+int
+_kernelrpc_mach_port_request_notification_trap(
+ struct _kernelrpc_mach_port_request_notification_args *args)
+{
+ task_t task = port_name_to_task(args->target);
+ int rv = MACH_SEND_INVALID_DEST;
+ ipc_port_t notify, previous;
+ mach_msg_type_name_t disp;
+ mach_port_name_t previous_name = MACH_PORT_NULL;
+
+ if (task != current_task()) {
+ goto done;
+ }
+
+ disp = ipc_object_copyin_type(args->notifyPoly);
+ if (disp != MACH_MSG_TYPE_PORT_SEND_ONCE) {
+ goto done;
+ }
+
+ if (MACH_PORT_VALID(args->notify)) {
+ rv = ipc_object_copyin(task->itk_space, args->notify, args->notifyPoly,
+ (ipc_object_t *)¬ify, 0, NULL, 0);
+ } else {
+ notify = CAST_MACH_NAME_TO_PORT(args->notify);
+ }
+ if (rv != KERN_SUCCESS) {
+ goto done;
+ }
+
+ rv = mach_port_request_notification(task->itk_space, args->name,
+ args->msgid, args->sync, notify, &previous);
+ if (rv != KERN_SUCCESS) {
+ ipc_object_destroy(ip_to_object(notify), disp);
+ goto done;
+ }
+
+ if (IP_VALID(previous)) {
+ // Remove once <rdar://problem/45522961> is fixed.
+ // We need to make ith_knote NULL as ipc_object_copyout() uses
+ // thread-argument-passing and its value should not be garbage
+ current_thread()->ith_knote = ITH_KNOTE_NULL;
+ rv = ipc_object_copyout(task->itk_space, ip_to_object(previous),
+ MACH_MSG_TYPE_PORT_SEND_ONCE, NULL, NULL, &previous_name);
+ if (rv != KERN_SUCCESS) {
+ ipc_object_destroy(ip_to_object(previous),
+ MACH_MSG_TYPE_PORT_SEND_ONCE);
+ goto done;
+ }
+ }
+
+ rv = copyout(&previous_name, args->previous, sizeof(previous_name));
+
+done:
+ if (task) {
+ task_deallocate(task);
+ }
+ return rv;
+}
+
+kern_return_t
+host_create_mach_voucher_trap(struct host_create_mach_voucher_args *args)
+{
+ host_t host = port_name_to_host(args->host);
+ ipc_voucher_t new_voucher = IV_NULL;
+ ipc_port_t voucher_port = IPC_PORT_NULL;
+ mach_port_name_t voucher_name = 0;
+ kern_return_t kr = 0;
+
+ if (host == HOST_NULL) {
+ return MACH_SEND_INVALID_DEST;
+ }
+
+ if (args->recipes_size < 0) {
+ return KERN_INVALID_ARGUMENT;
+ } else if (args->recipes_size > MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE) {
+ return MIG_ARRAY_TOO_LARGE;
+ }
+
+ if (args->recipes_size < MACH_VOUCHER_TRAP_STACK_LIMIT) {
+ /* keep small recipes on the stack for speed */
+ uint8_t krecipes[args->recipes_size];
+ if (copyin(CAST_USER_ADDR_T(args->recipes), (void *)krecipes, args->recipes_size)) {
+ kr = KERN_MEMORY_ERROR;
+ goto done;
+ }
+ kr = host_create_mach_voucher(host, krecipes, args->recipes_size, &new_voucher);
+ } else {
+ uint8_t *krecipes = kalloc((vm_size_t)args->recipes_size);
+ if (!krecipes) {
+ kr = KERN_RESOURCE_SHORTAGE;
+ goto done;
+ }
+
+ if (copyin(CAST_USER_ADDR_T(args->recipes), (void *)krecipes, args->recipes_size)) {
+ kfree(krecipes, (vm_size_t)args->recipes_size);
+ kr = KERN_MEMORY_ERROR;
+ goto done;
+ }
+
+ kr = host_create_mach_voucher(host, krecipes, args->recipes_size, &new_voucher);
+ kfree(krecipes, (vm_size_t)args->recipes_size);
+ }
+
+ if (kr == 0) {
+ voucher_port = convert_voucher_to_port(new_voucher);
+ voucher_name = ipc_port_copyout_send(voucher_port, current_space());
+
+ kr = copyout(&voucher_name, args->voucher, sizeof(voucher_name));
+ }
+
+done:
+ return kr;
+}
+
+kern_return_t
+mach_voucher_extract_attr_recipe_trap(struct mach_voucher_extract_attr_recipe_args *args)
+{
+ ipc_voucher_t voucher = IV_NULL;
+ kern_return_t kr = KERN_SUCCESS;
+ mach_msg_type_number_t sz = 0;
+
+ if (copyin(args->recipe_size, (void *)&sz, sizeof(sz))) {
+ return KERN_MEMORY_ERROR;
+ }
+
+ if (sz > MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE) {
+ return MIG_ARRAY_TOO_LARGE;
+ }
+
+ voucher = convert_port_name_to_voucher(args->voucher_name);
+ if (voucher == IV_NULL) {
+ return MACH_SEND_INVALID_DEST;
+ }
+
+ mach_msg_type_number_t max_sz = sz;
+
+ if (sz < MACH_VOUCHER_TRAP_STACK_LIMIT) {
+ /* keep small recipes on the stack for speed */
+ uint8_t krecipe[sz];
+ bzero(krecipe, sz);
+ if (copyin(CAST_USER_ADDR_T(args->recipe), (void *)krecipe, sz)) {
+ kr = KERN_MEMORY_ERROR;
+ goto done;
+ }
+ kr = mach_voucher_extract_attr_recipe(voucher, args->key,
+ (mach_voucher_attr_raw_recipe_t)krecipe, &sz);
+ assert(sz <= max_sz);
+
+ if (kr == KERN_SUCCESS && sz > 0) {
+ kr = copyout(krecipe, CAST_USER_ADDR_T(args->recipe), sz);
+ }
+ } else {
+ uint8_t *krecipe = kalloc((vm_size_t)max_sz);
+ if (!krecipe) {
+ kr = KERN_RESOURCE_SHORTAGE;
+ goto done;
+ }
+
+ if (copyin(CAST_USER_ADDR_T(args->recipe), (void *)krecipe, sz)) {
+ kfree(krecipe, (vm_size_t)max_sz);
+ kr = KERN_MEMORY_ERROR;
+ goto done;
+ }
+
+ kr = mach_voucher_extract_attr_recipe(voucher, args->key,
+ (mach_voucher_attr_raw_recipe_t)krecipe, &sz);
+ assert(sz <= max_sz);
+
+ if (kr == KERN_SUCCESS && sz > 0) {
+ kr = copyout(krecipe, CAST_USER_ADDR_T(args->recipe), sz);
+ }
+ kfree(krecipe, (vm_size_t)max_sz);
+ }
+
+ if (kr == KERN_SUCCESS) {
+ kr = copyout(&sz, args->recipe_size, sizeof(sz));
+ }
+
+done:
+ ipc_voucher_release(voucher);
+ return kr;
+}
projects / apple / xnu.git / blobdiff