Rev 2638 | Rev 2661 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log | RSS feed
| Rev 2638 | Rev 2660 | ||
|---|---|---|---|
| Line 47... | Line 47... | ||
| 47 | #include <syscall/copy.h> |
47 | #include <syscall/copy.h> |
| 48 | #include <security/cap.h> |
48 | #include <security/cap.h> |
| 49 | #include <mm/as.h> |
49 | #include <mm/as.h> |
| 50 | #include <print.h> |
50 | #include <print.h> |
| 51 | 51 | ||
| - | 52 | /** |
|
| 52 | /** Maximum buffer size allowed for IPC_M_DATA_SEND requests. */ |
53 | * Maximum buffer size allowed for IPC_M_DATA_WRITE and IPC_M_DATA_READ |
| - | 54 | * requests. |
|
| - | 55 | */ |
|
| 53 | #define DATA_SEND_LIMIT (64 * 1024) |
56 | #define DATA_XFER_LIMIT (64 * 1024) |
| 54 | 57 | ||
| 55 | #define GET_CHECK_PHONE(phone, phoneid, err) \ |
58 | #define GET_CHECK_PHONE(phone, phoneid, err) \ |
| 56 | { \ |
59 | { \ |
| 57 | if (phoneid > IPC_MAX_PHONES) { \ |
60 | if (phoneid > IPC_MAX_PHONES) { \ |
| 58 | err; \ |
61 | err; \ |
| Line 109... | Line 112... | ||
| 109 | static inline int method_is_immutable(unative_t method) |
112 | static inline int method_is_immutable(unative_t method) |
| 110 | { |
113 | { |
| 111 | switch (method) { |
114 | switch (method) { |
| 112 | case IPC_M_AS_AREA_SEND: |
115 | case IPC_M_AS_AREA_SEND: |
| 113 | case IPC_M_AS_AREA_RECV: |
116 | case IPC_M_AS_AREA_RECV: |
| - | 117 | case IPC_M_DATA_WRITE: |
|
| 114 | case IPC_M_DATA_SEND: |
118 | case IPC_M_DATA_READ: |
| 115 | return 1; |
119 | return 1; |
| 116 | break; |
120 | break; |
| 117 | default: |
121 | default: |
| 118 | return 0; |
122 | return 0; |
| 119 | } |
123 | } |
| Line 137... | Line 141... | ||
| 137 | switch (IPC_GET_METHOD(call->data)) { |
141 | switch (IPC_GET_METHOD(call->data)) { |
| 138 | case IPC_M_CONNECT_TO_ME: |
142 | case IPC_M_CONNECT_TO_ME: |
| 139 | case IPC_M_CONNECT_ME_TO: |
143 | case IPC_M_CONNECT_ME_TO: |
| 140 | case IPC_M_AS_AREA_SEND: |
144 | case IPC_M_AS_AREA_SEND: |
| 141 | case IPC_M_AS_AREA_RECV: |
145 | case IPC_M_AS_AREA_RECV: |
| - | 146 | case IPC_M_DATA_WRITE: |
|
| 142 | case IPC_M_DATA_SEND: |
147 | case IPC_M_DATA_READ: |
| 143 | return 1; |
148 | return 1; |
| 144 | default: |
149 | default: |
| 145 | return 0; |
150 | return 0; |
| 146 | } |
151 | } |
| 147 | } |
152 | } |
| Line 228... | Line 233... | ||
| 228 | rc = as_area_share(AS, IPC_GET_ARG1(answer->data), |
233 | rc = as_area_share(AS, IPC_GET_ARG1(answer->data), |
| 229 | IPC_GET_ARG2(*olddata), as, IPC_GET_ARG1(*olddata), |
234 | IPC_GET_ARG2(*olddata), as, IPC_GET_ARG1(*olddata), |
| 230 | IPC_GET_ARG2(answer->data)); |
235 | IPC_GET_ARG2(answer->data)); |
| 231 | IPC_SET_RETVAL(answer->data, rc); |
236 | IPC_SET_RETVAL(answer->data, rc); |
| 232 | } |
237 | } |
| 233 | } else if (IPC_GET_METHOD(*olddata) == IPC_M_DATA_SEND) { |
238 | } else if (IPC_GET_METHOD(*olddata) == IPC_M_DATA_WRITE) { |
| 234 | if (!IPC_GET_RETVAL(answer->data)) { |
239 | if (!IPC_GET_RETVAL(answer->data)) { |
| 235 | int rc; |
240 | int rc; |
| 236 | uintptr_t dst; |
241 | uintptr_t dst; |
| 237 | uintptr_t size; |
242 | uintptr_t size; |
| 238 | 243 | ||
| Line 278... | Line 283... | ||
| 278 | size = as_area_get_size(IPC_GET_ARG1(call->data)); |
283 | size = as_area_get_size(IPC_GET_ARG1(call->data)); |
| 279 | if (!size) |
284 | if (!size) |
| 280 | return EPERM; |
285 | return EPERM; |
| 281 | IPC_SET_ARG2(call->data, size); |
286 | IPC_SET_ARG2(call->data, size); |
| 282 | break; |
287 | break; |
| 283 | case IPC_M_DATA_SEND: |
288 | case IPC_M_DATA_WRITE: |
| 284 | src = IPC_GET_ARG2(call->data); |
289 | src = IPC_GET_ARG2(call->data); |
| 285 | size = IPC_GET_ARG3(call->data); |
290 | size = IPC_GET_ARG3(call->data); |
| 286 | 291 | ||
| 287 | if ((size <= 0) || (size > DATA_SEND_LIMIT)) |
292 | if ((size <= 0) || (size > DATA_XFER_LIMIT)) |
| 288 | return ELIMIT; |
293 | return ELIMIT; |
| 289 | 294 | ||
| 290 | call->buffer = (uint8_t *) malloc(size, 0); |
295 | call->buffer = (uint8_t *) malloc(size, 0); |
| 291 | rc = copy_from_uspace(call->buffer, (void *) src, size); |
296 | rc = copy_from_uspace(call->buffer, (void *) src, size); |
| 292 | if (rc != 0) { |
297 | if (rc != 0) { |