[apple/xnu.git] / osfmk / ipc / mach_kernelrpc.c

/*
 * Copyright (c) 2011 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 * 
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 * 
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 * 
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 * 
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

#include <mach/mach_types.h>
#include <mach/mach_traps.h>
#include <mach/mach_vm_server.h>
#include <mach/mach_port_server.h>
#include <mach/mach_host_server.h>
#include <mach/mach_voucher_server.h>
#include <mach/vm_map.h>
#include <kern/task.h>
#include <kern/ipc_tt.h>
#include <kern/kalloc.h>
#include <vm/vm_protos.h>

int
_kernelrpc_mach_vm_allocate_trap(struct _kernelrpc_mach_vm_allocate_trap_args *args)
{
	mach_vm_offset_t addr;
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	if (copyin(args->addr, (char *)&addr, sizeof (addr)))
		goto done;

	rv = mach_vm_allocate_external(task->map, &addr, args->size, args->flags);
	if (rv == KERN_SUCCESS)
		rv = copyout(&addr, args->addr, sizeof (addr));
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_vm_deallocate_trap(struct _kernelrpc_mach_vm_deallocate_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_vm_deallocate(task->map, args->address, args->size);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_vm_protect_trap(struct _kernelrpc_mach_vm_protect_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_vm_protect(task->map, args->address, args->size,
	    args->set_maximum, args->new_protection);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_vm_map_trap(struct _kernelrpc_mach_vm_map_trap_args *args)
{
	mach_vm_offset_t addr;
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	if (copyin(args->addr, (char *)&addr, sizeof (addr)))
		goto done;

	rv = mach_vm_map_external(task->map, &addr, args->size, args->mask, args->flags,
			IPC_PORT_NULL, 0, FALSE, args->cur_protection, VM_PROT_ALL,
			VM_INHERIT_DEFAULT);
	if (rv == KERN_SUCCESS)
		rv = copyout(&addr, args->addr, sizeof (addr));

done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_vm_purgable_control_trap(
	struct _kernelrpc_mach_vm_purgable_control_trap_args *args)
{
	int state;
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	if (copyin(args->state, (char *)&state, sizeof (state)))
		goto done;

	rv = mach_vm_purgable_control(task->map,
				      args->address,
				      args->control,
				      &state);
	if (rv == KERN_SUCCESS)
		rv = copyout(&state, args->state, sizeof (state));
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_allocate_trap(struct _kernelrpc_mach_port_allocate_args *args)
{
	task_t task = port_name_to_task(args->target);
	mach_port_name_t name;
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_allocate(task->itk_space, args->right, &name);
	if (rv == KERN_SUCCESS)
		rv = copyout(&name, args->name, sizeof (name));

	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_destroy_trap(struct _kernelrpc_mach_port_destroy_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_destroy(task->itk_space, args->name);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_deallocate_trap(struct _kernelrpc_mach_port_deallocate_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_deallocate(task->itk_space, args->name);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_mod_refs_trap(struct _kernelrpc_mach_port_mod_refs_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_mod_refs(task->itk_space, args->name, args->right, args->delta);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}


int
_kernelrpc_mach_port_move_member_trap(struct _kernelrpc_mach_port_move_member_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_move_member(task->itk_space, args->member, args->after);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_insert_right_trap(struct _kernelrpc_mach_port_insert_right_args *args)
{
	task_t task = port_name_to_task(args->target);
	ipc_port_t port;
	mach_msg_type_name_t disp;
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = ipc_object_copyin(task->itk_space, args->poly, args->polyPoly,
	    (ipc_object_t *)&port);
	if (rv != KERN_SUCCESS)
		goto done;
	disp = ipc_object_copyin_type(args->polyPoly);

	rv = mach_port_insert_right(task->itk_space, args->name, port, disp);
	if (rv != KERN_SUCCESS) {
		if (IO_VALID((ipc_object_t)port)) {
			ipc_object_destroy((ipc_object_t)port, disp);
		}
	}
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_get_attributes_trap(struct _kernelrpc_mach_port_get_attributes_args *args)
{
	task_inspect_t task = port_name_to_task_inspect(args->target);
	int rv = MACH_SEND_INVALID_DEST;
	mach_msg_type_number_t count;

	if (task != current_task())
		goto done;

	// MIG does not define the type or size of the mach_port_info_t out array
	// anywhere, so derive them from the field in the generated reply struct
#define MACH_PORT_INFO_OUT (((__Reply__mach_port_get_attributes_t*)NULL)->port_info_out)
#define MACH_PORT_INFO_STACK_LIMIT 80 // current size is 68 == 17 * sizeof(integer_t)
	_Static_assert(sizeof(MACH_PORT_INFO_OUT) < MACH_PORT_INFO_STACK_LIMIT,
			"mach_port_info_t has grown significantly, reevaluate stack usage");
	const mach_msg_type_number_t max_count = (sizeof(MACH_PORT_INFO_OUT)/sizeof(MACH_PORT_INFO_OUT[0]));
	typeof(MACH_PORT_INFO_OUT[0]) info[max_count];

	if (copyin(CAST_USER_ADDR_T(args->count), &count, sizeof(count))) {
		rv = MACH_SEND_INVALID_DATA;
		goto done;
	}
	if (count > max_count)
		count = max_count;

	rv = mach_port_get_attributes(task->itk_space, args->name, args->flavor, info, &count);
	if (rv == KERN_SUCCESS)
		rv = copyout(&count, CAST_USER_ADDR_T(args->count), sizeof(count));
	if (rv == KERN_SUCCESS && count > 0)
		rv = copyout(info, CAST_USER_ADDR_T(args->info), count * sizeof(info[0]));

done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_insert_member_trap(struct _kernelrpc_mach_port_insert_member_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_insert_member(task->itk_space, args->name, args->pset);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}


int
_kernelrpc_mach_port_extract_member_trap(struct _kernelrpc_mach_port_extract_member_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_extract_member(task->itk_space, args->name, args->pset);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_construct_trap(struct _kernelrpc_mach_port_construct_args *args)
{
	task_t task = port_name_to_task(args->target);
	mach_port_name_t name;
	int rv = MACH_SEND_INVALID_DEST;
	mach_port_options_t options;

	if (copyin(args->options, (char *)&options, sizeof (options))) {
		rv = MACH_SEND_INVALID_DATA;
		goto done;
	}

	if (task != current_task())
		goto done;

	rv = mach_port_construct(task->itk_space, &options, args->context, &name);
	if (rv == KERN_SUCCESS)
		rv = copyout(&name, args->name, sizeof (name));

done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_destruct_trap(struct _kernelrpc_mach_port_destruct_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_destruct(task->itk_space, args->name, args->srdelta, args->guard);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_guard_trap(struct _kernelrpc_mach_port_guard_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_guard(task->itk_space, args->name, args->guard, args->strict);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

int
_kernelrpc_mach_port_unguard_trap(struct _kernelrpc_mach_port_unguard_args *args)
{
	task_t task = port_name_to_task(args->target);
	int rv = MACH_SEND_INVALID_DEST;

	if (task != current_task())
		goto done;

	rv = mach_port_unguard(task->itk_space, args->name, args->guard);
	
done:
	if (task)
		task_deallocate(task);
	return (rv);
}

kern_return_t
host_create_mach_voucher_trap(struct host_create_mach_voucher_args *args)
{
	host_t host = port_name_to_host(args->host);
	ipc_voucher_t new_voucher = IV_NULL;
	ipc_port_t voucher_port = IPC_PORT_NULL;
	mach_port_name_t voucher_name = 0;
	kern_return_t kr = 0;

	if (host == HOST_NULL)
		return MACH_SEND_INVALID_DEST;

	if (args->recipes_size < 0)
		return KERN_INVALID_ARGUMENT;
	else if (args->recipes_size > MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE)
		return MIG_ARRAY_TOO_LARGE;

	if (args->recipes_size < MACH_VOUCHER_TRAP_STACK_LIMIT) {
		/* keep small recipes on the stack for speed */
		uint8_t krecipes[args->recipes_size];
		if (copyin(CAST_USER_ADDR_T(args->recipes), (void *)krecipes, args->recipes_size)) {
			kr = KERN_MEMORY_ERROR;
			goto done;
		}
		kr = host_create_mach_voucher(host, krecipes, args->recipes_size, &new_voucher);
	} else {
		uint8_t *krecipes = kalloc((vm_size_t)args->recipes_size);
		if (!krecipes) {
			kr = KERN_RESOURCE_SHORTAGE;
			goto done;
		}

		if (copyin(CAST_USER_ADDR_T(args->recipes), (void *)krecipes, args->recipes_size)) {
			kfree(krecipes, (vm_size_t)args->recipes_size);
			kr = KERN_MEMORY_ERROR;
			goto done;
		}

		kr = host_create_mach_voucher(host, krecipes, args->recipes_size, &new_voucher);
		kfree(krecipes, (vm_size_t)args->recipes_size);
	}

	if (kr == 0) {
		voucher_port = convert_voucher_to_port(new_voucher);
		voucher_name = ipc_port_copyout_send(voucher_port, current_space());

		kr = copyout(&voucher_name, args->voucher, sizeof(voucher_name));
	}

done:
	return kr;
}

kern_return_t
mach_voucher_extract_attr_recipe_trap(struct mach_voucher_extract_attr_recipe_args *args)
{
	ipc_voucher_t voucher = IV_NULL;
	kern_return_t kr = KERN_SUCCESS;
	mach_msg_type_number_t sz = 0;

	if (copyin(args->recipe_size, (void *)&sz, sizeof(sz)))
		return KERN_MEMORY_ERROR;

	if (sz > MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE)
		return MIG_ARRAY_TOO_LARGE;

	voucher = convert_port_name_to_voucher(args->voucher_name);
	if (voucher == IV_NULL)
		return MACH_SEND_INVALID_DEST;

	mach_msg_type_number_t max_sz = sz;

	if (sz < MACH_VOUCHER_TRAP_STACK_LIMIT) {
		/* keep small recipes on the stack for speed */
		uint8_t krecipe[sz];
		if (copyin(CAST_USER_ADDR_T(args->recipe), (void *)krecipe, sz)) {
			kr = KERN_MEMORY_ERROR;
			goto done;
		}
		kr = mach_voucher_extract_attr_recipe(voucher, args->key,
		                                      (mach_voucher_attr_raw_recipe_t)krecipe, &sz);
		assert(sz <= max_sz);

		if (kr == KERN_SUCCESS && sz > 0)
			kr = copyout(krecipe, CAST_USER_ADDR_T(args->recipe), sz);
	} else {
		uint8_t *krecipe = kalloc((vm_size_t)max_sz);
		if (!krecipe) {
			kr = KERN_RESOURCE_SHORTAGE;
			goto done;
		}

		if (copyin(CAST_USER_ADDR_T(args->recipe), (void *)krecipe, sz)) {
			kfree(krecipe, (vm_size_t)max_sz);
			kr = KERN_MEMORY_ERROR;
			goto done;
		}

		kr = mach_voucher_extract_attr_recipe(voucher, args->key,
		                                      (mach_voucher_attr_raw_recipe_t)krecipe, &sz);
		assert(sz <= max_sz);

		if (kr == KERN_SUCCESS && sz > 0)
			kr = copyout(krecipe, CAST_USER_ADDR_T(args->recipe), sz);
		kfree(krecipe, (vm_size_t)max_sz);
	}

	if (kr == KERN_SUCCESS)
		kr = copyout(&sz, args->recipe_size, sizeof(sz));

done:
	ipc_voucher_release(voucher);
	return kr;
}
Commit	Line	Data
316670eb A	1	/*
	2	* Copyright (c) 2011 Apple Inc. All rights reserved.
	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
	28
	29	#include <mach/mach_types.h>
	30	#include <mach/mach_traps.h>
	31	#include <mach/mach_vm_server.h>
	32	#include <mach/mach_port_server.h>
39037602 A	33	#include <mach/mach_host_server.h>
39037602 A	34	#include <mach/mach_voucher_server.h>
316670eb A	35	#include <mach/vm_map.h>
	36	#include <kern/task.h>
	37	#include <kern/ipc_tt.h>
39037602	38	#include <kern/kalloc.h>
316670eb A	39	#include <vm/vm_protos.h>
	40
	41	int
	42	_kernelrpc_mach_vm_allocate_trap(struct _kernelrpc_mach_vm_allocate_trap_args *args)
	43	{
	44	mach_vm_offset_t addr;
	45	task_t task = port_name_to_task(args->target);
	46	int rv = MACH_SEND_INVALID_DEST;
	47
	48	if (task != current_task())
	49	goto done;
	50
	51	if (copyin(args->addr, (char *)&addr, sizeof (addr)))
	52	goto done;
	53
5ba3f43e	54	rv = mach_vm_allocate_external(task->map, &addr, args->size, args->flags);
316670eb A	55	if (rv == KERN_SUCCESS)
	56	rv = copyout(&addr, args->addr, sizeof (addr));
	57
	58	done:
	59	if (task)
	60	task_deallocate(task);
	61	return (rv);
	62	}
	63
	64	int
	65	_kernelrpc_mach_vm_deallocate_trap(struct _kernelrpc_mach_vm_deallocate_args *args)
	66	{
	67	task_t task = port_name_to_task(args->target);
	68	int rv = MACH_SEND_INVALID_DEST;
	69
	70	if (task != current_task())
	71	goto done;
	72
	73	rv = mach_vm_deallocate(task->map, args->address, args->size);
	74
	75	done:
	76	if (task)
	77	task_deallocate(task);
	78	return (rv);
	79	}
	80
	81	int
	82	_kernelrpc_mach_vm_protect_trap(struct _kernelrpc_mach_vm_protect_args *args)
	83	{
	84	task_t task = port_name_to_task(args->target);
	85	int rv = MACH_SEND_INVALID_DEST;
	86
	87	if (task != current_task())
	88	goto done;
	89
	90	rv = mach_vm_protect(task->map, args->address, args->size,
	91	args->set_maximum, args->new_protection);
	92
	93	done:
	94	if (task)
	95	task_deallocate(task);
	96	return (rv);
	97	}
	98
39236c6e A	99	int
	100	_kernelrpc_mach_vm_map_trap(struct _kernelrpc_mach_vm_map_trap_args *args)
	101	{
	102	mach_vm_offset_t addr;
	103	task_t task = port_name_to_task(args->target);
	104	int rv = MACH_SEND_INVALID_DEST;
	105
	106	if (task != current_task())
	107	goto done;
	108
	109	if (copyin(args->addr, (char *)&addr, sizeof (addr)))
	110	goto done;
	111
5ba3f43e	112	rv = mach_vm_map_external(task->map, &addr, args->size, args->mask, args->flags,
39236c6e A	113	IPC_PORT_NULL, 0, FALSE, args->cur_protection, VM_PROT_ALL,
	114	VM_INHERIT_DEFAULT);
	115	if (rv == KERN_SUCCESS)
	116	rv = copyout(&addr, args->addr, sizeof (addr));
	117
	118	done:
	119	if (task)
	120	task_deallocate(task);
	121	return (rv);
	122	}
	123
39037602 A	124	int
	125	_kernelrpc_mach_vm_purgable_control_trap(
	126	struct _kernelrpc_mach_vm_purgable_control_trap_args *args)
	127	{
	128	int state;
	129	task_t task = port_name_to_task(args->target);
	130	int rv = MACH_SEND_INVALID_DEST;
	131
	132	if (task != current_task())
	133	goto done;
	134
	135	if (copyin(args->state, (char *)&state, sizeof (state)))
	136	goto done;
	137
	138	rv = mach_vm_purgable_control(task->map,
	139	args->address,
	140	args->control,
	141	&state);
	142	if (rv == KERN_SUCCESS)
	143	rv = copyout(&state, args->state, sizeof (state));
	144
	145	done:
	146	if (task)
	147	task_deallocate(task);
	148	return (rv);
	149	}
	150
316670eb A	151	int
	152	_kernelrpc_mach_port_allocate_trap(struct _kernelrpc_mach_port_allocate_args *args)
	153	{
	154	task_t task = port_name_to_task(args->target);
	155	mach_port_name_t name;
	156	int rv = MACH_SEND_INVALID_DEST;
	157
	158	if (task != current_task())
	159	goto done;
	160
	161	rv = mach_port_allocate(task->itk_space, args->right, &name);
	162	if (rv == KERN_SUCCESS)
	163	rv = copyout(&name, args->name, sizeof (name));
	164
	165
	166	done:
	167	if (task)
	168	task_deallocate(task);
	169	return (rv);
	170	}
	171
	172	int
	173	_kernelrpc_mach_port_destroy_trap(struct _kernelrpc_mach_port_destroy_args *args)
	174	{
	175	task_t task = port_name_to_task(args->target);
	176	int rv = MACH_SEND_INVALID_DEST;
	177
	178	if (task != current_task())
	179	goto done;
	180
	181	rv = mach_port_destroy(task->itk_space, args->name);
	182
	183	done:
	184	if (task)
	185	task_deallocate(task);
	186	return (rv);
	187	}
	188
	189	int
	190	_kernelrpc_mach_port_deallocate_trap(struct _kernelrpc_mach_port_deallocate_args *args)
	191	{
	192	task_t task = port_name_to_task(args->target);
	193	int rv = MACH_SEND_INVALID_DEST;
	194
	195	if (task != current_task())
	196	goto done;
	197
	198	rv = mach_port_deallocate(task->itk_space, args->name);
	199
	200	done:
	201	if (task)
	202	task_deallocate(task);
	203	return (rv);
	204	}
	205
	206	int
	207	_kernelrpc_mach_port_mod_refs_trap(struct _kernelrpc_mach_port_mod_refs_args *args)
	208	{
	209	task_t task = port_name_to_task(args->target);
	210	int rv = MACH_SEND_INVALID_DEST;
	211
	212	if (task != current_task())
	213	goto done;
	214
215	rv = mach_port_mod_refs(task->itk_space, args->name, args->right, args->delta);
216
217	done:
218	if (task)
219	task_deallocate(task);
220	return (rv);
221	}
222
223
224	int
225	_kernelrpc_mach_port_move_member_trap(struct _kernelrpc_mach_port_move_member_args *args)
226	{
227	task_t task = port_name_to_task(args->target);
228	int rv = MACH_SEND_INVALID_DEST;
229
230	if (task != current_task())
231	goto done;
232
233	rv = mach_port_move_member(task->itk_space, args->member, args->after);
234
235	done:
236	if (task)
237	task_deallocate(task);
238	return (rv);
239	}
240
241	int
242	_kernelrpc_mach_port_insert_right_trap(struct _kernelrpc_mach_port_insert_right_args *args)
243	{
244	task_t task = port_name_to_task(args->target);
245	ipc_port_t port;
246	mach_msg_type_name_t disp;
247	int rv = MACH_SEND_INVALID_DEST;
248
249	if (task != current_task())
250	goto done;
251
252	rv = ipc_object_copyin(task->itk_space, args->poly, args->polyPoly,
253	(ipc_object_t *)&port);
254	if (rv != KERN_SUCCESS)
255	goto done;
256	disp = ipc_object_copyin_type(args->polyPoly);
257
258	rv = mach_port_insert_right(task->itk_space, args->name, port, disp);
d190cdc3 A	259	if (rv != KERN_SUCCESS) {
	260	if (IO_VALID((ipc_object_t)port)) {
	261	ipc_object_destroy((ipc_object_t)port, disp);
	262	}
	263	}
316670eb A	264
	265	done:
	266	if (task)
	267	task_deallocate(task);
	268	return (rv);
	269	}
	270
d9a64523 A	271	int
	272	_kernelrpc_mach_port_get_attributes_trap(struct _kernelrpc_mach_port_get_attributes_args *args)
	273	{
	274	task_inspect_t task = port_name_to_task_inspect(args->target);
	275	int rv = MACH_SEND_INVALID_DEST;
	276	mach_msg_type_number_t count;
	277
	278	if (task != current_task())
	279	goto done;
	280
	281	// MIG does not define the type or size of the mach_port_info_t out array
	282	// anywhere, so derive them from the field in the generated reply struct
	283	#define MACH_PORT_INFO_OUT (((__Reply__mach_port_get_attributes_t*)NULL)->port_info_out)
	284	#define MACH_PORT_INFO_STACK_LIMIT 80 // current size is 68 == 17 * sizeof(integer_t)
	285	_Static_assert(sizeof(MACH_PORT_INFO_OUT) < MACH_PORT_INFO_STACK_LIMIT,
	286	"mach_port_info_t has grown significantly, reevaluate stack usage");
	287	const mach_msg_type_number_t max_count = (sizeof(MACH_PORT_INFO_OUT)/sizeof(MACH_PORT_INFO_OUT[0]));
	288	typeof(MACH_PORT_INFO_OUT[0]) info[max_count];
	289
	290	if (copyin(CAST_USER_ADDR_T(args->count), &count, sizeof(count))) {
	291	rv = MACH_SEND_INVALID_DATA;
	292	goto done;
	293	}
	294	if (count > max_count)
	295	count = max_count;
	296
	297	rv = mach_port_get_attributes(task->itk_space, args->name, args->flavor, info, &count);
	298	if (rv == KERN_SUCCESS)
	299	rv = copyout(&count, CAST_USER_ADDR_T(args->count), sizeof(count));
	300	if (rv == KERN_SUCCESS && count > 0)
	301	rv = copyout(info, CAST_USER_ADDR_T(args->info), count * sizeof(info[0]));
	302
	303	done:
	304	if (task)
	305	task_deallocate(task);
	306	return (rv);
	307	}
	308
316670eb A	309	int
	310	_kernelrpc_mach_port_insert_member_trap(struct _kernelrpc_mach_port_insert_member_args *args)
	311	{
	312	task_t task = port_name_to_task(args->target);
	313	int rv = MACH_SEND_INVALID_DEST;
	314
	315	if (task != current_task())
	316	goto done;
	317
	318	rv = mach_port_insert_member(task->itk_space, args->name, args->pset);
	319
	320	done:
	321	if (task)
	322	task_deallocate(task);
	323	return (rv);
	324	}
	325
	326
	327	int
	328	_kernelrpc_mach_port_extract_member_trap(struct _kernelrpc_mach_port_extract_member_args *args)
	329	{
	330	task_t task = port_name_to_task(args->target);
	331	int rv = MACH_SEND_INVALID_DEST;
	332
	333	if (task != current_task())
	334	goto done;
	335
	336	rv = mach_port_extract_member(task->itk_space, args->name, args->pset);
	337
	338	done:
	339	if (task)
	340	task_deallocate(task);
	341	return (rv);
	342	}
39236c6e A	343
	344	int
	345	_kernelrpc_mach_port_construct_trap(struct _kernelrpc_mach_port_construct_args *args)
	346	{
	347	task_t task = port_name_to_task(args->target);
	348	mach_port_name_t name;
	349	int rv = MACH_SEND_INVALID_DEST;
	350	mach_port_options_t options;
	351
	352	if (copyin(args->options, (char *)&options, sizeof (options))) {
	353	rv = MACH_SEND_INVALID_DATA;
	354	goto done;
	355	}
	356
	357	if (task != current_task())
	358	goto done;
	359
	360	rv = mach_port_construct(task->itk_space, &options, args->context, &name);
	361	if (rv == KERN_SUCCESS)
	362	rv = copyout(&name, args->name, sizeof (name));
	363
	364	done:
	365	if (task)
	366	task_deallocate(task);
	367	return (rv);
	368	}
	369
	370	int
	371	_kernelrpc_mach_port_destruct_trap(struct _kernelrpc_mach_port_destruct_args *args)
	372	{
	373	task_t task = port_name_to_task(args->target);
	374	int rv = MACH_SEND_INVALID_DEST;
	375
	376	if (task != current_task())
	377	goto done;
	378
	379	rv = mach_port_destruct(task->itk_space, args->name, args->srdelta, args->guard);
	380
	381	done:
	382	if (task)
	383	task_deallocate(task);
	384	return (rv);
	385	}
	386
	387	int
	388	_kernelrpc_mach_port_guard_trap(struct _kernelrpc_mach_port_guard_args *args)
	389	{
	390	task_t task = port_name_to_task(args->target);
	391	int rv = MACH_SEND_INVALID_DEST;
	392
	393	if (task != current_task())
	394	goto done;
	395
	396	rv = mach_port_guard(task->itk_space, args->name, args->guard, args->strict);
	397
	398	done:
	399	if (task)
	400	task_deallocate(task);
	401	return (rv);
	402	}
	403
	404	int
	405	_kernelrpc_mach_port_unguard_trap(struct _kernelrpc_mach_port_unguard_args *args)
	406	{
407	task_t task = port_name_to_task(args->target);
408	int rv = MACH_SEND_INVALID_DEST;
409
410	if (task != current_task())
411	goto done;
412
413	rv = mach_port_unguard(task->itk_space, args->name, args->guard);
414
415	done:
416	if (task)
417	task_deallocate(task);
418	return (rv);
419	}
420
39037602 A	421	kern_return_t
	422	host_create_mach_voucher_trap(struct host_create_mach_voucher_args *args)
	423	{
	424	host_t host = port_name_to_host(args->host);
	425	ipc_voucher_t new_voucher = IV_NULL;
	426	ipc_port_t voucher_port = IPC_PORT_NULL;
	427	mach_port_name_t voucher_name = 0;
	428	kern_return_t kr = 0;
	429
	430	if (host == HOST_NULL)
	431	return MACH_SEND_INVALID_DEST;
	432
	433	if (args->recipes_size < 0)
	434	return KERN_INVALID_ARGUMENT;
	435	else if (args->recipes_size > MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE)
	436	return MIG_ARRAY_TOO_LARGE;
	437
	438	if (args->recipes_size < MACH_VOUCHER_TRAP_STACK_LIMIT) {
	439	/* keep small recipes on the stack for speed */
	440	uint8_t krecipes[args->recipes_size];
5ba3f43e	441	if (copyin(CAST_USER_ADDR_T(args->recipes), (void *)krecipes, args->recipes_size)) {
39037602 A	442	kr = KERN_MEMORY_ERROR;
	443	goto done;
	444	}
	445	kr = host_create_mach_voucher(host, krecipes, args->recipes_size, &new_voucher);
	446	} else {
	447	uint8_t *krecipes = kalloc((vm_size_t)args->recipes_size);
	448	if (!krecipes) {
	449	kr = KERN_RESOURCE_SHORTAGE;
	450	goto done;
	451	}
	452
5ba3f43e	453	if (copyin(CAST_USER_ADDR_T(args->recipes), (void *)krecipes, args->recipes_size)) {
39037602 A	454	kfree(krecipes, (vm_size_t)args->recipes_size);
	455	kr = KERN_MEMORY_ERROR;
	456	goto done;
	457	}
	458
	459	kr = host_create_mach_voucher(host, krecipes, args->recipes_size, &new_voucher);
	460	kfree(krecipes, (vm_size_t)args->recipes_size);
	461	}
	462
	463	if (kr == 0) {
	464	voucher_port = convert_voucher_to_port(new_voucher);
	465	voucher_name = ipc_port_copyout_send(voucher_port, current_space());
	466
	467	kr = copyout(&voucher_name, args->voucher, sizeof(voucher_name));
	468	}
	469
	470	done:
	471	return kr;
	472	}
	473
	474	kern_return_t
	475	mach_voucher_extract_attr_recipe_trap(struct mach_voucher_extract_attr_recipe_args *args)
	476	{
	477	ipc_voucher_t voucher = IV_NULL;
	478	kern_return_t kr = KERN_SUCCESS;
	479	mach_msg_type_number_t sz = 0;
	480
	481	if (copyin(args->recipe_size, (void *)&sz, sizeof(sz)))
	482	return KERN_MEMORY_ERROR;
	483
	484	if (sz > MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE)
	485	return MIG_ARRAY_TOO_LARGE;
	486
	487	voucher = convert_port_name_to_voucher(args->voucher_name);
	488	if (voucher == IV_NULL)
	489	return MACH_SEND_INVALID_DEST;
	490
eee35659	491	mach_msg_type_number_t max_sz = sz;
39037602 A	492
	493	if (sz < MACH_VOUCHER_TRAP_STACK_LIMIT) {
	494	/* keep small recipes on the stack for speed */
	495	uint8_t krecipe[sz];
5ba3f43e	496	if (copyin(CAST_USER_ADDR_T(args->recipe), (void *)krecipe, sz)) {
39037602 A	497	kr = KERN_MEMORY_ERROR;
	498	goto done;
	499	}
	500	kr = mach_voucher_extract_attr_recipe(voucher, args->key,
	501	(mach_voucher_attr_raw_recipe_t)krecipe, &sz);
	502	assert(sz <= max_sz);
	503
	504	if (kr == KERN_SUCCESS && sz > 0)
5ba3f43e	505	kr = copyout(krecipe, CAST_USER_ADDR_T(args->recipe), sz);
39037602	506	} else {
eee35659	507	uint8_t *krecipe = kalloc((vm_size_t)max_sz);
39037602 A	508	if (!krecipe) {
	509	kr = KERN_RESOURCE_SHORTAGE;
	510	goto done;
	511	}
	512
5ba3f43e	513	if (copyin(CAST_USER_ADDR_T(args->recipe), (void *)krecipe, sz)) {
eee35659	514	kfree(krecipe, (vm_size_t)max_sz);
39037602 A	515	kr = KERN_MEMORY_ERROR;
	516	goto done;
	517	}
	518
	519	kr = mach_voucher_extract_attr_recipe(voucher, args->key,
	520	(mach_voucher_attr_raw_recipe_t)krecipe, &sz);
	521	assert(sz <= max_sz);
	522
	523	if (kr == KERN_SUCCESS && sz > 0)
5ba3f43e	524	kr = copyout(krecipe, CAST_USER_ADDR_T(args->recipe), sz);
eee35659	525	kfree(krecipe, (vm_size_t)max_sz);
39037602 A	526	}
39037602 A	527
d9a64523 A	528	if (kr == KERN_SUCCESS)
d9a64523 A	529	kr = copyout(&sz, args->recipe_size, sizeof(sz));
39037602 A	530
	531	done:
	532	ipc_voucher_release(voucher);
	533	return kr;
	534	}