X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/43866e378188c25dd1e2208016ab3cbeb086ae6c..143464d58d2bd6378e74eec636961ceb0d32fb91:/osfmk/mach/message.h diff --git a/osfmk/mach/message.h b/osfmk/mach/message.h index 75d3531de..7c1f16164 100644 --- a/osfmk/mach/message.h +++ b/osfmk/mach/message.h @@ -1,16 +1,19 @@ /* - * Copyright (c) 2000-2002 Apple Computer, Inc. All rights reserved. + * Copyright (c) 2000-2005 Apple Computer, Inc. All rights reserved. * - * @APPLE_LICENSE_HEADER_START@ - * - * Copyright (c) 1999-2003 Apple Computer, Inc. All Rights Reserved. + * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ * * This file contains Original Code and/or Modifications of Original Code * as defined in and that are subject to the Apple Public Source License * Version 2.0 (the 'License'). You may not use this file except in - * compliance with the License. Please obtain a copy of the License at - * http://www.opensource.apple.com/apsl/ and read it before using this - * file. + * compliance with the License. The rights granted to you under the License + * may not be used to create, or enable the creation or redistribution of, + * unlawful or unlicensed copies of an Apple operating system, or to + * circumvent, violate, or enable the circumvention or violation of, any + * terms of an Apple operating system software license agreement. + * + * Please obtain a copy of the License at + * http://www.opensource.apple.com/apsl/ and read it before using this file. * * The Original Code and all software distributed under the License are * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER @@ -20,7 +23,7 @@ * Please see the License for the specific language governing rights and * limitations under the License. * - * @APPLE_LICENSE_HEADER_END@ + * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ */ /* * @OSF_COPYRIGHT@ @@ -50,6 +53,13 @@ * any improvements or extensions that they make and grant Carnegie Mellon * the rights to redistribute these changes. */ +/* + * NOTICE: This file was modified by McAfee Research in 2004 to introduce + * support for mandatory and extensible security protections. This notice + * is included in support of clause 2.2 (b) of the Apple Public License, + * Version 2.0. + * Copyright (c) 2005 SPARTA, Inc. + */ /* */ /* @@ -61,23 +71,15 @@ #ifndef _MACH_MESSAGE_H_ #define _MACH_MESSAGE_H_ -#ifdef MACH_KERNEL -/* Have to have MIG parameter check for kernel */ -#define TypeCheck 1 -#define _MIG_KERNEL_SPECIFIC_CODE_ 1 -#endif /* MACH_KERNEL */ - -/* static templates are slower and bigger */ -/* #define UseStaticTemplates 0 */ - -#include - #include #include #include #include #include +#include +#include + /* * The timeout mechanism uses mach_msg_timeout_t values, * passed by value. The timeout units are milliseconds. @@ -95,7 +97,7 @@ typedef natural_t mach_msg_timeout_t; #define MACH_MSG_TIMEOUT_NONE ((mach_msg_timeout_t) 0) /* - * The kernel uses MACH_MSGH_BITS_COMPLEX as a hint. It it isn't on, it + * The kernel uses MACH_MSGH_BITS_COMPLEX as a hint. If it isn't on, it * assumes the body of the message doesn't contain port rights or OOL * data. The field is set in received messages. A user task must * use caution in interpreting the body of a message if the bit isn't @@ -126,7 +128,9 @@ typedef natural_t mach_msg_timeout_t; #define MACH_MSGH_BITS_USER 0x8000ffffU #define MACH_MSGH_BITS_CIRCULAR 0x40000000 /* internal use only */ -#define MACH_MSGH_BITS_USED 0xc000ffffU +#define MACH_MSGH_BITS_RAISEIMP 0x20000000 /* importance raise, internal use only */ +#define MACH_MSGH_BITS_IMPHOLDASRT 0x10000000 /* holds assertion alredy, in userland */ +#define MACH_MSGH_BITS_USED 0xf000ffffU #define MACH_MSGH_BITS_PORTS_MASK \ (MACH_MSGH_BITS_REMOTE_MASK|MACH_MSGH_BITS_LOCAL_MASK) @@ -144,11 +148,11 @@ typedef natural_t mach_msg_timeout_t; /* * Every message starts with a message header. - * Following the message header are zero or more pairs of - * type descriptors (mach_msg_type_t/mach_msg_type_long_t) and - * data values. The size of the message must be specified in bytes, - * and includes the message header, type descriptors, inline - * data, and inline pointer for out-of-line data. + * Following the message header, if the message is complex, are a count + * of type descriptors and the type descriptors themselves + * (mach_msg_descriptor_t). The size of the message must be specified in + * bytes, and includes the message header, descriptor count, descriptors, + * and inline data. * * The msgh_remote_port field specifies the destination of the message. * It must specify a valid send or send-once right for a port. @@ -195,6 +199,18 @@ typedef unsigned int mach_msg_copy_options_t; #define MACH_MSG_KALLOC_COPY_T 4 #endif /* MACH_KERNEL */ +/* + * In a complex mach message, the mach_msg_header_t is followed by + * a descriptor count, then an array of that number of descriptors + * (mach_msg_*_descriptor_t). The type field of mach_msg_type_descriptor_t + * (which any descriptor can be cast to) indicates the flavor of the + * descriptor. + * + * Note that in LP64, the various types of descriptors are no longer all + * the same size as mach_msg_descriptor_t, so the array cannot be indexed + * as expected. + */ + typedef unsigned int mach_msg_descriptor_type_t; #define MACH_MSG_PORT_DESCRIPTOR 0 @@ -202,10 +218,11 @@ typedef unsigned int mach_msg_descriptor_type_t; #define MACH_MSG_OOL_PORTS_DESCRIPTOR 2 #define MACH_MSG_OOL_VOLATILE_DESCRIPTOR 3 +#pragma pack(4) typedef struct { - void* pad1; + natural_t pad1; mach_msg_size_t pad2; unsigned int pad3 : 24; mach_msg_descriptor_type_t type : 8; @@ -214,32 +231,108 @@ typedef struct typedef struct { mach_port_t name; +#if !(defined(KERNEL) && defined(__LP64__)) +// Pad to 8 bytes everywhere except the K64 kernel where mach_port_t is 8 bytes mach_msg_size_t pad1; +#endif unsigned int pad2 : 16; mach_msg_type_name_t disposition : 8; mach_msg_descriptor_type_t type : 8; +#if defined(KERNEL) + uint32_t pad_end; +#endif } mach_msg_port_descriptor_t; typedef struct { - void* address; + uint32_t address; mach_msg_size_t size; boolean_t deallocate: 8; mach_msg_copy_options_t copy: 8; unsigned int pad1: 8; mach_msg_descriptor_type_t type: 8; +} mach_msg_ool_descriptor32_t; + +typedef struct +{ + uint64_t address; + boolean_t deallocate: 8; + mach_msg_copy_options_t copy: 8; + unsigned int pad1: 8; + mach_msg_descriptor_type_t type: 8; + mach_msg_size_t size; +} mach_msg_ool_descriptor64_t; + +typedef struct +{ + void* address; +#if !defined(__LP64__) + mach_msg_size_t size; +#endif + boolean_t deallocate: 8; + mach_msg_copy_options_t copy: 8; + unsigned int pad1: 8; + mach_msg_descriptor_type_t type: 8; +#if defined(__LP64__) + mach_msg_size_t size; +#endif +#if defined(KERNEL) && !defined(__LP64__) + uint32_t pad_end; +#endif } mach_msg_ool_descriptor_t; +typedef struct +{ + uint32_t address; + mach_msg_size_t count; + boolean_t deallocate: 8; + mach_msg_copy_options_t copy: 8; + mach_msg_type_name_t disposition : 8; + mach_msg_descriptor_type_t type : 8; +} mach_msg_ool_ports_descriptor32_t; + +typedef struct +{ + uint64_t address; + boolean_t deallocate: 8; + mach_msg_copy_options_t copy: 8; + mach_msg_type_name_t disposition : 8; + mach_msg_descriptor_type_t type : 8; + mach_msg_size_t count; +} mach_msg_ool_ports_descriptor64_t; + typedef struct { void* address; +#if !defined(__LP64__) mach_msg_size_t count; +#endif boolean_t deallocate: 8; mach_msg_copy_options_t copy: 8; mach_msg_type_name_t disposition : 8; mach_msg_descriptor_type_t type : 8; +#if defined(__LP64__) + mach_msg_size_t count; +#endif +#if defined(KERNEL) && !defined(__LP64__) + uint32_t pad_end; +#endif } mach_msg_ool_ports_descriptor_t; +/* + * LP64support - This union definition is not really + * appropriate in LP64 mode because not all descriptors + * are of the same size in that environment. + */ +#if defined(__LP64__) && defined(KERNEL) +typedef union +{ + mach_msg_port_descriptor_t port; + mach_msg_ool_descriptor32_t out_of_line; + mach_msg_ool_ports_descriptor32_t ool_ports; + mach_msg_type_descriptor_t type; +} mach_msg_descriptor_t; +#else typedef union { mach_msg_port_descriptor_t port; @@ -247,6 +340,7 @@ typedef union mach_msg_ool_ports_descriptor_t ool_ports; mach_msg_type_descriptor_t type; } mach_msg_descriptor_t; +#endif typedef struct { @@ -279,6 +373,7 @@ typedef unsigned int mach_msg_trailer_type_t; #define MACH_MSG_TRAILER_FORMAT_0 0 typedef unsigned int mach_msg_trailer_size_t; +typedef char *mach_msg_trailer_info_t; typedef struct { @@ -306,15 +401,96 @@ typedef struct security_token_t msgh_sender; } mach_msg_security_trailer_t; +/* + * The audit token is an opaque token which identifies + * Mach tasks and senders of Mach messages as subjects + * to the BSM audit system. Only the appropriate BSM + * library routines should be used to interpret the + * contents of the audit token as the representation + * of the subject identity within the token may change + * over time. + */ +typedef struct +{ + unsigned int val[8]; +} audit_token_t; + +typedef struct +{ + mach_msg_trailer_type_t msgh_trailer_type; + mach_msg_trailer_size_t msgh_trailer_size; + mach_port_seqno_t msgh_seqno; + security_token_t msgh_sender; + audit_token_t msgh_audit; +} mach_msg_audit_trailer_t; + +typedef struct +{ + mach_msg_trailer_type_t msgh_trailer_type; + mach_msg_trailer_size_t msgh_trailer_size; + mach_port_seqno_t msgh_seqno; + security_token_t msgh_sender; + audit_token_t msgh_audit; + mach_port_context_t msgh_context; +} mach_msg_context_trailer_t; + +typedef struct +{ + mach_port_name_t sender; +} msg_labels_t; + +/* + Trailer type to pass MAC policy label info as a mach message trailer. + +*/ + +typedef struct +{ + mach_msg_trailer_type_t msgh_trailer_type; + mach_msg_trailer_size_t msgh_trailer_size; + mach_port_seqno_t msgh_seqno; + security_token_t msgh_sender; + audit_token_t msgh_audit; + mach_port_context_t msgh_context; + int msgh_ad; + msg_labels_t msgh_labels; +} mach_msg_mac_trailer_t; + +#define MACH_MSG_TRAILER_MINIMUM_SIZE sizeof(mach_msg_trailer_t) + +/* + * These values can change from release to release - but clearly + * code cannot request additional trailer elements one was not + * compiled to understand. Therefore, it is safe to use this + * constant when the same module specified the receive options. + * Otherwise, you run the risk that the options requested by + * another module may exceed the local modules notion of + * MAX_TRAILER_SIZE. + */ + +typedef mach_msg_mac_trailer_t mach_msg_max_trailer_t; +#define MAX_TRAILER_SIZE ((mach_msg_size_t)sizeof(mach_msg_max_trailer_t)) + +/* + * Legacy requirements keep us from ever updating these defines (even + * when the format_0 trailers gain new option data fields in the future). + * Therefore, they shouldn't be used going forward. Instead, the sizes + * should be compared against the specific element size requested using + * REQUESTED_TRAILER_SIZE. + */ typedef mach_msg_security_trailer_t mach_msg_format_0_trailer_t; +/*typedef mach_msg_mac_trailer_t mach_msg_format_0_trailer_t; +*/ + #define MACH_MSG_TRAILER_FORMAT_0_SIZE sizeof(mach_msg_format_0_trailer_t) -#define MACH_MSG_TRAILER_MINIMUM_SIZE sizeof(mach_msg_trailer_t) -#define MAX_TRAILER_SIZE MACH_MSG_TRAILER_FORMAT_0_SIZE #define KERNEL_SECURITY_TOKEN_VALUE { {0, 1} } extern security_token_t KERNEL_SECURITY_TOKEN; +#define KERNEL_AUDIT_TOKEN_VALUE { {0, 0, 0, 0, 0, 0, 0, 0} } +extern audit_token_t KERNEL_AUDIT_TOKEN; + typedef integer_t mach_msg_options_t; typedef struct @@ -334,6 +510,8 @@ typedef union mach_msg_empty_rcv_t rcv; } mach_msg_empty_t; +#pragma pack() + /* utility to round the message size - will become machine dependent */ #define round_msg(x) (((mach_msg_size_t)(x) + sizeof (natural_t) - 1) & \ ~(sizeof (natural_t) - 1)) @@ -341,10 +519,19 @@ typedef union /* * There is no fixed upper bound to the size of Mach messages. */ - #define MACH_MSG_SIZE_MAX ((mach_msg_size_t) ~0) -#ifdef __APPLE_API_OBSOLETE +#if defined(__APPLE_API_PRIVATE) +/* + * But architectural limits of a given implementation, or + * temporal conditions may cause unpredictable send failures + * for messages larger than MACH_MSG_SIZE_RELIABLE. + * + * In either case, waiting for memory is [currently] outside + * the scope of send timeout values provided to IPC. + */ +#define MACH_MSG_SIZE_RELIABLE ((mach_msg_size_t) 256 * 1024) +#endif /* * Compatibility definitions, for code written * when there was a msgh_kind instead of msgh_seqno. @@ -353,32 +540,6 @@ typedef union #define MACH_MSGH_KIND_NOTIFICATION 0x00000001 #define msgh_kind msgh_seqno #define mach_msg_kind_t mach_port_seqno_t -#endif /* __APPLE_API_OBSOLETE */ - -/* - * The msgt_number field specifies the number of data elements. - * The msgt_size field specifies the size of each data element, in bits. - * The msgt_name field specifies the type of each data element. - * If msgt_inline is TRUE, the data follows the type descriptor - * in the body of the message. If msgt_inline is FALSE, then a pointer - * to the data should follow the type descriptor, and the data is - * sent out-of-line. In this case, if msgt_deallocate is TRUE, - * then the out-of-line data is moved (instead of copied) into the message. - * If msgt_longform is TRUE, then the type descriptor is actually - * a mach_msg_type_long_t. - * - * The actual amount of inline data following the descriptor must - * a multiple of the word size. For out-of-line data, this is a - * pointer. For inline data, the supplied data size (calculated - * from msgt_number/msgt_size) is rounded up. This guarantees - * that type descriptors always fall on word boundaries. - * - * For port rights, msgt_size must be 8*sizeof(mach_port_t). - * If the data is inline, msgt_deallocate should be FALSE. - * The msgt_unused bit should be zero. - * The msgt_name, msgt_size, msgt_number fields in - * a mach_msg_type_long_t should be zero. - */ typedef natural_t mach_msg_type_size_t; typedef natural_t mach_msg_type_number_t; @@ -430,40 +591,112 @@ typedef integer_t mach_msg_option_t; #define MACH_SEND_MSG 0x00000001 #define MACH_RCV_MSG 0x00000002 -#define MACH_RCV_LARGE 0x00000004 -#define MACH_SEND_TIMEOUT 0x00000010 -#define MACH_SEND_INTERRUPT 0x00000040 /* libmach implements */ -#define MACH_SEND_CANCEL 0x00000080 -#define MACH_SEND_ALWAYS 0x00010000 /* internal use only */ -#define MACH_SEND_TRAILER 0x00020000 +#define MACH_RCV_LARGE 0x00000004 /* report large message sizes */ +#define MACH_RCV_LARGE_IDENTITY 0x00000008 /* identify source of large messages */ + +#define MACH_SEND_TIMEOUT 0x00000010 /* timeout value applies to send */ +#define MACH_SEND_INTERRUPT 0x00000040 /* don't restart interrupted sends */ +#define MACH_SEND_NOTIFY 0x00000080 /* arm send-possible notify */ +#define MACH_SEND_ALWAYS 0x00010000 /* ignore qlimits - kernel only */ +#define MACH_SEND_TRAILER 0x00020000 /* sender-provided trailer */ +#define MACH_SEND_NOIMPORTANCE 0x00040000 /* msg won't carry importance */ +#define MACH_SEND_IMPORTANCE 0x00080000 /* msg carries importance - kernel only */ + -#define MACH_RCV_TIMEOUT 0x00000100 -#define MACH_RCV_NOTIFY 0x00000200 -#define MACH_RCV_INTERRUPT 0x00000400 /* libmach implements */ -#define MACH_RCV_OVERWRITE 0x00001000 +#define MACH_RCV_TIMEOUT 0x00000100 /* timeout value applies to receive */ +#define MACH_RCV_NOTIFY 0x00000200 /* reserved - legacy */ +#define MACH_RCV_INTERRUPT 0x00000400 /* don't restart interrupted receive */ +#define MACH_RCV_OVERWRITE 0x00001000 /* scatter receive */ /* * NOTE: a 0x00------ RCV mask implies to ask for * a MACH_MSG_TRAILER_FORMAT_0 with 0 Elements, * which is equivalent to a mach_msg_trailer_t. + * + * XXXMAC: unlike the rest of the MACH_RCV_* flags, MACH_RCV_TRAILER_LABELS + * needs its own private bit since we only calculate its fields when absolutely + * required. */ #define MACH_RCV_TRAILER_NULL 0 #define MACH_RCV_TRAILER_SEQNO 1 #define MACH_RCV_TRAILER_SENDER 2 +#define MACH_RCV_TRAILER_AUDIT 3 +#define MACH_RCV_TRAILER_CTX 4 +#define MACH_RCV_TRAILER_AV 7 +#define MACH_RCV_TRAILER_LABELS 8 #define MACH_RCV_TRAILER_TYPE(x) (((x) & 0xf) << 28) #define MACH_RCV_TRAILER_ELEMENTS(x) (((x) & 0xf) << 24) -#define MACH_RCV_TRAILER_MASK ((0xff << 24)) +#define MACH_RCV_TRAILER_MASK ((0xf << 24)) #define GET_RCV_ELEMENTS(y) (((y) >> 24) & 0xf) -#define REQUESTED_TRAILER_SIZE(y) \ + +#ifdef MACH_KERNEL_PRIVATE +/* The options that the kernel honors when passed from user space */ +#define MACH_SEND_USER (MACH_SEND_MSG | \ + MACH_SEND_TIMEOUT | MACH_SEND_NOTIFY | \ + MACH_SEND_TRAILER | MACH_SEND_NOIMPORTANCE ) + +#define MACH_RCV_USER (MACH_RCV_MSG | \ + MACH_RCV_TIMEOUT | MACH_RCV_OVERWRITE | \ + MACH_RCV_LARGE | MACH_RCV_LARGE_IDENTITY | \ + MACH_RCV_TRAILER_MASK) + +#define MACH_MSG_OPTION_USER (MACH_SEND_USER | MACH_RCV_USER) + +/* The options implemented by the library interface to mach_msg et. al. */ +#define MACH_MSG_OPTION_LIB (MACH_SEND_INTERRUPT | MACH_RCV_INTERRUPT) + +/* Default options to use when sending from the kernel */ +#if 11938665 + /* + * Until we are sure of its effects, we are disabling + * importance donation from the kernel-side of user + * threads in importance-donating tasks. + */ +#define MACH_SEND_KERNEL_DEFAULT (MACH_SEND_MSG | \ + MACH_SEND_ALWAYS | MACH_SEND_NOIMPORTANCE) +#else +#define MACH_SEND_KERNEL_DEFAULT (MACH_SEND_MSG | MACH_SEND_ALWAYS) +#endif + +#endif /* MACH_KERNEL_PRIVATE */ + +/* + * XXXMAC: note that in the case of MACH_RCV_TRAILER_LABELS, + * we just fall through to mach_msg_max_trailer_t. + * This is correct behavior since mach_msg_max_trailer_t is defined as + * mac_msg_mac_trailer_t which is used for the LABELS trailer. + * It also makes things work properly if MACH_RCV_TRAILER_LABELS is ORed + * with one of the other options. + */ + +#define REQUESTED_TRAILER_SIZE_NATIVE(y) \ ((mach_msg_trailer_size_t) \ ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_NULL) ? \ sizeof(mach_msg_trailer_t) : \ ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_SEQNO) ? \ sizeof(mach_msg_seqno_trailer_t) : \ - sizeof(mach_msg_security_trailer_t)))) + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_SENDER) ? \ + sizeof(mach_msg_security_trailer_t) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_AUDIT) ? \ + sizeof(mach_msg_audit_trailer_t) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_CTX) ? \ + sizeof(mach_msg_context_trailer_t) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_AV) ? \ + sizeof(mach_msg_mac_trailer_t) : \ + sizeof(mach_msg_max_trailer_t)))))))) + + +#ifdef XNU_KERNEL_PRIVATE + +#define REQUESTED_TRAILER_SIZE(is64, y) REQUESTED_TRAILER_SIZE_NATIVE(y) + +#else /* XNU_KERNEL_PRIVATE */ +#define REQUESTED_TRAILER_SIZE(y) REQUESTED_TRAILER_SIZE_NATIVE(y) +#endif /* XNU_KERNEL_PRIVATE */ + /* * Much code assumes that mach_msg_return_t == kern_return_t. * This definition is useful for descriptive purposes. @@ -557,6 +790,9 @@ typedef kern_return_t mach_msg_return_t; #define MACH_RCV_IN_PROGRESS_TIMED 0x10004011 /* Waiting for receive with timeout. (Internal use only.) */ + +__BEGIN_DECLS + /* * Routine: mach_msg_overwrite * Purpose: @@ -573,18 +809,6 @@ typedef kern_return_t mach_msg_return_t; * already contain scatter control information to direct the * receiving of the message. */ -#ifdef __APPLE_API_PRIVATE -extern mach_msg_return_t mach_msg_overwrite_trap( - mach_msg_header_t *msg, - mach_msg_option_t option, - mach_msg_size_t send_size, - mach_msg_size_t rcv_size, - mach_port_name_t rcv_name, - mach_msg_timeout_t timeout, - mach_port_name_t notify, - mach_msg_header_t *rcv_msg, - mach_msg_size_t rcv_limit); -#endif /* __APPLE_API_PRIVATE */ extern mach_msg_return_t mach_msg_overwrite( mach_msg_header_t *msg, @@ -597,6 +821,8 @@ extern mach_msg_return_t mach_msg_overwrite( mach_msg_header_t *rcv_msg, mach_msg_size_t rcv_limit); +#ifndef KERNEL + /* * Routine: mach_msg * Purpose: @@ -605,17 +831,6 @@ extern mach_msg_return_t mach_msg_overwrite( * of that fact, then restart the appropriate parts of the * operation silently (trap version does not restart). */ -#ifdef __APPLE_API_PRIVATE -extern mach_msg_return_t mach_msg_trap( - mach_msg_header_t *msg, - mach_msg_option_t option, - mach_msg_size_t send_size, - mach_msg_size_t rcv_size, - mach_port_name_t rcv_name, - mach_msg_timeout_t timeout, - mach_port_name_t notify); -#endif /* __APPLE_API_PRIVATE */ - extern mach_msg_return_t mach_msg( mach_msg_header_t *msg, mach_msg_option_t option, @@ -625,4 +840,13 @@ extern mach_msg_return_t mach_msg( mach_msg_timeout_t timeout, mach_port_name_t notify); +#elif defined(MACH_KERNEL_PRIVATE) + +extern mach_msg_return_t mach_msg_receive_results(void); + +#endif /* KERNEL */ + +__END_DECLS + #endif /* _MACH_MESSAGE_H_ */ +