1 /*
2 * Copyright (c) 1998-2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <IOKit/IORPC.h>
30 #include <IOKit/IOKitServer.h>
31 #include <IOKit/IOKitKeysPrivate.h>
32 #include <IOKit/IOKernelReportStructs.h>
33 #include <IOKit/IOUserClient.h>
34 #include <IOKit/IOService.h>
35 #include <IOKit/IORegistryEntry.h>
36 #include <IOKit/IOCatalogue.h>
37 #include <IOKit/IOMemoryDescriptor.h>
38 #include <IOKit/IOBufferMemoryDescriptor.h>
39 #include <IOKit/IOSubMemoryDescriptor.h>
40 #include <IOKit/IOMultiMemoryDescriptor.h>
41 #include <IOKit/IOMapper.h>
42 #include <IOKit/IOLib.h>
43 #include <IOKit/IOHibernatePrivate.h>
44 #include <IOKit/IOBSD.h>
45 #include <IOKit/system.h>
46 #include <IOKit/IOUserServer.h>
47 #include <IOKit/IOInterruptEventSource.h>
48 #include <IOKit/IOTimerEventSource.h>
49 #include <IOKit/pwr_mgt/RootDomain.h>
50 #include <IOKit/pwr_mgt/IOPowerConnection.h>
51 #include <libkern/c++/OSAllocation.h>
52 #include <libkern/c++/OSKext.h>
53 #include <libkern/c++/OSSharedPtr.h>
54 #include <libkern/OSDebug.h>
55 #include <libkern/Block.h>
56 #include <kern/cs_blobs.h>
57 #include <kern/thread_call.h>
58 #include <os/atomic_private.h>
59 #include <sys/proc.h>
60 #include <sys/reboot.h>
61 #include <sys/codesign.h>
62 #include "IOKitKernelInternal.h"
63
64 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
65
66 #include <DriverKit/IODispatchQueue.h>
67 #include <DriverKit/OSObject.h>
68 #include <DriverKit/OSAction.h>
69 #include <DriverKit/IODispatchSource.h>
70 #include <DriverKit/IOInterruptDispatchSource.h>
71 #include <DriverKit/IOService.h>
72 #include <DriverKit/IOMemoryDescriptor.h>
73 #include <DriverKit/IOBufferMemoryDescriptor.h>
74 #include <DriverKit/IOMemoryMap.h>
75 #include <DriverKit/IODataQueueDispatchSource.h>
76 #include <DriverKit/IOServiceNotificationDispatchSource.h>
77 #include <DriverKit/IOServiceStateNotificationDispatchSource.h>
78 #include <DriverKit/IOEventLink.h>
79 #include <DriverKit/IOWorkGroup.h>
80 #include <DriverKit/IOUserServer.h>
81
82 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
83
84 #include <System/IODataQueueDispatchSourceShared.h>
85
86 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
87
88 TUNABLE(SInt64, gIODKDebug, "dk", kIODKEnable);
89
90 #if DEBUG || DEVELOPMENT
91 TUNABLE(bool, disable_dext_crash_reboot, "disable_dext_crash_reboot", 0);
92 #endif /* DEBUG || DEVELOPMENT */
93
94 static OSString * gIOSystemStateSleepDescriptionKey;
95 static const OSSymbol * gIOSystemStateSleepDescriptionReasonKey;
96 static const OSSymbol * gIOSystemStateSleepDescriptionHibernateStateKey;
97
98 static OSString * gIOSystemStateWakeDescriptionKey;
99 static const OSSymbol * gIOSystemStateWakeDescriptionWakeReasonKey;
100
101 static OSString * gIOSystemStateHaltDescriptionKey;
102 static const OSSymbol * gIOSystemStateHaltDescriptionHaltStateKey;
103
104 static OSString * gIOSystemStatePowerSourceDescriptionKey;
105 static const OSSymbol * gIOSystemStatePowerSourceDescriptionACAttachedKey;
106
107 extern bool gInUserspaceReboot;
108
109 extern void iokit_clear_registered_ports(task_t task);
110
111 static IORPCMessage *
112 IORPCMessageFromMachReply(IORPCMessageMach * msg);
113
114 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
115
116 struct IOPStrings;
117
118 class OSUserMetaClass : public OSObject
119 {
120 OSDeclareDefaultStructors(OSUserMetaClass);
121 public:
122 const OSSymbol * name;
123 const OSMetaClass * meta;
124 OSUserMetaClass * superMeta;
125
126 queue_chain_t link;
127
128 OSClassDescription * description;
129 IOPStrings * queueNames;
130 uint32_t methodCount;
131 uint64_t * methods;
132
133 virtual void free() override;
134 virtual kern_return_t Dispatch(const IORPC rpc) APPLE_KEXT_OVERRIDE;
135 };
136 OSDefineMetaClassAndStructors(OSUserMetaClass, OSObject);
137
138 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
139
140 class IOUserService : public IOService
141 {
142 friend class IOService;
143
144 OSDeclareDefaultStructors(IOUserService)
145
146 virtual bool
147 start(IOService * provider) APPLE_KEXT_OVERRIDE;
148 };
149
150 OSDefineMetaClassAndStructors(IOUserService, IOService)
151
152 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
153
154 class IOUserUserClient : public IOUserClient
155 {
156 OSDeclareDefaultStructors(IOUserUserClient);
157 public:
158 task_t fTask;
159 OSDictionary * fWorkGroups;
160 OSDictionary * fEventLinks;
161 IOLock * fLock;
162
163 IOReturn setTask(task_t task);
164 IOReturn eventlinkConfigurationTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6);
165 IOReturn workgroupConfigurationTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6);
166
167 virtual bool init( OSDictionary * dictionary ) APPLE_KEXT_OVERRIDE;
168 virtual void free() APPLE_KEXT_OVERRIDE;
169 virtual void stop(IOService * provider) APPLE_KEXT_OVERRIDE;
170 virtual IOReturn clientClose(void) APPLE_KEXT_OVERRIDE;
171 virtual IOReturn setProperties(OSObject * properties) APPLE_KEXT_OVERRIDE;
172 virtual IOReturn externalMethod(uint32_t selector, IOExternalMethodArguments * args,
173 IOExternalMethodDispatch * dispatch, OSObject * target, void * reference) APPLE_KEXT_OVERRIDE;
174 virtual IOReturn clientMemoryForType(UInt32 type,
175 IOOptionBits * options,
176 IOMemoryDescriptor ** memory) APPLE_KEXT_OVERRIDE;
177 virtual IOExternalTrap * getTargetAndTrapForIndex( IOService **targetP, UInt32 index ) APPLE_KEXT_OVERRIDE;
178 };
179
180 OSDefineMetaClassAndStructors(IOUserServerCheckInToken, OSObject);
181 OSDefineMetaClassAndStructors(_IOUserServerCheckInCancellationHandler, OSObject);
182
183 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
184
185
186 bool
start(IOService * provider)187 IOUserService::start(IOService * provider)
188 {
189 bool ok = true;
190 IOReturn ret;
191
192 ret = Start(provider);
193 if (kIOReturnSuccess != ret) {
194 return false;
195 }
196
197 return ok;
198 }
199
200 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
201
202 #undef super
203
204 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
205
206 struct IODispatchQueue_IVars {
207 IOUserServer * userServer;
208 IODispatchQueue * queue;
209 queue_chain_t link;
210 uint64_t tid;
211
212 mach_port_t serverPort;
213 };
214
215 struct OSAction_IVars {
216 OSObject * target;
217 uint64_t targetmsgid;
218 uint64_t msgid;
219 IOUserServer * userServer;
220 OSActionAbortedHandler abortedHandler;
221 OSString * typeName;
222 void * reference;
223 size_t referenceSize;
224 bool aborted;
225 };
226
227 struct IOWorkGroup_IVars {
228 IOUserServer * userServer;
229 OSString * name;
230 IOUserUserClient * userClient;
231 };
232
233 struct IOEventLink_IVars {
234 IOUserServer * userServer;
235 OSString * name;
236 IOUserUserClient * userClient;
237 };
238
239 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
240
241 kern_return_t
GetRegistryEntryID_Impl(uint64_t * registryEntryID)242 IOService::GetRegistryEntryID_Impl(
243 uint64_t * registryEntryID)
244 {
245 IOReturn ret = kIOReturnSuccess;
246
247 *registryEntryID = getRegistryEntryID();
248
249 return ret;
250 }
251
252 kern_return_t
SetName_Impl(const char * name)253 IOService::SetName_Impl(
254 const char * name)
255 {
256 IOReturn ret = kIOReturnSuccess;
257
258 setName(name);
259
260 return ret;
261 }
262
263 kern_return_t
CopyName_Impl(OSString ** name)264 IOService::CopyName_Impl(
265 OSString ** name)
266 {
267 const OSString * str = copyName();
268 *name = __DECONST(OSString *, str);
269 return str ? kIOReturnSuccess : kIOReturnError;
270 }
271
272
273 kern_return_t
Start_Impl(IOService * provider)274 IOService::Start_Impl(
275 IOService * provider)
276 {
277 IOReturn ret = kIOReturnSuccess;
278 return ret;
279 }
280
281
282 IOReturn
UpdateReport_Impl(OSData * channels,uint32_t action,uint32_t * outElementCount,uint64_t offset,uint64_t capacity,IOMemoryDescriptor * buffer)283 IOService::UpdateReport_Impl(OSData *channels, uint32_t action,
284 uint32_t *outElementCount,
285 uint64_t offset, uint64_t capacity,
286 IOMemoryDescriptor *buffer)
287 {
288 return kIOReturnUnsupported;
289 }
290
291 IOReturn
ConfigureReport_Impl(OSData * channels,uint32_t action,uint32_t * outCount)292 IOService::ConfigureReport_Impl(OSData *channels, uint32_t action, uint32_t *outCount)
293 {
294 return kIOReturnUnsupported;
295 }
296
297 // adapt old signature of configureReport to the iig-friendly signature of ConfigureReport
298 IOReturn
_ConfigureReport(IOReportChannelList * channelList,IOReportConfigureAction action,void * result,void * destination)299 IOService::_ConfigureReport(IOReportChannelList *channelList,
300 IOReportConfigureAction action,
301 void *result,
302 void *destination)
303 {
304 if (action != kIOReportEnable && action != kIOReportGetDimensions && action != kIOReportDisable) {
305 return kIOReturnUnsupported;
306 }
307 static_assert(sizeof(IOReportChannelList) == 8);
308 static_assert(sizeof(IOReportChannel) == 16);
309 unsigned int size_of_channels;
310 bool overflow = os_mul_and_add_overflow(channelList->nchannels, sizeof(IOReportChannel), sizeof(IOReportChannelList), &size_of_channels);
311 if (overflow) {
312 return kIOReturnOverrun;
313 }
314 OSSharedPtr<OSData> sp_channels(OSData::withBytesNoCopy(channelList, size_of_channels), libkern::no_retain);
315 if (!sp_channels) {
316 return kIOReturnNoMemory;
317 }
318 int *resultp = (int*) result;
319 uint32_t count = 0;
320 IOReturn r = ConfigureReport(sp_channels.get(), action, &count);
321 int new_result;
322 overflow = os_add_overflow(*resultp, count, &new_result);
323 if (overflow) {
324 return kIOReturnOverrun;
325 }
326 *resultp = new_result;
327 return r;
328 }
329
330 // adapt old signature of updateReport to the iig-friendly signature of UpdateReport
331 IOReturn
_UpdateReport(IOReportChannelList * channelList,IOReportUpdateAction action,void * result,void * destination)332 IOService::_UpdateReport(IOReportChannelList *channelList,
333 IOReportUpdateAction action,
334 void *result,
335 void *destination)
336 {
337 if (action != kIOReportCopyChannelData) {
338 return kIOReturnUnsupported;
339 }
340 unsigned int size_of_channels;
341 bool overflow = os_mul_and_add_overflow(channelList->nchannels, sizeof(IOReportChannel), sizeof(IOReportChannelList), &size_of_channels);
342 if (overflow) {
343 return kIOReturnOverrun;
344 }
345 OSSharedPtr<OSData> sp_channels(OSData::withBytesNoCopy(channelList, size_of_channels), libkern::no_retain);
346 if (!sp_channels) {
347 return kIOReturnNoMemory;
348 }
349 int *resultp = (int*) result;
350 uint32_t count = 0;
351 auto buffer = (IOBufferMemoryDescriptor*) destination;
352 uint64_t length = buffer->getLength();
353 buffer->setLength(buffer->getCapacity());
354 IOReturn r = UpdateReport(sp_channels.get(), action, &count, length, buffer->getCapacity() - length, buffer);
355 int new_result;
356 overflow = os_add_overflow(*resultp, count, &new_result);
357 size_t new_length;
358 overflow = overflow || os_mul_and_add_overflow(count, sizeof(IOReportElement), length, &new_length);
359 if (overflow || new_length > buffer->getCapacity()) {
360 buffer->setLength(length);
361 return kIOReturnOverrun;
362 }
363 *resultp = new_result;
364 buffer->setLength(new_length);
365 return r;
366 }
367
368
369 IOReturn
SetLegend_Impl(OSArray * legend,bool is_public)370 IOService::SetLegend_Impl(OSArray *legend, bool is_public)
371 {
372 bool ok = setProperty(kIOReportLegendKey, legend);
373 ok = ok && setProperty(kIOReportLegendPublicKey, is_public);
374 return ok ? kIOReturnSuccess : kIOReturnError;
375 }
376
377
378 kern_return_t
RegisterService_Impl()379 IOService::RegisterService_Impl()
380 {
381 IOReturn ret = kIOReturnSuccess;
382 bool started;
383
384 IOUserServer *us = (typeof(us))thread_iokit_tls_get(0);
385 if (reserved != NULL && reserved->uvars != NULL && reserved->uvars->userServer == us) {
386 started = reserved->uvars->started;
387 } else {
388 // assume started
389 started = true;
390 }
391
392 if (OSDynamicCast(IOUserServer, this) != NULL || started) {
393 registerService(kIOServiceAsynchronous);
394 } else {
395 assert(reserved != NULL && reserved->uvars != NULL);
396 reserved->uvars->deferredRegisterService = true;
397 }
398
399 return ret;
400 }
401
402 kern_return_t
CopyDispatchQueue_Impl(const char * name,IODispatchQueue ** queue)403 IOService::CopyDispatchQueue_Impl(
404 const char * name,
405 IODispatchQueue ** queue)
406 {
407 IODispatchQueue * result;
408 IOService * service;
409 IOReturn ret;
410 uint32_t index;
411
412 if (!reserved->uvars) {
413 return kIOReturnError;
414 }
415
416 if (!reserved->uvars->queueArray) {
417 // CopyDispatchQueue should not be called after the service has stopped
418 return kIOReturnError;
419 }
420
421 ret = kIOReturnNotFound;
422 index = -1U;
423 if (!strcmp("Default", name)) {
424 index = 0;
425 } else if (reserved->uvars->userMeta
426 && reserved->uvars->userMeta->queueNames) {
427 index = reserved->uvars->userServer->stringArrayIndex(reserved->uvars->userMeta->queueNames, name);
428 if (index != -1U) {
429 index++;
430 }
431 }
432 if (index == -1U) {
433 if ((service = getProvider())) {
434 ret = service->CopyDispatchQueue(name, queue);
435 }
436 } else {
437 result = reserved->uvars->queueArray[index];
438 if (result) {
439 result->retain();
440 *queue = result;
441 ret = kIOReturnSuccess;
442 }
443 }
444
445 return ret;
446 }
447
448 kern_return_t
CreateDefaultDispatchQueue_Impl(IODispatchQueue ** queue)449 IOService::CreateDefaultDispatchQueue_Impl(
450 IODispatchQueue ** queue)
451 {
452 return kIOReturnError;
453 }
454
455 kern_return_t
CoreAnalyticsSendEvent_Impl(uint64_t options,OSString * eventName,OSDictionary * eventPayload)456 IOService::CoreAnalyticsSendEvent_Impl(
457 uint64_t options,
458 OSString * eventName,
459 OSDictionary * eventPayload)
460 {
461 kern_return_t ret;
462
463 if (NULL == gIOCoreAnalyticsSendEventProc) {
464 // perhaps save for later?
465 return kIOReturnNotReady;
466 }
467
468 ret = (*gIOCoreAnalyticsSendEventProc)(options, eventName, eventPayload);
469
470 return ret;
471 }
472
473 kern_return_t
SetDispatchQueue_Impl(const char * name,IODispatchQueue * queue)474 IOService::SetDispatchQueue_Impl(
475 const char * name,
476 IODispatchQueue * queue)
477 {
478 IOReturn ret = kIOReturnSuccess;
479 uint32_t index;
480
481 if (!reserved->uvars) {
482 return kIOReturnError;
483 }
484
485 if (kIODKLogSetup & gIODKDebug) {
486 DKLOG(DKS "::SetDispatchQueue(%s)\n", DKN(this), name);
487 }
488 queue->ivars->userServer = reserved->uvars->userServer;
489 index = -1U;
490 if (!strcmp("Default", name)) {
491 index = 0;
492 } else if (reserved->uvars->userMeta
493 && reserved->uvars->userMeta->queueNames) {
494 index = reserved->uvars->userServer->stringArrayIndex(reserved->uvars->userMeta->queueNames, name);
495 if (index != -1U) {
496 index++;
497 }
498 }
499 if (index == -1U) {
500 ret = kIOReturnBadArgument;
501 } else {
502 reserved->uvars->queueArray[index] = queue;
503 queue->retain();
504 }
505
506 return ret;
507 }
508
509 IOService *
GetProvider() const510 IOService::GetProvider() const
511 {
512 return getProvider();
513 }
514
515 kern_return_t
SetProperties_Impl(OSDictionary * properties)516 IOService::SetProperties_Impl(
517 OSDictionary * properties)
518 {
519 IOUserServer * us;
520 OSDictionary * dict;
521 IOReturn ret;
522
523 us = (typeof(us))thread_iokit_tls_get(0);
524 dict = OSDynamicCast(OSDictionary, properties);
525 if (NULL == us) {
526 if (!dict) {
527 return kIOReturnBadArgument;
528 }
529 bool ok __block = true;
530 dict->iterateObjects(^bool (const OSSymbol * key, OSObject * value) {
531 ok = setProperty(key, value);
532 return !ok;
533 });
534 ret = ok ? kIOReturnSuccess : kIOReturnNotWritable;
535 return ret;
536 }
537
538 ret = setProperties(properties);
539
540 if (kIOReturnUnsupported == ret) {
541 if (dict && reserved->uvars && (reserved->uvars->userServer == us)) {
542 ret = runPropertyActionBlock(^IOReturn (void) {
543 OSDictionary * userProps;
544 IOReturn ret;
545
546 userProps = OSDynamicCast(OSDictionary, getProperty(gIOUserServicePropertiesKey));
547 if (userProps) {
548 userProps = (typeof(userProps))userProps->copyCollection();
549 } else {
550 userProps = OSDictionary::withCapacity(4);
551 }
552 if (!userProps) {
553 ret = kIOReturnNoMemory;
554 } else {
555 bool ok = userProps->merge(dict);
556 if (ok) {
557 ok = setProperty(gIOUserServicePropertiesKey, userProps);
558 }
559 OSSafeReleaseNULL(userProps);
560 ret = ok ? kIOReturnSuccess : kIOReturnNotWritable;
561 }
562 return ret;
563 });
564 }
565 }
566
567 return ret;
568 }
569
570 kern_return_t
RemoveProperty_Impl(OSString * propertyName)571 IOService::RemoveProperty_Impl(OSString * propertyName)
572 {
573 IOUserServer * us = (IOUserServer *)thread_iokit_tls_get(0);
574 IOReturn ret = kIOReturnUnsupported;
575
576 if (NULL == propertyName) {
577 return kIOReturnUnsupported;
578 }
579 if (NULL == us) {
580 removeProperty(propertyName);
581 return kIOReturnSuccess;
582 }
583 if (reserved && reserved->uvars && reserved->uvars->userServer == us) {
584 ret = runPropertyActionBlock(^IOReturn (void) {
585 OSDictionary * userProps;
586 userProps = OSDynamicCast(OSDictionary, getProperty(gIOUserServicePropertiesKey));
587 if (userProps) {
588 userProps = (OSDictionary *)userProps->copyCollection();
589 if (!userProps) {
590 return kIOReturnNoMemory;
591 }
592 userProps->removeObject(propertyName);
593 bool ok = setProperty(gIOUserServicePropertiesKey, userProps);
594 OSSafeReleaseNULL(userProps);
595 return ok ? kIOReturnSuccess : kIOReturnNotWritable;
596 } else {
597 return kIOReturnNotFound;
598 }
599 });
600 }
601 return ret;
602 }
603
604 kern_return_t
CopyProperties_Local(OSDictionary ** properties)605 IOService::CopyProperties_Local(
606 OSDictionary ** properties)
607 {
608 OSDictionary * props;
609 OSDictionary * userProps;
610
611 props = dictionaryWithProperties();
612 userProps = OSDynamicCast(OSDictionary, props->getObject(gIOUserServicePropertiesKey));
613 if (userProps) {
614 props->merge(userProps);
615 props->removeObject(gIOUserServicePropertiesKey);
616 }
617
618 *properties = props;
619
620 return props ? kIOReturnSuccess : kIOReturnNoMemory;
621 }
622
623 kern_return_t
CopyProperties_Impl(OSDictionary ** properties)624 IOService::CopyProperties_Impl(
625 OSDictionary ** properties)
626 {
627 return CopyProperties_Local(properties);
628 }
629
630 kern_return_t
RequireMaxBusStall_Impl(uint64_t u64ns)631 IOService::RequireMaxBusStall_Impl(
632 uint64_t u64ns)
633 {
634 IOReturn ret;
635 UInt32 ns;
636
637 if (os_convert_overflow(u64ns, &ns)) {
638 return kIOReturnBadArgument;
639 }
640 ret = requireMaxBusStall(ns);
641
642 return ret;
643 }
644
645 #if PRIVATE_WIFI_ONLY
646 kern_return_t
UserSetProperties_Impl(OSContainer * properties)647 IOService::UserSetProperties_Impl(
648 OSContainer * properties)
649 {
650 return kIOReturnUnsupported;
651 }
652
653 kern_return_t
SendIOMessageServicePropertyChange_Impl(void)654 IOService::SendIOMessageServicePropertyChange_Impl(void)
655 {
656 return messageClients(kIOMessageServicePropertyChange);
657 }
658 #endif /* PRIVATE_WIFI_ONLY */
659
660 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
661
662 kern_return_t
_CopyState_Impl(_IOMDPrivateState * state)663 IOMemoryDescriptor::_CopyState_Impl(
664 _IOMDPrivateState * state)
665 {
666 IOReturn ret;
667
668 state->length = _length;
669 state->options = _flags;
670
671 ret = kIOReturnSuccess;
672
673 return ret;
674 }
675
676 kern_return_t
GetLength(uint64_t * returnLength)677 IOMemoryDescriptor::GetLength(uint64_t * returnLength)
678 {
679 *returnLength = getLength();
680
681 return kIOReturnSuccess;
682 }
683
684 kern_return_t
CreateMapping_Impl(uint64_t options,uint64_t address,uint64_t offset,uint64_t length,uint64_t alignment,IOMemoryMap ** map)685 IOMemoryDescriptor::CreateMapping_Impl(
686 uint64_t options,
687 uint64_t address,
688 uint64_t offset,
689 uint64_t length,
690 uint64_t alignment,
691 IOMemoryMap ** map)
692 {
693 IOReturn ret;
694 IOMemoryMap * resultMap;
695 IOOptionBits koptions;
696 mach_vm_address_t atAddress;
697
698 ret = kIOReturnSuccess;
699 koptions = 0;
700 resultMap = NULL;
701
702 if (kIOMemoryMapFixedAddress & options) {
703 atAddress = address;
704 koptions = 0;
705 } else {
706 switch (kIOMemoryMapGuardedMask & options) {
707 default:
708 case kIOMemoryMapGuardedDefault:
709 koptions |= kIOMapGuardedSmall;
710 break;
711 case kIOMemoryMapGuardedNone:
712 break;
713 case kIOMemoryMapGuardedSmall:
714 koptions |= kIOMapGuardedSmall;
715 break;
716 case kIOMemoryMapGuardedLarge:
717 koptions |= kIOMapGuardedLarge;
718 break;
719 }
720 atAddress = 0;
721 koptions |= kIOMapAnywhere;
722 }
723
724 if ((kIOMemoryMapReadOnly & options) || (kIODirectionOut == getDirection())) {
725 if (!reserved || (current_task() != reserved->creator)) {
726 koptions |= kIOMapReadOnly;
727 }
728 }
729
730 switch (0xFF00 & options) {
731 case kIOMemoryMapCacheModeDefault:
732 koptions |= kIOMapDefaultCache;
733 break;
734 case kIOMemoryMapCacheModeInhibit:
735 koptions |= kIOMapInhibitCache;
736 break;
737 case kIOMemoryMapCacheModeCopyback:
738 koptions |= kIOMapCopybackCache;
739 break;
740 case kIOMemoryMapCacheModeWriteThrough:
741 koptions |= kIOMapWriteThruCache;
742 break;
743 default:
744 ret = kIOReturnBadArgument;
745 }
746
747 if (kIOReturnSuccess == ret) {
748 resultMap = createMappingInTask(current_task(), atAddress, koptions, offset, length);
749 if (!resultMap) {
750 ret = kIOReturnError;
751 }
752 }
753
754 *map = resultMap;
755
756 return ret;
757 }
758
759 kern_return_t
CreateSubMemoryDescriptor_Impl(uint64_t memoryDescriptorCreateOptions,uint64_t offset,uint64_t length,IOMemoryDescriptor * ofDescriptor,IOMemoryDescriptor ** memory)760 IOMemoryDescriptor::CreateSubMemoryDescriptor_Impl(
761 uint64_t memoryDescriptorCreateOptions,
762 uint64_t offset,
763 uint64_t length,
764 IOMemoryDescriptor * ofDescriptor,
765 IOMemoryDescriptor ** memory)
766 {
767 IOReturn ret;
768 IOMemoryDescriptor * iomd;
769 IOByteCount mdOffset;
770 IOByteCount mdLength;
771 IOByteCount mdEnd;
772
773 if (!ofDescriptor) {
774 return kIOReturnBadArgument;
775 }
776 if (memoryDescriptorCreateOptions & ~kIOMemoryDirectionOutIn) {
777 return kIOReturnBadArgument;
778 }
779 if (os_convert_overflow(offset, &mdOffset)) {
780 return kIOReturnBadArgument;
781 }
782 if (os_convert_overflow(length, &mdLength)) {
783 return kIOReturnBadArgument;
784 }
785 if (os_add_overflow(mdOffset, mdLength, &mdEnd)) {
786 return kIOReturnBadArgument;
787 }
788 if (mdEnd > ofDescriptor->getLength()) {
789 return kIOReturnBadArgument;
790 }
791
792 iomd = IOSubMemoryDescriptor::withSubRange(
793 ofDescriptor, mdOffset, mdLength, (IOOptionBits) memoryDescriptorCreateOptions);
794
795 if (iomd) {
796 ret = kIOReturnSuccess;
797 *memory = iomd;
798 } else {
799 ret = kIOReturnNoMemory;
800 *memory = NULL;
801 }
802
803 return ret;
804 }
805
806 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
807
808 kern_return_t
CreateWithMemoryDescriptors_Impl(uint64_t memoryDescriptorCreateOptions,uint32_t withDescriptorsCount,IOMemoryDescriptor ** const withDescriptors,IOMemoryDescriptor ** memory)809 IOMemoryDescriptor::CreateWithMemoryDescriptors_Impl(
810 uint64_t memoryDescriptorCreateOptions,
811 uint32_t withDescriptorsCount,
812 IOMemoryDescriptor ** const withDescriptors,
813 IOMemoryDescriptor ** memory)
814 {
815 IOReturn ret;
816 IOMemoryDescriptor * iomd;
817
818 if (!withDescriptors) {
819 return kIOReturnBadArgument;
820 }
821 if (!withDescriptorsCount) {
822 return kIOReturnBadArgument;
823 }
824 if (memoryDescriptorCreateOptions & ~kIOMemoryDirectionOutIn) {
825 return kIOReturnBadArgument;
826 }
827
828 for (unsigned int idx = 0; idx < withDescriptorsCount; idx++) {
829 if (NULL == withDescriptors[idx]) {
830 return kIOReturnBadArgument;
831 }
832 }
833
834 iomd = IOMultiMemoryDescriptor::withDescriptors(withDescriptors, withDescriptorsCount,
835 (IODirection) memoryDescriptorCreateOptions, false);
836
837 if (iomd) {
838 ret = kIOReturnSuccess;
839 *memory = iomd;
840 } else {
841 ret = kIOReturnNoMemory;
842 *memory = NULL;
843 }
844
845 return ret;
846 }
847
848 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
849
850 kern_return_t
CreateMemoryDescriptorFromClient_Impl(uint64_t memoryDescriptorCreateOptions,uint32_t segmentsCount,const IOAddressSegment segments[32],IOMemoryDescriptor ** memory)851 IOUserClient::CreateMemoryDescriptorFromClient_Impl(
852 uint64_t memoryDescriptorCreateOptions,
853 uint32_t segmentsCount,
854 const IOAddressSegment segments[32],
855 IOMemoryDescriptor ** memory)
856 {
857 IOReturn ret;
858 IOMemoryDescriptor * iomd;
859 IOOptionBits mdOptions;
860 IOUserUserClient * me;
861 IOAddressRange * ranges;
862
863 me = OSDynamicCast(IOUserUserClient, this);
864 if (!me) {
865 return kIOReturnBadArgument;
866 }
867 if (!me->fTask) {
868 return kIOReturnNotReady;
869 }
870
871 mdOptions = kIOMemoryThreadSafe;
872 if (kIOMemoryDirectionOut & memoryDescriptorCreateOptions) {
873 mdOptions |= kIODirectionOut;
874 }
875 if (kIOMemoryDirectionIn & memoryDescriptorCreateOptions) {
876 mdOptions |= kIODirectionIn;
877 }
878 if (!(kIOMemoryDisableCopyOnWrite & memoryDescriptorCreateOptions)) {
879 mdOptions |= kIOMemoryMapCopyOnWrite;
880 }
881
882 static_assert(sizeof(IOAddressRange) == sizeof(IOAddressSegment));
883 ranges = __DECONST(IOAddressRange *, &segments[0]);
884
885 iomd = IOMemoryDescriptor::withAddressRanges(
886 ranges, segmentsCount,
887 mdOptions, me->fTask);
888
889 if (iomd) {
890 ret = kIOReturnSuccess;
891 *memory = iomd;
892 } else {
893 ret = kIOReturnNoMemory;
894 *memory = NULL;
895 }
896
897 return ret;
898 }
899
900 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
901
902 kern_return_t
_CopyState_Impl(_IOMemoryMapPrivateState * state)903 IOMemoryMap::_CopyState_Impl(
904 _IOMemoryMapPrivateState * state)
905 {
906 IOReturn ret;
907
908 state->offset = fOffset;
909 state->length = getLength();
910 state->address = getAddress();
911 state->options = getMapOptions();
912
913 ret = kIOReturnSuccess;
914
915 return ret;
916 }
917
918 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
919
920 kern_return_t
Create_Impl(uint64_t options,uint64_t capacity,uint64_t alignment,IOBufferMemoryDescriptor ** memory)921 IOBufferMemoryDescriptor::Create_Impl(
922 uint64_t options,
923 uint64_t capacity,
924 uint64_t alignment,
925 IOBufferMemoryDescriptor ** memory)
926 {
927 IOReturn ret;
928 IOOptionBits bmdOptions;
929 IOBufferMemoryDescriptor * bmd;
930 IOMemoryDescriptorReserved * reserved;
931
932 if (options & ~((uint64_t) kIOMemoryDirectionOutIn)) {
933 // no other options currently defined
934 return kIOReturnBadArgument;
935 }
936 bmdOptions = (options & kIOMemoryDirectionOutIn) | kIOMemoryKernelUserShared | kIOMemoryThreadSafe;
937 bmd = IOBufferMemoryDescriptor::inTaskWithOptions(
938 kernel_task, bmdOptions, capacity, alignment);
939
940 *memory = bmd;
941
942 if (!bmd) {
943 return kIOReturnNoMemory;
944 }
945
946 reserved = bmd->getKernelReserved();
947 reserved->creator = current_task();
948 task_reference(reserved->creator);
949
950 ret = kIOReturnSuccess;
951
952 return ret;
953 }
954
955 kern_return_t
SetLength_Impl(uint64_t length)956 IOBufferMemoryDescriptor::SetLength_Impl(
957 uint64_t length)
958 {
959 setLength(length);
960 return kIOReturnSuccess;
961 }
962
963
964 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
965
966 kern_return_t
Create_Impl(IOService * device,uint64_t options,const IODMACommandSpecification * specification,IODMACommand ** command)967 IODMACommand::Create_Impl(
968 IOService * device,
969 uint64_t options,
970 const IODMACommandSpecification * specification,
971 IODMACommand ** command)
972 {
973 IOReturn ret;
974 IODMACommand * dma;
975 IODMACommand::SegmentOptions segmentOptions;
976 IOMapper * mapper;
977
978 if (options & ~((uint64_t) kIODMACommandCreateNoOptions)) {
979 // no other options currently defined
980 return kIOReturnBadArgument;
981 }
982
983 if (os_convert_overflow(specification->maxAddressBits, &segmentOptions.fNumAddressBits)) {
984 return kIOReturnBadArgument;
985 }
986 segmentOptions.fMaxSegmentSize = 0;
987 segmentOptions.fMaxTransferSize = 0;
988 segmentOptions.fAlignment = 1;
989 segmentOptions.fAlignmentLength = 1;
990 segmentOptions.fAlignmentInternalSegments = 1;
991 segmentOptions.fStructSize = sizeof(segmentOptions);
992
993 mapper = IOMapper::copyMapperForDevice(device);
994
995 dma = IODMACommand::withSpecification(
996 kIODMACommandOutputHost64,
997 &segmentOptions,
998 kIODMAMapOptionDextOwner |
999 kIODMAMapOptionMapped,
1000 mapper,
1001 NULL);
1002
1003 OSSafeReleaseNULL(mapper);
1004 *command = dma;
1005
1006 if (!dma) {
1007 return kIOReturnNoMemory;
1008 }
1009 ret = kIOReturnSuccess;
1010
1011 return ret;
1012 }
1013
1014 #define fInternalState reserved
1015
1016 kern_return_t
PrepareForDMA_Impl(uint64_t options,IOMemoryDescriptor * memory,uint64_t offset,uint64_t length,uint64_t * flags,uint32_t * segmentsCount,IOAddressSegment * segments)1017 IODMACommand::PrepareForDMA_Impl(
1018 uint64_t options,
1019 IOMemoryDescriptor * memory,
1020 uint64_t offset,
1021 uint64_t length,
1022 uint64_t * flags,
1023 uint32_t * segmentsCount,
1024 IOAddressSegment * segments)
1025 {
1026 IOReturn ret;
1027 uint64_t lflags, mdFlags;
1028 UInt32 numSegments;
1029 UInt64 genOffset;
1030
1031 if (options & ~((uint64_t) kIODMACommandPrepareForDMANoOptions)) {
1032 // no other options currently defined
1033 return kIOReturnBadArgument;
1034 }
1035
1036 if (memory == NULL) {
1037 return kIOReturnBadArgument;
1038 }
1039
1040 assert(fInternalState->fDextLock);
1041 IOLockLock(fInternalState->fDextLock);
1042
1043 // uses IOMD direction
1044 ret = memory->prepare();
1045 if (kIOReturnSuccess != ret) {
1046 goto exit;
1047 }
1048
1049 ret = setMemoryDescriptor(memory, false);
1050 if (kIOReturnSuccess != ret) {
1051 memory->complete();
1052 goto exit;
1053 }
1054
1055 ret = prepare(offset, length);
1056 if (kIOReturnSuccess != ret) {
1057 clearMemoryDescriptor(false);
1058 memory->complete();
1059 goto exit;
1060 }
1061
1062 static_assert(sizeof(IODMACommand::Segment64) == sizeof(IOAddressSegment));
1063
1064 numSegments = *segmentsCount;
1065 genOffset = 0;
1066 ret = genIOVMSegments(&genOffset, segments, &numSegments);
1067
1068 if (kIOReturnSuccess != ret) {
1069 clearMemoryDescriptor(true);
1070 memory->complete();
1071 goto exit;
1072 }
1073
1074 mdFlags = fMemory->getFlags();
1075 lflags = 0;
1076 if (kIODirectionOut & mdFlags) {
1077 lflags |= kIOMemoryDirectionOut;
1078 }
1079 if (kIODirectionIn & mdFlags) {
1080 lflags |= kIOMemoryDirectionIn;
1081 }
1082 *flags = lflags;
1083 *segmentsCount = numSegments;
1084
1085 exit:
1086 IOLockUnlock(fInternalState->fDextLock);
1087
1088 return ret;
1089 }
1090
1091 kern_return_t
CompleteDMA_Impl(uint64_t options)1092 IODMACommand::CompleteDMA_Impl(
1093 uint64_t options)
1094 {
1095 IOReturn ret, completeRet;
1096 IOMemoryDescriptor * md;
1097
1098 if (options & ~((uint64_t) kIODMACommandCompleteDMANoOptions)) {
1099 // no other options currently defined
1100 return kIOReturnBadArgument;
1101 }
1102
1103 assert(fInternalState->fDextLock);
1104 IOLockLock(fInternalState->fDextLock);
1105
1106 if (!fInternalState->fPrepared) {
1107 ret = kIOReturnNotReady;
1108 goto exit;
1109 }
1110
1111 md = __DECONST(IOMemoryDescriptor *, fMemory);
1112 if (md) {
1113 md->retain();
1114 }
1115
1116 ret = clearMemoryDescriptor(true);
1117
1118 if (md) {
1119 completeRet = md->complete();
1120 OSSafeReleaseNULL(md);
1121 if (kIOReturnSuccess == ret) {
1122 ret = completeRet;
1123 }
1124 }
1125 exit:
1126 IOLockUnlock(fInternalState->fDextLock);
1127
1128 return ret;
1129 }
1130
1131 kern_return_t
GetPreparation_Impl(uint64_t * offset,uint64_t * length,IOMemoryDescriptor ** memory)1132 IODMACommand::GetPreparation_Impl(
1133 uint64_t * offset,
1134 uint64_t * length,
1135 IOMemoryDescriptor ** memory)
1136 {
1137 IOReturn ret;
1138 IOMemoryDescriptor * md;
1139
1140 if (!fActive) {
1141 return kIOReturnNotReady;
1142 }
1143
1144 ret = getPreparedOffsetAndLength(offset, length);
1145 if (kIOReturnSuccess != ret) {
1146 return ret;
1147 }
1148
1149 if (memory) {
1150 md = __DECONST(IOMemoryDescriptor *, fMemory);
1151 *memory = md;
1152 if (!md) {
1153 ret = kIOReturnNotReady;
1154 } else {
1155 md->retain();
1156 }
1157 }
1158 return ret;
1159 }
1160
1161 kern_return_t
PerformOperation_Impl(uint64_t options,uint64_t dmaOffset,uint64_t length,uint64_t dataOffset,IOMemoryDescriptor * data)1162 IODMACommand::PerformOperation_Impl(
1163 uint64_t options,
1164 uint64_t dmaOffset,
1165 uint64_t length,
1166 uint64_t dataOffset,
1167 IOMemoryDescriptor * data)
1168 {
1169 IOReturn ret;
1170 OSDataAllocation<uint8_t> buffer;
1171 UInt64 copiedDMA;
1172 IOByteCount mdOffset, mdLength, copied;
1173
1174 if (options & ~((uint64_t)
1175 (kIODMACommandPerformOperationOptionRead
1176 | kIODMACommandPerformOperationOptionWrite
1177 | kIODMACommandPerformOperationOptionZero))) {
1178 // no other options currently defined
1179 return kIOReturnBadArgument;
1180 }
1181
1182 if (!fActive) {
1183 return kIOReturnNotReady;
1184 }
1185 if (os_convert_overflow(dataOffset, &mdOffset)) {
1186 return kIOReturnBadArgument;
1187 }
1188 if (os_convert_overflow(length, &mdLength)) {
1189 return kIOReturnBadArgument;
1190 }
1191 if (length > fMemory->getLength()) {
1192 return kIOReturnBadArgument;
1193 }
1194 buffer = OSDataAllocation<uint8_t>(length, OSAllocateMemory);
1195 if (!buffer) {
1196 return kIOReturnNoMemory;
1197 }
1198
1199 switch (options) {
1200 case kIODMACommandPerformOperationOptionZero:
1201 bzero(buffer.data(), length);
1202 copiedDMA = writeBytes(dmaOffset, buffer.data(), length);
1203 if (copiedDMA != length) {
1204 ret = kIOReturnUnderrun;
1205 break;
1206 }
1207 ret = kIOReturnSuccess;
1208 break;
1209
1210 case kIODMACommandPerformOperationOptionRead:
1211 case kIODMACommandPerformOperationOptionWrite:
1212
1213 if (!data) {
1214 ret = kIOReturnBadArgument;
1215 break;
1216 }
1217 if (length > data->getLength()) {
1218 ret = kIOReturnBadArgument;
1219 break;
1220 }
1221 if (kIODMACommandPerformOperationOptionWrite == options) {
1222 copied = data->readBytes(mdOffset, buffer.data(), mdLength);
1223 if (copied != mdLength) {
1224 ret = kIOReturnUnderrun;
1225 break;
1226 }
1227 copiedDMA = writeBytes(dmaOffset, buffer.data(), length);
1228 if (copiedDMA != length) {
1229 ret = kIOReturnUnderrun;
1230 break;
1231 }
1232 } else { /* kIODMACommandPerformOperationOptionRead */
1233 copiedDMA = readBytes(dmaOffset, buffer.data(), length);
1234 if (copiedDMA != length) {
1235 ret = kIOReturnUnderrun;
1236 break;
1237 }
1238 copied = data->writeBytes(mdOffset, buffer.data(), mdLength);
1239 if (copied != mdLength) {
1240 ret = kIOReturnUnderrun;
1241 break;
1242 }
1243 }
1244 ret = kIOReturnSuccess;
1245 break;
1246 default:
1247 ret = kIOReturnBadArgument;
1248 break;
1249 }
1250
1251 return ret;
1252 }
1253
1254
1255 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1256
1257 static kern_return_t
OSActionCreateWithTypeNameInternal(OSObject * target,uint64_t targetmsgid,uint64_t msgid,size_t referenceSize,OSString * typeName,bool fromKernel,OSAction ** action)1258 OSActionCreateWithTypeNameInternal(OSObject * target, uint64_t targetmsgid, uint64_t msgid, size_t referenceSize, OSString * typeName, bool fromKernel, OSAction ** action)
1259 {
1260 OSAction * inst = NULL;
1261 void * reference = NULL; // must release
1262 const OSSymbol *sym = NULL; // must release
1263 OSObject *obj = NULL; // must release
1264 const OSMetaClass *actionMetaClass = NULL; // do not release
1265 kern_return_t ret;
1266
1267 if (fromKernel && typeName) {
1268 /* The action is being constructed in the kernel with a type name */
1269 sym = OSSymbol::withString(typeName);
1270 actionMetaClass = OSMetaClass::getMetaClassWithName(sym);
1271 if (actionMetaClass && actionMetaClass->getSuperClass() == OSTypeID(OSAction)) {
1272 obj = actionMetaClass->alloc();
1273 if (!obj) {
1274 ret = kIOReturnNoMemory;
1275 goto finish;
1276 }
1277 inst = OSDynamicCast(OSAction, obj);
1278 obj = NULL; // prevent release
1279 assert(inst); // obj is a subclass of OSAction so the dynamic cast should always work
1280 } else {
1281 DKLOG("Attempted to create action object with type \"%s\" which does not inherit from OSAction\n", typeName->getCStringNoCopy());
1282 ret = kIOReturnBadArgument;
1283 goto finish;
1284 }
1285 } else {
1286 inst = OSTypeAlloc(OSAction);
1287 if (!inst) {
1288 ret = kIOReturnNoMemory;
1289 goto finish;
1290 }
1291 }
1292
1293 if (referenceSize != 0) {
1294 reference = IONewZeroData(uint8_t, referenceSize);
1295 if (reference == NULL) {
1296 ret = kIOReturnNoMemory;
1297 goto finish;
1298 }
1299 }
1300
1301 inst->ivars = IONewZero(OSAction_IVars, 1);
1302 if (!inst->ivars) {
1303 ret = kIOReturnNoMemory;
1304 goto finish;
1305 }
1306 if (target) {
1307 target->retain();
1308 if (!fromKernel && !OSDynamicCast(IOService, target)) {
1309 IOUserServer * us;
1310 us = (typeof(us))thread_iokit_tls_get(0);
1311 inst->ivars->userServer = OSDynamicCast(IOUserServer, us);
1312 assert(inst->ivars->userServer);
1313 inst->ivars->userServer->retain();
1314 }
1315 }
1316 inst->ivars->target = target;
1317 inst->ivars->targetmsgid = targetmsgid;
1318 inst->ivars->msgid = msgid;
1319
1320 inst->ivars->reference = reference;
1321 inst->ivars->referenceSize = referenceSize;
1322 reference = NULL; // prevent release
1323
1324 if (typeName) {
1325 typeName->retain();
1326 }
1327 inst->ivars->typeName = typeName;
1328
1329 *action = inst;
1330 inst = NULL; // prevent release
1331 ret = kIOReturnSuccess;
1332
1333 finish:
1334 OSSafeReleaseNULL(obj);
1335 OSSafeReleaseNULL(sym);
1336 OSSafeReleaseNULL(inst);
1337 if (reference) {
1338 IODeleteData(reference, uint8_t, referenceSize);
1339 }
1340
1341 return ret;
1342 }
1343
1344 kern_return_t
Create(OSAction_Create_Args)1345 OSAction::Create(OSAction_Create_Args)
1346 {
1347 return OSAction::CreateWithTypeName(target, targetmsgid, msgid, referenceSize, NULL, action);
1348 }
1349
1350 kern_return_t
CreateWithTypeName(OSAction_CreateWithTypeName_Args)1351 OSAction::CreateWithTypeName(OSAction_CreateWithTypeName_Args)
1352 {
1353 return OSActionCreateWithTypeNameInternal(target, targetmsgid, msgid, referenceSize, typeName, true, action);
1354 }
1355
1356 kern_return_t
Create_Impl(OSObject * target,uint64_t targetmsgid,uint64_t msgid,size_t referenceSize,OSAction ** action)1357 OSAction::Create_Impl(
1358 OSObject * target,
1359 uint64_t targetmsgid,
1360 uint64_t msgid,
1361 size_t referenceSize,
1362 OSAction ** action)
1363 {
1364 return OSAction::CreateWithTypeName_Impl(target, targetmsgid, msgid, referenceSize, NULL, action);
1365 }
1366
1367 kern_return_t
CreateWithTypeName_Impl(OSObject * target,uint64_t targetmsgid,uint64_t msgid,size_t referenceSize,OSString * typeName,OSAction ** action)1368 OSAction::CreateWithTypeName_Impl(
1369 OSObject * target,
1370 uint64_t targetmsgid,
1371 uint64_t msgid,
1372 size_t referenceSize,
1373 OSString * typeName,
1374 OSAction ** action)
1375 {
1376 return OSActionCreateWithTypeNameInternal(target, targetmsgid, msgid, referenceSize, typeName, false, action);
1377 }
1378
1379 void
free()1380 OSAction::free()
1381 {
1382 if (ivars) {
1383 if (ivars->abortedHandler) {
1384 Block_release(ivars->abortedHandler);
1385 ivars->abortedHandler = NULL;
1386 }
1387 OSSafeReleaseNULL(ivars->target);
1388 OSSafeReleaseNULL(ivars->typeName);
1389 OSSafeReleaseNULL(ivars->userServer);
1390 if (ivars->reference) {
1391 assert(ivars->referenceSize > 0);
1392 IODeleteData(ivars->reference, uint8_t, ivars->referenceSize);
1393 }
1394 IOSafeDeleteNULL(ivars, OSAction_IVars, 1);
1395 }
1396 return super::free();
1397 }
1398
1399 void *
GetReference()1400 OSAction::GetReference()
1401 {
1402 assert(ivars && ivars->referenceSize && ivars->reference);
1403 return ivars->reference;
1404 }
1405
1406 kern_return_t
SetAbortedHandler(OSActionAbortedHandler handler)1407 OSAction::SetAbortedHandler(OSActionAbortedHandler handler)
1408 {
1409 ivars->abortedHandler = Block_copy(handler);
1410 return kIOReturnSuccess;
1411 }
1412
1413 void
Aborted_Impl(void)1414 OSAction::Aborted_Impl(void)
1415 {
1416 if (!os_atomic_cmpxchg(&ivars->aborted, false, true, relaxed)) {
1417 // already aborted
1418 return;
1419 }
1420 if (ivars->abortedHandler) {
1421 ivars->abortedHandler();
1422 }
1423 }
1424
1425 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1426
1427 struct IODispatchSource_IVars {
1428 queue_chain_t link;
1429 IODispatchSource * source;
1430 IOUserServer * server;
1431 IODispatchQueue_IVars * queue;
1432 bool enabled;
1433 };
1434
1435 bool
init()1436 IODispatchSource::init()
1437 {
1438 if (!super::init()) {
1439 return false;
1440 }
1441
1442 ivars = IOMallocType(IODispatchSource_IVars);
1443
1444 ivars->source = this;
1445
1446 return true;
1447 }
1448
1449 void
free()1450 IODispatchSource::free()
1451 {
1452 IOFreeType(ivars, IODispatchSource_IVars);
1453 super::free();
1454 }
1455
1456 kern_return_t
SetEnable_Impl(bool enable)1457 IODispatchSource::SetEnable_Impl(
1458 bool enable)
1459 {
1460 return SetEnableWithCompletion(enable, NULL);
1461 }
1462
1463 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1464
1465 struct IOInterruptDispatchSource_IVars {
1466 IOService * provider;
1467 uint32_t intIndex;
1468 uint32_t flags;
1469 int interruptType;
1470 IOSimpleLock * lock;
1471 thread_t waiter;
1472 uint64_t count;
1473 uint64_t time;
1474 OSAction * action;
1475 bool enable;
1476 bool canceled;
1477 };
1478
1479 static void
IOInterruptDispatchSourceInterrupt(OSObject * target,void * refCon,IOService * nub,int source)1480 IOInterruptDispatchSourceInterrupt(OSObject * target, void * refCon,
1481 IOService * nub, int source )
1482 {
1483 IOInterruptDispatchSource_IVars * ivars = (typeof(ivars))refCon;
1484 IOInterruptState is;
1485
1486 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1487 ivars->count++;
1488 ivars->time = (kIOInterruptSourceContinuousTime & ivars->flags)
1489 ? mach_continuous_time() : mach_absolute_time();
1490 if (ivars->waiter) {
1491 thread_wakeup_thread((event_t) ivars, ivars->waiter);
1492 ivars->waiter = NULL;
1493 }
1494 if (kIOInterruptTypeLevel & ivars->interruptType) {
1495 ivars->provider->disableInterrupt(ivars->intIndex);
1496 }
1497 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1498 }
1499
1500 kern_return_t
Create_Impl(IOService * provider,uint32_t indexAndFlags,IODispatchQueue * queue,IOInterruptDispatchSource ** source)1501 IOInterruptDispatchSource::Create_Impl(
1502 IOService * provider,
1503 uint32_t indexAndFlags,
1504 IODispatchQueue * queue,
1505 IOInterruptDispatchSource ** source)
1506 {
1507 IOReturn ret;
1508 IOInterruptDispatchSource * inst;
1509 uint32_t index;
1510 uint32_t flags;
1511
1512 index = indexAndFlags & kIOInterruptSourceIndexMask;
1513 flags = indexAndFlags & ~kIOInterruptSourceIndexMask;
1514
1515 inst = OSTypeAlloc(IOInterruptDispatchSource);
1516 if (!inst->init()) {
1517 inst->free();
1518 return kIOReturnNoMemory;
1519 }
1520
1521 inst->ivars->lock = IOSimpleLockAlloc();
1522
1523 ret = provider->getInterruptType(index, &inst->ivars->interruptType);
1524 if (kIOReturnSuccess != ret) {
1525 OSSafeReleaseNULL(inst);
1526 return ret;
1527 }
1528 ret = provider->registerInterrupt(index, inst, IOInterruptDispatchSourceInterrupt, inst->ivars);
1529 if (kIOReturnSuccess == ret) {
1530 inst->ivars->intIndex = index;
1531 inst->ivars->flags = flags;
1532 inst->ivars->provider = provider;
1533 inst->ivars->provider->retain();
1534 *source = inst;
1535 }
1536 return ret;
1537 }
1538
1539 kern_return_t
GetInterruptType_Impl(IOService * provider,uint32_t index,uint64_t * interruptType)1540 IOInterruptDispatchSource::GetInterruptType_Impl(
1541 IOService * provider,
1542 uint32_t index,
1543 uint64_t * interruptType)
1544 {
1545 IOReturn ret;
1546 int type;
1547
1548 *interruptType = 0;
1549 ret = provider->getInterruptType(index, &type);
1550 if (kIOReturnSuccess == ret) {
1551 *interruptType = type;
1552 }
1553
1554 return ret;
1555 }
1556
1557 bool
init()1558 IOInterruptDispatchSource::init()
1559 {
1560 if (!super::init()) {
1561 return false;
1562 }
1563 ivars = IOMallocType(IOInterruptDispatchSource_IVars);
1564
1565 return true;
1566 }
1567
1568 void
free()1569 IOInterruptDispatchSource::free()
1570 {
1571 IOReturn ret;
1572
1573 if (ivars && ivars->provider) {
1574 ret = ivars->provider->unregisterInterrupt(ivars->intIndex);
1575 assert(kIOReturnSuccess == ret);
1576 ivars->provider->release();
1577 }
1578
1579 if (ivars && ivars->lock) {
1580 IOSimpleLockFree(ivars->lock);
1581 }
1582
1583 IOFreeType(ivars, IOInterruptDispatchSource_IVars);
1584
1585 super::free();
1586 }
1587
1588 kern_return_t
SetHandler_Impl(OSAction * action)1589 IOInterruptDispatchSource::SetHandler_Impl(
1590 OSAction * action)
1591 {
1592 IOReturn ret;
1593 OSAction * oldAction;
1594
1595 oldAction = (typeof(oldAction))ivars->action;
1596 if (oldAction && OSCompareAndSwapPtr(oldAction, NULL, &ivars->action)) {
1597 oldAction->release();
1598 }
1599 action->retain();
1600 ivars->action = action;
1601
1602 ret = kIOReturnSuccess;
1603
1604 return ret;
1605 }
1606
1607 kern_return_t
SetEnableWithCompletion_Impl(bool enable,IODispatchSourceCancelHandler handler)1608 IOInterruptDispatchSource::SetEnableWithCompletion_Impl(
1609 bool enable,
1610 IODispatchSourceCancelHandler handler)
1611 {
1612 IOReturn ret;
1613 IOInterruptState is;
1614
1615 if (enable == ivars->enable) {
1616 return kIOReturnSuccess;
1617 }
1618
1619 if (enable) {
1620 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1621 ivars->enable = enable;
1622 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1623 ret = ivars->provider->enableInterrupt(ivars->intIndex);
1624 } else {
1625 ret = ivars->provider->disableInterrupt(ivars->intIndex);
1626 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1627 ivars->enable = enable;
1628 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1629 }
1630
1631 return ret;
1632 }
1633
1634 kern_return_t
Cancel_Impl(IODispatchSourceCancelHandler handler)1635 IOInterruptDispatchSource::Cancel_Impl(
1636 IODispatchSourceCancelHandler handler)
1637 {
1638 IOInterruptState is;
1639
1640 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1641 ivars->canceled = true;
1642 if (ivars->waiter) {
1643 thread_wakeup_thread((event_t) ivars, ivars->waiter);
1644 ivars->waiter = NULL;
1645 }
1646 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1647
1648 return kIOReturnSuccess;
1649 }
1650
1651 kern_return_t
CheckForWork_Impl(const IORPC rpc,bool synchronous)1652 IOInterruptDispatchSource::CheckForWork_Impl(
1653 const IORPC rpc,
1654 bool synchronous)
1655 {
1656 IOReturn ret = kIOReturnNotReady;
1657 IOInterruptState is;
1658 bool willWait;
1659 bool canceled;
1660 wait_result_t waitResult;
1661 uint64_t icount;
1662 uint64_t itime;
1663 thread_t self;
1664
1665 self = current_thread();
1666 icount = 0;
1667 do {
1668 willWait = false;
1669 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1670 canceled = ivars->canceled;
1671 if (!canceled) {
1672 if ((icount = ivars->count)) {
1673 itime = ivars->time;
1674 ivars->count = 0;
1675 waitResult = THREAD_AWAKENED;
1676 } else if (synchronous) {
1677 assert(NULL == ivars->waiter);
1678 ivars->waiter = self;
1679 waitResult = assert_wait((event_t) ivars, THREAD_INTERRUPTIBLE);
1680 }
1681 willWait = (synchronous && (waitResult == THREAD_WAITING));
1682 if (willWait && (kIOInterruptTypeLevel & ivars->interruptType) && ivars->enable) {
1683 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1684 ivars->provider->enableInterrupt(ivars->intIndex);
1685 } else {
1686 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1687 }
1688 } else {
1689 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1690 }
1691 if (willWait) {
1692 waitResult = thread_block(THREAD_CONTINUE_NULL);
1693 if (THREAD_INTERRUPTED == waitResult) {
1694 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1695 ivars->waiter = NULL;
1696 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1697 canceled = true;
1698 break;
1699 }
1700 }
1701 } while (synchronous && !icount && !canceled);
1702
1703 if (icount && ivars->action) {
1704 ret = InterruptOccurred(rpc, ivars->action, icount, itime);
1705 }
1706
1707 return ret;
1708 }
1709
1710 void
InterruptOccurred_Impl(OSAction * action,uint64_t count,uint64_t time)1711 IOInterruptDispatchSource::InterruptOccurred_Impl(
1712 OSAction * action,
1713 uint64_t count,
1714 uint64_t time)
1715 {
1716 }
1717
1718 kern_return_t
GetLastInterrupt_Impl(uint64_t * pCount,uint64_t * pTime)1719 IOInterruptDispatchSource::GetLastInterrupt_Impl(
1720 uint64_t * pCount,
1721 uint64_t * pTime)
1722 {
1723 IOInterruptState is;
1724 uint64_t count, time;
1725
1726 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
1727 count = ivars->count;
1728 time = ivars->time;
1729 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
1730
1731 if (pCount) {
1732 *pCount = count;
1733 }
1734 if (pTime) {
1735 *pTime = time;
1736 }
1737 return kIOReturnSuccess;
1738 }
1739
1740 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1741
1742 enum {
1743 kIOServiceNotificationTypeCount = kIOServiceNotificationTypeLast + 1,
1744 };
1745
1746 struct IOServiceNotificationDispatchSource_IVars {
1747 OSObject * serverName;
1748 OSAction * action;
1749 IOLock * lock;
1750 IONotifier * notifier;
1751 OSDictionary * interestNotifiers;
1752 OSBoundedArray<OSArray *, kIOServiceNotificationTypeCount> pending;
1753 bool enable;
1754 };
1755
1756 kern_return_t
Create_Impl(OSDictionary * matching,uint64_t options,IODispatchQueue * queue,IOServiceNotificationDispatchSource ** notification)1757 IOServiceNotificationDispatchSource::Create_Impl(
1758 OSDictionary * matching,
1759 uint64_t options,
1760 IODispatchQueue * queue,
1761 IOServiceNotificationDispatchSource ** notification)
1762 {
1763 IOUserServer * us;
1764 IOReturn ret;
1765 IOServiceNotificationDispatchSource * inst;
1766
1767 inst = OSTypeAlloc(IOServiceNotificationDispatchSource);
1768 if (!inst->init()) {
1769 OSSafeReleaseNULL(inst);
1770 return kIOReturnNoMemory;
1771 }
1772
1773 us = (typeof(us))thread_iokit_tls_get(0);
1774 assert(OSDynamicCast(IOUserServer, us));
1775 if (!us) {
1776 OSSafeReleaseNULL(inst);
1777 return kIOReturnError;
1778 }
1779 inst->ivars->serverName = us->copyProperty(gIOUserServerNameKey);
1780 if (!inst->ivars->serverName) {
1781 OSSafeReleaseNULL(inst);
1782 return kIOReturnNoMemory;
1783 }
1784
1785 inst->ivars->lock = IOLockAlloc();
1786 if (!inst->ivars->lock) {
1787 OSSafeReleaseNULL(inst);
1788 return kIOReturnNoMemory;
1789 }
1790 for (uint32_t idx = 0; idx < kIOServiceNotificationTypeCount; idx++) {
1791 inst->ivars->pending[idx] = OSArray::withCapacity(4);
1792 if (!inst->ivars->pending[idx]) {
1793 OSSafeReleaseNULL(inst);
1794 return kIOReturnNoMemory;
1795 }
1796 }
1797 inst->ivars->interestNotifiers = OSDictionary::withCapacity(4);
1798 if (!inst->ivars->interestNotifiers) {
1799 OSSafeReleaseNULL(inst);
1800 return kIOReturnNoMemory;
1801 }
1802
1803 inst->ivars->notifier = IOService::addMatchingNotification(gIOMatchedNotification, matching, 0 /*priority*/,
1804 ^bool (IOService * newService, IONotifier * notifier) {
1805 bool notifyReady = false;
1806 IONotifier * interest;
1807 OSObject * serverName;
1808 bool okToUse;
1809
1810 serverName = newService->copyProperty(gIOUserServerNameKey);
1811 okToUse = (serverName && inst->ivars->serverName->isEqualTo(serverName));
1812 OSSafeReleaseNULL(serverName);
1813 if (!okToUse) {
1814 OSObject * prop;
1815 OSObject * str;
1816
1817 if (!newService->reserved->uvars || !newService->reserved->uvars->userServer) {
1818 return false;
1819 }
1820 str = OSString::withCStringNoCopy(kIODriverKitAllowsPublishEntitlementsKey);
1821 if (!str) {
1822 return false;
1823 }
1824 okToUse = newService->reserved->uvars->userServer->checkEntitlements(str, NULL, NULL);
1825 if (!okToUse) {
1826 DKLOG(DKS ": publisher entitlements check failed\n", DKN(newService));
1827 return false;
1828 }
1829 prop = newService->copyProperty(kIODriverKitPublishEntitlementsKey);
1830 if (!prop) {
1831 return false;
1832 }
1833 okToUse = us->checkEntitlements(prop, NULL, NULL);
1834 if (!okToUse) {
1835 DKLOG(DKS ": subscriber entitlements check failed\n", DKN(newService));
1836 return false;
1837 }
1838 }
1839
1840 IOLockLock(inst->ivars->lock);
1841 notifyReady = (0 == inst->ivars->pending[kIOServiceNotificationTypeMatched]->getCount());
1842 inst->ivars->pending[kIOServiceNotificationTypeMatched]->setObject(newService);
1843 IOLockUnlock(inst->ivars->lock);
1844
1845 interest = newService->registerInterest(gIOGeneralInterest,
1846 ^IOReturn (uint32_t messageType, IOService * provider,
1847 void * messageArgument, size_t argSize) {
1848 IONotifier * interest;
1849 bool notifyReady = false;
1850
1851 switch (messageType) {
1852 case kIOMessageServiceIsTerminated:
1853 IOLockLock(inst->ivars->lock);
1854 notifyReady = (0 == inst->ivars->pending[kIOServiceNotificationTypeTerminated]->getCount());
1855 inst->ivars->pending[kIOServiceNotificationTypeTerminated]->setObject(provider);
1856 if (inst->ivars->interestNotifiers != NULL) {
1857 interest = (typeof(interest))inst->ivars->interestNotifiers->getObject((const OSSymbol *) newService);
1858 assert(interest);
1859 interest->remove();
1860 inst->ivars->interestNotifiers->removeObject((const OSSymbol *) newService);
1861 }
1862 IOLockUnlock(inst->ivars->lock);
1863 break;
1864 default:
1865 break;
1866 }
1867 if (notifyReady && inst->ivars->action) {
1868 inst->ServiceNotificationReady(inst->ivars->action);
1869 }
1870 return kIOReturnSuccess;
1871 });
1872 if (interest) {
1873 IOLockLock(inst->ivars->lock);
1874 inst->ivars->interestNotifiers->setObject((const OSSymbol *) newService, interest);
1875 IOLockUnlock(inst->ivars->lock);
1876 }
1877 if (notifyReady) {
1878 if (inst->ivars->action) {
1879 inst->ServiceNotificationReady(inst->ivars->action);
1880 }
1881 }
1882 return false;
1883 });
1884
1885 if (!inst->ivars->notifier) {
1886 OSSafeReleaseNULL(inst);
1887 ret = kIOReturnError;
1888 }
1889
1890 *notification = inst;
1891 ret = kIOReturnSuccess;
1892
1893 return ret;
1894 }
1895
1896 kern_return_t
CopyNextNotification_Impl(uint64_t * type,IOService ** service,uint64_t * options)1897 IOServiceNotificationDispatchSource::CopyNextNotification_Impl(
1898 uint64_t * type,
1899 IOService ** service,
1900 uint64_t * options)
1901 {
1902 IOService * next;
1903 uint32_t idx;
1904
1905 IOLockLock(ivars->lock);
1906 for (idx = 0; idx < kIOServiceNotificationTypeCount; idx++) {
1907 next = (IOService *) ivars->pending[idx]->getObject(0);
1908 if (next) {
1909 next->retain();
1910 ivars->pending[idx]->removeObject(0);
1911 break;
1912 }
1913 }
1914 IOLockUnlock(ivars->lock);
1915
1916 if (idx == kIOServiceNotificationTypeCount) {
1917 idx = kIOServiceNotificationTypeNone;
1918 }
1919 *type = idx;
1920 *service = next;
1921 *options = 0;
1922
1923 return kIOReturnSuccess;
1924 }
1925
1926 bool
init()1927 IOServiceNotificationDispatchSource::init()
1928 {
1929 if (!super::init()) {
1930 return false;
1931 }
1932 ivars = IOMallocType(IOServiceNotificationDispatchSource_IVars);
1933
1934 return true;
1935 }
1936
1937 void
free()1938 IOServiceNotificationDispatchSource::free()
1939 {
1940 if (ivars) {
1941 if (ivars->notifier) {
1942 ivars->notifier->remove();
1943 ivars->notifier = NULL;
1944 }
1945 if (ivars->interestNotifiers) {
1946 OSDictionary * savedInterestNotifiers = NULL;
1947
1948 // the lock is always initialized first, so it should exist
1949 assert(ivars->lock);
1950
1951 // Prevent additional changes to interestNotifiers
1952 IOLockLock(ivars->lock);
1953 savedInterestNotifiers = ivars->interestNotifiers;
1954 ivars->interestNotifiers = NULL;
1955 IOLockUnlock(ivars->lock);
1956
1957 // Remove all interest notifiers
1958 savedInterestNotifiers->iterateObjects(^bool (const OSSymbol * key, OSObject * object) {
1959 IONotifier * interest = (typeof(interest))object;
1960 interest->remove();
1961 return false;
1962 });
1963 OSSafeReleaseNULL(savedInterestNotifiers);
1964 }
1965 for (uint32_t idx = 0; idx < kIOServiceNotificationTypeCount; idx++) {
1966 OSSafeReleaseNULL(ivars->pending[idx]);
1967 }
1968 if (ivars->lock) {
1969 IOLockFree(ivars->lock);
1970 ivars->lock = NULL;
1971 }
1972 OSSafeReleaseNULL(ivars->serverName);
1973 IOFreeType(ivars, IOServiceNotificationDispatchSource_IVars);
1974 }
1975
1976 super::free();
1977 }
1978
1979 kern_return_t
SetHandler_Impl(OSAction * action)1980 IOServiceNotificationDispatchSource::SetHandler_Impl(
1981 OSAction * action)
1982 {
1983 IOReturn ret;
1984 bool notifyReady;
1985
1986 notifyReady = false;
1987
1988 IOLockLock(ivars->lock);
1989 OSSafeReleaseNULL(ivars->action);
1990 action->retain();
1991 ivars->action = action;
1992 if (action) {
1993 for (uint32_t idx = 0; idx < kIOServiceNotificationTypeCount; idx++) {
1994 notifyReady = (ivars->pending[idx]->getCount());
1995 if (notifyReady) {
1996 break;
1997 }
1998 }
1999 }
2000 IOLockUnlock(ivars->lock);
2001
2002 if (notifyReady) {
2003 ServiceNotificationReady(action);
2004 }
2005 ret = kIOReturnSuccess;
2006
2007 return ret;
2008 }
2009
2010 kern_return_t
SetEnableWithCompletion_Impl(bool enable,IODispatchSourceCancelHandler handler)2011 IOServiceNotificationDispatchSource::SetEnableWithCompletion_Impl(
2012 bool enable,
2013 IODispatchSourceCancelHandler handler)
2014 {
2015 if (enable == ivars->enable) {
2016 return kIOReturnSuccess;
2017 }
2018
2019 IOLockLock(ivars->lock);
2020 ivars->enable = enable;
2021 IOLockUnlock(ivars->lock);
2022
2023 return kIOReturnSuccess;
2024 }
2025
2026 kern_return_t
Cancel_Impl(IODispatchSourceCancelHandler handler)2027 IOServiceNotificationDispatchSource::Cancel_Impl(
2028 IODispatchSourceCancelHandler handler)
2029 {
2030 return kIOReturnUnsupported;
2031 }
2032
2033 kern_return_t
CheckForWork_Impl(const IORPC rpc,bool synchronous)2034 IOServiceNotificationDispatchSource::CheckForWork_Impl(
2035 const IORPC rpc,
2036 bool synchronous)
2037 {
2038 return kIOReturnNotReady;
2039 }
2040
2041 kern_return_t
DeliverNotifications(IOServiceNotificationBlock block)2042 IOServiceNotificationDispatchSource::DeliverNotifications(IOServiceNotificationBlock block)
2043 {
2044 return kIOReturnUnsupported;
2045 }
2046
2047
2048 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2049
2050 OSDictionary *
CreatePropertyMatchingDictionary(const char * key,OSObjectPtr value,OSDictionary * matching)2051 IOService::CreatePropertyMatchingDictionary(const char * key, OSObjectPtr value, OSDictionary * matching)
2052 {
2053 OSDictionary * result;
2054 const OSSymbol * keySym;
2055
2056 keySym = OSSymbol::withCString(key);
2057 result = propertyMatching(keySym, (const OSObject *) value, matching);
2058 OSSafeReleaseNULL(keySym);
2059
2060 return result;
2061 }
2062
2063 OSDictionary *
CreatePropertyMatchingDictionary(const char * key,const char * stringValue,OSDictionary * matching)2064 IOService::CreatePropertyMatchingDictionary(const char * key, const char * stringValue, OSDictionary * matching)
2065 {
2066 OSDictionary * result;
2067 OSString * value;
2068
2069 value = OSString::withCString(stringValue);
2070 result = CreatePropertyMatchingDictionary(key, value, matching);
2071 OSSafeReleaseNULL(value);
2072
2073 return result;
2074 }
2075
2076 OSDictionary *
CreateKernelClassMatchingDictionary(OSString * className,OSDictionary * matching)2077 IOService::CreateKernelClassMatchingDictionary(OSString * className, OSDictionary * matching)
2078 {
2079 if (!className) {
2080 return NULL;
2081 }
2082 if (!matching) {
2083 matching = OSDictionary::withCapacity(2);
2084 if (!matching) {
2085 return NULL;
2086 }
2087 }
2088 matching->setObject(kIOProviderClassKey, className);
2089
2090 return matching;
2091 }
2092
2093 OSDictionary *
CreateKernelClassMatchingDictionary(const char * className,OSDictionary * matching)2094 IOService::CreateKernelClassMatchingDictionary(const char * className, OSDictionary * matching)
2095 {
2096 OSDictionary * result;
2097 OSString * string;
2098
2099 string = OSString::withCString(className);
2100 result = CreateKernelClassMatchingDictionary(string, matching);
2101 OSSafeReleaseNULL(string);
2102
2103 return result;
2104 }
2105
2106 OSDictionary *
CreateUserClassMatchingDictionary(OSString * className,OSDictionary * matching)2107 IOService::CreateUserClassMatchingDictionary(OSString * className, OSDictionary * matching)
2108 {
2109 return CreatePropertyMatchingDictionary(kIOUserClassKey, className, matching);
2110 }
2111
2112 OSDictionary *
CreateUserClassMatchingDictionary(const char * className,OSDictionary * matching)2113 IOService::CreateUserClassMatchingDictionary(const char * className, OSDictionary * matching)
2114 {
2115 return CreatePropertyMatchingDictionary(kIOUserClassKey, className, matching);
2116 }
2117
2118 OSDictionary *
CreateNameMatchingDictionary(OSString * serviceName,OSDictionary * matching)2119 IOService::CreateNameMatchingDictionary(OSString * serviceName, OSDictionary * matching)
2120 {
2121 if (!serviceName) {
2122 return NULL;
2123 }
2124 if (!matching) {
2125 matching = OSDictionary::withCapacity(2);
2126 if (!matching) {
2127 return NULL;
2128 }
2129 }
2130 matching->setObject(kIONameMatchKey, serviceName);
2131
2132 return matching;
2133 }
2134
2135 OSDictionary *
CreateNameMatchingDictionary(const char * serviceName,OSDictionary * matching)2136 IOService::CreateNameMatchingDictionary(const char * serviceName, OSDictionary * matching)
2137 {
2138 OSDictionary * result;
2139 OSString * string;
2140
2141 string = OSString::withCString(serviceName);
2142 result = CreateNameMatchingDictionary(string, matching);
2143 OSSafeReleaseNULL(string);
2144
2145 return result;
2146 }
2147
2148
2149
2150 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2151
2152 kern_return_t
waitInterruptTrap(void * p1,void * p2,void * p3,void * p4,void * p5,void * p6)2153 IOUserServer::waitInterruptTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6)
2154 {
2155 IOReturn ret = kIOReturnBadArgument;
2156 IOInterruptState is;
2157 IOInterruptDispatchSource * interrupt;
2158 IOInterruptDispatchSource_IVars * ivars;
2159 IOInterruptDispatchSourcePayload payload;
2160
2161 bool willWait;
2162 bool canceled;
2163 wait_result_t waitResult;
2164 thread_t self;
2165
2166 OSObject * object;
2167
2168 object = iokit_lookup_object_with_port_name((mach_port_name_t)(uintptr_t)p1, IKOT_UEXT_OBJECT, current_task());
2169
2170 if (!object) {
2171 return kIOReturnBadArgument;
2172 }
2173 if (!(interrupt = OSDynamicCast(IOInterruptDispatchSource, object))) {
2174 ret = kIOReturnBadArgument;
2175 } else {
2176 self = current_thread();
2177 ivars = interrupt->ivars;
2178 payload.count = 0;
2179 do {
2180 willWait = false;
2181 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
2182 canceled = ivars->canceled;
2183 if (!canceled) {
2184 if ((payload.count = ivars->count)) {
2185 payload.time = ivars->time;
2186 ivars->count = 0;
2187 waitResult = THREAD_AWAKENED;
2188 } else {
2189 assert(NULL == ivars->waiter);
2190 ivars->waiter = self;
2191 waitResult = assert_wait((event_t) ivars, THREAD_INTERRUPTIBLE);
2192 }
2193 willWait = (waitResult == THREAD_WAITING);
2194 if (willWait && (kIOInterruptTypeLevel & ivars->interruptType) && ivars->enable) {
2195 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
2196 ivars->provider->enableInterrupt(ivars->intIndex);
2197 } else {
2198 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
2199 }
2200 } else {
2201 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
2202 }
2203 if (willWait) {
2204 waitResult = thread_block(THREAD_CONTINUE_NULL);
2205 if (THREAD_INTERRUPTED == waitResult) {
2206 is = IOSimpleLockLockDisableInterrupt(ivars->lock);
2207 ivars->waiter = NULL;
2208 IOSimpleLockUnlockEnableInterrupt(ivars->lock, is);
2209 canceled = true;
2210 break;
2211 }
2212 }
2213 } while (!payload.count && !canceled);
2214 ret = (payload.count ? kIOReturnSuccess : kIOReturnAborted);
2215 }
2216
2217 if (kIOReturnSuccess == ret) {
2218 int copyerr = copyout(&payload, (user_addr_t) p2, sizeof(payload));
2219 if (copyerr) {
2220 ret = kIOReturnVMError;
2221 }
2222 }
2223
2224 object->release();
2225
2226 return ret;
2227 }
2228
2229 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2230
2231 kern_return_t
Create_Impl(const char * name,uint64_t tag,uint64_t options,OSString * bundleID,IOUserServer ** server)2232 IOUserServer::Create_Impl(
2233 const char * name,
2234 uint64_t tag,
2235 uint64_t options,
2236 OSString * bundleID,
2237 IOUserServer ** server)
2238 {
2239 IOReturn ret;
2240 IOUserServer * us;
2241 const OSSymbol * sym;
2242 OSNumber * serverTag;
2243 io_name_t rname;
2244 OSKext * kext;
2245
2246 us = (typeof(us))thread_iokit_tls_get(0);
2247 assert(OSDynamicCast(IOUserServer, us));
2248 if (kIODKLogSetup & gIODKDebug) {
2249 DKLOG(DKS "::Create(" DKS ") %p\n", DKN(us), name, tag, us);
2250 }
2251 if (!us) {
2252 return kIOReturnError;
2253 }
2254
2255 if (bundleID) {
2256 kext = OSKext::lookupKextWithIdentifier(bundleID->getCStringNoCopy());
2257 if (kext) {
2258 us->setTaskLoadTag(kext);
2259 us->setDriverKitUUID(kext);
2260 us->setDriverKitStatistics(kext);
2261 OSKext::OSKextLogDriverKitInfoLoad(kext);
2262 OSSafeReleaseNULL(kext);
2263 } else {
2264 DKLOG(DKS "::Create(" DKS "): could not find OSKext for %s\n", DKN(us), name, tag, bundleID->getCStringNoCopy());
2265 }
2266
2267 us->fAllocationName = kern_allocation_name_allocate(bundleID->getCStringNoCopy(), 0);
2268 assert(us->fAllocationName);
2269 }
2270
2271 sym = OSSymbol::withCString(name);
2272 serverTag = OSNumber::withNumber(tag, 64);
2273
2274 us->setProperty(gIOUserServerNameKey, (OSObject *) sym);
2275 us->setProperty(gIOUserServerTagKey, serverTag);
2276
2277 serverTag->release();
2278 OSSafeReleaseNULL(sym);
2279
2280 snprintf(rname, sizeof(rname), "IOUserServer(%s-0x%qx)", name, tag);
2281 us->setName(rname);
2282
2283 us->retain();
2284 *server = us;
2285 ret = kIOReturnSuccess;
2286
2287 return ret;
2288 }
2289
2290 kern_return_t
RegisterService_Impl()2291 IOUserServer::RegisterService_Impl()
2292 {
2293 kern_return_t ret = IOService::RegisterService_Impl();
2294
2295 return ret;
2296 }
2297
2298 kern_return_t
Exit_Impl(const char * reason)2299 IOUserServer::Exit_Impl(
2300 const char * reason)
2301 {
2302 return kIOReturnUnsupported;
2303 }
2304
2305 kern_return_t
LoadModule_Impl(const char * path)2306 IOUserServer::LoadModule_Impl(
2307 const char * path)
2308 {
2309 return kIOReturnUnsupported;
2310 }
2311
2312
2313 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2314
2315 kern_return_t
Create_Impl(const char * name,uint64_t options,uint64_t priority,IODispatchQueue ** queue)2316 IODispatchQueue::Create_Impl(
2317 const char * name,
2318 uint64_t options,
2319 uint64_t priority,
2320 IODispatchQueue ** queue)
2321 {
2322 IODispatchQueue * result;
2323 IOUserServer * us;
2324
2325 result = OSTypeAlloc(IODispatchQueue);
2326 if (!result) {
2327 return kIOReturnNoMemory;
2328 }
2329 if (!result->init()) {
2330 OSSafeReleaseNULL(result);
2331 return kIOReturnNoMemory;
2332 }
2333
2334 *queue = result;
2335
2336 if (!strcmp("Root", name)) {
2337 us = (typeof(us))thread_iokit_tls_get(0);
2338 assert(OSDynamicCast(IOUserServer, us));
2339 us->setRootQueue(result);
2340 }
2341
2342 if (kIODKLogSetup & gIODKDebug) {
2343 DKLOG("IODispatchQueue::Create %s %p\n", name, result);
2344 }
2345
2346 return kIOReturnSuccess;
2347 }
2348
2349 kern_return_t
SetPort_Impl(mach_port_t port)2350 IODispatchQueue::SetPort_Impl(
2351 mach_port_t port)
2352 {
2353 if (MACH_PORT_NULL != ivars->serverPort) {
2354 return kIOReturnNotReady;
2355 }
2356
2357 ivars->serverPort = port;
2358 return kIOReturnSuccess;
2359 }
2360
2361 bool
init()2362 IODispatchQueue::init()
2363 {
2364 ivars = IOMallocType(IODispatchQueue_IVars);
2365 ivars->queue = this;
2366
2367 return true;
2368 }
2369
2370 void
free()2371 IODispatchQueue::free()
2372 {
2373 if (ivars && ivars->serverPort) {
2374 ipc_port_release_send(ivars->serverPort);
2375 ivars->serverPort = MACH_PORT_NULL;
2376 }
2377 IOFreeType(ivars, IODispatchQueue_IVars);
2378 super::free();
2379 }
2380
2381 bool
OnQueue()2382 IODispatchQueue::OnQueue()
2383 {
2384 return false;
2385 }
2386
2387 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2388
2389
2390 kern_return_t
Dispatch(IORPC rpc)2391 OSMetaClassBase::Dispatch(IORPC rpc)
2392 {
2393 return kIOReturnUnsupported;
2394 }
2395
2396 kern_return_t
Invoke(IORPC rpc)2397 OSMetaClassBase::Invoke(IORPC rpc)
2398 {
2399 IOReturn ret = kIOReturnUnsupported;
2400 OSMetaClassBase * object;
2401 OSAction * action;
2402 IOService * service;
2403 IOUserServer * us;
2404 IORPCMessage * message;
2405
2406 assert(rpc.sendSize >= (sizeof(IORPCMessageMach) + sizeof(IORPCMessage)));
2407 message = rpc.kernelContent;
2408 if (!message) {
2409 return kIOReturnIPCError;
2410 }
2411 message->flags |= kIORPCMessageKernel;
2412
2413 us = NULL;
2414 if (!(kIORPCMessageLocalHost & message->flags)) {
2415 us = OSDynamicCast(IOUserServer, this);
2416 if (!us) {
2417 IOEventLink * eventLink = NULL;
2418 IOWorkGroup * workgroup = NULL;
2419
2420 if ((action = OSDynamicCast(OSAction, this))) {
2421 object = IOUserServer::target(action, message);
2422 } else {
2423 object = this;
2424 }
2425 if ((service = OSDynamicCast(IOService, object))
2426 && service->reserved->uvars) {
2427 // xxx other classes
2428 us = service->reserved->uvars->userServer;
2429 } else if (action) {
2430 us = action->ivars->userServer;
2431 } else if ((eventLink = OSDynamicCast(IOEventLink, object))) {
2432 us = eventLink->ivars->userServer;
2433 } else if ((workgroup = OSDynamicCast(IOWorkGroup, object))) {
2434 us = workgroup->ivars->userServer;
2435 }
2436 }
2437 }
2438 if (us) {
2439 message->flags |= kIORPCMessageRemote;
2440 ret = us->rpc(rpc);
2441 if (kIOReturnSuccess != ret) {
2442 if (kIODKLogIPC & gIODKDebug) {
2443 DKLOG("OSMetaClassBase::Invoke user 0x%x\n", ret);
2444 }
2445 }
2446 } else {
2447 if (kIODKLogIPC & gIODKDebug) {
2448 DKLOG("OSMetaClassBase::Invoke kernel %s 0x%qx\n", getMetaClass()->getClassName(), message->msgid);
2449 }
2450 void * prior = thread_iokit_tls_get(0);
2451 thread_iokit_tls_set(0, NULL);
2452 ret = Dispatch(rpc);
2453 thread_iokit_tls_set(0, prior);
2454 }
2455
2456 return ret;
2457 }
2458
2459 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2460
2461 struct IOPStrings {
2462 uint32_t dataSize;
2463 uint32_t count;
2464 const char strings[0];
2465 };
2466
2467 kern_return_t
Dispatch(IORPC rpc)2468 OSUserMetaClass::Dispatch(IORPC rpc)
2469 {
2470 if (meta) {
2471 return const_cast<OSMetaClass *>(meta)->Dispatch(rpc);
2472 } else {
2473 return kIOReturnUnsupported;
2474 }
2475 }
2476
2477 void
free()2478 OSUserMetaClass::free()
2479 {
2480 if (queueNames) {
2481 IOFreeData(queueNames, sizeof(IOPStrings) + queueNames->dataSize * sizeof(char));
2482 queueNames = NULL;
2483 }
2484 if (description) {
2485 IOFreeData(description, description->descriptionSize);
2486 description = NULL;
2487 }
2488 IODeleteData(methods, uint64_t, 2 * methodCount);
2489 if (meta) {
2490 meta->releaseMetaClass();
2491 }
2492 if (name) {
2493 name->release();
2494 }
2495 OSObject::free();
2496 }
2497
2498 /*
2499 * Sets the loadTag of the associated OSKext
2500 * in the dext task.
2501 * NOTE: different instances of the same OSKext
2502 * (so same BounleID but different tasks)
2503 * will have the same loadTag.
2504 */
2505 void
setTaskLoadTag(OSKext * kext)2506 IOUserServer::setTaskLoadTag(OSKext *kext)
2507 {
2508 task_t owningTask;
2509 uint32_t loadTag, prev_taskloadTag;
2510
2511 owningTask = this->fOwningTask;
2512 if (!owningTask) {
2513 printf("%s: fOwningTask not found\n", __FUNCTION__);
2514 return;
2515 }
2516
2517 loadTag = kext->getLoadTag();
2518 prev_taskloadTag = set_task_loadTag(owningTask, loadTag);
2519 if (prev_taskloadTag) {
2520 printf("%s: found the task loadTag already set to %u (set to %u)\n",
2521 __FUNCTION__, prev_taskloadTag, loadTag);
2522 }
2523 }
2524
2525 /*
2526 * Sets the OSKext uuid as the uuid of the userspace
2527 * dext executable.
2528 */
2529 void
setDriverKitUUID(OSKext * kext)2530 IOUserServer::setDriverKitUUID(OSKext *kext)
2531 {
2532 task_t task;
2533 proc_t p;
2534 uuid_t p_uuid, k_uuid;
2535 OSData *k_data_uuid;
2536 OSData *new_uuid;
2537 uuid_string_t uuid_string = "";
2538
2539 task = this->fOwningTask;
2540 if (!task) {
2541 printf("%s: fOwningTask not found\n", __FUNCTION__);
2542 return;
2543 }
2544
2545 p = (proc_t)(get_bsdtask_info(task));
2546 if (!p) {
2547 printf("%s: proc not found\n", __FUNCTION__);
2548 return;
2549 }
2550 proc_getexecutableuuid(p, p_uuid, sizeof(p_uuid));
2551
2552 k_data_uuid = kext->copyUUID();
2553 if (k_data_uuid) {
2554 memcpy(&k_uuid, k_data_uuid->getBytesNoCopy(), sizeof(k_uuid));
2555 OSSafeReleaseNULL(k_data_uuid);
2556 if (uuid_compare(k_uuid, p_uuid) != 0) {
2557 printf("%s: uuid not matching\n", __FUNCTION__);
2558 }
2559 return;
2560 }
2561
2562 uuid_unparse(p_uuid, uuid_string);
2563 new_uuid = OSData::withValue(p_uuid);
2564 kext->setDriverKitUUID(new_uuid);
2565 }
2566
2567 void
setDriverKitStatistics(OSKext * kext)2568 IOUserServer::setDriverKitStatistics(OSKext *kext)
2569 {
2570 OSDextStatistics * statistics = kext->copyDextStatistics();
2571 if (statistics == NULL) {
2572 panic("Kext %s was not a DriverKit OSKext", kext->getIdentifierCString());
2573 }
2574 fStatistics = statistics;
2575 }
2576
2577 void
setCheckInToken(IOUserServerCheckInToken * token)2578 IOUserServer::setCheckInToken(IOUserServerCheckInToken *token)
2579 {
2580 if (token != NULL && fCheckInToken == NULL) {
2581 token->retain();
2582 fCheckInToken = token;
2583 iokit_clear_registered_ports(fOwningTask);
2584 } else {
2585 printf("%s: failed to set check in token. token=%p, fCheckInToken=%p\n", __FUNCTION__, token, fCheckInToken);
2586 }
2587 }
2588
2589 bool
serviceMatchesCheckInToken(IOUserServerCheckInToken * token)2590 IOUserServer::serviceMatchesCheckInToken(IOUserServerCheckInToken *token)
2591 {
2592 if (token != NULL) {
2593 bool result = token == fCheckInToken;
2594 if (result) {
2595 fCheckInToken->complete();
2596 }
2597 return result;
2598 } else {
2599 printf("%s: null check in token\n", __FUNCTION__);
2600 return false;
2601 }
2602 }
2603
2604 // entitlements - dict of entitlements to check
2605 // prop - string - if present return true
2606 // - array of strings - if any present return true
2607 // - array of arrays of strings - in each leaf array all must be present
2608 // - if any top level array succeeds return true
2609 // consumes one reference of prop
2610 bool
checkEntitlements(OSDictionary * entitlements,OSObject * prop,IOService * provider,IOService * dext)2611 IOUserServer::checkEntitlements(
2612 OSDictionary * entitlements, OSObject * prop,
2613 IOService * provider, IOService * dext)
2614 {
2615 OSDictionary * matching;
2616
2617 if (!prop) {
2618 return true;
2619 }
2620 if (!entitlements) {
2621 OSSafeReleaseNULL(prop);
2622 return false;
2623 }
2624
2625 matching = NULL;
2626 if (dext) {
2627 matching = dext->dictionaryWithProperties();
2628 if (!matching) {
2629 OSSafeReleaseNULL(prop);
2630 return false;
2631 }
2632 }
2633
2634 bool allPresent __block = false;
2635 prop->iterateObjects(^bool (OSObject * object) {
2636 allPresent = false;
2637 object->iterateObjects(^bool (OSObject * object) {
2638 OSString * string;
2639 OSObject * value;
2640 string = OSDynamicCast(OSString, object);
2641 value = entitlements->getObject(string);
2642 if (matching && value) {
2643 matching->setObject(string, value);
2644 }
2645 allPresent = (NULL != value);
2646 // early terminate if not found
2647 return !allPresent;
2648 });
2649 // early terminate if found
2650 return allPresent;
2651 });
2652
2653 if (allPresent && matching && provider) {
2654 allPresent = provider->matchPropertyTable(matching);
2655 }
2656
2657 OSSafeReleaseNULL(matching);
2658 OSSafeReleaseNULL(prop);
2659
2660 return allPresent;
2661 }
2662
2663 bool
checkEntitlements(OSObject * prop,IOService * provider,IOService * dext)2664 IOUserServer::checkEntitlements(OSObject * prop, IOService * provider, IOService * dext)
2665 {
2666 return checkEntitlements(fEntitlements, prop, provider, dext);
2667 }
2668
2669 bool
checkEntitlements(IOService * provider,IOService * dext)2670 IOUserServer::checkEntitlements(IOService * provider, IOService * dext)
2671 {
2672 OSObject * prop;
2673 bool ok;
2674
2675 if (!fOwningTask) {
2676 return false;
2677 }
2678
2679 prop = provider->copyProperty(gIOServiceDEXTEntitlementsKey);
2680 ok = checkEntitlements(fEntitlements, prop, provider, dext);
2681 if (!ok) {
2682 DKLOG(DKS ": provider entitlements check failed\n", DKN(dext));
2683 }
2684 if (ok) {
2685 prop = dext->copyProperty(gIOServiceDEXTEntitlementsKey);
2686 ok = checkEntitlements(fEntitlements, prop, NULL, NULL);
2687 if (!ok) {
2688 DKLOG(DKS ": family entitlements check failed\n", DKN(dext));
2689 }
2690 }
2691
2692 return ok;
2693 }
2694
2695 IOReturn
exit(const char * reason)2696 IOUserServer::exit(const char * reason)
2697 {
2698 DKLOG("%s::exit(%s)\n", getName(), reason);
2699 Exit(reason);
2700 return kIOReturnSuccess;
2701 }
2702
2703 IOReturn
kill(const char * reason)2704 IOUserServer::kill(const char * reason)
2705 {
2706 IOReturn ret = kIOReturnError;
2707 if (fOwningTask != NULL) {
2708 DKLOG("%s::kill(%s)\n", getName(), reason);
2709 task_bsdtask_kill(fOwningTask);
2710 ret = kIOReturnSuccess;
2711 }
2712 return ret;
2713 }
2714
2715 OSObjectUserVars *
varsForObject(OSObject * obj)2716 IOUserServer::varsForObject(OSObject * obj)
2717 {
2718 IOService * service;
2719
2720 if ((service = OSDynamicCast(IOService, obj))) {
2721 return service->reserved->uvars;
2722 }
2723
2724 return NULL;
2725 }
2726
2727 IOPStrings *
copyInStringArray(const char * string,uint32_t userSize)2728 IOUserServer::copyInStringArray(const char * string, uint32_t userSize)
2729 {
2730 IOPStrings * array;
2731 vm_size_t alloc;
2732 size_t len;
2733 const char * end;
2734 OSBoundedPtr<const char> cstr;
2735
2736 if (userSize <= 1) {
2737 return NULL;
2738 }
2739
2740 if (os_add_overflow(sizeof(IOPStrings), userSize, &alloc)) {
2741 assert(false);
2742 return NULL;
2743 }
2744 if (alloc > 16384) {
2745 assert(false);
2746 return NULL;
2747 }
2748 array = (typeof(array))IOMallocData(alloc);
2749 if (!array) {
2750 return NULL;
2751 }
2752 array->dataSize = userSize;
2753 bcopy(string, (void *) &array->strings[0], userSize);
2754
2755 array->count = 0;
2756 end = &array->strings[array->dataSize];
2757 cstr = OSBoundedPtr<const char>(&array->strings[0], &array->strings[0], end);
2758 while ((len = (unsigned char)cstr[0])) {
2759 cstr++;
2760 if ((cstr + len) >= end) {
2761 break;
2762 }
2763 cstr += len;
2764 array->count++;
2765 }
2766 if (len) {
2767 IOFreeData(array, alloc);
2768 array = NULL;
2769 }
2770
2771 return array;
2772 }
2773
2774 uint32_t
stringArrayIndex(IOPStrings * array,const char * look)2775 IOUserServer::stringArrayIndex(IOPStrings * array, const char * look)
2776 {
2777 uint32_t idx;
2778 size_t len, llen;
2779 OSBoundedPtr<const char> cstr;
2780 const char * end;
2781
2782 idx = 0;
2783 end = &array->strings[array->dataSize];
2784 cstr = OSBoundedPtr<const char>(&array->strings[0], &array->strings[0], end);
2785
2786 llen = strlen(look);
2787 while ((len = (unsigned char)cstr[0])) {
2788 cstr++;
2789 if ((cstr + len) >= end) {
2790 break;
2791 }
2792 if ((len == llen) && !strncmp(cstr.discard_bounds(), look, len)) {
2793 return idx;
2794 }
2795 cstr += len;
2796 idx++;
2797 }
2798
2799 return -1U;
2800 }
2801 #define kIODispatchQueueStopped ((IODispatchQueue *) -1L)
2802
2803 IODispatchQueue *
queueForObject(OSObject * obj,uint64_t msgid)2804 IOUserServer::queueForObject(OSObject * obj, uint64_t msgid)
2805 {
2806 IODispatchQueue * queue;
2807 OSObjectUserVars * uvars;
2808 uint64_t option;
2809
2810 uvars = varsForObject(obj);
2811 if (!uvars) {
2812 return NULL;
2813 }
2814 if (!uvars->queueArray) {
2815 if (uvars->stopped) {
2816 return kIODispatchQueueStopped;
2817 }
2818 return NULL;
2819 }
2820 queue = uvars->queueArray[0];
2821
2822 if (uvars->userMeta
2823 && uvars->userMeta->methods) {
2824 uint32_t idx, baseIdx;
2825 uint32_t lim;
2826 // bsearch
2827 for (baseIdx = 0, lim = uvars->userMeta->methodCount; lim; lim >>= 1) {
2828 idx = baseIdx + (lim >> 1);
2829 if (msgid == uvars->userMeta->methods[idx]) {
2830 option = uvars->userMeta->methods[uvars->userMeta->methodCount + idx];
2831 option &= 0xFF;
2832 if (option < uvars->userMeta->queueNames->count) {
2833 queue = uvars->queueArray[option + 1];
2834 }
2835 break;
2836 } else if (msgid > uvars->userMeta->methods[idx]) {
2837 // move right
2838 baseIdx += (lim >> 1) + 1;
2839 lim--;
2840 }
2841 // else move left
2842 }
2843 }
2844 return queue;
2845 }
2846
2847 IOReturn
objectInstantiate(OSObject * obj,IORPC rpc,IORPCMessage * message)2848 IOUserServer::objectInstantiate(OSObject * obj, IORPC rpc, IORPCMessage * message)
2849 {
2850 IOReturn ret;
2851 OSString * str;
2852 OSObject * prop;
2853 IOService * service;
2854
2855 OSAction * action;
2856 OSObject * target;
2857 uint32_t queueCount, queueAlloc;
2858 const char * resultClassName;
2859 uint64_t resultFlags;
2860
2861 mach_msg_size_t replySize;
2862 uint32_t methodCount;
2863 const uint64_t * methods;
2864 IODispatchQueue * queue;
2865 OSUserMetaClass * userMeta;
2866 OSObjectUserVars * uvars;
2867 uint32_t idx;
2868 ipc_port_t sendPort;
2869
2870 OSObject_Instantiate_Rpl_Content * reply;
2871 IODispatchQueue ** unboundedQueueArray = NULL;
2872 queueCount = 0;
2873 methodCount = 0;
2874 methods = NULL;
2875 str = NULL;
2876 prop = NULL;
2877 userMeta = NULL;
2878 resultClassName = NULL;
2879 resultFlags = 0;
2880 ret = kIOReturnUnsupportedMode;
2881
2882 service = OSDynamicCast(IOService, obj);
2883 action = OSDynamicCast(OSAction, obj);
2884 if (!service) {
2885 // xxx other classes hosted
2886 resultFlags |= kOSObjectRPCKernel;
2887 resultFlags |= kOSObjectRPCRemote;
2888 } else {
2889 if (service->isInactive()) {
2890 DKLOG(DKS "::instantiate inactive\n", DKN(service));
2891 return kIOReturnOffline;
2892 }
2893 prop = service->copyProperty(gIOUserClassKey);
2894 str = OSDynamicCast(OSString, prop);
2895 if (!service->reserved->uvars) {
2896 resultFlags |= kOSObjectRPCRemote;
2897 resultFlags |= kOSObjectRPCKernel;
2898 } else if (this != service->reserved->uvars->userServer) {
2899 // remote, use base class
2900 resultFlags |= kOSObjectRPCRemote;
2901 }
2902 if (service->reserved->uvars && service->reserved->uvars->userServer) {
2903 if (!str) {
2904 DKLOG("no IOUserClass defined for " DKS "\n", DKN(service));
2905 OSSafeReleaseNULL(prop);
2906 return kIOReturnError;
2907 }
2908 IOLockLock(service->reserved->uvars->userServer->fLock);
2909 userMeta = (typeof(userMeta))service->reserved->uvars->userServer->fClasses->getObject(str);
2910 IOLockUnlock(service->reserved->uvars->userServer->fLock);
2911 }
2912 }
2913 if (!str && !userMeta) {
2914 const OSMetaClass * meta;
2915 meta = obj->getMetaClass();
2916 IOLockLock(fLock);
2917 if (action) {
2918 str = action->ivars->typeName;
2919 if (str) {
2920 userMeta = (typeof(userMeta))fClasses->getObject(str);
2921 }
2922 }
2923 while (meta && !userMeta) {
2924 str = (OSString *) meta->getClassNameSymbol();
2925 userMeta = (typeof(userMeta))fClasses->getObject(str);
2926 if (!userMeta) {
2927 meta = meta->getSuperClass();
2928 }
2929 }
2930 IOLockUnlock(fLock);
2931 }
2932 if (str) {
2933 if (!userMeta) {
2934 IOLockLock(fLock);
2935 userMeta = (typeof(userMeta))fClasses->getObject(str);
2936 IOLockUnlock(fLock);
2937 }
2938 if (kIODKLogSetup & gIODKDebug) {
2939 DKLOG("userMeta %s %p\n", str->getCStringNoCopy(), userMeta);
2940 }
2941 if (userMeta) {
2942 if (kOSObjectRPCRemote & resultFlags) {
2943 if (!action) {
2944 /* Special case: For OSAction subclasses, do not use the superclass */
2945 while (userMeta && !(kOSClassCanRemote & userMeta->description->flags)) {
2946 userMeta = userMeta->superMeta;
2947 }
2948 }
2949 if (userMeta) {
2950 resultClassName = userMeta->description->name;
2951 ret = kIOReturnSuccess;
2952 }
2953 } else {
2954 service->reserved->uvars->userMeta = userMeta;
2955 queueAlloc = 1;
2956 if (userMeta->queueNames) {
2957 queueAlloc += userMeta->queueNames->count;
2958 }
2959 unboundedQueueArray = IONewZero(IODispatchQueue *, queueAlloc);
2960 service->reserved->uvars->queueArray =
2961 OSBoundedArrayRef<IODispatchQueue *>(unboundedQueueArray, queueAlloc);
2962 resultClassName = str->getCStringNoCopy();
2963 ret = kIOReturnSuccess;
2964 }
2965 } else if (kIODKLogSetup & gIODKDebug) {
2966 DKLOG("userMeta %s was not found in fClasses\n", str->getCStringNoCopy());
2967 IOLockLock(fLock);
2968 fClasses->iterateObjects(^bool (const OSSymbol * key, OSObject * val) {
2969 DKLOG(" fClasses[\"%s\"] => %p\n", key->getCStringNoCopy(), val);
2970 return false;
2971 });
2972 IOLockUnlock(fLock);
2973 }
2974 }
2975 OSSafeReleaseNULL(prop);
2976
2977 IORPCMessageMach * machReply = rpc.reply;
2978 replySize = sizeof(OSObject_Instantiate_Rpl);
2979
2980 if ((kIOReturnSuccess == ret) && (kOSObjectRPCRemote & resultFlags)) {
2981 target = obj;
2982 if (action) {
2983 if (action->ivars->referenceSize) {
2984 resultFlags |= kOSObjectRPCKernel;
2985 } else {
2986 resultFlags &= ~kOSObjectRPCKernel;
2987 if (action->ivars->target) {
2988 target = action->ivars->target;
2989 queueCount = 1;
2990 queue = queueForObject(target, action->ivars->targetmsgid);
2991 if (!queue && action->ivars->userServer) {
2992 queue = action->ivars->userServer->fRootQueue;
2993 }
2994 idx = 0;
2995 sendPort = NULL;
2996 if (queue && (kIODispatchQueueStopped != queue)) {
2997 sendPort = ipc_port_copy_send_mqueue(queue->ivars->serverPort);
2998 }
2999 replySize = sizeof(OSObject_Instantiate_Rpl)
3000 + queueCount * sizeof(machReply->objects[0])
3001 + 2 * methodCount * sizeof(reply->methods[0]);
3002 if (replySize > rpc.replySize) {
3003 assert(false);
3004 return kIOReturnIPCError;
3005 }
3006 machReply->objects[idx].type = MACH_MSG_PORT_DESCRIPTOR;
3007 machReply->objects[idx].disposition = MACH_MSG_TYPE_MOVE_SEND;
3008 machReply->objects[idx].name = sendPort;
3009 machReply->objects[idx].pad2 = 0;
3010 machReply->objects[idx].pad_end = 0;
3011 }
3012 }
3013 } else {
3014 uvars = varsForObject(target);
3015 if (uvars && uvars->userMeta) {
3016 queueCount = 1;
3017 if (uvars->userMeta->queueNames) {
3018 queueCount += uvars->userMeta->queueNames->count;
3019 }
3020 methods = &uvars->userMeta->methods[0];
3021 methodCount = uvars->userMeta->methodCount;
3022 replySize = sizeof(OSObject_Instantiate_Rpl)
3023 + queueCount * sizeof(machReply->objects[0])
3024 + 2 * methodCount * sizeof(reply->methods[0]);
3025 if (replySize > rpc.replySize) {
3026 assert(false);
3027 return kIOReturnIPCError;
3028 }
3029 for (idx = 0; idx < queueCount; idx++) {
3030 queue = uvars->queueArray[idx];
3031 sendPort = NULL;
3032 if (queue) {
3033 sendPort = ipc_port_copy_send_mqueue(queue->ivars->serverPort);
3034 }
3035 machReply->objects[idx].type = MACH_MSG_PORT_DESCRIPTOR;
3036 machReply->objects[idx].disposition = MACH_MSG_TYPE_MOVE_SEND;
3037 machReply->objects[idx].name = sendPort;
3038 machReply->objects[idx].pad2 = 0;
3039 machReply->objects[idx].pad_end = 0;
3040 }
3041 }
3042 }
3043 }
3044
3045 if (kIODKLogIPC & gIODKDebug) {
3046 DKLOG("instantiate object %s with user class %s\n", obj->getMetaClass()->getClassName(), str ? str->getCStringNoCopy() : "(null)");
3047 }
3048
3049 if (kIOReturnSuccess != ret) {
3050 DKLOG("%s: no user class found\n", str ? str->getCStringNoCopy() : obj->getMetaClass()->getClassName());
3051 resultClassName = "unknown";
3052 }
3053
3054 machReply->msgh.msgh_id = kIORPCVersionCurrentReply;
3055 machReply->msgh.msgh_size = replySize;
3056 machReply->msgh_body.msgh_descriptor_count = queueCount;
3057
3058 reply = (typeof(reply))IORPCMessageFromMachReply(machReply);
3059 if (!reply) {
3060 return kIOReturnIPCError;
3061 }
3062 if (methodCount) {
3063 bcopy(methods, &reply->methods[0], methodCount * 2 * sizeof(reply->methods[0]));
3064 }
3065 reply->__hdr.msgid = OSObject_Instantiate_ID;
3066 reply->__hdr.flags = kIORPCMessageOneway;
3067 reply->__hdr.objectRefs = 0;
3068 reply->__pad = 0;
3069 reply->flags = resultFlags;
3070 strlcpy(reply->classname, resultClassName, sizeof(reply->classname));
3071 reply->__result = ret;
3072
3073 ret = kIOReturnSuccess;
3074
3075 return ret;
3076 }
3077
3078 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3079
3080 IOReturn
kernelDispatch(OSObject * obj,IORPC rpc)3081 IOUserServer::kernelDispatch(OSObject * obj, IORPC rpc)
3082 {
3083 IOReturn ret;
3084 IORPCMessage * message;
3085
3086 message = rpc.kernelContent;
3087 if (!message) {
3088 return kIOReturnIPCError;
3089 }
3090
3091 if (OSObject_Instantiate_ID == message->msgid) {
3092 ret = objectInstantiate(obj, rpc, message);
3093 if (kIOReturnSuccess != ret) {
3094 DKLOG("%s: instantiate failed 0x%x\n", obj->getMetaClass()->getClassName(), ret);
3095 }
3096 } else {
3097 if (kIODKLogIPC & gIODKDebug) {
3098 DKLOG("%s::Dispatch kernel 0x%qx\n", obj->getMetaClass()->getClassName(), message->msgid);
3099 }
3100 ret = obj->Dispatch(rpc);
3101 if (kIODKLogIPC & gIODKDebug) {
3102 DKLOG("%s::Dispatch kernel 0x%qx result 0x%x\n", obj->getMetaClass()->getClassName(), message->msgid, ret);
3103 }
3104 }
3105
3106 return ret;
3107 }
3108
3109
3110 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3111
3112 OSObject *
target(OSAction * action,IORPCMessage * message)3113 IOUserServer::target(OSAction * action, IORPCMessage * message)
3114 {
3115 OSObject * object;
3116
3117 if (message->msgid != action->ivars->msgid) {
3118 return action;
3119 }
3120 object = action->ivars->target;
3121 if (!object) {
3122 return action;
3123 }
3124 message->msgid = action->ivars->targetmsgid;
3125 message->objects[0] = (OSObjectRef) object;
3126 if (kIORPCMessageRemote & message->flags) {
3127 object->retain();
3128 #ifndef __clang_analyzer__
3129 // Hide the release of 'action' from the clang static analyzer to suppress
3130 // an overrelease diagnostic. The analyzer doesn't have a way to express the
3131 // non-standard contract of this method, which is that it releases 'action' when
3132 // the message flags have kIORPCMessageRemote set.
3133 action->release();
3134 #endif
3135 }
3136 if (kIODKLogIPC & gIODKDebug) {
3137 DKLOG("TARGET %s msg 0x%qx from 0x%qx\n", object->getMetaClass()->getClassName(), message->msgid, action->ivars->msgid);
3138 }
3139
3140 return object;
3141 }
3142
3143 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3144
3145 kern_return_t
uext_server(ipc_port_t receiver,ipc_kmsg_t requestkmsg,ipc_kmsg_t * pReply)3146 uext_server(ipc_port_t receiver, ipc_kmsg_t requestkmsg, ipc_kmsg_t * pReply)
3147 {
3148 kern_return_t ret;
3149 OSObject * object;
3150 IOUserServer * server;
3151
3152 object = IOUserServer::copyObjectForSendRight(receiver, IKOT_UEXT_OBJECT);
3153 server = OSDynamicCast(IOUserServer, object);
3154 if (!server) {
3155 OSSafeReleaseNULL(object);
3156 return KERN_INVALID_NAME;
3157 }
3158
3159 IORPCMessage * message = (typeof(message))ikm_udata_from_header(requestkmsg);
3160
3161 ret = server->server(requestkmsg, message, pReply);
3162 object->release();
3163
3164 return ret;
3165 }
3166
3167 /*
3168 * Chosen to hit kalloc zones (as opposed to the VM).
3169 * doesn't include the trailer size which ipc_kmsg_alloc() will add
3170 */
3171 #define MAX_UEXT_REPLY_SIZE 0x17c0
3172 static_assert(MAX_UEXT_REPLY_SIZE + MAX_TRAILER_SIZE <= KALLOC_SAFE_ALLOC_SIZE);
3173
3174 kern_return_t
server(ipc_kmsg_t requestkmsg,IORPCMessage * message,ipc_kmsg_t * pReply)3175 IOUserServer::server(ipc_kmsg_t requestkmsg, IORPCMessage * message, ipc_kmsg_t * pReply)
3176 {
3177 kern_return_t ret;
3178 mach_msg_size_t replyAlloc;
3179 ipc_kmsg_t replykmsg;
3180 IORPCMessageMach * msgin;
3181 IORPCMessageMach * msgout;
3182 IORPCMessage * reply;
3183 uint32_t replySize;
3184 OSObject * object;
3185 OSAction * action;
3186 bool oneway;
3187 uint64_t msgid;
3188
3189 msgin = (typeof(msgin))ikm_header(requestkmsg);
3190 replyAlloc = 0;
3191 msgout = NULL;
3192 replykmsg = NULL;
3193
3194 if (msgin->msgh.msgh_size < (sizeof(IORPCMessageMach) + sizeof(IORPCMessage))) {
3195 if (kIODKLogIPC & gIODKDebug) {
3196 DKLOG("UEXT notify %o\n", msgin->msgh.msgh_id);
3197 }
3198 return KERN_NOT_SUPPORTED;
3199 }
3200
3201 if (!(MACH_MSGH_BITS_COMPLEX & msgin->msgh.msgh_bits)) {
3202 msgin->msgh_body.msgh_descriptor_count = 0;
3203 }
3204 if (!message) {
3205 return kIOReturnIPCError;
3206 }
3207 if (message->objectRefs == 0) {
3208 return kIOReturnIPCError;
3209 }
3210 ret = copyInObjects(msgin, message, msgin->msgh.msgh_size, true, false);
3211 if (kIOReturnSuccess != ret) {
3212 if (kIODKLogIPC & gIODKDebug) {
3213 DKLOG("UEXT copyin(0x%x) %x\n", ret, msgin->msgh.msgh_id);
3214 }
3215 return KERN_NOT_SUPPORTED;
3216 }
3217
3218 if (msgin->msgh_body.msgh_descriptor_count < 1) {
3219 return KERN_NOT_SUPPORTED;
3220 }
3221 object = (OSObject *) message->objects[0];
3222 msgid = message->msgid;
3223 message->flags &= ~kIORPCMessageKernel;
3224 message->flags |= kIORPCMessageRemote;
3225
3226 if ((action = OSDynamicCast(OSAction, object))) {
3227 object = target(action, message);
3228 msgid = message->msgid;
3229 }
3230
3231 oneway = (0 != (kIORPCMessageOneway & message->flags));
3232 assert(oneway || (MACH_PORT_NULL != msgin->msgh.msgh_local_port));
3233
3234 replyAlloc = oneway ? 0 : MAX_UEXT_REPLY_SIZE;
3235
3236
3237
3238
3239 if (replyAlloc) {
3240 /*
3241 * Same as:
3242 * ipc_kmsg_alloc(MAX_UEXT_REPLY_SIZE_MACH, MAX_UEXT_REPLY_SIZE_MESSAGE,
3243 * IPC_KMSG_ALLOC_KERNEL | IPC_KMSG_ALLOC_ZERO | IPC_KMSG_ALLOC_LINEAR |
3244 * IPC_KMSG_ALLOC_NOFAIL);
3245 */
3246 replykmsg = ipc_kmsg_alloc_uext_reply(MAX_UEXT_REPLY_SIZE);
3247 msgout = (typeof(msgout))ikm_header(replykmsg);
3248 }
3249
3250 IORPC rpc = { .message = msgin, .reply = msgout, .sendSize = msgin->msgh.msgh_size, .replySize = replyAlloc, .kernelContent = message };
3251
3252 if (object) {
3253 kern_allocation_name_t prior;
3254 bool setAllocationName;
3255
3256 setAllocationName = (NULL != fAllocationName);
3257 if (setAllocationName) {
3258 prior = thread_set_allocation_name(fAllocationName);
3259 }
3260 thread_iokit_tls_set(0, this);
3261 ret = kernelDispatch(object, rpc);
3262 thread_iokit_tls_set(0, NULL);
3263 if (setAllocationName) {
3264 thread_set_allocation_name(prior);
3265 }
3266 } else {
3267 ret = kIOReturnBadArgument;
3268 }
3269
3270 // release objects
3271 consumeObjects(message, msgin->msgh.msgh_size);
3272
3273 // release ports
3274 copyInObjects(msgin, message, msgin->msgh.msgh_size, false, true);
3275
3276 if (!oneway) {
3277 if (kIOReturnSuccess == ret) {
3278 replySize = msgout->msgh.msgh_size;
3279 reply = IORPCMessageFromMachReply(msgout);
3280 if (!reply) {
3281 ret = kIOReturnIPCError;
3282 } else {
3283 ret = copyOutObjects(msgout, reply, replySize, (kIORPCVersionCurrentReply == msgout->msgh.msgh_id) /* =>!InvokeReply */);
3284 }
3285 }
3286 if (kIOReturnSuccess != ret) {
3287 IORPCMessageErrorReturnContent * errorMsg;
3288
3289 msgout->msgh_body.msgh_descriptor_count = 0;
3290 msgout->msgh.msgh_id = kIORPCVersionCurrentReply;
3291 errorMsg = (typeof(errorMsg))IORPCMessageFromMachReply(msgout);
3292 errorMsg->hdr.msgid = message->msgid;
3293 errorMsg->hdr.flags = kIORPCMessageOneway | kIORPCMessageError;
3294 errorMsg->hdr.objectRefs = 0;
3295 errorMsg->result = ret;
3296 errorMsg->pad = 0;
3297 replySize = sizeof(IORPCMessageErrorReturn);
3298 }
3299
3300 msgout->msgh.msgh_bits = MACH_MSGH_BITS_COMPLEX |
3301 MACH_MSGH_BITS_SET(MACH_MSGH_BITS_LOCAL(msgin->msgh.msgh_bits) /*remote*/, 0 /*local*/, 0, 0);
3302
3303 msgout->msgh.msgh_remote_port = msgin->msgh.msgh_local_port;
3304 msgout->msgh.msgh_local_port = MACH_PORT_NULL;
3305 msgout->msgh.msgh_voucher_port = (mach_port_name_t) 0;
3306 msgout->msgh.msgh_reserved = 0;
3307 msgout->msgh.msgh_size = replySize;
3308 }
3309
3310 *pReply = replykmsg;
3311 return KERN_SUCCESS;
3312 }
3313
3314 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3315
3316 #define MAX_OBJECT_COUNT(mach, size, message) \
3317 ((uint32_t)(((((size) + ((uintptr_t) (mach))) - ((uintptr_t) (&message->objects[0]))) / sizeof(OSObjectRef))))
3318
3319 #pragma pack(push, 4)
3320 struct UEXTTrapReply {
3321 uint64_t replySize;
3322 IORPCMessage replyMessage;
3323 };
3324 #pragma pack(pop)
3325
3326 kern_return_t
IOUserServerUEXTTrap(OSObject * object,void * p1,void * p2,void * p3,void * p4,void * p5,void * p6)3327 IOUserServerUEXTTrap(OSObject * object, void * p1, void * p2, void * p3, void * p4, void * p5, void * p6)
3328 {
3329 const user_addr_t msg = (uintptr_t) p1;
3330 size_t inSize = (uintptr_t) p2;
3331 user_addr_t out = (uintptr_t) p3;
3332 size_t outSize = (uintptr_t) p4;
3333 mach_port_name_t objectName1 = (mach_port_name_t)(uintptr_t) p5;
3334 size_t totalSize;
3335 OSObject * objectArg1;
3336
3337 IORPCMessageMach * mach;
3338 mach_msg_port_descriptor_t * descs;
3339
3340 #pragma pack(4)
3341 struct {
3342 uint32_t pad;
3343 IORPCMessageMach mach;
3344 mach_msg_port_descriptor_t objects[2];
3345 IOTrapMessageBuffer buffer;
3346 } buffer;
3347 #pragma pack()
3348
3349 IOReturn ret;
3350 OSAction * action;
3351 int copyerr;
3352 IORPCMessage * message;
3353 IORPCMessage * reply;
3354 IORPC rpc;
3355 uint64_t refs;
3356 uint32_t maxObjectCount;
3357 size_t copySize;
3358 UEXTTrapReply * replyHdr;
3359 uintptr_t p;
3360
3361 bzero(&buffer, sizeof(buffer));
3362
3363 p = (typeof(p)) & buffer.buffer[0];
3364 if (os_add_overflow(inSize, outSize, &totalSize)) {
3365 return kIOReturnMessageTooLarge;
3366 }
3367 if (totalSize > sizeof(buffer.buffer)) {
3368 return kIOReturnMessageTooLarge;
3369 }
3370 if (inSize < sizeof(IORPCMessage)) {
3371 return kIOReturnIPCError;
3372 }
3373 copyerr = copyin(msg, &buffer.buffer[0], inSize);
3374 if (copyerr) {
3375 return kIOReturnVMError;
3376 }
3377
3378 message = (typeof(message))p;
3379 refs = message->objectRefs;
3380 if ((refs > 2) || !refs) {
3381 return kIOReturnUnsupported;
3382 }
3383 if (!(kIORPCMessageSimpleReply & message->flags)) {
3384 return kIOReturnUnsupported;
3385 }
3386 message->flags &= ~(kIORPCMessageKernel | kIORPCMessageRemote);
3387
3388 descs = (typeof(descs))(p - refs * sizeof(*descs));
3389 mach = (typeof(mach))(p - refs * sizeof(*descs) - sizeof(*mach));
3390
3391 mach->msgh.msgh_id = kIORPCVersionCurrent;
3392 mach->msgh.msgh_size = (mach_msg_size_t) (sizeof(IORPCMessageMach) + refs * sizeof(*descs) + inSize); // totalSize was checked
3393 mach->msgh_body.msgh_descriptor_count = ((mach_msg_size_t) refs);
3394
3395 rpc.message = mach;
3396 rpc.sendSize = mach->msgh.msgh_size;
3397 rpc.reply = (IORPCMessageMach *) (p + inSize);
3398 rpc.replySize = ((uint32_t) (sizeof(buffer.buffer) - inSize)); // inSize was checked
3399 rpc.kernelContent = message;
3400
3401 message->objects[0] = 0;
3402 if ((action = OSDynamicCast(OSAction, object))) {
3403 maxObjectCount = MAX_OBJECT_COUNT(rpc.message, rpc.sendSize, message);
3404 if (refs > maxObjectCount) {
3405 return kIOReturnBadArgument;
3406 }
3407 if (refs < 2) {
3408 DKLOG("invalid refs count %qd in message id 0x%qx\n", refs, message->msgid);
3409 return kIOReturnBadArgument;
3410 }
3411 object = IOUserServer::target(action, message);
3412 message->objects[1] = (OSObjectRef) action;
3413 if (kIODKLogIPC & gIODKDebug) {
3414 DKLOG("%s::Dispatch(trap) kernel 0x%qx\n", object->getMetaClass()->getClassName(), message->msgid);
3415 }
3416 ret = object->Dispatch(rpc);
3417 } else {
3418 objectArg1 = NULL;
3419 if (refs > 1) {
3420 if (objectName1) {
3421 objectArg1 = iokit_lookup_uext_ref_current_task(objectName1);
3422 if (!objectArg1) {
3423 return kIOReturnIPCError;
3424 }
3425 }
3426 message->objects[1] = (OSObjectRef) objectArg1;
3427 }
3428 if (kIODKLogIPC & gIODKDebug) {
3429 DKLOG("%s::Dispatch(trap) kernel 0x%qx\n", object->getMetaClass()->getClassName(), message->msgid);
3430 }
3431 ret = object->Dispatch(rpc);
3432 if (kIODKLogIPC & gIODKDebug) {
3433 DKLOG("%s::Dispatch(trap) kernel 0x%qx 0x%x\n", object->getMetaClass()->getClassName(), message->msgid, ret);
3434 }
3435 OSSafeReleaseNULL(objectArg1);
3436
3437 if (kIOReturnSuccess == ret) {
3438 if (rpc.reply->msgh_body.msgh_descriptor_count) {
3439 return kIOReturnIPCError;
3440 }
3441 reply = IORPCMessageFromMachReply(rpc.reply);
3442 if (!reply) {
3443 return kIOReturnIPCError;
3444 }
3445 copySize = rpc.reply->msgh.msgh_size - (((uintptr_t) reply) - ((uintptr_t) rpc.reply)) + sizeof(uint64_t);
3446 if (copySize > outSize) {
3447 return kIOReturnIPCError;
3448 }
3449 replyHdr = (UEXTTrapReply *) ((uintptr_t)reply - sizeof(uint64_t));
3450 replyHdr->replySize = copySize;
3451 copyerr = copyout(replyHdr, out, copySize);
3452 if (copyerr) {
3453 return kIOReturnVMError;
3454 }
3455 }
3456 }
3457
3458 return ret;
3459 }
3460
3461 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3462
3463 IOReturn
rpc(IORPC rpc)3464 IOUserServer::rpc(IORPC rpc)
3465 {
3466 if (isInactive() && !fRootQueue) {
3467 return kIOReturnOffline;
3468 }
3469
3470 IOReturn ret;
3471 IORPCMessage * message;
3472 IORPCMessageMach * mach;
3473 mach_msg_id_t machid;
3474 uint32_t sendSize, replySize;
3475 bool oneway;
3476 uint64_t msgid;
3477 IODispatchQueue * queue;
3478 IOService * service;
3479 ipc_port_t port;
3480 ipc_port_t sendPort;
3481
3482 queue = NULL;
3483 port = NULL;
3484 sendPort = NULL;
3485
3486 mach = rpc.message;
3487 sendSize = rpc.sendSize;
3488 replySize = rpc.replySize;
3489
3490 assert(sendSize >= (sizeof(IORPCMessageMach) + sizeof(IORPCMessage)));
3491
3492 message = rpc.kernelContent;
3493 if (!message) {
3494 return kIOReturnIPCError;
3495 }
3496 msgid = message->msgid;
3497 machid = (msgid >> 32);
3498
3499 if (mach->msgh_body.msgh_descriptor_count < 1) {
3500 return kIOReturnNoMedia;
3501 }
3502
3503 IOLockLock(gIOUserServerLock);
3504 if ((service = OSDynamicCast(IOService, (OSObject *) message->objects[0]))) {
3505 queue = queueForObject(service, msgid);
3506 }
3507 if (!queue) {
3508 queue = fRootQueue;
3509 }
3510 if (queue && (kIODispatchQueueStopped != queue)) {
3511 port = queue->ivars->serverPort;
3512 }
3513 if (port) {
3514 sendPort = ipc_port_copy_send_mqueue(port);
3515 }
3516 IOLockUnlock(gIOUserServerLock);
3517 if (!sendPort) {
3518 return kIOReturnNotReady;
3519 }
3520
3521 oneway = (0 != (kIORPCMessageOneway & message->flags));
3522
3523 ret = copyOutObjects(mach, message, sendSize, false);
3524
3525 mach->msgh.msgh_bits = MACH_MSGH_BITS_COMPLEX |
3526 MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, (oneway ? 0 : MACH_MSG_TYPE_MAKE_SEND_ONCE));
3527 mach->msgh.msgh_remote_port = sendPort;
3528 mach->msgh.msgh_local_port = (oneway ? MACH_PORT_NULL : mig_get_reply_port());
3529 mach->msgh.msgh_id = kIORPCVersionCurrent;
3530 mach->msgh.msgh_reserved = 0;
3531
3532 boolean_t message_moved;
3533
3534 if (oneway) {
3535 ret = kernel_mach_msg_send(&mach->msgh, sendSize,
3536 MACH_SEND_KERNEL_DEFAULT, 0, &message_moved);
3537 } else {
3538 assert(replySize >= (sizeof(IORPCMessageMach) + sizeof(IORPCMessage)));
3539 ret = kernel_mach_msg_rpc(&mach->msgh, sendSize, replySize, FALSE, &message_moved);
3540 }
3541
3542 ipc_port_release_send(sendPort);
3543
3544 if (MACH_MSG_SUCCESS != ret) {
3545 if (kIODKLogIPC & gIODKDebug) {
3546 DKLOG("mach_msg() failed 0x%x\n", ret);
3547 }
3548 if (!message_moved) {
3549 // release ports
3550 copyInObjects(mach, message, sendSize, false, true);
3551 }
3552 }
3553
3554 if ((KERN_SUCCESS == ret) && !oneway) {
3555 if (kIORPCVersionCurrentReply != mach->msgh.msgh_id) {
3556 ret = (MACH_NOTIFY_SEND_ONCE == mach->msgh.msgh_id) ? MIG_SERVER_DIED : MIG_REPLY_MISMATCH;
3557 } else if ((replySize = mach->msgh.msgh_size) < (sizeof(IORPCMessageMach) + sizeof(IORPCMessage))) {
3558 // printf("BAD REPLY SIZE\n");
3559 ret = MIG_BAD_ARGUMENTS;
3560 } else {
3561 if (!(MACH_MSGH_BITS_COMPLEX & mach->msgh.msgh_bits)) {
3562 mach->msgh_body.msgh_descriptor_count = 0;
3563 }
3564 message = IORPCMessageFromMachReply(mach);
3565 if (!message) {
3566 ret = kIOReturnIPCError;
3567 } else if (message->msgid != msgid) {
3568 // printf("BAD REPLY ID\n");
3569 ret = MIG_BAD_ARGUMENTS;
3570 } else {
3571 bool isError = (0 != (kIORPCMessageError & message->flags));
3572 ret = copyInObjects(mach, message, replySize, !isError, true);
3573 if (kIOReturnSuccess != ret) {
3574 if (kIODKLogIPC & gIODKDebug) {
3575 DKLOG("rpc copyin(0x%x) %x\n", ret, mach->msgh.msgh_id);
3576 }
3577 return KERN_NOT_SUPPORTED;
3578 }
3579 if (isError) {
3580 IORPCMessageErrorReturnContent * errorMsg = (typeof(errorMsg))message;
3581 ret = errorMsg->result;
3582 }
3583 }
3584 }
3585 }
3586
3587 return ret;
3588 }
3589
3590 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3591
3592 static IORPCMessage *
IORPCMessageFromMachReply(IORPCMessageMach * msg)3593 IORPCMessageFromMachReply(IORPCMessageMach * msg)
3594 {
3595 mach_msg_size_t idx, count;
3596 mach_msg_port_descriptor_t * desc;
3597 mach_msg_port_descriptor_t * maxDesc;
3598 size_t size, msgsize;
3599 bool upgrade;
3600 bool reply = true;
3601
3602 msgsize = msg->msgh.msgh_size;
3603 count = msg->msgh_body.msgh_descriptor_count;
3604 desc = &msg->objects[0];
3605 maxDesc = (typeof(maxDesc))(((uintptr_t) msg) + msgsize);
3606 upgrade = (msg->msgh.msgh_id != (reply ? kIORPCVersionCurrentReply : kIORPCVersionCurrent));
3607
3608 if (upgrade) {
3609 OSReportWithBacktrace("obsolete message");
3610 return NULL;
3611 }
3612
3613 for (idx = 0; idx < count; idx++) {
3614 if (desc >= maxDesc) {
3615 return NULL;
3616 }
3617 switch (desc->type) {
3618 case MACH_MSG_PORT_DESCRIPTOR:
3619 size = sizeof(mach_msg_port_descriptor_t);
3620 break;
3621 case MACH_MSG_OOL_DESCRIPTOR:
3622 size = sizeof(mach_msg_ool_descriptor_t);
3623 break;
3624 default:
3625 return NULL;
3626 }
3627 desc = (typeof(desc))(((uintptr_t) desc) + size);
3628 }
3629 return (IORPCMessage *)(uintptr_t) desc;
3630 }
3631
3632 ipc_port_t
copySendRightForObject(OSObject * object,ipc_kobject_type_t type)3633 IOUserServer::copySendRightForObject(OSObject * object, ipc_kobject_type_t type)
3634 {
3635 ipc_port_t port;
3636 ipc_port_t sendPort = NULL;
3637 ipc_kobject_t kobj;
3638
3639 port = iokit_port_for_object(object, type, &kobj);
3640 if (port) {
3641 sendPort = ipc_kobject_make_send(port, kobj, type);
3642 iokit_release_port(port);
3643 }
3644
3645 return sendPort;
3646 }
3647
3648 OSObject *
copyObjectForSendRight(ipc_port_t port,ipc_kobject_type_t type)3649 IOUserServer::copyObjectForSendRight(ipc_port_t port, ipc_kobject_type_t type)
3650 {
3651 OSObject * object;
3652 object = iokit_lookup_io_object(port, type);
3653 return object;
3654 }
3655
3656 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3657
3658 // Create a vm_map_copy_t or kalloc'ed data for memory
3659 // to be copied out. ipc will free after the copyout.
3660
3661 static kern_return_t
copyoutkdata(const void * data,vm_size_t len,void ** buf)3662 copyoutkdata(const void * data, vm_size_t len, void ** buf)
3663 {
3664 kern_return_t err;
3665 vm_map_copy_t copy;
3666
3667 err = vm_map_copyin( kernel_map, CAST_USER_ADDR_T(data), len,
3668 false /* src_destroy */, ©);
3669
3670 assert( err == KERN_SUCCESS );
3671 if (err == KERN_SUCCESS) {
3672 *buf = (char *) copy;
3673 }
3674
3675 return err;
3676 }
3677
3678 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3679
3680 IOReturn
copyOutObjects(IORPCMessageMach * mach,IORPCMessage * message,size_t size,bool consume)3681 IOUserServer::copyOutObjects(IORPCMessageMach * mach, IORPCMessage * message,
3682 size_t size, bool consume)
3683 {
3684 uint64_t refs;
3685 uint32_t idx, maxObjectCount;
3686 ipc_port_t port;
3687 OSObject * object;
3688 size_t descsize;
3689 mach_msg_port_descriptor_t * desc;
3690 mach_msg_ool_descriptor_t * ool;
3691 vm_map_copy_t copy;
3692 void * address;
3693 mach_msg_size_t length;
3694 kern_return_t kr;
3695 OSSerialize * s;
3696
3697 refs = message->objectRefs;
3698 maxObjectCount = MAX_OBJECT_COUNT(mach, size, message);
3699 // assert(refs <= mach->msgh_body.msgh_descriptor_count);
3700 // assert(refs <= maxObjectCount);
3701 if (refs > mach->msgh_body.msgh_descriptor_count) {
3702 return kIOReturnBadArgument;
3703 }
3704 if (refs > maxObjectCount) {
3705 return kIOReturnBadArgument;
3706 }
3707
3708 desc = &mach->objects[0];
3709 for (idx = 0; idx < refs; idx++) {
3710 object = (OSObject *) message->objects[idx];
3711
3712 switch (desc->type) {
3713 case MACH_MSG_PORT_DESCRIPTOR:
3714 descsize = sizeof(mach_msg_port_descriptor_t);
3715 port = NULL;
3716 if (object) {
3717 #if DEVELOPMENT || DEBUG
3718 if (kIODKLogIPC & gIODKDebug) {
3719 IOMemoryDescriptor * iomd = OSDynamicCast(IOMemoryDescriptor, object);
3720 if (iomd != NULL && (iomd->getFlags() & kIOMemoryThreadSafe) == 0) {
3721 OSReportWithBacktrace("IOMemoryDescriptor %p was created without kIOMemoryThreadSafe flag", iomd);
3722 }
3723 }
3724 #endif /* DEVELOPMENT || DEBUG */
3725
3726 port = copySendRightForObject(object, IKOT_UEXT_OBJECT);
3727 if (!port) {
3728 break;
3729 }
3730 if (consume) {
3731 object->release();
3732 }
3733 message->objects[idx] = 0;
3734 }
3735 // desc->type = MACH_MSG_PORT_DESCRIPTOR;
3736 desc->disposition = MACH_MSG_TYPE_MOVE_SEND;
3737 desc->name = port;
3738 desc->pad2 = 0;
3739 desc->pad_end = 0;
3740 break;
3741
3742 case MACH_MSG_OOL_DESCRIPTOR:
3743 descsize = sizeof(mach_msg_ool_descriptor_t);
3744
3745 length = 0;
3746 address = NULL;
3747 if (object) {
3748 s = OSSerialize::binaryWithCapacity(4096);
3749 assert(s);
3750 if (!s) {
3751 break;
3752 }
3753 s->setIndexed(true);
3754 if (!object->serialize(s)) {
3755 assert(false);
3756 descsize = -1UL;
3757 s->release();
3758 break;
3759 }
3760 length = s->getLength();
3761 kr = copyoutkdata(s->text(), length, &address);
3762 s->release();
3763 if (KERN_SUCCESS != kr) {
3764 descsize = -1UL;
3765 address = NULL;
3766 length = 0;
3767 }
3768 if (consume) {
3769 object->release();
3770 }
3771 message->objects[idx] = 0;
3772 }
3773 ool = (typeof(ool))desc;
3774 // ool->type = MACH_MSG_OOL_DESCRIPTOR;
3775 ool->deallocate = false;
3776 ool->copy = MACH_MSG_PHYSICAL_COPY;
3777 ool->size = length;
3778 ool->address = address;
3779 break;
3780
3781 default:
3782 descsize = -1UL;
3783 break;
3784 }
3785 if (-1UL == descsize) {
3786 break;
3787 }
3788 desc = (typeof(desc))(((uintptr_t) desc) + descsize);
3789 }
3790
3791 if (idx >= refs) {
3792 return kIOReturnSuccess;
3793 }
3794
3795 desc = &mach->objects[0];
3796 while (idx--) {
3797 switch (desc->type) {
3798 case MACH_MSG_PORT_DESCRIPTOR:
3799 descsize = sizeof(mach_msg_port_descriptor_t);
3800 port = desc->name;
3801 if (port) {
3802 ipc_port_release_send(port);
3803 }
3804 break;
3805
3806 case MACH_MSG_OOL_DESCRIPTOR:
3807 descsize = sizeof(mach_msg_ool_descriptor_t);
3808 ool = (typeof(ool))desc;
3809 copy = (vm_map_copy_t) ool->address;
3810 if (copy) {
3811 vm_map_copy_discard(copy);
3812 }
3813 break;
3814
3815 default:
3816 descsize = -1UL;
3817 break;
3818 }
3819 if (-1UL == descsize) {
3820 break;
3821 }
3822 desc = (typeof(desc))(((uintptr_t) desc) + descsize);
3823 }
3824
3825 return kIOReturnBadArgument;
3826 }
3827
3828 IOReturn
copyInObjects(IORPCMessageMach * mach,IORPCMessage * message,size_t size,bool copyObjects,bool consumePorts)3829 IOUserServer::copyInObjects(IORPCMessageMach * mach, IORPCMessage * message,
3830 size_t size, bool copyObjects, bool consumePorts)
3831 {
3832 uint64_t refs;
3833 uint32_t idx, maxObjectCount;
3834 ipc_port_t port;
3835 OSObject * object;
3836 size_t descsize;
3837 mach_msg_port_descriptor_t * desc;
3838 mach_msg_ool_descriptor_t * ool;
3839 vm_map_address_t copyoutdata;
3840 kern_return_t kr;
3841
3842 refs = message->objectRefs;
3843 maxObjectCount = MAX_OBJECT_COUNT(mach, size, message);
3844 // assert(refs <= mach->msgh_body.msgh_descriptor_count);
3845 // assert(refs <= maxObjectCount);
3846 if (refs > mach->msgh_body.msgh_descriptor_count) {
3847 return kIOReturnBadArgument;
3848 }
3849 if (refs > maxObjectCount) {
3850 return kIOReturnBadArgument;
3851 }
3852
3853 desc = &mach->objects[0];
3854 for (idx = 0; idx < refs; idx++) {
3855 switch (desc->type) {
3856 case MACH_MSG_PORT_DESCRIPTOR:
3857 descsize = sizeof(mach_msg_port_descriptor_t);
3858
3859 object = NULL;
3860 port = desc->name;
3861 if (port) {
3862 if (copyObjects) {
3863 object = copyObjectForSendRight(port, IKOT_UEXT_OBJECT);
3864 if (!object) {
3865 descsize = -1UL;
3866 break;
3867 }
3868 }
3869 if (consumePorts) {
3870 ipc_port_release_send(port);
3871 }
3872 }
3873 break;
3874
3875 case MACH_MSG_OOL_DESCRIPTOR:
3876 descsize = sizeof(mach_msg_ool_descriptor_t);
3877 ool = (typeof(ool))desc;
3878
3879 object = NULL;
3880 if (copyObjects && ool->size && ool->address) {
3881 kr = vm_map_copyout(kernel_map, ©outdata, (vm_map_copy_t) ool->address);
3882 if (KERN_SUCCESS == kr) {
3883 object = OSUnserializeXML((const char *) copyoutdata, ool->size);
3884 kr = vm_deallocate(kernel_map, copyoutdata, ool->size);
3885 assert(KERN_SUCCESS == kr);
3886 // vm_map_copyout() has consumed the vm_map_copy_t in the message
3887 ool->size = 0;
3888 ool->address = NULL;
3889 }
3890 if (!object) {
3891 descsize = -1UL;
3892 break;
3893 }
3894 }
3895 break;
3896
3897 default:
3898 descsize = -1UL;
3899 break;
3900 }
3901 if (-1UL == descsize) {
3902 break;
3903 }
3904 if (copyObjects) {
3905 message->objects[idx] = (OSObjectRef) object;
3906 }
3907 desc = (typeof(desc))(((uintptr_t) desc) + descsize);
3908 }
3909
3910 if (idx >= refs) {
3911 return kIOReturnSuccess;
3912 }
3913
3914 while (idx--) {
3915 object = (OSObject *) message->objects[idx];
3916 OSSafeReleaseNULL(object);
3917 message->objects[idx] = 0;
3918 }
3919
3920 return kIOReturnBadArgument;
3921 }
3922
3923 IOReturn
consumeObjects(IORPCMessage * message,size_t messageSize)3924 IOUserServer::consumeObjects(IORPCMessage * message, size_t messageSize)
3925 {
3926 uint64_t refs, idx;
3927 OSObject * object;
3928
3929 refs = message->objectRefs;
3930 for (idx = 0; idx < refs; idx++) {
3931 object = (OSObject *) message->objects[idx];
3932 if (object) {
3933 object->release();
3934 message->objects[idx] = 0;
3935 }
3936 }
3937
3938 return kIOReturnSuccess;
3939 }
3940
3941 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
3942
3943 bool
finalize(IOOptionBits options)3944 IOUserServer::finalize(IOOptionBits options)
3945 {
3946 OSArray * services;
3947
3948 if (kIODKLogSetup & gIODKDebug) {
3949 DKLOG("%s::finalize(%p)\n", getName(), this);
3950 }
3951
3952 IOLockLock(gIOUserServerLock);
3953 OSSafeReleaseNULL(fRootQueue);
3954 IOLockUnlock(gIOUserServerLock);
3955
3956 services = NULL;
3957 IOLockLock(fLock);
3958 if (fServices) {
3959 services = OSArray::withArray(fServices);
3960 }
3961 IOLockUnlock(fLock);
3962
3963 IOOptionBits terminateFlags = kIOServiceTerminateNeedWillTerminate | kIOServiceTerminateWithRematch;
3964 if (fCheckInToken) {
3965 bool can_rematch = fCheckInToken->dextTerminate();
3966 if (can_rematch) {
3967 terminateFlags |= kIOServiceTerminateWithRematchCurrentDext;
3968 } else {
3969 DKLOG("%s::finalize(%p) dext was replaced, do not rematch current dext\n", getName(), this);
3970 }
3971 } else {
3972 terminateFlags |= kIOServiceTerminateWithRematchCurrentDext;
3973 DKLOG("%s::finalize(%p) could not find fCheckInToken\n", getName(), this);
3974 }
3975
3976 if (services) {
3977 services->iterateObjects(^bool (OSObject * obj) {
3978 int service __unused; // hide outer defn
3979 IOService * nextService;
3980 IOService * provider;
3981 bool started = false;
3982
3983 nextService = (IOService *) obj;
3984 if (kIODKLogSetup & gIODKDebug) {
3985 DKLOG("%s::terminate(" DKS ")\n", getName(), DKN(nextService));
3986 }
3987 if (nextService->reserved->uvars) {
3988 IOUserClient * nextUserClient = OSDynamicCast(IOUserClient, nextService);
3989 provider = nextService->getProvider();
3990 if (nextUserClient) {
3991 nextUserClient->setTerminateDefer(provider, false);
3992 }
3993 started = nextService->reserved->uvars->started;
3994 nextService->reserved->uvars->serverDied = true;
3995
3996 serviceDidStop(nextService, provider);
3997 if (provider != NULL && (terminateFlags & kIOServiceTerminateWithRematchCurrentDext) == 0) {
3998 provider->resetRematchProperties();
3999 }
4000 if (started) {
4001 nextService->terminate(terminateFlags);
4002 }
4003 }
4004 if (!started) {
4005 DKLOG("%s::terminate(" DKS ") server exit before start()\n", getName(), DKN(nextService));
4006 serviceStop(nextService, NULL);
4007 }
4008 return false;
4009 });
4010 services->release();
4011 }
4012
4013 return IOUserClient::finalize(options);
4014 }
4015
4016 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4017
4018 #undef super
4019 #define super IOUserClient2022
4020
OSDefineMetaClassAndStructors(IOUserServer,IOUserClient2022)4021 OSDefineMetaClassAndStructors(IOUserServer, IOUserClient2022)
4022
4023 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4024
4025 IOUserClient * IOUserServer::withTask(task_t owningTask)
4026 {
4027 IOUserServer * inst;
4028
4029 assert(owningTask == current_task());
4030 if (!task_is_driver(owningTask)) {
4031 DKLOG("IOUserServer may only be created with driver tasks\n");
4032 return NULL;
4033 }
4034
4035 inst = new IOUserServer;
4036 if (inst && !inst->init()) {
4037 inst->release();
4038 inst = NULL;
4039 return inst;
4040 }
4041 OS_ANALYZER_SUPPRESS("82033761") inst->PMinit();
4042
4043 inst->fOwningTask = current_task();
4044 task_reference(inst->fOwningTask);
4045
4046 inst->fEntitlements = IOUserClient::copyClientEntitlements(inst->fOwningTask);
4047
4048 if (!(kIODKDisableEntitlementChecking & gIODKDebug)) {
4049 proc_t p;
4050 pid_t pid;
4051 const char * name;
4052 p = (proc_t)get_bsdtask_info(inst->fOwningTask);
4053 if (p) {
4054 name = proc_best_name(p);
4055 pid = proc_pid(p);
4056 } else {
4057 name = "unknown";
4058 pid = 0;
4059 }
4060
4061 if (inst->fEntitlements == NULL) {
4062 #if DEVELOPMENT || DEBUG
4063 panic("entitlements are missing for %s[%d]\n", name, pid);
4064 #else
4065 DKLOG("entitlements are missing for %s[%d]\n", name, pid);
4066 #endif /* DEVELOPMENT || DEBUG */
4067 }
4068
4069
4070 const char * dextTeamID = csproc_get_teamid(p);
4071 if (dextTeamID != NULL) {
4072 inst->fTeamIdentifier = OSString::withCString(dextTeamID);
4073 DKLOG("%s[%d] has team identifier %s\n", name, pid, dextTeamID);
4074 }
4075
4076 if (!IOCurrentTaskHasEntitlement(gIODriverKitEntitlementKey->getCStringNoCopy())) {
4077 IOLog(kIODriverKitEntitlementKey " entitlement check failed for %s[%d]\n", name, pid);
4078 inst->release();
4079 inst = NULL;
4080 return inst;
4081 }
4082 }
4083
4084 /* Mark the current task's space as eligible for uext object ports */
4085 iokit_label_dext_task(inst->fOwningTask);
4086
4087 inst->fLock = IOLockAlloc();
4088 inst->fServices = OSArray::withCapacity(4);
4089 inst->fClasses = OSDictionary::withCapacity(16);
4090 inst->fClasses->setOptions(OSCollection::kSort, OSCollection::kSort);
4091 inst->fPlatformDriver = task_get_platform_binary(inst->fOwningTask);
4092 if (csproc_get_validation_category(current_proc(), &inst->fCSValidationCategory) != KERN_SUCCESS) {
4093 inst->fCSValidationCategory = CS_VALIDATION_CATEGORY_INVALID;
4094 }
4095
4096 inst->setProperty(kIOUserClientDefaultLockingKey, kOSBooleanTrue);
4097 inst->setProperty(kIOUserClientDefaultLockingSetPropertiesKey, kOSBooleanTrue);
4098 inst->setProperty(kIOUserClientDefaultLockingSingleThreadExternalMethodKey, kOSBooleanTrue);
4099 //requirement for gIODriverKitEntitlementKey is enforced elsewhere conditionally
4100 inst->setProperty(kIOUserClientEntitlementsKey, kOSBooleanFalse);
4101
4102 return inst;
4103 }
4104
4105 static bool gIOUserServerLeakObjects = false;
4106
4107 bool
shouldLeakObjects()4108 IOUserServer::shouldLeakObjects()
4109 {
4110 return gIOUserServerLeakObjects;
4111 }
4112
4113 void
beginLeakingObjects()4114 IOUserServer::beginLeakingObjects()
4115 {
4116 gIOUserServerLeakObjects = true;
4117 }
4118
4119 bool
isPlatformDriver()4120 IOUserServer::isPlatformDriver()
4121 {
4122 return fPlatformDriver;
4123 }
4124
4125 int
getCSValidationCategory()4126 IOUserServer::getCSValidationCategory()
4127 {
4128 return fCSValidationCategory;
4129 }
4130
4131
4132 struct IOUserServerRecordExitReasonContext {
4133 task_t task;
4134 os_reason_t reason;
4135 };
4136
4137 static bool
IOUserServerRecordExitReasonMatch(const OSObject * obj,void * context)4138 IOUserServerRecordExitReasonMatch(const OSObject *obj, void * context)
4139 {
4140 IOUserServerRecordExitReasonContext * ctx = (IOUserServerRecordExitReasonContext *)context;
4141 IOUserServer * us = OSDynamicCast(IOUserServer, obj);
4142 if (us == NULL) {
4143 return false;
4144 }
4145
4146 if (us->fOwningTask == ctx->task) {
4147 assert(us->fTaskCrashReason == OS_REASON_NULL);
4148 assert(ctx->reason != OS_REASON_NULL);
4149 os_reason_ref(ctx->reason);
4150 us->fTaskCrashReason = ctx->reason;
4151 return true;
4152 }
4153
4154 return false;
4155 }
4156
4157 extern "C" void
IOUserServerRecordExitReason(task_t task,os_reason_t reason)4158 IOUserServerRecordExitReason(task_t task, os_reason_t reason)
4159 {
4160 IOUserServerRecordExitReasonContext ctx { task, reason };
4161 IOUserServer::gMetaClass.applyToInstances(IOUserServerRecordExitReasonMatch, &ctx);
4162 }
4163
4164 IOReturn
clientClose(void)4165 IOUserServer::clientClose(void)
4166 {
4167 OSArray * services;
4168 bool __block unexpectedExit = false;
4169
4170 if (kIODKLogSetup & gIODKDebug) {
4171 DKLOG("%s::clientClose(%p)\n", getName(), this);
4172 }
4173 services = NULL;
4174 IOLockLock(fLock);
4175 if (fServices) {
4176 services = OSArray::withArray(fServices);
4177 }
4178 IOLockUnlock(fLock);
4179
4180 // if this was a an expected exit, termination and stop should have detached at this
4181 // point, so send any provider still attached and not owned by this user server
4182 // the ClientCrashed() notification
4183 if (services) {
4184 services->iterateObjects(^bool (OSObject * obj) {
4185 int service __unused; // hide outer defn
4186 IOService * nextService;
4187 IOService * provider;
4188
4189 nextService = (IOService *) obj;
4190 if (nextService->isInactive()) {
4191 return false;
4192 }
4193 if (nextService->reserved && nextService->reserved->uvars && nextService->reserved->uvars->started) {
4194 unexpectedExit = true;
4195 }
4196 provider = nextService->getProvider();
4197 if (provider
4198 && (!provider->reserved->uvars || (provider->reserved->uvars->userServer != this))) {
4199 if (kIODKLogSetup & gIODKDebug) {
4200 DKLOG(DKS "::ClientCrashed(" DKS ")\n", DKN(provider), DKN(nextService));
4201 }
4202 provider->ClientCrashed(nextService, 0);
4203 }
4204 return false;
4205 });
4206 services->release();
4207 }
4208
4209 if (unexpectedExit &&
4210 !gInUserspaceReboot &&
4211 (fTaskCrashReason != OS_REASON_NULL && fTaskCrashReason->osr_namespace != OS_REASON_JETSAM && fTaskCrashReason->osr_namespace != OS_REASON_RUNNINGBOARD) &&
4212 fStatistics != NULL) {
4213 OSDextCrashPolicy policy = fStatistics->recordCrash();
4214 bool allowPanic;
4215 #if DEVELOPMENT || DEBUG
4216 allowPanic = fPlatformDriver && fEntitlements->getObject(gIODriverKitTestDriverEntitlementKey) != kOSBooleanTrue && !disable_dext_crash_reboot;
4217 #else
4218 allowPanic = fPlatformDriver;
4219 #endif /* DEVELOPMENT || DEBUG */
4220
4221 if (policy == kOSDextCrashPolicyReboot && allowPanic) {
4222 panic("Driver %s has crashed too many times\n", getName());
4223 }
4224 }
4225
4226 terminate();
4227 return kIOReturnSuccess;
4228 }
4229
4230 IOReturn
setProperties(OSObject * properties)4231 IOUserServer::setProperties(OSObject * properties)
4232 {
4233 IOReturn kr = kIOReturnUnsupported;
4234 return kr;
4235 }
4236
4237 void
stop(IOService * provider)4238 IOUserServer::stop(IOService * provider)
4239 {
4240 if (fOwningTask) {
4241 task_deallocate(fOwningTask);
4242 fOwningTask = TASK_NULL;
4243 }
4244
4245 PMstop();
4246
4247 IOServicePH::serverRemove(this);
4248
4249 OSSafeReleaseNULL(fRootQueue);
4250
4251 if (fInterruptLock) {
4252 IOSimpleLockFree(fInterruptLock);
4253 }
4254 }
4255
4256 void
free()4257 IOUserServer::free()
4258 {
4259 OSSafeReleaseNULL(fEntitlements);
4260 OSSafeReleaseNULL(fClasses);
4261 if (fOwningTask) {
4262 task_deallocate(fOwningTask);
4263 fOwningTask = TASK_NULL;
4264 }
4265 if (fLock) {
4266 IOLockFree(fLock);
4267 }
4268 OSSafeReleaseNULL(fServices);
4269 OSSafeReleaseNULL(fCheckInToken);
4270 OSSafeReleaseNULL(fStatistics);
4271 OSSafeReleaseNULL(fTeamIdentifier);
4272 if (fAllocationName) {
4273 kern_allocation_name_release(fAllocationName);
4274 fAllocationName = NULL;
4275 }
4276 if (fTaskCrashReason != OS_REASON_NULL) {
4277 os_reason_free(fTaskCrashReason);
4278 }
4279 IOUserClient::free();
4280 }
4281
4282 IOReturn
registerClass(OSClassDescription * desc,uint32_t size,OSUserMetaClass ** pCls)4283 IOUserServer::registerClass(OSClassDescription * desc, uint32_t size, OSUserMetaClass ** pCls)
4284 {
4285 OSUserMetaClass * cls;
4286 const OSSymbol * sym;
4287 uint64_t * methodOptions;
4288 const char * queueNames;
4289 uint32_t methodOptionsEnd, queueNamesEnd;
4290 IOReturn ret = kIOReturnSuccess;
4291
4292 if (size < sizeof(OSClassDescription)) {
4293 assert(false);
4294 return kIOReturnBadArgument;
4295 }
4296
4297 if (kIODKLogSetup & gIODKDebug) {
4298 DKLOG("%s::registerClass %s, %d, %d\n", getName(), desc->name, desc->queueNamesSize, desc->methodNamesSize);
4299 }
4300
4301 if (desc->descriptionSize != size) {
4302 assert(false);
4303 return kIOReturnBadArgument;
4304 }
4305 if (os_add_overflow(desc->queueNamesOffset, desc->queueNamesSize, &queueNamesEnd)) {
4306 assert(false);
4307 return kIOReturnBadArgument;
4308 }
4309 if (queueNamesEnd > size) {
4310 assert(false);
4311 return kIOReturnBadArgument;
4312 }
4313 if (os_add_overflow(desc->methodOptionsOffset, desc->methodOptionsSize, &methodOptionsEnd)) {
4314 assert(false);
4315 return kIOReturnBadArgument;
4316 }
4317 if (methodOptionsEnd > size) {
4318 assert(false);
4319 return kIOReturnBadArgument;
4320 }
4321 // overlaps?
4322 if ((desc->queueNamesOffset >= desc->methodOptionsOffset) && (desc->queueNamesOffset < methodOptionsEnd)) {
4323 assert(false);
4324 return kIOReturnBadArgument;
4325 }
4326 if ((queueNamesEnd >= desc->methodOptionsOffset) && (queueNamesEnd < methodOptionsEnd)) {
4327 assert(false);
4328 return kIOReturnBadArgument;
4329 }
4330
4331 if (desc->methodOptionsSize & ((2 * sizeof(uint64_t)) - 1)) {
4332 assert(false);
4333 return kIOReturnBadArgument;
4334 }
4335 if (sizeof(desc->name) == strnlen(desc->name, sizeof(desc->name))) {
4336 assert(false);
4337 return kIOReturnBadArgument;
4338 }
4339 if (sizeof(desc->superName) == strnlen(desc->superName, sizeof(desc->superName))) {
4340 assert(false);
4341 return kIOReturnBadArgument;
4342 }
4343
4344 cls = OSTypeAlloc(OSUserMetaClass);
4345 assert(cls);
4346 if (!cls) {
4347 return kIOReturnNoMemory;
4348 }
4349
4350 cls->description = (typeof(cls->description))IOMallocData(size);
4351 assert(cls->description);
4352 if (!cls->description) {
4353 assert(false);
4354 cls->release();
4355 return kIOReturnNoMemory;
4356 }
4357 bcopy(desc, cls->description, size);
4358
4359 cls->methodCount = desc->methodOptionsSize / (2 * sizeof(uint64_t));
4360 cls->methods = IONewData(uint64_t, 2 * cls->methodCount);
4361 if (!cls->methods) {
4362 assert(false);
4363 cls->release();
4364 return kIOReturnNoMemory;
4365 }
4366
4367 methodOptions = (typeof(methodOptions))(((uintptr_t) desc) + desc->methodOptionsOffset);
4368 bcopy(methodOptions, cls->methods, 2 * cls->methodCount * sizeof(uint64_t));
4369
4370 queueNames = (typeof(queueNames))(((uintptr_t) desc) + desc->queueNamesOffset);
4371 cls->queueNames = copyInStringArray(queueNames, desc->queueNamesSize);
4372
4373 sym = OSSymbol::withCString(desc->name);
4374 assert(sym);
4375 if (!sym) {
4376 assert(false);
4377 cls->release();
4378 return kIOReturnNoMemory;
4379 }
4380
4381 cls->name = sym;
4382 cls->meta = OSMetaClass::copyMetaClassWithName(sym);
4383 IOLockLock(fLock);
4384 cls->superMeta = OSDynamicCast(OSUserMetaClass, fClasses->getObject(desc->superName));
4385 if (fClasses->getObject(sym) != NULL) {
4386 /* class with this name exists */
4387 ret = kIOReturnBadArgument;
4388 } else {
4389 if (fClasses->setObject(sym, cls)) {
4390 *pCls = cls;
4391 } else {
4392 /* could not add class to fClasses */
4393 ret = kIOReturnNoMemory;
4394 }
4395 }
4396 IOLockUnlock(fLock);
4397 cls->release();
4398 return ret;
4399 }
4400
4401 IOReturn
registerClass(OSClassDescription * desc,uint32_t size,OSSharedPtr<OSUserMetaClass> & pCls)4402 IOUserServer::registerClass(OSClassDescription * desc, uint32_t size, OSSharedPtr<OSUserMetaClass>& pCls)
4403 {
4404 OSUserMetaClass* pClsRaw = NULL;
4405 IOReturn result = registerClass(desc, size, &pClsRaw);
4406 if (result == kIOReturnSuccess) {
4407 pCls.reset(pClsRaw, OSRetain);
4408 }
4409 return result;
4410 }
4411
4412 IOReturn
setRootQueue(IODispatchQueue * queue)4413 IOUserServer::setRootQueue(IODispatchQueue * queue)
4414 {
4415 assert(!fRootQueue);
4416 if (fRootQueue) {
4417 return kIOReturnStillOpen;
4418 }
4419 queue->retain();
4420 fRootQueue = queue;
4421
4422 return kIOReturnSuccess;
4423 }
4424
4425
4426 IOReturn
externalMethod(uint32_t selector,IOExternalMethodArgumentsOpaque * args)4427 IOUserServer::externalMethod(uint32_t selector, IOExternalMethodArgumentsOpaque * args)
4428 {
4429 static const IOExternalMethodDispatch2022 dispatchArray[] = {
4430 [kIOUserServerMethodRegisterClass] = {
4431 .function = &IOUserServer::externalMethodRegisterClass,
4432 .checkScalarInputCount = 0,
4433 .checkStructureInputSize = kIOUCVariableStructureSize,
4434 .checkScalarOutputCount = 2,
4435 .checkStructureOutputSize = 0,
4436 .allowAsync = false,
4437 .checkEntitlement = NULL,
4438 },
4439 [kIOUserServerMethodStart] = {
4440 .function = &IOUserServer::externalMethodStart,
4441 .checkScalarInputCount = 1,
4442 .checkStructureInputSize = 0,
4443 .checkScalarOutputCount = 1,
4444 .checkStructureOutputSize = 0,
4445 .allowAsync = false,
4446 .checkEntitlement = NULL,
4447 },
4448 };
4449
4450 return dispatchExternalMethod(selector, args, dispatchArray, sizeof(dispatchArray) / sizeof(dispatchArray[0]), this, NULL);
4451 }
4452
4453 IOReturn
externalMethodRegisterClass(OSObject * target,void * reference,IOExternalMethodArguments * args)4454 IOUserServer::externalMethodRegisterClass(OSObject * target, void * reference, IOExternalMethodArguments * args)
4455 {
4456 IOReturn ret = kIOReturnBadArgument;
4457 mach_port_name_t portname;
4458
4459 IOUserServer * me = (typeof(me))target;
4460
4461 OSUserMetaClass * cls;
4462 if (!args->structureInputSize) {
4463 return kIOReturnBadArgument;
4464 }
4465
4466 ret = me->registerClass((OSClassDescription *) args->structureInput, args->structureInputSize, &cls);
4467 if (kIOReturnSuccess == ret) {
4468 portname = iokit_make_send_right(me->fOwningTask, cls, IKOT_UEXT_OBJECT);
4469 assert(portname);
4470 args->scalarOutput[0] = portname;
4471 args->scalarOutput[1] = kOSObjectRPCRemote;
4472 }
4473
4474 return ret;
4475 }
4476
4477 IOReturn
externalMethodStart(OSObject * target,void * reference,IOExternalMethodArguments * args)4478 IOUserServer::externalMethodStart(OSObject * target, void * reference, IOExternalMethodArguments * args)
4479 {
4480 mach_port_name_t portname;
4481
4482 IOUserServer * me = (typeof(me))target;
4483
4484 if (!(kIODKDisableCheckInTokenVerification & gIODKDebug)) {
4485 mach_port_name_t checkInPortName = ((typeof(checkInPortName))args->scalarInput[0]);
4486 OSObject * obj = iokit_lookup_object_with_port_name(checkInPortName, IKOT_IOKIT_IDENT, me->fOwningTask);
4487 IOUserServerCheckInToken * retrievedToken = OSDynamicCast(IOUserServerCheckInToken, obj);
4488 if (retrievedToken != NULL) {
4489 me->setCheckInToken(retrievedToken);
4490 } else {
4491 OSSafeReleaseNULL(obj);
4492 return kIOReturnBadArgument;
4493 }
4494 OSSafeReleaseNULL(obj);
4495 }
4496 portname = iokit_make_send_right(me->fOwningTask, me, IKOT_UEXT_OBJECT);
4497 assert(portname);
4498 args->scalarOutput[0] = portname;
4499 return kIOReturnSuccess;
4500 }
4501 IOExternalTrap *
getTargetAndTrapForIndex(IOService ** targetP,UInt32 index)4502 IOUserServer::getTargetAndTrapForIndex( IOService **targetP, UInt32 index )
4503 {
4504 static const OSBoundedArray<IOExternalTrap, 1> trapTemplate = {{
4505 { NULL, (IOTrap) & IOUserServer::waitInterruptTrap},
4506 }};
4507 if (index >= trapTemplate.size()) {
4508 return NULL;
4509 }
4510 *targetP = this;
4511 return (IOExternalTrap *)&trapTemplate[index];
4512 }
4513
4514 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4515
4516 IOReturn
serviceAttach(IOService * service,IOService * provider)4517 IOUserServer::serviceAttach(IOService * service, IOService * provider)
4518 {
4519 IOReturn ret;
4520 OSObjectUserVars * vars;
4521 OSObject * prop;
4522 OSString * str;
4523 OSSymbol const* bundleID;
4524 char execPath[1024];
4525
4526 vars = IOMallocType(OSObjectUserVars);
4527 service->reserved->uvars = vars;
4528
4529 vars->userServer = this;
4530 vars->userServer->retain();
4531 vars->uvarsLock = IOLockAlloc();
4532 IOLockLock(fLock);
4533 if (-1U == fServices->getNextIndexOfObject(service, 0)) {
4534 fServices->setObject(service);
4535
4536 // Add to IOAssociatedServices
4537 OSObject * serviceArrayObj = copyProperty(gIOAssociatedServicesKey);
4538 OSArray * serviceArray = OSDynamicCast(OSArray, serviceArrayObj);
4539 if (!serviceArray) {
4540 serviceArray = OSArray::withCapacity(0);
4541 } else {
4542 serviceArray = OSDynamicCast(OSArray, serviceArray->copyCollection());
4543 assert(serviceArray != NULL);
4544 }
4545
4546 OSNumber * registryEntryNumber = OSNumber::withNumber(service->getRegistryEntryID(), 64);
4547 serviceArray->setObject(registryEntryNumber);
4548 setProperty(gIOAssociatedServicesKey, serviceArray);
4549 OSSafeReleaseNULL(registryEntryNumber);
4550 OSSafeReleaseNULL(serviceArray);
4551 OSSafeReleaseNULL(serviceArrayObj);
4552
4553 // populate kIOUserClassesKey
4554
4555 OSUserMetaClass * userMeta;
4556 OSArray * classesArray;
4557 const OSString * str2;
4558
4559 classesArray = OSArray::withCapacity(4);
4560 prop = service->copyProperty(gIOUserClassKey);
4561 str2 = OSDynamicCast(OSString, prop);
4562 userMeta = (typeof(userMeta))service->reserved->uvars->userServer->fClasses->getObject(str2);
4563 while (str2 && userMeta) {
4564 classesArray->setObject(str2);
4565 userMeta = userMeta->superMeta;
4566 if (userMeta) {
4567 str2 = userMeta->name;
4568 }
4569 }
4570 service->setProperty(gIOUserClassesKey, classesArray);
4571 OSSafeReleaseNULL(classesArray);
4572 OSSafeReleaseNULL(prop);
4573 }
4574 IOLockUnlock(fLock);
4575
4576 prop = service->copyProperty(gIOUserClassKey);
4577 str = OSDynamicCast(OSString, prop);
4578 if (str) {
4579 service->setName(str);
4580 }
4581 OSSafeReleaseNULL(prop);
4582
4583 prop = service->copyProperty(gIOModuleIdentifierKey);
4584 bundleID = OSDynamicCast(OSSymbol, prop);
4585 if (bundleID) {
4586 execPath[0] = 0;
4587 bool ok = OSKext::copyUserExecutablePath(bundleID, execPath, sizeof(execPath));
4588 if (ok) {
4589 ret = LoadModule(execPath);
4590 if (kIODKLogSetup & gIODKDebug) {
4591 DKLOG("%s::LoadModule 0x%x %s\n", getName(), ret, execPath);
4592 }
4593 }
4594 }
4595 OSSafeReleaseNULL(prop);
4596
4597 ret = kIOReturnSuccess;
4598
4599 return ret;
4600 }
4601
4602 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4603
4604 IOReturn
serviceNewUserClient(IOService * service,task_t owningTask,void * securityID,uint32_t type,OSDictionary * properties,IOUserClient ** handler)4605 IOUserServer::serviceNewUserClient(IOService * service, task_t owningTask, void * securityID,
4606 uint32_t type, OSDictionary * properties, IOUserClient ** handler)
4607 {
4608 IOReturn ret;
4609 IOUserClient * uc;
4610 IOUserUserClient * userUC;
4611 OSDictionary * entitlements;
4612 OSObject * prop;
4613 OSObject * bundleID;
4614 bool ok = false;
4615
4616 entitlements = IOUserClient::copyClientEntitlements(owningTask);
4617 if (!entitlements) {
4618 entitlements = OSDictionary::withCapacity(8);
4619 }
4620 if (entitlements) {
4621 if (kIOReturnSuccess == clientHasPrivilege((void *) owningTask, kIOClientPrivilegeAdministrator)) {
4622 entitlements->setObject(kIODriverKitUserClientEntitlementAdministratorKey, kOSBooleanTrue);
4623 }
4624 OSString * creatorName = IOCopyLogNameForPID(proc_selfpid());
4625 if (creatorName) {
4626 entitlements->setObject(kIOUserClientCreatorKey, creatorName);
4627 OSSafeReleaseNULL(creatorName);
4628 }
4629 }
4630
4631 *handler = NULL;
4632 ret = service->_NewUserClient(type, entitlements, &uc);
4633 if (kIOReturnSuccess != ret) {
4634 OSSafeReleaseNULL(entitlements);
4635 return ret;
4636 }
4637 userUC = OSDynamicCast(IOUserUserClient, uc);
4638 if (!userUC) {
4639 uc->terminate(kIOServiceTerminateNeedWillTerminate);
4640 uc->setTerminateDefer(service, false);
4641 OSSafeReleaseNULL(uc);
4642 OSSafeReleaseNULL(entitlements);
4643 return kIOReturnUnsupported;
4644 }
4645 userUC->setTask(owningTask);
4646
4647 if (!(kIODKDisableEntitlementChecking & gIODKDebug)) {
4648 do {
4649 bool checkiOS3pEntitlements;
4650
4651 // check if client has com.apple.private.driverkit.driver-access and the required entitlements match the driver's entitlements
4652 if (entitlements && (prop = entitlements->getObject(gIODriverKitRequiredEntitlementsKey))) {
4653 prop->retain();
4654 ok = checkEntitlements(fEntitlements, prop, NULL, NULL);
4655 if (ok) {
4656 break;
4657 } else {
4658 DKLOG(DKS ":UC failed required entitlement check\n", DKN(userUC));
4659 }
4660 }
4661
4662 #if XNU_TARGET_OS_IOS
4663 checkiOS3pEntitlements = !fPlatformDriver;
4664 if (checkiOS3pEntitlements && fTeamIdentifier == NULL) {
4665 DKLOG("warning: " DKS " does not have a team identifier\n", DKN(this));
4666 }
4667 #else
4668 checkiOS3pEntitlements = false;
4669 #endif
4670 if (checkiOS3pEntitlements) {
4671 // App must have com.apple.developer.driverkit.communicates-with-drivers
4672 ok = entitlements && entitlements->getObject(gIODriverKitUserClientEntitlementCommunicatesWithDriversKey) == kOSBooleanTrue;
4673 if (ok) {
4674 // check team ID
4675 const char * clientTeamID = csproc_get_teamid(current_proc());
4676 bool sameTeam = fTeamIdentifier != NULL && clientTeamID != NULL && strncmp(fTeamIdentifier->getCStringNoCopy(), clientTeamID, CS_MAX_TEAMID_LEN) == 0;
4677
4678 if (sameTeam) {
4679 ok = true;
4680 } else {
4681 // different team IDs, dext must have com.apple.developer.driverkit.allow-third-party-userclients
4682 ok = fEntitlements && fEntitlements->getObject(gIODriverKitUserClientEntitlementAllowThirdPartyUserClientsKey) == kOSBooleanTrue;
4683 }
4684 if (!ok) {
4685 DKLOG(DKS ":UC failed team ID check. client team=%s, driver team=%s\n", DKN(userUC), clientTeamID ? clientTeamID : "(null)", fTeamIdentifier ? fTeamIdentifier->getCStringNoCopy() : "(null)");
4686 }
4687 } else {
4688 DKLOG(DKS ":UC entitlement check failed, app does not have %s entitlement\n", DKN(userUC), gIODriverKitUserClientEntitlementCommunicatesWithDriversKey->getCStringNoCopy());
4689 }
4690
4691 // When checking iOS 3rd party entitlements, do not fall through to other entitlement checks
4692 break;
4693 }
4694
4695 // first party dexts and third party macOS dexts
4696
4697 // check if driver has com.apple.developer.driverkit.allow-any-userclient-access
4698 if (fEntitlements && fEntitlements->getObject(gIODriverKitUserClientEntitlementAllowAnyKey)) {
4699 ok = true;
4700 break;
4701 }
4702
4703 // check if client has com.apple.developer.driverkit.userclient-access and its value matches the bundle ID of the service
4704 bundleID = service->copyProperty(gIOModuleIdentifierKey);
4705 ok = (entitlements
4706 && bundleID
4707 && (prop = entitlements->getObject(gIODriverKitUserClientEntitlementsKey)));
4708 if (ok) {
4709 bool found __block = false;
4710 ok = prop->iterateObjects(^bool (OSObject * object) {
4711 found = object->isEqualTo(bundleID);
4712 return found;
4713 });
4714 ok = found;
4715 } else {
4716 OSString * bundleIDStr = OSDynamicCast(OSString, bundleID);
4717 DKLOG(DKS ":UC failed userclient-access check, needed bundle ID %s\n", DKN(userUC), bundleIDStr ? bundleIDStr->getCStringNoCopy() : "(null)");
4718 }
4719 OSSafeReleaseNULL(bundleID);
4720 } while (false);
4721
4722 if (ok) {
4723 prop = userUC->copyProperty(gIOServiceDEXTEntitlementsKey);
4724 ok = checkEntitlements(entitlements, prop, NULL, NULL);
4725 }
4726
4727 if (!ok) {
4728 DKLOG(DKS ":UC entitlements check failed\n", DKN(userUC));
4729 uc->terminate(kIOServiceTerminateNeedWillTerminate);
4730 uc->setTerminateDefer(service, false);
4731 OSSafeReleaseNULL(uc);
4732 OSSafeReleaseNULL(entitlements);
4733 return kIOReturnNotPermitted;
4734 }
4735 }
4736
4737 OSSafeReleaseNULL(entitlements);
4738 *handler = userUC;
4739
4740 return ret;
4741 }
4742
4743 IOReturn
serviceNewUserClient(IOService * service,task_t owningTask,void * securityID,uint32_t type,OSDictionary * properties,OSSharedPtr<IOUserClient> & handler)4744 IOUserServer::serviceNewUserClient(IOService * service, task_t owningTask, void * securityID,
4745 uint32_t type, OSDictionary * properties, OSSharedPtr<IOUserClient>& handler)
4746 {
4747 IOUserClient* handlerRaw = NULL;
4748 IOReturn result = serviceNewUserClient(service, owningTask, securityID, type, properties, &handlerRaw);
4749 handler.reset(handlerRaw, OSNoRetain);
4750 return result;
4751 }
4752
4753 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
4754
4755 static IOPMPowerState
4756 sPowerStates[] = {
4757 { .version = kIOPMPowerStateVersion1,
4758 .capabilityFlags = 0,
4759 .outputPowerCharacter = 0,
4760 .inputPowerRequirement = 0},
4761 { .version = kIOPMPowerStateVersion1,
4762 .capabilityFlags = kIOPMLowPower,
4763 .outputPowerCharacter = kIOPMLowPower,
4764 .inputPowerRequirement = kIOPMLowPower},
4765 { .version = kIOPMPowerStateVersion1,
4766 .capabilityFlags = kIOPMPowerOn,
4767 .outputPowerCharacter = kIOPMPowerOn,
4768 .inputPowerRequirement = kIOPMPowerOn},
4769 };
4770
4771 enum {
4772 kUserServerMaxPowerState = 2
4773 };
4774
4775 IOReturn
serviceJoinPMTree(IOService * service)4776 IOUserServer::serviceJoinPMTree(IOService * service)
4777 {
4778 IOReturn ret;
4779 IOService * pmProvider;
4780 bool joinTree;
4781
4782 if (service->reserved->uvars->userServerPM) {
4783 return kIOReturnSuccess;
4784 }
4785
4786 if (!fRootNotifier) {
4787 ret = registerPowerDriver(this, sPowerStates, sizeof(sPowerStates) / sizeof(sPowerStates[0]));
4788 assert(kIOReturnSuccess == ret);
4789 IOServicePH::serverAdd(this);
4790 fRootNotifier = true;
4791 }
4792
4793 joinTree = false;
4794 if (!(kIODKDisablePM & gIODKDebug) && !service->pm_vars) {
4795 kern_return_t kr;
4796 OSDictionary * props;
4797 kr = service->CopyProperties_Local(&props);
4798 if (kIOReturnSuccess == kr) {
4799 if (props->getObject(kIOPMResetPowerStateOnWakeKey) == kOSBooleanTrue) {
4800 service->setProperty(kIOPMResetPowerStateOnWakeKey, kOSBooleanTrue);
4801 }
4802 OSSafeReleaseNULL(props);
4803 }
4804 service->PMinit();
4805 ret = service->registerPowerDriver(this, sPowerStates, sizeof(sPowerStates) / sizeof(sPowerStates[0]));
4806 assert(kIOReturnSuccess == ret);
4807 joinTree = true;
4808 }
4809
4810 pmProvider = service;
4811 while (pmProvider && !pmProvider->inPlane(gIOPowerPlane)) {
4812 pmProvider = pmProvider->getProvider();
4813 }
4814 if (!pmProvider) {
4815 pmProvider = getPMRootDomain();
4816 }
4817 if (pmProvider) {
4818 IOService * entry;
4819 OSObject * prop;
4820 OSObject * nextProp;
4821 OSString * str;
4822
4823 entry = pmProvider;
4824 prop = NULL;
4825 do {
4826 nextProp = entry->copyProperty("non-removable");
4827 if (nextProp) {
4828 OSSafeReleaseNULL(prop);
4829 prop = nextProp;
4830 }
4831 entry = entry->getProvider();
4832 } while (entry);
4833 if (prop) {
4834 str = OSDynamicCast(OSString, prop);
4835 if (str && str->isEqualTo("yes")) {
4836 pmProvider = NULL;
4837 }
4838 prop->release();
4839 }
4840 }
4841
4842 if (!(kIODKDisablePM & gIODKDebug) && pmProvider) {
4843 IOLockLock(fLock);
4844 service->reserved->uvars->powerState = true;
4845 IOLockUnlock(fLock);
4846
4847 if (joinTree) {
4848 pmProvider->joinPMtree(service);
4849 service->reserved->uvars->userServerPM = true;
4850 service->reserved->uvars->resetPowerOnWake = service->propertyExists(kIOPMResetPowerStateOnWakeKey);
4851 }
4852 }
4853
4854 service->registerInterestedDriver(this);
4855 return kIOReturnSuccess;
4856 }
4857
4858 IOReturn
setPowerState(unsigned long state,IOService * service)4859 IOUserServer::setPowerState(unsigned long state, IOService * service)
4860 {
4861 if (kIODKLogPM & gIODKDebug) {
4862 DKLOG(DKS "::setPowerState(%ld) %d\n", DKN(service), state, fSystemPowerAck);
4863 }
4864 return kIOPMAckImplied;
4865 }
4866
4867
4868 IOReturn
serviceSetPowerState(IOService * controllingDriver,IOService * service,IOPMPowerFlags flags,unsigned long state)4869 IOUserServer::serviceSetPowerState(IOService * controllingDriver, IOService * service, IOPMPowerFlags flags, unsigned long state)
4870 {
4871 IOReturn ret;
4872 bool sendIt = false;
4873
4874 IOLockLock(fLock);
4875 if (service->reserved->uvars) {
4876 if (!fSystemOff && !(kIODKDisablePM & gIODKDebug)) {
4877 OSDictionary * wakeDescription;
4878 OSObject * prop;
4879 char wakeReasonString[128];
4880
4881 wakeDescription = OSDictionary::withCapacity(4);
4882 if (wakeDescription) {
4883 wakeReasonString[0] = 0;
4884 getPMRootDomain()->copyWakeReasonString(wakeReasonString, sizeof(wakeReasonString));
4885
4886 if (wakeReasonString[0]) {
4887 prop = OSString::withCString(&wakeReasonString[0]);
4888 wakeDescription->setObject(gIOSystemStateWakeDescriptionWakeReasonKey, prop);
4889 OSSafeReleaseNULL(prop);
4890 }
4891 getSystemStateNotificationService()->StateNotificationItemSet(gIOSystemStateWakeDescriptionKey, wakeDescription);
4892 OSSafeReleaseNULL(wakeDescription);
4893 }
4894
4895 service->reserved->uvars->willPower = true;
4896 service->reserved->uvars->willPowerState = state;
4897 service->reserved->uvars->controllingDriver = controllingDriver;
4898 sendIt = true;
4899 } else {
4900 service->reserved->uvars->willPower = false;
4901 }
4902 }
4903 IOLockUnlock(fLock);
4904
4905 if (sendIt) {
4906 if (kIODKLogPM & gIODKDebug) {
4907 DKLOG(DKS "::serviceSetPowerState(%ld) %d\n", DKN(service), state, fSystemPowerAck);
4908 }
4909 ret = service->SetPowerState((uint32_t) flags);
4910 if (kIOReturnSuccess == ret) {
4911 return 20 * 1000 * 1000;
4912 } else {
4913 IOLockLock(fLock);
4914 service->reserved->uvars->willPower = false;
4915 IOLockUnlock(fLock);
4916 }
4917 }
4918
4919 return kIOPMAckImplied;
4920 }
4921
4922 IOReturn
powerStateWillChangeTo(IOPMPowerFlags flags,unsigned long state,IOService * service)4923 IOUserServer::powerStateWillChangeTo(IOPMPowerFlags flags, unsigned long state, IOService * service)
4924 {
4925 return kIOPMAckImplied;
4926 }
4927
4928 IOReturn
powerStateDidChangeTo(IOPMPowerFlags flags,unsigned long state,IOService * service)4929 IOUserServer::powerStateDidChangeTo(IOPMPowerFlags flags, unsigned long state, IOService * service)
4930 {
4931 unsigned int idx;
4932 bool pmAck;
4933
4934 pmAck = false;
4935 IOLockLock(fLock);
4936 idx = fServices->getNextIndexOfObject(service, 0);
4937 if (-1U == idx) {
4938 IOLockUnlock(fLock);
4939 return kIOPMAckImplied;
4940 }
4941
4942 service->reserved->uvars->powerState = (0 != state);
4943 bool allPowerStates __block = service->reserved->uvars->powerState;
4944 if (!allPowerStates) {
4945 // any service on?
4946 fServices->iterateObjects(^bool (OSObject * obj) {
4947 int service __unused; // hide outer defn
4948 IOService * nextService;
4949 nextService = (IOService *) obj;
4950 allPowerStates = nextService->reserved->uvars->powerState;
4951 // early terminate if true
4952 return allPowerStates;
4953 });
4954 }
4955 if (kIODKLogPM & gIODKDebug) {
4956 DKLOG(DKS "::powerStateDidChangeTo(%ld) %d, %d\n", DKN(service), state, allPowerStates, fSystemPowerAck);
4957 }
4958 if (!allPowerStates && (pmAck = fSystemPowerAck)) {
4959 fSystemPowerAck = false;
4960 fSystemOff = true;
4961 }
4962 IOLockUnlock(fLock);
4963
4964 if (pmAck) {
4965 IOServicePH::serverAck(this);
4966 }
4967
4968 return kIOPMAckImplied;
4969 }
4970
4971 bool
checkPMReady()4972 IOUserServer::checkPMReady()
4973 {
4974 bool __block ready = true;
4975
4976 IOLockLock(fLock);
4977 // Check if any services have not completely joined the PM tree (i.e.
4978 // addPowerChild has not compeleted).
4979 fServices->iterateObjects(^bool (OSObject * obj) {
4980 IOPowerConnection *conn;
4981 IOService *service = (IOService *) obj;
4982 IORegistryEntry *parent = service->getParentEntry(gIOPowerPlane);
4983 if ((conn = OSDynamicCast(IOPowerConnection, parent))) {
4984 if (!conn->getReadyFlag()) {
4985 ready = false;
4986 return true;
4987 }
4988 }
4989 return false;
4990 });
4991 IOLockUnlock(fLock);
4992
4993 return ready;
4994 }
4995
4996 kern_return_t
JoinPMTree_Impl(void)4997 IOService::JoinPMTree_Impl(void)
4998 {
4999 if (!reserved->uvars || !reserved->uvars->userServer) {
5000 return kIOReturnNotReady;
5001 }
5002 return reserved->uvars->userServer->serviceJoinPMTree(this);
5003 }
5004
5005 kern_return_t
SetPowerState_Impl(uint32_t powerFlags)5006 IOService::SetPowerState_Impl(
5007 uint32_t powerFlags)
5008 {
5009 if (kIODKLogPM & gIODKDebug) {
5010 DKLOG(DKS "::SetPowerState(%d), %d\n", DKN(this), powerFlags, reserved->uvars->willPower);
5011 }
5012 if (reserved->uvars
5013 && reserved->uvars->userServer
5014 && reserved->uvars->willPower) {
5015 IOReturn ret;
5016 reserved->uvars->willPower = false;
5017 ret = reserved->uvars->controllingDriver->setPowerState(reserved->uvars->willPowerState, this);
5018 if (kIOPMAckImplied == ret) {
5019 acknowledgeSetPowerState();
5020 }
5021 return kIOReturnSuccess;
5022 }
5023 return kIOReturnNotReady;
5024 }
5025
5026 kern_return_t
ChangePowerState_Impl(uint32_t powerFlags)5027 IOService::ChangePowerState_Impl(
5028 uint32_t powerFlags)
5029 {
5030 switch (powerFlags) {
5031 case kIOServicePowerCapabilityOff:
5032 changePowerStateToPriv(0);
5033 break;
5034 case kIOServicePowerCapabilityLow:
5035 changePowerStateToPriv(1);
5036 break;
5037 case kIOServicePowerCapabilityOn:
5038 changePowerStateToPriv(2);
5039 break;
5040 default:
5041 return kIOReturnBadArgument;
5042 }
5043
5044 return kIOReturnSuccess;
5045 }
5046
5047 kern_return_t
_ClaimSystemWakeEvent_Impl(IOService * device,uint64_t flags,const char * reason,OSContainer * details)5048 IOService::_ClaimSystemWakeEvent_Impl(
5049 IOService * device,
5050 uint64_t flags,
5051 const char * reason,
5052 OSContainer * details)
5053 {
5054 IOPMrootDomain * rootDomain;
5055 IOOptionBits pmFlags;
5056
5057 rootDomain = getPMRootDomain();
5058 if (!rootDomain) {
5059 return kIOReturnNotReady;
5060 }
5061 if (os_convert_overflow(flags, &pmFlags)) {
5062 return kIOReturnBadArgument;
5063 }
5064 rootDomain->claimSystemWakeEvent(device, pmFlags, reason, details);
5065
5066 return kIOReturnSuccess;
5067 }
5068
5069 kern_return_t
Create_Impl(IOService * provider,const char * propertiesKey,IOService ** result)5070 IOService::Create_Impl(
5071 IOService * provider,
5072 const char * propertiesKey,
5073 IOService ** result)
5074 {
5075 OSObject * inst;
5076 IOService * service;
5077 OSString * str;
5078 const OSSymbol * sym;
5079 OSObject * prop = NULL;
5080 OSObject * moduleIdentifier = NULL;
5081 OSObject * userServerName = NULL;
5082 OSDictionary * properties = NULL;
5083 OSDictionary * copyProperties = NULL;
5084 kern_return_t ret;
5085
5086 if (provider != this) {
5087 return kIOReturnUnsupported;
5088 }
5089
5090 ret = kIOReturnUnsupported;
5091 inst = NULL;
5092 service = NULL;
5093
5094 prop = copyProperty(propertiesKey);
5095 properties = OSDynamicCast(OSDictionary, prop);
5096 if (!properties) {
5097 ret = kIOReturnBadArgument;
5098 goto finish;
5099 }
5100 copyProperties = OSDynamicCast(OSDictionary, properties->copyCollection());
5101 if (!copyProperties) {
5102 ret = kIOReturnNoMemory;
5103 goto finish;
5104 }
5105 moduleIdentifier = copyProperty(gIOModuleIdentifierKey);
5106 if (moduleIdentifier) {
5107 copyProperties->setObject(gIOModuleIdentifierKey, moduleIdentifier);
5108 }
5109 userServerName = reserved->uvars->userServer->copyProperty(gIOUserServerNameKey);
5110 if (userServerName) {
5111 copyProperties->setObject(gIOUserServerNameKey, userServerName);
5112 }
5113
5114 str = OSDynamicCast(OSString, copyProperties->getObject(gIOClassKey));
5115 if (!str) {
5116 ret = kIOReturnBadArgument;
5117 goto finish;
5118 }
5119 sym = OSSymbol::withString(str);
5120 if (sym) {
5121 inst = OSMetaClass::allocClassWithName(sym);
5122 service = OSDynamicCast(IOService, inst);
5123 if (service && service->init(copyProperties) && service->attach(this)) {
5124 reserved->uvars->userServer->serviceAttach(service, this);
5125 service->reserved->uvars->started = true;
5126 ret = kIOReturnSuccess;
5127 *result = service;
5128 }
5129 OSSafeReleaseNULL(sym);
5130 }
5131
5132 finish:
5133 OSSafeReleaseNULL(prop);
5134 OSSafeReleaseNULL(copyProperties);
5135 OSSafeReleaseNULL(moduleIdentifier);
5136 OSSafeReleaseNULL(userServerName);
5137 if (kIOReturnSuccess != ret) {
5138 OSSafeReleaseNULL(inst);
5139 }
5140
5141 return ret;
5142 }
5143
5144 kern_return_t
Terminate_Impl(uint64_t options)5145 IOService::Terminate_Impl(
5146 uint64_t options)
5147 {
5148 IOUserServer * us;
5149
5150 if (options) {
5151 return kIOReturnUnsupported;
5152 }
5153
5154 us = (typeof(us))thread_iokit_tls_get(0);
5155 if (us && (!reserved->uvars
5156 || (reserved->uvars->userServer != us))) {
5157 return kIOReturnNotPermitted;
5158 }
5159 terminate(kIOServiceTerminateNeedWillTerminate);
5160
5161 return kIOReturnSuccess;
5162 }
5163
5164 kern_return_t
NewUserClient_Impl(uint32_t type,IOUserClient ** userClient)5165 IOService::NewUserClient_Impl(
5166 uint32_t type,
5167 IOUserClient ** userClient)
5168 {
5169 return kIOReturnError;
5170 }
5171
5172 kern_return_t
_NewUserClient_Impl(uint32_t type,OSDictionary * entitlements,IOUserClient ** userClient)5173 IOService::_NewUserClient_Impl(
5174 uint32_t type,
5175 OSDictionary * entitlements,
5176 IOUserClient ** userClient)
5177 {
5178 return kIOReturnError;
5179 }
5180
5181 kern_return_t
SearchProperty_Impl(const char * name,const char * plane,uint64_t options,OSContainer ** property)5182 IOService::SearchProperty_Impl(
5183 const char * name,
5184 const char * plane,
5185 uint64_t options,
5186 OSContainer ** property)
5187 {
5188 OSObject * object __block;
5189 IOService * provider;
5190 IOOptionBits regOptions;
5191
5192 if (kIOServiceSearchPropertyParents & options) {
5193 regOptions = kIORegistryIterateParents | kIORegistryIterateRecursively;
5194 } else {
5195 regOptions = 0;
5196 }
5197
5198 object = copyProperty(name, IORegistryEntry::getPlane(plane), regOptions);
5199
5200 if (NULL == object) {
5201 for (provider = this; provider; provider = provider->getProvider()) {
5202 provider->runPropertyActionBlock(^IOReturn (void) {
5203 OSDictionary * userProps;
5204 object = provider->getProperty(name);
5205 if (!object
5206 && (userProps = OSDynamicCast(OSDictionary, provider->getProperty(gIOUserServicePropertiesKey)))) {
5207 object = userProps->getObject(name);
5208 }
5209 if (object) {
5210 object->retain();
5211 }
5212 return kIOReturnSuccess;
5213 });
5214 if (object || !(kIORegistryIterateParents & options)) {
5215 break;
5216 }
5217 }
5218 }
5219
5220 *property = object;
5221
5222 return object ? kIOReturnSuccess : kIOReturnNotFound;
5223 }
5224
5225 kern_return_t
StringFromReturn_Impl(IOReturn retval,OSString ** str)5226 IOService::StringFromReturn_Impl(
5227 IOReturn retval,
5228 OSString ** str)
5229 {
5230 OSString *obj = OSString::withCString(stringFromReturn(retval));
5231 *str = obj;
5232 return obj ? kIOReturnSuccess : kIOReturnError;
5233 }
5234
5235 #if PRIVATE_WIFI_ONLY
5236 const char *
StringFromReturn(IOReturn retval)5237 IOService::StringFromReturn(
5238 IOReturn retval)
5239 {
5240 return stringFromReturn(retval);
5241 }
5242 #endif /* PRIVATE_WIFI_ONLY */
5243
5244 kern_return_t
CopyProviderProperties_Impl(OSArray * propertyKeys,OSArray ** properties)5245 IOService::CopyProviderProperties_Impl(
5246 OSArray * propertyKeys,
5247 OSArray ** properties)
5248 {
5249 IOReturn ret;
5250 OSArray * result;
5251 IOService * provider;
5252
5253 result = OSArray::withCapacity(8);
5254 if (!result) {
5255 return kIOReturnNoMemory;
5256 }
5257
5258 ret = kIOReturnSuccess;
5259 for (provider = this; provider; provider = provider->getProvider()) {
5260 OSObject * obj;
5261 OSDictionary * props;
5262
5263 obj = provider->copyProperty(gIOSupportedPropertiesKey);
5264 props = OSDynamicCast(OSDictionary, obj);
5265 if (!props) {
5266 OSSafeReleaseNULL(obj);
5267 props = provider->dictionaryWithProperties();
5268 }
5269 if (!props) {
5270 ret = kIOReturnNoMemory;
5271 break;
5272 }
5273
5274 bool __block addClass = true;
5275 if (propertyKeys) {
5276 OSDictionary * retProps;
5277 retProps = OSDictionary::withCapacity(4);
5278 addClass = false;
5279 if (!retProps) {
5280 ret = kIOReturnNoMemory;
5281 OSSafeReleaseNULL(props);
5282 break;
5283 }
5284 propertyKeys->iterateObjects(^bool (OSObject * _key) {
5285 OSString * key = OSDynamicCast(OSString, _key);
5286 if (gIOClassKey->isEqualTo(key)) {
5287 addClass = true;
5288 return false;
5289 }
5290 retProps->setObject(key, props->getObject(key));
5291 return false;
5292 });
5293 OSSafeReleaseNULL(props);
5294 props = retProps;
5295 }
5296 if (addClass) {
5297 OSArray * classes = OSArray::withCapacity(8);
5298 if (!classes) {
5299 OSSafeReleaseNULL(props);
5300 ret = kIOReturnNoMemory;
5301 break;
5302 }
5303 for (const OSMetaClass * meta = provider->getMetaClass(); meta; meta = meta->getSuperClass()) {
5304 classes->setObject(meta->getClassNameSymbol());
5305 }
5306 props->setObject(gIOClassKey, classes);
5307 OSSafeReleaseNULL(classes);
5308 }
5309 bool ok = result->setObject(props);
5310 props->release();
5311 if (!ok) {
5312 ret = kIOReturnNoMemory;
5313 break;
5314 }
5315 }
5316 if (kIOReturnSuccess != ret) {
5317 OSSafeReleaseNULL(result);
5318 }
5319 *properties = result;
5320 return ret;
5321 }
5322
5323 IOReturn
AdjustBusy_Impl(int32_t delta)5324 IOService::AdjustBusy_Impl(int32_t delta)
5325 {
5326 adjustBusy(delta);
5327 return kIOReturnSuccess;
5328 }
5329
5330 IOReturn
GetBusyState_Impl(uint32_t * busyState)5331 IOService::GetBusyState_Impl(uint32_t *busyState)
5332 {
5333 *busyState = getBusyState();
5334 return kIOReturnSuccess;
5335 }
5336
5337 void
systemPower(bool powerOff)5338 IOUserServer::systemPower(bool powerOff)
5339 {
5340 OSArray * services;
5341 {
5342 OSDictionary * sleepDescription;
5343 OSObject * prop;
5344
5345 sleepDescription = OSDictionary::withCapacity(4);
5346 if (sleepDescription) {
5347 prop = getPMRootDomain()->copyProperty(kRootDomainSleepReasonKey);
5348 if (prop) {
5349 sleepDescription->setObject(gIOSystemStateSleepDescriptionReasonKey, prop);
5350 OSSafeReleaseNULL(prop);
5351 }
5352 prop = getPMRootDomain()->copyProperty(kIOHibernateStateKey);
5353 if (prop) {
5354 sleepDescription->setObject(gIOSystemStateSleepDescriptionHibernateStateKey, prop);
5355 OSSafeReleaseNULL(prop);
5356 }
5357 getSystemStateNotificationService()->StateNotificationItemSet(gIOSystemStateSleepDescriptionKey, sleepDescription);
5358 OSSafeReleaseNULL(sleepDescription);
5359 }
5360 }
5361
5362 IOLockLock(fLock);
5363
5364 services = OSArray::withArray(fServices);
5365
5366 bool allPowerStates __block = 0;
5367 // any service on?
5368 fServices->iterateObjects(^bool (OSObject * obj) {
5369 int service __unused; // hide outer defn
5370 IOService * nextService;
5371 nextService = (IOService *) obj;
5372 allPowerStates = nextService->reserved->uvars->powerState;
5373 // early terminate if true
5374 return allPowerStates;
5375 });
5376
5377 if (kIODKLogPM & gIODKDebug) {
5378 DKLOG("%s::powerOff(%d) %d\n", getName(), powerOff, allPowerStates);
5379 }
5380
5381 if (powerOff) {
5382 fSystemPowerAck = allPowerStates;
5383 if (!fSystemPowerAck) {
5384 fSystemOff = true;
5385 }
5386 IOLockUnlock(fLock);
5387
5388 if (!fSystemPowerAck) {
5389 IOServicePH::serverAck(this);
5390 } else {
5391 if (services) {
5392 services->iterateObjects(^bool (OSObject * obj) {
5393 int service __unused; // hide outer defn
5394 IOService * nextService;
5395 nextService = (IOService *) obj;
5396 if (kIODKLogPM & gIODKDebug) {
5397 DKLOG("changePowerStateWithOverrideTo(" DKS ", %d)\n", DKN(nextService), 0);
5398 }
5399 nextService->reserved->uvars->powerOverride = nextService->reserved->uvars->userServerPM ? kUserServerMaxPowerState : nextService->getPowerState();
5400 nextService->changePowerStateWithOverrideTo(0, 0);
5401 return false;
5402 });
5403 }
5404 }
5405 } else {
5406 fSystemOff = false;
5407 IOLockUnlock(fLock);
5408 if (services) {
5409 services->iterateObjects(^bool (OSObject * obj) {
5410 int service __unused; // hide outer defn
5411 IOService * nextService;
5412 nextService = (IOService *) obj;
5413 if (-1U != nextService->reserved->uvars->powerOverride) {
5414 if (kIODKLogPM & gIODKDebug) {
5415 DKLOG("%schangePowerStateWithOverrideTo(" DKS ", %d)\n", nextService->reserved->uvars->resetPowerOnWake ? "!" : "", DKN(nextService), nextService->reserved->uvars->powerOverride);
5416 }
5417 if (!nextService->reserved->uvars->resetPowerOnWake) {
5418 nextService->changePowerStateWithOverrideTo(nextService->reserved->uvars->powerOverride, 0);
5419 }
5420 nextService->reserved->uvars->powerOverride = -1U;
5421 }
5422 return false;
5423 });
5424 }
5425 }
5426 OSSafeReleaseNULL(services);
5427 }
5428
5429
5430 void
systemHalt(int howto)5431 IOUserServer::systemHalt(int howto)
5432 {
5433 OSArray * services;
5434
5435 if (true || (kIODKLogPM & gIODKDebug)) {
5436 DKLOG("%s::systemHalt()\n", getName());
5437 }
5438
5439 {
5440 OSDictionary * haltDescription;
5441 OSNumber * state;
5442 uint64_t haltStateFlags;
5443
5444 haltDescription = OSDictionary::withCapacity(4);
5445 if (haltDescription) {
5446 haltStateFlags = 0;
5447 if (RB_HALT & howto) {
5448 haltStateFlags |= kIOServiceHaltStatePowerOff;
5449 } else {
5450 haltStateFlags |= kIOServiceHaltStateRestart;
5451 }
5452 state = OSNumber::withNumber(haltStateFlags, 64);
5453 haltDescription->setObject(gIOSystemStateHaltDescriptionHaltStateKey, state);
5454 getSystemStateNotificationService()->StateNotificationItemSet(gIOSystemStateHaltDescriptionKey, haltDescription);
5455
5456 OSSafeReleaseNULL(state);
5457 OSSafeReleaseNULL(haltDescription);
5458 }
5459 }
5460
5461 IOLockLock(fLock);
5462 services = OSArray::withArray(fServices);
5463 IOLockUnlock(fLock);
5464
5465 if (services) {
5466 services->iterateObjects(^bool (OSObject * obj) {
5467 int service __unused; // hide outer defn
5468 IOService * nextService;
5469 IOService * provider;
5470 IOOptionBits terminateOptions;
5471 bool root;
5472
5473 nextService = (IOService *) obj;
5474 provider = nextService->getProvider();
5475 if (!provider) {
5476 DKLOG("stale service " DKS " found, skipping termination\n", DKN(nextService));
5477 return false;
5478 }
5479 root = (NULL == provider->getProperty(gIOUserServerNameKey, gIOServicePlane));
5480 if (true || (kIODKLogPM & gIODKDebug)) {
5481 DKLOG("%d: terminate(" DKS ")\n", root, DKN(nextService));
5482 }
5483 if (!root) {
5484 return false;
5485 }
5486 terminateOptions = kIOServiceRequired | kIOServiceTerminateNeedWillTerminate;
5487 if (!nextService->terminate(terminateOptions)) {
5488 IOLog("failed to terminate service %s-0x%llx\n", nextService->getName(), nextService->getRegistryEntryID());
5489 }
5490 return false;
5491 });
5492 }
5493 OSSafeReleaseNULL(services);
5494 }
5495
5496 void
powerSourceChanged(bool acAttached)5497 IOUserServer::powerSourceChanged(bool acAttached)
5498 {
5499 OSDictionary * powerSourceDescription;
5500
5501 powerSourceDescription = OSDictionary::withCapacity(4);
5502 if (!powerSourceDescription) {
5503 return;
5504 }
5505 powerSourceDescription->setObject(gIOSystemStatePowerSourceDescriptionACAttachedKey, acAttached ? kOSBooleanTrue : kOSBooleanFalse);
5506 getSystemStateNotificationService()->StateNotificationItemSet(gIOSystemStatePowerSourceDescriptionKey, powerSourceDescription);
5507
5508 OSSafeReleaseNULL(powerSourceDescription);
5509 }
5510
5511 IOReturn
serviceStarted(IOService * service,IOService * provider,bool result)5512 IOUserServer::serviceStarted(IOService * service, IOService * provider, bool result)
5513 {
5514 IOReturn ret;
5515
5516 DKLOG(DKS "::start(" DKS ") %s\n", DKN(service), DKN(provider), result ? "ok" : "fail");
5517
5518 if (!result) {
5519 ret = kIOReturnSuccess;
5520 return ret;
5521 }
5522
5523 ret = serviceJoinPMTree(service);
5524
5525 service->reserved->uvars->started = true;
5526
5527 if (service->reserved->uvars->deferredRegisterService) {
5528 service->registerService(kIOServiceAsynchronous | kIOServiceDextRequirePowerForMatching);
5529 service->reserved->uvars->deferredRegisterService = false;
5530 }
5531
5532 return kIOReturnSuccess;
5533 }
5534
5535
5536 IOReturn
serviceOpen(IOService * provider,IOService * client)5537 IOUserServer::serviceOpen(IOService * provider, IOService * client)
5538 {
5539 OSObjectUserVars * uvars;
5540 IOReturn ret;
5541
5542 IOLockLock(client->reserved->uvars->uvarsLock);
5543 uvars = client->reserved->uvars;
5544 if (uvars->willTerminate || uvars->stopped) {
5545 DKLOG(DKS "- " DKS " blocked attempt to open " DKS "\n", DKN(this), DKN(client), DKN(provider));
5546 ret = kIOReturnBadArgument;
5547 } else {
5548 if (!uvars->openProviders) {
5549 uvars->openProviders = OSArray::withObjects((const OSObject **) &provider, 1);
5550 } else if (-1U == uvars->openProviders->getNextIndexOfObject(provider, 0)) {
5551 uvars->openProviders->setObject(provider);
5552 }
5553 ret = kIOReturnSuccess;
5554 }
5555
5556 IOLockUnlock(client->reserved->uvars->uvarsLock);
5557
5558 return ret;
5559 }
5560
5561 IOReturn
serviceClose(IOService * provider,IOService * client)5562 IOUserServer::serviceClose(IOService * provider, IOService * client)
5563 {
5564 OSObjectUserVars * uvars;
5565 unsigned int idx;
5566 IOReturn ret;
5567
5568 IOLockLock(client->reserved->uvars->uvarsLock);
5569 uvars = client->reserved->uvars;
5570 if (!uvars->openProviders) {
5571 ret = kIOReturnNotOpen;
5572 goto finish;
5573 }
5574 idx = uvars->openProviders->getNextIndexOfObject(provider, 0);
5575 if (-1U == idx) {
5576 ret = kIOReturnNotOpen;
5577 goto finish;
5578 }
5579 uvars->openProviders->removeObject(idx);
5580 if (!uvars->openProviders->getCount()) {
5581 OSSafeReleaseNULL(uvars->openProviders);
5582 }
5583
5584 ret = kIOReturnSuccess;
5585
5586 finish:
5587 IOLockUnlock(client->reserved->uvars->uvarsLock);
5588
5589 return ret;
5590 }
5591
5592
5593 IOReturn
serviceStop(IOService * service,IOService *)5594 IOUserServer::serviceStop(IOService * service, IOService *)
5595 {
5596 IOReturn ret;
5597 uint32_t idx, queueAlloc;
5598 bool pmAck;
5599 OSObjectUserVars * uvars;
5600 IODispatchQueue ** unboundedQueueArray = NULL;
5601 pmAck = false;
5602 IOLockLock(fLock);
5603 idx = fServices->getNextIndexOfObject(service, 0);
5604 if (-1U != idx) {
5605 fServices->removeObject(idx);
5606
5607 // Remove the service from IOAssociatedServices
5608 OSObject * serviceArrayObj = copyProperty(gIOAssociatedServicesKey);
5609 OSArray * serviceArray = OSDynamicCast(OSArray, serviceArrayObj);
5610 assert(serviceArray != NULL);
5611
5612 serviceArray = OSDynamicCast(OSArray, serviceArray->copyCollection());
5613 assert(serviceArray != NULL);
5614
5615 // Index should be the same as it was in fServices
5616 OSNumber * __assert_only registryEntryID = OSDynamicCast(OSNumber, serviceArray->getObject(idx));
5617 assert(registryEntryID);
5618
5619 // ensure it is the right service
5620 assert(registryEntryID->unsigned64BitValue() == service->getRegistryEntryID());
5621 serviceArray->removeObject(idx);
5622
5623 setProperty(gIOAssociatedServicesKey, serviceArray);
5624 OSSafeReleaseNULL(serviceArray);
5625 OSSafeReleaseNULL(serviceArrayObj);
5626
5627 uvars = service->reserved->uvars;
5628 uvars->stopped = true;
5629 uvars->powerState = 0;
5630
5631 bool allPowerStates __block = 0;
5632 // any service on?
5633 fServices->iterateObjects(^bool (OSObject * obj) {
5634 int service __unused; // hide outer defn
5635 IOService * nextService;
5636 nextService = (IOService *) obj;
5637 allPowerStates = nextService->reserved->uvars->powerState;
5638 // early terminate if true
5639 return allPowerStates;
5640 });
5641
5642 if (!allPowerStates && (pmAck = fSystemPowerAck)) {
5643 fSystemPowerAck = false;
5644 fSystemOff = true;
5645 }
5646 }
5647 IOLockUnlock(fLock);
5648 if (pmAck) {
5649 IOServicePH::serverAck(this);
5650 }
5651
5652 if (-1U == idx) {
5653 return kIOReturnSuccess;
5654 }
5655
5656 if (uvars->queueArray && uvars->userMeta) {
5657 queueAlloc = 1;
5658 if (uvars->userMeta->queueNames) {
5659 queueAlloc += uvars->userMeta->queueNames->count;
5660 }
5661 for (idx = 0; idx < queueAlloc; idx++) {
5662 OSSafeReleaseNULL(uvars->queueArray[idx]);
5663 }
5664 unboundedQueueArray = uvars->queueArray.data();
5665 IOSafeDeleteNULL(unboundedQueueArray, IODispatchQueue *, queueAlloc);
5666 uvars->queueArray = OSBoundedArrayRef<IODispatchQueue *>();
5667 }
5668
5669 (void) service->deRegisterInterestedDriver(this);
5670 if (uvars->userServerPM) {
5671 service->PMstop();
5672 }
5673
5674 ret = kIOReturnSuccess;
5675 return ret;
5676 }
5677
5678 void
serviceFree(IOService * service)5679 IOUserServer::serviceFree(IOService * service)
5680 {
5681 OSObjectUserVars * uvars;
5682
5683 uvars = service->reserved->uvars;
5684 if (!uvars) {
5685 return;
5686 }
5687 OSSafeReleaseNULL(uvars->userServer);
5688 IOLockFree(uvars->uvarsLock);
5689 IOFreeType(service->reserved->uvars, OSObjectUserVars);
5690 }
5691
5692 void
serviceWillTerminate(IOService * client,IOService * provider,IOOptionBits options)5693 IOUserServer::serviceWillTerminate(IOService * client, IOService * provider, IOOptionBits options)
5694 {
5695 IOReturn ret;
5696 bool willTerminate;
5697
5698 willTerminate = false;
5699 IOLockLock(client->reserved->uvars->uvarsLock);
5700 if (!client->reserved->uvars->serverDied
5701 && !client->reserved->uvars->willTerminate) {
5702 client->reserved->uvars->willTerminate = true;
5703 willTerminate = true;
5704 }
5705 IOLockUnlock(client->reserved->uvars->uvarsLock);
5706
5707 if (willTerminate) {
5708 if (provider->isInactive() || IOServicePH::serverSlept()) {
5709 client->Stop_async(provider);
5710 ret = kIOReturnOffline;
5711 } else {
5712 ret = client->Stop(provider);
5713 }
5714 if (kIOReturnSuccess != ret) {
5715 IOUserServer::serviceDidStop(client, provider);
5716 ret = kIOReturnSuccess;
5717 }
5718 }
5719 }
5720
5721 void
serviceDidTerminate(IOService * client,IOService * provider,IOOptionBits options,bool * defer)5722 IOUserServer::serviceDidTerminate(IOService * client, IOService * provider, IOOptionBits options, bool * defer)
5723 {
5724 IOLockLock(client->reserved->uvars->uvarsLock);
5725 client->reserved->uvars->didTerminate = true;
5726 if (!client->reserved->uvars->serverDied
5727 && !client->reserved->uvars->stopped) {
5728 *defer = true;
5729 }
5730 IOLockUnlock(client->reserved->uvars->uvarsLock);
5731 }
5732
5733 void
serviceDidStop(IOService * client,IOService * provider)5734 IOUserServer::serviceDidStop(IOService * client, IOService * provider)
5735 {
5736 bool complete;
5737 OSArray * closeArray;
5738
5739 complete = false;
5740 closeArray = NULL;
5741
5742 IOLockLock(client->reserved->uvars->uvarsLock);
5743 if (client->reserved->uvars
5744 && client->reserved->uvars->willTerminate
5745 && !client->reserved->uvars->stopped) {
5746 client->reserved->uvars->stopped = true;
5747 complete = client->reserved->uvars->didTerminate;
5748 }
5749
5750 if (client->reserved->uvars) {
5751 closeArray = client->reserved->uvars->openProviders;
5752 client->reserved->uvars->openProviders = NULL;
5753 }
5754 IOLockUnlock(client->reserved->uvars->uvarsLock);
5755
5756 if (closeArray) {
5757 closeArray->iterateObjects(^bool (OSObject * obj) {
5758 IOService * toClose;
5759 toClose = OSDynamicCast(IOService, obj);
5760 if (toClose) {
5761 DKLOG(DKS ":force close (" DKS ")\n", DKN(client), DKN(toClose));
5762 toClose->close(client);
5763 }
5764 return false;
5765 });
5766 closeArray->release();
5767 }
5768
5769 if (complete) {
5770 bool defer = false;
5771 client->didTerminate(provider, 0, &defer);
5772 }
5773 }
5774
5775 kern_return_t
ClientCrashed_Impl(IOService * client,uint64_t options)5776 IOService::ClientCrashed_Impl(
5777 IOService * client,
5778 uint64_t options)
5779 {
5780 return kIOReturnUnsupported;
5781 }
5782
5783 kern_return_t
Stop_Impl(IOService * provider)5784 IOService::Stop_Impl(
5785 IOService * provider)
5786 {
5787 IOUserServer::serviceDidStop(this, provider);
5788
5789 return kIOReturnSuccess;
5790 }
5791
5792 void
Stop_async_Impl(IOService * provider)5793 IOService::Stop_async_Impl(
5794 IOService * provider)
5795 {
5796 }
5797
5798 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
5799
5800 #undef super
5801 #define super IOUserClient
5802
OSDefineMetaClassAndStructors(IOUserUserClient,IOUserClient)5803 OSDefineMetaClassAndStructors(IOUserUserClient, IOUserClient)
5804
5805 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
5806
5807 bool
5808 IOUserUserClient::init(OSDictionary * properties)
5809 {
5810 if (!super::init(properties)) {
5811 return false;
5812 }
5813
5814 fWorkGroups = OSDictionary::withCapacity(0);
5815 if (fWorkGroups == NULL) {
5816 return false;
5817 }
5818
5819 fEventLinks = OSDictionary::withCapacity(0);
5820 if (fEventLinks == NULL) {
5821 return false;
5822 }
5823
5824 fLock = IOLockAlloc();
5825
5826 return true;
5827 }
5828
5829 void
free()5830 IOUserUserClient::free()
5831 {
5832 OSSafeReleaseNULL(fWorkGroups);
5833 OSSafeReleaseNULL(fEventLinks);
5834 if (fLock) {
5835 IOLockFree(fLock);
5836 }
5837
5838 super::free();
5839 }
5840
5841 IOReturn
setTask(task_t task)5842 IOUserUserClient::setTask(task_t task)
5843 {
5844 task_reference(task);
5845 fTask = task;
5846
5847 return kIOReturnSuccess;
5848 }
5849
5850 void
stop(IOService * provider)5851 IOUserUserClient::stop(IOService * provider)
5852 {
5853 if (fTask) {
5854 task_deallocate(fTask);
5855 fTask = NULL;
5856 }
5857 super::stop(provider);
5858 }
5859
5860 IOReturn
clientClose(void)5861 IOUserUserClient::clientClose(void)
5862 {
5863 terminate(kIOServiceTerminateNeedWillTerminate);
5864 return kIOReturnSuccess;
5865 }
5866
5867 IOReturn
setProperties(OSObject * properties)5868 IOUserUserClient::setProperties(OSObject * properties)
5869 {
5870 IOReturn ret = kIOReturnUnsupported;
5871 return ret;
5872 }
5873
5874 // p1 - name of object
5875 // p2 - length of object name
5876 // p3 - mach port name
5877
5878 kern_return_t
eventlinkConfigurationTrap(void * p1,void * p2,void * p3,void * p4,void * p5,void * p6)5879 IOUserUserClient::eventlinkConfigurationTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6)
5880 {
5881 user_addr_t userObjectName = (user_addr_t)p1;
5882 mach_port_name_t portName = (mach_port_name_t)(uintptr_t)p3;
5883 mach_port_t port = MACH_PORT_NULL;
5884 ipc_kobject_type_t portType;
5885 char eventlinkName[kIOEventLinkMaxNameLength + 1] = {0};
5886 size_t eventLinkNameLen;
5887 OSString * eventlinkNameStr = NULL; // must release
5888 IOEventLink * eventLink = NULL; // do not release
5889 kern_return_t ret;
5890
5891 ret = copyinstr(userObjectName, &eventlinkName[0], sizeof(eventlinkName), &eventLinkNameLen);
5892 if (ret != kIOReturnSuccess) {
5893 goto finish;
5894 }
5895
5896 // ensure string length matches trap argument
5897 if (eventLinkNameLen != (size_t)p2 + 1) {
5898 ret = kIOReturnBadArgument;
5899 goto finish;
5900 }
5901
5902 eventlinkNameStr = OSString::withCStringNoCopy(eventlinkName);
5903 if (eventlinkNameStr == NULL) {
5904 ret = kIOReturnNoMemory;
5905 goto finish;
5906 }
5907
5908 IOLockLock(fLock);
5909 eventLink = OSDynamicCast(IOEventLink, fEventLinks->getObject(eventlinkNameStr));
5910 if (eventLink) {
5911 eventLink->retain();
5912 }
5913 IOLockUnlock(fLock);
5914
5915 if (eventLink == NULL) {
5916 ret = kIOReturnNotFound;
5917 goto finish;
5918 }
5919
5920 port = iokit_lookup_raw_current_task(portName, &portType);
5921
5922 if (port == NULL) {
5923 ret = kIOReturnNotFound;
5924 goto finish;
5925 }
5926
5927 if (portType != IKOT_EVENTLINK) {
5928 ret = kIOReturnBadArgument;
5929 goto finish;
5930 }
5931
5932 ret = eventLink->SetEventlinkPort(port);
5933 if (ret != kIOReturnSuccess) {
5934 if (kIODKLogSetup & gIODKDebug) {
5935 DKLOG(DKS " %s SetEventlinkPort() returned %x\n", DKN(this), eventlinkNameStr->getCStringNoCopy(), ret);
5936 }
5937 goto finish;
5938 }
5939
5940 finish:
5941 if (port != NULL) {
5942 iokit_release_port_send(port);
5943 }
5944
5945 OSSafeReleaseNULL(eventlinkNameStr);
5946 OSSafeReleaseNULL(eventLink);
5947
5948 return ret;
5949 }
5950
5951 kern_return_t
workgroupConfigurationTrap(void * p1,void * p2,void * p3,void * p4,void * p5,void * p6)5952 IOUserUserClient::workgroupConfigurationTrap(void * p1, void * p2, void * p3, void * p4, void * p5, void * p6)
5953 {
5954 user_addr_t userObjectName = (user_addr_t)p1;
5955 mach_port_name_t portName = (mach_port_name_t)(uintptr_t)p3;
5956 mach_port_t port = MACH_PORT_NULL;
5957 ipc_kobject_type_t portType;
5958 char workgroupName[kIOWorkGroupMaxNameLength + 1] = {0};
5959 size_t workgroupNameLen;
5960 OSString * workgroupNameStr = NULL; // must release
5961 IOWorkGroup * workgroup = NULL; // do not release
5962 kern_return_t ret;
5963
5964 ret = copyinstr(userObjectName, &workgroupName[0], sizeof(workgroupName), &workgroupNameLen);
5965 if (ret != kIOReturnSuccess) {
5966 goto finish;
5967 }
5968
5969 // ensure string length matches trap argument
5970 if (workgroupNameLen != (size_t)p2 + 1) {
5971 ret = kIOReturnBadArgument;
5972 goto finish;
5973 }
5974
5975 workgroupNameStr = OSString::withCStringNoCopy(workgroupName);
5976 if (workgroupNameStr == NULL) {
5977 ret = kIOReturnNoMemory;
5978 goto finish;
5979 }
5980
5981 IOLockLock(fLock);
5982 workgroup = OSDynamicCast(IOWorkGroup, fWorkGroups->getObject(workgroupNameStr));
5983 if (workgroup) {
5984 workgroup->retain();
5985 }
5986 IOLockUnlock(fLock);
5987
5988 if (workgroup == NULL) {
5989 ret = kIOReturnNotFound;
5990 goto finish;
5991 }
5992
5993 port = iokit_lookup_raw_current_task(portName, &portType);
5994
5995 if (port == NULL) {
5996 ret = kIOReturnNotFound;
5997 goto finish;
5998 }
5999
6000 if (portType != IKOT_WORK_INTERVAL) {
6001 ret = kIOReturnBadArgument;
6002 goto finish;
6003 }
6004
6005 ret = workgroup->SetWorkGroupPort(port);
6006 if (ret != kIOReturnSuccess) {
6007 if (kIODKLogSetup & gIODKDebug) {
6008 DKLOG(DKS " %s SetWorkGroupPort() returned %x\n", DKN(this), workgroupNameStr->getCStringNoCopy(), ret);
6009 }
6010 goto finish;
6011 }
6012
6013 finish:
6014
6015 if (port != NULL) {
6016 iokit_release_port_send(port);
6017 }
6018
6019 OSSafeReleaseNULL(workgroupNameStr);
6020 OSSafeReleaseNULL(workgroup);
6021
6022 return ret;
6023 }
6024
6025 IOExternalTrap *
getTargetAndTrapForIndex(IOService ** targetP,UInt32 index)6026 IOUserUserClient::getTargetAndTrapForIndex( IOService **targetP, UInt32 index )
6027 {
6028 static const OSBoundedArray<IOExternalTrap, 2> trapTemplate = {{
6029 { NULL, (IOTrap) & IOUserUserClient::eventlinkConfigurationTrap},
6030 { NULL, (IOTrap) & IOUserUserClient::workgroupConfigurationTrap},
6031 }};
6032 if (index >= trapTemplate.size()) {
6033 return NULL;
6034 }
6035 *targetP = this;
6036 return (IOExternalTrap *)&trapTemplate[index];
6037 }
6038
6039 kern_return_t
CopyClientEntitlements_Impl(OSDictionary ** entitlements)6040 IOUserClient::CopyClientEntitlements_Impl(OSDictionary ** entitlements)
6041 {
6042 return kIOReturnUnsupported;
6043 };
6044
6045 struct IOUserUserClientActionRef {
6046 OSAsyncReference64 asyncRef;
6047 };
6048
6049 void
KernelCompletion_Impl(OSAction * action,IOReturn status,const unsigned long long * asyncData,uint32_t asyncDataCount)6050 IOUserClient::KernelCompletion_Impl(
6051 OSAction * action,
6052 IOReturn status,
6053 const unsigned long long * asyncData,
6054 uint32_t asyncDataCount)
6055 {
6056 IOUserUserClientActionRef * ref;
6057
6058 ref = (typeof(ref))action->GetReference();
6059
6060 IOUserClient::sendAsyncResult64(ref->asyncRef, status, (io_user_reference_t *) asyncData, asyncDataCount);
6061 }
6062
6063 kern_return_t
_ExternalMethod_Impl(uint64_t selector,const unsigned long long * scalarInput,uint32_t scalarInputCount,OSData * structureInput,IOMemoryDescriptor * structureInputDescriptor,unsigned long long * scalarOutput,uint32_t * scalarOutputCount,uint64_t structureOutputMaximumSize,OSData ** structureOutput,IOMemoryDescriptor * structureOutputDescriptor,OSAction * completion)6064 IOUserClient::_ExternalMethod_Impl(
6065 uint64_t selector,
6066 const unsigned long long * scalarInput,
6067 uint32_t scalarInputCount,
6068 OSData * structureInput,
6069 IOMemoryDescriptor * structureInputDescriptor,
6070 unsigned long long * scalarOutput,
6071 uint32_t * scalarOutputCount,
6072 uint64_t structureOutputMaximumSize,
6073 OSData ** structureOutput,
6074 IOMemoryDescriptor * structureOutputDescriptor,
6075 OSAction * completion)
6076 {
6077 return kIOReturnUnsupported;
6078 }
6079
6080 IOReturn
clientMemoryForType(UInt32 type,IOOptionBits * koptions,IOMemoryDescriptor ** kmemory)6081 IOUserUserClient::clientMemoryForType(UInt32 type,
6082 IOOptionBits * koptions,
6083 IOMemoryDescriptor ** kmemory)
6084 {
6085 IOReturn kr;
6086 uint64_t options;
6087 IOMemoryDescriptor * memory;
6088
6089 kr = CopyClientMemoryForType(type, &options, &memory);
6090
6091 *koptions = 0;
6092 *kmemory = NULL;
6093 if (kIOReturnSuccess != kr) {
6094 return kr;
6095 }
6096
6097 if (kIOUserClientMemoryReadOnly & options) {
6098 *koptions |= kIOMapReadOnly;
6099 }
6100 *kmemory = memory;
6101
6102 return kr;
6103 }
6104
6105 IOReturn
externalMethod(uint32_t selector,IOExternalMethodArguments * args,IOExternalMethodDispatch * dispatch,OSObject * target,void * reference)6106 IOUserUserClient::externalMethod(uint32_t selector, IOExternalMethodArguments * args,
6107 IOExternalMethodDispatch * dispatch, OSObject * target, void * reference)
6108 {
6109 IOReturn kr;
6110 OSData * structureInput;
6111 OSData * structureOutput;
6112 size_t copylen;
6113 uint64_t structureOutputSize;
6114 OSAction * action;
6115 IOUserUserClientActionRef * ref;
6116 mach_port_t wake_port = MACH_PORT_NULL;
6117
6118 kr = kIOReturnUnsupported;
6119 structureInput = NULL;
6120 action = NULL;
6121 ref = NULL;
6122
6123 if (args->structureInputSize) {
6124 structureInput = OSData::withBytesNoCopy((void *) args->structureInput, args->structureInputSize);
6125 }
6126
6127 if (MACH_PORT_NULL != args->asyncWakePort) {
6128 // this retain is for the OSAction to release
6129 wake_port = ipc_port_make_send_mqueue(args->asyncWakePort);
6130 kr = CreateActionKernelCompletion(sizeof(IOUserUserClientActionRef), &action);
6131 assert(KERN_SUCCESS == kr);
6132 ref = (typeof(ref))action->GetReference();
6133 bcopy(args->asyncReference, &ref->asyncRef[0], args->asyncReferenceCount * sizeof(ref->asyncRef[0]));
6134 kr = action->SetAbortedHandler(^(void) {
6135 IOUserUserClientActionRef * ref;
6136 IOReturn ret;
6137
6138 ref = (typeof(ref))action->GetReference();
6139 ret = releaseAsyncReference64(ref->asyncRef);
6140 assert(kIOReturnSuccess == ret);
6141 bzero(&ref->asyncRef[0], sizeof(ref->asyncRef));
6142 });
6143 assert(KERN_SUCCESS == kr);
6144 }
6145
6146 if (args->structureVariableOutputData) {
6147 structureOutputSize = kIOUserClientVariableStructureSize;
6148 } else if (args->structureOutputDescriptor) {
6149 structureOutputSize = args->structureOutputDescriptor->getLength();
6150 } else {
6151 structureOutputSize = args->structureOutputSize;
6152 }
6153
6154 kr = _ExternalMethod(selector, &args->scalarInput[0], args->scalarInputCount,
6155 structureInput, args->structureInputDescriptor,
6156 args->scalarOutput, &args->scalarOutputCount,
6157 structureOutputSize, &structureOutput, args->structureOutputDescriptor,
6158 action);
6159
6160 OSSafeReleaseNULL(structureInput);
6161 OSSafeReleaseNULL(action);
6162
6163 if (kr == kIOReturnSuccess && structureOutput) {
6164 if (args->structureVariableOutputData) {
6165 *args->structureVariableOutputData = structureOutput;
6166 } else {
6167 copylen = structureOutput->getLength();
6168 if (copylen > args->structureOutputSize) {
6169 kr = kIOReturnBadArgument;
6170 } else {
6171 bcopy((const void *) structureOutput->getBytesNoCopy(), args->structureOutput, copylen);
6172 args->structureOutputSize = (uint32_t) copylen;
6173 }
6174 OSSafeReleaseNULL(structureOutput);
6175 }
6176 }
6177
6178 if (kIOReturnSuccess != kr) {
6179 // mig will destroy any async port
6180 return kr;
6181 }
6182
6183 // We must never return error after this point in order to preserve MIG ownership semantics
6184 assert(kr == kIOReturnSuccess);
6185 if (MACH_PORT_NULL != wake_port) {
6186 // this release is for the mig created send right
6187 iokit_release_port_send(wake_port);
6188 }
6189
6190 return kr;
6191 }
6192
6193 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
6194
6195 extern IORecursiveLock * gDriverKitLaunchLock;
6196 extern OSSet * gDriverKitLaunches;
6197
6198 _IOUserServerCheckInCancellationHandler *
setCancellationHandler(IOUserServerCheckInCancellationHandler handler,void * handlerArgs)6199 IOUserServerCheckInToken::setCancellationHandler(IOUserServerCheckInCancellationHandler handler,
6200 void* handlerArgs)
6201 {
6202 _IOUserServerCheckInCancellationHandler * handlerObj = _IOUserServerCheckInCancellationHandler::withHandler(handler, handlerArgs);
6203 if (!handlerObj) {
6204 goto finish;
6205 }
6206
6207 IORecursiveLockLock(gDriverKitLaunchLock);
6208
6209 assert(fState != kIOUserServerCheckInComplete);
6210
6211 if (fState == kIOUserServerCheckInCanceled) {
6212 // Send cancel notification if we set the handler after this was canceled
6213 handlerObj->call(this);
6214 } else if (fState == kIOUserServerCheckInPending) {
6215 fHandlers->setObject(handlerObj);
6216 }
6217
6218 IORecursiveLockUnlock(gDriverKitLaunchLock);
6219
6220 finish:
6221 return handlerObj;
6222 }
6223
6224 void
removeCancellationHandler(_IOUserServerCheckInCancellationHandler * handler)6225 IOUserServerCheckInToken::removeCancellationHandler(_IOUserServerCheckInCancellationHandler * handler)
6226 {
6227 IORecursiveLockLock(gDriverKitLaunchLock);
6228
6229 fHandlers->removeObject(handler);
6230
6231 IORecursiveLockUnlock(gDriverKitLaunchLock);
6232 }
6233
6234 void
cancel()6235 IOUserServerCheckInToken::cancel()
6236 {
6237 IORecursiveLockLock(gDriverKitLaunchLock);
6238
6239 if (fState == kIOUserServerCheckInPending) {
6240 fState = kIOUserServerCheckInCanceled;
6241 if (gDriverKitLaunches != NULL) {
6242 // Remove pending launch from list, if we have not shut down yet.
6243 gDriverKitLaunches->removeObject(this);
6244 }
6245
6246 fHandlers->iterateObjects(^bool (OSObject * obj){
6247 _IOUserServerCheckInCancellationHandler * handlerObj = OSDynamicCast(_IOUserServerCheckInCancellationHandler, obj);
6248 if (handlerObj) {
6249 handlerObj->call(this);
6250 }
6251 return false;
6252 });
6253 fHandlers->flushCollection();
6254 }
6255
6256 IORecursiveLockUnlock(gDriverKitLaunchLock);
6257 }
6258
6259 void
complete()6260 IOUserServerCheckInToken::complete()
6261 {
6262 IORecursiveLockLock(gDriverKitLaunchLock);
6263
6264 if (fState == kIOUserServerCheckInPending && --fPendingCount == 0) {
6265 fState = kIOUserServerCheckInComplete;
6266 if (gDriverKitLaunches != NULL) {
6267 // Remove pending launch from list, if we have not shut down yet.
6268 gDriverKitLaunches->removeObject(this);
6269 }
6270
6271 // No need to hold on to the cancellation handlers
6272 fHandlers->flushCollection();
6273 }
6274
6275 IORecursiveLockUnlock(gDriverKitLaunchLock);
6276 }
6277
6278 bool
init(const OSSymbol * serverName,OSNumber * serverTag,OSKext * driverKext,OSData * serverDUI)6279 IOUserServerCheckInToken::init(const OSSymbol * serverName, OSNumber * serverTag, OSKext *driverKext, OSData *serverDUI)
6280 {
6281 if (!OSObject::init()) {
6282 return false;
6283 }
6284
6285 if (!serverName) {
6286 return false;
6287 }
6288 fServerName = serverName;
6289 fServerName->retain();
6290
6291 if (!serverTag) {
6292 return false;
6293 }
6294 fServerTag = serverTag;
6295 fServerTag->retain();
6296
6297 fHandlers = OSSet::withCapacity(0);
6298 if (!fHandlers) {
6299 return false;
6300 }
6301
6302 fState = kIOUserServerCheckInPending;
6303 fPendingCount = 1;
6304
6305 fKextBundleID = NULL;
6306 fNeedDextDec = false;
6307
6308 fExecutableName = NULL;
6309
6310 if (driverKext) {
6311 fExecutableName = OSDynamicCast(OSSymbol, driverKext->getBundleExecutable());
6312
6313 if (fExecutableName) {
6314 fExecutableName->retain();
6315 }
6316
6317 /*
6318 * We need to keep track of how many dexts we have started.
6319 * For every new dext we are going to create a new token, and
6320 * we consider the token creation as the initial step to
6321 * create a dext as it is the data structure that will back up
6322 * the userspace dance to start a dext.
6323 * We later have to decrement only once per token.
6324 * If no error occurs we consider the finalize() call on IOUserServer
6325 * as the moment in which we do not consider the dext "alive" anymore;
6326 * however in case of errors we will still need to decrement the count
6327 * otherwise upgrades of the dext will never make progress.
6328 */
6329 if (OSKext::incrementDextLaunchCount(driverKext, serverDUI)) {
6330 /*
6331 * If fKext holds a pointer,
6332 * it is the indication that a decrements needs
6333 * to be called.
6334 */
6335 fNeedDextDec = true;
6336 fKextBundleID = OSDynamicCast(OSString, driverKext->getIdentifier());
6337 fKextBundleID->retain();
6338 } else {
6339 return false;
6340 }
6341 }
6342
6343 return true;
6344 }
6345
6346 /*
6347 * Returns if the dext can be re-used
6348 * for matching.
6349 */
6350 bool
dextTerminate(void)6351 IOUserServerCheckInToken::dextTerminate(void)
6352 {
6353 bool ret = true;
6354
6355 if (fNeedDextDec == true) {
6356 /*
6357 * We can decrement DextLaunchCount only
6358 * once per token.
6359 */
6360 ret = !(OSKext::decrementDextLaunchCount(fKextBundleID));
6361 fNeedDextDec = false;
6362 }
6363
6364 return ret;
6365 }
6366
6367 void
free()6368 IOUserServerCheckInToken::free()
6369 {
6370 OSSafeReleaseNULL(fServerName);
6371 OSSafeReleaseNULL(fServerTag);
6372 OSSafeReleaseNULL(fExecutableName);
6373 OSSafeReleaseNULL(fHandlers);
6374 if (fKextBundleID != NULL) {
6375 dextTerminate();
6376 OSSafeReleaseNULL(fKextBundleID);
6377 }
6378
6379 OSObject::free();
6380 }
6381
6382 const OSSymbol *
copyServerName() const6383 IOUserServerCheckInToken::copyServerName() const
6384 {
6385 fServerName->retain();
6386 return fServerName;
6387 }
6388
6389 OSNumber *
copyServerTag() const6390 IOUserServerCheckInToken::copyServerTag() const
6391 {
6392 fServerTag->retain();
6393 return fServerTag;
6394 }
6395
6396 IOUserServer *
launchUserServer(OSString * bundleID,const OSSymbol * serverName,OSNumber * serverTag,bool reuseIfExists,IOUserServerCheckInToken ** resultToken,OSData * serverDUI)6397 IOUserServer::launchUserServer(OSString * bundleID, const OSSymbol * serverName, OSNumber * serverTag, bool reuseIfExists, IOUserServerCheckInToken ** resultToken, OSData *serverDUI)
6398 {
6399 IOUserServer *me = NULL;
6400 IOUserServerCheckInToken * token = NULL;
6401 OSDictionary * matching = NULL; // must release
6402 OSKext * driverKext = NULL; // must release
6403 OSDextStatistics * driverStatistics = NULL; // must release
6404 bool reslide = false;
6405
6406 /* TODO: Check we are looking for same dextID
6407 * and if it is not the same
6408 * restart the matching process.
6409 */
6410 driverKext = OSKext::lookupDextWithIdentifier(bundleID, serverDUI);
6411 if (driverKext != NULL) {
6412 driverStatistics = driverKext->copyDextStatistics();
6413 if (driverStatistics == NULL) {
6414 panic("Kext %s was not a DriverKit OSKext", bundleID->getCStringNoCopy());
6415 }
6416 IOLog("Driver %s has crashed %zu time(s)\n", bundleID->getCStringNoCopy(), driverStatistics->getCrashCount());
6417 reslide = driverStatistics->getCrashCount() > 0;
6418 } else {
6419 DKLOG("Could not find OSKext for %s\n", bundleID->getCStringNoCopy());
6420 *resultToken = NULL;
6421 return NULL;
6422 }
6423
6424 IORecursiveLockLock(gDriverKitLaunchLock);
6425
6426 if (gDriverKitLaunches == NULL) {
6427 // About to shut down, don't launch anything
6428 goto finish;
6429 }
6430
6431 if (reuseIfExists) {
6432 const char * serverNameCStr;
6433 const char * bundleIDCStr;
6434 const char * endOrgCStr;
6435
6436 serverNameCStr = serverName->getCStringNoCopy();
6437 bundleIDCStr = bundleID->getCStringNoCopy();
6438 (endOrgCStr = strchr(bundleIDCStr, '.')) && (endOrgCStr = strchr(endOrgCStr + 1, '.'));
6439 reuseIfExists = endOrgCStr && (0 == strncmp(bundleIDCStr, serverNameCStr, endOrgCStr + 1 - bundleIDCStr));
6440 if (!reuseIfExists) {
6441 IOLog(kIOUserServerNameKey " \"%s\" not correct organization for bundleID \"%s\"\n", serverNameCStr, bundleIDCStr);
6442 }
6443 }
6444
6445 // Find existing server
6446 if (reuseIfExists) {
6447 token = IOUserServerCheckInToken::findExistingToken(serverName);
6448 if (token) {
6449 // Launch in progress, return token
6450 goto finish;
6451 } else {
6452 // Check if launch completed
6453 matching = IOService::serviceMatching(gIOUserServerClassKey);
6454 if (!matching) {
6455 goto finish;
6456 }
6457 IOService::propertyMatching(gIOUserServerNameKey, serverName, matching);
6458 IOService * service = IOService::copyMatchingService(matching);
6459 IOUserServer * userServer = OSDynamicCast(IOUserServer, service);
6460 if (userServer) {
6461 // found existing user server
6462 me = userServer;
6463 goto finish;
6464 } else {
6465 OSSafeReleaseNULL(service);
6466 }
6467 }
6468 }
6469
6470 // No existing server, request launch
6471 token = new IOUserServerCheckInToken;
6472 if (!token) {
6473 goto finish;
6474 }
6475
6476 /*
6477 * TODO: If the init fails because the personalities are not up to date
6478 * restart the whole matching process.
6479 */
6480 if (token && !token->init(serverName, serverTag, driverKext, serverDUI)) {
6481 IOLog("Could not initialize token\n");
6482 OSSafeReleaseNULL(token);
6483 goto finish;
6484 }
6485
6486 /*
6487 * If the launch fails at any point terminate() will
6488 * be called on this IOUserServer.
6489 */
6490 gDriverKitLaunches->setObject(token);
6491 OSKext::requestDaemonLaunch(bundleID, (OSString *)serverName, serverTag, reslide ? kOSBooleanTrue : kOSBooleanFalse, token, serverDUI);
6492
6493 finish:
6494 IORecursiveLockUnlock(gDriverKitLaunchLock);
6495 OSSafeReleaseNULL(matching);
6496 OSSafeReleaseNULL(driverStatistics);
6497 OSSafeReleaseNULL(driverKext);
6498
6499 if (resultToken) {
6500 *resultToken = token;
6501 } else {
6502 OSSafeReleaseNULL(token);
6503 }
6504
6505 return me;
6506 }
6507
6508 /*
6509 * IOUserServerCheckInTokens are used to track dext launches. They have three possible states:
6510 *
6511 * - Pending: A dext launch is pending
6512 * - Canceled: Dext launch failed
6513 * - Complete: Dext launch is complete
6514 *
6515 * A token can be shared among multiple IOServices that are waiting for dexts if the IOUserServerName
6516 * is the same. This allows dexts to be reused and host multiple services. All pending tokens are stored
6517 * in gDriverKitLaunches and we check here before creating a new token when launching a dext.
6518 *
6519 * A token starts in the pending state with a pending count of 1. When we reuse a token, we increase the
6520 * pending count of the token.
6521 *
6522 * The token is sent to userspace as a mach port through kernelmanagerd/driverkitd to the dext. The dext then
6523 * uses that token to check in to the kernel. If any part of the dext launch failed (dext crashed, kmd crashed, etc.)
6524 * we get a no-senders notification for the token in the kernel and the token goes into the Canceled state.
6525 *
6526 * Once the dext checks in to the kernel, we decrement the pending count for the token. When the pending count reaches
6527 * 0, the token goes into the Complete state. So if the token is in the Complete state, there are no kernel matching threads
6528 * waiting on the dext to check in.
6529 */
6530
6531 IOUserServerCheckInToken *
findExistingToken(const OSSymbol * serverName)6532 IOUserServerCheckInToken::findExistingToken(const OSSymbol * serverName)
6533 {
6534 IOUserServerCheckInToken * __block result = NULL;
6535
6536 IORecursiveLockLock(gDriverKitLaunchLock);
6537 if (gDriverKitLaunches == NULL) {
6538 goto finish;
6539 }
6540
6541 gDriverKitLaunches->iterateObjects(^(OSObject * obj) {
6542 IOUserServerCheckInToken * token = OSDynamicCast(IOUserServerCheckInToken, obj);
6543 if (token) {
6544 // Check if server name matches
6545 const OSSymbol * tokenServerName = token->fServerName;
6546 if (tokenServerName->isEqualTo(serverName)) {
6547 assert(token->fState == kIOUserServerCheckInPending);
6548 token->fPendingCount++;
6549 result = token;
6550 result->retain();
6551 }
6552 }
6553 return result != NULL;
6554 });
6555
6556 finish:
6557 IORecursiveLockUnlock(gDriverKitLaunchLock);
6558 return result;
6559 }
6560
6561 void
cancelAll()6562 IOUserServerCheckInToken::cancelAll()
6563 {
6564 OSSet * tokensToCancel;
6565
6566 IORecursiveLockLock(gDriverKitLaunchLock);
6567 tokensToCancel = gDriverKitLaunches;
6568 gDriverKitLaunches = NULL;
6569
6570
6571 tokensToCancel->iterateObjects(^(OSObject *obj) {
6572 IOUserServerCheckInToken * token = OSDynamicCast(IOUserServerCheckInToken, obj);
6573 if (token) {
6574 token->cancel();
6575 }
6576 return false;
6577 });
6578
6579 IORecursiveLockUnlock(gDriverKitLaunchLock);
6580
6581 OSSafeReleaseNULL(tokensToCancel);
6582 }
6583
6584 void
call(IOUserServerCheckInToken * token)6585 _IOUserServerCheckInCancellationHandler::call(IOUserServerCheckInToken * token)
6586 {
6587 fHandler(token, fHandlerArgs);
6588 }
6589
6590 _IOUserServerCheckInCancellationHandler *
withHandler(IOUserServerCheckInCancellationHandler handler,void * args)6591 _IOUserServerCheckInCancellationHandler::withHandler(IOUserServerCheckInCancellationHandler handler, void * args)
6592 {
6593 _IOUserServerCheckInCancellationHandler * handlerObj = NULL;
6594 if (!handler) {
6595 goto finish;
6596 }
6597
6598 handlerObj = new _IOUserServerCheckInCancellationHandler;
6599 if (!handlerObj) {
6600 goto finish;
6601 }
6602
6603 handlerObj->fHandler = handler;
6604 handlerObj->fHandlerArgs = args;
6605
6606 finish:
6607 return handlerObj;
6608 }
6609
6610 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
6611
6612 struct IOServiceStateNotificationDispatchSource_IVars {
6613 IOLock * fLock;
6614 IOService * fStateNotification;
6615 IOStateNotificationListenerRef fListener;
6616 OSAction * fAction;
6617 bool fEnable;
6618 bool fArmed;
6619 };
6620
6621 kern_return_t
Create_Impl(IOService * service,OSArray * items,IODispatchQueue * queue,IOServiceStateNotificationDispatchSource ** outSource)6622 IOServiceStateNotificationDispatchSource::Create_Impl(IOService * service, OSArray * items,
6623 IODispatchQueue * queue, IOServiceStateNotificationDispatchSource ** outSource)
6624 {
6625 kern_return_t kr;
6626 IOServiceStateNotificationDispatchSource * source;
6627
6628 source = OSTypeAlloc(IOServiceStateNotificationDispatchSource);
6629 source->init();
6630
6631 source->ivars->fStateNotification = service;
6632 kr = service->stateNotificationListenerAdd(items, &source->ivars->fListener, ^kern_return_t () {
6633 OSAction * action;
6634
6635 action = NULL;
6636 IOLockLock(source->ivars->fLock);
6637 if (source->ivars->fArmed && source->ivars->fAction) {
6638 source->ivars->fArmed = false;
6639 action = source->ivars->fAction;
6640 action->retain();
6641 }
6642 IOLockUnlock(source->ivars->fLock);
6643 if (action) {
6644 source->StateNotificationReady(action);
6645 OSSafeReleaseNULL(action);
6646 }
6647 return kIOReturnSuccess;
6648 });
6649
6650 if (kIOReturnSuccess != kr) {
6651 OSSafeReleaseNULL(source);
6652 }
6653 *outSource = source;
6654
6655 return kr;
6656 }
6657
6658
6659 bool
init()6660 IOServiceStateNotificationDispatchSource::init()
6661 {
6662 if (!IODispatchSource::init()) {
6663 return false;
6664 }
6665 ivars = IOMallocType(IOServiceStateNotificationDispatchSource_IVars);
6666 if (!ivars) {
6667 return false;
6668 }
6669 ivars->fLock = IOLockAlloc();
6670 if (!ivars->fLock) {
6671 return false;
6672 }
6673 ivars->fArmed = true;
6674
6675 return true;
6676 }
6677
6678 void
free()6679 IOServiceStateNotificationDispatchSource::free()
6680 {
6681 if (ivars) {
6682 if (ivars->fListener) {
6683 ivars->fStateNotification->stateNotificationListenerRemove(ivars->fListener);
6684 }
6685 if (ivars->fLock) {
6686 IOLockFree(ivars->fLock);
6687 }
6688 IOFreeType(ivars, IOServiceStateNotificationDispatchSource_IVars);
6689 }
6690 IODispatchSource::free();
6691 }
6692
6693 kern_return_t
SetHandler_Impl(OSAction * action)6694 IOServiceStateNotificationDispatchSource::SetHandler_Impl(OSAction * action)
6695 {
6696 IOReturn ret;
6697 bool notifyReady;
6698
6699 notifyReady = false;
6700
6701 IOLockLock(ivars->fLock);
6702 action->retain();
6703 OSSafeReleaseNULL(ivars->fAction);
6704 ivars->fAction = action;
6705 if (action) {
6706 notifyReady = true;
6707 }
6708 IOLockUnlock(ivars->fLock);
6709
6710 if (notifyReady) {
6711 StateNotificationReady(action);
6712 }
6713 ret = kIOReturnSuccess;
6714
6715 return ret;
6716 }
6717
6718 kern_return_t
SetEnableWithCompletion_Impl(bool enable,IODispatchSourceCancelHandler handler)6719 IOServiceStateNotificationDispatchSource::SetEnableWithCompletion_Impl(
6720 bool enable,
6721 IODispatchSourceCancelHandler handler)
6722 {
6723 if (enable == ivars->fEnable) {
6724 return kIOReturnSuccess;
6725 }
6726
6727 IOLockLock(ivars->fLock);
6728 ivars->fEnable = enable;
6729 IOLockUnlock(ivars->fLock);
6730
6731 return kIOReturnSuccess;
6732 }
6733
6734 kern_return_t
Cancel_Impl(IODispatchSourceCancelHandler handler)6735 IOServiceStateNotificationDispatchSource::Cancel_Impl(
6736 IODispatchSourceCancelHandler handler)
6737 {
6738 return kIOReturnUnsupported;
6739 }
6740
6741 kern_return_t
StateNotificationBegin_Impl(void)6742 IOServiceStateNotificationDispatchSource::StateNotificationBegin_Impl(void)
6743 {
6744 IOLockLock(ivars->fLock);
6745 ivars->fArmed = true;
6746 IOLockUnlock(ivars->fLock);
6747
6748 return kIOReturnSuccess;
6749 }
6750
6751 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
6752
6753 #include <IOKit/IOServiceStateNotificationEventSource.h>
6754
6755 OSDefineMetaClassAndStructors(IOServiceStateNotificationEventSource, IOEventSource)
6756 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 0);
6757 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 1);
6758 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 2);
6759 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 3);
6760 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 4);
6761 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 5);
6762 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 6);
6763 OSMetaClassDefineReservedUnused(IOServiceStateNotificationEventSource, 7);
6764
6765 OSPtr<IOServiceStateNotificationEventSource>
serviceStateNotificationEventSource(IOService * service,OSArray * items,ActionBlock inAction)6766 IOServiceStateNotificationEventSource::serviceStateNotificationEventSource(IOService *service,
6767 OSArray * items,
6768 ActionBlock inAction)
6769 {
6770 kern_return_t kr;
6771 IOServiceStateNotificationEventSource * source;
6772
6773 source = OSTypeAlloc(IOServiceStateNotificationEventSource);
6774 if (source && !source->init(service, NULL)) {
6775 OSSafeReleaseNULL(source);
6776 }
6777
6778 if (!source) {
6779 return nullptr;
6780 }
6781
6782 source->fStateNotification = service;
6783 kr = service->stateNotificationListenerAdd(items, &source->fListener, ^kern_return_t () {
6784 if (!source->workLoop) {
6785 return kIOReturnSuccess;
6786 }
6787 source->workLoop->runActionBlock(^IOReturn (void) {
6788 source->fArmed = true;
6789 return kIOReturnSuccess;
6790 });
6791 source->signalWorkAvailable();
6792 return kIOReturnSuccess;
6793 });
6794
6795 if (kIOReturnSuccess != kr) {
6796 OSSafeReleaseNULL(source);
6797 }
6798
6799 if (source) {
6800 source->setActionBlock((IOEventSource::ActionBlock) inAction);
6801 }
6802
6803 return source;
6804 }
6805
6806 void
free()6807 IOServiceStateNotificationEventSource::free()
6808 {
6809 if (fListener) {
6810 fStateNotification->stateNotificationListenerRemove(fListener);
6811 }
6812 IOEventSource::free();
6813 }
6814
6815 void
enable()6816 IOServiceStateNotificationEventSource::enable()
6817 {
6818 fEnable = true;
6819 }
6820
6821 void
disable()6822 IOServiceStateNotificationEventSource::disable()
6823 {
6824 fEnable = false;
6825 }
6826
6827 void
setWorkLoop(IOWorkLoop * inWorkLoop)6828 IOServiceStateNotificationEventSource::setWorkLoop(IOWorkLoop *inWorkLoop)
6829 {
6830 IOEventSource::setWorkLoop(inWorkLoop);
6831 }
6832
6833 bool
checkForWork()6834 IOServiceStateNotificationEventSource::checkForWork()
6835 {
6836 ActionBlock intActionBlock = (ActionBlock) actionBlock;
6837
6838 if (fArmed) {
6839 fArmed = false;
6840 (intActionBlock)();
6841 }
6842
6843 return false;
6844 }
6845
6846 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
6847
6848 OSDefineMetaClassAndStructors(IOSystemStateNotification, IOService);
6849
6850 class IOStateNotificationItem : public OSObject
6851 {
6852 OSDeclareDefaultStructors(IOStateNotificationItem);
6853
6854 public:
6855 virtual bool init() override;
6856
6857 OSDictionary * fSchema;
6858 OSDictionary * fValue;
6859 OSSet * fListeners;
6860 };
6861 OSDefineMetaClassAndStructors(IOStateNotificationItem, OSObject);
6862
6863
6864 class IOStateNotificationListener : public OSObject
6865 {
6866 OSDeclareDefaultStructors(IOStateNotificationListener);
6867
6868 public:
6869 virtual bool init() override;
6870 virtual void free() override;
6871
6872 IOStateNotificationHandler fHandler;
6873 };
6874 OSDefineMetaClassAndStructors(IOStateNotificationListener, OSObject);
6875
6876
6877 bool
init()6878 IOStateNotificationItem::init()
6879 {
6880 return OSObject::init();
6881 }
6882
6883 bool
init()6884 IOStateNotificationListener::init()
6885 {
6886 return OSObject::init();
6887 }
6888
6889 void
free()6890 IOStateNotificationListener::free()
6891 {
6892 if (fHandler) {
6893 Block_release(fHandler);
6894 }
6895 OSObject::free();
6896 }
6897
6898
6899 struct IOServiceStateChangeVars {
6900 IOLock * fLock;
6901 OSDictionary * fItems;
6902 };
6903
6904 IOService *
initialize(void)6905 IOSystemStateNotification::initialize(void)
6906 {
6907 IOSystemStateNotification * me;
6908 IOServiceStateChangeVars * vars;
6909
6910 me = OSTypeAlloc(IOSystemStateNotification);
6911 me->init();
6912 vars = IOMallocType(IOServiceStateChangeVars);
6913 me->reserved->svars = vars;
6914 vars->fLock = IOLockAlloc();
6915 vars->fItems = OSDictionary::withCapacity(16);
6916 {
6917 kern_return_t ret;
6918
6919 gIOSystemStateSleepDescriptionKey = (OSString *)OSSymbol::withCStringNoCopy(kIOSystemStateSleepDescriptionKey);
6920 gIOSystemStateSleepDescriptionHibernateStateKey = OSSymbol::withCStringNoCopy(kIOSystemStateSleepDescriptionHibernateStateKey);
6921 gIOSystemStateSleepDescriptionReasonKey = OSSymbol::withCStringNoCopy(kIOSystemStateSleepDescriptionReasonKey);
6922
6923 ret = me->StateNotificationItemCreate(gIOSystemStateSleepDescriptionKey, NULL);
6924 assert(kIOReturnSuccess == ret);
6925
6926 gIOSystemStateWakeDescriptionKey = (OSString *)OSSymbol::withCStringNoCopy(kIOSystemStateWakeDescriptionKey);
6927 gIOSystemStateWakeDescriptionWakeReasonKey = OSSymbol::withCStringNoCopy(kIOSystemStateWakeDescriptionWakeReasonKey);
6928
6929 ret = me->StateNotificationItemCreate(gIOSystemStateWakeDescriptionKey, NULL);
6930 assert(kIOReturnSuccess == ret);
6931
6932 gIOSystemStateHaltDescriptionKey = (OSString *)OSSymbol::withCStringNoCopy(kIOSystemStateHaltDescriptionKey);
6933 gIOSystemStateHaltDescriptionHaltStateKey = OSSymbol::withCStringNoCopy(kIOSystemStateHaltDescriptionHaltStateKey);
6934
6935 ret = me->StateNotificationItemCreate(gIOSystemStateHaltDescriptionKey, NULL);
6936 assert(kIOReturnSuccess == ret);
6937
6938 gIOSystemStatePowerSourceDescriptionKey = (OSString *)OSSymbol::withCStringNoCopy(kIOSystemStatePowerSourceDescriptionKey);
6939 gIOSystemStatePowerSourceDescriptionACAttachedKey = OSSymbol::withCStringNoCopy(kIOSystemStatePowerSourceDescriptionACAttachedKey);
6940
6941 ret = me->StateNotificationItemCreate(gIOSystemStatePowerSourceDescriptionKey, NULL);
6942 assert(kIOReturnSuccess == ret);
6943 }
6944
6945 return me;
6946 }
6947
6948 bool
serializeProperties(OSSerialize * s) const6949 IOSystemStateNotification::serializeProperties(OSSerialize * s) const
6950 {
6951 IOServiceStateChangeVars * ivars = reserved->svars;
6952
6953 bool ok;
6954 OSDictionary * result;
6955
6956 result = OSDictionary::withCapacity(16);
6957
6958 IOLockLock(ivars->fLock);
6959 ivars->fItems->iterateObjects(^bool (const OSSymbol * key, OSObject * object) {
6960 IOStateNotificationItem * item;
6961
6962 item = (typeof(item))object;
6963 if (!item->fValue) {
6964 return false;
6965 }
6966 result->setObject(key, item->fValue);
6967 return false;
6968 });
6969 IOLockUnlock(ivars->fLock);
6970
6971 ok = result->serialize(s);
6972 OSSafeReleaseNULL(result);
6973
6974 return ok;
6975 }
6976
6977 kern_return_t
setProperties(OSObject * properties)6978 IOSystemStateNotification::setProperties(OSObject * properties)
6979 {
6980 kern_return_t kr;
6981 OSDictionary * dict;
6982 OSDictionary * schema;
6983 OSDictionary * value;
6984 OSString * itemName;
6985
6986 dict = OSDynamicCast(OSDictionary, properties);
6987 if (!dict) {
6988 return kIOReturnBadArgument;
6989 }
6990
6991 if (!IOCurrentTaskHasEntitlement(kIOSystemStateEntitlement)) {
6992 return kIOReturnNotPermitted;
6993 }
6994
6995 if ((schema = OSDynamicCast(OSDictionary, dict->getObject(kIOStateNotificationItemCreateKey)))) {
6996 itemName = OSDynamicCast(OSString, schema->getObject(kIOStateNotificationNameKey));
6997 kr = StateNotificationItemCreate(itemName, schema);
6998 } else if ((value = OSDynamicCast(OSDictionary, dict->getObject(kIOStateNotificationItemSetKey)))) {
6999 itemName = OSDynamicCast(OSString, value->getObject(kIOStateNotificationNameKey));
7000 itemName->retain();
7001 value->removeObject(kIOStateNotificationNameKey);
7002 kr = StateNotificationItemSet(itemName, value);
7003 itemName->release();
7004 } else {
7005 kr = kIOReturnError;
7006 }
7007
7008 return kr;
7009 }
7010
7011 kern_return_t
CopySystemStateNotificationService_Impl(IOService ** outService)7012 IOService::CopySystemStateNotificationService_Impl(IOService ** outService)
7013 {
7014 IOService * service;
7015
7016 service = getSystemStateNotificationService();
7017 service->retain();
7018 *outService = service;
7019
7020 return kIOReturnSuccess;
7021 }
7022
7023 IOStateNotificationItem *
stateNotificationItemCopy(OSString * itemName,OSDictionary * schema)7024 IOService::stateNotificationItemCopy(OSString * itemName, OSDictionary * schema)
7025 {
7026 IOServiceStateChangeVars * ivars = reserved->svars;
7027
7028 const OSSymbol * name;
7029 IOStateNotificationItem * item;
7030
7031 name = OSSymbol::withString(itemName);
7032
7033 IOLockLock(ivars->fLock);
7034 if ((item = (typeof(item))ivars->fItems->getObject(name))) {
7035 item->retain();
7036 } else {
7037 item = OSTypeAlloc(IOStateNotificationItem);
7038 item->init();
7039 item->fListeners = OSSet::withCapacity(16);
7040
7041 if (schema) {
7042 schema->retain();
7043 } else {
7044 schema = OSDictionary::withCapacity(8);
7045 }
7046 schema->setObject(kIOStateNotificationNameKey, name);
7047 item->fSchema = schema;
7048 ivars->fItems->setObject(name, item);
7049 }
7050 IOLockUnlock(ivars->fLock);
7051
7052 OSSafeReleaseNULL(name);
7053
7054 return item;
7055 }
7056
7057 kern_return_t
StateNotificationItemCreate_Impl(OSString * itemName,OSDictionary * schema)7058 IOService::StateNotificationItemCreate_Impl(OSString * itemName, OSDictionary * schema)
7059 {
7060 IOStateNotificationItem * item;
7061
7062 item = stateNotificationItemCopy(itemName, schema);
7063 if (!item) {
7064 return kIOReturnNoMemory;
7065 }
7066 item->release();
7067
7068 return kIOReturnSuccess;
7069 }
7070
7071 kern_return_t
StateNotificationItemSet_Impl(OSString * itemName,OSDictionary * value)7072 IOService::StateNotificationItemSet_Impl(OSString * itemName, OSDictionary * value)
7073 {
7074 IOServiceStateChangeVars * ivars = reserved->svars;
7075
7076 OSSet * listeners;
7077 IOStateNotificationItem * item;
7078
7079 value->retain();
7080 IOLockLock(ivars->fLock);
7081 item = (typeof(item))ivars->fItems->getObject(itemName);
7082 OSSafeReleaseNULL(item->fValue);
7083 item->fValue = value;
7084 listeners = NULL;
7085 if (item->fListeners->getCount()) {
7086 listeners = OSSet::withSet(item->fListeners);
7087 }
7088 IOLockUnlock(ivars->fLock);
7089
7090 if (listeners) {
7091 listeners->iterateObjects(^bool (OSObject * object) {
7092 IOStateNotificationListener * listener;
7093
7094 listener = (typeof(listener))object;
7095 listener->fHandler();
7096 return false;
7097 });
7098 OSSafeReleaseNULL(listeners);
7099 }
7100
7101 return kIOReturnSuccess;
7102 }
7103
7104 kern_return_t
StateNotificationItemCopy_Impl(OSString * itemName,OSDictionary ** outValue)7105 IOService::StateNotificationItemCopy_Impl(OSString * itemName, OSDictionary ** outValue)
7106 {
7107 IOServiceStateChangeVars * ivars = reserved->svars;
7108
7109 kern_return_t ret;
7110 IOStateNotificationItem * item;
7111 OSDictionary * value;
7112
7113 IOLockLock(ivars->fLock);
7114 item = (typeof(item))ivars->fItems->getObject(itemName);
7115 if (item) {
7116 value = item->fValue;
7117 } else {
7118 value = NULL;
7119 }
7120 if (!value) {
7121 ret = kIOReturnNotFound;
7122 } else {
7123 value->retain();
7124 ret = kIOReturnSuccess;
7125 }
7126 IOLockUnlock(ivars->fLock);
7127
7128 *outValue = value;
7129
7130 return ret;
7131 }
7132
7133 kern_return_t
stateNotificationListenerAdd(OSArray * items,IOStateNotificationListenerRef * outRef,IOStateNotificationHandler handler)7134 IOService::stateNotificationListenerAdd(OSArray * items,
7135 IOStateNotificationListenerRef * outRef,
7136 IOStateNotificationHandler handler)
7137 {
7138 IOServiceStateChangeVars * ivars = reserved->svars;
7139
7140 kern_return_t kr __block;
7141 IOStateNotificationListener * listener;
7142
7143 listener = OSTypeAlloc(IOStateNotificationListener);
7144 listener->init();
7145 listener->fHandler = Block_copy(handler);
7146
7147 kr = kIOReturnSuccess;
7148 items->iterateObjects(^bool (OSObject * object) {
7149 OSString * itemName;
7150 IOStateNotificationItem * item;
7151
7152 itemName = OSDynamicCast(OSString, object);
7153 if (!itemName) {
7154 kr = kIOReturnBadArgument;
7155 return true;
7156 }
7157 item = stateNotificationItemCopy(itemName, NULL);
7158 if (!item) {
7159 kr = kIOReturnNoMemory;
7160 return true;
7161 }
7162 IOLockLock(ivars->fLock);
7163 item->fListeners->setObject(listener);
7164 IOLockUnlock(ivars->fLock);
7165 item->release();
7166 return false;
7167 });
7168
7169 if (kIOReturnSuccess != kr) {
7170 stateNotificationListenerRemove(listener);
7171 OSSafeReleaseNULL(listener);
7172 }
7173 *outRef = listener;
7174
7175 return kr;
7176 }
7177
7178
7179 kern_return_t
stateNotificationListenerRemove(IOStateNotificationListenerRef ref)7180 IOService::stateNotificationListenerRemove(IOStateNotificationListenerRef ref)
7181 {
7182 IOServiceStateChangeVars * ivars = reserved->svars;
7183
7184 IOStateNotificationListener * listener;
7185 kern_return_t kr;
7186
7187 kr = kIOReturnSuccess;
7188 listener = (typeof(listener))ref;
7189
7190 IOLockLock(ivars->fLock);
7191 ivars->fItems->iterateObjects(^bool (const OSSymbol * key, OSObject * object) {
7192 IOStateNotificationItem * item;
7193
7194 item = (typeof(item))object;
7195 item->fListeners->removeObject(listener);
7196 return false;
7197 });
7198 IOLockUnlock(ivars->fLock);
7199
7200 return kr;
7201 }
7202
7203
7204
7205 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
7206
7207 kern_return_t
Create_Impl(OSString * name,IOUserClient * userClient,IOWorkGroup ** workgroup)7208 IOWorkGroup::Create_Impl(OSString * name, IOUserClient * userClient, IOWorkGroup ** workgroup)
7209 {
7210 IOWorkGroup * inst = NULL;
7211 IOUserUserClient * uc = NULL;
7212 kern_return_t ret = kIOReturnError;
7213 IOUserServer * us;
7214
7215 if (name == NULL) {
7216 ret = kIOReturnBadArgument;
7217 goto finish;
7218 }
7219
7220 if (name->getLength() > kIOWorkGroupMaxNameLength) {
7221 ret = kIOReturnBadArgument;
7222 goto finish;
7223 }
7224
7225 uc = OSDynamicCast(IOUserUserClient, userClient);
7226 if (uc == NULL) {
7227 ret = kIOReturnBadArgument;
7228 goto finish;
7229 }
7230
7231 inst = OSTypeAlloc(IOWorkGroup);
7232 if (!inst->init()) {
7233 inst->free();
7234 inst = NULL;
7235 ret = kIOReturnNoMemory;
7236 goto finish;
7237 }
7238
7239 us = (typeof(us))thread_iokit_tls_get(0);
7240 inst->ivars->userServer = OSDynamicCast(IOUserServer, us);
7241
7242 if (inst->ivars->userServer == NULL) {
7243 ret = kIOReturnBadArgument;
7244 goto finish;
7245 }
7246 inst->ivars->userServer->retain();
7247
7248 inst->ivars->name = name;
7249 inst->ivars->name->retain();
7250
7251 inst->ivars->userClient = uc; // no retain
7252
7253 IOLockLock(uc->fLock);
7254 uc->fWorkGroups->setObject(name, inst);
7255 IOLockUnlock(uc->fLock);
7256 ret = kIOReturnSuccess;
7257
7258 finish:
7259 if (ret != kIOReturnSuccess) {
7260 OSSafeReleaseNULL(inst);
7261 } else {
7262 *workgroup = inst;
7263 }
7264
7265 return ret;
7266 }
7267
7268 kern_return_t
InvalidateKernel_Impl(IOUserClient * client)7269 IOWorkGroup::InvalidateKernel_Impl(IOUserClient * client)
7270 {
7271 IOUserUserClient * uc = OSDynamicCast(IOUserUserClient, client);
7272
7273 if (uc == NULL) {
7274 return kIOReturnBadArgument;
7275 }
7276
7277 if (uc != ivars->userClient) {
7278 return kIOReturnBadArgument;
7279 }
7280
7281 IOLockLock(uc->fLock);
7282 uc->fWorkGroups->removeObject(ivars->name);
7283 IOLockUnlock(uc->fLock);
7284
7285 return kIOReturnSuccess;
7286 }
7287
7288 kern_return_t
SetWorkGroupPort_Impl(mach_port_t port)7289 IOWorkGroup::SetWorkGroupPort_Impl(mach_port_t port)
7290 {
7291 return kIOReturnUnsupported;
7292 }
7293
7294 bool
init()7295 IOWorkGroup::init()
7296 {
7297 if (!OSObject::init()) {
7298 return false;
7299 }
7300 ivars = IOMallocType(IOWorkGroup_IVars);
7301
7302 return true;
7303 }
7304
7305 void
free()7306 IOWorkGroup::free()
7307 {
7308 if (ivars) {
7309 OSSafeReleaseNULL(ivars->userServer);
7310 OSSafeReleaseNULL(ivars->name);
7311 IOFreeType(ivars, IOWorkGroup_IVars);
7312 }
7313
7314 OSObject::free();
7315 }
7316
7317 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
7318
7319 kern_return_t
Create_Impl(OSString * name,IOUserClient * userClient,IOEventLink ** eventlink)7320 IOEventLink::Create_Impl(OSString * name, IOUserClient * userClient, IOEventLink ** eventlink)
7321 {
7322 IOEventLink * inst = NULL;
7323 IOUserUserClient * uc = NULL;
7324 IOUserServer * us;
7325 kern_return_t ret = kIOReturnError;
7326
7327 if (name == NULL) {
7328 ret = kIOReturnBadArgument;
7329 goto finish;
7330 }
7331
7332 if (name->getLength() > kIOEventLinkMaxNameLength) {
7333 ret = kIOReturnBadArgument;
7334 goto finish;
7335 }
7336
7337 uc = OSDynamicCast(IOUserUserClient, userClient);
7338 if (uc == NULL) {
7339 ret = kIOReturnBadArgument;
7340 goto finish;
7341 }
7342
7343 inst = OSTypeAlloc(IOEventLink);
7344 if (!inst->init()) {
7345 inst->free();
7346 inst = NULL;
7347 ret = kIOReturnNoMemory;
7348 goto finish;
7349 }
7350
7351 us = (typeof(us))thread_iokit_tls_get(0);
7352 inst->ivars->userServer = OSDynamicCast(IOUserServer, us);
7353
7354 if (inst->ivars->userServer == NULL) {
7355 ret = kIOReturnBadArgument;
7356 goto finish;
7357 }
7358 inst->ivars->userServer->retain();
7359
7360 inst->ivars->name = name;
7361 inst->ivars->name->retain();
7362
7363 inst->ivars->userClient = uc; // no retain
7364
7365 IOLockLock(uc->fLock);
7366 uc->fEventLinks->setObject(name, inst);
7367 IOLockUnlock(uc->fLock);
7368
7369 ret = kIOReturnSuccess;
7370
7371 finish:
7372 if (ret != kIOReturnSuccess) {
7373 OSSafeReleaseNULL(inst);
7374 } else {
7375 *eventlink = inst;
7376 }
7377
7378 return ret;
7379 }
7380
7381 kern_return_t
InvalidateKernel_Impl(IOUserClient * client)7382 IOEventLink::InvalidateKernel_Impl(IOUserClient * client)
7383 {
7384 IOUserUserClient * uc = OSDynamicCast(IOUserUserClient, client);
7385
7386 if (uc == NULL) {
7387 return kIOReturnBadArgument;
7388 }
7389
7390 if (uc != ivars->userClient) {
7391 return kIOReturnBadArgument;
7392 }
7393
7394 IOLockLock(uc->fLock);
7395 uc->fEventLinks->removeObject(ivars->name);
7396 IOLockUnlock(uc->fLock);
7397
7398 return kIOReturnSuccess;
7399 }
7400
7401 bool
init()7402 IOEventLink::init()
7403 {
7404 if (!OSObject::init()) {
7405 return false;
7406 }
7407 ivars = IOMallocType(IOEventLink_IVars);
7408
7409 return true;
7410 }
7411
7412 void
free()7413 IOEventLink::free()
7414 {
7415 if (ivars) {
7416 OSSafeReleaseNULL(ivars->userServer);
7417 OSSafeReleaseNULL(ivars->name);
7418 IOFreeType(ivars, IOEventLink_IVars);
7419 }
7420
7421 OSObject::free();
7422 }
7423
7424 kern_return_t
SetEventlinkPort_Impl(mach_port_t port __unused)7425 IOEventLink::SetEventlinkPort_Impl(mach_port_t port __unused)
7426 {
7427 return kIOReturnUnsupported;
7428 }
7429