1 /*
2 * Copyright (c) 1998-2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <IOKit/IORPC.h>
30 #include <IOKit/IOKitServer.h>
31 #include <IOKit/IOKitKeysPrivate.h>
32 #include <IOKit/IOKernelReportStructs.h>
33 #include <IOKit/IOUserClient.h>
34 #include <IOKit/IOService.h>
35 #include <IOKit/IORegistryEntry.h>
36 #include <IOKit/IOCatalogue.h>
37 #include <IOKit/IOMemoryDescriptor.h>
38 #include <IOKit/IOBufferMemoryDescriptor.h>
39 #include <IOKit/IOSubMemoryDescriptor.h>
40 #include <IOKit/IOMultiMemoryDescriptor.h>
41 #include <IOKit/IOMapper.h>
42 #include <IOKit/IOLib.h>
43 #include <IOKit/IOHibernatePrivate.h>
44 #include <IOKit/IOBSD.h>
45 #include <IOKit/system.h>
46 #include <IOKit/IOUserServer.h>
47 #include <IOKit/IOInterruptEventSource.h>
48 #include <IOKit/IOTimerEventSource.h>
49 #include <IOKit/pwr_mgt/RootDomain.h>
50 #include <IOKit/pwr_mgt/IOPowerConnection.h>
51 #include <libkern/c++/OSAllocation.h>
52 #include <libkern/c++/OSKext.h>
53 #include <libkern/c++/OSSharedPtr.h>
54 #include <libkern/OSDebug.h>
55 #include <libkern/Block.h>
56 #include <kern/cs_blobs.h>
57 #include <kern/thread_call.h>
58 #include <os/atomic_private.h>
59 #include <sys/proc.h>
60 #include <sys/reboot.h>
61 #include <sys/codesign.h>
62 #include "IOKitKernelInternal.h"
63
64 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
65
66 #include <DriverKit/IODispatchQueue.h>
67 #include <DriverKit/OSObject.h>
68 #include <DriverKit/OSAction.h>
69 #include <DriverKit/IODispatchSource.h>
70 #include <DriverKit/IOInterruptDispatchSource.h>
71 #include <DriverKit/IOService.h>
72 #include <DriverKit/IOMemoryDescriptor.h>
73 #include <DriverKit/IOBufferMemoryDescriptor.h>
74 #include <DriverKit/IOMemoryMap.h>
75 #include <DriverKit/IODataQueueDispatchSource.h>
76 #include <DriverKit/IOServiceNotificationDispatchSource.h>
77 #include <DriverKit/IOServiceStateNotificationDispatchSource.h>
78 #include <DriverKit/IOEventLink.h>
79 #include <DriverKit/IOWorkGroup.h>
80 #include <DriverKit/IOUserServer.h>
81
82 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
83
84 #include <System/IODataQueueDispatchSourceShared.h>
85
86 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
87
88 TUNABLE(SInt64, gIODKDebug, "dk", kIODKEnable);
89
90 #if DEBUG || DEVELOPMENT
91 TUNABLE(bool, disable_dext_crash_reboot, "disable_dext_crash_reboot", 0);
92 #endif /* DEBUG || DEVELOPMENT */
93
94 static OSString * gIOSystemStateSleepDescriptionKey;
95 static const OSSymbol * gIOSystemStateSleepDescriptionReasonKey;
96 static const OSSymbol * gIOSystemStateSleepDescriptionHibernateStateKey;
97
98 static OSString * gIOSystemStateWakeDescriptionKey;
99 static const OSSymbol * gIOSystemStateWakeDescriptionWakeReasonKey;
100
101 static OSString * gIOSystemStateHaltDescriptionKey;
102 static const OSSymbol * gIOSystemStateHaltDescriptionHaltStateKey;
103
104 static OSString * gIOSystemStatePowerSourceDescriptionKey;
105 static const OSSymbol * gIOSystemStatePowerSourceDescriptionACAttachedKey;
106
107 extern bool gInUserspaceReboot;
108
109 extern void iokit_clear_registered_ports(task_t task);
110
111 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
112
113 struct IOPStrings;
114
115 class OSUserMetaClass : public OSObject
116 {
117 OSDeclareDefaultStructors(OSUserMetaClass);
118 public:
119 const OSSymbol * name;
120 const OSMetaClass * meta;
121 OSUserMetaClass * superMeta;
122
123 queue_chain_t link;
124
125 OSClassDescription * description;
126 IOPStrings * queueNames;
127 uint32_t methodCount;
128 uint64_t * methods;
129
130 virtual void free() override;
131 virtual kern_return_t Dispatch(const IORPC rpc) APPLE_KEXT_OVERRIDE;
132 };
133 OSDefineMetaClassAndStructors(OSUserMetaClass, OSObject);
134
135 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
136
137 class IOUserService : public IOService
138 {
139 friend class IOService;
140
141 OSDeclareDefaultStructors(IOUserService)
142
143 virtual bool
144 start(IOService * provider) APPLE_KEXT_OVERRIDE;
145 };
146
147 OSDefineMetaClassAndStructors(IOUserService, IOService)
148
149 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
150
151 class IOUserUserClient : public IOUserClient
152 {
153 OSDeclareDefaultStructors(IOUserUserClient);
154 public:
155 task_t fTask;
156 OSDictionary * fWorkGroups;
157 OSDictionary * fEventLinks;
158 IOLock * fLock;
159
160 IOReturn setTask(task_t task);
161 IOReturn eventlinkConfigurationTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6);
162 IOReturn workgroupConfigurationTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6);
163
164 virtual bool init( OSDictionary * dictionary ) APPLE_KEXT_OVERRIDE;
165 virtual void free() APPLE_KEXT_OVERRIDE;
166 virtual void stop(IOService * provider) APPLE_KEXT_OVERRIDE;
167 virtual IOReturn clientClose(void) APPLE_KEXT_OVERRIDE;
168 virtual IOReturn setProperties(OSObject * properties) APPLE_KEXT_OVERRIDE;
169 virtual IOReturn externalMethod(uint32_t selector, IOExternalMethodArguments * args,
170 IOExternalMethodDispatch * dispatch, OSObject * target, void * reference) APPLE_KEXT_OVERRIDE;
171 virtual IOReturn clientMemoryForType(UInt32 type,
172 IOOptionBits * options,
173 IOMemoryDescriptor ** memory) APPLE_KEXT_OVERRIDE;
174 virtual IOExternalTrap * getTargetAndTrapForIndex( IOService **targetP, UInt32 index ) APPLE_KEXT_OVERRIDE;
175 };
176
177 OSDefineMetaClassAndStructors(IOUserServerCheckInToken, OSObject);
178 OSDefineMetaClassAndStructors(_IOUserServerCheckInCancellationHandler, OSObject);
179
180 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
181
182
183 bool
start(IOService * provider)184 IOUserService::start(IOService * provider)
185 {
186 bool ok = true;
187 IOReturn ret;
188
189 ret = Start(provider);
190 if (kIOReturnSuccess != ret) {
191 return false;
192 }
193
194 return ok;
195 }
196
197 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
198
199 #undef super
200
201 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
202
203 struct IODispatchQueue_IVars {
204 IOUserServer * userServer;
205 IODispatchQueue * queue;
206 queue_chain_t link;
207 uint64_t tid;
208
209 mach_port_t serverPort;
210 };
211
212 struct OSAction_IVars {
213 OSObject * target;
214 uint64_t targetmsgid;
215 uint64_t msgid;
216 IOUserServer * userServer;
217 OSActionAbortedHandler abortedHandler;
218 OSString * typeName;
219 void * reference;
220 size_t referenceSize;
221 bool aborted;
222 };
223
224 struct IOWorkGroup_IVars {
225 IOUserServer * userServer;
226 OSString * name;
227 IOUserUserClient * userClient;
228 };
229
230 struct IOEventLink_IVars {
231 IOUserServer * userServer;
232 OSString * name;
233 IOUserUserClient * userClient;
234 };
235
236 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
237
238 kern_return_t
GetRegistryEntryID_Impl(uint64_t * registryEntryID)239 IOService::GetRegistryEntryID_Impl(
240 uint64_t * registryEntryID)
241 {
242 IOReturn ret = kIOReturnSuccess;
243
244 *registryEntryID = getRegistryEntryID();
245
246 return ret;
247 }
248
249 kern_return_t
SetName_Impl(const char * name)250 IOService::SetName_Impl(
251 const char * name)
252 {
253 IOReturn ret = kIOReturnSuccess;
254
255 setName(name);
256
257 return ret;
258 }
259
260 kern_return_t
CopyName_Impl(OSString ** name)261 IOService::CopyName_Impl(
262 OSString ** name)
263 {
264 const OSString * str = copyName();
265 *name = __DECONST(OSString *, str);
266 return str ? kIOReturnSuccess : kIOReturnError;
267 }
268
269
270 kern_return_t
Start_Impl(IOService * provider)271 IOService::Start_Impl(
272 IOService * provider)
273 {
274 IOReturn ret = kIOReturnSuccess;
275 return ret;
276 }
277
278
279 IOReturn
UpdateReport_Impl(OSData * channels,uint32_t action,uint32_t * outElementCount,uint64_t offset,uint64_t capacity,IOMemoryDescriptor * buffer)280 IOService::UpdateReport_Impl(OSData *channels, uint32_t action,
281 uint32_t *outElementCount,
282 uint64_t offset, uint64_t capacity,
283 IOMemoryDescriptor *buffer)
284 {
285 return kIOReturnUnsupported;
286 }
287
288 IOReturn
ConfigureReport_Impl(OSData * channels,uint32_t action,uint32_t * outCount)289 IOService::ConfigureReport_Impl(OSData *channels, uint32_t action, uint32_t *outCount)
290 {
291 return kIOReturnUnsupported;
292 }
293
294 // adapt old signature of configureReport to the iig-friendly signature of ConfigureReport
295 IOReturn
_ConfigureReport(IOReportChannelList * channelList,IOReportConfigureAction action,void * result,void * destination)296 IOService::_ConfigureReport(IOReportChannelList *channelList,
297 IOReportConfigureAction action,
298 void *result,
299 void *destination)
300 {
301 if (action != kIOReportEnable && action != kIOReportGetDimensions && action != kIOReportDisable) {
302 return kIOReturnUnsupported;
303 }
304 static_assert(sizeof(IOReportChannelList) == 8);
305 static_assert(sizeof(IOReportChannel) == 16);
306 unsigned int size_of_channels;
307 bool overflow = os_mul_and_add_overflow(channelList->nchannels, sizeof(IOReportChannel), sizeof(IOReportChannelList), &size_of_channels);
308 if (overflow) {
309 return kIOReturnOverrun;
310 }
311 OSSharedPtr<OSData> sp_channels(OSData::withBytesNoCopy(channelList, size_of_channels), libkern::no_retain);
312 if (!sp_channels) {
313 return kIOReturnNoMemory;
314 }
315 int *resultp = (int*) result;
316 uint32_t count = 0;
317 IOReturn r = ConfigureReport(sp_channels.get(), action, &count);
318 int new_result;
319 overflow = os_add_overflow(*resultp, count, &new_result);
320 if (overflow) {
321 return kIOReturnOverrun;
322 }
323 *resultp = new_result;
324 return r;
325 }
326
327 // adapt old signature of updateReport to the iig-friendly signature of UpdateReport
328 IOReturn
_UpdateReport(IOReportChannelList * channelList,IOReportUpdateAction action,void * result,void * destination)329 IOService::_UpdateReport(IOReportChannelList *channelList,
330 IOReportUpdateAction action,
331 void *result,
332 void *destination)
333 {
334 if (action != kIOReportCopyChannelData) {
335 return kIOReturnUnsupported;
336 }
337 unsigned int size_of_channels;
338 bool overflow = os_mul_and_add_overflow(channelList->nchannels, sizeof(IOReportChannel), sizeof(IOReportChannelList), &size_of_channels);
339 if (overflow) {
340 return kIOReturnOverrun;
341 }
342 OSSharedPtr<OSData> sp_channels(OSData::withBytesNoCopy(channelList, size_of_channels), libkern::no_retain);
343 if (!sp_channels) {
344 return kIOReturnNoMemory;
345 }
346 int *resultp = (int*) result;
347 uint32_t count = 0;
348 auto buffer = (IOBufferMemoryDescriptor*) destination;
349 uint64_t length = buffer->getLength();
350 buffer->setLength(buffer->getCapacity());
351 IOReturn r = UpdateReport(sp_channels.get(), action, &count, length, buffer->getCapacity() - length, buffer);
352 int new_result;
353 overflow = os_add_overflow(*resultp, count, &new_result);
354 size_t new_length;
355 overflow = overflow || os_mul_and_add_overflow(count, sizeof(IOReportElement), length, &new_length);
356 if (overflow || new_length > buffer->getCapacity()) {
357 buffer->setLength(length);
358 return kIOReturnOverrun;
359 }
360 *resultp = new_result;
361 buffer->setLength(new_length);
362 return r;
363 }
364
365
366 IOReturn
SetLegend_Impl(OSArray * legend,bool is_public)367 IOService::SetLegend_Impl(OSArray *legend, bool is_public)
368 {
369 bool ok = setProperty(kIOReportLegendKey, legend);
370 ok = ok && setProperty(kIOReportLegendPublicKey, is_public);
371 return ok ? kIOReturnSuccess : kIOReturnError;
372 }
373
374
375 kern_return_t
RegisterService_Impl()376 IOService::RegisterService_Impl()
377 {
378 IOReturn ret = kIOReturnSuccess;
379 bool started;
380
381 IOUserServer *us = (typeof(us))thread_iokit_tls_get(0);
382 if (reserved != NULL && reserved->uvars != NULL && reserved->uvars->userServer == us) {
383 started = reserved->uvars->started;
384 } else {
385 // assume started
386 started = true;
387 }
388
389 if (OSDynamicCast(IOUserServer, this) != NULL || started) {
390 registerService(kIOServiceAsynchronous);
391 } else {
392 assert(reserved != NULL && reserved->uvars != NULL);
393 reserved->uvars->deferredRegisterService = true;
394 }
395
396 return ret;
397 }
398
399 kern_return_t
CopyDispatchQueue_Impl(const char * name,IODispatchQueue ** queue)400 IOService::CopyDispatchQueue_Impl(
401 const char * name,
402 IODispatchQueue ** queue)
403 {
404 IODispatchQueue * result;
405 IOService * service;
406 IOReturn ret;
407 uint32_t index;
408
409 if (!reserved->uvars) {
410 return kIOReturnError;
411 }
412
413 if (!reserved->uvars->queueArray) {
414 // CopyDispatchQueue should not be called after the service has stopped
415 return kIOReturnError;
416 }
417
418 ret = kIOReturnNotFound;
419 index = -1U;
420 if (!strcmp("Default", name)) {
421 index = 0;
422 } else if (reserved->uvars->userMeta
423 && reserved->uvars->userMeta->queueNames) {
424 index = reserved->uvars->userServer->stringArrayIndex(reserved->uvars->userMeta->queueNames, name);
425 if (index != -1U) {
426 index++;
427 }
428 }
429 if (index == -1U) {
430 if ((service = getProvider())) {
431 ret = service->CopyDispatchQueue(name, queue);
432 }
433 } else {
434 result = reserved->uvars->queueArray[index];
435 if (result) {
436 result->retain();
437 *queue = result;
438 ret = kIOReturnSuccess;
439 }
440 }
441
442 return ret;
443 }
444
445 kern_return_t
CreateDefaultDispatchQueue_Impl(IODispatchQueue ** queue)446 IOService::CreateDefaultDispatchQueue_Impl(
447 IODispatchQueue ** queue)
448 {
449 return kIOReturnError;
450 }
451
452 kern_return_t
CoreAnalyticsSendEvent_Impl(uint64_t options,OSString * eventName,OSDictionary * eventPayload)453 IOService::CoreAnalyticsSendEvent_Impl(
454 uint64_t options,
455 OSString * eventName,
456 OSDictionary * eventPayload)
457 {
458 kern_return_t ret;
459
460 if (NULL == gIOCoreAnalyticsSendEventProc) {
461 // perhaps save for later?
462 return kIOReturnNotReady;
463 }
464
465 ret = (*gIOCoreAnalyticsSendEventProc)(options, eventName, eventPayload);
466
467 return ret;
468 }
469
470 kern_return_t
SetDispatchQueue_Impl(const char * name,IODispatchQueue * queue)471 IOService::SetDispatchQueue_Impl(
472 const char * name,
473 IODispatchQueue * queue)
474 {
475 IOReturn ret = kIOReturnSuccess;
476 uint32_t index;
477
478 if (!reserved->uvars) {
479 return kIOReturnError;
480 }
481
482 if (kIODKLogSetup & gIODKDebug) {
483 DKLOG(DKS "::SetDispatchQueue(%s)\n", DKN(this), name);
484 }
485 queue->ivars->userServer = reserved->uvars->userServer;
486 index = -1U;
487 if (!strcmp("Default", name)) {
488 index = 0;
489 } else if (reserved->uvars->userMeta
490 && reserved->uvars->userMeta->queueNames) {
491 index = reserved->uvars->userServer->stringArrayIndex(reserved->uvars->userMeta->queueNames, name);
492 if (index != -1U) {
493 index++;
494 }
495 }
496 if (index == -1U) {
497 ret = kIOReturnBadArgument;
498 } else {
499 reserved->uvars->queueArray[index] = queue;
500 queue->retain();
501 }
502
503 return ret;
504 }
505
506 IOService *
GetProvider() const507 IOService::GetProvider() const
508 {
509 return getProvider();
510 }
511
512 kern_return_t
SetProperties_Impl(OSDictionary * properties)513 IOService::SetProperties_Impl(
514 OSDictionary * properties)
515 {
516 IOUserServer * us;
517 OSDictionary * dict;
518 IOReturn ret;
519
520 us = (typeof(us))thread_iokit_tls_get(0);
521 dict = OSDynamicCast(OSDictionary, properties);
522 if (NULL == us) {
523 if (!dict) {
524 return kIOReturnBadArgument;
525 }
526 bool ok __block = true;
527 dict->iterateObjects(^bool (const OSSymbol * key, OSObject * value) {
528 ok = setProperty(key, value);
529 return !ok;
530 });
531 ret = ok ? kIOReturnSuccess : kIOReturnNotWritable;
532 return ret;
533 }
534
535 ret = setProperties(properties);
536
537 if (kIOReturnUnsupported == ret) {
538 if (dict && reserved->uvars && (reserved->uvars->userServer == us)) {
539 ret = runPropertyActionBlock(^IOReturn (void) {
540 OSDictionary * userProps;
541 IOReturn ret;
542
543 userProps = OSDynamicCast(OSDictionary, getProperty(gIOUserServicePropertiesKey));
544 if (userProps) {
545 userProps = (typeof(userProps))userProps->copyCollection();
546 } else {
547 userProps = OSDictionary::withCapacity(4);
548 }
549 if (!userProps) {
550 ret = kIOReturnNoMemory;
551 } else {
552 bool ok = userProps->merge(dict);
553 if (ok) {
554 ok = setProperty(gIOUserServicePropertiesKey, userProps);
555 }
556 OSSafeReleaseNULL(userProps);
557 ret = ok ? kIOReturnSuccess : kIOReturnNotWritable;
558 }
559 return ret;
560 });
561 }
562 }
563
564 return ret;
565 }
566
567 kern_return_t
RemoveProperty_Impl(OSString * propertyName)568 IOService::RemoveProperty_Impl(OSString * propertyName)
569 {
570 IOUserServer * us = (IOUserServer *)thread_iokit_tls_get(0);
571 IOReturn ret = kIOReturnUnsupported;
572
573 if (NULL == propertyName) {
574 return kIOReturnUnsupported;
575 }
576 if (NULL == us) {
577 removeProperty(propertyName);
578 return kIOReturnSuccess;
579 }
580 if (reserved && reserved->uvars && reserved->uvars->userServer == us) {
581 ret = runPropertyActionBlock(^IOReturn (void) {
582 OSDictionary * userProps;
583 userProps = OSDynamicCast(OSDictionary, getProperty(gIOUserServicePropertiesKey));
584 if (userProps) {
585 userProps = (OSDictionary *)userProps->copyCollection();
586 if (!userProps) {
587 return kIOReturnNoMemory;
588 }
589 userProps->removeObject(propertyName);
590 bool ok = setProperty(gIOUserServicePropertiesKey, userProps);
591 OSSafeReleaseNULL(userProps);
592 return ok ? kIOReturnSuccess : kIOReturnNotWritable;
593 } else {
594 return kIOReturnNotFound;
595 }
596 });
597 }
598 return ret;
599 }
600
601 kern_return_t
CopyProperties_Local(OSDictionary ** properties)602 IOService::CopyProperties_Local(
603 OSDictionary ** properties)
604 {
605 OSDictionary * props;
606 OSDictionary * userProps;
607
608 props = dictionaryWithProperties();
609 userProps = OSDynamicCast(OSDictionary, props->getObject(gIOUserServicePropertiesKey));
610 if (userProps) {
611 props->merge(userProps);
612 props->removeObject(gIOUserServicePropertiesKey);
613 }
614
615 *properties = props;
616
617 return props ? kIOReturnSuccess : kIOReturnNoMemory;
618 }
619
620 kern_return_t
CopyProperties_Impl(OSDictionary ** properties)621 IOService::CopyProperties_Impl(
622 OSDictionary ** properties)
623 {
624 return CopyProperties_Local(properties);
625 }
626
627 kern_return_t
RequireMaxBusStall_Impl(uint64_t u64ns)628 IOService::RequireMaxBusStall_Impl(
629 uint64_t u64ns)
630 {
631 IOReturn ret;
632 UInt32 ns;
633
634 if (os_convert_overflow(u64ns, &ns)) {
635 return kIOReturnBadArgument;
636 }
637 ret = requireMaxBusStall(ns);
638
639 return ret;
640 }
641
642 #if PRIVATE_WIFI_ONLY
643 kern_return_t
UserSetProperties_Impl(OSContainer * properties)644 IOService::UserSetProperties_Impl(
645 OSContainer * properties)
646 {
647 return kIOReturnUnsupported;
648 }
649
650 kern_return_t
SendIOMessageServicePropertyChange_Impl(void)651 IOService::SendIOMessageServicePropertyChange_Impl(void)
652 {
653 return messageClients(kIOMessageServicePropertyChange);
654 }
655 #endif /* PRIVATE_WIFI_ONLY */
656
657 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
658
659 kern_return_t
_CopyState_Impl(_IOMDPrivateState * state)660 IOMemoryDescriptor::_CopyState_Impl(
661 _IOMDPrivateState * state)
662 {
663 IOReturn ret;
664
665 state->length = _length;
666 state->options = _flags;
667
668 ret = kIOReturnSuccess;
669
670 return ret;
671 }
672
673 kern_return_t
GetLength(uint64_t * returnLength)674 IOMemoryDescriptor::GetLength(uint64_t * returnLength)
675 {
676 *returnLength = getLength();
677
678 return kIOReturnSuccess;
679 }
680
681 kern_return_t
CreateMapping_Impl(uint64_t options,uint64_t address,uint64_t offset,uint64_t length,uint64_t alignment,IOMemoryMap ** map)682 IOMemoryDescriptor::CreateMapping_Impl(
683 uint64_t options,
684 uint64_t address,
685 uint64_t offset,
686 uint64_t length,
687 uint64_t alignment,
688 IOMemoryMap ** map)
689 {
690 IOReturn ret;
691 IOMemoryMap * resultMap;
692 IOOptionBits koptions;
693 mach_vm_address_t atAddress;
694
695 ret = kIOReturnSuccess;
696 koptions = 0;
697 resultMap = NULL;
698
699 if (kIOMemoryMapFixedAddress & options) {
700 atAddress = address;
701 koptions = 0;
702 } else {
703 switch (kIOMemoryMapGuardedMask & options) {
704 default:
705 case kIOMemoryMapGuardedDefault:
706 koptions |= kIOMapGuardedSmall;
707 break;
708 case kIOMemoryMapGuardedNone:
709 break;
710 case kIOMemoryMapGuardedSmall:
711 koptions |= kIOMapGuardedSmall;
712 break;
713 case kIOMemoryMapGuardedLarge:
714 koptions |= kIOMapGuardedLarge;
715 break;
716 }
717 atAddress = 0;
718 koptions |= kIOMapAnywhere;
719 }
720
721 if ((kIOMemoryMapReadOnly & options) || (kIODirectionOut == getDirection())) {
722 if (!reserved || (current_task() != reserved->creator)) {
723 koptions |= kIOMapReadOnly;
724 }
725 }
726
727 switch (0xFF00 & options) {
728 case kIOMemoryMapCacheModeDefault:
729 koptions |= kIOMapDefaultCache;
730 break;
731 case kIOMemoryMapCacheModeInhibit:
732 koptions |= kIOMapInhibitCache;
733 break;
734 case kIOMemoryMapCacheModeCopyback:
735 koptions |= kIOMapCopybackCache;
736 break;
737 case kIOMemoryMapCacheModeWriteThrough:
738 koptions |= kIOMapWriteThruCache;
739 break;
740 default:
741 ret = kIOReturnBadArgument;
742 }
743
744 if (kIOReturnSuccess == ret) {
745 resultMap = createMappingInTask(current_task(), atAddress, koptions, offset, length);
746 if (!resultMap) {
747 ret = kIOReturnError;
748 }
749 }
750
751 *map = resultMap;
752
753 return ret;
754 }
755
756 kern_return_t
CreateSubMemoryDescriptor_Impl(uint64_t memoryDescriptorCreateOptions,uint64_t offset,uint64_t length,IOMemoryDescriptor * ofDescriptor,IOMemoryDescriptor ** memory)757 IOMemoryDescriptor::CreateSubMemoryDescriptor_Impl(
758 uint64_t memoryDescriptorCreateOptions,
759 uint64_t offset,
760 uint64_t length,
761 IOMemoryDescriptor * ofDescriptor,
762 IOMemoryDescriptor ** memory)
763 {
764 IOReturn ret;
765 IOMemoryDescriptor * iomd;
766 IOByteCount mdOffset;
767 IOByteCount mdLength;
768 IOByteCount mdEnd;
769
770 if (!ofDescriptor) {
771 return kIOReturnBadArgument;
772 }
773 if (memoryDescriptorCreateOptions & ~kIOMemoryDirectionOutIn) {
774 return kIOReturnBadArgument;
775 }
776 if (os_convert_overflow(offset, &mdOffset)) {
777 return kIOReturnBadArgument;
778 }
779 if (os_convert_overflow(length, &mdLength)) {
780 return kIOReturnBadArgument;
781 }
782 if (os_add_overflow(mdOffset, mdLength, &mdEnd)) {
783 return kIOReturnBadArgument;
784 }
785 if (mdEnd > ofDescriptor->getLength()) {
786 return kIOReturnBadArgument;
787 }
788
789 iomd = IOSubMemoryDescriptor::withSubRange(
790 ofDescriptor, mdOffset, mdLength, (IOOptionBits) memoryDescriptorCreateOptions);
791
792 if (iomd) {
793 ret = kIOReturnSuccess;
794 *memory = iomd;
795 } else {
796 ret = kIOReturnNoMemory;
797 *memory = NULL;
798 }
799
800 return ret;
801 }
802
803 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
804
805 kern_return_t
CreateWithMemoryDescriptors_Impl(uint64_t memoryDescriptorCreateOptions,uint32_t withDescriptorsCount,IOMemoryDescriptor ** const withDescriptors,IOMemoryDescriptor ** memory)806 IOMemoryDescriptor::CreateWithMemoryDescriptors_Impl(
807 uint64_t memoryDescriptorCreateOptions,
808 uint32_t withDescriptorsCount,
809 IOMemoryDescriptor ** const withDescriptors,
810 IOMemoryDescriptor ** memory)
811 {
812 IOReturn ret;
813 IOMemoryDescriptor * iomd;
814
815 if (!withDescriptors) {
816 return kIOReturnBadArgument;
817 }
818 if (!withDescriptorsCount) {
819 return kIOReturnBadArgument;
820 }
821 if (memoryDescriptorCreateOptions & ~kIOMemoryDirectionOutIn) {
822 return kIOReturnBadArgument;
823 }
824
825 for (unsigned int idx = 0; idx < withDescriptorsCount; idx++) {
826 if (NULL == withDescriptors[idx]) {
827 return kIOReturnBadArgument;
828 }
829 }
830
831 iomd = IOMultiMemoryDescriptor::withDescriptors(withDescriptors, withDescriptorsCount,
832 (IODirection) memoryDescriptorCreateOptions, false);
833
834 if (iomd) {
835 ret = kIOReturnSuccess;
836 *memory = iomd;
837 } else {
838 ret = kIOReturnNoMemory;
839 *memory = NULL;
840 }
841
842 return ret;
843 }
844
845 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
846
847 kern_return_t
CreateMemoryDescriptorFromClient_Impl(uint64_t memoryDescriptorCreateOptions,uint32_t segmentsCount,const IOAddressSegment segments[32],IOMemoryDescriptor ** memory)848 IOUserClient::CreateMemoryDescriptorFromClient_Impl(
849 uint64_t memoryDescriptorCreateOptions,
850 uint32_t segmentsCount,
851 const IOAddressSegment segments[32],
852 IOMemoryDescriptor ** memory)
853 {
854 IOReturn ret;
855 IOMemoryDescriptor * iomd;
856 IOOptionBits mdOptions;
857 IOUserUserClient * me;
858 IOAddressRange * ranges;
859
860 me = OSDynamicCast(IOUserUserClient, this);
861 if (!me) {
862 return kIOReturnBadArgument;
863 }
864 if (!me->fTask) {
865 return kIOReturnNotReady;
866 }
867
868 mdOptions = kIOMemoryThreadSafe;
869 if (kIOMemoryDirectionOut & memoryDescriptorCreateOptions) {
870 mdOptions |= kIODirectionOut;
871 }
872 if (kIOMemoryDirectionIn & memoryDescriptorCreateOptions) {
873 mdOptions |= kIODirectionIn;
874 }
875 if (!(kIOMemoryDisableCopyOnWrite & memoryDescriptorCreateOptions)) {
876 mdOptions |= kIOMemoryMapCopyOnWrite;
877 }
878
879 static_assert(sizeof(IOAddressRange) == sizeof(IOAddressSegment));
880 ranges = __DECONST(IOAddressRange *, &segments[0]);
881
882 iomd = IOMemoryDescriptor::withAddressRanges(
883 ranges, segmentsCount,
884 mdOptions, me->fTask);
885
886 if (iomd) {
887 ret = kIOReturnSuccess;
888 *memory = iomd;
889 } else {
890 ret = kIOReturnNoMemory;
891 *memory = NULL;
892 }
893
894 return ret;
895 }
896
897 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
898
899 kern_return_t
_CopyState_Impl(_IOMemoryMapPrivateState * state)900 IOMemoryMap::_CopyState_Impl(
901 _IOMemoryMapPrivateState * state)
902 {
903 IOReturn ret;
904
905 state->offset = fOffset;
906 state->length = getLength();
907 state->address = getAddress();
908 state->options = getMapOptions();
909
910 ret = kIOReturnSuccess;
911
912 return ret;
913 }
914
915 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
916
917 kern_return_t
Create_Impl(uint64_t options,uint64_t capacity,uint64_t alignment,IOBufferMemoryDescriptor ** memory)918 IOBufferMemoryDescriptor::Create_Impl(
919 uint64_t options,
920 uint64_t capacity,
921 uint64_t alignment,
922 IOBufferMemoryDescriptor ** memory)
923 {
924 IOReturn ret;
925 IOOptionBits bmdOptions;
926 IOBufferMemoryDescriptor * bmd;
927 IOMemoryDescriptorReserved * reserved;
928
929 if (options & ~((uint64_t) kIOMemoryDirectionOutIn)) {
930 // no other options currently defined
931 return kIOReturnBadArgument;
932 }
933 bmdOptions = (options & kIOMemoryDirectionOutIn) | kIOMemoryKernelUserShared | kIOMemoryThreadSafe;
934 bmd = IOBufferMemoryDescriptor::inTaskWithOptions(
935 kernel_task, bmdOptions, capacity, alignment);
936
937 *memory = bmd;
938
939 if (!bmd) {
940 return kIOReturnNoMemory;
941 }
942
943 reserved = bmd->getKernelReserved();
944 reserved->creator = current_task();
945 task_reference(reserved->creator);
946
947 ret = kIOReturnSuccess;
948
949 return ret;
950 }
951
952 kern_return_t
SetLength_Impl(uint64_t length)953 IOBufferMemoryDescriptor::SetLength_Impl(
954 uint64_t length)
955 {
956 setLength(length);
957 return kIOReturnSuccess;
958 }
959
960
961 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
962
963 kern_return_t
Create_Impl(IOService * device,uint64_t options,const IODMACommandSpecification * specification,IODMACommand ** command)964 IODMACommand::Create_Impl(
965 IOService * device,
966 uint64_t options,
967 const IODMACommandSpecification * specification,
968 IODMACommand ** command)
969 {
970 IOReturn ret;
971 IODMACommand * dma;
972 IODMACommand::SegmentOptions segmentOptions;
973 IOMapper * mapper;
974
975 if (options & ~((uint64_t) kIODMACommandCreateNoOptions)) {
976 // no other options currently defined
977 return kIOReturnBadArgument;
978 }
979
980 if (os_convert_overflow(specification->maxAddressBits, &segmentOptions.fNumAddressBits)) {
981 return kIOReturnBadArgument;
982 }
983 segmentOptions.fMaxSegmentSize = 0;
984 segmentOptions.fMaxTransferSize = 0;
985 segmentOptions.fAlignment = 1;
986 segmentOptions.fAlignmentLength = 1;
987 segmentOptions.fAlignmentInternalSegments = 1;
988 segmentOptions.fStructSize = sizeof(segmentOptions);
989
990 mapper = IOMapper::copyMapperForDevice(device);
991
992 dma = IODMACommand::withSpecification(
993 kIODMACommandOutputHost64,
994 &segmentOptions,
995 kIODMAMapOptionDextOwner |
996 kIODMAMapOptionMapped,
997 mapper,
998 NULL);
999
1000 OSSafeReleaseNULL(mapper);
1001 *command = dma;
1002
1003 if (!dma) {
1004 return kIOReturnNoMemory;
1005 }
1006 ret = kIOReturnSuccess;
1007
1008 return ret;
1009 }
1010
1011 #define fInternalState reserved
1012
1013 kern_return_t
PrepareForDMA_Impl(uint64_t options,IOMemoryDescriptor * memory,uint64_t offset,uint64_t length,uint64_t * flags,uint32_t * segmentsCount,IOAddressSegment * segments)1014 IODMACommand::PrepareForDMA_Impl(
1015 uint64_t options,
1016 IOMemoryDescriptor * memory,
1017 uint64_t offset,
1018 uint64_t length,
1019 uint64_t * flags,
1020 uint32_t * segmentsCount,
1021 IOAddressSegment * segments)
1022 {
1023 IOReturn ret;
1024 uint64_t lflags, mdFlags;
1025 UInt32 numSegments;
1026 UInt64 genOffset;
1027
1028 if (options & ~((uint64_t) kIODMACommandPrepareForDMANoOptions)) {
1029 // no other options currently defined
1030 return kIOReturnBadArgument;
1031 }
1032
1033 if (memory == NULL) {
1034 return kIOReturnBadArgument;
1035 }
1036
1037 assert(fInternalState->fDextLock);
1038 IOLockLock(fInternalState->fDextLock);
1039
1040 // uses IOMD direction
1041 ret = memory->prepare();
1042 if (kIOReturnSuccess != ret) {
1043 goto exit;
1044 }
1045
1046 ret = setMemoryDescriptor(memory, false);
1047 if (kIOReturnSuccess != ret) {
1048 memory->complete();
1049 goto exit;
1050 }
1051
1052 ret = prepare(offset, length);
1053 if (kIOReturnSuccess != ret) {
1054 clearMemoryDescriptor(false);
1055 memory->complete();
1056 goto exit;
1057 }
1058
1059 static_assert(sizeof(IODMACommand::Segment64) == sizeof(IOAddressSegment));
1060
1061 numSegments = *segmentsCount;
1062 genOffset = 0;
1063 ret = genIOVMSegments(&genOffset, segments, &numSegments);
1064
1065 if (kIOReturnSuccess != ret) {
1066 clearMemoryDescriptor(true);
1067 memory->complete();
1068 goto exit;
1069 }
1070
1071 mdFlags = fMemory->getFlags();
1072 lflags = 0;
1073 if (kIODirectionOut & mdFlags) {
1074 lflags |= kIOMemoryDirectionOut;
1075 }
1076 if (kIODirectionIn & mdFlags) {
1077 lflags |= kIOMemoryDirectionIn;
1078 }
1079 *flags = lflags;
1080 *segmentsCount = numSegments;
1081
1082 exit:
1083 IOLockUnlock(fInternalState->fDextLock);
1084
1085 return ret;
1086 }
1087
1088 kern_return_t
CompleteDMA_Impl(uint64_t options)1089 IODMACommand::CompleteDMA_Impl(
1090 uint64_t options)
1091 {
1092 IOReturn ret, completeRet;
1093 IOMemoryDescriptor * md;
1094
1095 if (options & ~((uint64_t) kIODMACommandCompleteDMANoOptions)) {
1096 // no other options currently defined
1097 return kIOReturnBadArgument;
1098 }
1099
1100 assert(fInternalState->fDextLock);
1101 IOLockLock(fInternalState->fDextLock);
1102
1103 if (!fInternalState->fPrepared) {
1104 ret = kIOReturnNotReady;
1105 goto exit;
1106 }
1107
1108 md = __DECONST(IOMemoryDescriptor *, fMemory);
1109 if (md) {
1110 md->retain();
1111 }
1112
1113 ret = clearMemoryDescriptor(true);
1114
1115 if (md) {
1116 completeRet = md->complete();
1117 OSSafeReleaseNULL(md);
1118 if (kIOReturnSuccess == ret) {
1119 ret = completeRet;
1120 }
1121 }
1122 exit:
1123 IOLockUnlock(fInternalState->fDextLock);
1124
1125 return ret;
1126 }
1127
1128 kern_return_t
GetPreparation_Impl(uint64_t * offset,uint64_t * length,IOMemoryDescriptor ** memory)1129 IODMACommand::GetPreparation_Impl(
1130 uint64_t * offset,
1131 uint64_t * length,
1132 IOMemoryDescriptor ** memory)
1133 {
1134 IOReturn ret;
1135 IOMemoryDescriptor * md;
1136
1137 if (!fActive) {
1138 return kIOReturnNotReady;
1139 }
1140
1141 ret = getPreparedOffsetAndLength(offset, length);
1142 if (kIOReturnSuccess != ret) {
1143 return ret;
1144 }
1145
1146 if (memory) {
1147 md = __DECONST(IOMemoryDescriptor *, fMemory);
1148 *memory = md;
1149 if (!md) {
1150 ret = kIOReturnNotReady;
1151 } else {
1152 md->retain();
1153 }
1154 }
1155 return ret;
1156 }
1157
1158 kern_return_t
PerformOperation_Impl(uint64_t options,uint64_t dmaOffset,uint64_t length,uint64_t dataOffset,IOMemoryDescriptor * data)1159 IODMACommand::PerformOperation_Impl(
1160 uint64_t options,
1161 uint64_t dmaOffset,
1162 uint64_t length,
1163 uint64_t dataOffset,
1164 IOMemoryDescriptor * data)
1165 {
1166 IOReturn ret;
1167 OSDataAllocation<uint8_t> buffer;
1168 UInt64 copiedDMA;
1169 IOByteCount mdOffset, mdLength, copied;
1170
1171 if (options & ~((uint64_t)
1172 (kIODMACommandPerformOperationOptionRead
1173 | kIODMACommandPerformOperationOptionWrite
1174 | kIODMACommandPerformOperationOptionZero))) {
1175 // no other options currently defined
1176 return kIOReturnBadArgument;
1177 }
1178
1179 if (!fActive) {
1180 return kIOReturnNotReady;
1181 }
1182 if (os_convert_overflow(dataOffset, &mdOffset)) {
1183 return kIOReturnBadArgument;
1184 }
1185 if (os_convert_overflow(length, &mdLength)) {
1186 return kIOReturnBadArgument;
1187 }
1188 if (length > fMemory->getLength()) {
1189 return kIOReturnBadArgument;
1190 }
1191 buffer = OSDataAllocation<uint8_t>(length, OSAllocateMemory);
1192 if (!buffer) {
1193 return kIOReturnNoMemory;
1194 }
1195
1196 switch (options) {
1197 case kIODMACommandPerformOperationOptionZero:
1198 bzero(buffer.data(), length);
1199 copiedDMA = writeBytes(dmaOffset, buffer.data(), length);
1200 if (copiedDMA != length) {
1201 ret = kIOReturnUnderrun;
1202 break;
1203 }
1204 ret = kIOReturnSuccess;
1205 break;
1206
1207 case kIODMACommandPerformOperationOptionRead:
1208 case kIODMACommandPerformOperationOptionWrite:
1209
1210 if (!data) {
1211 ret = kIOReturnBadArgument;
1212 break;
1213 }
1214 if (length > data->getLength()) {
1215 ret = kIOReturnBadArgument;
1216 break;
1217 }
1218 if (kIODMACommandPerformOperationOptionWrite == options) {
1219 copied = data->readBytes(mdOffset, buffer.data(), mdLength);
1220 if (copied != mdLength) {
1221 ret = kIOReturnUnderrun;
1222 break;
1223 }
1224 copiedDMA = writeBytes(dmaOffset, buffer.data(), length);
1225 if (copiedDMA != length) {
1226 ret = kIOReturnUnderrun;
1227 break;
1228 }
1229 } else { /* kIODMACommandPerformOperationOptionRead */
1230 copiedDMA = readBytes(dmaOffset, buffer.data(), length);
1231 if (copiedDMA != length) {
1232 ret = kIOReturnUnderrun;
1233 break;
1234 }
1235 copied = data->writeBytes(mdOffset, buffer.data(), mdLength);
1236 if (copied != mdLength) {
1237 ret = kIOReturnUnderrun;
1238 break;
1239 }
1240 }
1241 ret = kIOReturnSuccess;
1242 break;
1243 default:
1244 ret = kIOReturnBadArgument;
1245 break;
1246 }
1247
1248 return ret;
1249 }
1250
1251
1252 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1253
1254 static kern_return_t
OSActionCreateWithTypeNameInternal(OSObject * target,uint64_t targetmsgid,uint64_t msgid,size_t referenceSize,OSString * typeName,bool fromKernel,OSAction ** action)1255 OSActionCreateWithTypeNameInternal(OSObject * target, uint64_t targetmsgid, uint64_t msgid, size_t referenceSize, OSString * typeName, bool fromKernel, OSAction ** action)
1256 {
1257 OSAction * inst = NULL;
1258 void * reference = NULL; // must release
1259 const OSSymbol *sym = NULL; // must release
1260 OSObject *obj = NULL; // must release
1261 const OSMetaClass *actionMetaClass = NULL; // do not release
1262 kern_return_t ret;
1263
1264 if (fromKernel && typeName) {
1265 /* The action is being constructed in the kernel with a type name */
1266 sym = OSSymbol::withString(typeName);
1267 actionMetaClass = OSMetaClass::getMetaClassWithName(sym);
1268 if (actionMetaClass && actionMetaClass->getSuperClass() == OSTypeID(OSAction)) {
1269 obj = actionMetaClass->alloc();
1270 if (!obj) {
1271 ret = kIOReturnNoMemory;
1272 goto finish;
1273 }
1274 inst = OSDynamicCast(OSAction, obj);
1275 obj = NULL; // prevent release
1276 assert(inst); // obj is a subclass of OSAction so the dynamic cast should always work
1277 } else {
1278 DKLOG("Attempted to create action object with type \"%s\" which does not inherit from OSAction\n", typeName->getCStringNoCopy());
1279 ret = kIOReturnBadArgument;
1280 goto finish;
1281 }
1282 } else {
1283 inst = OSTypeAlloc(OSAction);
1284 if (!inst) {
1285 ret = kIOReturnNoMemory;
1286 goto finish;
1287 }
1288 }
1289
1290 if (referenceSize != 0) {
1291 reference = IONewZeroData(uint8_t, referenceSize);
1292 if (reference == NULL) {
1293 ret = kIOReturnNoMemory;
1294 goto finish;
1295 }
1296 }
1297
1298 inst->ivars = IONewZero(OSAction_IVars, 1);
1299 if (!inst->ivars) {
1300 ret = kIOReturnNoMemory;
1301 goto finish;
1302 }
1303 if (target) {
1304 target->retain();
1305 if (!fromKernel && !OSDynamicCast(IOService, target)) {
1306 IOUserServer * us;
1307 us = (typeof(us))thread_iokit_tls_get(0);
1308 inst->ivars->userServer = OSDynamicCast(IOUserServer, us);
1309 assert(inst->ivars->userServer);
1310 inst->ivars->userServer->retain();
1311 }
1312 }
1313 inst->ivars->target = target;
1314 inst->ivars->targetmsgid = targetmsgid;
1315 inst->ivars->msgid = msgid;
1316
1317 inst->ivars->reference = reference;
1318 inst->ivars->referenceSize = referenceSize;
1319 reference = NULL; // prevent release
1320
1321 if (typeName) {
1322 typeName->retain();
1323 }
1324 inst->ivars->typeName = typeName;
1325
1326 *action = inst;
1327 inst = NULL; // prevent release
1328 ret = kIOReturnSuccess;
1329
1330 finish:
1331 OSSafeReleaseNULL(obj);
1332 OSSafeReleaseNULL(sym);
1333 OSSafeReleaseNULL(inst);
1334 if (reference) {
1335 IODeleteData(reference, uint8_t, referenceSize);
1336 }
1337
1338 return ret;
1339 }
1340
1341 kern_return_t
Create(OSAction_Create_Args)1342 OSAction::Create(OSAction_Create_Args)
1343 {
1344 return OSAction::CreateWithTypeName(target, targetmsgid, msgid, referenceSize, NULL, action);
1345 }
1346
1347 kern_return_t
CreateWithTypeName(OSAction_CreateWithTypeName_Args)1348 OSAction::CreateWithTypeName(OSAction_CreateWithTypeName_Args)
1349 {
1350 return OSActionCreateWithTypeNameInternal(target, targetmsgid, msgid, referenceSize, typeName, true, action);
1351 }
1352
1353 kern_return_t
Create_Impl(OSObject * target,uint64_t targetmsgid,uint64_t msgid,size_t referenceSize,OSAction ** action)1354 OSAction::Create_Impl(
1355 OSObject * target,
1356 uint64_t targetmsgid,
1357 uint64_t msgid,
1358 size_t referenceSize,
1359 OSAction ** action)
1360 {
1361 return OSAction::CreateWithTypeName_Impl(target, targetmsgid, msgid, referenceSize, NULL, action);
1362 }
1363
1364 kern_return_t
CreateWithTypeName_Impl(OSObject * target,uint64_t targetmsgid,uint64_t msgid,size_t referenceSize,OSString * typeName,OSAction ** action)1365 OSAction::CreateWithTypeName_Impl(
1366 OSObject * target,
1367 uint64_t targetmsgid,
1368 uint64_t msgid,
1369 size_t referenceSize,
1370 OSString * typeName,
1371 OSAction ** action)
1372 {
1373 return OSActionCreateWithTypeNameInternal(target, targetmsgid, msgid, referenceSize, typeName, false, action);
1374 }
1375
1376 void
free()1377 OSAction::free()
1378 {
1379 if (ivars) {
1380 if (ivars->abortedHandler) {
1381 Block_release(ivars->abortedHandler);
1382 ivars->abortedHandler = NULL;
1383 }
1384 OSSafeReleaseNULL(ivars->target);
1385 OSSafeReleaseNULL(ivars->typeName);
1386 OSSafeReleaseNULL(ivars->userServer);
1387 if (ivars->reference) {
1388 assert(ivars->referenceSize > 0);
1389 IODeleteData(ivars->reference, uint8_t, ivars->referenceSize);
1390 }
1391 IOSafeDeleteNULL(ivars, OSAction_IVars, 1);
1392 }
1393 return super::free();
1394 }
1395
1396 void *
GetReference()1397 OSAction::GetReference()
1398 {
1399 assert(ivars && ivars->referenceSize && ivars->reference);
1400 return ivars->reference;
1401 }
1402
1403 kern_return_t
SetAbortedHandler(OSActionAbortedHandler handler)1404 OSAction::SetAbortedHandler(OSActionAbortedHandler handler)
1405 {
1406 ivars->abortedHandler = Block_copy(handler);
1407 return kIOReturnSuccess;
1408 }
1409
1410 void
Aborted_Impl(void)1411 OSAction::Aborted_Impl(void)
1412 {
1413 if (!os_atomic_cmpxchg(&ivars->aborted, false, true, relaxed)) {
1414 // already aborted
1415 return;
1416 }
1417 if (ivars->abortedHandler) {
1418 ivars->abortedHandler();
1419 }
1420 }
1421
1422 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1423
1424 struct IODispatchSource_IVars {
1425 queue_chain_t link;
1426 IODispatchSource * source;
1427 IOUserServer * server;
1428 IODispatchQueue_IVars * queue;
1429 bool enabled;
1430 };
1431
1432 bool
init()1433 IODispatchSource::init()
1434 {
1435 if (!super::init()) {
1436 return false;
1437 }
1438
1439 ivars = IOMallocType(IODispatchSource_IVars);
1440
1441 ivars->source = this;
1442
1443 return true;
1444 }
1445
1446 void
free()1447 IODispatchSource::free()
1448 {
1449 IOFreeType(ivars, IODispatchSource_IVars);
1450 super::free();
1451 }
1452
1453 kern_return_t
SetEnable_Impl(bool enable)1454 IODispatchSource::SetEnable_Impl(
1455 bool enable)
1456 {
1457 return SetEnableWithCompletion(enable, NULL);
1458 }
1459
1460 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1461
1462 struct IOInterruptDispatchSource_IVars {
1463 IOService * provider;
1464 uint32_t intIndex;
1465 uint32_t flags;
1466 int interruptType;
1467 IOSimpleLock * lock;
1468 thread_t waiter;
1469 uint64_t count;
1470 uint64_t time;
1471 OSAction * action;
1472 bool enable;
1473 bool canceled;
1474 };
1475
1476 static void
IOInterruptDispatchSourceInterrupt(OSObject * target,void * refCon,IOService * nub,int source)1477 IOInterruptDispatchSourceInterrupt(OSObject * target, void * refCon,
1478 IOService * nub, int source )
1479 {
1480 IOInterruptDispatchSource_IVars * ivars = (typeof(ivars))refCon;
1481 IOInterruptState is;
1482
1483 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1484 ivars->count++;
1485 ivars->time = (kIOInterruptSourceContinuousTime & ivars->flags)
1486 ? mach_continuous_time() : mach_absolute_time();
1487 if (ivars->waiter) {
1488 thread_wakeup_thread((event_t) ivars, ivars->waiter);
1489 ivars->waiter = NULL;
1490 }
1491 if (kIOInterruptTypeLevel & ivars->interruptType) {
1492 ivars->provider->disableInterrupt(ivars->intIndex);
1493 }
1494 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1495 }
1496
1497 kern_return_t
Create_Impl(IOService * provider,uint32_t indexAndFlags,IODispatchQueue * queue,IOInterruptDispatchSource ** source)1498 IOInterruptDispatchSource::Create_Impl(
1499 IOService * provider,
1500 uint32_t indexAndFlags,
1501 IODispatchQueue * queue,
1502 IOInterruptDispatchSource ** source)
1503 {
1504 IOReturn ret;
1505 IOInterruptDispatchSource * inst;
1506 uint32_t index;
1507 uint32_t flags;
1508
1509 index = indexAndFlags & kIOInterruptSourceIndexMask;
1510 flags = indexAndFlags & ~kIOInterruptSourceIndexMask;
1511
1512 inst = OSTypeAlloc(IOInterruptDispatchSource);
1513 if (!inst->init()) {
1514 inst->free();
1515 return kIOReturnNoMemory;
1516 }
1517
1518 inst->ivars->lock = IOSimpleLockAlloc();
1519
1520 ret = provider->getInterruptType(index, &inst->ivars->interruptType);
1521 if (kIOReturnSuccess != ret) {
1522 OSSafeReleaseNULL(inst);
1523 return ret;
1524 }
1525 ret = provider->registerInterrupt(index, inst, IOInterruptDispatchSourceInterrupt, inst->ivars);
1526 if (kIOReturnSuccess == ret) {
1527 inst->ivars->intIndex = index;
1528 inst->ivars->flags = flags;
1529 inst->ivars->provider = provider;
1530 inst->ivars->provider->retain();
1531 *source = inst;
1532 }
1533 return ret;
1534 }
1535
1536 kern_return_t
GetInterruptType_Impl(IOService * provider,uint32_t index,uint64_t * interruptType)1537 IOInterruptDispatchSource::GetInterruptType_Impl(
1538 IOService * provider,
1539 uint32_t index,
1540 uint64_t * interruptType)
1541 {
1542 IOReturn ret;
1543 int type;
1544
1545 *interruptType = 0;
1546 ret = provider->getInterruptType(index, &type);
1547 if (kIOReturnSuccess == ret) {
1548 *interruptType = type;
1549 }
1550
1551 return ret;
1552 }
1553
1554 bool
init()1555 IOInterruptDispatchSource::init()
1556 {
1557 if (!super::init()) {
1558 return false;
1559 }
1560 ivars = IOMallocType(IOInterruptDispatchSource_IVars);
1561
1562 return true;
1563 }
1564
1565 void
free()1566 IOInterruptDispatchSource::free()
1567 {
1568 IOReturn ret;
1569
1570 if (ivars && ivars->provider) {
1571 ret = ivars->provider->unregisterInterrupt(ivars->intIndex);
1572 assert(kIOReturnSuccess == ret);
1573 ivars->provider->release();
1574 }
1575
1576 if (ivars && ivars->lock) {
1577 IOSimpleLockFree(ivars->lock);
1578 }
1579
1580 IOFreeType(ivars, IOInterruptDispatchSource_IVars);
1581
1582 super::free();
1583 }
1584
1585 kern_return_t
SetHandler_Impl(OSAction * action)1586 IOInterruptDispatchSource::SetHandler_Impl(
1587 OSAction * action)
1588 {
1589 IOReturn ret;
1590 OSAction * oldAction;
1591
1592 oldAction = (typeof(oldAction))ivars->action;
1593 if (oldAction && OSCompareAndSwapPtr(oldAction, NULL, &ivars->action)) {
1594 oldAction->release();
1595 }
1596 action->retain();
1597 ivars->action = action;
1598
1599 ret = kIOReturnSuccess;
1600
1601 return ret;
1602 }
1603
1604 kern_return_t
SetEnableWithCompletion_Impl(bool enable,IODispatchSourceCancelHandler handler)1605 IOInterruptDispatchSource::SetEnableWithCompletion_Impl(
1606 bool enable,
1607 IODispatchSourceCancelHandler handler)
1608 {
1609 IOReturn ret;
1610 IOInterruptState is;
1611
1612 if (enable == ivars->enable) {
1613 return kIOReturnSuccess;
1614 }
1615
1616 if (enable) {
1617 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1618 ivars->enable = enable;
1619 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1620 ret = ivars->provider->enableInterrupt(ivars->intIndex);
1621 } else {
1622 ret = ivars->provider->disableInterrupt(ivars->intIndex);
1623 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1624 ivars->enable = enable;
1625 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1626 }
1627
1628 return ret;
1629 }
1630
1631 kern_return_t
Cancel_Impl(IODispatchSourceCancelHandler handler)1632 IOInterruptDispatchSource::Cancel_Impl(
1633 IODispatchSourceCancelHandler handler)
1634 {
1635 IOInterruptState is;
1636
1637 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1638 ivars->canceled = true;
1639 if (ivars->waiter) {
1640 thread_wakeup_thread((event_t) ivars, ivars->waiter);
1641 ivars->waiter = NULL;
1642 }
1643 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1644
1645 return kIOReturnSuccess;
1646 }
1647
1648 kern_return_t
CheckForWork_Impl(const IORPC rpc,bool synchronous)1649 IOInterruptDispatchSource::CheckForWork_Impl(
1650 const IORPC rpc,
1651 bool synchronous)
1652 {
1653 IOReturn ret = kIOReturnNotReady;
1654 IOInterruptState is;
1655 bool willWait;
1656 bool canceled;
1657 wait_result_t waitResult;
1658 uint64_t icount;
1659 uint64_t itime;
1660 thread_t self;
1661
1662 self = current_thread();
1663 icount = 0;
1664 do {
1665 willWait = false;
1666 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1667 canceled = ivars->canceled;
1668 if (!canceled) {
1669 if ((icount = ivars->count)) {
1670 itime = ivars->time;
1671 ivars->count = 0;
1672 waitResult = THREAD_AWAKENED;
1673 } else if (synchronous) {
1674 assert(NULL == ivars->waiter);
1675 ivars->waiter = self;
1676 waitResult = assert_wait((event_t) ivars, THREAD_INTERRUPTIBLE);
1677 }
1678 willWait = (synchronous && (waitResult == THREAD_WAITING));
1679 if (willWait && (kIOInterruptTypeLevel & ivars->interruptType) && ivars->enable) {
1680 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1681 ivars->provider->enableInterrupt(ivars->intIndex);
1682 } else {
1683 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1684 }
1685 } else {
1686 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1687 }
1688 if (willWait) {
1689 waitResult = thread_block(THREAD_CONTINUE_NULL);
1690 if (THREAD_INTERRUPTED == waitResult) {
1691 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1692 ivars->waiter = NULL;
1693 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1694 canceled = true;
1695 break;
1696 }
1697 }
1698 } while (synchronous && !icount && !canceled);
1699
1700 if (icount && ivars->action) {
1701 ret = InterruptOccurred(rpc, ivars->action, icount, itime);
1702 }
1703
1704 return ret;
1705 }
1706
1707 void
InterruptOccurred_Impl(OSAction * action,uint64_t count,uint64_t time)1708 IOInterruptDispatchSource::InterruptOccurred_Impl(
1709 OSAction * action,
1710 uint64_t count,
1711 uint64_t time)
1712 {
1713 }
1714
1715 kern_return_t
GetLastInterrupt_Impl(uint64_t * pCount,uint64_t * pTime)1716 IOInterruptDispatchSource::GetLastInterrupt_Impl(
1717 uint64_t * pCount,
1718 uint64_t * pTime)
1719 {
1720 IOInterruptState is;
1721 uint64_t count, time;
1722
1723 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1724 count = ivars->count;
1725 time = ivars->time;
1726 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1727
1728 if (pCount) {
1729 *pCount = count;
1730 }
1731 if (pTime) {
1732 *pTime = time;
1733 }
1734 return kIOReturnSuccess;
1735 }
1736
1737 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1738
1739 enum {
1740 kIOServiceNotificationTypeCount = kIOServiceNotificationTypeLast + 1,
1741 };
1742
1743 struct IOServiceNotificationDispatchSource_IVars {
1744 OSObject * serverName;
1745 OSAction * action;
1746 IOLock * lock;
1747 IONotifier * notifier;
1748 OSDictionary * interestNotifiers;
1749 OSBoundedArray<OSArray *, kIOServiceNotificationTypeCount> pending;
1750 bool enable;
1751 };
1752
1753 kern_return_t
Create_Impl(OSDictionary * matching,uint64_t options,IODispatchQueue * queue,IOServiceNotificationDispatchSource ** notification)1754 IOServiceNotificationDispatchSource::Create_Impl(
1755 OSDictionary * matching,
1756 uint64_t options,
1757 IODispatchQueue * queue,
1758 IOServiceNotificationDispatchSource ** notification)
1759 {
1760 IOUserServer * us;
1761 IOReturn ret;
1762 IOServiceNotificationDispatchSource * inst;
1763
1764 inst = OSTypeAlloc(IOServiceNotificationDispatchSource);
1765 if (!inst->init()) {
1766 OSSafeReleaseNULL(inst);
1767 return kIOReturnNoMemory;
1768 }
1769
1770 us = (typeof(us))thread_iokit_tls_get(0);
1771 assert(OSDynamicCast(IOUserServer, us));
1772 if (!us) {
1773 OSSafeReleaseNULL(inst);
1774 return kIOReturnError;
1775 }
1776 inst->ivars->serverName = us->copyProperty(gIOUserServerNameKey);
1777 if (!inst->ivars->serverName) {
1778 OSSafeReleaseNULL(inst);
1779 return kIOReturnNoMemory;
1780 }
1781
1782 inst->ivars->lock = IOLockAlloc();
1783 if (!inst->ivars->lock) {
1784 OSSafeReleaseNULL(inst);
1785 return kIOReturnNoMemory;
1786 }
1787 for (uint32_t idx = 0; idx < kIOServiceNotificationTypeCount; idx++) {
1788 inst->ivars->pending[idx] = OSArray::withCapacity(4);
1789 if (!inst->ivars->pending[idx]) {
1790 OSSafeReleaseNULL(inst);
1791 return kIOReturnNoMemory;
1792 }
1793 }
1794 inst->ivars->interestNotifiers = OSDictionary::withCapacity(4);
1795 if (!inst->ivars->interestNotifiers) {
1796 OSSafeReleaseNULL(inst);
1797 return kIOReturnNoMemory;
1798 }
1799
1800 inst->ivars->notifier = IOService::addMatchingNotification(gIOMatchedNotification, matching, 0 /*priority*/,
1801 ^bool (IOService * newService, IONotifier * notifier) {
1802 bool notifyReady = false;
1803 IONotifier * interest;
1804 OSObject * serverName;
1805 bool okToUse;
1806
1807 serverName = newService->copyProperty(gIOUserServerNameKey);
1808 okToUse = (serverName && inst->ivars->serverName->isEqualTo(serverName));
1809 OSSafeReleaseNULL(serverName);
1810 if (!okToUse) {
1811 OSObject * prop;
1812 OSObject * str;
1813
1814 if (!newService->reserved->uvars || !newService->reserved->uvars->userServer) {
1815 return false;
1816 }
1817 str = OSString::withCStringNoCopy(kIODriverKitAllowsPublishEntitlementsKey);
1818 if (!str) {
1819 return false;
1820 }
1821 okToUse = newService->reserved->uvars->userServer->checkEntitlements(str, NULL, NULL);
1822 if (!okToUse) {
1823 DKLOG(DKS ": publisher entitlements check failed\n", DKN(newService));
1824 return false;
1825 }
1826 prop = newService->copyProperty(kIODriverKitPublishEntitlementsKey);
1827 if (!prop) {
1828 return false;
1829 }
1830 okToUse = us->checkEntitlements(prop, NULL, NULL);
1831 if (!okToUse) {
1832 DKLOG(DKS ": subscriber entitlements check failed\n", DKN(newService));
1833 return false;
1834 }
1835 }
1836
1837 IOLockLock(inst->ivars->lock);
1838 notifyReady = (0 == inst->ivars->pending[kIOServiceNotificationTypeMatched]->getCount());
1839 inst->ivars->pending[kIOServiceNotificationTypeMatched]->setObject(newService);
1840 IOLockUnlock(inst->ivars->lock);
1841
1842 interest = newService->registerInterest(gIOGeneralInterest,
1843 ^IOReturn (uint32_t messageType, IOService * provider,
1844 void * messageArgument, size_t argSize) {
1845 IONotifier * interest;
1846 bool notifyReady = false;
1847
1848 switch (messageType) {
1849 case kIOMessageServiceIsTerminated:
1850 IOLockLock(inst->ivars->lock);
1851 notifyReady = (0 == inst->ivars->pending[kIOServiceNotificationTypeTerminated]->getCount());
1852 inst->ivars->pending[kIOServiceNotificationTypeTerminated]->setObject(provider);
1853 if (inst->ivars->interestNotifiers != NULL) {
1854 interest = (typeof(interest))inst->ivars->interestNotifiers->getObject((const OSSymbol *) newService);
1855 assert(interest);
1856 interest->remove();
1857 inst->ivars->interestNotifiers->removeObject((const OSSymbol *) newService);
1858 }
1859 IOLockUnlock(inst->ivars->lock);
1860 break;
1861 default:
1862 break;
1863 }
1864 if (notifyReady && inst->ivars->action) {
1865 inst->ServiceNotificationReady(inst->ivars->action);
1866 }
1867 return kIOReturnSuccess;
1868 });
1869 if (interest) {
1870 IOLockLock(inst->ivars->lock);
1871 inst->ivars->interestNotifiers->setObject((const OSSymbol *) newService, interest);
1872 IOLockUnlock(inst->ivars->lock);
1873 }
1874 if (notifyReady) {
1875 if (inst->ivars->action) {
1876 inst->ServiceNotificationReady(inst->ivars->action);
1877 }
1878 }
1879 return false;
1880 });
1881
1882 if (!inst->ivars->notifier) {
1883 OSSafeReleaseNULL(inst);
1884 ret = kIOReturnError;
1885 }
1886
1887 *notification = inst;
1888 ret = kIOReturnSuccess;
1889
1890 return ret;
1891 }
1892
1893 kern_return_t
CopyNextNotification_Impl(uint64_t * type,IOService ** service,uint64_t * options)1894 IOServiceNotificationDispatchSource::CopyNextNotification_Impl(
1895 uint64_t * type,
1896 IOService ** service,
1897 uint64_t * options)
1898 {
1899 IOService * next;
1900 uint32_t idx;
1901
1902 IOLockLock(ivars->lock);
1903 for (idx = 0; idx < kIOServiceNotificationTypeCount; idx++) {
1904 next = (IOService *) ivars->pending[idx]->getObject(0);
1905 if (next) {
1906 next->retain();
1907 ivars->pending[idx]->removeObject(0);
1908 break;
1909 }
1910 }
1911 IOLockUnlock(ivars->lock);
1912
1913 if (idx == kIOServiceNotificationTypeCount) {
1914 idx = kIOServiceNotificationTypeNone;
1915 }
1916 *type = idx;
1917 *service = next;
1918 *options = 0;
1919
1920 return kIOReturnSuccess;
1921 }
1922
1923 bool
init()1924 IOServiceNotificationDispatchSource::init()
1925 {
1926 if (!super::init()) {
1927 return false;
1928 }
1929 ivars = IOMallocType(IOServiceNotificationDispatchSource_IVars);
1930
1931 return true;
1932 }
1933
1934 void
free()1935 IOServiceNotificationDispatchSource::free()
1936 {
1937 if (ivars) {
1938 if (ivars->notifier) {
1939 ivars->notifier->remove();
1940 ivars->notifier = NULL;
1941 }
1942 if (ivars->interestNotifiers) {
1943 OSDictionary * savedInterestNotifiers = NULL;
1944
1945 // the lock is always initialized first, so it should exist
1946 assert(ivars->lock);
1947
1948 // Prevent additional changes to interestNotifiers
1949 IOLockLock(ivars->lock);
1950 savedInterestNotifiers = ivars->interestNotifiers;
1951 ivars->interestNotifiers = NULL;
1952 IOLockUnlock(ivars->lock);
1953
1954 // Remove all interest notifiers
1955 savedInterestNotifiers->iterateObjects(^bool (const OSSymbol * key, OSObject * object) {
1956 IONotifier * interest = (typeof(interest))object;
1957 interest->remove();
1958 return false;
1959 });
1960 OSSafeReleaseNULL(savedInterestNotifiers);
1961 }
1962 for (uint32_t idx = 0; idx < kIOServiceNotificationTypeCount; idx++) {
1963 OSSafeReleaseNULL(ivars->pending[idx]);
1964 }
1965 if (ivars->lock) {
1966 IOLockFree(ivars->lock);
1967 ivars->lock = NULL;
1968 }
1969 OSSafeReleaseNULL(ivars->serverName);
1970 IOFreeType(ivars, IOServiceNotificationDispatchSource_IVars);
1971 }
1972
1973 super::free();
1974 }
1975
1976 kern_return_t
SetHandler_Impl(OSAction * action)1977 IOServiceNotificationDispatchSource::SetHandler_Impl(
1978 OSAction * action)
1979 {
1980 IOReturn ret;
1981 bool notifyReady;
1982
1983 notifyReady = false;
1984
1985 IOLockLock(ivars->lock);
1986 OSSafeReleaseNULL(ivars->action);
1987 action->retain();
1988 ivars->action = action;
1989 if (action) {
1990 for (uint32_t idx = 0; idx < kIOServiceNotificationTypeCount; idx++) {
1991 notifyReady = (ivars->pending[idx]->getCount());
1992 if (notifyReady) {
1993 break;
1994 }
1995 }
1996 }
1997 IOLockUnlock(ivars->lock);
1998
1999 if (notifyReady) {
2000 ServiceNotificationReady(action);
2001 }
2002 ret = kIOReturnSuccess;
2003
2004 return ret;
2005 }
2006
2007 kern_return_t
SetEnableWithCompletion_Impl(bool enable,IODispatchSourceCancelHandler handler)2008 IOServiceNotificationDispatchSource::SetEnableWithCompletion_Impl(
2009 bool enable,
2010 IODispatchSourceCancelHandler handler)
2011 {
2012 if (enable == ivars->enable) {
2013 return kIOReturnSuccess;
2014 }
2015
2016 IOLockLock(ivars->lock);
2017 ivars->enable = enable;
2018 IOLockUnlock(ivars->lock);
2019
2020 return kIOReturnSuccess;
2021 }
2022
2023 kern_return_t
Cancel_Impl(IODispatchSourceCancelHandler handler)2024 IOServiceNotificationDispatchSource::Cancel_Impl(
2025 IODispatchSourceCancelHandler handler)
2026 {
2027 return kIOReturnUnsupported;
2028 }
2029
2030 kern_return_t
CheckForWork_Impl(const IORPC rpc,bool synchronous)2031 IOServiceNotificationDispatchSource::CheckForWork_Impl(
2032 const IORPC rpc,
2033 bool synchronous)
2034 {
2035 return kIOReturnNotReady;
2036 }
2037
2038 kern_return_t
DeliverNotifications(IOServiceNotificationBlock block)2039 IOServiceNotificationDispatchSource::DeliverNotifications(IOServiceNotificationBlock block)
2040 {
2041 return kIOReturnUnsupported;
2042 }
2043
2044
2045 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2046
2047 OSDictionary *
CreatePropertyMatchingDictionary(const char * key,OSObjectPtr value,OSDictionary * matching)2048 IOService::CreatePropertyMatchingDictionary(const char * key, OSObjectPtr value, OSDictionary * matching)
2049 {
2050 OSDictionary * result;
2051 const OSSymbol * keySym;
2052
2053 keySym = OSSymbol::withCString(key);
2054 result = propertyMatching(keySym, (const OSObject *) value, matching);
2055 OSSafeReleaseNULL(keySym);
2056
2057 return result;
2058 }
2059
2060 OSDictionary *
CreatePropertyMatchingDictionary(const char * key,const char * stringValue,OSDictionary * matching)2061 IOService::CreatePropertyMatchingDictionary(const char * key, const char * stringValue, OSDictionary * matching)
2062 {
2063 OSDictionary * result;
2064 OSString * value;
2065
2066 value = OSString::withCString(stringValue);
2067 result = CreatePropertyMatchingDictionary(key, value, matching);
2068 OSSafeReleaseNULL(value);
2069
2070 return result;
2071 }
2072
2073 OSDictionary *
CreateKernelClassMatchingDictionary(OSString * className,OSDictionary * matching)2074 IOService::CreateKernelClassMatchingDictionary(OSString * className, OSDictionary * matching)
2075 {
2076 if (!className) {
2077 return NULL;
2078 }
2079 if (!matching) {
2080 matching = OSDictionary::withCapacity(2);
2081 if (!matching) {
2082 return NULL;
2083 }
2084 }
2085 matching->setObject(kIOProviderClassKey, className);
2086
2087 return matching;
2088 }
2089
2090 OSDictionary *
CreateKernelClassMatchingDictionary(const char * className,OSDictionary * matching)2091 IOService::CreateKernelClassMatchingDictionary(const char * className, OSDictionary * matching)
2092 {
2093 OSDictionary * result;
2094 OSString * string;
2095
2096 string = OSString::withCString(className);
2097 result = CreateKernelClassMatchingDictionary(string, matching);
2098 OSSafeReleaseNULL(string);
2099
2100 return result;
2101 }
2102
2103 OSDictionary *
CreateUserClassMatchingDictionary(OSString * className,OSDictionary * matching)2104 IOService::CreateUserClassMatchingDictionary(OSString * className, OSDictionary * matching)
2105 {
2106 return CreatePropertyMatchingDictionary(kIOUserClassKey, className, matching);
2107 }
2108
2109 OSDictionary *
CreateUserClassMatchingDictionary(const char * className,OSDictionary * matching)2110 IOService::CreateUserClassMatchingDictionary(const char * className, OSDictionary * matching)
2111 {
2112 return CreatePropertyMatchingDictionary(kIOUserClassKey, className, matching);
2113 }
2114
2115 OSDictionary *
CreateNameMatchingDictionary(OSString * serviceName,OSDictionary * matching)2116 IOService::CreateNameMatchingDictionary(OSString * serviceName, OSDictionary * matching)
2117 {
2118 if (!serviceName) {
2119 return NULL;
2120 }
2121 if (!matching) {
2122 matching = OSDictionary::withCapacity(2);
2123 if (!matching) {
2124 return NULL;
2125 }
2126 }
2127 matching->setObject(kIONameMatchKey, serviceName);
2128
2129 return matching;
2130 }
2131
2132 OSDictionary *
CreateNameMatchingDictionary(const char * serviceName,OSDictionary * matching)2133 IOService::CreateNameMatchingDictionary(const char * serviceName, OSDictionary * matching)
2134 {
2135 OSDictionary * result;
2136 OSString * string;
2137
2138 string = OSString::withCString(serviceName);
2139 result = CreateNameMatchingDictionary(string, matching);
2140 OSSafeReleaseNULL(string);
2141
2142 return result;
2143 }
2144
2145
2146
2147 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2148
2149 kern_return_t
waitInterruptTrap(void * p1,void * p2,void * p3,void * p4,void * p5,void * p6)2150 IOUserServer::waitInterruptTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6)
2151 {
2152 IOReturn ret = kIOReturnBadArgument;
2153 IOInterruptState is;
2154 IOInterruptDispatchSource * interrupt;
2155 IOInterruptDispatchSource_IVars * ivars;
2156 IOInterruptDispatchSourcePayload payload;
2157
2158 bool willWait;
2159 bool canceled;
2160 wait_result_t waitResult;
2161 thread_t self;
2162
2163 OSObject * object;
2164
2165 object = iokit_lookup_object_with_port_name((mach_port_name_t)(uintptr_t)p1, IKOT_UEXT_OBJECT, current_task());
2166
2167 if (!object) {
2168 return kIOReturnBadArgument;
2169 }
2170 if (!(interrupt = OSDynamicCast(IOInterruptDispatchSource, object))) {
2171 ret = kIOReturnBadArgument;
2172 } else {
2173 self = current_thread();
2174 ivars = interrupt->ivars;
2175 payload.count = 0;
2176 do {
2177 willWait = false;
2178 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
2179 canceled = ivars->canceled;
2180 if (!canceled) {
2181 if ((payload.count = ivars->count)) {
2182 payload.time = ivars->time;
2183 ivars->count = 0;
2184 waitResult = THREAD_AWAKENED;
2185 } else {
2186 assert(NULL == ivars->waiter);
2187 ivars->waiter = self;
2188 waitResult = assert_wait((event_t) ivars, THREAD_INTERRUPTIBLE);
2189 }
2190 willWait = (waitResult == THREAD_WAITING);
2191 if (willWait && (kIOInterruptTypeLevel & ivars->interruptType) && ivars->enable) {
2192 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
2193 ivars->provider->enableInterrupt(ivars->intIndex);
2194 } else {
2195 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
2196 }
2197 } else {
2198 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
2199 }
2200 if (willWait) {
2201 waitResult = thread_block(THREAD_CONTINUE_NULL);
2202 if (THREAD_INTERRUPTED == waitResult) {
2203 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
2204 ivars->waiter = NULL;
2205 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
2206 canceled = true;
2207 break;
2208 }
2209 }
2210 } while (!payload.count && !canceled);
2211 ret = (payload.count ? kIOReturnSuccess : kIOReturnAborted);
2212 }
2213
2214 if (kIOReturnSuccess == ret) {
2215 int copyerr = copyout(&payload, (user_addr_t) p2, sizeof(payload));
2216 if (copyerr) {
2217 ret = kIOReturnVMError;
2218 }
2219 }
2220
2221 object->release();
2222
2223 return ret;
2224 }
2225
2226 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2227
2228 kern_return_t
Create_Impl(const char * name,uint64_t tag,uint64_t options,OSString * bundleID,IOUserServer ** server)2229 IOUserServer::Create_Impl(
2230 const char * name,
2231 uint64_t tag,
2232 uint64_t options,
2233 OSString * bundleID,
2234 IOUserServer ** server)
2235 {
2236 IOReturn ret;
2237 IOUserServer * us;
2238 const OSSymbol * sym;
2239 OSNumber * serverTag;
2240 io_name_t rname;
2241 OSKext * kext;
2242
2243 us = (typeof(us))thread_iokit_tls_get(0);
2244 assert(OSDynamicCast(IOUserServer, us));
2245 if (kIODKLogSetup & gIODKDebug) {
2246 DKLOG(DKS "::Create(" DKS ") %p\n", DKN(us), name, tag, us);
2247 }
2248 if (!us) {
2249 return kIOReturnError;
2250 }
2251
2252 if (bundleID) {
2253 kext = OSKext::lookupKextWithIdentifier(bundleID->getCStringNoCopy());
2254 if (kext) {
2255 us->setTaskLoadTag(kext);
2256 us->setDriverKitUUID(kext);
2257 us->setDriverKitStatistics(kext);
2258 OSKext::OSKextLogDriverKitInfoLoad(kext);
2259 OSSafeReleaseNULL(kext);
2260 } else {
2261 DKLOG(DKS "::Create(" DKS "): could not find OSKext for %s\n", DKN(us), name, tag, bundleID->getCStringNoCopy());
2262 }
2263
2264 us->fAllocationName = kern_allocation_name_allocate(bundleID->getCStringNoCopy(), 0);
2265 assert(us->fAllocationName);
2266 }
2267
2268 sym = OSSymbol::withCString(name);
2269 serverTag = OSNumber::withNumber(tag, 64);
2270
2271 us->setProperty(gIOUserServerNameKey, (OSObject *) sym);
2272 us->setProperty(gIOUserServerTagKey, serverTag);
2273
2274 serverTag->release();
2275 OSSafeReleaseNULL(sym);
2276
2277 snprintf(rname, sizeof(rname), "IOUserServer(%s-0x%qx)", name, tag);
2278 us->setName(rname);
2279
2280 us->retain();
2281 *server = us;
2282 ret = kIOReturnSuccess;
2283
2284 return ret;
2285 }
2286
2287 kern_return_t
RegisterService_Impl()2288 IOUserServer::RegisterService_Impl()
2289 {
2290 kern_return_t ret = IOService::RegisterService_Impl();
2291
2292 return ret;
2293 }
2294
2295 kern_return_t
Exit_Impl(const char * reason)2296 IOUserServer::Exit_Impl(
2297 const char * reason)
2298 {
2299 return kIOReturnUnsupported;
2300 }
2301
2302 kern_return_t
LoadModule_Impl(const char * path)2303 IOUserServer::LoadModule_Impl(
2304 const char * path)
2305 {
2306 return kIOReturnUnsupported;
2307 }
2308
2309
2310 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2311
2312 kern_return_t
Create_Impl(const char * name,uint64_t options,uint64_t priority,IODispatchQueue ** queue)2313 IODispatchQueue::Create_Impl(
2314 const char * name,
2315 uint64_t options,
2316 uint64_t priority,
2317 IODispatchQueue ** queue)
2318 {
2319 IODispatchQueue * result;
2320 IOUserServer * us;
2321
2322 result = OSTypeAlloc(IODispatchQueue);
2323 if (!result) {
2324 return kIOReturnNoMemory;
2325 }
2326 if (!result->init()) {
2327 OSSafeReleaseNULL(result);
2328 return kIOReturnNoMemory;
2329 }
2330
2331 *queue = result;
2332
2333 if (!strcmp("Root", name)) {
2334 us = (typeof(us))thread_iokit_tls_get(0);
2335 assert(OSDynamicCast(IOUserServer, us));
2336 us->setRootQueue(result);
2337 }
2338
2339 if (kIODKLogSetup & gIODKDebug) {
2340 DKLOG("IODispatchQueue::Create %s %p\n", name, result);
2341 }
2342
2343 return kIOReturnSuccess;
2344 }
2345
2346 kern_return_t
SetPort_Impl(mach_port_t port)2347 IODispatchQueue::SetPort_Impl(
2348 mach_port_t port)
2349 {
2350 if (MACH_PORT_NULL != ivars->serverPort) {
2351 return kIOReturnNotReady;
2352 }
2353
2354 ivars->serverPort = port;
2355 return kIOReturnSuccess;
2356 }
2357
2358 bool
init()2359 IODispatchQueue::init()
2360 {
2361 ivars = IOMallocType(IODispatchQueue_IVars);
2362 ivars->queue = this;
2363
2364 return true;
2365 }
2366
2367 void
free()2368 IODispatchQueue::free()
2369 {
2370 if (ivars && ivars->serverPort) {
2371 ipc_port_release_send(ivars->serverPort);
2372 ivars->serverPort = MACH_PORT_NULL;
2373 }
2374 IOFreeType(ivars, IODispatchQueue_IVars);
2375 super::free();
2376 }
2377
2378 bool
OnQueue()2379 IODispatchQueue::OnQueue()
2380 {
2381 return false;
2382 }
2383
2384 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2385
2386
2387 kern_return_t
Dispatch(IORPC rpc)2388 OSMetaClassBase::Dispatch(IORPC rpc)
2389 {
2390 return kIOReturnUnsupported;
2391 }
2392
2393 kern_return_t
Invoke(IORPC rpc)2394 OSMetaClassBase::Invoke(IORPC rpc)
2395 {
2396 IOReturn ret = kIOReturnUnsupported;
2397 OSMetaClassBase * object;
2398 OSAction * action;
2399 IOService * service;
2400 IOUserServer * us;
2401 IORPCMessage * message;
2402
2403 assert(rpc.sendSize >= (sizeof(IORPCMessageMach) + sizeof(IORPCMessage)));
2404 message = IORPCMessageFromMach(rpc.message, false);
2405 if (!message) {
2406 return kIOReturnIPCError;
2407 }
2408 message->flags |= kIORPCMessageKernel;
2409
2410 us = NULL;
2411 if (!(kIORPCMessageLocalHost & message->flags)) {
2412 us = OSDynamicCast(IOUserServer, this);
2413 if (!us) {
2414 IOEventLink * eventLink = NULL;
2415 IOWorkGroup * workgroup = NULL;
2416
2417 if ((action = OSDynamicCast(OSAction, this))) {
2418 object = IOUserServer::target(action, message);
2419 } else {
2420 object = this;
2421 }
2422 if ((service = OSDynamicCast(IOService, object))
2423 && service->reserved->uvars) {
2424 // xxx other classes
2425 us = service->reserved->uvars->userServer;
2426 } else if (action) {
2427 us = action->ivars->userServer;
2428 } else if ((eventLink = OSDynamicCast(IOEventLink, object))) {
2429 us = eventLink->ivars->userServer;
2430 } else if ((workgroup = OSDynamicCast(IOWorkGroup, object))) {
2431 us = workgroup->ivars->userServer;
2432 }
2433 }
2434 }
2435 if (us) {
2436 message->flags |= kIORPCMessageRemote;
2437 ret = us->rpc(rpc);
2438 if (kIOReturnSuccess != ret) {
2439 if (kIODKLogIPC & gIODKDebug) {
2440 DKLOG("OSMetaClassBase::Invoke user 0x%x\n", ret);
2441 }
2442 }
2443 } else {
2444 if (kIODKLogIPC & gIODKDebug) {
2445 DKLOG("OSMetaClassBase::Invoke kernel %s 0x%qx\n", getMetaClass()->getClassName(), message->msgid);
2446 }
2447 void * prior = thread_iokit_tls_get(0);
2448 thread_iokit_tls_set(0, NULL);
2449 ret = Dispatch(rpc);
2450 thread_iokit_tls_set(0, prior);
2451 }
2452
2453 return ret;
2454 }
2455
2456 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2457
2458 struct IOPStrings {
2459 uint32_t dataSize;
2460 uint32_t count;
2461 const char strings[0];
2462 };
2463
2464 kern_return_t
Dispatch(IORPC rpc)2465 OSUserMetaClass::Dispatch(IORPC rpc)
2466 {
2467 if (meta) {
2468 return const_cast<OSMetaClass *>(meta)->Dispatch(rpc);
2469 } else {
2470 return kIOReturnUnsupported;
2471 }
2472 }
2473
2474 void
free()2475 OSUserMetaClass::free()
2476 {
2477 if (queueNames) {
2478 IOFreeData(queueNames, sizeof(IOPStrings) + queueNames->dataSize * sizeof(char));
2479 queueNames = NULL;
2480 }
2481 if (description) {
2482 IOFreeData(description, description->descriptionSize);
2483 description = NULL;
2484 }
2485 IODeleteData(methods, uint64_t, 2 * methodCount);
2486 if (meta) {
2487 meta->releaseMetaClass();
2488 }
2489 if (name) {
2490 name->release();
2491 }
2492 OSObject::free();
2493 }
2494
2495 /*
2496 * Sets the loadTag of the associated OSKext
2497 * in the dext task.
2498 * NOTE: different instances of the same OSKext
2499 * (so same BounleID but different tasks)
2500 * will have the same loadTag.
2501 */
2502 void
setTaskLoadTag(OSKext * kext)2503 IOUserServer::setTaskLoadTag(OSKext *kext)
2504 {
2505 task_t owningTask;
2506 uint32_t loadTag, prev_taskloadTag;
2507
2508 owningTask = this->fOwningTask;
2509 if (!owningTask) {
2510 printf("%s: fOwningTask not found\n", __FUNCTION__);
2511 return;
2512 }
2513
2514 loadTag = kext->getLoadTag();
2515 prev_taskloadTag = set_task_loadTag(owningTask, loadTag);
2516 if (prev_taskloadTag) {
2517 printf("%s: found the task loadTag already set to %u (set to %u)\n",
2518 __FUNCTION__, prev_taskloadTag, loadTag);
2519 }
2520 }
2521
2522 /*
2523 * Sets the OSKext uuid as the uuid of the userspace
2524 * dext executable.
2525 */
2526 void
setDriverKitUUID(OSKext * kext)2527 IOUserServer::setDriverKitUUID(OSKext *kext)
2528 {
2529 task_t task;
2530 proc_t p;
2531 uuid_t p_uuid, k_uuid;
2532 OSData *k_data_uuid;
2533 OSData *new_uuid;
2534 uuid_string_t uuid_string = "";
2535
2536 task = this->fOwningTask;
2537 if (!task) {
2538 printf("%s: fOwningTask not found\n", __FUNCTION__);
2539 return;
2540 }
2541
2542 p = (proc_t)(get_bsdtask_info(task));
2543 if (!p) {
2544 printf("%s: proc not found\n", __FUNCTION__);
2545 return;
2546 }
2547 proc_getexecutableuuid(p, p_uuid, sizeof(p_uuid));
2548
2549 k_data_uuid = kext->copyUUID();
2550 if (k_data_uuid) {
2551 memcpy(&k_uuid, k_data_uuid->getBytesNoCopy(), sizeof(k_uuid));
2552 OSSafeReleaseNULL(k_data_uuid);
2553 if (uuid_compare(k_uuid, p_uuid) != 0) {
2554 printf("%s: uuid not matching\n", __FUNCTION__);
2555 }
2556 return;
2557 }
2558
2559 uuid_unparse(p_uuid, uuid_string);
2560 new_uuid = OSData::withValue(p_uuid);
2561 kext->setDriverKitUUID(new_uuid);
2562 }
2563
2564 void
setDriverKitStatistics(OSKext * kext)2565 IOUserServer::setDriverKitStatistics(OSKext *kext)
2566 {
2567 OSDextStatistics * statistics = kext->copyDextStatistics();
2568 if (statistics == NULL) {
2569 panic("Kext %s was not a DriverKit OSKext", kext->getIdentifierCString());
2570 }
2571 fStatistics = statistics;
2572 }
2573
2574 void
setCheckInToken(IOUserServerCheckInToken * token)2575 IOUserServer::setCheckInToken(IOUserServerCheckInToken *token)
2576 {
2577 if (token != NULL && fCheckInToken == NULL) {
2578 token->retain();
2579 fCheckInToken = token;
2580 iokit_clear_registered_ports(fOwningTask);
2581 } else {
2582 printf("%s: failed to set check in token. token=%p, fCheckInToken=%p\n", __FUNCTION__, token, fCheckInToken);
2583 }
2584 }
2585
2586 bool
serviceMatchesCheckInToken(IOUserServerCheckInToken * token)2587 IOUserServer::serviceMatchesCheckInToken(IOUserServerCheckInToken *token)
2588 {
2589 if (token != NULL) {
2590 bool result = token == fCheckInToken;
2591 if (result) {
2592 fCheckInToken->complete();
2593 }
2594 return result;
2595 } else {
2596 printf("%s: null check in token\n", __FUNCTION__);
2597 return false;
2598 }
2599 }
2600
2601 // entitlements - dict of entitlements to check
2602 // prop - string - if present return true
2603 // - array of strings - if any present return true
2604 // - array of arrays of strings - in each leaf array all must be present
2605 // - if any top level array succeeds return true
2606 // consumes one reference of prop
2607 bool
checkEntitlements(OSDictionary * entitlements,OSObject * prop,IOService * provider,IOService * dext)2608 IOUserServer::checkEntitlements(
2609 OSDictionary * entitlements, OSObject * prop,
2610 IOService * provider, IOService * dext)
2611 {
2612 OSDictionary * matching;
2613
2614 if (!prop) {
2615 return true;
2616 }
2617 if (!entitlements) {
2618 OSSafeReleaseNULL(prop);
2619 return false;
2620 }
2621
2622 matching = NULL;
2623 if (dext) {
2624 matching = dext->dictionaryWithProperties();
2625 if (!matching) {
2626 OSSafeReleaseNULL(prop);
2627 return false;
2628 }
2629 }
2630
2631 bool allPresent __block = false;
2632 prop->iterateObjects(^bool (OSObject * object) {
2633 allPresent = false;
2634 object->iterateObjects(^bool (OSObject * object) {
2635 OSString * string;
2636 OSObject * value;
2637 string = OSDynamicCast(OSString, object);
2638 value = entitlements->getObject(string);
2639 if (matching && value) {
2640 matching->setObject(string, value);
2641 }
2642 allPresent = (NULL != value);
2643 // early terminate if not found
2644 return !allPresent;
2645 });
2646 // early terminate if found
2647 return allPresent;
2648 });
2649
2650 if (allPresent && matching && provider) {
2651 allPresent = provider->matchPropertyTable(matching);
2652 }
2653
2654 OSSafeReleaseNULL(matching);
2655 OSSafeReleaseNULL(prop);
2656
2657 return allPresent;
2658 }
2659
2660 bool
checkEntitlements(OSObject * prop,IOService * provider,IOService * dext)2661 IOUserServer::checkEntitlements(OSObject * prop, IOService * provider, IOService * dext)
2662 {
2663 return checkEntitlements(fEntitlements, prop, provider, dext);
2664 }
2665
2666 bool
checkEntitlements(IOService * provider,IOService * dext)2667 IOUserServer::checkEntitlements(IOService * provider, IOService * dext)
2668 {
2669 OSObject * prop;
2670 bool ok;
2671
2672 if (!fOwningTask) {
2673 return false;
2674 }
2675
2676 prop = provider->copyProperty(gIOServiceDEXTEntitlementsKey);
2677 ok = checkEntitlements(fEntitlements, prop, provider, dext);
2678 if (!ok) {
2679 DKLOG(DKS ": provider entitlements check failed\n", DKN(dext));
2680 }
2681 if (ok) {
2682 prop = dext->copyProperty(gIOServiceDEXTEntitlementsKey);
2683 ok = checkEntitlements(fEntitlements, prop, NULL, NULL);
2684 if (!ok) {
2685 DKLOG(DKS ": family entitlements check failed\n", DKN(dext));
2686 }
2687 }
2688
2689 return ok;
2690 }
2691
2692 IOReturn
exit(const char * reason)2693 IOUserServer::exit(const char * reason)
2694 {
2695 DKLOG("%s::exit(%s)\n", getName(), reason);
2696 Exit(reason);
2697 return kIOReturnSuccess;
2698 }
2699
2700 IOReturn
kill(const char * reason)2701 IOUserServer::kill(const char * reason)
2702 {
2703 IOReturn ret = kIOReturnError;
2704 if (fOwningTask != NULL) {
2705 DKLOG("%s::kill(%s)\n", getName(), reason);
2706 task_bsdtask_kill(fOwningTask);
2707 ret = kIOReturnSuccess;
2708 }
2709 return ret;
2710 }
2711
2712 OSObjectUserVars *
varsForObject(OSObject * obj)2713 IOUserServer::varsForObject(OSObject * obj)
2714 {
2715 IOService * service;
2716
2717 if ((service = OSDynamicCast(IOService, obj))) {
2718 return service->reserved->uvars;
2719 }
2720
2721 return NULL;
2722 }
2723
2724 IOPStrings *
copyInStringArray(const char * string,uint32_t userSize)2725 IOUserServer::copyInStringArray(const char * string, uint32_t userSize)
2726 {
2727 IOPStrings * array;
2728 vm_size_t alloc;
2729 size_t len;
2730 const char * end;
2731 OSBoundedPtr<const char> cstr;
2732
2733 if (userSize <= 1) {
2734 return NULL;
2735 }
2736
2737 if (os_add_overflow(sizeof(IOPStrings), userSize, &alloc)) {
2738 assert(false);
2739 return NULL;
2740 }
2741 if (alloc > 16384) {
2742 assert(false);
2743 return NULL;
2744 }
2745 array = (typeof(array))IOMallocData(alloc);
2746 if (!array) {
2747 return NULL;
2748 }
2749 array->dataSize = userSize;
2750 bcopy(string, (void *) &array->strings[0], userSize);
2751
2752 array->count = 0;
2753 end = &array->strings[array->dataSize];
2754 cstr = OSBoundedPtr<const char>(&array->strings[0], &array->strings[0], end);
2755 while ((len = (unsigned char)cstr[0])) {
2756 cstr++;
2757 if ((cstr + len) >= end) {
2758 break;
2759 }
2760 cstr += len;
2761 array->count++;
2762 }
2763 if (len) {
2764 IOFreeData(array, alloc);
2765 array = NULL;
2766 }
2767
2768 return array;
2769 }
2770
2771 uint32_t
stringArrayIndex(IOPStrings * array,const char * look)2772 IOUserServer::stringArrayIndex(IOPStrings * array, const char * look)
2773 {
2774 uint32_t idx;
2775 size_t len, llen;
2776 OSBoundedPtr<const char> cstr;
2777 const char * end;
2778
2779 idx = 0;
2780 end = &array->strings[array->dataSize];
2781 cstr = OSBoundedPtr<const char>(&array->strings[0], &array->strings[0], end);
2782
2783 llen = strlen(look);
2784 while ((len = (unsigned char)cstr[0])) {
2785 cstr++;
2786 if ((cstr + len) >= end) {
2787 break;
2788 }
2789 if ((len == llen) && !strncmp(cstr.discard_bounds(), look, len)) {
2790 return idx;
2791 }
2792 cstr += len;
2793 idx++;
2794 }
2795
2796 return -1U;
2797 }
2798 #define kIODispatchQueueStopped ((IODispatchQueue *) -1L)
2799
2800 IODispatchQueue *
queueForObject(OSObject * obj,uint64_t msgid)2801 IOUserServer::queueForObject(OSObject * obj, uint64_t msgid)
2802 {
2803 IODispatchQueue * queue;
2804 OSObjectUserVars * uvars;
2805 uint64_t option;
2806
2807 uvars = varsForObject(obj);
2808 if (!uvars) {
2809 return NULL;
2810 }
2811 if (!uvars->queueArray) {
2812 if (uvars->stopped) {
2813 return kIODispatchQueueStopped;
2814 }
2815 return NULL;
2816 }
2817 queue = uvars->queueArray[0];
2818
2819 if (uvars->userMeta
2820 && uvars->userMeta->methods) {
2821 uint32_t idx, baseIdx;
2822 uint32_t lim;
2823 // bsearch
2824 for (baseIdx = 0, lim = uvars->userMeta->methodCount; lim; lim >>= 1) {
2825 idx = baseIdx + (lim >> 1);
2826 if (msgid == uvars->userMeta->methods[idx]) {
2827 option = uvars->userMeta->methods[uvars->userMeta->methodCount + idx];
2828 option &= 0xFF;
2829 if (option < uvars->userMeta->queueNames->count) {
2830 queue = uvars->queueArray[option + 1];
2831 }
2832 break;
2833 } else if (msgid > uvars->userMeta->methods[idx]) {
2834 // move right
2835 baseIdx += (lim >> 1) + 1;
2836 lim--;
2837 }
2838 // else move left
2839 }
2840 }
2841 return queue;
2842 }
2843
2844 IOReturn
objectInstantiate(OSObject * obj,IORPC rpc,IORPCMessage * message)2845 IOUserServer::objectInstantiate(OSObject * obj, IORPC rpc, IORPCMessage * message)
2846 {
2847 IOReturn ret;
2848 OSString * str;
2849 OSObject * prop;
2850 IOService * service;
2851
2852 OSAction * action;
2853 OSObject * target;
2854 uint32_t queueCount, queueAlloc;
2855 const char * resultClassName;
2856 uint64_t resultFlags;
2857
2858 mach_msg_size_t replySize;
2859 uint32_t methodCount;
2860 const uint64_t * methods;
2861 IODispatchQueue * queue;
2862 OSUserMetaClass * userMeta;
2863 OSObjectUserVars * uvars;
2864 uint32_t idx;
2865 ipc_port_t sendPort;
2866
2867 OSObject_Instantiate_Rpl_Content * reply;
2868 IODispatchQueue ** unboundedQueueArray = NULL;
2869 queueCount = 0;
2870 methodCount = 0;
2871 methods = NULL;
2872 str = NULL;
2873 prop = NULL;
2874 userMeta = NULL;
2875 resultClassName = NULL;
2876 resultFlags = 0;
2877 ret = kIOReturnUnsupportedMode;
2878
2879 service = OSDynamicCast(IOService, obj);
2880 action = OSDynamicCast(OSAction, obj);
2881 if (!service) {
2882 // xxx other classes hosted
2883 resultFlags |= kOSObjectRPCKernel;
2884 resultFlags |= kOSObjectRPCRemote;
2885 } else {
2886 if (service->isInactive()) {
2887 DKLOG(DKS "::instantiate inactive\n", DKN(service));
2888 return kIOReturnOffline;
2889 }
2890 prop = service->copyProperty(gIOUserClassKey);
2891 str = OSDynamicCast(OSString, prop);
2892 if (!service->reserved->uvars) {
2893 resultFlags |= kOSObjectRPCRemote;
2894 resultFlags |= kOSObjectRPCKernel;
2895 } else if (this != service->reserved->uvars->userServer) {
2896 // remote, use base class
2897 resultFlags |= kOSObjectRPCRemote;
2898 }
2899 if (service->reserved->uvars && service->reserved->uvars->userServer) {
2900 if (!str) {
2901 DKLOG("no IOUserClass defined for " DKS "\n", DKN(service));
2902 OSSafeReleaseNULL(prop);
2903 return kIOReturnError;
2904 }
2905 IOLockLock(service->reserved->uvars->userServer->fLock);
2906 userMeta = (typeof(userMeta))service->reserved->uvars->userServer->fClasses->getObject(str);
2907 IOLockUnlock(service->reserved->uvars->userServer->fLock);
2908 }
2909 }
2910 if (!str && !userMeta) {
2911 const OSMetaClass * meta;
2912 meta = obj->getMetaClass();
2913 IOLockLock(fLock);
2914 if (action) {
2915 str = action->ivars->typeName;
2916 if (str) {
2917 userMeta = (typeof(userMeta))fClasses->getObject(str);
2918 }
2919 }
2920 while (meta && !userMeta) {
2921 str = (OSString *) meta->getClassNameSymbol();
2922 userMeta = (typeof(userMeta))fClasses->getObject(str);
2923 if (!userMeta) {
2924 meta = meta->getSuperClass();
2925 }
2926 }
2927 IOLockUnlock(fLock);
2928 }
2929 if (str) {
2930 if (!userMeta) {
2931 IOLockLock(fLock);
2932 userMeta = (typeof(userMeta))fClasses->getObject(str);
2933 IOLockUnlock(fLock);
2934 }
2935 if (kIODKLogSetup & gIODKDebug) {
2936 DKLOG("userMeta %s %p\n", str->getCStringNoCopy(), userMeta);
2937 }
2938 if (userMeta) {
2939 if (kOSObjectRPCRemote & resultFlags) {
2940 if (!action) {
2941 /* Special case: For OSAction subclasses, do not use the superclass */
2942 while (userMeta && !(kOSClassCanRemote & userMeta->description->flags)) {
2943 userMeta = userMeta->superMeta;
2944 }
2945 }
2946 if (userMeta) {
2947 resultClassName = userMeta->description->name;
2948 ret = kIOReturnSuccess;
2949 }
2950 } else {
2951 service->reserved->uvars->userMeta = userMeta;
2952 queueAlloc = 1;
2953 if (userMeta->queueNames) {
2954 queueAlloc += userMeta->queueNames->count;
2955 }
2956 unboundedQueueArray = IONewZero(IODispatchQueue *, queueAlloc);
2957 service->reserved->uvars->queueArray =
2958 OSBoundedArrayRef<IODispatchQueue *>(unboundedQueueArray, queueAlloc);
2959 resultClassName = str->getCStringNoCopy();
2960 ret = kIOReturnSuccess;
2961 }
2962 } else if (kIODKLogSetup & gIODKDebug) {
2963 DKLOG("userMeta %s was not found in fClasses\n", str->getCStringNoCopy());
2964 IOLockLock(fLock);
2965 fClasses->iterateObjects(^bool (const OSSymbol * key, OSObject * val) {
2966 DKLOG(" fClasses[\"%s\"] => %p\n", key->getCStringNoCopy(), val);
2967 return false;
2968 });
2969 IOLockUnlock(fLock);
2970 }
2971 }
2972 OSSafeReleaseNULL(prop);
2973
2974 IORPCMessageMach * machReply = rpc.reply;
2975 replySize = sizeof(OSObject_Instantiate_Rpl);
2976
2977 if ((kIOReturnSuccess == ret) && (kOSObjectRPCRemote & resultFlags)) {
2978 target = obj;
2979 if (action) {
2980 if (action->ivars->referenceSize) {
2981 resultFlags |= kOSObjectRPCKernel;
2982 } else {
2983 resultFlags &= ~kOSObjectRPCKernel;
2984 if (action->ivars->target) {
2985 target = action->ivars->target;
2986 queueCount = 1;
2987 queue = queueForObject(target, action->ivars->targetmsgid);
2988 if (!queue && action->ivars->userServer) {
2989 queue = action->ivars->userServer->fRootQueue;
2990 }
2991 idx = 0;
2992 sendPort = NULL;
2993 if (queue && (kIODispatchQueueStopped != queue)) {
2994 sendPort = ipc_port_copy_send_mqueue(queue->ivars->serverPort);
2995 }
2996 replySize = sizeof(OSObject_Instantiate_Rpl)
2997 + queueCount * sizeof(machReply->objects[0])
2998 + 2 * methodCount * sizeof(reply->methods[0]);
2999 if (replySize > rpc.replySize) {
3000 assert(false);
3001 return kIOReturnIPCError;
3002 }
3003 machReply->objects[idx].type = MACH_MSG_PORT_DESCRIPTOR;
3004 machReply->objects[idx].disposition = MACH_MSG_TYPE_MOVE_SEND;
3005 machReply->objects[idx].name = sendPort;
3006 machReply->objects[idx].pad2 = 0;
3007 machReply->objects[idx].pad_end = 0;
3008 }
3009 }
3010 } else {
3011 uvars = varsForObject(target);
3012 if (uvars && uvars->userMeta) {
3013 queueCount = 1;
3014 if (uvars->userMeta->queueNames) {
3015 queueCount += uvars->userMeta->queueNames->count;
3016 }
3017 methods = &uvars->userMeta->methods[0];
3018 methodCount = uvars->userMeta->methodCount;
3019 replySize = sizeof(OSObject_Instantiate_Rpl)
3020 + queueCount * sizeof(machReply->objects[0])
3021 + 2 * methodCount * sizeof(reply->methods[0]);
3022 if (replySize > rpc.replySize) {
3023 assert(false);
3024 return kIOReturnIPCError;
3025 }
3026 for (idx = 0; idx < queueCount; idx++) {
3027 queue = uvars->queueArray[idx];
3028 sendPort = NULL;
3029 if (queue) {
3030 sendPort = ipc_port_copy_send_mqueue(queue->ivars->serverPort);
3031 }
3032 machReply->objects[idx].type = MACH_MSG_PORT_DESCRIPTOR;
3033 machReply->objects[idx].disposition = MACH_MSG_TYPE_MOVE_SEND;
3034 machReply->objects[idx].name = sendPort;
3035 machReply->objects[idx].pad2 = 0;
3036 machReply->objects[idx].pad_end = 0;
3037 }
3038 }
3039 }
3040 }
3041
3042 if (kIODKLogIPC & gIODKDebug) {
3043 DKLOG("instantiate object %s with user class %s\n", obj->getMetaClass()->getClassName(), str ? str->getCStringNoCopy() : "(null)");
3044 }
3045
3046 if (kIOReturnSuccess != ret) {
3047 DKLOG("%s: no user class found\n", str ? str->getCStringNoCopy() : obj->getMetaClass()->getClassName());
3048 resultClassName = "unknown";
3049 }
3050
3051 machReply->msgh.msgh_id = kIORPCVersionCurrentReply;
3052 machReply->msgh.msgh_size = replySize;
3053 machReply->msgh_body.msgh_descriptor_count = queueCount;
3054
3055 reply = (typeof(reply))IORPCMessageFromMach(machReply, true);
3056 if (!reply) {
3057 return kIOReturnIPCError;
3058 }
3059 if (methodCount) {
3060 bcopy(methods, &reply->methods[0], methodCount * 2 * sizeof(reply->methods[0]));
3061 }
3062 reply->__hdr.msgid = OSObject_Instantiate_ID;
3063 reply->__hdr.flags = kIORPCMessageOneway;
3064 reply->__hdr.objectRefs = 0;
3065 reply->__pad = 0;
3066 reply->flags = resultFlags;
3067 strlcpy(reply->classname, resultClassName, sizeof(reply->classname));
3068 reply->__result = ret;
3069
3070 ret = kIOReturnSuccess;
3071
3072 return ret;
3073 }
3074
3075 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3076
3077 IOReturn
kernelDispatch(OSObject * obj,IORPC rpc)3078 IOUserServer::kernelDispatch(OSObject * obj, IORPC rpc)
3079 {
3080 IOReturn ret;
3081 IORPCMessage * message;
3082
3083 message = IORPCMessageFromMach(rpc.message, false);
3084 if (!message) {
3085 return kIOReturnIPCError;
3086 }
3087
3088 if (OSObject_Instantiate_ID == message->msgid) {
3089 ret = objectInstantiate(obj, rpc, message);
3090 if (kIOReturnSuccess != ret) {
3091 DKLOG("%s: instantiate failed 0x%x\n", obj->getMetaClass()->getClassName(), ret);
3092 }
3093 } else {
3094 if (kIODKLogIPC & gIODKDebug) {
3095 DKLOG("%s::Dispatch kernel 0x%qx\n", obj->getMetaClass()->getClassName(), message->msgid);
3096 }
3097 ret = obj->Dispatch(rpc);
3098 if (kIODKLogIPC & gIODKDebug) {
3099 DKLOG("%s::Dispatch kernel 0x%qx result 0x%x\n", obj->getMetaClass()->getClassName(), message->msgid, ret);
3100 }
3101 }
3102
3103 return ret;
3104 }
3105
3106
3107 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3108
3109 OSObject *
target(OSAction * action,IORPCMessage * message)3110 IOUserServer::target(OSAction * action, IORPCMessage * message)
3111 {
3112 OSObject * object;
3113
3114 if (message->msgid != action->ivars->msgid) {
3115 return action;
3116 }
3117 object = action->ivars->target;
3118 if (!object) {
3119 return action;
3120 }
3121 message->msgid = action->ivars->targetmsgid;
3122 message->objects[0] = (OSObjectRef) object;
3123 if (kIORPCMessageRemote & message->flags) {
3124 object->retain();
3125 #ifndef __clang_analyzer__
3126 // Hide the release of 'action' from the clang static analyzer to suppress
3127 // an overrelease diagnostic. The analyzer doesn't have a way to express the
3128 // non-standard contract of this method, which is that it releases 'action' when
3129 // the message flags have kIORPCMessageRemote set.
3130 action->release();
3131 #endif
3132 }
3133 if (kIODKLogIPC & gIODKDebug) {
3134 DKLOG("TARGET %s msg 0x%qx from 0x%qx\n", object->getMetaClass()->getClassName(), message->msgid, action->ivars->msgid);
3135 }
3136
3137 return object;
3138 }
3139
3140 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3141
3142 kern_return_t
uext_server(ipc_port_t receiver,ipc_kmsg_t requestkmsg,ipc_kmsg_t * pReply)3143 uext_server(ipc_port_t receiver, ipc_kmsg_t requestkmsg, ipc_kmsg_t * pReply)
3144 {
3145 kern_return_t ret;
3146 OSObject * object;
3147 IOUserServer * server;
3148
3149 object = IOUserServer::copyObjectForSendRight(receiver, IKOT_UEXT_OBJECT);
3150 server = OSDynamicCast(IOUserServer, object);
3151 if (!server) {
3152 OSSafeReleaseNULL(object);
3153 return KERN_INVALID_NAME;
3154 }
3155 ret = server->server(requestkmsg, pReply);
3156 object->release();
3157
3158 return ret;
3159 }
3160
3161 /*
3162 * Chosen to hit kalloc zones (as opposed to the VM).
3163 * doesn't include the trailer size which ipc_kmsg_alloc() will add
3164 */
3165 #define MAX_UEXT_REPLY_SIZE 0x17c0
3166 static_assert(MAX_UEXT_REPLY_SIZE + MAX_TRAILER_SIZE <= KALLOC_SAFE_ALLOC_SIZE);
3167
3168 kern_return_t
server(ipc_kmsg_t requestkmsg,ipc_kmsg_t * pReply)3169 IOUserServer::server(ipc_kmsg_t requestkmsg, ipc_kmsg_t * pReply)
3170 {
3171 kern_return_t ret;
3172 mach_msg_size_t replyAlloc;
3173 ipc_kmsg_t replykmsg;
3174 IORPCMessageMach * msgin;
3175 IORPCMessage * message;
3176 IORPCMessageMach * msgout;
3177 IORPCMessage * reply;
3178 uint32_t replySize;
3179 OSObject * object;
3180 OSAction * action;
3181 bool oneway;
3182 uint64_t msgid;
3183
3184 msgin = (typeof(msgin))ikm_header(requestkmsg);
3185 replyAlloc = 0;
3186 msgout = NULL;
3187 replykmsg = NULL;
3188
3189 if (msgin->msgh.msgh_size < (sizeof(IORPCMessageMach) + sizeof(IORPCMessage))) {
3190 if (kIODKLogIPC & gIODKDebug) {
3191 DKLOG("UEXT notify %o\n", msgin->msgh.msgh_id);
3192 }
3193 return KERN_NOT_SUPPORTED;
3194 }
3195
3196 if (!(MACH_MSGH_BITS_COMPLEX & msgin->msgh.msgh_bits)) {
3197 msgin->msgh_body.msgh_descriptor_count = 0;
3198 }
3199 message = IORPCMessageFromMach(msgin, false);
3200 if (!message) {
3201 return kIOReturnIPCError;
3202 }
3203 if (message->objectRefs == 0) {
3204 return kIOReturnIPCError;
3205 }
3206 ret = copyInObjects(msgin, message, msgin->msgh.msgh_size, true, false);
3207 if (kIOReturnSuccess != ret) {
3208 if (kIODKLogIPC & gIODKDebug) {
3209 DKLOG("UEXT copyin(0x%x) %x\n", ret, msgin->msgh.msgh_id);
3210 }
3211 return KERN_NOT_SUPPORTED;
3212 }
3213
3214 if (msgin->msgh_body.msgh_descriptor_count < 1) {
3215 return KERN_NOT_SUPPORTED;
3216 }
3217 object = (OSObject *) message->objects[0];
3218 msgid = message->msgid;
3219 message->flags &= ~kIORPCMessageKernel;
3220 message->flags |= kIORPCMessageRemote;
3221
3222 if ((action = OSDynamicCast(OSAction, object))) {
3223 object = target(action, message);
3224 msgid = message->msgid;
3225 }
3226
3227 oneway = (0 != (kIORPCMessageOneway & message->flags));
3228 assert(oneway || (MACH_PORT_NULL != msgin->msgh.msgh_local_port));
3229
3230 replyAlloc = oneway ? 0 : MAX_UEXT_REPLY_SIZE;
3231 if (replyAlloc) {
3232 /*
3233 * Same as:
3234 * ipc_kmsg_alloc(replyAlloc, 0,
3235 * IPC_KMSG_ALLOC_KERNEL | IPC_KMSG_ALLOC_ZERO | IPC_KMSG_ALLOC_LINEAR |
3236 * IPC_KMSG_ALLOC_NOFAIL);
3237 */
3238 replykmsg = ipc_kmsg_alloc_uext_reply(replyAlloc);
3239 msgout = (typeof(msgout))ikm_header(replykmsg);
3240 }
3241
3242 IORPC rpc = { .message = msgin, .reply = msgout, .sendSize = msgin->msgh.msgh_size, .replySize = replyAlloc };
3243
3244 if (object) {
3245 kern_allocation_name_t prior;
3246 bool setAllocationName;
3247
3248 setAllocationName = (NULL != fAllocationName);
3249 if (setAllocationName) {
3250 prior = thread_set_allocation_name(fAllocationName);
3251 }
3252 thread_iokit_tls_set(0, this);
3253 ret = kernelDispatch(object, rpc);
3254 thread_iokit_tls_set(0, NULL);
3255 if (setAllocationName) {
3256 thread_set_allocation_name(prior);
3257 }
3258 } else {
3259 ret = kIOReturnBadArgument;
3260 }
3261
3262 // release objects
3263 consumeObjects(message, msgin->msgh.msgh_size);
3264
3265 // release ports
3266 copyInObjects(msgin, message, msgin->msgh.msgh_size, false, true);
3267
3268 if (!oneway) {
3269 if (kIOReturnSuccess == ret) {
3270 replySize = msgout->msgh.msgh_size;
3271 reply = IORPCMessageFromMach(msgout, true);
3272 if (!reply) {
3273 ret = kIOReturnIPCError;
3274 } else {
3275 ret = copyOutObjects(msgout, reply, replySize, (kIORPCVersionCurrentReply == msgout->msgh.msgh_id) /* =>!InvokeReply */);
3276 }
3277 }
3278 if (kIOReturnSuccess != ret) {
3279 IORPCMessageErrorReturnContent * errorMsg;
3280
3281 msgout->msgh_body.msgh_descriptor_count = 0;
3282 msgout->msgh.msgh_id = kIORPCVersionCurrentReply;
3283 errorMsg = (typeof(errorMsg))IORPCMessageFromMach(msgout, true);
3284 errorMsg->hdr.msgid = message->msgid;
3285 errorMsg->hdr.flags = kIORPCMessageOneway | kIORPCMessageError;
3286 errorMsg->hdr.objectRefs = 0;
3287 errorMsg->result = ret;
3288 errorMsg->pad = 0;
3289 replySize = sizeof(IORPCMessageErrorReturn);
3290 }
3291
3292 msgout->msgh.msgh_bits = MACH_MSGH_BITS_COMPLEX |
3293 MACH_MSGH_BITS_SET(MACH_MSGH_BITS_LOCAL(msgin->msgh.msgh_bits) /*remote*/, 0 /*local*/, 0, 0);
3294
3295 msgout->msgh.msgh_remote_port = msgin->msgh.msgh_local_port;
3296 msgout->msgh.msgh_local_port = MACH_PORT_NULL;
3297 msgout->msgh.msgh_voucher_port = (mach_port_name_t) 0;
3298 msgout->msgh.msgh_reserved = 0;
3299 msgout->msgh.msgh_size = replySize;
3300 }
3301
3302 *pReply = replykmsg;
3303 return KERN_SUCCESS;
3304 }
3305
3306 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3307
3308 #define MAX_OBJECT_COUNT(mach, size, message) \
3309 ((uint32_t)(((((size) + ((uintptr_t) (mach))) - ((uintptr_t) (&message->objects[0]))) / sizeof(OSObjectRef))))
3310
3311 #pragma pack(push, 4)
3312 struct UEXTTrapReply {
3313 uint64_t replySize;
3314 IORPCMessage replyMessage;
3315 };
3316 #pragma pack(pop)
3317
3318 kern_return_t
IOUserServerUEXTTrap(OSObject * object,void * p1,void * p2,void * p3,void * p4,void * p5,void * p6)3319 IOUserServerUEXTTrap(OSObject * object, void * p1, void * p2, void * p3, void * p4, void * p5, void * p6)
3320 {
3321 const user_addr_t msg = (uintptr_t) p1;
3322 size_t inSize = (uintptr_t) p2;
3323 user_addr_t out = (uintptr_t) p3;
3324 size_t outSize = (uintptr_t) p4;
3325 mach_port_name_t objectName1 = (mach_port_name_t)(uintptr_t) p5;
3326 size_t totalSize;
3327 OSObject * objectArg1;
3328
3329 IORPCMessageMach * mach;
3330 mach_msg_port_descriptor_t * descs;
3331
3332 #pragma pack(4)
3333 struct {
3334 uint32_t pad;
3335 IORPCMessageMach mach;
3336 mach_msg_port_descriptor_t objects[2];
3337 IOTrapMessageBuffer buffer;
3338 } buffer;
3339 #pragma pack()
3340
3341 IOReturn ret;
3342 OSAction * action;
3343 int copyerr;
3344 IORPCMessage * message;
3345 IORPCMessage * reply;
3346 IORPC rpc;
3347 uint64_t refs;
3348 uint32_t maxObjectCount;
3349 size_t copySize;
3350 UEXTTrapReply * replyHdr;
3351 uintptr_t p;
3352
3353 bzero(&buffer, sizeof(buffer));
3354
3355 p = (typeof(p)) & buffer.buffer[0];
3356 if (os_add_overflow(inSize, outSize, &totalSize)) {
3357 return kIOReturnMessageTooLarge;
3358 }
3359 if (totalSize > sizeof(buffer.buffer)) {
3360 return kIOReturnMessageTooLarge;
3361 }
3362 if (inSize < sizeof(IORPCMessage)) {
3363 return kIOReturnIPCError;
3364 }
3365 copyerr = copyin(msg, &buffer.buffer[0], inSize);
3366 if (copyerr) {
3367 return kIOReturnVMError;
3368 }
3369
3370 message = (typeof(message))p;
3371 refs = message->objectRefs;
3372 if ((refs > 2) || !refs) {
3373 return kIOReturnUnsupported;
3374 }
3375 if (!(kIORPCMessageSimpleReply & message->flags)) {
3376 return kIOReturnUnsupported;
3377 }
3378 message->flags &= ~(kIORPCMessageKernel | kIORPCMessageRemote);
3379
3380 descs = (typeof(descs))(p - refs * sizeof(*descs));
3381 mach = (typeof(mach))(p - refs * sizeof(*descs) - sizeof(*mach));
3382
3383 mach->msgh.msgh_id = kIORPCVersionCurrent;
3384 mach->msgh.msgh_size = (mach_msg_size_t) (sizeof(IORPCMessageMach) + refs * sizeof(*descs) + inSize); // totalSize was checked
3385 mach->msgh_body.msgh_descriptor_count = ((mach_msg_size_t) refs);
3386
3387 rpc.message = mach;
3388 rpc.sendSize = mach->msgh.msgh_size;
3389 rpc.reply = (IORPCMessageMach *) (p + inSize);
3390 rpc.replySize = ((uint32_t) (sizeof(buffer.buffer) - inSize)); // inSize was checked
3391
3392 message->objects[0] = 0;
3393 if ((action = OSDynamicCast(OSAction, object))) {
3394 maxObjectCount = MAX_OBJECT_COUNT(rpc.message, rpc.sendSize, message);
3395 if (refs > maxObjectCount) {
3396 return kIOReturnBadArgument;
3397 }
3398 if (refs < 2) {
3399 DKLOG("invalid refs count %qd in message id 0x%qx\n", refs, message->msgid);
3400 return kIOReturnBadArgument;
3401 }
3402 object = IOUserServer::target(action, message);
3403 message->objects[1] = (OSObjectRef) action;
3404 if (kIODKLogIPC & gIODKDebug) {
3405 DKLOG("%s::Dispatch(trap) kernel 0x%qx\n", object->getMetaClass()->getClassName(), message->msgid);
3406 }
3407 ret = object->Dispatch(rpc);
3408 } else {
3409 objectArg1 = NULL;
3410 if (refs > 1) {
3411 if (objectName1) {
3412 objectArg1 = iokit_lookup_uext_ref_current_task(objectName1);
3413 if (!objectArg1) {
3414 return kIOReturnIPCError;
3415 }
3416 }
3417 message->objects[1] = (OSObjectRef) objectArg1;
3418 }
3419 if (kIODKLogIPC & gIODKDebug) {
3420 DKLOG("%s::Dispatch(trap) kernel 0x%qx\n", object->getMetaClass()->getClassName(), message->msgid);
3421 }
3422 ret = object->Dispatch(rpc);
3423 if (kIODKLogIPC & gIODKDebug) {
3424 DKLOG("%s::Dispatch(trap) kernel 0x%qx 0x%x\n", object->getMetaClass()->getClassName(), message->msgid, ret);
3425 }
3426 OSSafeReleaseNULL(objectArg1);
3427
3428 if (kIOReturnSuccess == ret) {
3429 if (rpc.reply->msgh_body.msgh_descriptor_count) {
3430 return kIOReturnIPCError;
3431 }
3432 reply = IORPCMessageFromMach(rpc.reply, rpc.reply->msgh.msgh_size);
3433 if (!reply) {
3434 return kIOReturnIPCError;
3435 }
3436 copySize = rpc.reply->msgh.msgh_size - (((uintptr_t) reply) - ((uintptr_t) rpc.reply)) + sizeof(uint64_t);
3437 if (copySize > outSize) {
3438 return kIOReturnIPCError;
3439 }
3440 replyHdr = (UEXTTrapReply *) ((uintptr_t)reply - sizeof(uint64_t));
3441 replyHdr->replySize = copySize;
3442 copyerr = copyout(replyHdr, out, copySize);
3443 if (copyerr) {
3444 return kIOReturnVMError;
3445 }
3446 }
3447 }
3448
3449 return ret;
3450 }
3451
3452 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3453
3454 IOReturn
rpc(IORPC rpc)3455 IOUserServer::rpc(IORPC rpc)
3456 {
3457 if (isInactive() && !fRootQueue) {
3458 return kIOReturnOffline;
3459 }
3460
3461 IOReturn ret;
3462 IORPCMessage * message;
3463 IORPCMessageMach * mach;
3464 mach_msg_id_t machid;
3465 uint32_t sendSize, replySize;
3466 bool oneway;
3467 uint64_t msgid;
3468 IODispatchQueue * queue;
3469 IOService * service;
3470 ipc_port_t port;
3471 ipc_port_t sendPort;
3472
3473 queue = NULL;
3474 port = NULL;
3475 sendPort = NULL;
3476
3477 mach = rpc.message;
3478 sendSize = rpc.sendSize;
3479 replySize = rpc.replySize;
3480
3481 assert(sendSize >= (sizeof(IORPCMessageMach) + sizeof(IORPCMessage)));
3482
3483 message = IORPCMessageFromMach(mach, false);
3484 if (!message) {
3485 return kIOReturnIPCError;
3486 }
3487 msgid = message->msgid;
3488 machid = (msgid >> 32);
3489
3490 if (mach->msgh_body.msgh_descriptor_count < 1) {
3491 return kIOReturnNoMedia;
3492 }
3493
3494 IOLockLock(gIOUserServerLock);
3495 if ((service = OSDynamicCast(IOService, (OSObject *) message->objects[0]))) {
3496 queue = queueForObject(service, msgid);
3497 }
3498 if (!queue) {
3499 queue = fRootQueue;
3500 }
3501 if (queue && (kIODispatchQueueStopped != queue)) {
3502 port = queue->ivars->serverPort;
3503 }
3504 if (port) {
3505 sendPort = ipc_port_copy_send_mqueue(port);
3506 }
3507 IOLockUnlock(gIOUserServerLock);
3508 if (!sendPort) {
3509 return kIOReturnNotReady;
3510 }
3511
3512 oneway = (0 != (kIORPCMessageOneway & message->flags));
3513
3514 ret = copyOutObjects(mach, message, sendSize, false);
3515
3516 mach->msgh.msgh_bits = MACH_MSGH_BITS_COMPLEX |
3517 MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, (oneway ? 0 : MACH_MSG_TYPE_MAKE_SEND_ONCE));
3518 mach->msgh.msgh_remote_port = sendPort;
3519 mach->msgh.msgh_local_port = (oneway ? MACH_PORT_NULL : mig_get_reply_port());
3520 mach->msgh.msgh_id = kIORPCVersionCurrent;
3521 mach->msgh.msgh_reserved = 0;
3522
3523 boolean_t message_moved;
3524
3525 if (oneway) {
3526 ret = kernel_mach_msg_send(&mach->msgh, sendSize,
3527 MACH_SEND_MSG | MACH_SEND_ALWAYS | MACH_SEND_NOIMPORTANCE,
3528 0, &message_moved);
3529 } else {
3530 assert(replySize >= (sizeof(IORPCMessageMach) + sizeof(IORPCMessage)));
3531 ret = kernel_mach_msg_rpc(&mach->msgh, sendSize, replySize, FALSE, &message_moved);
3532 }
3533
3534 ipc_port_release_send(sendPort);
3535
3536 if (MACH_MSG_SUCCESS != ret) {
3537 if (kIODKLogIPC & gIODKDebug) {
3538 DKLOG("mach_msg() failed 0x%x\n", ret);
3539 }
3540 if (!message_moved) {
3541 // release ports
3542 copyInObjects(mach, message, sendSize, false, true);
3543 }
3544 }
3545
3546 if ((KERN_SUCCESS == ret) && !oneway) {
3547 if (kIORPCVersionCurrentReply != mach->msgh.msgh_id) {
3548 ret = (MACH_NOTIFY_SEND_ONCE == mach->msgh.msgh_id) ? MIG_SERVER_DIED : MIG_REPLY_MISMATCH;
3549 } else if ((replySize = mach->msgh.msgh_size) < (sizeof(IORPCMessageMach) + sizeof(IORPCMessage))) {
3550 // printf("BAD REPLY SIZE\n");
3551 ret = MIG_BAD_ARGUMENTS;
3552 } else {
3553 if (!(MACH_MSGH_BITS_COMPLEX & mach->msgh.msgh_bits)) {
3554 mach->msgh_body.msgh_descriptor_count = 0;
3555 }
3556 message = IORPCMessageFromMach(mach, true);
3557 if (!message) {
3558 ret = kIOReturnIPCError;
3559 } else if (message->msgid != msgid) {
3560 // printf("BAD REPLY ID\n");
3561 ret = MIG_BAD_ARGUMENTS;
3562 } else {
3563 bool isError = (0 != (kIORPCMessageError & message->flags));
3564 ret = copyInObjects(mach, message, replySize, !isError, true);
3565 if (kIOReturnSuccess != ret) {
3566 if (kIODKLogIPC & gIODKDebug) {
3567 DKLOG("rpc copyin(0x%x) %x\n", ret, mach->msgh.msgh_id);
3568 }
3569 return KERN_NOT_SUPPORTED;
3570 }
3571 if (isError) {
3572 IORPCMessageErrorReturnContent * errorMsg = (typeof(errorMsg))message;
3573 ret = errorMsg->result;
3574 }
3575 }
3576 }
3577 }
3578
3579 return ret;
3580 }
3581
3582 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3583
3584 IORPCMessage *
IORPCMessageFromMach(IORPCMessageMach * msg,bool reply)3585 IORPCMessageFromMach(IORPCMessageMach * msg, bool reply)
3586 {
3587 mach_msg_size_t idx, count;
3588 mach_msg_port_descriptor_t * desc;
3589 mach_msg_port_descriptor_t * maxDesc;
3590 size_t size, msgsize;
3591 bool upgrade;
3592
3593 msgsize = msg->msgh.msgh_size;
3594 count = msg->msgh_body.msgh_descriptor_count;
3595 desc = &msg->objects[0];
3596 maxDesc = (typeof(maxDesc))(((uintptr_t) msg) + msgsize);
3597 upgrade = (msg->msgh.msgh_id != (reply ? kIORPCVersionCurrentReply : kIORPCVersionCurrent));
3598
3599 if (upgrade) {
3600 OSReportWithBacktrace("obsolete message");
3601 return NULL;
3602 }
3603
3604 for (idx = 0; idx < count; idx++) {
3605 if (desc >= maxDesc) {
3606 return NULL;
3607 }
3608 switch (desc->type) {
3609 case MACH_MSG_PORT_DESCRIPTOR:
3610 size = sizeof(mach_msg_port_descriptor_t);
3611 break;
3612 case MACH_MSG_OOL_DESCRIPTOR:
3613 size = sizeof(mach_msg_ool_descriptor_t);
3614 break;
3615 default:
3616 return NULL;
3617 }
3618 desc = (typeof(desc))(((uintptr_t) desc) + size);
3619 }
3620 return (IORPCMessage *)(uintptr_t) desc;
3621 }
3622
3623 ipc_port_t
copySendRightForObject(OSObject * object,ipc_kobject_type_t type)3624 IOUserServer::copySendRightForObject(OSObject * object, ipc_kobject_type_t type)
3625 {
3626 ipc_port_t port;
3627 ipc_port_t sendPort = NULL;
3628 ipc_kobject_t kobj;
3629
3630 port = iokit_port_for_object(object, type, &kobj);
3631 if (port) {
3632 sendPort = ipc_kobject_make_send(port, kobj, type);
3633 iokit_release_port(port);
3634 }
3635
3636 return sendPort;
3637 }
3638
3639 OSObject *
copyObjectForSendRight(ipc_port_t port,ipc_kobject_type_t type)3640 IOUserServer::copyObjectForSendRight(ipc_port_t port, ipc_kobject_type_t type)
3641 {
3642 OSObject * object;
3643 object = iokit_lookup_io_object(port, type);
3644 return object;
3645 }
3646
3647 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3648
3649 // Create a vm_map_copy_t or kalloc'ed data for memory
3650 // to be copied out. ipc will free after the copyout.
3651
3652 static kern_return_t
copyoutkdata(const void * data,vm_size_t len,void ** buf)3653 copyoutkdata(const void * data, vm_size_t len, void ** buf)
3654 {
3655 kern_return_t err;
3656 vm_map_copy_t copy;
3657
3658 err = vm_map_copyin( kernel_map, CAST_USER_ADDR_T(data), len,
3659 false /* src_destroy */, ©);
3660
3661 assert( err == KERN_SUCCESS );
3662 if (err == KERN_SUCCESS) {
3663 *buf = (char *) copy;
3664 }
3665
3666 return err;
3667 }
3668
3669 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3670
3671 IOReturn
copyOutObjects(IORPCMessageMach * mach,IORPCMessage * message,size_t size,bool consume)3672 IOUserServer::copyOutObjects(IORPCMessageMach * mach, IORPCMessage * message,
3673 size_t size, bool consume)
3674 {
3675 uint64_t refs;
3676 uint32_t idx, maxObjectCount;
3677 ipc_port_t port;
3678 OSObject * object;
3679 size_t descsize;
3680 mach_msg_port_descriptor_t * desc;
3681 mach_msg_ool_descriptor_t * ool;
3682 vm_map_copy_t copy;
3683 void * address;
3684 mach_msg_size_t length;
3685 kern_return_t kr;
3686 OSSerialize * s;
3687
3688 refs = message->objectRefs;
3689 maxObjectCount = MAX_OBJECT_COUNT(mach, size, message);
3690 // assert(refs <= mach->msgh_body.msgh_descriptor_count);
3691 // assert(refs <= maxObjectCount);
3692 if (refs > mach->msgh_body.msgh_descriptor_count) {
3693 return kIOReturnBadArgument;
3694 }
3695 if (refs > maxObjectCount) {
3696 return kIOReturnBadArgument;
3697 }
3698
3699 desc = &mach->objects[0];
3700 for (idx = 0; idx < refs; idx++) {
3701 object = (OSObject *) message->objects[idx];
3702
3703 switch (desc->type) {
3704 case MACH_MSG_PORT_DESCRIPTOR:
3705 descsize = sizeof(mach_msg_port_descriptor_t);
3706 port = NULL;
3707 if (object) {
3708 #if DEVELOPMENT || DEBUG
3709 if (kIODKLogIPC & gIODKDebug) {
3710 IOMemoryDescriptor * iomd = OSDynamicCast(IOMemoryDescriptor, object);
3711 if (iomd != NULL && (iomd->getFlags() & kIOMemoryThreadSafe) == 0) {
3712 OSReportWithBacktrace("IOMemoryDescriptor %p was created without kIOMemoryThreadSafe flag", iomd);
3713 }
3714 }
3715 #endif /* DEVELOPMENT || DEBUG */
3716
3717 port = copySendRightForObject(object, IKOT_UEXT_OBJECT);
3718 if (!port) {
3719 break;
3720 }
3721 if (consume) {
3722 object->release();
3723 }
3724 message->objects[idx] = 0;
3725 }
3726 // desc->type = MACH_MSG_PORT_DESCRIPTOR;
3727 desc->disposition = MACH_MSG_TYPE_MOVE_SEND;
3728 desc->name = port;
3729 desc->pad2 = 0;
3730 desc->pad_end = 0;
3731 break;
3732
3733 case MACH_MSG_OOL_DESCRIPTOR:
3734 descsize = sizeof(mach_msg_ool_descriptor_t);
3735
3736 length = 0;
3737 address = NULL;
3738 if (object) {
3739 s = OSSerialize::binaryWithCapacity(4096);
3740 assert(s);
3741 if (!s) {
3742 break;
3743 }
3744 s->setIndexed(true);
3745 if (!object->serialize(s)) {
3746 assert(false);
3747 descsize = -1UL;
3748 s->release();
3749 break;
3750 }
3751 length = s->getLength();
3752 kr = copyoutkdata(s->text(), length, &address);
3753 s->release();
3754 if (KERN_SUCCESS != kr) {
3755 descsize = -1UL;
3756 address = NULL;
3757 length = 0;
3758 }
3759 if (consume) {
3760 object->release();
3761 }
3762 message->objects[idx] = 0;
3763 }
3764 ool = (typeof(ool))desc;
3765 // ool->type = MACH_MSG_OOL_DESCRIPTOR;
3766 ool->deallocate = false;
3767 ool->copy = MACH_MSG_PHYSICAL_COPY;
3768 ool->size = length;
3769 ool->address = address;
3770 break;
3771
3772 default:
3773 descsize = -1UL;
3774 break;
3775 }
3776 if (-1UL == descsize) {
3777 break;
3778 }
3779 desc = (typeof(desc))(((uintptr_t) desc) + descsize);
3780 }
3781
3782 if (idx >= refs) {
3783 return kIOReturnSuccess;
3784 }
3785
3786 desc = &mach->objects[0];
3787 while (idx--) {
3788 switch (desc->type) {
3789 case MACH_MSG_PORT_DESCRIPTOR:
3790 descsize = sizeof(mach_msg_port_descriptor_t);
3791 port = desc->name;
3792 if (port) {
3793 ipc_port_release_send(port);
3794 }
3795 break;
3796
3797 case MACH_MSG_OOL_DESCRIPTOR:
3798 descsize = sizeof(mach_msg_ool_descriptor_t);
3799 ool = (typeof(ool))desc;
3800 copy = (vm_map_copy_t) ool->address;
3801 if (copy) {
3802 vm_map_copy_discard(copy);
3803 }
3804 break;
3805
3806 default:
3807 descsize = -1UL;
3808 break;
3809 }
3810 if (-1UL == descsize) {
3811 break;
3812 }
3813 desc = (typeof(desc))(((uintptr_t) desc) + descsize);
3814 }
3815
3816 return kIOReturnBadArgument;
3817 }
3818
3819 IOReturn
copyInObjects(IORPCMessageMach * mach,IORPCMessage * message,size_t size,bool copyObjects,bool consumePorts)3820 IOUserServer::copyInObjects(IORPCMessageMach * mach, IORPCMessage * message,
3821 size_t size, bool copyObjects, bool consumePorts)
3822 {
3823 uint64_t refs;
3824 uint32_t idx, maxObjectCount;
3825 ipc_port_t port;
3826 OSObject * object;
3827 size_t descsize;
3828 mach_msg_port_descriptor_t * desc;
3829 mach_msg_ool_descriptor_t * ool;
3830 vm_map_address_t copyoutdata;
3831 kern_return_t kr;
3832
3833 refs = message->objectRefs;
3834 maxObjectCount = MAX_OBJECT_COUNT(mach, size, message);
3835 // assert(refs <= mach->msgh_body.msgh_descriptor_count);
3836 // assert(refs <= maxObjectCount);
3837 if (refs > mach->msgh_body.msgh_descriptor_count) {
3838 return kIOReturnBadArgument;
3839 }
3840 if (refs > maxObjectCount) {
3841 return kIOReturnBadArgument;
3842 }
3843
3844 desc = &mach->objects[0];
3845 for (idx = 0; idx < refs; idx++) {
3846 switch (desc->type) {
3847 case MACH_MSG_PORT_DESCRIPTOR:
3848 descsize = sizeof(mach_msg_port_descriptor_t);
3849
3850 object = NULL;
3851 port = desc->name;
3852 if (port) {
3853 if (copyObjects) {
3854 object = copyObjectForSendRight(port, IKOT_UEXT_OBJECT);
3855 if (!object) {
3856 descsize = -1UL;
3857 break;
3858 }
3859 }
3860 if (consumePorts) {
3861 ipc_port_release_send(port);
3862 }
3863 }
3864 break;
3865
3866 case MACH_MSG_OOL_DESCRIPTOR:
3867 descsize = sizeof(mach_msg_ool_descriptor_t);
3868 ool = (typeof(ool))desc;
3869
3870 object = NULL;
3871 if (copyObjects && ool->size && ool->address) {
3872 kr = vm_map_copyout(kernel_map, ©outdata, (vm_map_copy_t) ool->address);
3873 if (KERN_SUCCESS == kr) {
3874 object = OSUnserializeXML((const char *) copyoutdata, ool->size);
3875 kr = vm_deallocate(kernel_map, copyoutdata, ool->size);
3876 assert(KERN_SUCCESS == kr);
3877 // vm_map_copyout() has consumed the vm_map_copy_t in the message
3878 ool->size = 0;
3879 ool->address = NULL;
3880 }
3881 if (!object) {
3882 descsize = -1UL;
3883 break;
3884 }
3885 }
3886 break;
3887
3888 default:
3889 descsize = -1UL;
3890 break;
3891 }
3892 if (-1UL == descsize) {
3893 break;
3894 }
3895 if (copyObjects) {
3896 message->objects[idx] = (OSObjectRef) object;
3897 }
3898 desc = (typeof(desc))(((uintptr_t) desc) + descsize);
3899 }
3900
3901 if (idx >= refs) {
3902 return kIOReturnSuccess;
3903 }
3904
3905 while (idx--) {
3906 object = (OSObject *) message->objects[idx];
3907 OSSafeReleaseNULL(object);
3908 message->objects[idx] = 0;
3909 }
3910
3911 return kIOReturnBadArgument;
3912 }
3913
3914 IOReturn
consumeObjects(IORPCMessage * message,size_t messageSize)3915 IOUserServer::consumeObjects(IORPCMessage * message, size_t messageSize)
3916 {
3917 uint64_t refs, idx;
3918 OSObject * object;
3919
3920 refs = message->objectRefs;
3921 for (idx = 0; idx < refs; idx++) {
3922 object = (OSObject *) message->objects[idx];
3923 if (object) {
3924 object->release();
3925 message->objects[idx] = 0;
3926 }
3927 }
3928
3929 return kIOReturnSuccess;
3930 }
3931
3932 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3933
3934 bool
finalize(IOOptionBits options)3935 IOUserServer::finalize(IOOptionBits options)
3936 {
3937 OSArray * services;
3938
3939 if (kIODKLogSetup & gIODKDebug) {
3940 DKLOG("%s::finalize(%p)\n", getName(), this);
3941 }
3942
3943 IOLockLock(gIOUserServerLock);
3944 OSSafeReleaseNULL(fRootQueue);
3945 IOLockUnlock(gIOUserServerLock);
3946
3947 services = NULL;
3948 IOLockLock(fLock);
3949 if (fServices) {
3950 services = OSArray::withArray(fServices);
3951 }
3952 IOLockUnlock(fLock);
3953
3954 IOOptionBits terminateFlags = kIOServiceTerminateNeedWillTerminate | kIOServiceTerminateWithRematch;
3955 if (fCheckInToken) {
3956 bool can_rematch = fCheckInToken->dextTerminate();
3957 if (can_rematch) {
3958 terminateFlags |= kIOServiceTerminateWithRematchCurrentDext;
3959 } else {
3960 DKLOG("%s::finalize(%p) dext was replaced, do not rematch current dext\n", getName(), this);
3961 }
3962 } else {
3963 terminateFlags |= kIOServiceTerminateWithRematchCurrentDext;
3964 DKLOG("%s::finalize(%p) could not find fCheckInToken\n", getName(), this);
3965 }
3966
3967 if (services) {
3968 services->iterateObjects(^bool (OSObject * obj) {
3969 int service __unused; // hide outer defn
3970 IOService * nextService;
3971 IOService * provider;
3972 bool started = false;
3973
3974 nextService = (IOService *) obj;
3975 if (kIODKLogSetup & gIODKDebug) {
3976 DKLOG("%s::terminate(" DKS ")\n", getName(), DKN(nextService));
3977 }
3978 if (nextService->reserved->uvars) {
3979 IOUserClient * nextUserClient = OSDynamicCast(IOUserClient, nextService);
3980 provider = nextService->getProvider();
3981 if (nextUserClient) {
3982 nextUserClient->setTerminateDefer(provider, false);
3983 }
3984 started = nextService->reserved->uvars->started;
3985 nextService->reserved->uvars->serverDied = true;
3986
3987 serviceDidStop(nextService, provider);
3988 if (provider != NULL && (terminateFlags & kIOServiceTerminateWithRematchCurrentDext) == 0) {
3989 provider->resetRematchProperties();
3990 }
3991 if (started) {
3992 nextService->terminate(terminateFlags);
3993 }
3994 }
3995 if (!started) {
3996 DKLOG("%s::terminate(" DKS ") server exit before start()\n", getName(), DKN(nextService));
3997 serviceStop(nextService, NULL);
3998 }
3999 return false;
4000 });
4001 services->release();
4002 }
4003
4004 return IOUserClient::finalize(options);
4005 }
4006
4007 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4008
4009 #undef super
4010 #define super IOUserClient2022
4011
OSDefineMetaClassAndStructors(IOUserServer,IOUserClient2022)4012 OSDefineMetaClassAndStructors(IOUserServer, IOUserClient2022)
4013
4014 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4015
4016 IOUserClient * IOUserServer::withTask(task_t owningTask)
4017 {
4018 IOUserServer * inst;
4019
4020 assert(owningTask == current_task());
4021 if (!task_is_driver(owningTask)) {
4022 DKLOG("IOUserServer may only be created with driver tasks\n");
4023 return NULL;
4024 }
4025
4026 inst = new IOUserServer;
4027 if (inst && !inst->init()) {
4028 inst->release();
4029 inst = NULL;
4030 return inst;
4031 }
4032 OS_ANALYZER_SUPPRESS("82033761") inst->PMinit();
4033
4034 inst->fOwningTask = current_task();
4035 task_reference(inst->fOwningTask);
4036
4037 inst->fEntitlements = IOUserClient::copyClientEntitlements(inst->fOwningTask);
4038
4039 if (!(kIODKDisableEntitlementChecking & gIODKDebug)) {
4040 proc_t p;
4041 pid_t pid;
4042 const char * name;
4043 p = (proc_t)get_bsdtask_info(inst->fOwningTask);
4044 if (p) {
4045 name = proc_best_name(p);
4046 pid = proc_pid(p);
4047 } else {
4048 name = "unknown";
4049 pid = 0;
4050 }
4051
4052 if (inst->fEntitlements == NULL) {
4053 #if DEVELOPMENT || DEBUG
4054 panic("entitlements are missing for %s[%d]\n", name, pid);
4055 #else
4056 DKLOG("entitlements are missing for %s[%d]\n", name, pid);
4057 #endif /* DEVELOPMENT || DEBUG */
4058 }
4059
4060
4061 const char * dextTeamID = csproc_get_teamid(p);
4062 if (dextTeamID != NULL) {
4063 inst->fTeamIdentifier = OSString::withCString(dextTeamID);
4064 DKLOG("%s[%d] has team identifier %s\n", name, pid, dextTeamID);
4065 }
4066
4067 if (!IOCurrentTaskHasEntitlement(gIODriverKitEntitlementKey->getCStringNoCopy())) {
4068 IOLog(kIODriverKitEntitlementKey " entitlement check failed for %s[%d]\n", name, pid);
4069 inst->release();
4070 inst = NULL;
4071 return inst;
4072 }
4073 }
4074
4075 /* Mark the current task's space as eligible for uext object ports */
4076 iokit_label_dext_task(inst->fOwningTask);
4077
4078 inst->fLock = IOLockAlloc();
4079 inst->fServices = OSArray::withCapacity(4);
4080 inst->fClasses = OSDictionary::withCapacity(16);
4081 inst->fClasses->setOptions(OSCollection::kSort, OSCollection::kSort);
4082 inst->fPlatformDriver = task_get_platform_binary(inst->fOwningTask);
4083 if (csproc_get_validation_category(current_proc(), &inst->fCSValidationCategory) != KERN_SUCCESS) {
4084 inst->fCSValidationCategory = CS_VALIDATION_CATEGORY_INVALID;
4085 }
4086
4087 inst->setProperty(kIOUserClientDefaultLockingKey, kOSBooleanTrue);
4088 inst->setProperty(kIOUserClientDefaultLockingSetPropertiesKey, kOSBooleanTrue);
4089 inst->setProperty(kIOUserClientDefaultLockingSingleThreadExternalMethodKey, kOSBooleanTrue);
4090 //requirement for gIODriverKitEntitlementKey is enforced elsewhere conditionally
4091 inst->setProperty(kIOUserClientEntitlementsKey, kOSBooleanFalse);
4092
4093 return inst;
4094 }
4095
4096 static bool gIOUserServerLeakObjects = false;
4097
4098 bool
shouldLeakObjects()4099 IOUserServer::shouldLeakObjects()
4100 {
4101 return gIOUserServerLeakObjects;
4102 }
4103
4104 void
beginLeakingObjects()4105 IOUserServer::beginLeakingObjects()
4106 {
4107 gIOUserServerLeakObjects = true;
4108 }
4109
4110 bool
isPlatformDriver()4111 IOUserServer::isPlatformDriver()
4112 {
4113 return fPlatformDriver;
4114 }
4115
4116 int
getCSValidationCategory()4117 IOUserServer::getCSValidationCategory()
4118 {
4119 return fCSValidationCategory;
4120 }
4121
4122
4123 struct IOUserServerRecordExitReasonContext {
4124 task_t task;
4125 os_reason_t reason;
4126 };
4127
4128 static bool
IOUserServerRecordExitReasonMatch(const OSObject * obj,void * context)4129 IOUserServerRecordExitReasonMatch(const OSObject *obj, void * context)
4130 {
4131 IOUserServerRecordExitReasonContext * ctx = (IOUserServerRecordExitReasonContext *)context;
4132 IOUserServer * us = OSDynamicCast(IOUserServer, obj);
4133 if (us == NULL) {
4134 return false;
4135 }
4136
4137 if (us->fOwningTask == ctx->task) {
4138 assert(us->fTaskCrashReason == OS_REASON_NULL);
4139 assert(ctx->reason != OS_REASON_NULL);
4140 os_reason_ref(ctx->reason);
4141 us->fTaskCrashReason = ctx->reason;
4142 return true;
4143 }
4144
4145 return false;
4146 }
4147
4148 extern "C" void
IOUserServerRecordExitReason(task_t task,os_reason_t reason)4149 IOUserServerRecordExitReason(task_t task, os_reason_t reason)
4150 {
4151 IOUserServerRecordExitReasonContext ctx { task, reason };
4152 IOUserServer::gMetaClass.applyToInstances(IOUserServerRecordExitReasonMatch, &ctx);
4153 }
4154
4155 IOReturn
clientClose(void)4156 IOUserServer::clientClose(void)
4157 {
4158 OSArray * services;
4159 bool __block unexpectedExit = false;
4160
4161 if (kIODKLogSetup & gIODKDebug) {
4162 DKLOG("%s::clientClose(%p)\n", getName(), this);
4163 }
4164 services = NULL;
4165 IOLockLock(fLock);
4166 if (fServices) {
4167 services = OSArray::withArray(fServices);
4168 }
4169 IOLockUnlock(fLock);
4170
4171 // if this was a an expected exit, termination and stop should have detached at this
4172 // point, so send any provider still attached and not owned by this user server
4173 // the ClientCrashed() notification
4174 if (services) {
4175 services->iterateObjects(^bool (OSObject * obj) {
4176 int service __unused; // hide outer defn
4177 IOService * nextService;
4178 IOService * provider;
4179
4180 nextService = (IOService *) obj;
4181 if (nextService->isInactive()) {
4182 return false;
4183 }
4184 if (nextService->reserved && nextService->reserved->uvars && nextService->reserved->uvars->started) {
4185 unexpectedExit = true;
4186 }
4187 provider = nextService->getProvider();
4188 if (provider
4189 && (!provider->reserved->uvars || (provider->reserved->uvars->userServer != this))) {
4190 if (kIODKLogSetup & gIODKDebug) {
4191 DKLOG(DKS "::ClientCrashed(" DKS ")\n", DKN(provider), DKN(nextService));
4192 }
4193 provider->ClientCrashed(nextService, 0);
4194 }
4195 return false;
4196 });
4197 services->release();
4198 }
4199
4200 if (unexpectedExit &&
4201 !gInUserspaceReboot &&
4202 (fTaskCrashReason != OS_REASON_NULL && fTaskCrashReason->osr_namespace != OS_REASON_JETSAM && fTaskCrashReason->osr_namespace != OS_REASON_RUNNINGBOARD) &&
4203 fStatistics != NULL) {
4204 OSDextCrashPolicy policy = fStatistics->recordCrash();
4205 bool allowPanic;
4206 #if DEVELOPMENT || DEBUG
4207 allowPanic = fPlatformDriver && fEntitlements->getObject(gIODriverKitTestDriverEntitlementKey) != kOSBooleanTrue && !disable_dext_crash_reboot;
4208 #else
4209 allowPanic = fPlatformDriver;
4210 #endif /* DEVELOPMENT || DEBUG */
4211
4212 if (policy == kOSDextCrashPolicyReboot && allowPanic) {
4213 panic("Driver %s has crashed too many times\n", getName());
4214 }
4215 }
4216
4217 terminate();
4218 return kIOReturnSuccess;
4219 }
4220
4221 IOReturn
setProperties(OSObject * properties)4222 IOUserServer::setProperties(OSObject * properties)
4223 {
4224 IOReturn kr = kIOReturnUnsupported;
4225 return kr;
4226 }
4227
4228 void
stop(IOService * provider)4229 IOUserServer::stop(IOService * provider)
4230 {
4231 if (fOwningTask) {
4232 task_deallocate(fOwningTask);
4233 fOwningTask = TASK_NULL;
4234 }
4235
4236 PMstop();
4237
4238 IOServicePH::serverRemove(this);
4239
4240 OSSafeReleaseNULL(fRootQueue);
4241
4242 if (fInterruptLock) {
4243 IOSimpleLockFree(fInterruptLock);
4244 }
4245 }
4246
4247 void
free()4248 IOUserServer::free()
4249 {
4250 OSSafeReleaseNULL(fEntitlements);
4251 OSSafeReleaseNULL(fClasses);
4252 if (fOwningTask) {
4253 task_deallocate(fOwningTask);
4254 fOwningTask = TASK_NULL;
4255 }
4256 if (fLock) {
4257 IOLockFree(fLock);
4258 }
4259 OSSafeReleaseNULL(fServices);
4260 OSSafeReleaseNULL(fCheckInToken);
4261 OSSafeReleaseNULL(fStatistics);
4262 OSSafeReleaseNULL(fTeamIdentifier);
4263 if (fAllocationName) {
4264 kern_allocation_name_release(fAllocationName);
4265 fAllocationName = NULL;
4266 }
4267 if (fTaskCrashReason != OS_REASON_NULL) {
4268 os_reason_free(fTaskCrashReason);
4269 }
4270 IOUserClient::free();
4271 }
4272
4273 IOReturn
registerClass(OSClassDescription * desc,uint32_t size,OSUserMetaClass ** pCls)4274 IOUserServer::registerClass(OSClassDescription * desc, uint32_t size, OSUserMetaClass ** pCls)
4275 {
4276 OSUserMetaClass * cls;
4277 const OSSymbol * sym;
4278 uint64_t * methodOptions;
4279 const char * queueNames;
4280 uint32_t methodOptionsEnd, queueNamesEnd;
4281 IOReturn ret = kIOReturnSuccess;
4282
4283 if (size < sizeof(OSClassDescription)) {
4284 assert(false);
4285 return kIOReturnBadArgument;
4286 }
4287
4288 if (kIODKLogSetup & gIODKDebug) {
4289 DKLOG("%s::registerClass %s, %d, %d\n", getName(), desc->name, desc->queueNamesSize, desc->methodNamesSize);
4290 }
4291
4292 if (desc->descriptionSize != size) {
4293 assert(false);
4294 return kIOReturnBadArgument;
4295 }
4296 if (os_add_overflow(desc->queueNamesOffset, desc->queueNamesSize, &queueNamesEnd)) {
4297 assert(false);
4298 return kIOReturnBadArgument;
4299 }
4300 if (queueNamesEnd > size) {
4301 assert(false);
4302 return kIOReturnBadArgument;
4303 }
4304 if (os_add_overflow(desc->methodOptionsOffset, desc->methodOptionsSize, &methodOptionsEnd)) {
4305 assert(false);
4306 return kIOReturnBadArgument;
4307 }
4308 if (methodOptionsEnd > size) {
4309 assert(false);
4310 return kIOReturnBadArgument;
4311 }
4312 // overlaps?
4313 if ((desc->queueNamesOffset >= desc->methodOptionsOffset) && (desc->queueNamesOffset < methodOptionsEnd)) {
4314 assert(false);
4315 return kIOReturnBadArgument;
4316 }
4317 if ((queueNamesEnd >= desc->methodOptionsOffset) && (queueNamesEnd < methodOptionsEnd)) {
4318 assert(false);
4319 return kIOReturnBadArgument;
4320 }
4321
4322 if (desc->methodOptionsSize & ((2 * sizeof(uint64_t)) - 1)) {
4323 assert(false);
4324 return kIOReturnBadArgument;
4325 }
4326 if (sizeof(desc->name) == strnlen(desc->name, sizeof(desc->name))) {
4327 assert(false);
4328 return kIOReturnBadArgument;
4329 }
4330 if (sizeof(desc->superName) == strnlen(desc->superName, sizeof(desc->superName))) {
4331 assert(false);
4332 return kIOReturnBadArgument;
4333 }
4334
4335 cls = OSTypeAlloc(OSUserMetaClass);
4336 assert(cls);
4337 if (!cls) {
4338 return kIOReturnNoMemory;
4339 }
4340
4341 cls->description = (typeof(cls->description))IOMallocData(size);
4342 assert(cls->description);
4343 if (!cls->description) {
4344 assert(false);
4345 cls->release();
4346 return kIOReturnNoMemory;
4347 }
4348 bcopy(desc, cls->description, size);
4349
4350 cls->methodCount = desc->methodOptionsSize / (2 * sizeof(uint64_t));
4351 cls->methods = IONewData(uint64_t, 2 * cls->methodCount);
4352 if (!cls->methods) {
4353 assert(false);
4354 cls->release();
4355 return kIOReturnNoMemory;
4356 }
4357
4358 methodOptions = (typeof(methodOptions))(((uintptr_t) desc) + desc->methodOptionsOffset);
4359 bcopy(methodOptions, cls->methods, 2 * cls->methodCount * sizeof(uint64_t));
4360
4361 queueNames = (typeof(queueNames))(((uintptr_t) desc) + desc->queueNamesOffset);
4362 cls->queueNames = copyInStringArray(queueNames, desc->queueNamesSize);
4363
4364 sym = OSSymbol::withCString(desc->name);
4365 assert(sym);
4366 if (!sym) {
4367 assert(false);
4368 cls->release();
4369 return kIOReturnNoMemory;
4370 }
4371
4372 cls->name = sym;
4373 cls->meta = OSMetaClass::copyMetaClassWithName(sym);
4374 IOLockLock(fLock);
4375 cls->superMeta = OSDynamicCast(OSUserMetaClass, fClasses->getObject(desc->superName));
4376 if (fClasses->getObject(sym) != NULL) {
4377 /* class with this name exists */
4378 ret = kIOReturnBadArgument;
4379 } else {
4380 if (fClasses->setObject(sym, cls)) {
4381 *pCls = cls;
4382 } else {
4383 /* could not add class to fClasses */
4384 ret = kIOReturnNoMemory;
4385 }
4386 }
4387 IOLockUnlock(fLock);
4388 cls->release();
4389 return ret;
4390 }
4391
4392 IOReturn
registerClass(OSClassDescription * desc,uint32_t size,OSSharedPtr<OSUserMetaClass> & pCls)4393 IOUserServer::registerClass(OSClassDescription * desc, uint32_t size, OSSharedPtr<OSUserMetaClass>& pCls)
4394 {
4395 OSUserMetaClass* pClsRaw = NULL;
4396 IOReturn result = registerClass(desc, size, &pClsRaw);
4397 if (result == kIOReturnSuccess) {
4398 pCls.reset(pClsRaw, OSRetain);
4399 }
4400 return result;
4401 }
4402
4403 IOReturn
setRootQueue(IODispatchQueue * queue)4404 IOUserServer::setRootQueue(IODispatchQueue * queue)
4405 {
4406 assert(!fRootQueue);
4407 if (fRootQueue) {
4408 return kIOReturnStillOpen;
4409 }
4410 queue->retain();
4411 fRootQueue = queue;
4412
4413 return kIOReturnSuccess;
4414 }
4415
4416
4417 IOReturn
externalMethod(uint32_t selector,IOExternalMethodArgumentsOpaque * args)4418 IOUserServer::externalMethod(uint32_t selector, IOExternalMethodArgumentsOpaque * args)
4419 {
4420 static const IOExternalMethodDispatch2022 dispatchArray[] = {
4421 [kIOUserServerMethodRegisterClass] = {
4422 .function = &IOUserServer::externalMethodRegisterClass,
4423 .checkScalarInputCount = 0,
4424 .checkStructureInputSize = kIOUCVariableStructureSize,
4425 .checkScalarOutputCount = 2,
4426 .checkStructureOutputSize = 0,
4427 .allowAsync = false,
4428 .checkEntitlement = NULL,
4429 },
4430 [kIOUserServerMethodStart] = {
4431 .function = &IOUserServer::externalMethodStart,
4432 .checkScalarInputCount = 1,
4433 .checkStructureInputSize = 0,
4434 .checkScalarOutputCount = 1,
4435 .checkStructureOutputSize = 0,
4436 .allowAsync = false,
4437 .checkEntitlement = NULL,
4438 },
4439 };
4440
4441 return dispatchExternalMethod(selector, args, dispatchArray, sizeof(dispatchArray) / sizeof(dispatchArray[0]), this, NULL);
4442 }
4443
4444 IOReturn
externalMethodRegisterClass(OSObject * target,void * reference,IOExternalMethodArguments * args)4445 IOUserServer::externalMethodRegisterClass(OSObject * target, void * reference, IOExternalMethodArguments * args)
4446 {
4447 IOReturn ret = kIOReturnBadArgument;
4448 mach_port_name_t portname;
4449
4450 IOUserServer * me = (typeof(me))target;
4451
4452 OSUserMetaClass * cls;
4453 if (!args->structureInputSize) {
4454 return kIOReturnBadArgument;
4455 }
4456
4457 ret = me->registerClass((OSClassDescription *) args->structureInput, args->structureInputSize, &cls);
4458 if (kIOReturnSuccess == ret) {
4459 portname = iokit_make_send_right(me->fOwningTask, cls, IKOT_UEXT_OBJECT);
4460 assert(portname);
4461 args->scalarOutput[0] = portname;
4462 args->scalarOutput[1] = kOSObjectRPCRemote;
4463 }
4464
4465 return ret;
4466 }
4467
4468 IOReturn
externalMethodStart(OSObject * target,void * reference,IOExternalMethodArguments * args)4469 IOUserServer::externalMethodStart(OSObject * target, void * reference, IOExternalMethodArguments * args)
4470 {
4471 mach_port_name_t portname;
4472
4473 IOUserServer * me = (typeof(me))target;
4474
4475 if (!(kIODKDisableCheckInTokenVerification & gIODKDebug)) {
4476 mach_port_name_t checkInPortName = ((typeof(checkInPortName))args->scalarInput[0]);
4477 OSObject * obj = iokit_lookup_object_with_port_name(checkInPortName, IKOT_IOKIT_IDENT, me->fOwningTask);
4478 IOUserServerCheckInToken * retrievedToken = OSDynamicCast(IOUserServerCheckInToken, obj);
4479 if (retrievedToken != NULL) {
4480 me->setCheckInToken(retrievedToken);
4481 } else {
4482 OSSafeReleaseNULL(obj);
4483 return kIOReturnBadArgument;
4484 }
4485 OSSafeReleaseNULL(obj);
4486 }
4487 portname = iokit_make_send_right(me->fOwningTask, me, IKOT_UEXT_OBJECT);
4488 assert(portname);
4489 args->scalarOutput[0] = portname;
4490 return kIOReturnSuccess;
4491 }
4492 IOExternalTrap *
getTargetAndTrapForIndex(IOService ** targetP,UInt32 index)4493 IOUserServer::getTargetAndTrapForIndex( IOService **targetP, UInt32 index )
4494 {
4495 static const OSBoundedArray<IOExternalTrap, 1> trapTemplate = {{
4496 { NULL, (IOTrap) & IOUserServer::waitInterruptTrap},
4497 }};
4498 if (index >= trapTemplate.size()) {
4499 return NULL;
4500 }
4501 *targetP = this;
4502 return (IOExternalTrap *)&trapTemplate[index];
4503 }
4504
4505 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4506
4507 IOReturn
serviceAttach(IOService * service,IOService * provider)4508 IOUserServer::serviceAttach(IOService * service, IOService * provider)
4509 {
4510 IOReturn ret;
4511 OSObjectUserVars * vars;
4512 OSObject * prop;
4513 OSString * str;
4514 OSSymbol const* bundleID;
4515 char execPath[1024];
4516
4517 vars = IOMallocType(OSObjectUserVars);
4518 service->reserved->uvars = vars;
4519
4520 vars->userServer = this;
4521 vars->userServer->retain();
4522 vars->uvarsLock = IOLockAlloc();
4523 IOLockLock(fLock);
4524 if (-1U == fServices->getNextIndexOfObject(service, 0)) {
4525 fServices->setObject(service);
4526
4527 // Add to IOAssociatedServices
4528 OSObject * serviceArrayObj = copyProperty(gIOAssociatedServicesKey);
4529 OSArray * serviceArray = OSDynamicCast(OSArray, serviceArrayObj);
4530 if (!serviceArray) {
4531 serviceArray = OSArray::withCapacity(0);
4532 } else {
4533 serviceArray = OSDynamicCast(OSArray, serviceArray->copyCollection());
4534 assert(serviceArray != NULL);
4535 }
4536
4537 OSNumber * registryEntryNumber = OSNumber::withNumber(service->getRegistryEntryID(), 64);
4538 serviceArray->setObject(registryEntryNumber);
4539 setProperty(gIOAssociatedServicesKey, serviceArray);
4540 OSSafeReleaseNULL(registryEntryNumber);
4541 OSSafeReleaseNULL(serviceArray);
4542 OSSafeReleaseNULL(serviceArrayObj);
4543
4544 // populate kIOUserClassesKey
4545
4546 OSUserMetaClass * userMeta;
4547 OSArray * classesArray;
4548 const OSString * str2;
4549
4550 classesArray = OSArray::withCapacity(4);
4551 prop = service->copyProperty(gIOUserClassKey);
4552 str2 = OSDynamicCast(OSString, prop);
4553 userMeta = (typeof(userMeta))service->reserved->uvars->userServer->fClasses->getObject(str2);
4554 while (str2 && userMeta) {
4555 classesArray->setObject(str2);
4556 userMeta = userMeta->superMeta;
4557 if (userMeta) {
4558 str2 = userMeta->name;
4559 }
4560 }
4561 service->setProperty(gIOUserClassesKey, classesArray);
4562 OSSafeReleaseNULL(classesArray);
4563 OSSafeReleaseNULL(prop);
4564 }
4565 IOLockUnlock(fLock);
4566
4567 prop = service->copyProperty(gIOUserClassKey);
4568 str = OSDynamicCast(OSString, prop);
4569 if (str) {
4570 service->setName(str);
4571 }
4572 OSSafeReleaseNULL(prop);
4573
4574 prop = service->copyProperty(gIOModuleIdentifierKey);
4575 bundleID = OSDynamicCast(OSSymbol, prop);
4576 if (bundleID) {
4577 execPath[0] = 0;
4578 bool ok = OSKext::copyUserExecutablePath(bundleID, execPath, sizeof(execPath));
4579 if (ok) {
4580 ret = LoadModule(execPath);
4581 if (kIODKLogSetup & gIODKDebug) {
4582 DKLOG("%s::LoadModule 0x%x %s\n", getName(), ret, execPath);
4583 }
4584 }
4585 }
4586 OSSafeReleaseNULL(prop);
4587
4588 ret = kIOReturnSuccess;
4589
4590 return ret;
4591 }
4592
4593 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4594
4595 IOReturn
serviceNewUserClient(IOService * service,task_t owningTask,void * securityID,uint32_t type,OSDictionary * properties,IOUserClient ** handler)4596 IOUserServer::serviceNewUserClient(IOService * service, task_t owningTask, void * securityID,
4597 uint32_t type, OSDictionary * properties, IOUserClient ** handler)
4598 {
4599 IOReturn ret;
4600 IOUserClient * uc;
4601 IOUserUserClient * userUC;
4602 OSDictionary * entitlements;
4603 OSObject * prop;
4604 OSObject * bundleID;
4605 bool ok = false;
4606
4607 entitlements = IOUserClient::copyClientEntitlements(owningTask);
4608 if (!entitlements) {
4609 entitlements = OSDictionary::withCapacity(8);
4610 }
4611 if (entitlements) {
4612 if (kIOReturnSuccess == clientHasPrivilege((void *) owningTask, kIOClientPrivilegeAdministrator)) {
4613 entitlements->setObject(kIODriverKitUserClientEntitlementAdministratorKey, kOSBooleanTrue);
4614 }
4615 OSString * creatorName = IOCopyLogNameForPID(proc_selfpid());
4616 if (creatorName) {
4617 entitlements->setObject(kIOUserClientCreatorKey, creatorName);
4618 OSSafeReleaseNULL(creatorName);
4619 }
4620 }
4621
4622 *handler = NULL;
4623 ret = service->_NewUserClient(type, entitlements, &uc);
4624 if (kIOReturnSuccess != ret) {
4625 OSSafeReleaseNULL(entitlements);
4626 return ret;
4627 }
4628 userUC = OSDynamicCast(IOUserUserClient, uc);
4629 if (!userUC) {
4630 uc->terminate(kIOServiceTerminateNeedWillTerminate);
4631 uc->setTerminateDefer(service, false);
4632 OSSafeReleaseNULL(uc);
4633 OSSafeReleaseNULL(entitlements);
4634 return kIOReturnUnsupported;
4635 }
4636 userUC->setTask(owningTask);
4637
4638 if (!(kIODKDisableEntitlementChecking & gIODKDebug)) {
4639 do {
4640 bool checkiOS3pEntitlements;
4641
4642 // check if client has com.apple.private.driverkit.driver-access and the required entitlements match the driver's entitlements
4643 if (entitlements && (prop = entitlements->getObject(gIODriverKitRequiredEntitlementsKey))) {
4644 prop->retain();
4645 ok = checkEntitlements(fEntitlements, prop, NULL, NULL);
4646 if (ok) {
4647 break;
4648 } else {
4649 DKLOG(DKS ":UC failed required entitlement check\n", DKN(userUC));
4650 }
4651 }
4652
4653 #if XNU_TARGET_OS_IOS
4654 checkiOS3pEntitlements = !fPlatformDriver;
4655 if (checkiOS3pEntitlements && fTeamIdentifier == NULL) {
4656 DKLOG("warning: " DKS " does not have a team identifier\n", DKN(this));
4657 }
4658 #else
4659 checkiOS3pEntitlements = false;
4660 #endif
4661 if (checkiOS3pEntitlements) {
4662 // App must have com.apple.developer.driverkit.communicates-with-drivers
4663 ok = entitlements && entitlements->getObject(gIODriverKitUserClientEntitlementCommunicatesWithDriversKey) == kOSBooleanTrue;
4664 if (ok) {
4665 // check team ID
4666 const char * clientTeamID = csproc_get_teamid(current_proc());
4667 bool sameTeam = fTeamIdentifier != NULL && clientTeamID != NULL && strncmp(fTeamIdentifier->getCStringNoCopy(), clientTeamID, CS_MAX_TEAMID_LEN) == 0;
4668
4669 if (sameTeam) {
4670 ok = true;
4671 } else {
4672 // different team IDs, dext must have com.apple.developer.driverkit.allow-third-party-userclients
4673 ok = fEntitlements && fEntitlements->getObject(gIODriverKitUserClientEntitlementAllowThirdPartyUserClientsKey) == kOSBooleanTrue;
4674 }
4675 if (!ok) {
4676 DKLOG(DKS ":UC failed team ID check. client team=%s, driver team=%s\n", DKN(userUC), clientTeamID ? clientTeamID : "(null)", fTeamIdentifier ? fTeamIdentifier->getCStringNoCopy() : "(null)");
4677 }
4678 } else {
4679 DKLOG(DKS ":UC entitlement check failed, app does not have %s entitlement\n", DKN(userUC), gIODriverKitUserClientEntitlementCommunicatesWithDriversKey->getCStringNoCopy());
4680 }
4681
4682 // When checking iOS 3rd party entitlements, do not fall through to other entitlement checks
4683 break;
4684 }
4685
4686 // first party dexts and third party macOS dexts
4687
4688 // check if driver has com.apple.developer.driverkit.allow-any-userclient-access
4689 if (fEntitlements && fEntitlements->getObject(gIODriverKitUserClientEntitlementAllowAnyKey)) {
4690 ok = true;
4691 break;
4692 }
4693
4694 // check if client has com.apple.developer.driverkit.userclient-access and its value matches the bundle ID of the service
4695 bundleID = service->copyProperty(gIOModuleIdentifierKey);
4696 ok = (entitlements
4697 && bundleID
4698 && (prop = entitlements->getObject(gIODriverKitUserClientEntitlementsKey)));
4699 if (ok) {
4700 bool found __block = false;
4701 ok = prop->iterateObjects(^bool (OSObject * object) {
4702 found = object->isEqualTo(bundleID);
4703 return found;
4704 });
4705 ok = found;
4706 } else {
4707 OSString * bundleIDStr = OSDynamicCast(OSString, bundleID);
4708 DKLOG(DKS ":UC failed userclient-access check, needed bundle ID %s\n", DKN(userUC), bundleIDStr ? bundleIDStr->getCStringNoCopy() : "(null)");
4709 }
4710 OSSafeReleaseNULL(bundleID);
4711 } while (false);
4712
4713 if (ok) {
4714 prop = userUC->copyProperty(gIOServiceDEXTEntitlementsKey);
4715 ok = checkEntitlements(entitlements, prop, NULL, NULL);
4716 }
4717
4718 if (!ok) {
4719 DKLOG(DKS ":UC entitlements check failed\n", DKN(userUC));
4720 uc->terminate(kIOServiceTerminateNeedWillTerminate);
4721 uc->setTerminateDefer(service, false);
4722 OSSafeReleaseNULL(uc);
4723 OSSafeReleaseNULL(entitlements);
4724 return kIOReturnNotPermitted;
4725 }
4726 }
4727
4728 OSSafeReleaseNULL(entitlements);
4729 *handler = userUC;
4730
4731 return ret;
4732 }
4733
4734 IOReturn
serviceNewUserClient(IOService * service,task_t owningTask,void * securityID,uint32_t type,OSDictionary * properties,OSSharedPtr<IOUserClient> & handler)4735 IOUserServer::serviceNewUserClient(IOService * service, task_t owningTask, void * securityID,
4736 uint32_t type, OSDictionary * properties, OSSharedPtr<IOUserClient>& handler)
4737 {
4738 IOUserClient* handlerRaw = NULL;
4739 IOReturn result = serviceNewUserClient(service, owningTask, securityID, type, properties, &handlerRaw);
4740 handler.reset(handlerRaw, OSNoRetain);
4741 return result;
4742 }
4743
4744 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4745
4746 static IOPMPowerState
4747 sPowerStates[] = {
4748 { .version = kIOPMPowerStateVersion1,
4749 .capabilityFlags = 0,
4750 .outputPowerCharacter = 0,
4751 .inputPowerRequirement = 0},
4752 { .version = kIOPMPowerStateVersion1,
4753 .capabilityFlags = kIOPMLowPower,
4754 .outputPowerCharacter = kIOPMLowPower,
4755 .inputPowerRequirement = kIOPMLowPower},
4756 { .version = kIOPMPowerStateVersion1,
4757 .capabilityFlags = kIOPMPowerOn,
4758 .outputPowerCharacter = kIOPMPowerOn,
4759 .inputPowerRequirement = kIOPMPowerOn},
4760 };
4761
4762 enum {
4763 kUserServerMaxPowerState = 2
4764 };
4765
4766 IOReturn
serviceJoinPMTree(IOService * service)4767 IOUserServer::serviceJoinPMTree(IOService * service)
4768 {
4769 IOReturn ret;
4770 IOService * pmProvider;
4771 bool joinTree;
4772
4773 if (service->reserved->uvars->userServerPM) {
4774 return kIOReturnSuccess;
4775 }
4776
4777 if (!fRootNotifier) {
4778 ret = registerPowerDriver(this, sPowerStates, sizeof(sPowerStates) / sizeof(sPowerStates[0]));
4779 assert(kIOReturnSuccess == ret);
4780 IOServicePH::serverAdd(this);
4781 fRootNotifier = true;
4782 }
4783
4784 joinTree = false;
4785 if (!(kIODKDisablePM & gIODKDebug) && !service->pm_vars) {
4786 kern_return_t kr;
4787 OSDictionary * props;
4788 kr = service->CopyProperties_Local(&props);
4789 if (kIOReturnSuccess == kr) {
4790 if (props->getObject(kIOPMResetPowerStateOnWakeKey) == kOSBooleanTrue) {
4791 service->setProperty(kIOPMResetPowerStateOnWakeKey, kOSBooleanTrue);
4792 }
4793 OSSafeReleaseNULL(props);
4794 }
4795 service->PMinit();
4796 ret = service->registerPowerDriver(this, sPowerStates, sizeof(sPowerStates) / sizeof(sPowerStates[0]));
4797 assert(kIOReturnSuccess == ret);
4798 joinTree = true;
4799 }
4800
4801 pmProvider = service;
4802 while (pmProvider && !pmProvider->inPlane(gIOPowerPlane)) {
4803 pmProvider = pmProvider->getProvider();
4804 }
4805 if (!pmProvider) {
4806 pmProvider = getPMRootDomain();
4807 }
4808 if (pmProvider) {
4809 IOService * entry;
4810 OSObject * prop;
4811 OSObject * nextProp;
4812 OSString * str;
4813
4814 entry = pmProvider;
4815 prop = NULL;
4816 do {
4817 nextProp = entry->copyProperty("non-removable");
4818 if (nextProp) {
4819 OSSafeReleaseNULL(prop);
4820 prop = nextProp;
4821 }
4822 entry = entry->getProvider();
4823 } while (entry);
4824 if (prop) {
4825 str = OSDynamicCast(OSString, prop);
4826 if (str && str->isEqualTo("yes")) {
4827 pmProvider = NULL;
4828 }
4829 prop->release();
4830 }
4831 }
4832
4833 if (!(kIODKDisablePM & gIODKDebug) && pmProvider) {
4834 IOLockLock(fLock);
4835 service->reserved->uvars->powerState = true;
4836 IOLockUnlock(fLock);
4837
4838 if (joinTree) {
4839 pmProvider->joinPMtree(service);
4840 service->reserved->uvars->userServerPM = true;
4841 service->reserved->uvars->resetPowerOnWake = service->propertyExists(kIOPMResetPowerStateOnWakeKey);
4842 }
4843 }
4844
4845 service->registerInterestedDriver(this);
4846 return kIOReturnSuccess;
4847 }
4848
4849 IOReturn
setPowerState(unsigned long state,IOService * service)4850 IOUserServer::setPowerState(unsigned long state, IOService * service)
4851 {
4852 if (kIODKLogPM & gIODKDebug) {
4853 DKLOG(DKS "::setPowerState(%ld) %d\n", DKN(service), state, fSystemPowerAck);
4854 }
4855 return kIOPMAckImplied;
4856 }
4857
4858
4859 IOReturn
serviceSetPowerState(IOService * controllingDriver,IOService * service,IOPMPowerFlags flags,unsigned long state)4860 IOUserServer::serviceSetPowerState(IOService * controllingDriver, IOService * service, IOPMPowerFlags flags, unsigned long state)
4861 {
4862 IOReturn ret;
4863 bool sendIt = false;
4864
4865 IOLockLock(fLock);
4866 if (service->reserved->uvars) {
4867 if (!fSystemOff && !(kIODKDisablePM & gIODKDebug)) {
4868 OSDictionary * wakeDescription;
4869 OSObject * prop;
4870 char wakeReasonString[128];
4871
4872 wakeDescription = OSDictionary::withCapacity(4);
4873 if (wakeDescription) {
4874 wakeReasonString[0] = 0;
4875 getPMRootDomain()->copyWakeReasonString(wakeReasonString, sizeof(wakeReasonString));
4876
4877 if (wakeReasonString[0]) {
4878 prop = OSString::withCString(&wakeReasonString[0]);
4879 wakeDescription->setObject(gIOSystemStateWakeDescriptionWakeReasonKey, prop);
4880 OSSafeReleaseNULL(prop);
4881 }
4882 getSystemStateNotificationService()->StateNotificationItemSet(gIOSystemStateWakeDescriptionKey, wakeDescription);
4883 OSSafeReleaseNULL(wakeDescription);
4884 }
4885
4886 service->reserved->uvars->willPower = true;
4887 service->reserved->uvars->willPowerState = state;
4888 service->reserved->uvars->controllingDriver = controllingDriver;
4889 sendIt = true;
4890 } else {
4891 service->reserved->uvars->willPower = false;
4892 }
4893 }
4894 IOLockUnlock(fLock);
4895
4896 if (sendIt) {
4897 if (kIODKLogPM & gIODKDebug) {
4898 DKLOG(DKS "::serviceSetPowerState(%ld) %d\n", DKN(service), state, fSystemPowerAck);
4899 }
4900 ret = service->SetPowerState((uint32_t) flags);
4901 if (kIOReturnSuccess == ret) {
4902 return 20 * 1000 * 1000;
4903 } else {
4904 IOLockLock(fLock);
4905 service->reserved->uvars->willPower = false;
4906 IOLockUnlock(fLock);
4907 }
4908 }
4909
4910 return kIOPMAckImplied;
4911 }
4912
4913 IOReturn
powerStateWillChangeTo(IOPMPowerFlags flags,unsigned long state,IOService * service)4914 IOUserServer::powerStateWillChangeTo(IOPMPowerFlags flags, unsigned long state, IOService * service)
4915 {
4916 return kIOPMAckImplied;
4917 }
4918
4919 IOReturn
powerStateDidChangeTo(IOPMPowerFlags flags,unsigned long state,IOService * service)4920 IOUserServer::powerStateDidChangeTo(IOPMPowerFlags flags, unsigned long state, IOService * service)
4921 {
4922 unsigned int idx;
4923 bool pmAck;
4924
4925 pmAck = false;
4926 IOLockLock(fLock);
4927 idx = fServices->getNextIndexOfObject(service, 0);
4928 if (-1U == idx) {
4929 IOLockUnlock(fLock);
4930 return kIOPMAckImplied;
4931 }
4932
4933 service->reserved->uvars->powerState = (0 != state);
4934 bool allPowerStates __block = service->reserved->uvars->powerState;
4935 if (!allPowerStates) {
4936 // any service on?
4937 fServices->iterateObjects(^bool (OSObject * obj) {
4938 int service __unused; // hide outer defn
4939 IOService * nextService;
4940 nextService = (IOService *) obj;
4941 allPowerStates = nextService->reserved->uvars->powerState;
4942 // early terminate if true
4943 return allPowerStates;
4944 });
4945 }
4946 if (kIODKLogPM & gIODKDebug) {
4947 DKLOG(DKS "::powerStateDidChangeTo(%ld) %d, %d\n", DKN(service), state, allPowerStates, fSystemPowerAck);
4948 }
4949 if (!allPowerStates && (pmAck = fSystemPowerAck)) {
4950 fSystemPowerAck = false;
4951 fSystemOff = true;
4952 }
4953 IOLockUnlock(fLock);
4954
4955 if (pmAck) {
4956 IOServicePH::serverAck(this);
4957 }
4958
4959 return kIOPMAckImplied;
4960 }
4961
4962 bool
checkPMReady()4963 IOUserServer::checkPMReady()
4964 {
4965 bool __block ready = true;
4966
4967 IOLockLock(fLock);
4968 // Check if any services have not completely joined the PM tree (i.e.
4969 // addPowerChild has not compeleted).
4970 fServices->iterateObjects(^bool (OSObject * obj) {
4971 IOPowerConnection *conn;
4972 IOService *service = (IOService *) obj;
4973 IORegistryEntry *parent = service->getParentEntry(gIOPowerPlane);
4974 if ((conn = OSDynamicCast(IOPowerConnection, parent))) {
4975 if (!conn->getReadyFlag()) {
4976 ready = false;
4977 return true;
4978 }
4979 }
4980 return false;
4981 });
4982 IOLockUnlock(fLock);
4983
4984 return ready;
4985 }
4986
4987 kern_return_t
JoinPMTree_Impl(void)4988 IOService::JoinPMTree_Impl(void)
4989 {
4990 if (!reserved->uvars || !reserved->uvars->userServer) {
4991 return kIOReturnNotReady;
4992 }
4993 return reserved->uvars->userServer->serviceJoinPMTree(this);
4994 }
4995
4996 kern_return_t
SetPowerState_Impl(uint32_t powerFlags)4997 IOService::SetPowerState_Impl(
4998 uint32_t powerFlags)
4999 {
5000 if (kIODKLogPM & gIODKDebug) {
5001 DKLOG(DKS "::SetPowerState(%d), %d\n", DKN(this), powerFlags, reserved->uvars->willPower);
5002 }
5003 if (reserved->uvars
5004 && reserved->uvars->userServer
5005 && reserved->uvars->willPower) {
5006 IOReturn ret;
5007 reserved->uvars->willPower = false;
5008 ret = reserved->uvars->controllingDriver->setPowerState(reserved->uvars->willPowerState, this);
5009 if (kIOPMAckImplied == ret) {
5010 acknowledgeSetPowerState();
5011 }
5012 return kIOReturnSuccess;
5013 }
5014 return kIOReturnNotReady;
5015 }
5016
5017 kern_return_t
ChangePowerState_Impl(uint32_t powerFlags)5018 IOService::ChangePowerState_Impl(
5019 uint32_t powerFlags)
5020 {
5021 switch (powerFlags) {
5022 case kIOServicePowerCapabilityOff:
5023 changePowerStateToPriv(0);
5024 break;
5025 case kIOServicePowerCapabilityLow:
5026 changePowerStateToPriv(1);
5027 break;
5028 case kIOServicePowerCapabilityOn:
5029 changePowerStateToPriv(2);
5030 break;
5031 default:
5032 return kIOReturnBadArgument;
5033 }
5034
5035 return kIOReturnSuccess;
5036 }
5037
5038 kern_return_t
_ClaimSystemWakeEvent_Impl(IOService * device,uint64_t flags,const char * reason,OSContainer * details)5039 IOService::_ClaimSystemWakeEvent_Impl(
5040 IOService * device,
5041 uint64_t flags,
5042 const char * reason,
5043 OSContainer * details)
5044 {
5045 IOPMrootDomain * rootDomain;
5046 IOOptionBits pmFlags;
5047
5048 rootDomain = getPMRootDomain();
5049 if (!rootDomain) {
5050 return kIOReturnNotReady;
5051 }
5052 if (os_convert_overflow(flags, &pmFlags)) {
5053 return kIOReturnBadArgument;
5054 }
5055 rootDomain->claimSystemWakeEvent(device, pmFlags, reason, details);
5056
5057 return kIOReturnSuccess;
5058 }
5059
5060 kern_return_t
Create_Impl(IOService * provider,const char * propertiesKey,IOService ** result)5061 IOService::Create_Impl(
5062 IOService * provider,
5063 const char * propertiesKey,
5064 IOService ** result)
5065 {
5066 OSObject * inst;
5067 IOService * service;
5068 OSString * str;
5069 const OSSymbol * sym;
5070 OSObject * prop = NULL;
5071 OSObject * moduleIdentifier = NULL;
5072 OSObject * userServerName = NULL;
5073 OSDictionary * properties = NULL;
5074 OSDictionary * copyProperties = NULL;
5075 kern_return_t ret;
5076
5077 if (provider != this) {
5078 return kIOReturnUnsupported;
5079 }
5080
5081 ret = kIOReturnUnsupported;
5082 inst = NULL;
5083 service = NULL;
5084
5085 prop = copyProperty(propertiesKey);
5086 properties = OSDynamicCast(OSDictionary, prop);
5087 if (!properties) {
5088 ret = kIOReturnBadArgument;
5089 goto finish;
5090 }
5091 copyProperties = OSDynamicCast(OSDictionary, properties->copyCollection());
5092 if (!copyProperties) {
5093 ret = kIOReturnNoMemory;
5094 goto finish;
5095 }
5096 moduleIdentifier = copyProperty(gIOModuleIdentifierKey);
5097 if (moduleIdentifier) {
5098 copyProperties->setObject(gIOModuleIdentifierKey, moduleIdentifier);
5099 }
5100 userServerName = reserved->uvars->userServer->copyProperty(gIOUserServerNameKey);
5101 if (userServerName) {
5102 copyProperties->setObject(gIOUserServerNameKey, userServerName);
5103 }
5104
5105 str = OSDynamicCast(OSString, copyProperties->getObject(gIOClassKey));
5106 if (!str) {
5107 ret = kIOReturnBadArgument;
5108 goto finish;
5109 }
5110 sym = OSSymbol::withString(str);
5111 if (sym) {
5112 inst = OSMetaClass::allocClassWithName(sym);
5113 service = OSDynamicCast(IOService, inst);
5114 if (service && service->init(copyProperties) && service->attach(this)) {
5115 reserved->uvars->userServer->serviceAttach(service, this);
5116 service->reserved->uvars->started = true;
5117 ret = kIOReturnSuccess;
5118 *result = service;
5119 }
5120 OSSafeReleaseNULL(sym);
5121 }
5122
5123 finish:
5124 OSSafeReleaseNULL(prop);
5125 OSSafeReleaseNULL(copyProperties);
5126 OSSafeReleaseNULL(moduleIdentifier);
5127 OSSafeReleaseNULL(userServerName);
5128 if (kIOReturnSuccess != ret) {
5129 OSSafeReleaseNULL(inst);
5130 }
5131
5132 return ret;
5133 }
5134
5135 kern_return_t
Terminate_Impl(uint64_t options)5136 IOService::Terminate_Impl(
5137 uint64_t options)
5138 {
5139 IOUserServer * us;
5140
5141 if (options) {
5142 return kIOReturnUnsupported;
5143 }
5144
5145 us = (typeof(us))thread_iokit_tls_get(0);
5146 if (us && (!reserved->uvars
5147 || (reserved->uvars->userServer != us))) {
5148 return kIOReturnNotPermitted;
5149 }
5150 terminate(kIOServiceTerminateNeedWillTerminate);
5151
5152 return kIOReturnSuccess;
5153 }
5154
5155 kern_return_t
NewUserClient_Impl(uint32_t type,IOUserClient ** userClient)5156 IOService::NewUserClient_Impl(
5157 uint32_t type,
5158 IOUserClient ** userClient)
5159 {
5160 return kIOReturnError;
5161 }
5162
5163 kern_return_t
_NewUserClient_Impl(uint32_t type,OSDictionary * entitlements,IOUserClient ** userClient)5164 IOService::_NewUserClient_Impl(
5165 uint32_t type,
5166 OSDictionary * entitlements,
5167 IOUserClient ** userClient)
5168 {
5169 return kIOReturnError;
5170 }
5171
5172 kern_return_t
SearchProperty_Impl(const char * name,const char * plane,uint64_t options,OSContainer ** property)5173 IOService::SearchProperty_Impl(
5174 const char * name,
5175 const char * plane,
5176 uint64_t options,
5177 OSContainer ** property)
5178 {
5179 OSObject * object __block;
5180 IOService * provider;
5181 IOOptionBits regOptions;
5182
5183 if (kIOServiceSearchPropertyParents & options) {
5184 regOptions = kIORegistryIterateParents | kIORegistryIterateRecursively;
5185 } else {
5186 regOptions = 0;
5187 }
5188
5189 object = copyProperty(name, IORegistryEntry::getPlane(plane), regOptions);
5190
5191 if (NULL == object) {
5192 for (provider = this; provider; provider = provider->getProvider()) {
5193 provider->runPropertyActionBlock(^IOReturn (void) {
5194 OSDictionary * userProps;
5195 object = provider->getProperty(name);
5196 if (!object
5197 && (userProps = OSDynamicCast(OSDictionary, provider->getProperty(gIOUserServicePropertiesKey)))) {
5198 object = userProps->getObject(name);
5199 }
5200 if (object) {
5201 object->retain();
5202 }
5203 return kIOReturnSuccess;
5204 });
5205 if (object || !(kIORegistryIterateParents & options)) {
5206 break;
5207 }
5208 }
5209 }
5210
5211 *property = object;
5212
5213 return object ? kIOReturnSuccess : kIOReturnNotFound;
5214 }
5215
5216 kern_return_t
StringFromReturn_Impl(IOReturn retval,OSString ** str)5217 IOService::StringFromReturn_Impl(
5218 IOReturn retval,
5219 OSString ** str)
5220 {
5221 OSString *obj = OSString::withCString(stringFromReturn(retval));
5222 *str = obj;
5223 return obj ? kIOReturnSuccess : kIOReturnError;
5224 }
5225
5226 #if PRIVATE_WIFI_ONLY
5227 const char *
StringFromReturn(IOReturn retval)5228 IOService::StringFromReturn(
5229 IOReturn retval)
5230 {
5231 return stringFromReturn(retval);
5232 }
5233 #endif /* PRIVATE_WIFI_ONLY */
5234
5235 kern_return_t
CopyProviderProperties_Impl(OSArray * propertyKeys,OSArray ** properties)5236 IOService::CopyProviderProperties_Impl(
5237 OSArray * propertyKeys,
5238 OSArray ** properties)
5239 {
5240 IOReturn ret;
5241 OSArray * result;
5242 IOService * provider;
5243
5244 result = OSArray::withCapacity(8);
5245 if (!result) {
5246 return kIOReturnNoMemory;
5247 }
5248
5249 ret = kIOReturnSuccess;
5250 for (provider = this; provider; provider = provider->getProvider()) {
5251 OSObject * obj;
5252 OSDictionary * props;
5253
5254 obj = provider->copyProperty(gIOSupportedPropertiesKey);
5255 props = OSDynamicCast(OSDictionary, obj);
5256 if (!props) {
5257 OSSafeReleaseNULL(obj);
5258 props = provider->dictionaryWithProperties();
5259 }
5260 if (!props) {
5261 ret = kIOReturnNoMemory;
5262 break;
5263 }
5264
5265 bool __block addClass = true;
5266 if (propertyKeys) {
5267 OSDictionary * retProps;
5268 retProps = OSDictionary::withCapacity(4);
5269 addClass = false;
5270 if (!retProps) {
5271 ret = kIOReturnNoMemory;
5272 OSSafeReleaseNULL(props);
5273 break;
5274 }
5275 propertyKeys->iterateObjects(^bool (OSObject * _key) {
5276 OSString * key = OSDynamicCast(OSString, _key);
5277 if (gIOClassKey->isEqualTo(key)) {
5278 addClass = true;
5279 return false;
5280 }
5281 retProps->setObject(key, props->getObject(key));
5282 return false;
5283 });
5284 OSSafeReleaseNULL(props);
5285 props = retProps;
5286 }
5287 if (addClass) {
5288 OSArray * classes = OSArray::withCapacity(8);
5289 if (!classes) {
5290 OSSafeReleaseNULL(props);
5291 ret = kIOReturnNoMemory;
5292 break;
5293 }
5294 for (const OSMetaClass * meta = provider->getMetaClass(); meta; meta = meta->getSuperClass()) {
5295 classes->setObject(meta->getClassNameSymbol());
5296 }
5297 props->setObject(gIOClassKey, classes);
5298 OSSafeReleaseNULL(classes);
5299 }
5300 bool ok = result->setObject(props);
5301 props->release();
5302 if (!ok) {
5303 ret = kIOReturnNoMemory;
5304 break;
5305 }
5306 }
5307 if (kIOReturnSuccess != ret) {
5308 OSSafeReleaseNULL(result);
5309 }
5310 *properties = result;
5311 return ret;
5312 }
5313
5314 IOReturn
AdjustBusy_Impl(int32_t delta)5315 IOService::AdjustBusy_Impl(int32_t delta)
5316 {
5317 adjustBusy(delta);
5318 return kIOReturnSuccess;
5319 }
5320
5321 IOReturn
GetBusyState_Impl(uint32_t * busyState)5322 IOService::GetBusyState_Impl(uint32_t *busyState)
5323 {
5324 *busyState = getBusyState();
5325 return kIOReturnSuccess;
5326 }
5327
5328 void
systemPower(bool powerOff)5329 IOUserServer::systemPower(bool powerOff)
5330 {
5331 OSArray * services;
5332 {
5333 OSDictionary * sleepDescription;
5334 OSObject * prop;
5335
5336 sleepDescription = OSDictionary::withCapacity(4);
5337 if (sleepDescription) {
5338 prop = getPMRootDomain()->copyProperty(kRootDomainSleepReasonKey);
5339 if (prop) {
5340 sleepDescription->setObject(gIOSystemStateSleepDescriptionReasonKey, prop);
5341 OSSafeReleaseNULL(prop);
5342 }
5343 prop = getPMRootDomain()->copyProperty(kIOHibernateStateKey);
5344 if (prop) {
5345 sleepDescription->setObject(gIOSystemStateSleepDescriptionHibernateStateKey, prop);
5346 OSSafeReleaseNULL(prop);
5347 }
5348 getSystemStateNotificationService()->StateNotificationItemSet(gIOSystemStateSleepDescriptionKey, sleepDescription);
5349 OSSafeReleaseNULL(sleepDescription);
5350 }
5351 }
5352
5353 IOLockLock(fLock);
5354
5355 services = OSArray::withArray(fServices);
5356
5357 bool allPowerStates __block = 0;
5358 // any service on?
5359 fServices->iterateObjects(^bool (OSObject * obj) {
5360 int service __unused; // hide outer defn
5361 IOService * nextService;
5362 nextService = (IOService *) obj;
5363 allPowerStates = nextService->reserved->uvars->powerState;
5364 // early terminate if true
5365 return allPowerStates;
5366 });
5367
5368 if (kIODKLogPM & gIODKDebug) {
5369 DKLOG("%s::powerOff(%d) %d\n", getName(), powerOff, allPowerStates);
5370 }
5371
5372 if (powerOff) {
5373 fSystemPowerAck = allPowerStates;
5374 if (!fSystemPowerAck) {
5375 fSystemOff = true;
5376 }
5377 IOLockUnlock(fLock);
5378
5379 if (!fSystemPowerAck) {
5380 IOServicePH::serverAck(this);
5381 } else {
5382 if (services) {
5383 services->iterateObjects(^bool (OSObject * obj) {
5384 int service __unused; // hide outer defn
5385 IOService * nextService;
5386 nextService = (IOService *) obj;
5387 if (kIODKLogPM & gIODKDebug) {
5388 DKLOG("changePowerStateWithOverrideTo(" DKS ", %d)\n", DKN(nextService), 0);
5389 }
5390 nextService->reserved->uvars->powerOverride = nextService->reserved->uvars->userServerPM ? kUserServerMaxPowerState : nextService->getPowerState();
5391 nextService->changePowerStateWithOverrideTo(0, 0);
5392 return false;
5393 });
5394 }
5395 }
5396 } else {
5397 fSystemOff = false;
5398 IOLockUnlock(fLock);
5399 if (services) {
5400 services->iterateObjects(^bool (OSObject * obj) {
5401 int service __unused; // hide outer defn
5402 IOService * nextService;
5403 nextService = (IOService *) obj;
5404 if (-1U != nextService->reserved->uvars->powerOverride) {
5405 if (kIODKLogPM & gIODKDebug) {
5406 DKLOG("%schangePowerStateWithOverrideTo(" DKS ", %d)\n", nextService->reserved->uvars->resetPowerOnWake ? "!" : "", DKN(nextService), nextService->reserved->uvars->powerOverride);
5407 }
5408 if (!nextService->reserved->uvars->resetPowerOnWake) {
5409 nextService->changePowerStateWithOverrideTo(nextService->reserved->uvars->powerOverride, 0);
5410 }
5411 nextService->reserved->uvars->powerOverride = -1U;
5412 }
5413 return false;
5414 });
5415 }
5416 }
5417 OSSafeReleaseNULL(services);
5418 }
5419
5420
5421 void
systemHalt(int howto)5422 IOUserServer::systemHalt(int howto)
5423 {
5424 OSArray * services;
5425
5426 if (true || (kIODKLogPM & gIODKDebug)) {
5427 DKLOG("%s::systemHalt()\n", getName());
5428 }
5429
5430 {
5431 OSDictionary * haltDescription;
5432 OSNumber * state;
5433 uint64_t haltStateFlags;
5434
5435 haltDescription = OSDictionary::withCapacity(4);
5436 if (haltDescription) {
5437 haltStateFlags = 0;
5438 if (RB_HALT & howto) {
5439 haltStateFlags |= kIOServiceHaltStatePowerOff;
5440 } else {
5441 haltStateFlags |= kIOServiceHaltStateRestart;
5442 }
5443 state = OSNumber::withNumber(haltStateFlags, 64);
5444 haltDescription->setObject(gIOSystemStateHaltDescriptionHaltStateKey, state);
5445 getSystemStateNotificationService()->StateNotificationItemSet(gIOSystemStateHaltDescriptionKey, haltDescription);
5446
5447 OSSafeReleaseNULL(state);
5448 OSSafeReleaseNULL(haltDescription);
5449 }
5450 }
5451
5452 IOLockLock(fLock);
5453 services = OSArray::withArray(fServices);
5454 IOLockUnlock(fLock);
5455
5456 if (services) {
5457 services->iterateObjects(^bool (OSObject * obj) {
5458 int service __unused; // hide outer defn
5459 IOService * nextService;
5460 IOService * provider;
5461 IOOptionBits terminateOptions;
5462 bool root;
5463
5464 nextService = (IOService *) obj;
5465 provider = nextService->getProvider();
5466 if (!provider) {
5467 DKLOG("stale service " DKS " found, skipping termination\n", DKN(nextService));
5468 return false;
5469 }
5470 root = (NULL == provider->getProperty(gIOUserServerNameKey, gIOServicePlane));
5471 if (true || (kIODKLogPM & gIODKDebug)) {
5472 DKLOG("%d: terminate(" DKS ")\n", root, DKN(nextService));
5473 }
5474 if (!root) {
5475 return false;
5476 }
5477 terminateOptions = kIOServiceRequired | kIOServiceTerminateNeedWillTerminate;
5478 if (!nextService->terminate(terminateOptions)) {
5479 IOLog("failed to terminate service %s-0x%llx\n", nextService->getName(), nextService->getRegistryEntryID());
5480 }
5481 return false;
5482 });
5483 }
5484 OSSafeReleaseNULL(services);
5485 }
5486
5487 void
powerSourceChanged(bool acAttached)5488 IOUserServer::powerSourceChanged(bool acAttached)
5489 {
5490 OSDictionary * powerSourceDescription;
5491
5492 powerSourceDescription = OSDictionary::withCapacity(4);
5493 if (!powerSourceDescription) {
5494 return;
5495 }
5496 powerSourceDescription->setObject(gIOSystemStatePowerSourceDescriptionACAttachedKey, acAttached ? kOSBooleanTrue : kOSBooleanFalse);
5497 getSystemStateNotificationService()->StateNotificationItemSet(gIOSystemStatePowerSourceDescriptionKey, powerSourceDescription);
5498
5499 OSSafeReleaseNULL(powerSourceDescription);
5500 }
5501
5502 IOReturn
serviceStarted(IOService * service,IOService * provider,bool result)5503 IOUserServer::serviceStarted(IOService * service, IOService * provider, bool result)
5504 {
5505 IOReturn ret;
5506
5507 DKLOG(DKS "::start(" DKS ") %s\n", DKN(service), DKN(provider), result ? "ok" : "fail");
5508
5509 if (!result) {
5510 ret = kIOReturnSuccess;
5511 return ret;
5512 }
5513
5514 ret = serviceJoinPMTree(service);
5515
5516 service->reserved->uvars->started = true;
5517
5518 if (service->reserved->uvars->deferredRegisterService) {
5519 service->registerService(kIOServiceAsynchronous | kIOServiceDextRequirePowerForMatching);
5520 service->reserved->uvars->deferredRegisterService = false;
5521 }
5522
5523 return kIOReturnSuccess;
5524 }
5525
5526
5527 IOReturn
serviceOpen(IOService * provider,IOService * client)5528 IOUserServer::serviceOpen(IOService * provider, IOService * client)
5529 {
5530 OSObjectUserVars * uvars;
5531 IOReturn ret;
5532
5533 IOLockLock(client->reserved->uvars->uvarsLock);
5534 uvars = client->reserved->uvars;
5535 if (uvars->willTerminate || uvars->stopped) {
5536 DKLOG(DKS "- " DKS " blocked attempt to open " DKS "\n", DKN(this), DKN(client), DKN(provider));
5537 ret = kIOReturnBadArgument;
5538 } else {
5539 if (!uvars->openProviders) {
5540 uvars->openProviders = OSArray::withObjects((const OSObject **) &provider, 1);
5541 } else if (-1U == uvars->openProviders->getNextIndexOfObject(provider, 0)) {
5542 uvars->openProviders->setObject(provider);
5543 }
5544 ret = kIOReturnSuccess;
5545 }
5546
5547 IOLockUnlock(client->reserved->uvars->uvarsLock);
5548
5549 return ret;
5550 }
5551
5552 IOReturn
serviceClose(IOService * provider,IOService * client)5553 IOUserServer::serviceClose(IOService * provider, IOService * client)
5554 {
5555 OSObjectUserVars * uvars;
5556 unsigned int idx;
5557 IOReturn ret;
5558
5559 IOLockLock(client->reserved->uvars->uvarsLock);
5560 uvars = client->reserved->uvars;
5561 if (!uvars->openProviders) {
5562 ret = kIOReturnNotOpen;
5563 goto finish;
5564 }
5565 idx = uvars->openProviders->getNextIndexOfObject(provider, 0);
5566 if (-1U == idx) {
5567 ret = kIOReturnNotOpen;
5568 goto finish;
5569 }
5570 uvars->openProviders->removeObject(idx);
5571 if (!uvars->openProviders->getCount()) {
5572 OSSafeReleaseNULL(uvars->openProviders);
5573 }
5574
5575 ret = kIOReturnSuccess;
5576
5577 finish:
5578 IOLockUnlock(client->reserved->uvars->uvarsLock);
5579
5580 return ret;
5581 }
5582
5583
5584 IOReturn
serviceStop(IOService * service,IOService *)5585 IOUserServer::serviceStop(IOService * service, IOService *)
5586 {
5587 IOReturn ret;
5588 uint32_t idx, queueAlloc;
5589 bool pmAck;
5590 OSObjectUserVars * uvars;
5591 IODispatchQueue ** unboundedQueueArray = NULL;
5592 pmAck = false;
5593 IOLockLock(fLock);
5594 idx = fServices->getNextIndexOfObject(service, 0);
5595 if (-1U != idx) {
5596 fServices->removeObject(idx);
5597
5598 // Remove the service from IOAssociatedServices
5599 OSObject * serviceArrayObj = copyProperty(gIOAssociatedServicesKey);
5600 OSArray * serviceArray = OSDynamicCast(OSArray, serviceArrayObj);
5601 assert(serviceArray != NULL);
5602
5603 serviceArray = OSDynamicCast(OSArray, serviceArray->copyCollection());
5604 assert(serviceArray != NULL);
5605
5606 // Index should be the same as it was in fServices
5607 OSNumber * __assert_only registryEntryID = OSDynamicCast(OSNumber, serviceArray->getObject(idx));
5608 assert(registryEntryID);
5609
5610 // ensure it is the right service
5611 assert(registryEntryID->unsigned64BitValue() == service->getRegistryEntryID());
5612 serviceArray->removeObject(idx);
5613
5614 setProperty(gIOAssociatedServicesKey, serviceArray);
5615 OSSafeReleaseNULL(serviceArray);
5616 OSSafeReleaseNULL(serviceArrayObj);
5617
5618 uvars = service->reserved->uvars;
5619 uvars->stopped = true;
5620 uvars->powerState = 0;
5621
5622 bool allPowerStates __block = 0;
5623 // any service on?
5624 fServices->iterateObjects(^bool (OSObject * obj) {
5625 int service __unused; // hide outer defn
5626 IOService * nextService;
5627 nextService = (IOService *) obj;
5628 allPowerStates = nextService->reserved->uvars->powerState;
5629 // early terminate if true
5630 return allPowerStates;
5631 });
5632
5633 if (!allPowerStates && (pmAck = fSystemPowerAck)) {
5634 fSystemPowerAck = false;
5635 fSystemOff = true;
5636 }
5637 }
5638 IOLockUnlock(fLock);
5639 if (pmAck) {
5640 IOServicePH::serverAck(this);
5641 }
5642
5643 if (-1U == idx) {
5644 return kIOReturnSuccess;
5645 }
5646
5647 if (uvars->queueArray && uvars->userMeta) {
5648 queueAlloc = 1;
5649 if (uvars->userMeta->queueNames) {
5650 queueAlloc += uvars->userMeta->queueNames->count;
5651 }
5652 for (idx = 0; idx < queueAlloc; idx++) {
5653 OSSafeReleaseNULL(uvars->queueArray[idx]);
5654 }
5655 unboundedQueueArray = uvars->queueArray.data();
5656 IOSafeDeleteNULL(unboundedQueueArray, IODispatchQueue *, queueAlloc);
5657 uvars->queueArray = OSBoundedArrayRef<IODispatchQueue *>();
5658 }
5659
5660 (void) service->deRegisterInterestedDriver(this);
5661 if (uvars->userServerPM) {
5662 service->PMstop();
5663 }
5664
5665 ret = kIOReturnSuccess;
5666 return ret;
5667 }
5668
5669 void
serviceFree(IOService * service)5670 IOUserServer::serviceFree(IOService * service)
5671 {
5672 OSObjectUserVars * uvars;
5673
5674 uvars = service->reserved->uvars;
5675 if (!uvars) {
5676 return;
5677 }
5678 OSSafeReleaseNULL(uvars->userServer);
5679 IOLockFree(uvars->uvarsLock);
5680 IOFreeType(service->reserved->uvars, OSObjectUserVars);
5681 }
5682
5683 void
serviceWillTerminate(IOService * client,IOService * provider,IOOptionBits options)5684 IOUserServer::serviceWillTerminate(IOService * client, IOService * provider, IOOptionBits options)
5685 {
5686 IOReturn ret;
5687 bool willTerminate;
5688
5689 willTerminate = false;
5690 IOLockLock(client->reserved->uvars->uvarsLock);
5691 if (!client->reserved->uvars->serverDied
5692 && !client->reserved->uvars->willTerminate) {
5693 client->reserved->uvars->willTerminate = true;
5694 willTerminate = true;
5695 }
5696 IOLockUnlock(client->reserved->uvars->uvarsLock);
5697
5698 if (willTerminate) {
5699 if (provider->isInactive() || IOServicePH::serverSlept()) {
5700 client->Stop_async(provider);
5701 ret = kIOReturnOffline;
5702 } else {
5703 ret = client->Stop(provider);
5704 }
5705 if (kIOReturnSuccess != ret) {
5706 IOUserServer::serviceDidStop(client, provider);
5707 ret = kIOReturnSuccess;
5708 }
5709 }
5710 }
5711
5712 void
serviceDidTerminate(IOService * client,IOService * provider,IOOptionBits options,bool * defer)5713 IOUserServer::serviceDidTerminate(IOService * client, IOService * provider, IOOptionBits options, bool * defer)
5714 {
5715 IOLockLock(client->reserved->uvars->uvarsLock);
5716 client->reserved->uvars->didTerminate = true;
5717 if (!client->reserved->uvars->serverDied
5718 && !client->reserved->uvars->stopped) {
5719 *defer = true;
5720 }
5721 IOLockUnlock(client->reserved->uvars->uvarsLock);
5722 }
5723
5724 void
serviceDidStop(IOService * client,IOService * provider)5725 IOUserServer::serviceDidStop(IOService * client, IOService * provider)
5726 {
5727 bool complete;
5728 OSArray * closeArray;
5729
5730 complete = false;
5731 closeArray = NULL;
5732
5733 IOLockLock(client->reserved->uvars->uvarsLock);
5734 if (client->reserved->uvars
5735 && client->reserved->uvars->willTerminate
5736 && !client->reserved->uvars->stopped) {
5737 client->reserved->uvars->stopped = true;
5738 complete = client->reserved->uvars->didTerminate;
5739 }
5740
5741 if (client->reserved->uvars) {
5742 closeArray = client->reserved->uvars->openProviders;
5743 client->reserved->uvars->openProviders = NULL;
5744 }
5745 IOLockUnlock(client->reserved->uvars->uvarsLock);
5746
5747 if (closeArray) {
5748 closeArray->iterateObjects(^bool (OSObject * obj) {
5749 IOService * toClose;
5750 toClose = OSDynamicCast(IOService, obj);
5751 if (toClose) {
5752 DKLOG(DKS ":force close (" DKS ")\n", DKN(client), DKN(toClose));
5753 toClose->close(client);
5754 }
5755 return false;
5756 });
5757 closeArray->release();
5758 }
5759
5760 if (complete) {
5761 bool defer = false;
5762 client->didTerminate(provider, 0, &defer);
5763 }
5764 }
5765
5766 kern_return_t
ClientCrashed_Impl(IOService * client,uint64_t options)5767 IOService::ClientCrashed_Impl(
5768 IOService * client,
5769 uint64_t options)
5770 {
5771 return kIOReturnUnsupported;
5772 }
5773
5774 kern_return_t
Stop_Impl(IOService * provider)5775 IOService::Stop_Impl(
5776 IOService * provider)
5777 {
5778 IOUserServer::serviceDidStop(this, provider);
5779
5780 return kIOReturnSuccess;
5781 }
5782
5783 void
Stop_async_Impl(IOService * provider)5784 IOService::Stop_async_Impl(
5785 IOService * provider)
5786 {
5787 }
5788
5789 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
5790
5791 #undef super
5792 #define super IOUserClient
5793
OSDefineMetaClassAndStructors(IOUserUserClient,IOUserClient)5794 OSDefineMetaClassAndStructors(IOUserUserClient, IOUserClient)
5795
5796 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
5797
5798 bool
5799 IOUserUserClient::init(OSDictionary * properties)
5800 {
5801 if (!super::init(properties)) {
5802 return false;
5803 }
5804
5805 fWorkGroups = OSDictionary::withCapacity(0);
5806 if (fWorkGroups == NULL) {
5807 return false;
5808 }
5809
5810 fEventLinks = OSDictionary::withCapacity(0);
5811 if (fEventLinks == NULL) {
5812 return false;
5813 }
5814
5815 fLock = IOLockAlloc();
5816
5817 return true;
5818 }
5819
5820 void
free()5821 IOUserUserClient::free()
5822 {
5823 OSSafeReleaseNULL(fWorkGroups);
5824 OSSafeReleaseNULL(fEventLinks);
5825 if (fLock) {
5826 IOLockFree(fLock);
5827 }
5828
5829 super::free();
5830 }
5831
5832 IOReturn
setTask(task_t task)5833 IOUserUserClient::setTask(task_t task)
5834 {
5835 task_reference(task);
5836 fTask = task;
5837
5838 return kIOReturnSuccess;
5839 }
5840
5841 void
stop(IOService * provider)5842 IOUserUserClient::stop(IOService * provider)
5843 {
5844 if (fTask) {
5845 task_deallocate(fTask);
5846 fTask = NULL;
5847 }
5848 super::stop(provider);
5849 }
5850
5851 IOReturn
clientClose(void)5852 IOUserUserClient::clientClose(void)
5853 {
5854 terminate(kIOServiceTerminateNeedWillTerminate);
5855 return kIOReturnSuccess;
5856 }
5857
5858 IOReturn
setProperties(OSObject * properties)5859 IOUserUserClient::setProperties(OSObject * properties)
5860 {
5861 IOReturn ret = kIOReturnUnsupported;
5862 return ret;
5863 }
5864
5865 // p1 - name of object
5866 // p2 - length of object name
5867 // p3 - mach port name
5868
5869 kern_return_t
eventlinkConfigurationTrap(void * p1,void * p2,void * p3,void * p4,void * p5,void * p6)5870 IOUserUserClient::eventlinkConfigurationTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6)
5871 {
5872 user_addr_t userObjectName = (user_addr_t)p1;
5873 mach_port_name_t portName = (mach_port_name_t)(uintptr_t)p3;
5874 mach_port_t port = MACH_PORT_NULL;
5875 ipc_kobject_type_t portType;
5876 char eventlinkName[kIOEventLinkMaxNameLength + 1] = {0};
5877 size_t eventLinkNameLen;
5878 OSString * eventlinkNameStr = NULL; // must release
5879 IOEventLink * eventLink = NULL; // do not release
5880 kern_return_t ret;
5881
5882 ret = copyinstr(userObjectName, &eventlinkName[0], sizeof(eventlinkName), &eventLinkNameLen);
5883 if (ret != kIOReturnSuccess) {
5884 goto finish;
5885 }
5886
5887 // ensure string length matches trap argument
5888 if (eventLinkNameLen != (size_t)p2 + 1) {
5889 ret = kIOReturnBadArgument;
5890 goto finish;
5891 }
5892
5893 eventlinkNameStr = OSString::withCStringNoCopy(eventlinkName);
5894 if (eventlinkNameStr == NULL) {
5895 ret = kIOReturnNoMemory;
5896 goto finish;
5897 }
5898
5899 IOLockLock(fLock);
5900 eventLink = OSDynamicCast(IOEventLink, fEventLinks->getObject(eventlinkNameStr));
5901 if (eventLink) {
5902 eventLink->retain();
5903 }
5904 IOLockUnlock(fLock);
5905
5906 if (eventLink == NULL) {
5907 ret = kIOReturnNotFound;
5908 goto finish;
5909 }
5910
5911 port = iokit_lookup_raw_current_task(portName, &portType);
5912
5913 if (port == NULL) {
5914 ret = kIOReturnNotFound;
5915 goto finish;
5916 }
5917
5918 if (portType != IKOT_EVENTLINK) {
5919 ret = kIOReturnBadArgument;
5920 goto finish;
5921 }
5922
5923 ret = eventLink->SetEventlinkPort(port);
5924 if (ret != kIOReturnSuccess) {
5925 if (kIODKLogSetup & gIODKDebug) {
5926 DKLOG(DKS " %s SetEventlinkPort() returned %x\n", DKN(this), eventlinkNameStr->getCStringNoCopy(), ret);
5927 }
5928 goto finish;
5929 }
5930
5931 finish:
5932 if (port != NULL) {
5933 iokit_release_port_send(port);
5934 }
5935
5936 OSSafeReleaseNULL(eventlinkNameStr);
5937 OSSafeReleaseNULL(eventLink);
5938
5939 return ret;
5940 }
5941
5942 kern_return_t
workgroupConfigurationTrap(void * p1,void * p2,void * p3,void * p4,void * p5,void * p6)5943 IOUserUserClient::workgroupConfigurationTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6)
5944 {
5945 user_addr_t userObjectName = (user_addr_t)p1;
5946 mach_port_name_t portName = (mach_port_name_t)(uintptr_t)p3;
5947 mach_port_t port = MACH_PORT_NULL;
5948 ipc_kobject_type_t portType;
5949 char workgroupName[kIOWorkGroupMaxNameLength + 1] = {0};
5950 size_t workgroupNameLen;
5951 OSString * workgroupNameStr = NULL; // must release
5952 IOWorkGroup * workgroup = NULL; // do not release
5953 kern_return_t ret;
5954
5955 ret = copyinstr(userObjectName, &workgroupName[0], sizeof(workgroupName), &workgroupNameLen);
5956 if (ret != kIOReturnSuccess) {
5957 goto finish;
5958 }
5959
5960 // ensure string length matches trap argument
5961 if (workgroupNameLen != (size_t)p2 + 1) {
5962 ret = kIOReturnBadArgument;
5963 goto finish;
5964 }
5965
5966 workgroupNameStr = OSString::withCStringNoCopy(workgroupName);
5967 if (workgroupNameStr == NULL) {
5968 ret = kIOReturnNoMemory;
5969 goto finish;
5970 }
5971
5972 IOLockLock(fLock);
5973 workgroup = OSDynamicCast(IOWorkGroup, fWorkGroups->getObject(workgroupNameStr));
5974 if (workgroup) {
5975 workgroup->retain();
5976 }
5977 IOLockUnlock(fLock);
5978
5979 if (workgroup == NULL) {
5980 ret = kIOReturnNotFound;
5981 goto finish;
5982 }
5983
5984 port = iokit_lookup_raw_current_task(portName, &portType);
5985
5986 if (port == NULL) {
5987 ret = kIOReturnNotFound;
5988 goto finish;
5989 }
5990
5991 if (portType != IKOT_WORK_INTERVAL) {
5992 ret = kIOReturnBadArgument;
5993 goto finish;
5994 }
5995
5996 ret = workgroup->SetWorkGroupPort(port);
5997 if (ret != kIOReturnSuccess) {
5998 if (kIODKLogSetup & gIODKDebug) {
5999 DKLOG(DKS " %s SetWorkGroupPort() returned %x\n", DKN(this), workgroupNameStr->getCStringNoCopy(), ret);
6000 }
6001 goto finish;
6002 }
6003
6004 finish:
6005
6006 if (port != NULL) {
6007 iokit_release_port_send(port);
6008 }
6009
6010 OSSafeReleaseNULL(workgroupNameStr);
6011 OSSafeReleaseNULL(workgroup);
6012
6013 return ret;
6014 }
6015
6016 IOExternalTrap *
getTargetAndTrapForIndex(IOService ** targetP,UInt32 index)6017 IOUserUserClient::getTargetAndTrapForIndex( IOService **targetP, UInt32 index )
6018 {
6019 static const OSBoundedArray<IOExternalTrap, 2> trapTemplate = {{
6020 { NULL, (IOTrap) & IOUserUserClient::eventlinkConfigurationTrap},
6021 { NULL, (IOTrap) & IOUserUserClient::workgroupConfigurationTrap},
6022 }};
6023 if (index >= trapTemplate.size()) {
6024 return NULL;
6025 }
6026 *targetP = this;
6027 return (IOExternalTrap *)&trapTemplate[index];
6028 }
6029
6030 kern_return_t
CopyClientEntitlements_Impl(OSDictionary ** entitlements)6031 IOUserClient::CopyClientEntitlements_Impl(OSDictionary ** entitlements)
6032 {
6033 return kIOReturnUnsupported;
6034 };
6035
6036 struct IOUserUserClientActionRef {
6037 OSAsyncReference64 asyncRef;
6038 };
6039
6040 void
KernelCompletion_Impl(OSAction * action,IOReturn status,const unsigned long long * asyncData,uint32_t asyncDataCount)6041 IOUserClient::KernelCompletion_Impl(
6042 OSAction * action,
6043 IOReturn status,
6044 const unsigned long long * asyncData,
6045 uint32_t asyncDataCount)
6046 {
6047 IOUserUserClientActionRef * ref;
6048
6049 ref = (typeof(ref))action->GetReference();
6050
6051 IOUserClient::sendAsyncResult64(ref->asyncRef, status, (io_user_reference_t *) asyncData, asyncDataCount);
6052 }
6053
6054 kern_return_t
_ExternalMethod_Impl(uint64_t selector,const unsigned long long * scalarInput,uint32_t scalarInputCount,OSData * structureInput,IOMemoryDescriptor * structureInputDescriptor,unsigned long long * scalarOutput,uint32_t * scalarOutputCount,uint64_t structureOutputMaximumSize,OSData ** structureOutput,IOMemoryDescriptor * structureOutputDescriptor,OSAction * completion)6055 IOUserClient::_ExternalMethod_Impl(
6056 uint64_t selector,
6057 const unsigned long long * scalarInput,
6058 uint32_t scalarInputCount,
6059 OSData * structureInput,
6060 IOMemoryDescriptor * structureInputDescriptor,
6061 unsigned long long * scalarOutput,
6062 uint32_t * scalarOutputCount,
6063 uint64_t structureOutputMaximumSize,
6064 OSData ** structureOutput,
6065 IOMemoryDescriptor * structureOutputDescriptor,
6066 OSAction * completion)
6067 {
6068 return kIOReturnUnsupported;
6069 }
6070
6071 IOReturn
clientMemoryForType(UInt32 type,IOOptionBits * koptions,IOMemoryDescriptor ** kmemory)6072 IOUserUserClient::clientMemoryForType(UInt32 type,
6073 IOOptionBits * koptions,
6074 IOMemoryDescriptor ** kmemory)
6075 {
6076 IOReturn kr;
6077 uint64_t options;
6078 IOMemoryDescriptor * memory;
6079
6080 kr = CopyClientMemoryForType(type, &options, &memory);
6081
6082 *koptions = 0;
6083 *kmemory = NULL;
6084 if (kIOReturnSuccess != kr) {
6085 return kr;
6086 }
6087
6088 if (kIOUserClientMemoryReadOnly & options) {
6089 *koptions |= kIOMapReadOnly;
6090 }
6091 *kmemory = memory;
6092
6093 return kr;
6094 }
6095
6096 IOReturn
externalMethod(uint32_t selector,IOExternalMethodArguments * args,IOExternalMethodDispatch * dispatch,OSObject * target,void * reference)6097 IOUserUserClient::externalMethod(uint32_t selector, IOExternalMethodArguments * args,
6098 IOExternalMethodDispatch * dispatch, OSObject * target, void * reference)
6099 {
6100 IOReturn kr;
6101 OSData * structureInput;
6102 OSData * structureOutput;
6103 size_t copylen;
6104 uint64_t structureOutputSize;
6105 OSAction * action;
6106 IOUserUserClientActionRef * ref;
6107 mach_port_t wake_port = MACH_PORT_NULL;
6108
6109 kr = kIOReturnUnsupported;
6110 structureInput = NULL;
6111 action = NULL;
6112 ref = NULL;
6113
6114 if (args->structureInputSize) {
6115 structureInput = OSData::withBytesNoCopy((void *) args->structureInput, args->structureInputSize);
6116 }
6117
6118 if (MACH_PORT_NULL != args->asyncWakePort) {
6119 // this retain is for the OSAction to release
6120 wake_port = ipc_port_make_send_mqueue(args->asyncWakePort);
6121 kr = CreateActionKernelCompletion(sizeof(IOUserUserClientActionRef), &action);
6122 assert(KERN_SUCCESS == kr);
6123 ref = (typeof(ref))action->GetReference();
6124 bcopy(args->asyncReference, &ref->asyncRef[0], args->asyncReferenceCount * sizeof(ref->asyncRef[0]));
6125 kr = action->SetAbortedHandler(^(void) {
6126 IOUserUserClientActionRef * ref;
6127 IOReturn ret;
6128
6129 ref = (typeof(ref))action->GetReference();
6130 ret = releaseAsyncReference64(ref->asyncRef);
6131 assert(kIOReturnSuccess == ret);
6132 bzero(&ref->asyncRef[0], sizeof(ref->asyncRef));
6133 });
6134 assert(KERN_SUCCESS == kr);
6135 }
6136
6137 if (args->structureVariableOutputData) {
6138 structureOutputSize = kIOUserClientVariableStructureSize;
6139 } else if (args->structureOutputDescriptor) {
6140 structureOutputSize = args->structureOutputDescriptor->getLength();
6141 } else {
6142 structureOutputSize = args->structureOutputSize;
6143 }
6144
6145 kr = _ExternalMethod(selector, &args->scalarInput[0], args->scalarInputCount,
6146 structureInput, args->structureInputDescriptor,
6147 args->scalarOutput, &args->scalarOutputCount,
6148 structureOutputSize, &structureOutput, args->structureOutputDescriptor,
6149 action);
6150
6151 OSSafeReleaseNULL(structureInput);
6152 OSSafeReleaseNULL(action);
6153
6154 if (kr == kIOReturnSuccess && structureOutput) {
6155 if (args->structureVariableOutputData) {
6156 *args->structureVariableOutputData = structureOutput;
6157 } else {
6158 copylen = structureOutput->getLength();
6159 if (copylen > args->structureOutputSize) {
6160 kr = kIOReturnBadArgument;
6161 } else {
6162 bcopy((const void *) structureOutput->getBytesNoCopy(), args->structureOutput, copylen);
6163 args->structureOutputSize = (uint32_t) copylen;
6164 }
6165 OSSafeReleaseNULL(structureOutput);
6166 }
6167 }
6168
6169 if (kIOReturnSuccess != kr) {
6170 // mig will destroy any async port
6171 return kr;
6172 }
6173
6174 // We must never return error after this point in order to preserve MIG ownership semantics
6175 assert(kr == kIOReturnSuccess);
6176 if (MACH_PORT_NULL != wake_port) {
6177 // this release is for the mig created send right
6178 iokit_release_port_send(wake_port);
6179 }
6180
6181 return kr;
6182 }
6183
6184 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
6185
6186 extern IORecursiveLock * gDriverKitLaunchLock;
6187 extern OSSet * gDriverKitLaunches;
6188
6189 _IOUserServerCheckInCancellationHandler *
setCancellationHandler(IOUserServerCheckInCancellationHandler handler,void * handlerArgs)6190 IOUserServerCheckInToken::setCancellationHandler(IOUserServerCheckInCancellationHandler handler,
6191 void* handlerArgs)
6192 {
6193 _IOUserServerCheckInCancellationHandler * handlerObj = _IOUserServerCheckInCancellationHandler::withHandler(handler, handlerArgs);
6194 if (!handlerObj) {
6195 goto finish;
6196 }
6197
6198 IORecursiveLockLock(gDriverKitLaunchLock);
6199
6200 assert(fState != kIOUserServerCheckInComplete);
6201
6202 if (fState == kIOUserServerCheckInCanceled) {
6203 // Send cancel notification if we set the handler after this was canceled
6204 handlerObj->call(this);
6205 } else if (fState == kIOUserServerCheckInPending) {
6206 fHandlers->setObject(handlerObj);
6207 }
6208
6209 IORecursiveLockUnlock(gDriverKitLaunchLock);
6210
6211 finish:
6212 return handlerObj;
6213 }
6214
6215 void
removeCancellationHandler(_IOUserServerCheckInCancellationHandler * handler)6216 IOUserServerCheckInToken::removeCancellationHandler(_IOUserServerCheckInCancellationHandler * handler)
6217 {
6218 IORecursiveLockLock(gDriverKitLaunchLock);
6219
6220 fHandlers->removeObject(handler);
6221
6222 IORecursiveLockUnlock(gDriverKitLaunchLock);
6223 }
6224
6225 void
cancel()6226 IOUserServerCheckInToken::cancel()
6227 {
6228 IORecursiveLockLock(gDriverKitLaunchLock);
6229
6230 if (fState == kIOUserServerCheckInPending) {
6231 fState = kIOUserServerCheckInCanceled;
6232 if (gDriverKitLaunches != NULL) {
6233 // Remove pending launch from list, if we have not shut down yet.
6234 gDriverKitLaunches->removeObject(this);
6235 }
6236
6237 fHandlers->iterateObjects(^bool (OSObject * obj){
6238 _IOUserServerCheckInCancellationHandler * handlerObj = OSDynamicCast(_IOUserServerCheckInCancellationHandler, obj);
6239 if (handlerObj) {
6240 handlerObj->call(this);
6241 }
6242 return false;
6243 });
6244 fHandlers->flushCollection();
6245 }
6246
6247 IORecursiveLockUnlock(gDriverKitLaunchLock);
6248 }
6249
6250 void
complete()6251 IOUserServerCheckInToken::complete()
6252 {
6253 IORecursiveLockLock(gDriverKitLaunchLock);
6254
6255 if (fState == kIOUserServerCheckInPending && --fPendingCount == 0) {
6256 fState = kIOUserServerCheckInComplete;
6257 if (gDriverKitLaunches != NULL) {
6258 // Remove pending launch from list, if we have not shut down yet.
6259 gDriverKitLaunches->removeObject(this);
6260 }
6261
6262 // No need to hold on to the cancellation handlers
6263 fHandlers->flushCollection();
6264 }
6265
6266 IORecursiveLockUnlock(gDriverKitLaunchLock);
6267 }
6268
6269 bool
init(const OSSymbol * serverName,OSNumber * serverTag,OSKext * driverKext,OSData * serverDUI)6270 IOUserServerCheckInToken::init(const OSSymbol * serverName, OSNumber * serverTag, OSKext *driverKext, OSData *serverDUI)
6271 {
6272 if (!OSObject::init()) {
6273 return false;
6274 }
6275
6276 if (!serverName) {
6277 return false;
6278 }
6279 fServerName = serverName;
6280 fServerName->retain();
6281
6282 if (!serverTag) {
6283 return false;
6284 }
6285 fServerTag = serverTag;
6286 fServerTag->retain();
6287
6288 fHandlers = OSSet::withCapacity(0);
6289 if (!fHandlers) {
6290 return false;
6291 }
6292
6293 fState = kIOUserServerCheckInPending;
6294 fPendingCount = 1;
6295
6296 fKextBundleID = NULL;
6297 fNeedDextDec = false;
6298
6299 fExecutableName = NULL;
6300
6301 if (driverKext) {
6302 fExecutableName = OSDynamicCast(OSSymbol, driverKext->getBundleExecutable());
6303
6304 if (fExecutableName) {
6305 fExecutableName->retain();
6306 }
6307
6308 /*
6309 * We need to keep track of how many dexts we have started.
6310 * For every new dext we are going to create a new token, and
6311 * we consider the token creation as the initial step to
6312 * create a dext as it is the data structure that will back up
6313 * the userspace dance to start a dext.
6314 * We later have to decrement only once per token.
6315 * If no error occurs we consider the finalize() call on IOUserServer
6316 * as the moment in which we do not consider the dext "alive" anymore;
6317 * however in case of errors we will still need to decrement the count
6318 * otherwise upgrades of the dext will never make progress.
6319 */
6320 if (OSKext::incrementDextLaunchCount(driverKext, serverDUI)) {
6321 /*
6322 * If fKext holds a pointer,
6323 * it is the indication that a decrements needs
6324 * to be called.
6325 */
6326 fNeedDextDec = true;
6327 fKextBundleID = OSDynamicCast(OSString, driverKext->getIdentifier());
6328 fKextBundleID->retain();
6329 } else {
6330 return false;
6331 }
6332 }
6333
6334 return true;
6335 }
6336
6337 /*
6338 * Returns if the dext can be re-used
6339 * for matching.
6340 */
6341 bool
dextTerminate(void)6342 IOUserServerCheckInToken::dextTerminate(void)
6343 {
6344 bool ret = true;
6345
6346 if (fNeedDextDec == true) {
6347 /*
6348 * We can decrement DextLaunchCount only
6349 * once per token.
6350 */
6351 ret = !(OSKext::decrementDextLaunchCount(fKextBundleID));
6352 fNeedDextDec = false;
6353 }
6354
6355 return ret;
6356 }
6357
6358 void
free()6359 IOUserServerCheckInToken::free()
6360 {
6361 OSSafeReleaseNULL(fServerName);
6362 OSSafeReleaseNULL(fServerTag);
6363 OSSafeReleaseNULL(fExecutableName);
6364 OSSafeReleaseNULL(fHandlers);
6365 if (fKextBundleID != NULL) {
6366 dextTerminate();
6367 OSSafeReleaseNULL(fKextBundleID);
6368 }
6369
6370 OSObject::free();
6371 }
6372
6373 const OSSymbol *
copyServerName() const6374 IOUserServerCheckInToken::copyServerName() const
6375 {
6376 fServerName->retain();
6377 return fServerName;
6378 }
6379
6380 OSNumber *
copyServerTag() const6381 IOUserServerCheckInToken::copyServerTag() const
6382 {
6383 fServerTag->retain();
6384 return fServerTag;
6385 }
6386
6387 IOUserServer *
launchUserServer(OSString * bundleID,const OSSymbol * serverName,OSNumber * serverTag,bool reuseIfExists,IOUserServerCheckInToken ** resultToken,OSData * serverDUI)6388 IOUserServer::launchUserServer(OSString * bundleID, const OSSymbol * serverName, OSNumber * serverTag, bool reuseIfExists, IOUserServerCheckInToken ** resultToken, OSData *serverDUI)
6389 {
6390 IOUserServer *me = NULL;
6391 IOUserServerCheckInToken * token = NULL;
6392 OSDictionary * matching = NULL; // must release
6393 OSKext * driverKext = NULL; // must release
6394 OSDextStatistics * driverStatistics = NULL; // must release
6395 bool reslide = false;
6396
6397 /* TODO: Check we are looking for same dextID
6398 * and if it is not the same
6399 * restart the matching process.
6400 */
6401 driverKext = OSKext::lookupDextWithIdentifier(bundleID, serverDUI);
6402 if (driverKext != NULL) {
6403 driverStatistics = driverKext->copyDextStatistics();
6404 if (driverStatistics == NULL) {
6405 panic("Kext %s was not a DriverKit OSKext", bundleID->getCStringNoCopy());
6406 }
6407 IOLog("Driver %s has crashed %zu time(s)\n", bundleID->getCStringNoCopy(), driverStatistics->getCrashCount());
6408 reslide = driverStatistics->getCrashCount() > 0;
6409 } else {
6410 DKLOG("Could not find OSKext for %s\n", bundleID->getCStringNoCopy());
6411 *resultToken = NULL;
6412 return NULL;
6413 }
6414
6415 IORecursiveLockLock(gDriverKitLaunchLock);
6416
6417 if (gDriverKitLaunches == NULL) {
6418 // About to shut down, don't launch anything
6419 goto finish;
6420 }
6421
6422 if (reuseIfExists) {
6423 const char * serverNameCStr;
6424 const char * bundleIDCStr;
6425 const char * endOrgCStr;
6426
6427 serverNameCStr = serverName->getCStringNoCopy();
6428 bundleIDCStr = bundleID->getCStringNoCopy();
6429 (endOrgCStr = strchr(bundleIDCStr, '.')) && (endOrgCStr = strchr(endOrgCStr + 1, '.'));
6430 reuseIfExists = endOrgCStr && (0 == strncmp(bundleIDCStr, serverNameCStr, endOrgCStr + 1 - bundleIDCStr));
6431 if (!reuseIfExists) {
6432 IOLog(kIOUserServerNameKey " \"%s\" not correct organization for bundleID \"%s\"\n", serverNameCStr, bundleIDCStr);
6433 }
6434 }
6435
6436 // Find existing server
6437 if (reuseIfExists) {
6438 token = IOUserServerCheckInToken::findExistingToken(serverName);
6439 if (token) {
6440 // Launch in progress, return token
6441 goto finish;
6442 } else {
6443 // Check if launch completed
6444 matching = IOService::serviceMatching(gIOUserServerClassKey);
6445 if (!matching) {
6446 goto finish;
6447 }
6448 IOService::propertyMatching(gIOUserServerNameKey, serverName, matching);
6449 IOService * service = IOService::copyMatchingService(matching);
6450 IOUserServer * userServer = OSDynamicCast(IOUserServer, service);
6451 if (userServer) {
6452 // found existing user server
6453 me = userServer;
6454 goto finish;
6455 } else {
6456 OSSafeReleaseNULL(service);
6457 }
6458 }
6459 }
6460
6461 // No existing server, request launch
6462 token = new IOUserServerCheckInToken;
6463 if (!token) {
6464 goto finish;
6465 }
6466
6467 /*
6468 * TODO: If the init fails because the personalities are not up to date
6469 * restart the whole matching process.
6470 */
6471 if (token && !token->init(serverName, serverTag, driverKext, serverDUI)) {
6472 IOLog("Could not initialize token\n");
6473 OSSafeReleaseNULL(token);
6474 goto finish;
6475 }
6476
6477 /*
6478 * If the launch fails at any point terminate() will
6479 * be called on this IOUserServer.
6480 */
6481 gDriverKitLaunches->setObject(token);
6482 OSKext::requestDaemonLaunch(bundleID, (OSString *)serverName, serverTag, reslide ? kOSBooleanTrue : kOSBooleanFalse, token, serverDUI);
6483
6484 finish:
6485 IORecursiveLockUnlock(gDriverKitLaunchLock);
6486 OSSafeReleaseNULL(matching);
6487 OSSafeReleaseNULL(driverStatistics);
6488 OSSafeReleaseNULL(driverKext);
6489
6490 if (resultToken) {
6491 *resultToken = token;
6492 } else {
6493 OSSafeReleaseNULL(token);
6494 }
6495
6496 return me;
6497 }
6498
6499 /*
6500 * IOUserServerCheckInTokens are used to track dext launches. They have three possible states:
6501 *
6502 * - Pending: A dext launch is pending
6503 * - Canceled: Dext launch failed
6504 * - Complete: Dext launch is complete
6505 *
6506 * A token can be shared among multiple IOServices that are waiting for dexts if the IOUserServerName
6507 * is the same. This allows dexts to be reused and host multiple services. All pending tokens are stored
6508 * in gDriverKitLaunches and we check here before creating a new token when launching a dext.
6509 *
6510 * A token starts in the pending state with a pending count of 1. When we reuse a token, we increase the
6511 * pending count of the token.
6512 *
6513 * The token is sent to userspace as a mach port through kernelmanagerd/driverkitd to the dext. The dext then
6514 * uses that token to check in to the kernel. If any part of the dext launch failed (dext crashed, kmd crashed, etc.)
6515 * we get a no-senders notification for the token in the kernel and the token goes into the Canceled state.
6516 *
6517 * Once the dext checks in to the kernel, we decrement the pending count for the token. When the pending count reaches
6518 * 0, the token goes into the Complete state. So if the token is in the Complete state, there are no kernel matching threads
6519 * waiting on the dext to check in.
6520 */
6521
6522 IOUserServerCheckInToken *
findExistingToken(const OSSymbol * serverName)6523 IOUserServerCheckInToken::findExistingToken(const OSSymbol * serverName)
6524 {
6525 IOUserServerCheckInToken * __block result = NULL;
6526
6527 IORecursiveLockLock(gDriverKitLaunchLock);
6528 if (gDriverKitLaunches == NULL) {
6529 goto finish;
6530 }
6531
6532 gDriverKitLaunches->iterateObjects(^(OSObject * obj) {
6533 IOUserServerCheckInToken * token = OSDynamicCast(IOUserServerCheckInToken, obj);
6534 if (token) {
6535 // Check if server name matches
6536 const OSSymbol * tokenServerName = token->fServerName;
6537 if (tokenServerName->isEqualTo(serverName)) {
6538 assert(token->fState == kIOUserServerCheckInPending);
6539 token->fPendingCount++;
6540 result = token;
6541 result->retain();
6542 }
6543 }
6544 return result != NULL;
6545 });
6546
6547 finish:
6548 IORecursiveLockUnlock(gDriverKitLaunchLock);
6549 return result;
6550 }
6551
6552 void
cancelAll()6553 IOUserServerCheckInToken::cancelAll()
6554 {
6555 OSSet * tokensToCancel;
6556
6557 IORecursiveLockLock(gDriverKitLaunchLock);
6558 tokensToCancel = gDriverKitLaunches;
6559 gDriverKitLaunches = NULL;
6560
6561
6562 tokensToCancel->iterateObjects(^(OSObject *obj) {
6563 IOUserServerCheckInToken * token = OSDynamicCast(IOUserServerCheckInToken, obj);
6564 if (token) {
6565 token->cancel();
6566 }
6567 return false;
6568 });
6569
6570 IORecursiveLockUnlock(gDriverKitLaunchLock);
6571
6572 OSSafeReleaseNULL(tokensToCancel);
6573 }
6574
6575 void
call(IOUserServerCheckInToken * token)6576 _IOUserServerCheckInCancellationHandler::call(IOUserServerCheckInToken * token)
6577 {
6578 fHandler(token, fHandlerArgs);
6579 }
6580
6581 _IOUserServerCheckInCancellationHandler *
withHandler(IOUserServerCheckInCancellationHandler handler,void * args)6582 _IOUserServerCheckInCancellationHandler::withHandler(IOUserServerCheckInCancellationHandler handler, void * args)
6583 {
6584 _IOUserServerCheckInCancellationHandler * handlerObj = NULL;
6585 if (!handler) {
6586 goto finish;
6587 }
6588
6589 handlerObj = new _IOUserServerCheckInCancellationHandler;
6590 if (!handlerObj) {
6591 goto finish;
6592 }
6593
6594 handlerObj->fHandler = handler;
6595 handlerObj->fHandlerArgs = args;
6596
6597 finish:
6598 return handlerObj;
6599 }
6600
6601 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
6602
6603 struct IOServiceStateNotificationDispatchSource_IVars {
6604 IOLock * fLock;
6605 IOService * fStateNotification;
6606 IOStateNotificationListenerRef fListener;
6607 OSAction * fAction;
6608 bool fEnable;
6609 bool fArmed;
6610 };
6611
6612 kern_return_t
Create_Impl(IOService * service,OSArray * items,IODispatchQueue * queue,IOServiceStateNotificationDispatchSource ** outSource)6613 IOServiceStateNotificationDispatchSource::Create_Impl(IOService * service, OSArray * items,
6614 IODispatchQueue * queue, IOServiceStateNotificationDispatchSource ** outSource)
6615 {
6616 kern_return_t kr;
6617 IOServiceStateNotificationDispatchSource * source;
6618
6619 source = OSTypeAlloc(IOServiceStateNotificationDispatchSource);
6620 source->init();
6621
6622 source->ivars->fStateNotification = service;
6623 kr = service->stateNotificationListenerAdd(items, &source->ivars->fListener, ^kern_return_t () {
6624 OSAction * action;
6625
6626 action = NULL;
6627 IOLockLock(source->ivars->fLock);
6628 if (source->ivars->fArmed && source->ivars->fAction) {
6629 source->ivars->fArmed = false;
6630 action = source->ivars->fAction;
6631 action->retain();
6632 }
6633 IOLockUnlock(source->ivars->fLock);
6634 if (action) {
6635 source->StateNotificationReady(action);
6636 OSSafeReleaseNULL(action);
6637 }
6638 return kIOReturnSuccess;
6639 });
6640
6641 if (kIOReturnSuccess != kr) {
6642 OSSafeReleaseNULL(source);
6643 }
6644 *outSource = source;
6645
6646 return kr;
6647 }
6648
6649
6650 bool
init()6651 IOServiceStateNotificationDispatchSource::init()
6652 {
6653 if (!IODispatchSource::init()) {
6654 return false;
6655 }
6656 ivars = IOMallocType(IOServiceStateNotificationDispatchSource_IVars);
6657 if (!ivars) {
6658 return false;
6659 }
6660 ivars->fLock = IOLockAlloc();
6661 if (!ivars->fLock) {
6662 return false;
6663 }
6664 ivars->fArmed = true;
6665
6666 return true;
6667 }
6668
6669 void
free()6670 IOServiceStateNotificationDispatchSource::free()
6671 {
6672 if (ivars) {
6673 if (ivars->fListener) {
6674 ivars->fStateNotification->stateNotificationListenerRemove(ivars->fListener);
6675 }
6676 if (ivars->fLock) {
6677 IOLockFree(ivars->fLock);
6678 }
6679 IOFreeType(ivars, IOServiceStateNotificationDispatchSource_IVars);
6680 }
6681 IODispatchSource::free();
6682 }
6683
6684 kern_return_t
SetHandler_Impl(OSAction * action)6685 IOServiceStateNotificationDispatchSource::SetHandler_Impl(OSAction * action)
6686 {
6687 IOReturn ret;
6688 bool notifyReady;
6689
6690 notifyReady = false;
6691
6692 IOLockLock(ivars->fLock);
6693 action->retain();
6694 OSSafeReleaseNULL(ivars->fAction);
6695 ivars->fAction = action;
6696 if (action) {
6697 notifyReady = true;
6698 }
6699 IOLockUnlock(ivars->fLock);
6700
6701 if (notifyReady) {
6702 StateNotificationReady(action);
6703 }
6704 ret = kIOReturnSuccess;
6705
6706 return ret;
6707 }
6708
6709 kern_return_t
SetEnableWithCompletion_Impl(bool enable,IODispatchSourceCancelHandler handler)6710 IOServiceStateNotificationDispatchSource::SetEnableWithCompletion_Impl(
6711 bool enable,
6712 IODispatchSourceCancelHandler handler)
6713 {
6714 if (enable == ivars->fEnable) {
6715 return kIOReturnSuccess;
6716 }
6717
6718 IOLockLock(ivars->fLock);
6719 ivars->fEnable = enable;
6720 IOLockUnlock(ivars->fLock);
6721
6722 return kIOReturnSuccess;
6723 }
6724
6725 kern_return_t
Cancel_Impl(IODispatchSourceCancelHandler handler)6726 IOServiceStateNotificationDispatchSource::Cancel_Impl(
6727 IODispatchSourceCancelHandler handler)
6728 {
6729 return kIOReturnUnsupported;
6730 }
6731
6732 kern_return_t
StateNotificationBegin_Impl(void)6733 IOServiceStateNotificationDispatchSource::StateNotificationBegin_Impl(void)
6734 {
6735 IOLockLock(ivars->fLock);
6736 ivars->fArmed = true;
6737 IOLockUnlock(ivars->fLock);
6738
6739 return kIOReturnSuccess;
6740 }
6741
6742 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
6743
6744 #include <IOKit/IOServiceStateNotificationEventSource.h>
6745
6746 OSDefineMetaClassAndStructors(IOServiceStateNotificationEventSource, IOEventSource)
6747 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 0);
6748 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 1);
6749 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 2);
6750 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 3);
6751 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 4);
6752 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 5);
6753 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 6);
6754 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 7);
6755
6756 OSPtr<IOServiceStateNotificationEventSource>
serviceStateNotificationEventSource(IOService * service,OSArray * items,ActionBlock inAction)6757 IOServiceStateNotificationEventSource::serviceStateNotificationEventSource(IOService *service,
6758 OSArray * items,
6759 ActionBlock inAction)
6760 {
6761 kern_return_t kr;
6762 IOServiceStateNotificationEventSource * source;
6763
6764 source = OSTypeAlloc(IOServiceStateNotificationEventSource);
6765 if (source && !source->init(service, NULL)) {
6766 OSSafeReleaseNULL(source);
6767 }
6768
6769 if (!source) {
6770 return nullptr;
6771 }
6772
6773 source->fStateNotification = service;
6774 kr = service->stateNotificationListenerAdd(items, &source->fListener, ^kern_return_t () {
6775 if (!source->workLoop) {
6776 return kIOReturnSuccess;
6777 }
6778 source->workLoop->runActionBlock(^IOReturn (void) {
6779 source->fArmed = true;
6780 return kIOReturnSuccess;
6781 });
6782 source->signalWorkAvailable();
6783 return kIOReturnSuccess;
6784 });
6785
6786 if (kIOReturnSuccess != kr) {
6787 OSSafeReleaseNULL(source);
6788 }
6789
6790 if (source) {
6791 source->setActionBlock((IOEventSource::ActionBlock) inAction);
6792 }
6793
6794 return source;
6795 }
6796
6797 void
free()6798 IOServiceStateNotificationEventSource::free()
6799 {
6800 if (fListener) {
6801 fStateNotification->stateNotificationListenerRemove(fListener);
6802 }
6803 IOEventSource::free();
6804 }
6805
6806 void
enable()6807 IOServiceStateNotificationEventSource::enable()
6808 {
6809 fEnable = true;
6810 }
6811
6812 void
disable()6813 IOServiceStateNotificationEventSource::disable()
6814 {
6815 fEnable = false;
6816 }
6817
6818 void
setWorkLoop(IOWorkLoop * inWorkLoop)6819 IOServiceStateNotificationEventSource::setWorkLoop(IOWorkLoop *inWorkLoop)
6820 {
6821 IOEventSource::setWorkLoop(inWorkLoop);
6822 }
6823
6824 bool
checkForWork()6825 IOServiceStateNotificationEventSource::checkForWork()
6826 {
6827 ActionBlock intActionBlock = (ActionBlock) actionBlock;
6828
6829 if (fArmed) {
6830 fArmed = false;
6831 (intActionBlock)();
6832 }
6833
6834 return false;
6835 }
6836
6837 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
6838
6839 OSDefineMetaClassAndStructors(IOSystemStateNotification, IOService);
6840
6841 class IOStateNotificationItem : public OSObject
6842 {
6843 OSDeclareDefaultStructors(IOStateNotificationItem);
6844
6845 public:
6846 virtual bool init() override;
6847
6848 OSDictionary * fSchema;
6849 OSDictionary * fValue;
6850 OSSet * fListeners;
6851 };
6852 OSDefineMetaClassAndStructors(IOStateNotificationItem, OSObject);
6853
6854
6855 class IOStateNotificationListener : public OSObject
6856 {
6857 OSDeclareDefaultStructors(IOStateNotificationListener);
6858
6859 public:
6860 virtual bool init() override;
6861 virtual void free() override;
6862
6863 IOStateNotificationHandler fHandler;
6864 };
6865 OSDefineMetaClassAndStructors(IOStateNotificationListener, OSObject);
6866
6867
6868 bool
init()6869 IOStateNotificationItem::init()
6870 {
6871 return OSObject::init();
6872 }
6873
6874 bool
init()6875 IOStateNotificationListener::init()
6876 {
6877 return OSObject::init();
6878 }
6879
6880 void
free()6881 IOStateNotificationListener::free()
6882 {
6883 if (fHandler) {
6884 Block_release(fHandler);
6885 }
6886 OSObject::free();
6887 }
6888
6889
6890 struct IOServiceStateChangeVars {
6891 IOLock * fLock;
6892 OSDictionary * fItems;
6893 };
6894
6895 IOService *
initialize(void)6896 IOSystemStateNotification::initialize(void)
6897 {
6898 IOSystemStateNotification * me;
6899 IOServiceStateChangeVars * vars;
6900
6901 me = OSTypeAlloc(IOSystemStateNotification);
6902 me->init();
6903 vars = IOMallocType(IOServiceStateChangeVars);
6904 me->reserved->svars = vars;
6905 vars->fLock = IOLockAlloc();
6906 vars->fItems = OSDictionary::withCapacity(16);
6907 {
6908 kern_return_t ret;
6909
6910 gIOSystemStateSleepDescriptionKey = (OSString *)OSSymbol::withCStringNoCopy(kIOSystemStateSleepDescriptionKey);
6911 gIOSystemStateSleepDescriptionHibernateStateKey = OSSymbol::withCStringNoCopy(kIOSystemStateSleepDescriptionHibernateStateKey);
6912 gIOSystemStateSleepDescriptionReasonKey = OSSymbol::withCStringNoCopy(kIOSystemStateSleepDescriptionReasonKey);
6913
6914 ret = me->StateNotificationItemCreate(gIOSystemStateSleepDescriptionKey, NULL);
6915 assert(kIOReturnSuccess == ret);
6916
6917 gIOSystemStateWakeDescriptionKey = (OSString *)OSSymbol::withCStringNoCopy(kIOSystemStateWakeDescriptionKey);
6918 gIOSystemStateWakeDescriptionWakeReasonKey = OSSymbol::withCStringNoCopy(kIOSystemStateWakeDescriptionWakeReasonKey);
6919
6920 ret = me->StateNotificationItemCreate(gIOSystemStateWakeDescriptionKey, NULL);
6921 assert(kIOReturnSuccess == ret);
6922
6923 gIOSystemStateHaltDescriptionKey = (OSString *)OSSymbol::withCStringNoCopy(kIOSystemStateHaltDescriptionKey);
6924 gIOSystemStateHaltDescriptionHaltStateKey = OSSymbol::withCStringNoCopy(kIOSystemStateHaltDescriptionHaltStateKey);
6925
6926 ret = me->StateNotificationItemCreate(gIOSystemStateHaltDescriptionKey, NULL);
6927 assert(kIOReturnSuccess == ret);
6928
6929 gIOSystemStatePowerSourceDescriptionKey = (OSString *)OSSymbol::withCStringNoCopy(kIOSystemStatePowerSourceDescriptionKey);
6930 gIOSystemStatePowerSourceDescriptionACAttachedKey = OSSymbol::withCStringNoCopy(kIOSystemStatePowerSourceDescriptionACAttachedKey);
6931
6932 ret = me->StateNotificationItemCreate(gIOSystemStatePowerSourceDescriptionKey, NULL);
6933 assert(kIOReturnSuccess == ret);
6934 }
6935
6936 return me;
6937 }
6938
6939 bool
serializeProperties(OSSerialize * s) const6940 IOSystemStateNotification::serializeProperties(OSSerialize * s) const
6941 {
6942 IOServiceStateChangeVars * ivars = reserved->svars;
6943
6944 bool ok;
6945 OSDictionary * result;
6946
6947 result = OSDictionary::withCapacity(16);
6948
6949 IOLockLock(ivars->fLock);
6950 ivars->fItems->iterateObjects(^bool (const OSSymbol * key, OSObject * object) {
6951 IOStateNotificationItem * item;
6952
6953 item = (typeof(item))object;
6954 if (!item->fValue) {
6955 return false;
6956 }
6957 result->setObject(key, item->fValue);
6958 return false;
6959 });
6960 IOLockUnlock(ivars->fLock);
6961
6962 ok = result->serialize(s);
6963 OSSafeReleaseNULL(result);
6964
6965 return ok;
6966 }
6967
6968 kern_return_t
setProperties(OSObject * properties)6969 IOSystemStateNotification::setProperties(OSObject * properties)
6970 {
6971 kern_return_t kr;
6972 OSDictionary * dict;
6973 OSDictionary * schema;
6974 OSDictionary * value;
6975 OSString * itemName;
6976
6977 dict = OSDynamicCast(OSDictionary, properties);
6978 if (!dict) {
6979 return kIOReturnBadArgument;
6980 }
6981
6982 if (!IOCurrentTaskHasEntitlement(kIOSystemStateEntitlement)) {
6983 return kIOReturnNotPermitted;
6984 }
6985
6986 if ((schema = OSDynamicCast(OSDictionary, dict->getObject(kIOStateNotificationItemCreateKey)))) {
6987 itemName = OSDynamicCast(OSString, schema->getObject(kIOStateNotificationNameKey));
6988 kr = StateNotificationItemCreate(itemName, schema);
6989 } else if ((value = OSDynamicCast(OSDictionary, dict->getObject(kIOStateNotificationItemSetKey)))) {
6990 itemName = OSDynamicCast(OSString, value->getObject(kIOStateNotificationNameKey));
6991 itemName->retain();
6992 value->removeObject(kIOStateNotificationNameKey);
6993 kr = StateNotificationItemSet(itemName, value);
6994 itemName->release();
6995 } else {
6996 kr = kIOReturnError;
6997 }
6998
6999 return kr;
7000 }
7001
7002 kern_return_t
CopySystemStateNotificationService_Impl(IOService ** outService)7003 IOService::CopySystemStateNotificationService_Impl(IOService ** outService)
7004 {
7005 IOService * service;
7006
7007 service = getSystemStateNotificationService();
7008 service->retain();
7009 *outService = service;
7010
7011 return kIOReturnSuccess;
7012 }
7013
7014 IOStateNotificationItem *
stateNotificationItemCopy(OSString * itemName,OSDictionary * schema)7015 IOService::stateNotificationItemCopy(OSString * itemName, OSDictionary * schema)
7016 {
7017 IOServiceStateChangeVars * ivars = reserved->svars;
7018
7019 const OSSymbol * name;
7020 IOStateNotificationItem * item;
7021
7022 name = OSSymbol::withString(itemName);
7023
7024 IOLockLock(ivars->fLock);
7025 if ((item = (typeof(item))ivars->fItems->getObject(name))) {
7026 item->retain();
7027 } else {
7028 item = OSTypeAlloc(IOStateNotificationItem);
7029 item->init();
7030 item->fListeners = OSSet::withCapacity(16);
7031
7032 if (schema) {
7033 schema->retain();
7034 } else {
7035 schema = OSDictionary::withCapacity(8);
7036 }
7037 schema->setObject(kIOStateNotificationNameKey, name);
7038 item->fSchema = schema;
7039 ivars->fItems->setObject(name, item);
7040 }
7041 IOLockUnlock(ivars->fLock);
7042
7043 OSSafeReleaseNULL(name);
7044
7045 return item;
7046 }
7047
7048 kern_return_t
StateNotificationItemCreate_Impl(OSString * itemName,OSDictionary * schema)7049 IOService::StateNotificationItemCreate_Impl(OSString * itemName, OSDictionary * schema)
7050 {
7051 IOStateNotificationItem * item;
7052
7053 item = stateNotificationItemCopy(itemName, schema);
7054 if (!item) {
7055 return kIOReturnNoMemory;
7056 }
7057 item->release();
7058
7059 return kIOReturnSuccess;
7060 }
7061
7062 kern_return_t
StateNotificationItemSet_Impl(OSString * itemName,OSDictionary * value)7063 IOService::StateNotificationItemSet_Impl(OSString * itemName, OSDictionary * value)
7064 {
7065 IOServiceStateChangeVars * ivars = reserved->svars;
7066
7067 OSSet * listeners;
7068 IOStateNotificationItem * item;
7069
7070 value->retain();
7071 IOLockLock(ivars->fLock);
7072 item = (typeof(item))ivars->fItems->getObject(itemName);
7073 OSSafeReleaseNULL(item->fValue);
7074 item->fValue = value;
7075 listeners = NULL;
7076 if (item->fListeners->getCount()) {
7077 listeners = OSSet::withSet(item->fListeners);
7078 }
7079 IOLockUnlock(ivars->fLock);
7080
7081 if (listeners) {
7082 listeners->iterateObjects(^bool (OSObject * object) {
7083 IOStateNotificationListener * listener;
7084
7085 listener = (typeof(listener))object;
7086 listener->fHandler();
7087 return false;
7088 });
7089 OSSafeReleaseNULL(listeners);
7090 }
7091
7092 return kIOReturnSuccess;
7093 }
7094
7095 kern_return_t
StateNotificationItemCopy_Impl(OSString * itemName,OSDictionary ** outValue)7096 IOService::StateNotificationItemCopy_Impl(OSString * itemName, OSDictionary ** outValue)
7097 {
7098 IOServiceStateChangeVars * ivars = reserved->svars;
7099
7100 kern_return_t ret;
7101 IOStateNotificationItem * item;
7102 OSDictionary * value;
7103
7104 IOLockLock(ivars->fLock);
7105 item = (typeof(item))ivars->fItems->getObject(itemName);
7106 if (item) {
7107 value = item->fValue;
7108 } else {
7109 value = NULL;
7110 }
7111 if (!value) {
7112 ret = kIOReturnNotFound;
7113 } else {
7114 value->retain();
7115 ret = kIOReturnSuccess;
7116 }
7117 IOLockUnlock(ivars->fLock);
7118
7119 *outValue = value;
7120
7121 return ret;
7122 }
7123
7124 kern_return_t
stateNotificationListenerAdd(OSArray * items,IOStateNotificationListenerRef * outRef,IOStateNotificationHandler handler)7125 IOService::stateNotificationListenerAdd(OSArray * items,
7126 IOStateNotificationListenerRef * outRef,
7127 IOStateNotificationHandler handler)
7128 {
7129 IOServiceStateChangeVars * ivars = reserved->svars;
7130
7131 kern_return_t kr __block;
7132 IOStateNotificationListener * listener;
7133
7134 listener = OSTypeAlloc(IOStateNotificationListener);
7135 listener->init();
7136 listener->fHandler = Block_copy(handler);
7137
7138 kr = kIOReturnSuccess;
7139 items->iterateObjects(^bool (OSObject * object) {
7140 OSString * itemName;
7141 IOStateNotificationItem * item;
7142
7143 itemName = OSDynamicCast(OSString, object);
7144 if (!itemName) {
7145 kr = kIOReturnBadArgument;
7146 return true;
7147 }
7148 item = stateNotificationItemCopy(itemName, NULL);
7149 if (!item) {
7150 kr = kIOReturnNoMemory;
7151 return true;
7152 }
7153 IOLockLock(ivars->fLock);
7154 item->fListeners->setObject(listener);
7155 IOLockUnlock(ivars->fLock);
7156 item->release();
7157 return false;
7158 });
7159
7160 if (kIOReturnSuccess != kr) {
7161 stateNotificationListenerRemove(listener);
7162 OSSafeReleaseNULL(listener);
7163 }
7164 *outRef = listener;
7165
7166 return kr;
7167 }
7168
7169
7170 kern_return_t
stateNotificationListenerRemove(IOStateNotificationListenerRef ref)7171 IOService::stateNotificationListenerRemove(IOStateNotificationListenerRef ref)
7172 {
7173 IOServiceStateChangeVars * ivars = reserved->svars;
7174
7175 IOStateNotificationListener * listener;
7176 kern_return_t kr;
7177
7178 kr = kIOReturnSuccess;
7179 listener = (typeof(listener))ref;
7180
7181 IOLockLock(ivars->fLock);
7182 ivars->fItems->iterateObjects(^bool (const OSSymbol * key, OSObject * object) {
7183 IOStateNotificationItem * item;
7184
7185 item = (typeof(item))object;
7186 item->fListeners->removeObject(listener);
7187 return false;
7188 });
7189 IOLockUnlock(ivars->fLock);
7190
7191 return kr;
7192 }
7193
7194
7195
7196 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
7197
7198 kern_return_t
Create_Impl(OSString * name,IOUserClient * userClient,IOWorkGroup ** workgroup)7199 IOWorkGroup::Create_Impl(OSString * name, IOUserClient * userClient, IOWorkGroup ** workgroup)
7200 {
7201 IOWorkGroup * inst = NULL;
7202 IOUserUserClient * uc = NULL;
7203 kern_return_t ret = kIOReturnError;
7204 IOUserServer * us;
7205
7206 if (name == NULL) {
7207 ret = kIOReturnBadArgument;
7208 goto finish;
7209 }
7210
7211 if (name->getLength() > kIOWorkGroupMaxNameLength) {
7212 ret = kIOReturnBadArgument;
7213 goto finish;
7214 }
7215
7216 uc = OSDynamicCast(IOUserUserClient, userClient);
7217 if (uc == NULL) {
7218 ret = kIOReturnBadArgument;
7219 goto finish;
7220 }
7221
7222 inst = OSTypeAlloc(IOWorkGroup);
7223 if (!inst->init()) {
7224 inst->free();
7225 inst = NULL;
7226 ret = kIOReturnNoMemory;
7227 goto finish;
7228 }
7229
7230 us = (typeof(us))thread_iokit_tls_get(0);
7231 inst->ivars->userServer = OSDynamicCast(IOUserServer, us);
7232
7233 if (inst->ivars->userServer == NULL) {
7234 ret = kIOReturnBadArgument;
7235 goto finish;
7236 }
7237 inst->ivars->userServer->retain();
7238
7239 inst->ivars->name = name;
7240 inst->ivars->name->retain();
7241
7242 inst->ivars->userClient = uc; // no retain
7243
7244 IOLockLock(uc->fLock);
7245 uc->fWorkGroups->setObject(name, inst);
7246 IOLockUnlock(uc->fLock);
7247 ret = kIOReturnSuccess;
7248
7249 finish:
7250 if (ret != kIOReturnSuccess) {
7251 OSSafeReleaseNULL(inst);
7252 } else {
7253 *workgroup = inst;
7254 }
7255
7256 return ret;
7257 }
7258
7259 kern_return_t
InvalidateKernel_Impl(IOUserClient * client)7260 IOWorkGroup::InvalidateKernel_Impl(IOUserClient * client)
7261 {
7262 IOUserUserClient * uc = OSDynamicCast(IOUserUserClient, client);
7263
7264 if (uc == NULL) {
7265 return kIOReturnBadArgument;
7266 }
7267
7268 if (uc != ivars->userClient) {
7269 return kIOReturnBadArgument;
7270 }
7271
7272 IOLockLock(uc->fLock);
7273 uc->fWorkGroups->removeObject(ivars->name);
7274 IOLockUnlock(uc->fLock);
7275
7276 return kIOReturnSuccess;
7277 }
7278
7279 kern_return_t
SetWorkGroupPort_Impl(mach_port_t port)7280 IOWorkGroup::SetWorkGroupPort_Impl(mach_port_t port)
7281 {
7282 return kIOReturnUnsupported;
7283 }
7284
7285 bool
init()7286 IOWorkGroup::init()
7287 {
7288 if (!OSObject::init()) {
7289 return false;
7290 }
7291 ivars = IOMallocType(IOWorkGroup_IVars);
7292
7293 return true;
7294 }
7295
7296 void
free()7297 IOWorkGroup::free()
7298 {
7299 if (ivars) {
7300 OSSafeReleaseNULL(ivars->userServer);
7301 OSSafeReleaseNULL(ivars->name);
7302 IOFreeType(ivars, IOWorkGroup_IVars);
7303 }
7304
7305 OSObject::free();
7306 }
7307
7308 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
7309
7310 kern_return_t
Create_Impl(OSString * name,IOUserClient * userClient,IOEventLink ** eventlink)7311 IOEventLink::Create_Impl(OSString * name, IOUserClient * userClient, IOEventLink ** eventlink)
7312 {
7313 IOEventLink * inst = NULL;
7314 IOUserUserClient * uc = NULL;
7315 IOUserServer * us;
7316 kern_return_t ret = kIOReturnError;
7317
7318 if (name == NULL) {
7319 ret = kIOReturnBadArgument;
7320 goto finish;
7321 }
7322
7323 if (name->getLength() > kIOEventLinkMaxNameLength) {
7324 ret = kIOReturnBadArgument;
7325 goto finish;
7326 }
7327
7328 uc = OSDynamicCast(IOUserUserClient, userClient);
7329 if (uc == NULL) {
7330 ret = kIOReturnBadArgument;
7331 goto finish;
7332 }
7333
7334 inst = OSTypeAlloc(IOEventLink);
7335 if (!inst->init()) {
7336 inst->free();
7337 inst = NULL;
7338 ret = kIOReturnNoMemory;
7339 goto finish;
7340 }
7341
7342 us = (typeof(us))thread_iokit_tls_get(0);
7343 inst->ivars->userServer = OSDynamicCast(IOUserServer, us);
7344
7345 if (inst->ivars->userServer == NULL) {
7346 ret = kIOReturnBadArgument;
7347 goto finish;
7348 }
7349 inst->ivars->userServer->retain();
7350
7351 inst->ivars->name = name;
7352 inst->ivars->name->retain();
7353
7354 inst->ivars->userClient = uc; // no retain
7355
7356 IOLockLock(uc->fLock);
7357 uc->fEventLinks->setObject(name, inst);
7358 IOLockUnlock(uc->fLock);
7359
7360 ret = kIOReturnSuccess;
7361
7362 finish:
7363 if (ret != kIOReturnSuccess) {
7364 OSSafeReleaseNULL(inst);
7365 } else {
7366 *eventlink = inst;
7367 }
7368
7369 return ret;
7370 }
7371
7372 kern_return_t
InvalidateKernel_Impl(IOUserClient * client)7373 IOEventLink::InvalidateKernel_Impl(IOUserClient * client)
7374 {
7375 IOUserUserClient * uc = OSDynamicCast(IOUserUserClient, client);
7376
7377 if (uc == NULL) {
7378 return kIOReturnBadArgument;
7379 }
7380
7381 if (uc != ivars->userClient) {
7382 return kIOReturnBadArgument;
7383 }
7384
7385 IOLockLock(uc->fLock);
7386 uc->fEventLinks->removeObject(ivars->name);
7387 IOLockUnlock(uc->fLock);
7388
7389 return kIOReturnSuccess;
7390 }
7391
7392 bool
init()7393 IOEventLink::init()
7394 {
7395 if (!OSObject::init()) {
7396 return false;
7397 }
7398 ivars = IOMallocType(IOEventLink_IVars);
7399
7400 return true;
7401 }
7402
7403 void
free()7404 IOEventLink::free()
7405 {
7406 if (ivars) {
7407 OSSafeReleaseNULL(ivars->userServer);
7408 OSSafeReleaseNULL(ivars->name);
7409 IOFreeType(ivars, IOEventLink_IVars);
7410 }
7411
7412 OSObject::free();
7413 }
7414
7415 kern_return_t
SetEventlinkPort_Impl(mach_port_t port __unused)7416 IOEventLink::SetEventlinkPort_Impl(mach_port_t port __unused)
7417 {
7418 return kIOReturnUnsupported;
7419 }
7420