1 /* 2 * Copyright (c) 2000-2018 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 /* Copyright 1995 NeXT Computer, Inc. All rights reserved. */ 29 /* 30 * Copyright (c) 1991, 1993 31 * The Regents of the University of California. All rights reserved. 32 * 33 * This code is derived from software contributed to Berkeley by 34 * Berkeley Software Design, Inc. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. All advertising materials mentioning features or use of this software 45 * must display the following acknowledgement: 46 * This product includes software developed by the University of 47 * California, Berkeley and its contributors. 48 * 4. Neither the name of the University nor the names of its contributors 49 * may be used to endorse or promote products derived from this software 50 * without specific prior written permission. 51 * 52 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 53 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 54 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 55 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 56 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 57 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 58 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 59 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 60 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 61 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 62 * SUCH DAMAGE. 63 * 64 * @(#)cdefs.h 8.8 (Berkeley) 1/9/95 65 */ 66 67 #ifndef _CDEFS_H_ 68 #define _CDEFS_H_ 69 70 #if defined(__cplusplus) 71 #define __BEGIN_DECLS extern "C" { 72 #define __END_DECLS } 73 #else 74 #define __BEGIN_DECLS 75 #define __END_DECLS 76 #endif 77 78 /* This SDK is designed to work with clang and specific versions of 79 * gcc >= 4.0 with Apple's patch sets */ 80 #if !defined(__GNUC__) || __GNUC__ < 4 81 #warning "Unsupported compiler detected" 82 #endif 83 84 /* 85 * Compatibility with compilers and environments that don't support compiler 86 * feature checking function-like macros. 87 */ 88 #ifndef __has_builtin 89 #define __has_builtin(x) 0 90 #endif 91 #ifndef __has_include 92 #define __has_include(x) 0 93 #endif 94 #ifndef __has_feature 95 #define __has_feature(x) 0 96 #endif 97 #ifndef __has_attribute 98 #define __has_attribute(x) 0 99 #endif 100 #ifndef __has_cpp_attribute 101 #define __has_cpp_attribute(x) 0 102 #endif 103 #ifndef __has_extension 104 #define __has_extension(x) 0 105 #endif 106 107 /* 108 * The __CONCAT macro is used to concatenate parts of symbol names, e.g. 109 * with "#define OLD(foo) __CONCAT(old,foo)", OLD(foo) produces oldfoo. 110 * The __CONCAT macro is a bit tricky -- make sure you don't put spaces 111 * in between its arguments. __CONCAT can also concatenate double-quoted 112 * strings produced by the __STRING macro, but this only works with ANSI C. 113 */ 114 #if defined(__STDC__) || defined(__cplusplus) 115 #define __P(protos) protos /* full-blown ANSI C */ 116 #define __CONCAT(x, y) x ## y 117 #define __STRING(x) #x 118 119 #define __const const /* define reserved names to standard */ 120 #define __signed signed 121 #define __volatile volatile 122 #if defined(__cplusplus) 123 #define __inline inline /* convert to C++ keyword */ 124 #else 125 #ifndef __GNUC__ 126 #define __inline /* delete GCC keyword */ 127 #endif /* !__GNUC__ */ 128 #endif /* !__cplusplus */ 129 130 #else /* !(__STDC__ || __cplusplus) */ 131 #define __P(protos) () /* traditional C preprocessor */ 132 #define __CONCAT(x, y) x /**/ y 133 #define __STRING(x) "x" 134 135 #ifndef __GNUC__ 136 #define __const /* delete pseudo-ANSI C keywords */ 137 #define __inline 138 #define __signed 139 #define __volatile 140 #endif /* !__GNUC__ */ 141 142 /* 143 * In non-ANSI C environments, new programs will want ANSI-only C keywords 144 * deleted from the program and old programs will want them left alone. 145 * When using a compiler other than gcc, programs using the ANSI C keywords 146 * const, inline etc. as normal identifiers should define -DNO_ANSI_KEYWORDS. 147 * When using "gcc -traditional", we assume that this is the intent; if 148 * __GNUC__ is defined but __STDC__ is not, we leave the new keywords alone. 149 */ 150 #ifndef NO_ANSI_KEYWORDS 151 #define const __const /* convert ANSI C keywords */ 152 #define inline __inline 153 #define signed __signed 154 #define volatile __volatile 155 #endif /* !NO_ANSI_KEYWORDS */ 156 #endif /* !(__STDC__ || __cplusplus) */ 157 158 /* 159 * __pure2 can be used for functions that are only a function of their scalar 160 * arguments (meaning they can't dereference pointers). 161 * 162 * __stateful_pure can be used for functions that have no side effects, 163 * but depend on the state of the memory. 164 */ 165 #define __dead2 __attribute__((__noreturn__)) 166 #define __pure2 __attribute__((__const__)) 167 #define __stateful_pure __attribute__((__pure__)) 168 169 /* __unused denotes variables and functions that may not be used, preventing 170 * the compiler from warning about it if not used. 171 */ 172 #define __unused __attribute__((__unused__)) 173 174 /* __used forces variables and functions to be included even if it appears 175 * to the compiler that they are not used (and would thust be discarded). 176 */ 177 #define __used __attribute__((__used__)) 178 179 /* __cold marks code used for debugging or that is rarely taken 180 * and tells the compiler to optimize for size and outline code. 181 */ 182 #if __has_attribute(cold) 183 #define __cold __attribute__((__cold__)) 184 #else 185 #define __cold 186 #endif 187 188 /* __returns_nonnull marks functions that return a non-null pointer. */ 189 #if __has_attribute(returns_nonnull) 190 #define __returns_nonnull __attribute((returns_nonnull)) 191 #else 192 #define __returns_nonnull 193 #endif 194 195 /* __exported denotes symbols that should be exported even when symbols 196 * are hidden by default. 197 * __exported_push/_exported_pop are pragmas used to delimit a range of 198 * symbols that should be exported even when symbols are hidden by default. 199 */ 200 #define __exported __attribute__((__visibility__("default"))) 201 #define __exported_push _Pragma("GCC visibility push(default)") 202 #ifndef __BUILDING_XNU_LIBRARY__ 203 #define __exported_push_hidden _Pragma("GCC visibility push(hidden)") 204 #define __exported_pop _Pragma("GCC visibility pop") 205 #define __exported_hidden __private_extern__ 206 #else /* __BUILDING_XNU_LIBRARY__ */ 207 /* Don't hide symbols that the might be need to be used from outside */ 208 #define __exported_push_hidden 209 #define __exported_pop 210 #define __exported_hidden 211 #endif /* __BUILDING_XNU_LIBRARY__ */ 212 213 /* __deprecated causes the compiler to produce a warning when encountering 214 * code using the deprecated functionality. 215 * __deprecated_msg() does the same, and compilers that support it will print 216 * a message along with the deprecation warning. 217 * This may require turning on such warning with the -Wdeprecated flag. 218 * __deprecated_enum_msg() should be used on enums, and compilers that support 219 * it will print the deprecation warning. 220 * __kpi_deprecated() specifically indicates deprecation of kernel programming 221 * interfaces in Kernel.framework used by KEXTs. 222 */ 223 #define __deprecated __attribute__((__deprecated__)) 224 225 #if __has_extension(attribute_deprecated_with_message) || \ 226 (defined(__GNUC__) && ((__GNUC__ >= 5) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 5)))) 227 #define __deprecated_msg(_msg) __attribute__((__deprecated__(_msg))) 228 #else 229 #define __deprecated_msg(_msg) __attribute__((__deprecated__)) 230 #endif 231 232 #if __has_extension(enumerator_attributes) 233 #define __deprecated_enum_msg(_msg) __deprecated_msg(_msg) 234 #else 235 #define __deprecated_enum_msg(_msg) 236 #endif 237 238 #if defined(KERNEL) && !defined(KERNEL_PRIVATE) 239 #define __kpi_deprecated(_msg) __deprecated_msg(_msg) 240 #else /* !defined(KERNEL) || defined(KERNEL_PRIVATE) */ 241 #define __kpi_deprecated(_msg) 242 #endif /* !defined(KERNEL) || defined(KERNEL_PRIVATE) */ 243 244 /* __unavailable causes the compiler to error out when encountering 245 * code using the tagged function 246 */ 247 #if __has_attribute(unavailable) 248 #define __unavailable __attribute__((__unavailable__)) 249 #else 250 #define __unavailable 251 #endif 252 253 #if defined(KERNEL) && !defined(KERNEL_PRIVATE) 254 #define __kpi_unavailable __unavailable 255 #else /* !defined(KERNEL) || defined(KERNEL_PRIVATE) */ 256 #define __kpi_unavailable 257 #endif /* !defined(KERNEL) || defined(KERNEL_PRIVATE) */ 258 259 #if XNU_KERNEL_PRIVATE 260 /* This macro is meant to be used for kpi deprecated to x86 3rd parties 261 * but should be marked as unavailable for arm macOS devices. 262 * XNU: nothing (API is still available) 263 * 1st party kexts: __deprecated 264 * 3rd party kexts macOS x86: __deprecated 265 * 3rd party kexts macOS arm: __unavailable 266 */ 267 #define __kpi_deprecated_arm64_macos_unavailable 268 #elif !KERNEL || !XNU_PLATFORM_MacOSX 269 #define __kpi_deprecated_arm64_macos_unavailable 270 #elif KERNEL_PRIVATE 271 #define __kpi_deprecated_arm64_macos_unavailable __deprecated 272 #elif defined(__arm64__) 273 #define __kpi_deprecated_arm64_macos_unavailable __unavailable 274 #else 275 #define __kpi_deprecated_arm64_macos_unavailable __deprecated 276 #endif /* XNU_KERNEL_PRIVATE */ 277 278 /* Delete pseudo-keywords wherever they are not available or needed. */ 279 #ifndef __dead 280 #define __dead 281 #define __pure 282 #endif 283 284 /* 285 * We use `__restrict' as a way to define the `restrict' type qualifier 286 * without disturbing older software that is unaware of C99 keywords. 287 */ 288 #if __STDC_VERSION__ < 199901 289 #define __restrict 290 #else 291 #define __restrict restrict 292 #endif 293 294 /* Compatibility with compilers and environments that don't support the 295 * nullability feature. 296 */ 297 298 #if !__has_feature(nullability) 299 #ifndef __nullable 300 #define __nullable 301 #endif 302 #ifndef __nonnull 303 #define __nonnull 304 #endif 305 #ifndef __null_unspecified 306 #define __null_unspecified 307 #endif 308 #ifndef _Nullable 309 #define _Nullable 310 #endif 311 #ifndef _Nonnull 312 #define _Nonnull 313 #endif 314 #ifndef _Null_unspecified 315 #define _Null_unspecified 316 #endif 317 #endif 318 319 /* 320 * __disable_tail_calls causes the compiler to not perform tail call 321 * optimization inside the marked function. 322 */ 323 #if __has_attribute(disable_tail_calls) 324 #define __disable_tail_calls __attribute__((__disable_tail_calls__)) 325 #else 326 #define __disable_tail_calls 327 #endif 328 329 /* 330 * __not_tail_called causes the compiler to prevent tail call optimization 331 * on statically bound calls to the function. It has no effect on indirect 332 * calls. Virtual functions, objective-c methods, and functions marked as 333 * "always_inline" cannot be marked as __not_tail_called. 334 */ 335 #if __has_attribute(not_tail_called) 336 #define __not_tail_called __attribute__((__not_tail_called__)) 337 #else 338 #define __not_tail_called 339 #endif 340 341 /* 342 * __result_use_check warns callers of a function that not using the function 343 * return value is a bug, i.e. dismissing malloc() return value results in a 344 * memory leak. 345 */ 346 #if __has_attribute(warn_unused_result) 347 #define __result_use_check __attribute__((__warn_unused_result__)) 348 #else 349 #define __result_use_check 350 #endif 351 352 /* 353 * __swift_unavailable causes the compiler to mark a symbol as specifically 354 * unavailable in Swift, regardless of any other availability in C. 355 */ 356 #if __has_feature(attribute_availability_swift) 357 #define __swift_unavailable(_msg) __attribute__((__availability__(swift, unavailable, message=_msg))) 358 #else 359 #define __swift_unavailable(_msg) 360 #endif 361 362 /* 363 * Attributes to support Swift concurrency. 364 */ 365 #if __has_attribute(__swift_attr__) 366 #define __swift_unavailable_from_async(_msg) __attribute__((__swift_attr__("@_unavailableFromAsync(message: \"" _msg "\")"))) 367 #define __swift_nonisolated __attribute__((__swift_attr__("nonisolated"))) 368 #define __swift_nonisolated_unsafe __attribute__((__swift_attr__("nonisolated(unsafe)"))) 369 #else 370 #define __swift_unavailable_from_async(_msg) 371 #define __swift_nonisolated 372 #define __swift_nonisolated_unsafe 373 #endif 374 375 /* 376 * __abortlike is the attribute to put on functions like abort() that are 377 * typically used to mark assertions. These optimize the codegen 378 * for outlining while still maintaining debugability. 379 */ 380 #ifndef __abortlike 381 #define __abortlike __dead2 __cold __not_tail_called 382 #endif 383 384 /* Declaring inline functions within headers is error-prone due to differences 385 * across various versions of the C language and extensions. __header_inline 386 * can be used to declare inline functions within system headers. In cases 387 * where you want to force inlining instead of letting the compiler make 388 * the decision, you can use __header_always_inline. 389 * 390 * Be aware that using inline for functions which compilers may also provide 391 * builtins can behave differently under various compilers. If you intend to 392 * provide an inline version of such a function, you may want to use a macro 393 * instead. 394 * 395 * The check for !__GNUC__ || __clang__ is because gcc doesn't correctly 396 * support c99 inline in some cases: 397 * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55965 398 */ 399 400 #if defined(__cplusplus) || \ 401 (__STDC_VERSION__ >= 199901L && \ 402 !defined(__GNUC_GNU_INLINE__) && \ 403 (!defined(__GNUC__) || defined(__clang__))) 404 # define __header_inline inline 405 #elif defined(__GNUC__) && defined(__GNUC_STDC_INLINE__) 406 # define __header_inline extern __inline __attribute__((__gnu_inline__)) 407 #elif defined(__GNUC__) 408 # define __header_inline extern __inline 409 #else 410 /* If we land here, we've encountered an unsupported compiler, 411 * so hopefully it understands static __inline as a fallback. 412 */ 413 # define __header_inline static __inline 414 #endif 415 416 #ifdef __GNUC__ 417 # define __header_always_inline __header_inline __attribute__ ((__always_inline__)) 418 #else 419 /* Unfortunately, we're using a compiler that we don't know how to force to 420 * inline. Oh well. 421 */ 422 # define __header_always_inline __header_inline 423 #endif 424 425 /* 426 * Compiler-dependent macros that bracket portions of code where the 427 * "-Wunreachable-code" warning should be ignored. Please use sparingly. 428 */ 429 #if defined(__clang__) 430 # define __unreachable_ok_push \ 431 _Pragma("clang diagnostic push") \ 432 _Pragma("clang diagnostic ignored \"-Wunreachable-code\"") 433 # define __unreachable_ok_pop \ 434 _Pragma("clang diagnostic pop") 435 #elif defined(__GNUC__) && ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)) 436 # define __unreachable_ok_push \ 437 _Pragma("GCC diagnostic push") \ 438 _Pragma("GCC diagnostic ignored \"-Wunreachable-code\"") 439 # define __unreachable_ok_pop \ 440 _Pragma("GCC diagnostic pop") 441 #else 442 # define __unreachable_ok_push 443 # define __unreachable_ok_pop 444 #endif 445 446 /* 447 * Compiler-dependent macros to declare that functions take printf-like 448 * or scanf-like arguments. They are null except for versions of gcc 449 * that are known to support the features properly. Functions declared 450 * with these attributes will cause compilation warnings if there is a 451 * mismatch between the format string and subsequent function parameter 452 * types. 453 */ 454 #define __printflike(fmtarg, firstvararg) \ 455 __attribute__((__format__ (__printf__, fmtarg, firstvararg))) 456 #define __printf0like(fmtarg, firstvararg) \ 457 __attribute__((__format__ (__printf0__, fmtarg, firstvararg))) 458 #define __scanflike(fmtarg, firstvararg) \ 459 __attribute__((__format__ (__scanf__, fmtarg, firstvararg))) 460 #define __osloglike(fmtarg, firstvararg) \ 461 __attribute__((__format__ (__os_log__, fmtarg, firstvararg))) 462 463 #define __IDSTRING(name, string) static const char name[] __used = string 464 465 #ifndef __COPYRIGHT 466 #define __COPYRIGHT(s) __IDSTRING(copyright,s) 467 #endif 468 469 #ifndef __RCSID 470 #define __RCSID(s) __IDSTRING(rcsid,s) 471 #endif 472 473 #ifndef __SCCSID 474 #define __SCCSID(s) __IDSTRING(sccsid,s) 475 #endif 476 477 #ifndef __PROJECT_VERSION 478 #define __PROJECT_VERSION(s) __IDSTRING(project_version,s) 479 #endif 480 481 /* Source compatibility only, ID string not emitted in object file */ 482 #ifndef __FBSDID 483 #define __FBSDID(s) 484 #endif 485 486 #ifndef __DECONST 487 #define __DECONST(type, var) __CAST_AWAY_QUALIFIER(var, const, type) 488 #endif 489 490 #ifndef __DEVOLATILE 491 #define __DEVOLATILE(type, var) __CAST_AWAY_QUALIFIER(var, volatile, type) 492 #endif 493 494 #ifndef __DEQUALIFY 495 #define __DEQUALIFY(type, var) __CAST_AWAY_QUALIFIER(var, const volatile, type) 496 #endif 497 498 /* 499 * __alloc_align can be used to label function arguments that represent the 500 * alignment of the returned pointer. 501 */ 502 #ifndef __alloc_align 503 #if __has_attribute(alloc_align) 504 #define __alloc_align(n) __attribute__((alloc_align(n))) 505 #else 506 #define __alloc_align(n) 507 #endif 508 #endif // __alloc_align 509 510 /* 511 * __alloc_size can be used to label function arguments that represent the 512 * size of memory that the function allocates and returns. The one-argument 513 * form labels a single argument that gives the allocation size (where the 514 * arguments are numbered from 1): 515 * 516 * void *malloc(size_t __size) __alloc_size(1); 517 * 518 * The two-argument form handles the case where the size is calculated as the 519 * product of two arguments: 520 * 521 * void *calloc(size_t __count, size_t __size) __alloc_size(1,2); 522 */ 523 #ifndef __alloc_size 524 #if __has_attribute(alloc_size) 525 #define __alloc_size(...) __attribute__((alloc_size(__VA_ARGS__))) 526 #else 527 #define __alloc_size(...) 528 #endif 529 #endif // __alloc_size 530 531 /* 532 * Facilities below assist adoption of -Wunsafe-buffer-usage, an off-by-default 533 * Clang compiler warning that helps the developer minimize unsafe, raw 534 * buffer manipulation in the code that may lead to buffer overflow 535 * vulnerabilities. 536 * 537 * They are primarily designed for modern C++ code where -Wunsafe-buffer-usage 538 * comes with automatic fix-it hints that help the developer transform 539 * their code to use modern C++ containers, which may be made bounds-safe by 540 * linking against a version of the C++ standard library that offers 541 * bounds-checked containers. 542 * They can be used in plain C, but -fbounds-safety is the preferred solution 543 * for plain C (see also <ptrcheck.h>). 544 * 545 * Attribute __unsafe_buffer_usage can be used to label functions that should be 546 * avoided as they may perform or otherwise introduce unsafe buffer manipulation 547 * operations. The attribute can also be attached to class/struct fields that 548 * are used in unsafe buffer manipulations. 549 * 550 * Calls to attribute annotated functions are flagged by -Wunsafe-buffer-usage, similar to 551 * how unchecked buffer manipulation operations are flagged when observed 552 * by the compiler directly. Similarly, use of and assignment to the struct/class fields 553 * that have the attribute also get flagged by the compiler. 554 * 555 * // An unsafe function that needs to be avoided. 556 * __unsafe_buffer_usage 557 * void foo(int *buf, size_t size); 558 * 559 * // A safe alternative to foo(). 560 * void foo(std::span<int> buf); 561 * 562 * void bar(size_t idx) { 563 * int array[5]; 564 * 565 * // Direct unsafe buffer manipulation through subscript operator: 566 * array[idx] = 3; // warning: function introduces unsafe buffer manipulation [-Wunsafe-buffer-usage] 567 * // Unsafe buffer manipulation through function foo(): 568 * foo(array, 5); // warning: function introduces unsafe buffer manipulation [-Wunsafe-buffer-usage] 569 * // Checked buffer manipulation, with bounds information automatically 570 * // preserved for the purposes of runtime checks in standard library: 571 * foo(array); // no warning 572 * } 573 * 574 * struct Reader { 575 * // Field involved in unsafe buffer manipulation 576 * __unsafe_buffer_usage 577 * void *ptr; 578 * 579 * __unsafe_buffer_usage 580 * size_t sz, count; 581 * }; 582 * 583 * void add_element(Reader rdr, int value) { 584 * if(rdr.count < rdr.sz) { // warning: unsafe buffer access [-Wunsafe-buffer-usage] 585 * rdr.ptr[rdr.count] = value; // warning: unsafe buffer access [-Wunsafe-buffer-usage] 586 * rdr.count++; // warning: unsafe buffer access [-Wunsafe-buffer-usage] 587 * } 588 * } 589 * 590 * While annotating a function as __unsafe_buffer_usage has an effect similar 591 * to annotating it as __deprecated, the __unsafe_buffer_usage attribute 592 * should be used whenever the resulting warning needs to be controlled 593 * by the -Wunsafe-buffer-usage flag (which is turned off in codebases that 594 * don't attempt to achieve bounds safety this way) as opposed to -Wdeprecated 595 * (enabled in most codebases). 596 * 597 * The attribute suppresses all -Wunsafe-buffer-usage warnings inside the 598 * function's body as it is explictly marked as unsafe by the user and 599 * introduces new warnings at each call site to help the developers avoid the 600 * function entirely. Most of the time it does not make sense to annotate a 601 * function as __unsafe_buffer_usage without providing the users with a safe 602 * alternative. 603 * 604 * Pragmas __unsafe_buffer_usage_begin and __unsafe_buffer_usage_end 605 * annotate a range of code as intentionally containing unsafe buffer 606 * operations. They suppress -Wunsafe-buffer-usage warnings 607 * for unsafe operations in range: 608 * 609 * __unsafe_buffer_usage_begin 610 * array[idx] = 3; // warning suppressed 611 * foo(array, 5); // warning suppressed 612 * __unsafe_buffer_usage_end 613 * 614 * These pragmas are NOT a way to mass-annotate functions with the attribute 615 * __unsafe_buffer_usage. Functions declared within the pragma range 616 * do NOT get annotated automatically. 617 */ 618 #if __has_cpp_attribute(clang::unsafe_buffer_usage) 619 #define __has_safe_buffers 1 620 #define __unsafe_buffer_usage [[clang::unsafe_buffer_usage]] 621 #elif __has_attribute(unsafe_buffer_usage) 622 #define __has_safe_buffers 1 623 #define __unsafe_buffer_usage __attribute__((__unsafe_buffer_usage__)) 624 #else 625 #define __has_safe_buffers 0 626 #define __unsafe_buffer_usage 627 #endif 628 #if __has_safe_buffers 629 #define __unsafe_buffer_usage_begin _Pragma("clang unsafe_buffer_usage begin") 630 #define __unsafe_buffer_usage_end _Pragma("clang unsafe_buffer_usage end") 631 #else 632 #define __unsafe_buffer_usage_begin 633 #define __unsafe_buffer_usage_end 634 #endif 635 636 /* 637 * COMPILATION ENVIRONMENTS -- see compat(5) for additional detail 638 * 639 * DEFAULT By default newly complied code will get POSIX APIs plus 640 * Apple API extensions in scope. 641 * 642 * Most users will use this compilation environment to avoid 643 * behavioral differences between 32 and 64 bit code. 644 * 645 * LEGACY Defining _NONSTD_SOURCE will get pre-POSIX APIs plus Apple 646 * API extensions in scope. 647 * 648 * This is generally equivalent to the Tiger release compilation 649 * environment, except that it cannot be applied to 64 bit code; 650 * its use is discouraged. 651 * 652 * We expect this environment to be deprecated in the future. 653 * 654 * STRICT Defining _POSIX_C_SOURCE or _XOPEN_SOURCE restricts the 655 * available APIs to exactly the set of APIs defined by the 656 * corresponding standard, based on the value defined. 657 * 658 * A correct, portable definition for _POSIX_C_SOURCE is 200112L. 659 * A correct, portable definition for _XOPEN_SOURCE is 600L. 660 * 661 * Apple API extensions are not visible in this environment, 662 * which can cause Apple specific code to fail to compile, 663 * or behave incorrectly if prototypes are not in scope or 664 * warnings about missing prototypes are not enabled or ignored. 665 * 666 * In any compilation environment, for correct symbol resolution to occur, 667 * function prototypes must be in scope. It is recommended that all Apple 668 * tools users add either the "-Wall" or "-Wimplicit-function-declaration" 669 * compiler flags to their projects to be warned when a function is being 670 * used without a prototype in scope. 671 */ 672 673 /* These settings are particular to each product. */ 674 #ifdef KERNEL 675 #define __DARWIN_ONLY_64_BIT_INO_T 0 676 #define __DARWIN_ONLY_UNIX_CONFORMANCE 0 677 #define __DARWIN_ONLY_VERS_1050 0 678 #if defined(__x86_64__) 679 #define __DARWIN_SUF_DARWIN14 "_darwin14" 680 #define __DARWIN14_ALIAS(sym) __asm("_" __STRING(sym) __DARWIN_SUF_DARWIN14) 681 #else 682 #define __DARWIN14_ALIAS(sym) 683 #endif 684 #else /* !KERNEL */ 685 #ifdef XNU_PLATFORM_iPhoneOS 686 /* Platform: iPhoneOS */ 687 #define __DARWIN_ONLY_64_BIT_INO_T 1 688 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 689 #define __DARWIN_ONLY_VERS_1050 1 690 #endif /* XNU_PLATFORM_iPhoneOS */ 691 #ifdef XNU_PLATFORM_iPhoneSimulator 692 /* Platform: iPhoneSimulator */ 693 #define __DARWIN_ONLY_64_BIT_INO_T 1 694 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 695 #define __DARWIN_ONLY_VERS_1050 1 696 #endif /* XNU_PLATFORM_iPhoneSimulator */ 697 #ifdef XNU_PLATFORM_tvOS 698 /* Platform: tvOS */ 699 #define __DARWIN_ONLY_64_BIT_INO_T 1 700 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 701 #define __DARWIN_ONLY_VERS_1050 1 702 #endif /* XNU_PLATFORM_tvOS */ 703 #ifdef XNU_PLATFORM_AppleTVOS 704 /* Platform: AppleTVOS */ 705 #define __DARWIN_ONLY_64_BIT_INO_T 1 706 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 707 #define __DARWIN_ONLY_VERS_1050 1 708 #endif /* XNU_PLATFORM_AppleTVOS */ 709 #ifdef XNU_PLATFORM_tvSimulator 710 /* Platform: tvSimulator */ 711 #define __DARWIN_ONLY_64_BIT_INO_T 1 712 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 713 #define __DARWIN_ONLY_VERS_1050 1 714 #endif /* XNU_PLATFORM_tvSimulator */ 715 #ifdef XNU_PLATFORM_AppleTVSimulator 716 /* Platform: AppleTVSimulator */ 717 #define __DARWIN_ONLY_64_BIT_INO_T 1 718 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 719 #define __DARWIN_ONLY_VERS_1050 1 720 #endif /* XNU_PLATFORM_AppleTVSimulator */ 721 #ifdef XNU_PLATFORM_iPhoneOSNano 722 /* Platform: iPhoneOSNano */ 723 #define __DARWIN_ONLY_64_BIT_INO_T 1 724 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 725 #define __DARWIN_ONLY_VERS_1050 1 726 #endif /* XNU_PLATFORM_iPhoneOSNano */ 727 #ifdef XNU_PLATFORM_iPhoneNanoSimulator 728 /* Platform: iPhoneNanoSimulator */ 729 #define __DARWIN_ONLY_64_BIT_INO_T 1 730 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 731 #define __DARWIN_ONLY_VERS_1050 1 732 #endif /* XNU_PLATFORM_iPhoneNanoSimulator */ 733 #ifdef XNU_PLATFORM_WatchOS 734 /* Platform: WatchOS */ 735 #define __DARWIN_ONLY_64_BIT_INO_T 1 736 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 737 #define __DARWIN_ONLY_VERS_1050 1 738 #endif /* XNU_PLATFORM_WatchOS */ 739 #ifdef XNU_PLATFORM_WatchSimulator 740 /* Platform: WatchSimulator */ 741 #define __DARWIN_ONLY_64_BIT_INO_T 1 742 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 743 #define __DARWIN_ONLY_VERS_1050 1 744 #endif /* XNU_PLATFORM_WatchSimulator */ 745 #ifdef XNU_PLATFORM_BridgeOS 746 /* Platform: BridgeOS */ 747 #define __DARWIN_ONLY_64_BIT_INO_T 1 748 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 749 #define __DARWIN_ONLY_VERS_1050 1 750 #endif /* XNU_PLATFORM_BridgeOS */ 751 #ifdef XNU_PLATFORM_DriverKit 752 /* Platform: DriverKit */ 753 #define __DARWIN_ONLY_64_BIT_INO_T 1 754 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 755 #define __DARWIN_ONLY_VERS_1050 1 756 #endif /* XNU_PLATFORM_DriverKit */ 757 #ifdef XNU_PLATFORM_MacOSX 758 /* Platform: MacOSX */ 759 #if defined(__i386__) 760 #define __DARWIN_ONLY_64_BIT_INO_T 0 761 #define __DARWIN_ONLY_UNIX_CONFORMANCE 0 762 #define __DARWIN_ONLY_VERS_1050 0 763 #elif defined(__x86_64__) 764 #define __DARWIN_ONLY_64_BIT_INO_T 0 765 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 766 #define __DARWIN_ONLY_VERS_1050 0 767 #else 768 #define __DARWIN_ONLY_64_BIT_INO_T 1 769 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 770 #define __DARWIN_ONLY_VERS_1050 1 771 #endif 772 #endif /* XNU_PLATFORM_MacOSX */ 773 #ifdef XNU_PLATFORM_XROS 774 /* Platform: XROS */ 775 #define __DARWIN_ONLY_64_BIT_INO_T 1 776 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 777 #define __DARWIN_ONLY_VERS_1050 1 778 #endif /* XNU_PLATFORM_XROS */ 779 #ifdef XNU_PLATFORM_XRSimulator 780 /* Platform: XRSimulator */ 781 #define __DARWIN_ONLY_64_BIT_INO_T 1 782 #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 783 #define __DARWIN_ONLY_VERS_1050 1 784 #endif /* XNU_PLATFORM_XRSimulator */ 785 #endif /* KERNEL */ 786 787 /* 788 * The __DARWIN_ALIAS macros are used to do symbol renaming; they allow 789 * legacy code to use the old symbol, thus maintaining binary compatibility 790 * while new code can use a standards compliant version of the same function. 791 * 792 * __DARWIN_ALIAS is used by itself if the function signature has not 793 * changed, it is used along with a #ifdef check for __DARWIN_UNIX03 794 * if the signature has changed. Because the __LP64__ environment 795 * only supports UNIX03 semantics it causes __DARWIN_UNIX03 to be 796 * defined, but causes __DARWIN_ALIAS to do no symbol mangling. 797 * 798 * As a special case, when XCode is used to target a specific version of the 799 * OS, the manifest constant __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ 800 * will be defined by the compiler, with the digits representing major version 801 * time 100 + minor version times 10 (e.g. 10.5 := 1050). If we are targeting 802 * pre-10.5, and it is the default compilation environment, revert the 803 * compilation environment to pre-__DARWIN_UNIX03. 804 */ 805 #if !defined(__DARWIN_UNIX03) 806 # if defined(KERNEL) 807 # define __DARWIN_UNIX03 0 808 # elif __DARWIN_ONLY_UNIX_CONFORMANCE 809 # if defined(_NONSTD_SOURCE) 810 # error "Can't define _NONSTD_SOURCE when only UNIX conformance is available." 811 # endif /* _NONSTD_SOURCE */ 812 # define __DARWIN_UNIX03 1 813 # elif defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) && ((__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ - 0) < 1040) 814 # define __DARWIN_UNIX03 0 815 # elif defined(_DARWIN_C_SOURCE) || defined(_XOPEN_SOURCE) || defined(_POSIX_C_SOURCE) 816 # if defined(_NONSTD_SOURCE) 817 # error "Can't define both _NONSTD_SOURCE and any of _DARWIN_C_SOURCE, _XOPEN_SOURCE or _POSIX_C_SOURCE." 818 # endif /* _NONSTD_SOURCE */ 819 # define __DARWIN_UNIX03 1 820 # elif defined(_NONSTD_SOURCE) 821 # define __DARWIN_UNIX03 0 822 # else /* default */ 823 # if defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) && ((__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ - 0) < 1050) 824 # define __DARWIN_UNIX03 0 825 # else /* __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ >= 1050 */ 826 # define __DARWIN_UNIX03 1 827 # endif /* __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ >= 1050 */ 828 # endif /* _DARWIN_C_SOURCE || _XOPEN_SOURCE || _POSIX_C_SOURCE || __LP64__ */ 829 #endif /* !__DARWIN_UNIX03 */ 830 831 #if !defined(__DARWIN_64_BIT_INO_T) 832 # if defined(KERNEL) 833 # define __DARWIN_64_BIT_INO_T 0 834 # elif defined(_DARWIN_USE_64_BIT_INODE) 835 # if defined(_DARWIN_NO_64_BIT_INODE) 836 # error "Can't define both _DARWIN_USE_64_BIT_INODE and _DARWIN_NO_64_BIT_INODE." 837 # endif /* _DARWIN_NO_64_BIT_INODE */ 838 # define __DARWIN_64_BIT_INO_T 1 839 # elif defined(_DARWIN_NO_64_BIT_INODE) 840 # if __DARWIN_ONLY_64_BIT_INO_T 841 # error "Can't define _DARWIN_NO_64_BIT_INODE when only 64-bit inodes are available." 842 # endif /* __DARWIN_ONLY_64_BIT_INO_T */ 843 # define __DARWIN_64_BIT_INO_T 0 844 # else /* default */ 845 # if __DARWIN_ONLY_64_BIT_INO_T 846 # define __DARWIN_64_BIT_INO_T 1 847 # elif defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) && ((__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ - 0) < 1060) || __DARWIN_UNIX03 == 0 848 # define __DARWIN_64_BIT_INO_T 0 849 # else /* default */ 850 # define __DARWIN_64_BIT_INO_T 1 851 # endif /* __DARWIN_ONLY_64_BIT_INO_T */ 852 # endif 853 #endif /* !__DARWIN_64_BIT_INO_T */ 854 855 #if !defined(__DARWIN_VERS_1050) 856 # if defined(KERNEL) 857 # define __DARWIN_VERS_1050 0 858 # elif __DARWIN_ONLY_VERS_1050 859 # define __DARWIN_VERS_1050 1 860 # elif defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) && ((__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ - 0) < 1050) || __DARWIN_UNIX03 == 0 861 # define __DARWIN_VERS_1050 0 862 # else /* default */ 863 # define __DARWIN_VERS_1050 1 864 # endif 865 #endif /* !__DARWIN_VERS_1050 */ 866 867 #if !defined(__DARWIN_NON_CANCELABLE) 868 # if defined(KERNEL) 869 # define __DARWIN_NON_CANCELABLE 0 870 # else /* default */ 871 # define __DARWIN_NON_CANCELABLE 0 872 # endif 873 #endif /* !__DARWIN_NON_CANCELABLE */ 874 875 /* 876 * symbol suffixes used for symbol versioning 877 */ 878 #if __DARWIN_UNIX03 879 # if __DARWIN_ONLY_UNIX_CONFORMANCE 880 # define __DARWIN_SUF_UNIX03 /* nothing */ 881 # else /* !__DARWIN_ONLY_UNIX_CONFORMANCE */ 882 # define __DARWIN_SUF_UNIX03 "$UNIX2003" 883 # endif /* __DARWIN_ONLY_UNIX_CONFORMANCE */ 884 885 # if __DARWIN_64_BIT_INO_T 886 # if __DARWIN_ONLY_64_BIT_INO_T 887 # define __DARWIN_SUF_64_BIT_INO_T /* nothing */ 888 # else /* !__DARWIN_ONLY_64_BIT_INO_T */ 889 # define __DARWIN_SUF_64_BIT_INO_T "$INODE64" 890 # endif /* __DARWIN_ONLY_64_BIT_INO_T */ 891 # else /* !__DARWIN_64_BIT_INO_T */ 892 # define __DARWIN_SUF_64_BIT_INO_T /* nothing */ 893 # endif /* __DARWIN_64_BIT_INO_T */ 894 895 # if __DARWIN_VERS_1050 896 # if __DARWIN_ONLY_VERS_1050 897 # define __DARWIN_SUF_1050 /* nothing */ 898 # else /* !__DARWIN_ONLY_VERS_1050 */ 899 # define __DARWIN_SUF_1050 "$1050" 900 # endif /* __DARWIN_ONLY_VERS_1050 */ 901 # else /* !__DARWIN_VERS_1050 */ 902 # define __DARWIN_SUF_1050 /* nothing */ 903 # endif /* __DARWIN_VERS_1050 */ 904 905 # if __DARWIN_NON_CANCELABLE 906 # define __DARWIN_SUF_NON_CANCELABLE "$NOCANCEL" 907 # else /* !__DARWIN_NON_CANCELABLE */ 908 # define __DARWIN_SUF_NON_CANCELABLE /* nothing */ 909 # endif /* __DARWIN_NON_CANCELABLE */ 910 911 #else /* !__DARWIN_UNIX03 */ 912 # define __DARWIN_SUF_UNIX03 /* nothing */ 913 # define __DARWIN_SUF_64_BIT_INO_T /* nothing */ 914 # define __DARWIN_SUF_NON_CANCELABLE /* nothing */ 915 # define __DARWIN_SUF_1050 /* nothing */ 916 #endif /* __DARWIN_UNIX03 */ 917 918 #define __DARWIN_SUF_EXTSN "$DARWIN_EXTSN" 919 920 /* 921 * symbol versioning macros 922 */ 923 #define __DARWIN_ALIAS(sym) __asm("_" __STRING(sym) __DARWIN_SUF_UNIX03) 924 #define __DARWIN_ALIAS_C(sym) __asm("_" __STRING(sym) __DARWIN_SUF_NON_CANCELABLE __DARWIN_SUF_UNIX03) 925 #define __DARWIN_ALIAS_I(sym) __asm("_" __STRING(sym) __DARWIN_SUF_64_BIT_INO_T __DARWIN_SUF_UNIX03) 926 #define __DARWIN_NOCANCEL(sym) __asm("_" __STRING(sym) __DARWIN_SUF_NON_CANCELABLE) 927 #define __DARWIN_INODE64(sym) __asm("_" __STRING(sym) __DARWIN_SUF_64_BIT_INO_T) 928 929 #define __DARWIN_1050(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050) 930 #define __DARWIN_1050ALIAS(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050 __DARWIN_SUF_UNIX03) 931 #define __DARWIN_1050ALIAS_C(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050 __DARWIN_SUF_NON_CANCELABLE __DARWIN_SUF_UNIX03) 932 #define __DARWIN_1050ALIAS_I(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050 __DARWIN_SUF_64_BIT_INO_T __DARWIN_SUF_UNIX03) 933 #define __DARWIN_1050INODE64(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050 __DARWIN_SUF_64_BIT_INO_T) 934 935 #define __DARWIN_EXTSN(sym) __asm("_" __STRING(sym) __DARWIN_SUF_EXTSN) 936 #define __DARWIN_EXTSN_C(sym) __asm("_" __STRING(sym) __DARWIN_SUF_EXTSN __DARWIN_SUF_NON_CANCELABLE) 937 #if XNU_KERNEL_PRIVATE 938 #define __XNU_INTERNAL(sym) __asm("_" __STRING(sym) "$XNU_INTERNAL") __attribute__((used)) 939 #endif 940 941 /* 942 * symbol release macros 943 */ 944 #ifdef KERNEL 945 #define __DARWIN_ALIAS_STARTING(_mac, _iphone, x) 946 #else 947 #include <sys/_symbol_aliasing.h> 948 949 #if defined(__ENVIRONMENT_IPHONE_OS_VERSION_MIN_REQUIRED__) 950 #define __DARWIN_ALIAS_STARTING(_mac, _iphone, x) __DARWIN_ALIAS_STARTING_IPHONE_##_iphone(x) 951 #elif defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) 952 #define __DARWIN_ALIAS_STARTING(_mac, _iphone, x) __DARWIN_ALIAS_STARTING_MAC_##_mac(x) 953 #else 954 #define __DARWIN_ALIAS_STARTING(_mac, _iphone, x) x 955 #endif 956 #endif /* KERNEL */ 957 958 959 /* 960 * POSIX.1 requires that the macros we test be defined before any standard 961 * header file is included. This permits us to convert values for feature 962 * testing, as necessary, using only _POSIX_C_SOURCE. 963 * 964 * Here's a quick run-down of the versions: 965 * defined(_POSIX_SOURCE) 1003.1-1988 966 * _POSIX_C_SOURCE == 1L 1003.1-1990 967 * _POSIX_C_SOURCE == 2L 1003.2-1992 C Language Binding Option 968 * _POSIX_C_SOURCE == 199309L 1003.1b-1993 969 * _POSIX_C_SOURCE == 199506L 1003.1c-1995, 1003.1i-1995, 970 * and the omnibus ISO/IEC 9945-1: 1996 971 * _POSIX_C_SOURCE == 200112L 1003.1-2001 972 * _POSIX_C_SOURCE == 200809L 1003.1-2008 973 * 974 * In addition, the X/Open Portability Guide, which is now the Single UNIX 975 * Specification, defines a feature-test macro which indicates the version of 976 * that specification, and which subsumes _POSIX_C_SOURCE. 977 */ 978 979 /* Deal with IEEE Std. 1003.1-1990, in which _POSIX_C_SOURCE == 1L. */ 980 #if defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE == 1L 981 #undef _POSIX_C_SOURCE 982 #define _POSIX_C_SOURCE 199009L 983 #endif 984 985 /* Deal with IEEE Std. 1003.2-1992, in which _POSIX_C_SOURCE == 2L. */ 986 #if defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE == 2L 987 #undef _POSIX_C_SOURCE 988 #define _POSIX_C_SOURCE 199209L 989 #endif 990 991 /* Deal with various X/Open Portability Guides and Single UNIX Spec. */ 992 #ifdef _XOPEN_SOURCE 993 #if _XOPEN_SOURCE - 0L >= 700L && (!defined(_POSIX_C_SOURCE) || _POSIX_C_SOURCE - 0L < 200809L) 994 #undef _POSIX_C_SOURCE 995 #define _POSIX_C_SOURCE 200809L 996 #elif _XOPEN_SOURCE - 0L >= 600L && (!defined(_POSIX_C_SOURCE) || _POSIX_C_SOURCE - 0L < 200112L) 997 #undef _POSIX_C_SOURCE 998 #define _POSIX_C_SOURCE 200112L 999 #elif _XOPEN_SOURCE - 0L >= 500L && (!defined(_POSIX_C_SOURCE) || _POSIX_C_SOURCE - 0L < 199506L) 1000 #undef _POSIX_C_SOURCE 1001 #define _POSIX_C_SOURCE 199506L 1002 #endif 1003 #endif 1004 1005 /* 1006 * Deal with all versions of POSIX. The ordering relative to the tests above is 1007 * important. 1008 */ 1009 #if defined(_POSIX_SOURCE) && !defined(_POSIX_C_SOURCE) 1010 #define _POSIX_C_SOURCE 198808L 1011 #endif 1012 1013 /* POSIX C deprecation macros */ 1014 #ifdef KERNEL 1015 #define __POSIX_C_DEPRECATED(ver) 1016 #else 1017 #include <sys/_posix_availability.h> 1018 1019 #define __POSIX_C_DEPRECATED(ver) ___POSIX_C_DEPRECATED_STARTING_##ver 1020 #endif 1021 1022 /* 1023 * Set a single macro which will always be defined and can be used to determine 1024 * the appropriate namespace. For POSIX, these values will correspond to 1025 * _POSIX_C_SOURCE value. Currently there are two additional levels corresponding 1026 * to ANSI (_ANSI_SOURCE) and Darwin extensions (_DARWIN_C_SOURCE) 1027 */ 1028 #define __DARWIN_C_ANSI 010000L 1029 #define __DARWIN_C_FULL 900000L 1030 1031 #if defined(_ANSI_SOURCE) 1032 #define __DARWIN_C_LEVEL __DARWIN_C_ANSI 1033 #elif defined(_POSIX_C_SOURCE) && !defined(_DARWIN_C_SOURCE) && !defined(_NONSTD_SOURCE) 1034 #define __DARWIN_C_LEVEL _POSIX_C_SOURCE 1035 #else 1036 #define __DARWIN_C_LEVEL __DARWIN_C_FULL 1037 #endif 1038 1039 /* If the developer has neither requested a strict language mode nor a version 1040 * of POSIX, turn on functionality provided by __STDC_WANT_LIB_EXT1__ as part 1041 * of __DARWIN_C_FULL. 1042 */ 1043 #if !defined(__STDC_WANT_LIB_EXT1__) && !defined(__STRICT_ANSI__) && __DARWIN_C_LEVEL >= __DARWIN_C_FULL 1044 #define __STDC_WANT_LIB_EXT1__ 1 1045 #endif 1046 1047 /* 1048 * long long is not supported in c89 (__STRICT_ANSI__), but g++ -ansi and 1049 * c99 still want long longs. While not perfect, we allow long longs for 1050 * g++. 1051 */ 1052 #if (defined(__STRICT_ANSI__) && (__STDC_VERSION__ - 0 < 199901L) && !defined(__GNUG__)) 1053 #define __DARWIN_NO_LONG_LONG 1 1054 #else 1055 #define __DARWIN_NO_LONG_LONG 0 1056 #endif 1057 1058 /***************************************** 1059 * Public darwin-specific feature macros 1060 *****************************************/ 1061 1062 /* 1063 * _DARWIN_FEATURE_64_BIT_INODE indicates that the ino_t type is 64-bit, and 1064 * structures modified for 64-bit inodes (like struct stat) will be used. 1065 */ 1066 #if __DARWIN_64_BIT_INO_T 1067 #define _DARWIN_FEATURE_64_BIT_INODE 1 1068 #endif 1069 1070 /* 1071 * _DARWIN_FEATURE_64_ONLY_BIT_INODE indicates that the ino_t type may only 1072 * be 64-bit; there is no support for 32-bit ino_t when this macro is defined 1073 * (and non-zero). There is no struct stat64 either, as the regular 1074 * struct stat will already be the 64-bit version. 1075 */ 1076 #if __DARWIN_ONLY_64_BIT_INO_T 1077 #define _DARWIN_FEATURE_ONLY_64_BIT_INODE 1 1078 #endif 1079 1080 /* 1081 * _DARWIN_FEATURE_ONLY_VERS_1050 indicates that only those APIs updated 1082 * in 10.5 exists; no pre-10.5 variants are available. 1083 */ 1084 #if __DARWIN_ONLY_VERS_1050 1085 #define _DARWIN_FEATURE_ONLY_VERS_1050 1 1086 #endif 1087 1088 /* 1089 * _DARWIN_FEATURE_ONLY_UNIX_CONFORMANCE indicates only UNIX conforming API 1090 * are available (the legacy BSD APIs are not available) 1091 */ 1092 #if __DARWIN_ONLY_UNIX_CONFORMANCE 1093 #define _DARWIN_FEATURE_ONLY_UNIX_CONFORMANCE 1 1094 #endif 1095 1096 /* 1097 * _DARWIN_FEATURE_UNIX_CONFORMANCE indicates whether UNIX conformance is on, 1098 * and specifies the conformance level (3 is SUSv3) 1099 */ 1100 #if __DARWIN_UNIX03 1101 #define _DARWIN_FEATURE_UNIX_CONFORMANCE 3 1102 #endif 1103 1104 #if defined(DRIVERKIT) && !defined(KERNEL) 1105 /* 1106 * __DRIVERKIT_LIBC__ indicates to the C++ standard library headers and 1107 * similar components that only the restricted set of standard C library 1108 * functionality and headers for the DriverKit userspace driver environment 1109 * are available. 1110 */ 1111 #define __DRIVERKIT_LIBC__ 1 1112 #endif /* defined(DRIVERKIT) && !defined(KERNEL) */ 1113 1114 /* 1115 * This macro casts away the qualifier from the variable 1116 * 1117 * Note: use at your own risk, removing qualifiers can result in 1118 * catastrophic run-time failures. 1119 */ 1120 #ifndef __CAST_AWAY_QUALIFIER 1121 /* 1122 * XXX: this shouldn't ignore anything more than -Wcast-qual, 1123 * but the old implementation made it an almighty cast that 1124 * ignored everything, so things break left and right if you 1125 * make it only ignore -Wcast-qual. 1126 */ 1127 #define __CAST_AWAY_QUALIFIER(variable, qualifier, type) \ 1128 _Pragma("GCC diagnostic push") \ 1129 _Pragma("GCC diagnostic ignored \"-Wcast-qual\"") \ 1130 _Pragma("GCC diagnostic ignored \"-Wcast-align\"") \ 1131 _Pragma("GCC diagnostic ignored \"-Waddress-of-packed-member\"") \ 1132 ((type)(variable)) \ 1133 _Pragma("GCC diagnostic pop") 1134 #endif 1135 1136 /* 1137 * __XNU_PRIVATE_EXTERN is a linkage decoration indicating that a symbol can be 1138 * used from other compilation units, but not other libraries or executables. 1139 */ 1140 #ifndef __XNU_PRIVATE_EXTERN 1141 #define __XNU_PRIVATE_EXTERN __attribute__((visibility("hidden"))) 1142 #endif 1143 1144 #if __has_include(<ptrcheck.h>) 1145 #include <ptrcheck.h> 1146 #else 1147 #if __has_feature(bounds_safety) 1148 #error -fbounds-safety is enabled, but <ptrcheck.h> is missing. \ 1149 This will lead to difficult-to-diagnose compilation errors. 1150 #endif /* __has_feature(bounds_safety) */ 1151 1152 /* 1153 * We intentionally define to nothing pointer attributes which do not have an 1154 * impact on the ABI. __indexable and __bidi_indexable are not defined because 1155 * of the ABI incompatibility that makes the diagnostic preferable. 1156 */ 1157 #define __has_ptrcheck 0 1158 #define __single 1159 #define __unsafe_indexable 1160 #define __counted_by(N) 1161 #define __counted_by_or_null(N) 1162 #define __sized_by(N) 1163 #define __sized_by_or_null(N) 1164 #define __ended_by(E) 1165 #define __terminated_by(T) 1166 #define __null_terminated 1167 1168 /* 1169 * Similarly, we intentionally define to nothing the 1170 * __ptrcheck_abi_assume_single and __ptrcheck_abi_assume_unsafe_indexable 1171 * macros because they do not lead to an ABI incompatibility. However, we do not 1172 * define the indexable and unsafe_indexable ones because the diagnostic is 1173 * better than the silent ABI break. 1174 */ 1175 #define __ptrcheck_abi_assume_single() 1176 #define __ptrcheck_abi_assume_unsafe_indexable() 1177 1178 /* __unsafe_forge intrinsics are defined as regular C casts. */ 1179 #define __unsafe_forge_bidi_indexable(T, P, S) ((T)(P)) 1180 #define __unsafe_forge_single(T, P) ((T)(P)) 1181 #define __unsafe_forge_terminated_by(T, P, E) ((T)(P)) 1182 #define __unsafe_forge_null_terminated(T, P) ((T)(P)) 1183 #define __terminated_by_to_indexable(P) (P) 1184 #define __unsafe_terminated_by_to_indexable(P) (P) 1185 #define __null_terminated_to_indexable(P) (P) 1186 #define __unsafe_null_terminated_to_indexable(P) (P) 1187 #define __unsafe_terminated_by_from_indexable(T, P, ...) (P) 1188 #define __unsafe_null_terminated_from_indexable(P, ...) (P) 1189 1190 /* decay operates normally; attribute is meaningless without pointer checks. */ 1191 #define __array_decay_dicards_count_in_parameters 1192 1193 /* this is a write-once variable; not useful without pointer checks. */ 1194 #define __unsafe_late_const 1195 1196 #define __ptrcheck_unavailable 1197 #define __ptrcheck_unavailable_r(REPLACEMENT) 1198 1199 #endif /* !__has_include(<ptrcheck.h>) */ 1200 1201 #if KERNEL && !BOUND_CHECKS && !__has_ptrcheck 1202 /* 1203 * With pointer checks disabled, we define __indexable to allow source to still 1204 * contain these annotations. This is safe in builds which _uniformly_ disable 1205 * pointer checks (but not in builds which inconsistently have them enabled). 1206 */ 1207 1208 #define __indexable 1209 #define __bidi_indexable 1210 #endif 1211 1212 #define __ASSUME_PTR_ABI_SINGLE_BEGIN __ptrcheck_abi_assume_single() 1213 #define __ASSUME_PTR_ABI_SINGLE_END __ptrcheck_abi_assume_unsafe_indexable() 1214 1215 #if __has_ptrcheck 1216 #define __header_indexable __indexable 1217 #define __header_bidi_indexable __bidi_indexable 1218 #else 1219 #define __header_indexable 1220 #define __header_bidi_indexable 1221 #endif 1222 1223 /* 1224 * Architecture validation for current SDK 1225 */ 1226 #if !defined(__sys_cdefs_arch_unknown__) && defined(__i386__) 1227 #elif !defined(__sys_cdefs_arch_unknown__) && defined(__x86_64__) 1228 #elif !defined(__sys_cdefs_arch_unknown__) && defined(__arm__) 1229 #elif !defined(__sys_cdefs_arch_unknown__) && defined(__arm64__) 1230 #else 1231 #error Unsupported architecture 1232 #endif 1233 1234 #ifdef XNU_KERNEL_PRIVATE 1235 /* 1236 * Selectively ignore cast alignment warnings 1237 */ 1238 #define __IGNORE_WCASTALIGN(x) _Pragma("clang diagnostic push") \ 1239 _Pragma("clang diagnostic ignored \"-Wcast-align\"") \ 1240 x \ 1241 _Pragma("clang diagnostic pop") 1242 #endif 1243 1244 #if defined(PRIVATE) || defined(KERNEL) 1245 /* 1246 * Check if __probable and __improbable have already been defined elsewhere. 1247 * These macros inform the compiler (and humans) about which branches are likely 1248 * to be taken. 1249 */ 1250 #if !defined(__probable) && !defined(__improbable) 1251 #define __probable(x) __builtin_expect(!!(x), 1) 1252 #define __improbable(x) __builtin_expect(!!(x), 0) 1253 #endif /* !defined(__probable) && !defined(__improbable) */ 1254 1255 #define __container_of(ptr, type_t, field) __extension__({ \ 1256 const __typeof__(((type_t *)NULL)->field) *__ptr = (ptr); \ 1257 uintptr_t __result = (uintptr_t)__ptr - offsetof(type_t, field); \ 1258 if (__ptr) __builtin_assume(__result != 0); \ 1259 __unsafe_forge_single(type_t *, __result); \ 1260 }) 1261 1262 #define __container_of_safe(ptr, type_t, field) __extension__({ \ 1263 const __typeof__(((type_t *)NULL)->field) *__ptr_or_null = (ptr); \ 1264 __ptr_or_null ? __container_of(__ptr_or_null, type_t, field) : NULL; \ 1265 }) 1266 1267 /* 1268 * This forces the optimizer to materialize the specified variable value, 1269 * and prevents any reordering of operations done to it. 1270 */ 1271 #define __compiler_materialize_and_prevent_reordering_on(var) \ 1272 __asm__ ("" : "=r"(var) : "0"(var)) 1273 1274 #endif /* KERNEL || PRIVATE */ 1275 1276 #define __compiler_barrier() __asm__ __volatile__("" ::: "memory") 1277 1278 #if __has_attribute(enum_extensibility) 1279 #define __enum_open __attribute__((__enum_extensibility__(open))) 1280 #define __enum_closed __attribute__((__enum_extensibility__(closed))) 1281 #else 1282 #define __enum_open 1283 #define __enum_closed 1284 #endif // __has_attribute(enum_extensibility) 1285 1286 #if __has_attribute(flag_enum) 1287 #define __enum_options __attribute__((__flag_enum__)) 1288 #else 1289 #define __enum_options 1290 #endif 1291 1292 /* 1293 * Similar to OS_ENUM/OS_CLOSED_ENUM/OS_OPTIONS/OS_CLOSED_OPTIONS 1294 * 1295 * This provides more advanced type checking on compilers supporting 1296 * the proper extensions, even in C. 1297 */ 1298 #if __has_feature(objc_fixed_enum) || __has_extension(cxx_fixed_enum) || \ 1299 __has_extension(cxx_strong_enums) 1300 #define __enum_decl(_name, _type, ...) \ 1301 typedef enum : _type __VA_ARGS__ __enum_open _name 1302 #define __enum_closed_decl(_name, _type, ...) \ 1303 typedef enum : _type __VA_ARGS__ __enum_closed _name 1304 #define __options_decl(_name, _type, ...) \ 1305 typedef enum : _type __VA_ARGS__ __enum_open __enum_options _name 1306 #define __options_closed_decl(_name, _type, ...) \ 1307 typedef enum : _type __VA_ARGS__ __enum_closed __enum_options _name 1308 #else 1309 #define __enum_decl(_name, _type, ...) \ 1310 typedef _type _name; enum __VA_ARGS__ __enum_open 1311 #define __enum_closed_decl(_name, _type, ...) \ 1312 typedef _type _name; enum __VA_ARGS__ __enum_closed 1313 #define __options_decl(_name, _type, ...) \ 1314 typedef _type _name; enum __VA_ARGS__ __enum_open __enum_options 1315 #define __options_closed_decl(_name, _type, ...) \ 1316 typedef _type _name; enum __VA_ARGS__ __enum_closed __enum_options 1317 #endif 1318 1319 #if XNU_KERNEL_PRIVATE 1320 /* 1321 * __xnu_struct_group() can be used to declare a set of fields to be grouped 1322 * together logically in order to perform safer memory operations 1323 * (assignment, zeroing, ...) on them. 1324 */ 1325 #ifdef __cplusplus 1326 #define __xnu_struct_group(group_type, group_name, ...) \ 1327 struct group_type __VA_ARGS__; \ 1328 union { \ 1329 struct __VA_ARGS__; \ 1330 struct group_type group_name; \ 1331 } 1332 #else 1333 #define __xnu_struct_group(group_type, group_name, ...) \ 1334 union { \ 1335 struct __VA_ARGS__; \ 1336 struct group_type __VA_ARGS__ group_name; \ 1337 } 1338 #endif 1339 #endif /* XNU_KERNEL_PRIVATE */ 1340 1341 #if defined(KERNEL) && __has_attribute(xnu_usage_semantics) 1342 /* 1343 * These macros can be used to annotate type definitions or scalar structure 1344 * fields to inform the compiler about which semantic they have with regards 1345 * to the content of the underlying memory represented by such type or field. 1346 * 1347 * This information is used in the analysis of the types performed by the 1348 * signature based type segregation implemented in kalloc. 1349 */ 1350 #define __kernel_ptr_semantics __attribute__((xnu_usage_semantics("pointer"))) 1351 #define __kernel_data_semantics __attribute__((xnu_usage_semantics("data"))) 1352 #define __kernel_dual_semantics __attribute__((xnu_usage_semantics("pointer", "data"))) 1353 1354 #else /* defined(KERNEL) && __has_attribute(xnu_usage_semantics) */ 1355 1356 #define __kernel_ptr_semantics 1357 #define __kernel_data_semantics 1358 #define __kernel_dual_semantics 1359 1360 #endif /* defined(KERNEL) && __has_attribute(xnu_usage_semantics) */ 1361 1362 #if XNU_KERNEL_PRIVATE 1363 /* 1364 * Compiler-dependent macros that bracket portions of code where the 1365 * "-Wxnu-typed-allocators" warning should be ignored. 1366 */ 1367 #if defined(__clang__) 1368 # define __typed_allocators_ignore_push \ 1369 _Pragma("clang diagnostic push") \ 1370 _Pragma("clang diagnostic ignored \"-Wxnu-typed-allocators\"") 1371 # define __typed_allocators_ignore_pop \ 1372 _Pragma("clang diagnostic pop") 1373 # define __typed_allocators_ignore(x) __typed_allocators_ignore_push \ 1374 x \ 1375 __typed_allocators_ignore_pop 1376 #else 1377 # define __typed_allocators_ignore_push 1378 # define __typed_allocators_ignore_pop 1379 # define __typed_allocators_ignore(x) x 1380 #endif /* __clang */ 1381 #endif /* XNU_KERNEL_PRIVATE */ 1382 1383 #if defined(KERNEL_PRIVATE) && \ 1384 __has_attribute(xnu_data_size) && \ 1385 __has_attribute(xnu_returns_data_pointer) 1386 /* 1387 * Annotate function parameters to specify that they semantically 1388 * represent the size of a data-only backing storage. 1389 */ 1390 # define __xnu_data_size __attribute__((xnu_data_size)) 1391 /* 1392 * Annotate function declarations to specify that the pointer they return 1393 * points to a data-only backing storage. 1394 */ 1395 # define __xnu_returns_data_pointer __attribute__((xnu_returns_data_pointer)) 1396 #else 1397 # define __xnu_data_size 1398 # define __xnu_returns_data_pointer 1399 #endif 1400 1401 #if XNU_KERNEL_PRIVATE 1402 /* 1403 * Macro pair which allows C code to, at build time, require that a function 1404 * will not use a stack frame/spill to the stack in RELEASE or DEVELOPMENT (i.e. 1405 * not DEBUG). 1406 * 1407 * This macro has no effect on non-optimizing/-O0 builds since we rely on the 1408 * existence of some basic optimizations in order to ensure that stack usage can 1409 * be avoided. Since non-optimizing builds should never be used in production, 1410 * we can relax the security properties of this macro and permit stack usage 1411 * without an error. 1412 * 1413 * When unsupported, this macro is ignored and stack usage will not generate an 1414 * error. As such, this macro should only be used when stack usage may pose a 1415 * security concern rather than a functional issue. 1416 * 1417 * In user-space compilation the function decorated with this calls into a mock 1418 * function and that uses the stack, so this needs to be disabled. 1419 */ 1420 #if __OPTIMIZE__ && !defined(__BUILDING_XNU_LIBRARY__) 1421 #define __SECURITY_STACK_DISALLOWED_PUSH \ 1422 _Pragma("clang diagnostic push") \ 1423 _Pragma("clang diagnostic error \"-Wframe-larger-than\"") 1424 #define __SECURITY_STACK_DISALLOWED_POP \ 1425 _Pragma("clang diagnostic pop") 1426 #else 1427 #define __SECURITY_STACK_DISALLOWED_PUSH 1428 #define __SECURITY_STACK_DISALLOWED_POP 1429 #endif /* __clang */ 1430 #endif /* XNU_KERNEL_PRIVATE */ 1431 1432 #endif /* !_CDEFS_H_ */ 1433