskfs_end_using_control_port (struct diskfs_control *cred);
+@@ -851,6 +857,14 @@ diskfs_begin_using_protid_port (file_t port)
+   return ports_lookup_port (diskfs_port_bucket, port, diskfs_protid_class);
+ }
+ 
++DISKFS_EXTERN_INLINE struct protid *
++diskfs_begin_using_protid_payload (unsigned long payload)
++{
++  return ports_lookup_payload (diskfs_port_bucket,
++                               payload,
++                               diskfs_protid_class);
++}
++
+ /* And for the fsys interface. */
+ DISKFS_EXTERN_INLINE struct diskfs_control *
+ diskfs_begin_using_control_port (fsys_t port)
+@@ -858,6 +872,14 @@ diskfs_begin_using_control_port (fsys_t port)
+   return ports_lookup_port (diskfs_port_bucket, port, NULL);
+ }
+ 
++DISKFS_EXTERN_INLINE struct diskfs_control *
++diskfs_begin_using_control_port_payload (unsigned long payload)
++{
++  return ports_lookup_payload (diskfs_port_bucket,
++                               payload,
++                               NULL);
++}
++
+ /* And for the exec_startup interface. */
+ DISKFS_EXTERN_INLINE struct bootinfo *
+ diskfs_begin_using_bootinfo_port (exec_startup_t port)
+@@ -865,6 +887,13 @@ diskfs_begin_using_bootinfo_port (exec_startup_t port)
+   return ports_lookup_port (diskfs_port_bucket, port, diskfs_execboot_class);
+ }
+ 
++DISKFS_EXTERN_INLINE struct bootinfo *
++diskfs_begin_using_bootinfo_payload (unsigned long payload)
++{
++  return ports_lookup_payload (diskfs_port_bucket,
++                               payload,
++                               diskfs_execboot_class);
++}
+ 
+ /* Called by MiG after server routines have been run; this
+    balances begin_using_protid_port, and is arranged for the io
+diff --git a/libdiskfs/fsmutations.h b/libdiskfs/fsmutations.h
+index 3f9362b..c2167c6 100644
+--- a/libdiskfs/fsmutations.h
++++ b/libdiskfs/fsmutations.h
+@@ -18,12 +18,15 @@
+ /* Only CPP macro definitions should go in this file. */
+ 
+ #define FILE_INTRAN protid_t diskfs_begin_using_protid_port (file_t)
++#define FILE_INTRAN_PAYLOAD protid_t diskfs_begin_using_protid_payload
+ #define FILE_DESTRUCTOR diskfs_end_using_protid_port (protid_t)
+ 
+ #define IO_INTRAN protid_t diskfs_begin_using_protid_port (io_t)
++#define IO_INTRAN_PAYLOAD protid_t diskfs_begin_using_protid_payload
+ #define IO_DESTRUCTOR diskfs_end_using_protid_port (protid_t)
+ 
+ #define FSYS_INTRAN control_t diskfs_begin_using_control_port (fsys_t)
++#define FSYS_INTRAN_PAYLOAD control_t diskfs_begin_using_control_port_payload
+ #define FSYS_DESTRUCTOR diskfs_end_using_control_port (control_t)
+ 
+ #define FILE_IMPORTS import "libdiskfs/priv.h";
+@@ -33,6 +36,8 @@
+ 
+ #define EXEC_STARTUP_INTRAN                             \
+   bootinfo_t diskfs_begin_using_bootinfo_port (exec_startup_t)
++#define EXEC_STARTUP_INTRAN_PAYLOAD                     \
++  bootinfo_t diskfs_begin_using_bootinfo_payload
+ #define EXEC_STARTUP_DESTRUCTOR                         \
+   diskfs_end_using_bootinfo (bootinfo_t)
+ #define EXEC_STARTUP_IMPORTS                            \
+diff --git a/libnetfs/mutations.h b/libnetfs/mutations.h
+index e60a220..088d8a0 100644
+--- a/libnetfs/mutations.h
++++ b/libnetfs/mutations.h
+@@ -23,12 +23,15 @@
+ #define IO_SELECT_REPLY_PORT
+ 
+ #define FILE_INTRAN protid_t begin_using_protid_port (file_t)
++#define FILE_INTRAN_PAYLOAD protid_t begin_using_protid_payload
+ #define FILE_DESTRUCTOR end_using_protid_port (protid_t)
+ 
+ #define IO_INTRAN protid_t begin_using_protid_port (io_t)
++#define IO_INTRAN_PAYLOAD protid_t begin_using_protid_payload
+ #define IO_DESTRUCTOR end_using_protid_port (protid_t)
+ 
+ #define FSYS_INTRAN control_t begin_using_control_port (fsys_t)
++#define FSYS_INTRAN_PAYLOAD control_t begin_using_control_payload
+ #define FSYS_DESTRUCTOR end_using_control_port (control_t)
+ 
+ #define FILE_IMPORTS import "libnetfs/netfs.h"; import "libnetfs/priv.h";
+diff --git a/libnetfs/priv.h b/libnetfs/priv.h
+index ba31080..3c5bcd4 100644
+--- a/libnetfs/priv.h
++++ b/libnetfs/priv.h
+@@ -31,6 +31,12 @@ begin_using_protid_port (file_t port)
+   return ports_lookup_port (netfs_port_bucket, port, netfs_protid_class);
+ }
+ 
++static inline struct protid * __attribute__ ((unused))
++begin_using_protid_payload (unsigned long payload)
++{
++  return ports_lookup_payload (netfs_port_bucket, payload, netfs_protid_class);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_protid_port (struct protid *cred)
+ {
+@@ -44,6 +50,12 @@ begin_using_control_port (fsys_t port)
+   return ports_lookup_port (netfs_port_bucket, port, netfs_control_class);
+ }
+ 
++static inline struct netfs_control * __attribute__ ((unused))
++begin_using_control_payload (unsigned long payload)
++{
++  return ports_lookup_payload (netfs_port_bucket, payload, netfs_control_class);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_control_port (struct netfs_control *cred)
+ {
+diff --git a/libpager/demuxer.c b/libpager/demuxer.c
+index b4d4054..cdffa79 100644
+--- a/libpager/demuxer.c
++++ b/libpager/demuxer.c
+@@ -18,6 +18,7 @@
+ #include "priv.h"
+ #include "memory_object_S.h"
+ #include "notify_S.h"
++#include "mig-decls.h"
+ 
+ /* Demultiplex a single message directed at a pager port; INP is the
+    message received; fill OUTP with the reply.  */
+@@ -35,6 +36,18 @@ pager_demuxer (mach_msg_header_t *inp,
+ 
+   /* Synchronize our bookkeeping of the port's seqno with the one
+      consumed by this bogus message.  */
+-  _pager_update_seqno (inp->msgh_local_port, inp->msgh_seqno);
++  if (MACH_MSGH_BITS_LOCAL (inp->msgh_bits) ==
++      MACH_MSG_TYPE_PROTECTED_PAYLOAD)
++    {
++      struct pager *p = begin_using_pager_payload (
++	inp->msgh_protected_payload);
++      if (p)
++        {
++          _pager_update_seqno_p (p, inp->msgh_seqno);
++          ports_port_deref (p);
++        }
++    }
++  else
++    _pager_update_seqno (inp->msgh_local_port, inp->msgh_seqno);
+   return FALSE;
+ }
+diff --git a/libpager/mig-decls.h b/libpager/mig-decls.h
+index 0c7b402..7e6b64f 100644
+--- a/libpager/mig-decls.h
++++ b/libpager/mig-decls.h
+@@ -32,6 +32,12 @@ begin_using_pager (mach_port_t port)
+   return ports_lookup_port (0, port, _pager_class);
+ }
+ 
++static inline struct pager * __attribute__ ((unused))
++begin_using_pager_payload (unsigned long payload)
++{
++  return ports_lookup_payload (0, payload, _pager_class);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_pager (struct pager *p)
+ {
+diff --git a/libpager/mig-mutate.h b/libpager/mig-mutate.h
+index 9e9065f..c4f30ce 100644
+--- a/libpager/mig-mutate.h
++++ b/libpager/mig-mutate.h
+@@ -18,11 +18,14 @@
+    along with the GNU Hurd.  If not, see <http://www.gnu.org/licenses/>.  */
+ 
+ #define MEMORY_OBJECT_INTRAN pager_t begin_using_pager (memory_object_t)
++#define MEMORY_OBJECT_INTRAN_PAYLOAD pager_t begin_using_pager_payload
+ #define MEMORY_OBJECT_DESTRUCTOR end_using_pager (pager_t)
+ #define MEMORY_OBJECT_IMPORTS import "mig-decls.h";
+ 
+ #define NOTIFY_INTRAN						\
+   port_info_t begin_using_port_info_port (mach_port_t)
++#define NOTIFY_INTRAN_PAYLOAD					\
++  port_info_t begin_using_port_info_payload
+ #define NOTIFY_DESTRUCTOR					\
+   end_using_port_info (port_info_t)
+ #define NOTIFY_IMPORTS						\
+diff --git a/libports/Makefile b/libports/Makefile
+index 30da1c1..331dc45 100644
+--- a/libports/Makefile
++++ b/libports/Makefile
+@@ -36,13 +36,13 @@ SRCS = create-bucket.c create-class.c \
+  interrupt-operation.c interrupt-on-notify.c interrupt-notified-rpcs.c \
+  dead-name.c create-port.c import-port.c default-uninhibitable-rpcs.c \
+  claim-right.c transfer-right.c create-port-noinstall.c create-internal.c \
+- interrupted.c
++ interrupted.c lookup-payload.c
+ 
+ installhdrs = ports.h
+ 
+ HURDLIBS= ihash
+ LDLIBS += -lpthread
+-OBJS = $(SRCS:.c=.o) notifyServer.o interruptServer.o
++OBJS = $(SRCS:.c=.o) notifyServer.o interruptServer.o mach_portUser.o
+ 
+ MIGCOMSFLAGS = -prefix ports_
+ MIGSFLAGS = -imacros $(srcdir)/mig-mutate.h
+diff --git a/libports/complete-deallocate.c b/libports/complete-deallocate.c
+index 8ce095b..36c955b 100644
+--- a/libports/complete-deallocate.c
++++ b/libports/complete-deallocate.c
+@@ -30,8 +30,11 @@ _ports_complete_deallocate (struct port_info *pi)
+   if (pi->port_right)
+     {
+       hurd_ihash_locp_remove (&pi->bucket->htable, pi->hentry);
+-      mach_port_mod_refs (mach_task_self (), pi->port_right,
+-			  MACH_PORT_RIGHT_RECEIVE, -1);
++      /* If the right has been destroyed using ports_destroy_right,
++	 port_right is set to MACH_PORT_DEAD.  */
++      if (MACH_PORT_VALID (pi->port_right))
++	mach_port_mod_refs (mach_task_self (), pi->port_right,
++			    MACH_PORT_RIGHT_RECEIVE, -1);
+       pi->port_right = MACH_PORT_NULL;
+     }
+ 
+diff --git a/libports/create-internal.c b/libports/create-internal.c
+index 8551297..c391adc 100644
+--- a/libports/create-internal.c
++++ b/libports/create-internal.c
+@@ -85,6 +85,9 @@ _ports_create_port_internal (struct port_class *class,
+   if (err)
+     goto lose;
+ 
++  /* This is an optimization.  It may fail.  */
++  mach_port_set_protected_payload (mach_task_self (), port, pi);
++
+   pi->next = class->ports;
+   pi->prevp = &class->ports;
+   if (class->ports)
+diff --git a/libports/destroy-right.c b/libports/destroy-right.c
+index 65e19c7..a1ce6c3 100644
+--- a/libports/destroy-right.c
++++ b/libports/destroy-right.c
+@@ -1,5 +1,5 @@
+ /*
+-   Copyright (C) 1995, 1996, 1999 Free Software Foundation, Inc.
++   Copyright (C) 1995, 1996, 1999, 2014 Free Software Foundation, Inc.
+    Written by Michael I. Bushnell.
+ 
+    This file is part of the GNU Hurd.
+@@ -22,29 +22,168 @@
+ #include <hurd/ihash.h>
+ #include <assert.h>
+ 
++#include <pthread.h>
++#include <error.h>
++#include <time.h>
++
++/* To prevent protected payloads from becoming stale, we defer the
++   derefercing of port_info objects.  */
++static error_t defer_dereferencing (struct port_info *pi);
++
+ error_t
+ ports_destroy_right (void *portstruct)
+ {
+   struct port_info *pi = portstruct;
+   error_t err;
+ 
++  pthread_mutex_lock (&_ports_lock);
+   if (pi->port_right != MACH_PORT_NULL)
+     {
+-      pthread_mutex_lock (&_ports_lock);
+-      hurd_ihash_locp_remove (&pi->bucket->htable, pi->hentry);
++      mach_port_clear_protected_payload (mach_task_self (),
++					 pi->port_right);
++
+       err = mach_port_mod_refs (mach_task_self (), pi->port_right,
+ 				MACH_PORT_RIGHT_RECEIVE, -1);
+       assert_perror (err);
+-      pthread_mutex_unlock (&_ports_lock);
+-
+-      pi->port_right = MACH_PORT_NULL;
+ 
+       if (pi->flags & PORT_HAS_SENDRIGHTS)
+ 	{
+-	  pi->flags &= ~PORT_HAS_SENDRIGHTS;
+-	  ports_port_deref (pi);
++	  /* There are outstanding send rights, so we might get a
++	     no-senders notification.  Attached to the notification
++	     is a reference to the port_info object.  Of course we
++	     destroyed the receive right these were send to above, but
++	     the message could already have been send and dequeued.
++
++	     Previously, those messages would have carried an stale
++	     name, which would have caused a hash table lookup
++	     failure.  However, stale payloads results in port_info
++	     use-after-free.  Therefore, we cannot release the
++	     reference here, but defer that instead.  */
++	  defer_dereferencing (pi);
+ 	}
++      else
++	hurd_ihash_locp_remove (&pi->bucket->htable, pi->hentry);
++
++      pi->port_right = MACH_PORT_DEAD;
+     }
++  pthread_mutex_unlock (&_ports_lock);
++
++  return 0;
++}
++
++/* Simple lock-less generational garbage collection.  */
++
++/* We maintain three lists of objects.	Producers add objects to the
++   current generation G using defer_dereferencing.  G-1 holds old
++   objects, G-2 holds garbage.	*/
++static struct deferred_dereference
++{
++  struct deferred_dereference *next;
++  struct port_info *pi;	/* We hold a reference for these objects.  */
++} *generations[3];	/* Must be accessed using atomic
++			   operations.	*/
++
++/* The current generation.  Must be accessed using atomic operations.  */
++static int generation;
++
++/* The garbage collection thread.  Does not return.  */
++static void *
++gc_loop (void *arg)
++{
++  while (1)
++    {
++      int old, garbage;
++      struct deferred_dereference *d;
++
++      sleep (5);
++
++      /* We are the only one updating generation, so this is safe.  */
++      old = generation;
++
++      /* Update generation.  */
++      __atomic_store_n (&generation, (old + 1) % 3, __ATOMIC_RELAXED);
++
++      /* This is the garbage generation.  As all writers are long
++	 gone, we do not need to bother with atomic operations.	 */
++      garbage = (old + 2) % 3;
++      d = generations[garbage];
++      generations[garbage] = NULL;
++      while (d != NULL)
++	{
++	  struct deferred_dereference *next = d->next;
++	  int references;
++
++	  pthread_mutex_lock (&_ports_lock);
++	  references = d->pi->refcnt;
++	  pthread_mutex_unlock (&_ports_lock);
++
++	  assert (references <= 2 || !"reference to destroyed right leaked");
++
++	  if (references == 2)
++	    {
++	      /* Get rid of the hash table reference.  */
++	      pthread_mutex_lock (&_ports_lock);
++	      hurd_ihash_locp_remove (&d->pi->bucket->htable, d->pi->hentry);
++	      pthread_mutex_unlock (&_ports_lock);
++	      ports_port_deref (d->pi);
++	    }
++
++	  /* Get rid of our reference.	*/
++	  ports_port_deref (d->pi);
++
++	  free (d);
++	  d = next;
++	}
++    }
++
++  assert (! "reached");
++  return NULL;
++}
++
++/* Start the gc thread.  */
++static void
++start_gc (void)
++{
++  error_t err;
++  pthread_attr_t attr;
++  pthread_t thread;
++
++  pthread_attr_init (&attr);
++#define STACK_SIZE (64 * 1024)
++  pthread_attr_setstacksize (&attr, STACK_SIZE);
++#undef STACK_SIZE
++
++  err = pthread_create (&thread, &attr, gc_loop, NULL);
++  assert_perror (err);
++  err = pthread_detach (thread);
++  assert_perror (err);
++}
++
++/* Defer the derefercing of port_info objects.  */
++static error_t
++defer_dereferencing (struct port_info *pi)
++{
++  static pthread_once_t once = PTHREAD_ONCE_INIT;
++  int g;
++  struct deferred_dereference *d = malloc (sizeof *d);
++  if (d == NULL)
++    return ENOMEM;
++
++  pthread_once (&once, start_gc);
++
++  /* XXX we hold _ports_lock, so we cannot do
++     ports_port_ref (pi); */
++  pi->refcnt += 1;
++  d->pi = pi;
++
++  /* Append to the current generation.	*/
++  g = __atomic_load_n (&generation, __ATOMIC_RELAXED);
++
++ retry:
++  d->next = __atomic_load_n (&generations[g], __ATOMIC_RELAXED);
++  if (! __atomic_compare_exchange_n (&generations[g], &d->next, d,
++				     0, __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++    goto retry;
+ 
+   return 0;
+ }
+diff --git a/libports/import-port.c b/libports/import-port.c
+index 226f47e..79072db 100644
+--- a/libports/import-port.c
++++ b/libports/import-port.c
+@@ -79,6 +79,9 @@ ports_import_port (struct port_class *class, struct port_bucket *bucket,
+   if (err)
+     goto lose;
+ 
++  /* This is an optimization.  It may fail.  */
++  mach_port_set_protected_payload (mach_task_self (), port, pi);
++
+   pi->next = class->ports;
+   pi->prevp = &class->ports;
+   if (class->ports)
+diff --git a/libports/lookup-payload.c b/libports/lookup-payload.c
+new file mode 100644
+index 0000000..92f54b6
+--- /dev/null
++++ b/libports/lookup-payload.c
+@@ -0,0 +1,44 @@
++/*
++   Copyright (C) 2013 Free Software Foundation, Inc.
++
++   Written by Justus Winter <4winter@informatik.uni-hamburg.de>
++
++   This file is part of the GNU Hurd.
++
++   The GNU Hurd is free software; you can redistribute it and/or
++   modify it under the terms of the GNU General Public License as
++   published by the Free Software Foundation; either version 2, or (at
++   your option) any later version.
++
++   The GNU Hurd is distributed in the hope that it will be useful, but
++   WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   General Public License for more details.
++
++   You should have received a copy of the GNU General Public License
++   along with the GNU Hurd.  If not, see <http://www.gnu.org/licenses/>.  */
++
++#include "ports.h"
++
++void *
++ports_lookup_payload (struct port_bucket *bucket,
++		      unsigned long payload,
++		      struct port_class *class)
++{
++  struct port_info *pi = (struct port_info *) payload;
++
++  if (pi && bucket && pi->bucket != bucket)
++    pi = NULL;
++
++  if (pi && class && pi->class != class)
++    pi = NULL;
++
++  if (pi)
++    {
++      pthread_mutex_lock (&_ports_lock);
++      pi->refcnt++;
++      pthread_mutex_unlock (&_ports_lock);
++    }
++
++  return pi;
++}
+diff --git a/libports/manage-multithread.c b/libports/manage-multithread.c
+index 2067cba..90b3044 100644
+--- a/libports/manage-multithread.c
++++ b/libports/manage-multithread.c
+@@ -162,7 +162,27 @@ ports_manage_port_operations_multithread (struct port_bucket *bucket,
+       outp->RetCodeType = RetCodeType;
+       outp->RetCode = MIG_BAD_ID;
+ 
+-      pi = ports_lookup_port (bucket, inp->msgh_local_port, 0);
++      if (MACH_MSGH_BITS_LOCAL (inp->msgh_bits) ==
++	  MACH_MSG_TYPE_PROTECTED_PAYLOAD)
++	{
++	  pi = (struct port_info *) inp->msgh_protected_payload;
++	  if (pi && pi->bucket == bucket)
++	    ports_port_ref (pi);
++	  else
++	    pi = NULL;
++	}
++      else
++	{
++	  pi = ports_lookup_port (bucket, inp->msgh_local_port, 0);
++	  if (pi)
++	    {
++	      inp->msgh_bits = MACH_MSGH_BITS (
++		MACH_MSGH_BITS_REMOTE (inp->msgh_bits),
++		MACH_MSG_TYPE_PROTECTED_PAYLOAD);
++	      inp->msgh_protected_payload = (unsigned long) pi;
++	    }
++	}
++
+       if (pi)
+ 	{
+ 	  error_t err = ports_begin_rpc (pi, inp->msgh_id, &link);
+diff --git a/libports/manage-one-thread.c b/libports/manage-one-thread.c
+index cbd2df7..58c0f36 100644
+--- a/libports/manage-one-thread.c
++++ b/libports/manage-one-thread.c
+@@ -57,7 +57,27 @@ ports_manage_port_operations_one_thread (struct port_bucket *bucket,
+       outp->RetCodeType = RetCodeType;
+       outp->RetCode = MIG_BAD_ID;
+ 
+-      pi = ports_lookup_port (bucket, inp->msgh_local_port, 0);
++      if (MACH_MSGH_BITS_LOCAL (inp->msgh_bits) ==
++	  MACH_MSG_TYPE_PROTECTED_PAYLOAD)
++	{
++	  pi = (struct port_info *) inp->msgh_protected_payload;
++	  if (pi && pi->bucket == bucket)
++	    ports_port_ref (pi);
++	  else
++	    pi = NULL;
++	}
++      else
++	{
++	  pi = ports_lookup_port (bucket, inp->msgh_local_port, 0);
++	  if (pi)
++	    {
++	      inp->msgh_bits = MACH_MSGH_BITS (
++		MACH_MSGH_BITS_REMOTE (inp->msgh_bits),
++		MACH_MSG_TYPE_PROTECTED_PAYLOAD);
++	      inp->msgh_protected_payload = (unsigned long) pi;
++	    }
++	}
++
+       if (pi)
+ 	{
+ 	  err = ports_begin_rpc (pi, inp->msgh_id, &link);
+diff --git a/libports/mig-decls.h b/libports/mig-decls.h
+index f8c4f15..c88ff26 100644
+--- a/libports/mig-decls.h
++++ b/libports/mig-decls.h
+@@ -30,6 +30,12 @@ begin_using_port_info_port (mach_port_t port)
+   return ports_lookup_port (0, port, 0);
+ }
+ 
++static inline struct port_info * __attribute__ ((unused))
++begin_using_port_info_payload (unsigned long payload)
++{
++  return ports_lookup_payload (0, payload, 0);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_port_info (struct port_info *p)
+ {
+diff --git a/libports/mig-mutate.h b/libports/mig-mutate.h
+index 4c011b6..1c96fea 100644
+--- a/libports/mig-mutate.h
++++ b/libports/mig-mutate.h
+@@ -19,6 +19,8 @@
+ 
+ #define NOTIFY_INTRAN						\
+   port_info_t begin_using_port_info_port (mach_port_t)
++#define NOTIFY_INTRAN_PAYLOAD					\
++  port_info_t begin_using_port_info_payload
+ #define NOTIFY_DESTRUCTOR					\
+   end_using_port_info (port_info_t)
+ #define NOTIFY_IMPORTS						\
+@@ -26,6 +28,8 @@
+ 
+ #define INTERRUPT_INTRAN					\
+   port_info_t begin_using_port_info_port (mach_port_t)
++#define INTERRUPT_INTRAN_PAYLOAD				\
++  port_info_t begin_using_port_info_payload
+ #define INTERRUPT_DESTRUCTOR					\
+   end_using_port_info (port_info_t)
+ #define INTERRUPT_IMPORTS					\
+diff --git a/libports/ports.h b/libports/ports.h
+index 7f13124..d99edcb 100644
+--- a/libports/ports.h
++++ b/libports/ports.h
+@@ -234,6 +234,24 @@ mach_port_t ports_get_send_right (void *port);
+ void *ports_lookup_port (struct port_bucket *bucket,
+ 			 mach_port_t port, struct port_class *class);
+ 
++/* Like ports_lookup_port, but uses PAYLOAD to look up the object.  If
++   this function is used, PAYLOAD must be a pointer to the port
++   structure.  */
++void *ports_lookup_payload (struct port_bucket *bucket,
++                            unsigned long payload, struct port_class *class);
++
++/* This returns the ports name.  This function can be used as
++   intranpayload function turning payloads back into port names.  If
++   this function is used, PAYLOAD must be a pointer to the port
++   structure.  */
++static inline mach_port_t ports_payload_get_name (unsigned int payload)
++{
++  struct port_info *pi = (struct port_info *) payload;
++  if (pi)
++    return pi->port_right;
++  return MACH_PORT_NULL;
++}
++
+ /* Allocate another reference to PORT. */
+ void ports_port_ref (void *port);
+ 
+diff --git a/libports/reallocate-from-external.c b/libports/reallocate-from-external.c
+index 8cccb2a..a07904b 100644
+--- a/libports/reallocate-from-external.c
++++ b/libports/reallocate-from-external.c
+@@ -62,6 +62,8 @@ ports_reallocate_from_external (void *portstruct, mach_port_t receive)
+   
+   err = hurd_ihash_add (&pi->bucket->htable, receive, pi);
+   assert_perror (err);
++  /* This is an optimization.  It may fail.  */
++  mach_port_set_protected_payload (mach_task_self (), pi->port_right, pi);
+   pthread_mutex_unlock (&_ports_lock);
+   
+   mach_port_move_member (mach_task_self (), receive, pi->bucket->portset);
+diff --git a/libports/reallocate-port.c b/libports/reallocate-port.c
+index d2adaeb..396ab88 100644
+--- a/libports/reallocate-port.c
++++ b/libports/reallocate-port.c
+@@ -50,6 +50,8 @@ ports_reallocate_port (void *portstruct)
+   pi->mscount = 0;
+   err = hurd_ihash_add (&pi->bucket->htable, pi->port_right, pi);
+   assert_perror (err);
++  /* This is an optimization.  It may fail.  */
++  mach_port_set_protected_payload (mach_task_self (), pi->port_right, pi);
+   pthread_mutex_unlock (&_ports_lock);
+ 
+   err = mach_port_move_member (mach_task_self (), pi->port_right, 
+diff --git a/libports/transfer-right.c b/libports/transfer-right.c
+index 72488a9..e4ba9b4 100644
+--- a/libports/transfer-right.c
++++ b/libports/transfer-right.c
+@@ -79,6 +79,8 @@ ports_transfer_right (void *tostruct,
+     {
+       err = hurd_ihash_add (&topi->bucket->htable, port, topi);
+       assert_perror (err);
++      /* This is an optimization.  It may fail.  */
++      mach_port_set_protected_payload (mach_task_self (), port, topi);
+       if (topi->bucket != frompi->bucket)
+         {
+ 	  err = mach_port_move_member (mach_task_self (), port,
+diff --git a/libtrivfs/mig-decls.h b/libtrivfs/mig-decls.h
+index 2baaee8..13a9eb7 100644
+--- a/libtrivfs/mig-decls.h
++++ b/libtrivfs/mig-decls.h
+@@ -61,6 +61,35 @@ trivfs_begin_using_protid (mach_port_t port)
+     return ports_lookup_port (0, port, trivfs_dynamic_protid_port_classes[0]);
+ }
+ 
++static inline struct trivfs_protid * __attribute__ ((unused))
++trivfs_begin_using_protid_payload (unsigned long payload)
++{
++  if (trivfs_protid_nportclasses + trivfs_num_dynamic_protid_port_classes > 1)
++    {
++      struct port_info *pi = ports_lookup_payload (NULL, payload, NULL);
++      int i;
++
++      if (pi)
++	{
++	  for (i = 0; i < trivfs_protid_nportclasses; i++)
++	    if (pi->class == trivfs_protid_portclasses[i])
++	      return (struct trivfs_protid *) pi;
++	  for (i = 0; i < trivfs_num_dynamic_protid_port_classes; i++)
++	    if (pi->class == trivfs_dynamic_protid_port_classes[i])
++	      return (struct trivfs_protid *) pi;
++	  ports_port_deref (pi);
++	}
++
++      return NULL;
++    }
++  else if (trivfs_protid_nportclasses == 1)
++    return ports_lookup_payload (NULL, payload,
++				 trivfs_protid_portclasses[0]);
++  else
++    return ports_lookup_payload (NULL, payload,
++				 trivfs_dynamic_protid_port_classes[0]);
++}
++
+ static inline void __attribute__ ((unused))
+ trivfs_end_using_protid (struct trivfs_protid *cred)
+ {
+@@ -95,6 +124,35 @@ trivfs_begin_using_control (mach_port_t port)
+     return ports_lookup_port (0, port, trivfs_dynamic_control_port_classes[0]);
+ }
+ 
++static inline struct trivfs_control * __attribute__ ((unused))
++trivfs_begin_using_control_payload (unsigned long payload)
++{
++  if (trivfs_cntl_nportclasses + trivfs_num_dynamic_control_port_classes > 1)
++    {
++      struct port_info *pi = ports_lookup_payload (NULL, payload, NULL);
++      int i;
++
++      if (pi)
++	{
++	  for (i = 0; i < trivfs_cntl_nportclasses; i++)
++	    if (pi->class == trivfs_cntl_portclasses[i])
++	      return (struct trivfs_control *) pi;
++	  for (i = 0; i < trivfs_num_dynamic_control_port_classes; i++)
++	    if (pi->class == trivfs_dynamic_control_port_classes[i])
++	      return (struct trivfs_control *) pi;
++	  ports_port_deref (pi);
++	}
++
++      return NULL;
++    }
++  else if (trivfs_cntl_nportclasses == 1)
++    return ports_lookup_payload (NULL, payload,
++				 trivfs_cntl_portclasses[0]);
++  else
++    return ports_lookup_payload (NULL, payload,
++				 trivfs_dynamic_control_port_classes[0]);
++}
++
+ static inline void __attribute__ ((unused))
+ trivfs_end_using_control (struct trivfs_control *cred)
+ {
+diff --git a/libtrivfs/mig-mutate.h b/libtrivfs/mig-mutate.h
+index cc15d38..dcbebf6 100644
+--- a/libtrivfs/mig-mutate.h
++++ b/libtrivfs/mig-mutate.h
+@@ -20,13 +20,16 @@
+ #define REPLY_PORTS
+ 
+ #define FILE_INTRAN trivfs_protid_t trivfs_begin_using_protid (file_t)
++#define FILE_INTRAN_PAYLOAD trivfs_protid_t trivfs_begin_using_protid_payload
+ #define FILE_DESTRUCTOR trivfs_end_using_protid (trivfs_protid_t)
+ #define FILE_IMPORTS import "libtrivfs/mig-decls.h";
+ 
+ #define IO_INTRAN trivfs_protid_t trivfs_begin_using_protid (io_t)
++#define IO_INTRAN_PAYLOAD trivfs_protid_t trivfs_begin_using_protid_payload
+ #define IO_DESTRUCTOR trivfs_end_using_protid (trivfs_protid_t)
+ #define IO_IMPORTS import "libtrivfs/mig-decls.h";
+ 
+ #define FSYS_INTRAN trivfs_control_t trivfs_begin_using_control (fsys_t)
++#define FSYS_INTRAN_PAYLOAD trivfs_control_t trivfs_begin_using_control_payload
+ #define FSYS_DESTRUCTOR trivfs_end_using_control (trivfs_control_t)
+ #define FSYS_IMPORTS import "libtrivfs/mig-decls.h";
+diff --git a/pfinet/ethernet.c b/pfinet/ethernet.c
+index 053fd1b..17967ce 100644
+--- a/pfinet/ethernet.c
++++ b/pfinet/ethernet.c
+@@ -116,12 +116,30 @@ ethernet_demuxer (mach_msg_header_t *inp,
+   int datalen;
+   struct ether_device *edev;
+   struct device *dev = 0;
++  mach_port_t local_port;
+ 
+   if (inp->msgh_id != NET_RCV_MSG_ID)
+     return 0;
+ 
++  if (MACH_MSGH_BITS_LOCAL (inp->msgh_bits) ==
++      MACH_MSG_TYPE_PROTECTED_PAYLOAD)
++    {
++      struct port_info *pi = ports_lookup_payload (NULL,
++                                                   inp->msgh_protected_payload,
++                                                   NULL);
++      if (pi)
++        {
++          local_port = pi->port_right;
++          ports_port_deref (pi);
++        }
++      else
++        local_port = MACH_PORT_NULL;
++    }
++  else
++    local_port = inp->msgh_local_port;
++
+   for (edev = ether_dev; edev; edev = edev->next)
+-    if (inp->msgh_local_port == edev->readptname)
++    if (local_port == edev->readptname)
+       dev = &edev->dev;
+ 
+   if (! dev)
+diff --git a/pfinet/main.c b/pfinet/main.c
+index 5b0262f..2973b8a 100644
+--- a/pfinet/main.c
++++ b/pfinet/main.c
+@@ -86,7 +86,15 @@ pfinet_demuxer (mach_msg_header_t *inp,
+ 
+   /* We have several classes in one bucket, which need to be demuxed
+      differently.  */
+-  pi = ports_lookup_port(pfinet_bucket, inp->msgh_local_port, socketport_class);
++  if (MACH_MSGH_BITS_LOCAL (inp->msgh_bits) ==
++      MACH_MSG_TYPE_PROTECTED_PAYLOAD)
++    pi = ports_lookup_payload (pfinet_bucket,
++                               inp->msgh_protected_payload,
++                               socketport_class);
++  else
++    pi = ports_lookup_port (pfinet_bucket,
++                            inp->msgh_local_port,
++                            socketport_class);
+   
+   if (pi)
+     {
+diff --git a/pfinet/mig-decls.h b/pfinet/mig-decls.h
+index ec8fb23..67bcbfc 100644
+--- a/pfinet/mig-decls.h
++++ b/pfinet/mig-decls.h
+@@ -32,6 +32,12 @@ begin_using_socket_port (mach_port_t port)
+   return ports_lookup_port (pfinet_bucket, port, socketport_class);
+ }
+ 
++static inline struct sock_user * __attribute__ ((unused))
++begin_using_socket_payload (unsigned long payload)
++{
++  return ports_lookup_payload (pfinet_bucket, payload, socketport_class);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_socket_port (struct sock_user *user)
+ {
+@@ -45,6 +51,12 @@ begin_using_sockaddr_port (mach_port_t port)
+   return ports_lookup_port (pfinet_bucket, port, addrport_class);
+ }
+ 
++static inline struct sock_addr * __attribute__ ((unused))
++begin_using_sockaddr_payload (unsigned long payload)
++{
++  return ports_lookup_payload (pfinet_bucket, payload, addrport_class);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_sockaddr_port (struct sock_addr *addr)
+ {
+diff --git a/pfinet/mig-mutate.h b/pfinet/mig-mutate.h
+index 0a1eeb8..2bc385b 100644
+--- a/pfinet/mig-mutate.h
++++ b/pfinet/mig-mutate.h
+@@ -23,18 +23,22 @@
+ #define IO_SELECT_REPLY_PORT
+ 
+ #define IO_INTRAN sock_user_t begin_using_socket_port (io_t)
++#define IO_INTRAN_PAYLOAD sock_user_t begin_using_socket_payload
+ #define IO_DESTRUCTOR end_using_socket_port (sock_user_t)
+ #define IO_IMPORTS import "mig-decls.h";
+ #define IIOCTL_IMPORTS import "mig-decls.h";
+ 
+ #define SOCKET_INTRAN sock_user_t begin_using_socket_port (socket_t)
++#define SOCKET_INTRAN_PAYLOAD sock_user_t begin_using_socket_payload
+ #define SOCKET_DESTRUCTOR end_using_socket_port (sock_user_t)
+ #define SOCKET_IMPORTS				\
+   import "mig-decls.h";				\
+   import "../libtrivfs/mig-decls.h";		\
+ 
+ #define ADDRPORT_INTRAN sock_addr_t begin_using_sockaddr_port (addr_port_t)
++#define ADDRPORT_INTRAN_PAYLOAD sock_addr_t begin_using_sockaddr_payload
+ #define ADDRPORT_DESTRUCTOR end_using_sockaddr_port (sock_addr_t)
+ 
+ #define PF_INTRAN trivfs_protid_t trivfs_begin_using_protid (pf_t)
++#define PF_INTRAN_PAYLOAD trivfs_protid_t trivfs_begin_using_protid_payload
+ #define PF_DESTRUCTOR trivfs_end_using_protid (trivfs_protid_t)
+diff --git a/pflocal/mig-decls.h b/pflocal/mig-decls.h
+index 983de9d..b1da797 100644
+--- a/pflocal/mig-decls.h
++++ b/pflocal/mig-decls.h
+@@ -36,6 +36,12 @@ begin_using_sock_user_port(mach_port_t port)
+   return (sock_user_t)ports_lookup_port (0, port, sock_user_port_class);
+ }
+ 
++static inline sock_user_t __attribute__ ((unused))
++begin_using_sock_user_payload (unsigned long payload)
++{
++  return ports_lookup_payload (NULL, payload, sock_user_port_class);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_sock_user_port (sock_user_t sock_user)
+ {
+@@ -49,6 +55,12 @@ begin_using_addr_port(mach_port_t port)
+   return (addr_t)ports_lookup_port (0, port, addr_port_class);
+ }
+ 
++static inline addr_t __attribute__ ((unused))
++begin_using_addr_payload (unsigned long payload)
++{
++  return ports_lookup_port (NULL, payload, addr_port_class);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_addr_port (addr_t addr)
+ {
+diff --git a/pflocal/mig-mutate.h b/pflocal/mig-mutate.h
+index b149473..238c806 100644
+--- a/pflocal/mig-mutate.h
++++ b/pflocal/mig-mutate.h
+@@ -21,13 +21,16 @@
+ #define IO_SELECT_REPLY_PORT
+ 
+ #define IO_INTRAN sock_user_t begin_using_sock_user_port (io_t)
++#define IO_INTRAN_PAYLOAD sock_user_t begin_using_sock_user_payload
+ #define IO_DESTRUCTOR end_using_sock_user_port (sock_user_t)
+ 
+ #define IO_IMPORTS import "mig-decls.h";
+ 
+ #define SOCKET_INTRAN sock_user_t begin_using_sock_user_port (socket_t)
++#define SOCKET_INTRAN_PAYLOAD sock_user_t begin_using_sock_user_payload
+ #define SOCKET_DESTRUCTOR end_using_sock_user_port (sock_user_t)
+ #define ADDRPORT_INTRAN addr_t begin_using_addr_port (addr_port_t)
++#define ADDRPORT_INTRAN_PAYLOAD addr_t begin_using_addr_payload
+ #define ADDRPORT_DESTRUCTOR end_using_addr_port (addr_t)
+ 
+ #define SOCKET_IMPORTS import "mig-decls.h";
+diff --git a/proc/mig-decls.h b/proc/mig-decls.h
+index 7d36a87..eb33ef3 100644
+--- a/proc/mig-decls.h
++++ b/proc/mig-decls.h
+@@ -35,6 +35,17 @@ begin_using_proc_port (mach_port_t port)
+   return (!p || p->p_dead) ? NULL : p;
+ }
+ 
++static inline struct proc * __attribute__ ((unused))
++begin_using_proc_payload (unsigned long payload)
++{
++  struct proc *p;
++  p = ports_lookup_payload (proc_bucket, payload, proc_class);
++  if (p && p->p_dead)
++    ports_port_deref (p);
++  return (!p || p->p_dead) ? 0 : p;
++}
++
++
+ static inline void __attribute__ ((unused))
+ end_using_proc (struct proc *p)
+ {
+@@ -50,6 +61,12 @@ begin_using_exc_port (mach_port_t port)
+   return ports_lookup_port (NULL, port, exc_class);
+ }
+ 
++static inline exc_t __attribute__ ((unused))
++begin_using_exc_payload (unsigned long payload)
++{
++  return ports_lookup_payload (NULL, payload, exc_class);
++}
++
+ static inline void __attribute__ ((unused))
+ end_using_exc (exc_t exc)
+ {
+diff --git a/proc/mig-mutate.h b/proc/mig-mutate.h
+index ce9f88e..62dc2a5 100644
+--- a/proc/mig-mutate.h
++++ b/proc/mig-mutate.h
+@@ -20,6 +20,8 @@
+ 
+ #define PROCESS_INTRAN						\
+   pstruct_t begin_using_proc_port (process_t)
++#define PROCESS_INTRAN_PAYLOAD					\
++  pstruct_t begin_using_proc_payload
+ #define PROCESS_DESTRUCTOR					\
+   end_using_proc (pstruct_t)
+ #define PROCESS_IMPORTS						\
+@@ -27,6 +29,8 @@
+ 
+ #define NOTIFY_INTRAN						\
+   port_info_t begin_using_port_info_port (mach_port_t)
++#define NOTIFY_INTRAN_PAYLOAD					\
++  port_info_t begin_using_port_info_payload
+ #define NOTIFY_DESTRUCTOR					\
+   end_using_port_info (port_info_t)
+ #define NOTIFY_IMPORTS						\
+diff --git a/proc/proc_exc.defs b/proc/proc_exc.defs
+index c910824..9dc3626 100644
+--- a/proc/proc_exc.defs
++++ b/proc/proc_exc.defs
+@@ -38,6 +38,7 @@ import "mig-decls.h";
+ type exception_t = mach_port_copy_send_t
+ 	cusertype: mach_port_t
+ 	intran: exc_t begin_using_exc_port (exception_t)
++	intranpayload: exc_t begin_using_exc_payload
+ 	destructor: end_using_exc (exc_t);
+ 
+ routine proc_exception_raise (
+diff --git a/term/mig-mutate.h b/term/mig-mutate.h
+index a6b99fe..8927e3a 100644
+--- a/term/mig-mutate.h
++++ b/term/mig-mutate.h
+@@ -20,6 +20,7 @@
+ /* Only CPP macro definitions should go in this file. */
+ 
+ #define IO_INTRAN trivfs_protid_t trivfs_begin_using_protid (io_t)
++#define IO_INTRAN_PAYLOAD trivfs_protid_t trivfs_begin_using_protid_payload
+ #define IO_DESTRUCTOR trivfs_end_using_protid (trivfs_protid_t)
+ #define TIOCTL_IMPORTS import "../libtrivfs/mig-decls.h";
+ #define TERM_IMPORTS import "../libtrivfs/mig-decls.h";
+diff --git a/trans/Makefile b/trans/Makefile
+index 71e6424..24ab9d8 100644
+--- a/trans/Makefile
++++ b/trans/Makefile
+@@ -34,14 +34,20 @@ LDLIBS += -lpthread
+ password-LDLIBS = -lcrypt
+ password-MIGSFLAGS=\
+     "-DIO_INTRAN=trivfs_protid_t trivfs_begin_using_protid (io_t)" \
++    "-DIO_INTRAN_PAYLOAD=trivfs_protid_t trivfs_begin_using_protid_payload" \
+     "-DIO_DESTRUCTOR=trivfs_end_using_protid (trivfs_protid_t)" \
+     "-DPASSWORD_IMPORTS=import \"../libtrivfs/mig-decls.h\";"
+ 
+ ifsock-MIGSFLAGS=\
+     "-DFILE_INTRAN=trivfs_protid_t trivfs_begin_using_protid (io_t)" \
++    "-DFILE_INTRAN_PAYLOAD=trivfs_protid_t trivfs_begin_using_protid_payload" \
+     "-DFILE_DESTRUCTOR=trivfs_end_using_protid (trivfs_protid_t)" \
+     "-DIFSOCK_IMPORTS=import \"../libtrivfs/mig-decls.h\";"
+ 
++# fsysServer is only used by the symlink translator which does not use
++# libports.  Disable the default payload to port conversion.
++fsys-MIGSFLAGS = "-DHURD_DEFAULT_PAYLOAD_TO_PORT=1"
++
+ include ../Makeconf
+ 
+ vpath elfcore.c $(top_srcdir)/exec
+diff --git a/utils/rpctrace.c b/utils/rpctrace.c
+index fc913e3..c7c4d25 100644
+--- a/utils/rpctrace.c
++++ b/utils/rpctrace.c
+@@ -1213,7 +1213,25 @@ trace_and_forward (mach_msg_header_t *inp, mach_msg_header_t *outp)
+   /* Look up our record for the receiving port.  There is no need to check
+      the class, because our port bucket only ever contains one class of
+      ports (traced_class).  */
+-  info = ports_lookup_port (traced_bucket, inp->msgh_local_port, 0);
++
++  if (MACH_MSGH_BITS_LOCAL (inp->msgh_bits) == MACH_MSG_TYPE_PROTECTED_PAYLOAD)
++    {
++      info = (struct traced_info *) inp->msgh_protected_payload;
++      if (info && info->pi.bucket == traced_bucket)
++	{
++	  ports_port_ref (info);
++	  /* Undo the protected payload optimization for our tracee.  */
++	  inp->msgh_bits = MACH_MSGH_BITS (
++	    MACH_MSGH_BITS_REMOTE (inp->msgh_bits),
++	    MACH_MSG_TYPE_PORT_SEND); /* XXX we cannot know the real type :( */
++	  inp->msgh_local_port = ports_payload_get_name (info);
++	}
++      else
++	info = NULL;
++    }
++  else
++    info = ports_lookup_port (traced_bucket, inp->msgh_local_port, 0);
++
+   assert (info);
+ 
+   /* A notification message from the kernel appears to have been sent