1 | /* |
2 | * Copyright (c) 2011 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #include <mach/mach_types.h> |
30 | #include <mach/mach_traps.h> |
31 | #include <mach/mach_vm_server.h> |
32 | #include <mach/mach_port_server.h> |
33 | #include <mach/mach_host_server.h> |
34 | #include <mach/mach_voucher_server.h> |
35 | #include <mach/vm_map.h> |
36 | #include <kern/task.h> |
37 | #include <kern/ipc_tt.h> |
38 | #include <kern/kalloc.h> |
39 | #include <vm/vm_protos.h> |
40 | |
41 | int |
42 | _kernelrpc_mach_vm_allocate_trap(struct _kernelrpc_mach_vm_allocate_trap_args *args) |
43 | { |
44 | mach_vm_offset_t addr; |
45 | task_t task = port_name_to_task(args->target); |
46 | int rv = MACH_SEND_INVALID_DEST; |
47 | |
48 | if (task != current_task()) |
49 | goto done; |
50 | |
51 | if (copyin(args->addr, (char *)&addr, sizeof (addr))) |
52 | goto done; |
53 | |
54 | rv = mach_vm_allocate_external(task->map, &addr, args->size, args->flags); |
55 | if (rv == KERN_SUCCESS) |
56 | rv = copyout(&addr, args->addr, sizeof (addr)); |
57 | |
58 | done: |
59 | if (task) |
60 | task_deallocate(task); |
61 | return (rv); |
62 | } |
63 | |
64 | int |
65 | _kernelrpc_mach_vm_deallocate_trap(struct _kernelrpc_mach_vm_deallocate_args *args) |
66 | { |
67 | task_t task = port_name_to_task(args->target); |
68 | int rv = MACH_SEND_INVALID_DEST; |
69 | |
70 | if (task != current_task()) |
71 | goto done; |
72 | |
73 | rv = mach_vm_deallocate(task->map, args->address, args->size); |
74 | |
75 | done: |
76 | if (task) |
77 | task_deallocate(task); |
78 | return (rv); |
79 | } |
80 | |
81 | int |
82 | _kernelrpc_mach_vm_protect_trap(struct _kernelrpc_mach_vm_protect_args *args) |
83 | { |
84 | task_t task = port_name_to_task(args->target); |
85 | int rv = MACH_SEND_INVALID_DEST; |
86 | |
87 | if (task != current_task()) |
88 | goto done; |
89 | |
90 | rv = mach_vm_protect(task->map, args->address, args->size, |
91 | args->set_maximum, args->new_protection); |
92 | |
93 | done: |
94 | if (task) |
95 | task_deallocate(task); |
96 | return (rv); |
97 | } |
98 | |
99 | int |
100 | _kernelrpc_mach_vm_map_trap(struct _kernelrpc_mach_vm_map_trap_args *args) |
101 | { |
102 | mach_vm_offset_t addr; |
103 | task_t task = port_name_to_task(args->target); |
104 | int rv = MACH_SEND_INVALID_DEST; |
105 | |
106 | if (task != current_task()) |
107 | goto done; |
108 | |
109 | if (copyin(args->addr, (char *)&addr, sizeof (addr))) |
110 | goto done; |
111 | |
112 | rv = mach_vm_map_external(task->map, &addr, args->size, args->mask, args->flags, |
113 | IPC_PORT_NULL, 0, FALSE, args->cur_protection, VM_PROT_ALL, |
114 | VM_INHERIT_DEFAULT); |
115 | if (rv == KERN_SUCCESS) |
116 | rv = copyout(&addr, args->addr, sizeof (addr)); |
117 | |
118 | done: |
119 | if (task) |
120 | task_deallocate(task); |
121 | return (rv); |
122 | } |
123 | |
124 | int |
125 | _kernelrpc_mach_vm_purgable_control_trap( |
126 | struct _kernelrpc_mach_vm_purgable_control_trap_args *args) |
127 | { |
128 | int state; |
129 | task_t task = port_name_to_task(args->target); |
130 | int rv = MACH_SEND_INVALID_DEST; |
131 | |
132 | if (task != current_task()) |
133 | goto done; |
134 | |
135 | if (copyin(args->state, (char *)&state, sizeof (state))) |
136 | goto done; |
137 | |
138 | rv = mach_vm_purgable_control(task->map, |
139 | args->address, |
140 | args->control, |
141 | &state); |
142 | if (rv == KERN_SUCCESS) |
143 | rv = copyout(&state, args->state, sizeof (state)); |
144 | |
145 | done: |
146 | if (task) |
147 | task_deallocate(task); |
148 | return (rv); |
149 | } |
150 | |
151 | int |
152 | _kernelrpc_mach_port_allocate_trap(struct _kernelrpc_mach_port_allocate_args *args) |
153 | { |
154 | task_t task = port_name_to_task(args->target); |
155 | mach_port_name_t name; |
156 | int rv = MACH_SEND_INVALID_DEST; |
157 | |
158 | if (task != current_task()) |
159 | goto done; |
160 | |
161 | rv = mach_port_allocate(task->itk_space, args->right, &name); |
162 | if (rv == KERN_SUCCESS) |
163 | rv = copyout(&name, args->name, sizeof (name)); |
164 | |
165 | |
166 | done: |
167 | if (task) |
168 | task_deallocate(task); |
169 | return (rv); |
170 | } |
171 | |
172 | int |
173 | _kernelrpc_mach_port_destroy_trap(struct _kernelrpc_mach_port_destroy_args *args) |
174 | { |
175 | task_t task = port_name_to_task(args->target); |
176 | int rv = MACH_SEND_INVALID_DEST; |
177 | |
178 | if (task != current_task()) |
179 | goto done; |
180 | |
181 | rv = mach_port_destroy(task->itk_space, args->name); |
182 | |
183 | done: |
184 | if (task) |
185 | task_deallocate(task); |
186 | return (rv); |
187 | } |
188 | |
189 | int |
190 | _kernelrpc_mach_port_deallocate_trap(struct _kernelrpc_mach_port_deallocate_args *args) |
191 | { |
192 | task_t task = port_name_to_task(args->target); |
193 | int rv = MACH_SEND_INVALID_DEST; |
194 | |
195 | if (task != current_task()) |
196 | goto done; |
197 | |
198 | rv = mach_port_deallocate(task->itk_space, args->name); |
199 | |
200 | done: |
201 | if (task) |
202 | task_deallocate(task); |
203 | return (rv); |
204 | } |
205 | |
206 | int |
207 | _kernelrpc_mach_port_mod_refs_trap(struct _kernelrpc_mach_port_mod_refs_args *args) |
208 | { |
209 | task_t task = port_name_to_task(args->target); |
210 | int rv = MACH_SEND_INVALID_DEST; |
211 | |
212 | if (task != current_task()) |
213 | goto done; |
214 | |
215 | rv = mach_port_mod_refs(task->itk_space, args->name, args->right, args->delta); |
216 | |
217 | done: |
218 | if (task) |
219 | task_deallocate(task); |
220 | return (rv); |
221 | } |
222 | |
223 | |
224 | int |
225 | _kernelrpc_mach_port_move_member_trap(struct _kernelrpc_mach_port_move_member_args *args) |
226 | { |
227 | task_t task = port_name_to_task(args->target); |
228 | int rv = MACH_SEND_INVALID_DEST; |
229 | |
230 | if (task != current_task()) |
231 | goto done; |
232 | |
233 | rv = mach_port_move_member(task->itk_space, args->member, args->after); |
234 | |
235 | done: |
236 | if (task) |
237 | task_deallocate(task); |
238 | return (rv); |
239 | } |
240 | |
241 | int |
242 | _kernelrpc_mach_port_insert_right_trap(struct _kernelrpc_mach_port_insert_right_args *args) |
243 | { |
244 | task_t task = port_name_to_task(args->target); |
245 | ipc_port_t port; |
246 | mach_msg_type_name_t disp; |
247 | int rv = MACH_SEND_INVALID_DEST; |
248 | |
249 | if (task != current_task()) |
250 | goto done; |
251 | |
252 | rv = ipc_object_copyin(task->itk_space, args->poly, args->polyPoly, |
253 | (ipc_object_t *)&port); |
254 | if (rv != KERN_SUCCESS) |
255 | goto done; |
256 | disp = ipc_object_copyin_type(args->polyPoly); |
257 | |
258 | rv = mach_port_insert_right(task->itk_space, args->name, port, disp); |
259 | if (rv != KERN_SUCCESS) { |
260 | if (IO_VALID((ipc_object_t)port)) { |
261 | ipc_object_destroy((ipc_object_t)port, disp); |
262 | } |
263 | } |
264 | |
265 | done: |
266 | if (task) |
267 | task_deallocate(task); |
268 | return (rv); |
269 | } |
270 | |
271 | int |
272 | _kernelrpc_mach_port_get_attributes_trap(struct _kernelrpc_mach_port_get_attributes_args *args) |
273 | { |
274 | task_inspect_t task = port_name_to_task_inspect(args->target); |
275 | int rv = MACH_SEND_INVALID_DEST; |
276 | mach_msg_type_number_t count; |
277 | |
278 | if (task != current_task()) |
279 | goto done; |
280 | |
281 | // MIG does not define the type or size of the mach_port_info_t out array |
282 | // anywhere, so derive them from the field in the generated reply struct |
283 | #define MACH_PORT_INFO_OUT (((__Reply__mach_port_get_attributes_t*)NULL)->port_info_out) |
284 | #define MACH_PORT_INFO_STACK_LIMIT 80 // current size is 68 == 17 * sizeof(integer_t) |
285 | _Static_assert(sizeof(MACH_PORT_INFO_OUT) < MACH_PORT_INFO_STACK_LIMIT, |
286 | "mach_port_info_t has grown significantly, reevaluate stack usage" ); |
287 | const mach_msg_type_number_t max_count = (sizeof(MACH_PORT_INFO_OUT)/sizeof(MACH_PORT_INFO_OUT[0])); |
288 | typeof(MACH_PORT_INFO_OUT[0]) info[max_count]; |
289 | |
290 | if (copyin(CAST_USER_ADDR_T(args->count), &count, sizeof(count))) { |
291 | rv = MACH_SEND_INVALID_DATA; |
292 | goto done; |
293 | } |
294 | if (count > max_count) |
295 | count = max_count; |
296 | |
297 | rv = mach_port_get_attributes(task->itk_space, args->name, args->flavor, info, &count); |
298 | if (rv == KERN_SUCCESS) |
299 | rv = copyout(&count, CAST_USER_ADDR_T(args->count), sizeof(count)); |
300 | if (rv == KERN_SUCCESS && count > 0) |
301 | rv = copyout(info, CAST_USER_ADDR_T(args->info), count * sizeof(info[0])); |
302 | |
303 | done: |
304 | if (task) |
305 | task_deallocate(task); |
306 | return (rv); |
307 | } |
308 | |
309 | int |
310 | _kernelrpc_mach_port_insert_member_trap(struct _kernelrpc_mach_port_insert_member_args *args) |
311 | { |
312 | task_t task = port_name_to_task(args->target); |
313 | int rv = MACH_SEND_INVALID_DEST; |
314 | |
315 | if (task != current_task()) |
316 | goto done; |
317 | |
318 | rv = mach_port_insert_member(task->itk_space, args->name, args->pset); |
319 | |
320 | done: |
321 | if (task) |
322 | task_deallocate(task); |
323 | return (rv); |
324 | } |
325 | |
326 | |
327 | int |
328 | (struct _kernelrpc_mach_port_extract_member_args *args) |
329 | { |
330 | task_t task = port_name_to_task(args->target); |
331 | int rv = MACH_SEND_INVALID_DEST; |
332 | |
333 | if (task != current_task()) |
334 | goto done; |
335 | |
336 | rv = mach_port_extract_member(task->itk_space, args->name, args->pset); |
337 | |
338 | done: |
339 | if (task) |
340 | task_deallocate(task); |
341 | return (rv); |
342 | } |
343 | |
344 | int |
345 | _kernelrpc_mach_port_construct_trap(struct _kernelrpc_mach_port_construct_args *args) |
346 | { |
347 | task_t task = port_name_to_task(args->target); |
348 | mach_port_name_t name; |
349 | int rv = MACH_SEND_INVALID_DEST; |
350 | mach_port_options_t options; |
351 | |
352 | if (copyin(args->options, (char *)&options, sizeof (options))) { |
353 | rv = MACH_SEND_INVALID_DATA; |
354 | goto done; |
355 | } |
356 | |
357 | if (task != current_task()) |
358 | goto done; |
359 | |
360 | rv = mach_port_construct(task->itk_space, &options, args->context, &name); |
361 | if (rv == KERN_SUCCESS) |
362 | rv = copyout(&name, args->name, sizeof (name)); |
363 | |
364 | done: |
365 | if (task) |
366 | task_deallocate(task); |
367 | return (rv); |
368 | } |
369 | |
370 | int |
371 | _kernelrpc_mach_port_destruct_trap(struct _kernelrpc_mach_port_destruct_args *args) |
372 | { |
373 | task_t task = port_name_to_task(args->target); |
374 | int rv = MACH_SEND_INVALID_DEST; |
375 | |
376 | if (task != current_task()) |
377 | goto done; |
378 | |
379 | rv = mach_port_destruct(task->itk_space, args->name, args->srdelta, args->guard); |
380 | |
381 | done: |
382 | if (task) |
383 | task_deallocate(task); |
384 | return (rv); |
385 | } |
386 | |
387 | int |
388 | _kernelrpc_mach_port_guard_trap(struct _kernelrpc_mach_port_guard_args *args) |
389 | { |
390 | task_t task = port_name_to_task(args->target); |
391 | int rv = MACH_SEND_INVALID_DEST; |
392 | |
393 | if (task != current_task()) |
394 | goto done; |
395 | |
396 | rv = mach_port_guard(task->itk_space, args->name, args->guard, args->strict); |
397 | |
398 | done: |
399 | if (task) |
400 | task_deallocate(task); |
401 | return (rv); |
402 | } |
403 | |
404 | int |
405 | _kernelrpc_mach_port_unguard_trap(struct _kernelrpc_mach_port_unguard_args *args) |
406 | { |
407 | task_t task = port_name_to_task(args->target); |
408 | int rv = MACH_SEND_INVALID_DEST; |
409 | |
410 | if (task != current_task()) |
411 | goto done; |
412 | |
413 | rv = mach_port_unguard(task->itk_space, args->name, args->guard); |
414 | |
415 | done: |
416 | if (task) |
417 | task_deallocate(task); |
418 | return (rv); |
419 | } |
420 | |
421 | kern_return_t |
422 | host_create_mach_voucher_trap(struct host_create_mach_voucher_args *args) |
423 | { |
424 | host_t host = port_name_to_host(args->host); |
425 | ipc_voucher_t new_voucher = IV_NULL; |
426 | ipc_port_t voucher_port = IPC_PORT_NULL; |
427 | mach_port_name_t voucher_name = 0; |
428 | kern_return_t kr = 0; |
429 | |
430 | if (host == HOST_NULL) |
431 | return MACH_SEND_INVALID_DEST; |
432 | |
433 | if (args->recipes_size < 0) |
434 | return KERN_INVALID_ARGUMENT; |
435 | else if (args->recipes_size > MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE) |
436 | return MIG_ARRAY_TOO_LARGE; |
437 | |
438 | if (args->recipes_size < MACH_VOUCHER_TRAP_STACK_LIMIT) { |
439 | /* keep small recipes on the stack for speed */ |
440 | uint8_t krecipes[args->recipes_size]; |
441 | if (copyin(CAST_USER_ADDR_T(args->recipes), (void *)krecipes, args->recipes_size)) { |
442 | kr = KERN_MEMORY_ERROR; |
443 | goto done; |
444 | } |
445 | kr = host_create_mach_voucher(host, krecipes, args->recipes_size, &new_voucher); |
446 | } else { |
447 | uint8_t *krecipes = kalloc((vm_size_t)args->recipes_size); |
448 | if (!krecipes) { |
449 | kr = KERN_RESOURCE_SHORTAGE; |
450 | goto done; |
451 | } |
452 | |
453 | if (copyin(CAST_USER_ADDR_T(args->recipes), (void *)krecipes, args->recipes_size)) { |
454 | kfree(krecipes, (vm_size_t)args->recipes_size); |
455 | kr = KERN_MEMORY_ERROR; |
456 | goto done; |
457 | } |
458 | |
459 | kr = host_create_mach_voucher(host, krecipes, args->recipes_size, &new_voucher); |
460 | kfree(krecipes, (vm_size_t)args->recipes_size); |
461 | } |
462 | |
463 | if (kr == 0) { |
464 | voucher_port = convert_voucher_to_port(new_voucher); |
465 | voucher_name = ipc_port_copyout_send(voucher_port, current_space()); |
466 | |
467 | kr = copyout(&voucher_name, args->voucher, sizeof(voucher_name)); |
468 | } |
469 | |
470 | done: |
471 | return kr; |
472 | } |
473 | |
474 | kern_return_t |
475 | (struct mach_voucher_extract_attr_recipe_args *args) |
476 | { |
477 | ipc_voucher_t voucher = IV_NULL; |
478 | kern_return_t kr = KERN_SUCCESS; |
479 | mach_msg_type_number_t sz = 0; |
480 | |
481 | if (copyin(args->recipe_size, (void *)&sz, sizeof(sz))) |
482 | return KERN_MEMORY_ERROR; |
483 | |
484 | if (sz > MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE) |
485 | return MIG_ARRAY_TOO_LARGE; |
486 | |
487 | voucher = convert_port_name_to_voucher(args->voucher_name); |
488 | if (voucher == IV_NULL) |
489 | return MACH_SEND_INVALID_DEST; |
490 | |
491 | mach_msg_type_number_t max_sz = sz; |
492 | |
493 | if (sz < MACH_VOUCHER_TRAP_STACK_LIMIT) { |
494 | /* keep small recipes on the stack for speed */ |
495 | uint8_t krecipe[sz]; |
496 | if (copyin(CAST_USER_ADDR_T(args->recipe), (void *)krecipe, sz)) { |
497 | kr = KERN_MEMORY_ERROR; |
498 | goto done; |
499 | } |
500 | kr = mach_voucher_extract_attr_recipe(voucher, args->key, |
501 | (mach_voucher_attr_raw_recipe_t)krecipe, &sz); |
502 | assert(sz <= max_sz); |
503 | |
504 | if (kr == KERN_SUCCESS && sz > 0) |
505 | kr = copyout(krecipe, CAST_USER_ADDR_T(args->recipe), sz); |
506 | } else { |
507 | uint8_t *krecipe = kalloc((vm_size_t)max_sz); |
508 | if (!krecipe) { |
509 | kr = KERN_RESOURCE_SHORTAGE; |
510 | goto done; |
511 | } |
512 | |
513 | if (copyin(CAST_USER_ADDR_T(args->recipe), (void *)krecipe, sz)) { |
514 | kfree(krecipe, (vm_size_t)max_sz); |
515 | kr = KERN_MEMORY_ERROR; |
516 | goto done; |
517 | } |
518 | |
519 | kr = mach_voucher_extract_attr_recipe(voucher, args->key, |
520 | (mach_voucher_attr_raw_recipe_t)krecipe, &sz); |
521 | assert(sz <= max_sz); |
522 | |
523 | if (kr == KERN_SUCCESS && sz > 0) |
524 | kr = copyout(krecipe, CAST_USER_ADDR_T(args->recipe), sz); |
525 | kfree(krecipe, (vm_size_t)max_sz); |
526 | } |
527 | |
528 | if (kr == KERN_SUCCESS) |
529 | kr = copyout(&sz, args->recipe_size, sizeof(sz)); |
530 | |
531 | done: |
532 | ipc_voucher_release(voucher); |
533 | return kr; |
534 | } |
535 | |