X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/8f6c56a50524aa785f7e596d52dddfb331e18961..d26ffc64f583ab2d29df48f13518685602bc8832:/osfmk/mach/message.h diff --git a/osfmk/mach/message.h b/osfmk/mach/message.h index a07ad5a2b..13481e1bd 100644 --- a/osfmk/mach/message.h +++ b/osfmk/mach/message.h @@ -53,6 +53,13 @@ * any improvements or extensions that they make and grant Carnegie Mellon * the rights to redistribute these changes. */ +/* + * NOTICE: This file was modified by McAfee Research in 2004 to introduce + * support for mandatory and extensible security protections. This notice + * is included in support of clause 2.2 (b) of the Apple Public License, + * Version 2.0. + * Copyright (c) 2005 SPARTA, Inc. + */ /* */ /* @@ -71,6 +78,8 @@ #include #include +#include +#include /* * The timeout mechanism uses mach_msg_timeout_t values, @@ -89,7 +98,7 @@ typedef natural_t mach_msg_timeout_t; #define MACH_MSG_TIMEOUT_NONE ((mach_msg_timeout_t) 0) /* - * The kernel uses MACH_MSGH_BITS_COMPLEX as a hint. It it isn't on, it + * The kernel uses MACH_MSGH_BITS_COMPLEX as a hint. If it isn't on, it * assumes the body of the message doesn't contain port rights or OOL * data. The field is set in received messages. A user task must * use caution in interpreting the body of a message if the bit isn't @@ -99,10 +108,17 @@ typedef natural_t mach_msg_timeout_t; * (Ie, an error may or may not be produced.) * * The value of MACH_MSGH_BITS_REMOTE determines the interpretation - * of the msgh_remote_port field. It is handled like a msgt_name. + * of the msgh_remote_port field. It is handled like a msgt_name, + * but must result in a send or send-once type right. * * The value of MACH_MSGH_BITS_LOCAL determines the interpretation - * of the msgh_local_port field. It is handled like a msgt_name. + * of the msgh_local_port field. It is handled like a msgt_name, + * and also must result in a send or send-once type right. + * + * The value of MACH_MSGH_BITS_VOUCHER determines the interpretation + * of the msgh_voucher_port field. It is handled like a msgt_name, + * but must result in a send right (and the msgh_voucher_port field + * must be the name of a send right to a Mach voucher kernel object. * * MACH_MSGH_BITS() combines two MACH_MSG_TYPE_* values, for the remote * and local fields, into a single value suitable for msgh_bits. @@ -114,35 +130,76 @@ typedef natural_t mach_msg_timeout_t; */ #define MACH_MSGH_BITS_ZERO 0x00000000 -#define MACH_MSGH_BITS_REMOTE_MASK 0x000000ff -#define MACH_MSGH_BITS_LOCAL_MASK 0x0000ff00 -#define MACH_MSGH_BITS_COMPLEX 0x80000000U -#define MACH_MSGH_BITS_USER 0x8000ffffU -#define MACH_MSGH_BITS_CIRCULAR 0x40000000 /* internal use only */ -#define MACH_MSGH_BITS_USED 0xc000ffffU +#define MACH_MSGH_BITS_REMOTE_MASK 0x0000001f +#define MACH_MSGH_BITS_LOCAL_MASK 0x00001f00 +#define MACH_MSGH_BITS_VOUCHER_MASK 0x001f0000 + +#define MACH_MSGH_BITS_PORTS_MASK \ + (MACH_MSGH_BITS_REMOTE_MASK | \ + MACH_MSGH_BITS_LOCAL_MASK | \ + MACH_MSGH_BITS_VOUCHER_MASK) + +#define MACH_MSGH_BITS_COMPLEX 0x80000000U /* message is complex */ + +#define MACH_MSGH_BITS_USER 0x801f1f1fU /* allowed bits user->kernel */ + +#define MACH_MSGH_BITS_RAISEIMP 0x20000000U /* importance raised due to msg */ +#define MACH_MSGH_BITS_DENAP MACH_MSGH_BITS_RAISEIMP + +#define MACH_MSGH_BITS_IMPHOLDASRT 0x10000000U /* assertion help, userland private */ +#define MACH_MSGH_BITS_DENAPHOLDASRT MACH_MSGH_BITS_IMPHOLDASRT + +#define MACH_MSGH_BITS_CIRCULAR 0x10000000U /* message circular, kernel private */ -#define MACH_MSGH_BITS_PORTS_MASK \ - (MACH_MSGH_BITS_REMOTE_MASK|MACH_MSGH_BITS_LOCAL_MASK) +#define MACH_MSGH_BITS_USED 0xb01f1f1fU -#define MACH_MSGH_BITS(remote, local) \ +/* setter macros for the bits */ +#define MACH_MSGH_BITS(remote, local) /* legacy */ \ ((remote) | ((local) << 8)) +#define MACH_MSGH_BITS_SET_PORTS(remote, local, voucher) \ + (((remote) & MACH_MSGH_BITS_REMOTE_MASK) | \ + (((local) << 8) & MACH_MSGH_BITS_LOCAL_MASK) | \ + (((voucher) << 16) & MACH_MSGH_BITS_VOUCHER_MASK)) +#define MACH_MSGH_BITS_SET(remote, local, voucher, other) \ + (MACH_MSGH_BITS_SET_PORTS((remote), (local), (voucher)) \ + | ((other) &~ MACH_MSGH_BITS_PORTS_MASK)) + +/* getter macros for pulling values out of the bits field */ #define MACH_MSGH_BITS_REMOTE(bits) \ ((bits) & MACH_MSGH_BITS_REMOTE_MASK) #define MACH_MSGH_BITS_LOCAL(bits) \ (((bits) & MACH_MSGH_BITS_LOCAL_MASK) >> 8) +#define MACH_MSGH_BITS_VOUCHER(bits) \ + (((bits) & MACH_MSGH_BITS_VOUCHER_MASK) >> 16) #define MACH_MSGH_BITS_PORTS(bits) \ - ((bits) & MACH_MSGH_BITS_PORTS_MASK) + ((bits) & MACH_MSGH_BITS_PORTS_MASK) #define MACH_MSGH_BITS_OTHER(bits) \ ((bits) &~ MACH_MSGH_BITS_PORTS_MASK) +/* checking macros */ +#define MACH_MSGH_BITS_HAS_REMOTE(bits) \ + (MACH_MSGH_BITS_REMOTE(bits) != MACH_MSGH_BITS_ZERO) +#define MACH_MSGH_BITS_HAS_LOCAL(bits) \ + (MACH_MSGH_BITS_LOCAL(bits) != MACH_MSGH_BITS_ZERO) +#define MACH_MSGH_BITS_HAS_VOUCHER(bits) \ + (MACH_MSGH_BITS_VOUCHER(bits) != MACH_MSGH_BITS_ZERO) +#define MACH_MSGH_BITS_IS_COMPLEX(bits) \ + (((bits) & MACH_MSGH_BITS_COMPLEX) != MACH_MSGH_BITS_ZERO) + +/* importance checking macros */ +#define MACH_MSGH_BITS_RAISED_IMPORTANCE(bits) \ + (((bits) & MACH_MSGH_BITS_RAISEIMP) != MACH_MSGH_BITS_ZERO) +#define MACH_MSGH_BITS_HOLDS_IMPORTANCE_ASSERTION(bits) \ + (((bits) & MACH_MSGH_BITS_IMPHOLDASRT) != MACH_MSGH_BITS_ZERO) + /* * Every message starts with a message header. - * Following the message header are zero or more pairs of - * type descriptors (mach_msg_type_t/mach_msg_type_long_t) and - * data values. The size of the message must be specified in bytes, - * and includes the message header, type descriptors, inline - * data, and inline pointer for out-of-line data. + * Following the message header, if the message is complex, are a count + * of type descriptors and the type descriptors themselves + * (mach_msg_descriptor_t). The size of the message must be specified in + * bytes, and includes the message header, descriptor count, descriptors, + * and inline data. * * The msgh_remote_port field specifies the destination of the message. * It must specify a valid send or send-once right for a port. @@ -152,10 +209,9 @@ typedef natural_t mach_msg_timeout_t; * to reply to the message. It may carry the values MACH_PORT_NULL, * MACH_PORT_DEAD, a send-once right, or a send right. * - * The msgh_seqno field carries a sequence number associated with the - * received-from port. A port's sequence number is incremented every - * time a message is received from it. In sent messages, the field's - * value is ignored. + * The msgh_voucher_port field specifies a Mach voucher port. Only + * send rights to kernel-implemented Mach Voucher kernel objects in + * addition to MACH_PORT_NULL or MACH_PORT_DEAD may be passed. * * The msgh_id field is uninterpreted by the message primitives. * It normally carries information specifying the format @@ -166,29 +222,47 @@ typedef unsigned int mach_msg_bits_t; typedef natural_t mach_msg_size_t; typedef integer_t mach_msg_id_t; - #define MACH_MSG_SIZE_NULL (mach_msg_size_t *) 0 +typedef unsigned int mach_msg_priority_t; + +#define MACH_MSG_PRIORITY_UNSPECIFIED (mach_msg_priority_t) 0 + typedef unsigned int mach_msg_type_name_t; -#define MACH_MSG_TYPE_MOVE_RECEIVE 16 /* Must hold receive rights */ -#define MACH_MSG_TYPE_MOVE_SEND 17 /* Must hold send rights */ -#define MACH_MSG_TYPE_MOVE_SEND_ONCE 18 /* Must hold sendonce rights */ -#define MACH_MSG_TYPE_COPY_SEND 19 /* Must hold send rights */ -#define MACH_MSG_TYPE_MAKE_SEND 20 /* Must hold receive rights */ -#define MACH_MSG_TYPE_MAKE_SEND_ONCE 21 /* Must hold receive rights */ -#define MACH_MSG_TYPE_COPY_RECEIVE 22 /* Must hold receive rights */ +#define MACH_MSG_TYPE_MOVE_RECEIVE 16 /* Must hold receive right */ +#define MACH_MSG_TYPE_MOVE_SEND 17 /* Must hold send right(s) */ +#define MACH_MSG_TYPE_MOVE_SEND_ONCE 18 /* Must hold sendonce right */ +#define MACH_MSG_TYPE_COPY_SEND 19 /* Must hold send right(s) */ +#define MACH_MSG_TYPE_MAKE_SEND 20 /* Must hold receive right */ +#define MACH_MSG_TYPE_MAKE_SEND_ONCE 21 /* Must hold receive right */ +#define MACH_MSG_TYPE_COPY_RECEIVE 22 /* NOT VALID */ +#define MACH_MSG_TYPE_DISPOSE_RECEIVE 24 /* must hold receive right */ +#define MACH_MSG_TYPE_DISPOSE_SEND 25 /* must hold send right(s) */ +#define MACH_MSG_TYPE_DISPOSE_SEND_ONCE 26 /* must hold sendonce right */ typedef unsigned int mach_msg_copy_options_t; #define MACH_MSG_PHYSICAL_COPY 0 #define MACH_MSG_VIRTUAL_COPY 1 #define MACH_MSG_ALLOCATE 2 -#define MACH_MSG_OVERWRITE 3 +#define MACH_MSG_OVERWRITE 3 /* deprecated */ #ifdef MACH_KERNEL #define MACH_MSG_KALLOC_COPY_T 4 #endif /* MACH_KERNEL */ +/* + * In a complex mach message, the mach_msg_header_t is followed by + * a descriptor count, then an array of that number of descriptors + * (mach_msg_*_descriptor_t). The type field of mach_msg_type_descriptor_t + * (which any descriptor can be cast to) indicates the flavor of the + * descriptor. + * + * Note that in LP64, the various types of descriptors are no longer all + * the same size as mach_msg_descriptor_t, so the array cannot be indexed + * as expected. + */ + typedef unsigned int mach_msg_descriptor_type_t; #define MACH_MSG_PORT_DESCRIPTOR 0 @@ -209,10 +283,16 @@ typedef struct typedef struct { mach_port_t name; +#if !(defined(KERNEL) && defined(__LP64__)) +// Pad to 8 bytes everywhere except the K64 kernel where mach_port_t is 8 bytes mach_msg_size_t pad1; +#endif unsigned int pad2 : 16; mach_msg_type_name_t disposition : 8; mach_msg_descriptor_type_t type : 8; +#if defined(KERNEL) + uint32_t pad_end; +#endif } mach_msg_port_descriptor_t; typedef struct @@ -248,6 +328,9 @@ typedef struct #if defined(__LP64__) mach_msg_size_t size; #endif +#if defined(KERNEL) && !defined(__LP64__) + uint32_t pad_end; +#endif } mach_msg_ool_descriptor_t; typedef struct @@ -283,6 +366,9 @@ typedef struct #if defined(__LP64__) mach_msg_size_t count; #endif +#if defined(KERNEL) && !defined(__LP64__) + uint32_t pad_end; +#endif } mach_msg_ool_ports_descriptor_t; /* @@ -290,6 +376,15 @@ typedef struct * appropriate in LP64 mode because not all descriptors * are of the same size in that environment. */ +#if defined(__LP64__) && defined(KERNEL) +typedef union +{ + mach_msg_port_descriptor_t port; + mach_msg_ool_descriptor32_t out_of_line; + mach_msg_ool_ports_descriptor32_t ool_ports; + mach_msg_type_descriptor_t type; +} mach_msg_descriptor_t; +#else typedef union { mach_msg_port_descriptor_t port; @@ -297,6 +392,7 @@ typedef union mach_msg_ool_ports_descriptor_t ool_ports; mach_msg_type_descriptor_t type; } mach_msg_descriptor_t; +#endif typedef struct { @@ -312,11 +408,12 @@ typedef struct mach_msg_size_t msgh_size; mach_port_t msgh_remote_port; mach_port_t msgh_local_port; - mach_msg_size_t msgh_reserved; + mach_port_name_t msgh_voucher_port; mach_msg_id_t msgh_id; } mach_msg_header_t; -#define MACH_MSG_NULL (mach_msg_header_t *) 0 +#define msgh_reserved msgh_voucher_port +#define MACH_MSG_NULL (mach_msg_header_t *) 0 typedef struct { @@ -329,6 +426,7 @@ typedef unsigned int mach_msg_trailer_type_t; #define MACH_MSG_TRAILER_FORMAT_0 0 typedef unsigned int mach_msg_trailer_size_t; +typedef char *mach_msg_trailer_info_t; typedef struct { @@ -336,6 +434,15 @@ typedef struct mach_msg_trailer_size_t msgh_trailer_size; } mach_msg_trailer_t; +/* + * The msgh_seqno field carries a sequence number + * associated with the received-from port. A port's + * sequence number is incremented every time a message + * is received from it and included in the received + * trailer to help put messages back in sequence if + * multiple threads receive and/or process received + * messages. + */ typedef struct { mach_msg_trailer_type_t msgh_trailer_type; @@ -379,6 +486,88 @@ typedef struct audit_token_t msgh_audit; } mach_msg_audit_trailer_t; +typedef struct +{ + mach_msg_trailer_type_t msgh_trailer_type; + mach_msg_trailer_size_t msgh_trailer_size; + mach_port_seqno_t msgh_seqno; + security_token_t msgh_sender; + audit_token_t msgh_audit; + mach_port_context_t msgh_context; +} mach_msg_context_trailer_t; + +#if defined(MACH_KERNEL_PRIVATE) && defined(__arm64__) +typedef struct +{ + mach_msg_trailer_type_t msgh_trailer_type; + mach_msg_trailer_size_t msgh_trailer_size; + mach_port_seqno_t msgh_seqno; + security_token_t msgh_sender; + audit_token_t msgh_audit; + mach_port_context32_t msgh_context; +} mach_msg_context_trailer32_t; + +typedef struct +{ + mach_msg_trailer_type_t msgh_trailer_type; + mach_msg_trailer_size_t msgh_trailer_size; + mach_port_seqno_t msgh_seqno; + security_token_t msgh_sender; + audit_token_t msgh_audit; + mach_port_context64_t msgh_context; +} mach_msg_context_trailer64_t; +#endif + + +typedef struct +{ + mach_port_name_t sender; +} msg_labels_t; + +/* + Trailer type to pass MAC policy label info as a mach message trailer. + +*/ + +typedef struct +{ + mach_msg_trailer_type_t msgh_trailer_type; + mach_msg_trailer_size_t msgh_trailer_size; + mach_port_seqno_t msgh_seqno; + security_token_t msgh_sender; + audit_token_t msgh_audit; + mach_port_context_t msgh_context; + int msgh_ad; + msg_labels_t msgh_labels; +} mach_msg_mac_trailer_t; + +#if defined(MACH_KERNEL_PRIVATE) && defined(__arm64__) +typedef struct +{ + mach_msg_trailer_type_t msgh_trailer_type; + mach_msg_trailer_size_t msgh_trailer_size; + mach_port_seqno_t msgh_seqno; + security_token_t msgh_sender; + audit_token_t msgh_audit; + mach_port_context32_t msgh_context; + int msgh_ad; + msg_labels_t msgh_labels; +} mach_msg_mac_trailer32_t; + +typedef struct +{ + mach_msg_trailer_type_t msgh_trailer_type; + mach_msg_trailer_size_t msgh_trailer_size; + mach_port_seqno_t msgh_seqno; + security_token_t msgh_sender; + audit_token_t msgh_audit; + mach_port_context64_t msgh_context; + int msgh_ad; + msg_labels_t msgh_labels; +} mach_msg_mac_trailer64_t; + +#endif + #define MACH_MSG_TRAILER_MINIMUM_SIZE sizeof(mach_msg_trailer_t) /* @@ -390,8 +579,13 @@ typedef struct * another module may exceed the local modules notion of * MAX_TRAILER_SIZE. */ -typedef mach_msg_audit_trailer_t mach_msg_max_trailer_t; -#define MAX_TRAILER_SIZE sizeof(mach_msg_max_trailer_t) +#if defined(MACH_KERNEL_PRIVATE) && defined(__arm64__) +typedef mach_msg_mac_trailer64_t mach_msg_max_trailer64_t; +typedef mach_msg_mac_trailer32_t mach_msg_max_trailer32_t; +#endif + +typedef mach_msg_mac_trailer_t mach_msg_max_trailer_t; +#define MAX_TRAILER_SIZE ((mach_msg_size_t)sizeof(mach_msg_max_trailer_t)) /* * Legacy requirements keep us from ever updating these defines (even @@ -401,6 +595,10 @@ typedef mach_msg_audit_trailer_t mach_msg_max_trailer_t; * REQUESTED_TRAILER_SIZE. */ typedef mach_msg_security_trailer_t mach_msg_format_0_trailer_t; + +/*typedef mach_msg_mac_trailer_t mach_msg_format_0_trailer_t; +*/ + #define MACH_MSG_TRAILER_FORMAT_0_SIZE sizeof(mach_msg_format_0_trailer_t) #define KERNEL_SECURITY_TOKEN_VALUE { {0, 1} } @@ -437,9 +635,19 @@ typedef union /* * There is no fixed upper bound to the size of Mach messages. */ - #define MACH_MSG_SIZE_MAX ((mach_msg_size_t) ~0) +#if defined(__APPLE_API_PRIVATE) +/* + * But architectural limits of a given implementation, or + * temporal conditions may cause unpredictable send failures + * for messages larger than MACH_MSG_SIZE_RELIABLE. + * + * In either case, waiting for memory is [currently] outside + * the scope of send timeout values provided to IPC. + */ +#define MACH_MSG_SIZE_RELIABLE ((mach_msg_size_t) 256 * 1024) +#endif /* * Compatibility definitions, for code written * when there was a msgh_kind instead of msgh_seqno. @@ -449,31 +657,6 @@ typedef union #define msgh_kind msgh_seqno #define mach_msg_kind_t mach_port_seqno_t -/* - * The msgt_number field specifies the number of data elements. - * The msgt_size field specifies the size of each data element, in bits. - * The msgt_name field specifies the type of each data element. - * If msgt_inline is TRUE, the data follows the type descriptor - * in the body of the message. If msgt_inline is FALSE, then a pointer - * to the data should follow the type descriptor, and the data is - * sent out-of-line. In this case, if msgt_deallocate is TRUE, - * then the out-of-line data is moved (instead of copied) into the message. - * If msgt_longform is TRUE, then the type descriptor is actually - * a mach_msg_type_long_t. - * - * The actual amount of inline data following the descriptor must - * a multiple of the word size. For out-of-line data, this is a - * pointer. For inline data, the supplied data size (calculated - * from msgt_number/msgt_size) is rounded up. This guarantees - * that type descriptors always fall on word boundaries. - * - * For port rights, msgt_size must be 8*sizeof(mach_port_t). - * If the data is inline, msgt_deallocate should be FALSE. - * The msgt_unused bit should be zero. - * The msgt_name, msgt_size, msgt_number fields in - * a mach_msg_type_long_t should be zero. - */ - typedef natural_t mach_msg_type_size_t; typedef natural_t mach_msg_type_number_t; @@ -524,35 +707,126 @@ typedef integer_t mach_msg_option_t; #define MACH_SEND_MSG 0x00000001 #define MACH_RCV_MSG 0x00000002 -#define MACH_RCV_LARGE 0x00000004 -#define MACH_SEND_TIMEOUT 0x00000010 -#define MACH_SEND_INTERRUPT 0x00000040 /* libmach implements */ -#define MACH_SEND_CANCEL 0x00000080 -#define MACH_SEND_ALWAYS 0x00010000 /* internal use only */ -#define MACH_SEND_TRAILER 0x00020000 +#define MACH_RCV_LARGE 0x00000004 /* report large message sizes */ +#define MACH_RCV_LARGE_IDENTITY 0x00000008 /* identify source of large messages */ + +#define MACH_SEND_TIMEOUT 0x00000010 /* timeout value applies to send */ +#define MACH_SEND_OVERRIDE 0x00000020 /* priority override for send */ +#define MACH_SEND_INTERRUPT 0x00000040 /* don't restart interrupted sends */ +#define MACH_SEND_NOTIFY 0x00000080 /* arm send-possible notify */ +#define MACH_SEND_ALWAYS 0x00010000 /* ignore qlimits - kernel only */ +#define MACH_SEND_TRAILER 0x00020000 /* sender-provided trailer */ +#define MACH_SEND_NOIMPORTANCE 0x00040000 /* msg won't carry importance */ +#define MACH_SEND_NODENAP MACH_SEND_NOIMPORTANCE +#define MACH_SEND_IMPORTANCE 0x00080000 /* msg carries importance - kernel only */ +#define MACH_SEND_SYNC_OVERRIDE 0x00100000 /* msg should do sync ipc override */ + + +#define MACH_RCV_TIMEOUT 0x00000100 /* timeout value applies to receive */ +#define MACH_RCV_NOTIFY 0x00000200 /* reserved - legacy */ +#define MACH_RCV_INTERRUPT 0x00000400 /* don't restart interrupted receive */ +#define MACH_RCV_VOUCHER 0x00000800 /* willing to receive voucher port */ +#define MACH_RCV_OVERWRITE 0x00001000 /* scatter receive (deprecated) */ +#define MACH_RCV_SYNC_WAIT 0x00004000 /* sync waiter waiting for rcv */ + +#ifdef XNU_KERNEL_PRIVATE -#define MACH_RCV_TIMEOUT 0x00000100 -#define MACH_RCV_NOTIFY 0x00000200 -#define MACH_RCV_INTERRUPT 0x00000400 /* libmach implements */ -#define MACH_RCV_OVERWRITE 0x00001000 +#define MACH_RCV_STACK 0x00002000 /* receive into highest addr of buffer */ + +/* + * NOTE: + * This internal-only flag is intended for use by a single thread per-port/set! + * If more than one thread attempts to MACH_PEEK_MSG on a port or set, one of + * the threads may miss messages (in fact, it may never wake up). + */ +#define MACH_PEEK_MSG 0x00100000 /* receive, but leave msgs queued */ + +#endif /* * NOTE: a 0x00------ RCV mask implies to ask for * a MACH_MSG_TRAILER_FORMAT_0 with 0 Elements, * which is equivalent to a mach_msg_trailer_t. + * + * XXXMAC: unlike the rest of the MACH_RCV_* flags, MACH_RCV_TRAILER_LABELS + * needs its own private bit since we only calculate its fields when absolutely + * required. */ #define MACH_RCV_TRAILER_NULL 0 #define MACH_RCV_TRAILER_SEQNO 1 #define MACH_RCV_TRAILER_SENDER 2 #define MACH_RCV_TRAILER_AUDIT 3 +#define MACH_RCV_TRAILER_CTX 4 +#define MACH_RCV_TRAILER_AV 7 +#define MACH_RCV_TRAILER_LABELS 8 #define MACH_RCV_TRAILER_TYPE(x) (((x) & 0xf) << 28) #define MACH_RCV_TRAILER_ELEMENTS(x) (((x) & 0xf) << 24) -#define MACH_RCV_TRAILER_MASK ((0xff << 24)) +#define MACH_RCV_TRAILER_MASK ((0xf << 24)) #define GET_RCV_ELEMENTS(y) (((y) >> 24) & 0xf) -#define REQUESTED_TRAILER_SIZE(y) \ + +#ifdef MACH_KERNEL_PRIVATE +/* The options that the kernel honors when passed from user space */ +#define MACH_SEND_USER (MACH_SEND_MSG | MACH_SEND_TIMEOUT | \ + MACH_SEND_NOTIFY | MACH_SEND_OVERRIDE | \ + MACH_SEND_TRAILER | MACH_SEND_NOIMPORTANCE | \ + MACH_SEND_SYNC_OVERRIDE) + +#define MACH_RCV_USER (MACH_RCV_MSG | MACH_RCV_TIMEOUT | \ + MACH_RCV_LARGE | MACH_RCV_LARGE_IDENTITY | \ + MACH_RCV_VOUCHER | MACH_RCV_TRAILER_MASK | \ + MACH_RCV_SYNC_WAIT) + +#define MACH_MSG_OPTION_USER (MACH_SEND_USER | MACH_RCV_USER) + +/* The options implemented by the library interface to mach_msg et. al. */ +#define MACH_MSG_OPTION_LIB (MACH_SEND_INTERRUPT | MACH_RCV_INTERRUPT) + +/* + * Default options to use when sending from the kernel. + * + * Until we are sure of its effects, we are disabling + * importance donation from the kernel-side of user + * threads in importance-donating tasks. + * (11938665 & 23925818) + */ +#define MACH_SEND_KERNEL_DEFAULT (MACH_SEND_MSG | \ + MACH_SEND_ALWAYS | MACH_SEND_NOIMPORTANCE) + +#endif /* MACH_KERNEL_PRIVATE */ + +/* + * XXXMAC: note that in the case of MACH_RCV_TRAILER_LABELS, + * we just fall through to mach_msg_max_trailer_t. + * This is correct behavior since mach_msg_max_trailer_t is defined as + * mac_msg_mac_trailer_t which is used for the LABELS trailer. + * It also makes things work properly if MACH_RCV_TRAILER_LABELS is ORed + * with one of the other options. + */ + +#define REQUESTED_TRAILER_SIZE_NATIVE(y) \ + ((mach_msg_trailer_size_t) \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_NULL) ? \ + sizeof(mach_msg_trailer_t) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_SEQNO) ? \ + sizeof(mach_msg_seqno_trailer_t) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_SENDER) ? \ + sizeof(mach_msg_security_trailer_t) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_AUDIT) ? \ + sizeof(mach_msg_audit_trailer_t) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_CTX) ? \ + sizeof(mach_msg_context_trailer_t) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_AV) ? \ + sizeof(mach_msg_mac_trailer_t) : \ + sizeof(mach_msg_max_trailer_t)))))))) + + +#ifdef XNU_KERNEL_PRIVATE + +#if defined(__arm64__) +#define REQUESTED_TRAILER_SIZE(is64, y) \ ((mach_msg_trailer_size_t) \ ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_NULL) ? \ sizeof(mach_msg_trailer_t) : \ @@ -560,7 +834,21 @@ typedef integer_t mach_msg_option_t; sizeof(mach_msg_seqno_trailer_t) : \ ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_SENDER) ? \ sizeof(mach_msg_security_trailer_t) : \ - sizeof(mach_msg_audit_trailer_t))))) + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_AUDIT) ? \ + sizeof(mach_msg_audit_trailer_t) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_CTX) ? \ + ((is64) ? sizeof(mach_msg_context_trailer64_t) : sizeof(mach_msg_context_trailer32_t)) : \ + ((GET_RCV_ELEMENTS(y) == MACH_RCV_TRAILER_AV) ? \ + ((is64) ? sizeof(mach_msg_mac_trailer64_t) : sizeof(mach_msg_mac_trailer32_t)) : \ + sizeof(mach_msg_max_trailer_t)))))))) +#else +#define REQUESTED_TRAILER_SIZE(is64, y) REQUESTED_TRAILER_SIZE_NATIVE(y) +#endif + +#else /* XNU_KERNEL_PRIVATE */ +#define REQUESTED_TRAILER_SIZE(y) REQUESTED_TRAILER_SIZE_NATIVE(y) +#endif /* XNU_KERNEL_PRIVATE */ + /* * Much code assumes that mach_msg_return_t == kern_return_t. * This definition is useful for descriptive purposes. @@ -596,6 +884,8 @@ typedef kern_return_t mach_msg_return_t; /* Bogus destination port. */ #define MACH_SEND_TIMED_OUT 0x10000004 /* Message not sent before timeout expired. */ +#define MACH_SEND_INVALID_VOUCHER 0x10000005 + /* Bogus voucher port. */ #define MACH_SEND_INTERRUPTED 0x10000007 /* Software interrupt. */ #define MACH_SEND_MSG_TOO_SMALL 0x10000008 @@ -654,6 +944,13 @@ typedef kern_return_t mach_msg_return_t; #define MACH_RCV_IN_PROGRESS_TIMED 0x10004011 /* Waiting for receive with timeout. (Internal use only.) */ +#ifdef XNU_KERNEL_PRIVATE +#define MACH_PEEK_IN_PROGRESS 0x10008001 + /* Waiting for a peek. (Internal use only.) */ +#define MACH_PEEK_READY 0x10008002 + /* Waiting for a peek. (Internal use only.) */ +#endif + __BEGIN_DECLS @@ -673,7 +970,7 @@ __BEGIN_DECLS * already contain scatter control information to direct the * receiving of the message. */ - +__WATCHOS_PROHIBITED __TVOS_PROHIBITED extern mach_msg_return_t mach_msg_overwrite( mach_msg_header_t *msg, mach_msg_option_t option, @@ -695,6 +992,7 @@ extern mach_msg_return_t mach_msg_overwrite( * of that fact, then restart the appropriate parts of the * operation silently (trap version does not restart). */ +__WATCHOS_PROHIBITED __TVOS_PROHIBITED extern mach_msg_return_t mach_msg( mach_msg_header_t *msg, mach_msg_option_t option, @@ -704,8 +1002,25 @@ extern mach_msg_return_t mach_msg( mach_msg_timeout_t timeout, mach_port_name_t notify); +/* + * Routine: mach_voucher_deallocate + * Purpose: + * Deallocate a mach voucher created or received in a message. Drops + * one (send right) reference to the voucher. + */ +__WATCHOS_PROHIBITED __TVOS_PROHIBITED +extern kern_return_t mach_voucher_deallocate( + mach_port_name_t voucher); + +#elif defined(MACH_KERNEL_PRIVATE) + +extern mach_msg_return_t mach_msg_receive_results(mach_msg_size_t *size); + +extern mach_msg_priority_t mach_msg_priority_combine(mach_msg_priority_t msg_qos, + mach_msg_priority_t recv_qos); #endif /* KERNEL */ __END_DECLS #endif /* _MACH_MESSAGE_H_ */ +