Loading...
--- xnu/xnu-12377.121.6/iokit/Kernel/IONVRAM.cpp
+++ xnu/xnu-11417.121.6/iokit/Kernel/IONVRAM.cpp
@@ -53,10 +53,9 @@
#define MAX_VAR_NAME_SIZE 63
-#define kNVRAMBankSizeKey "nvram-bank-size"
-#define kNVRAMBankCountKey "nvram-bank-count"
-#define kNVRAMCurrentBankKey "nvram-current-bank"
-#define kNVRAMClearTestVarKey "clear-test-vars"
+#define kNVRAMBankSizeKey "nvram-bank-size"
+#define kNVRAMBankCountKey "nvram-bank-count"
+#define kNVRAMCurrentBankKey "nvram-current-bank"
#define kCurrentGenerationCountKey "Generation"
#define kCurrentNVRAMVersionKey "Version"
@@ -67,32 +66,17 @@
#define kIONVRAMPrivilege kIOClientPrivilegeAdministrator
#define MIN_SYNC_NOW_INTERVAL 15*60 /* Minimum 15 Minutes interval mandated */
-
-enum IONVRAMLogging {
- kIONVRAMNoLogs = 0,
- kIONVRAMInfoLogs = 1,
- kIONVRAMErrorLogs = 2,
- kIONVRAMDataHexDump = 4
-};
-
-#define IS_LOG_BIT_SET(level) ((gNVRAMLogging & (level)) != 0)
#if defined(DEBUG) || defined(DEVELOPMENT)
#define DEBUG_IFERROR(err, fmt, args...) \
({ \
- if ((err != kIOReturnSuccess) || IS_LOG_BIT_SET(kIONVRAMErrorLogs)) \
+ if ((err != kIOReturnSuccess) || gNVRAMLogging) \
IOLog("%s:%s:%u - " fmt, __FILE_NAME__, __FUNCTION__, __LINE__, ##args); \
})
-#define DEBUG_INFO_IF(log, fmt, args...) \
-({ \
- if ((log) && IS_LOG_BIT_SET(kIONVRAMInfoLogs)) \
- IOLog("%s:%s:%u - " fmt, __FILE_NAME__, __FUNCTION__, __LINE__, ##args); \
-})
-
#define DEBUG_INFO(fmt, args...) \
({ \
- if (IS_LOG_BIT_SET(kIONVRAMInfoLogs)) \
+ if (gNVRAMLogging) \
IOLog("%s:%s:%u - " fmt, __FILE_NAME__, __FUNCTION__, __LINE__, ##args); \
})
@@ -104,7 +88,6 @@
#define DEBUG_IFERROR(err, fmt, args...) (void)NULL
#define DEBUG_INFO(fmt, args...) (void)NULL
#define DEBUG_ALWAYS(fmt, args...) (void)NULL
-#define DEBUG_INFO_IF(fmt, args...) (void)NULL
#endif
#define DEBUG_ERROR DEBUG_ALWAYS
@@ -169,12 +152,12 @@
// RST = Reset, Obliterate
// RD = Read
// DEL = Delete
-#define OP_RD ((1 << kIONVRAMOperationRead))
-#define OP_RST ((1 << kIONVRAMOperationObliterate) | (1 << kIONVRAMOperationReset))
-#define OP_DEL ((1 << kIONVRAMOperationDelete))
-#define OP_MOD ((1 << kIONVRAMOperationWrite) | OP_DEL)
-#define OP_MOD_RD (OP_RD | OP_MOD)
-#define OP_MOD_RST (OP_MOD | OP_RST)
+#define ENT_MOD_RST ((1 << kIONVRAMOperationWrite) | (1 << kIONVRAMOperationDelete) | (1 << kIONVRAMOperationObliterate) | (1 << kIONVRAMOperationReset))
+#define ENT_MOD_RD ((1 << kIONVRAMOperationRead) | (1 << kIONVRAMOperationWrite) | (1 << kIONVRAMOperationDelete))
+#define ENT_MOD ((1 << kIONVRAMOperationWrite) | (1 << kIONVRAMOperationDelete))
+#define ENT_RST ((1 << kIONVRAMOperationObliterate) | (1 << kIONVRAMOperationReset))
+#define ENT_RD ((1 << kIONVRAMOperationRead))
+#define ENT_DEL ((1 << kIONVRAMOperationDelete))
enum NVRAMVersion {
kNVRAMVersionUnknown,
@@ -199,8 +182,7 @@
// Prefix for kernel-only variables
#define KERNEL_ONLY_VAR_NAME_PREFIX "krn."
-static TUNABLE(uint8_t, gNVRAMLogging, "nvram-log", kIONVRAMNoLogs);
-static TUNABLE(bool, gRestoreBoot, "-restore", false);
+static TUNABLE(bool, gNVRAMLogging, "nvram-log", false);
static bool gInternalBuild = false;
// IONVRAMSystemVariableListInternal:
@@ -292,8 +274,6 @@
uint64_t SystemReadHidden :1;
uint64_t FullAccess :1;
uint64_t InternalOnly :1;
- uint64_t TestingOnly :1;
- uint64_t RestoreModifyOnly :1;
uint64_t Reserved:57;
} Bits;
uint64_t Uint64;
@@ -311,7 +291,6 @@
.p.Bits.NeverAllowedToDelete = 1},
{"boot-image", .p.Bits.UserWrite = 1},
{"com.apple.System.fp-state", .p.Bits.KernelOnly = 1},
- {"enable-ephdm", .p.Bits.RestoreModifyOnly = 1},
{"fm-account-masked", .p.Bits.RootRequired = 1,
.p.Bits.NeverAllowedToDelete = 1},
{"fm-activation-locked", .p.Bits.RootRequired = 1,
@@ -338,18 +317,12 @@
{"nonce-seeds", .p.Bits.KernelOnly = 1},
#endif /* !defined(__x86_64__) */
// Variables used for testing permissions
- {"testSysReadHidden", .p.Bits.SystemReadHidden = 1,
- .p.Bits.TestingOnly = 1},
- {"testKernelOnly", .p.Bits.KernelOnly = 1,
- .p.Bits.TestingOnly = 1},
- {"testResetOnlyDel", .p.Bits.ResetNVRAMOnlyDelete = 1,
- .p.Bits.TestingOnly = 1},
- {"testNeverDel", .p.Bits.NeverAllowedToDelete = 1,
- .p.Bits.TestingOnly = 1},
- {"testUserWrite", .p.Bits.UserWrite = 1,
- .p.Bits.TestingOnly = 1},
- {"testRootReq", .p.Bits.RootRequired = 1,
- .p.Bits.TestingOnly = 1},
+ {"testSysReadHidden", .p.Bits.SystemReadHidden = 1},
+ {"testKernelOnly", .p.Bits.KernelOnly = 1},
+ {"testResetOnlyDel", .p.Bits.ResetNVRAMOnlyDelete = 1},
+ {"testNeverDel", .p.Bits.NeverAllowedToDelete = 1},
+ {"testUserWrite", .p.Bits.UserWrite = 1},
+ {"testRootReq", .p.Bits.RootRequired = 1},
{"reclaim-int", .p.Bits.InternalOnly = 1},
{nullptr, {.Bits.FullAccess = 1}} // Default access
};
@@ -364,34 +337,26 @@
// variable-guid pair entries that require entitlement check to do specified nvram operations
static const
VariableEntitlementEntry gVariableEntitlements[] = {
- {OP_MOD_RST, &gAppleNVRAMGuid, "ownership-warning", "com.apple.private.iokit.ddl-write"},
- {OP_MOD, &gAppleSystemVariableGuid, "BluetoothInfo", "com.apple.private.iokit.nvram-bluetooth"},
- {OP_MOD, &gAppleSystemVariableGuid, "BluetoothUHEDevices", "com.apple.private.iokit.nvram-bluetooth"},
- {OP_MOD, &gAppleNVRAMGuid, "bluetoothExternalDongleFailed", "com.apple.private.iokit.nvram-bluetooth"},
- {OP_MOD, &gAppleNVRAMGuid, "bluetoothInternalControllerInfo", "com.apple.private.iokit.nvram-bluetooth"},
- {OP_RD, &gAppleSystemVariableGuid, "current-network", "com.apple.private.security.nvram.wifi-psks"},
- {OP_RD, &gAppleWifiGuid, "current-network", "com.apple.private.security.nvram.wifi-psks"},
- {OP_RD, &gAppleSystemVariableGuid, "preferred-networks", "com.apple.private.security.nvram.wifi-psks"},
- {OP_RD, &gAppleWifiGuid, "preferred-networks", "com.apple.private.security.nvram.wifi-psks"},
- {OP_RD, &gAppleSystemVariableGuid, "preferred-count", "com.apple.private.security.nvram.wifi-psks"},
- {OP_RD, &gAppleWifiGuid, "preferred-count", "com.apple.private.security.nvram.wifi-psks"},
- {OP_MOD_RD, &gAppleSystemVariableGuid, "fmm-mobileme-token-FMM", "com.apple.private.security.nvram.fmm"},
- {OP_MOD_RD, &gAppleNVRAMGuid, "fmm-mobileme-token-FMM", "com.apple.private.security.nvram.fmm"},
- {OP_MOD_RD, &gAppleSystemVariableGuid, "fmm-mobileme-token-FMM-BridgeHasAccount", "com.apple.private.security.nvram.fmm"},
- {OP_MOD_RD, &gAppleNVRAMGuid, "fmm-mobileme-token-FMM-BridgeHasAccount", "com.apple.private.security.nvram.fmm"},
- {OP_MOD_RD, &gAppleSystemVariableGuid, "fmm-computer-name", "com.apple.private.security.nvram.fmm"},
- {OP_MOD_RD, &gAppleNVRAMGuid, "fmm-computer-name", "com.apple.private.security.nvram.fmm"},
- {OP_MOD, &gAppleSystemVariableGuid, "rdma-enable", "com.apple.private.iokit.rdma"},
- {OP_MOD, &gAppleNVRAMGuid, "rdma-enable", "com.apple.private.iokit.rdma"},
+ {ENT_MOD_RST, &gAppleNVRAMGuid, "ownership-warning", "com.apple.private.iokit.ddl-write"},
+ {ENT_MOD, &gAppleSystemVariableGuid, "BluetoothInfo", "com.apple.private.iokit.nvram-bluetooth"},
+ {ENT_MOD, &gAppleSystemVariableGuid, "BluetoothUHEDevices", "com.apple.private.iokit.nvram-bluetooth"},
+ {ENT_MOD, &gAppleNVRAMGuid, "bluetoothExternalDongleFailed", "com.apple.private.iokit.nvram-bluetooth"},
+ {ENT_MOD, &gAppleNVRAMGuid, "bluetoothInternalControllerInfo", "com.apple.private.iokit.nvram-bluetooth"},
+ {ENT_RD, &gAppleSystemVariableGuid, "current-network", "com.apple.private.security.nvram.wifi-psks"},
+ {ENT_RD, &gAppleWifiGuid, "current-network", "com.apple.private.security.nvram.wifi-psks"},
+ {ENT_RD, &gAppleSystemVariableGuid, "preferred-networks", "com.apple.private.security.nvram.wifi-psks"},
+ {ENT_RD, &gAppleWifiGuid, "preferred-networks", "com.apple.private.security.nvram.wifi-psks"},
+ {ENT_RD, &gAppleSystemVariableGuid, "preferred-count", "com.apple.private.security.nvram.wifi-psks"},
+ {ENT_RD, &gAppleWifiGuid, "preferred-count", "com.apple.private.security.nvram.wifi-psks"},
// Variables used for testing entitlement
- {OP_MOD_RST, &gAppleNVRAMGuid, "testEntModRst", "com.apple.private.iokit.testEntModRst"},
- {OP_MOD_RST, &gAppleSystemVariableGuid, "testEntModRstSys", "com.apple.private.iokit.testEntModRst"},
- {OP_RST, &gAppleNVRAMGuid, "testEntRst", "com.apple.private.iokit.testEntRst"},
- {OP_RST, &gAppleSystemVariableGuid, "testEntRstSys", "com.apple.private.iokit.testEntRst"},
- {OP_RD, &gAppleNVRAMGuid, "testEntRd", "com.apple.private.iokit.testEntRd"},
- {OP_RD, &gAppleSystemVariableGuid, "testEntRdSys", "com.apple.private.iokit.testEntRd"},
- {OP_DEL, &gAppleNVRAMGuid, "testEntDel", "com.apple.private.iokit.testEntDel"},
- {OP_DEL, &gAppleSystemVariableGuid, "testEntDelSys", "com.apple.private.iokit.testEntDel"},
+ {ENT_MOD_RST, &gAppleNVRAMGuid, "testEntModRst", "com.apple.private.iokit.testEntModRst"},
+ {ENT_MOD_RST, &gAppleSystemVariableGuid, "testEntModRstSys", "com.apple.private.iokit.testEntModRst"},
+ {ENT_RST, &gAppleNVRAMGuid, "testEntRst", "com.apple.private.iokit.testEntRst"},
+ {ENT_RST, &gAppleSystemVariableGuid, "testEntRstSys", "com.apple.private.iokit.testEntRst"},
+ {ENT_RD, &gAppleNVRAMGuid, "testEntRd", "com.apple.private.iokit.testEntRd"},
+ {ENT_RD, &gAppleSystemVariableGuid, "testEntRdSys", "com.apple.private.iokit.testEntRd"},
+ {ENT_DEL, &gAppleNVRAMGuid, "testEntDel", "com.apple.private.iokit.testEntDel"},
+ {ENT_DEL, &gAppleSystemVariableGuid, "testEntDelSys", "com.apple.private.iokit.testEntDel"},
{0, &UUID_NULL, nullptr, nullptr}
};
@@ -544,7 +509,7 @@
* @param systemActive boolean to indicate if it has system partition size > 0
*/
static void
-translateGUID(const uuid_t varGuid, const char *variableName, uuid_t destGuid, bool systemActive, bool log)
+translateGUID(const uuid_t varGuid, const char *variableName, uuid_t destGuid, bool systemActive)
{
if (varGuid == nullptr || variableName == nullptr || destGuid == nullptr) {
DEBUG_ERROR("nullptr passed as an argument\n");
@@ -555,20 +520,20 @@
if (systemActive) {
if (variableInAllowList(variableName)) {
- DEBUG_INFO_IF(log, "Using system GUID due to allow list\n");
+ DEBUG_INFO("Using system GUID due to allow list\n");
uuid_copy(destGuid, gAppleSystemVariableGuid);
} else if (systemGuid) {
- DEBUG_INFO_IF(log, "System GUID used\n");
+ DEBUG_INFO("System GUID used\n");
uuid_copy(destGuid, gAppleSystemVariableGuid);
} else {
- DEBUG_INFO_IF(log, "Use given guid\n");
+ DEBUG_INFO("Use given guid\n");
uuid_copy(destGuid, varGuid);
}
} else if (systemGuid) {
- DEBUG_INFO_IF(log, "Overriding to Apple guid\n");
+ DEBUG_INFO("Overriding to Apple guid\n");
uuid_copy(destGuid, gAppleNVRAMGuid);
} else {
- DEBUG_INFO_IF(log, "Use given guid\n");
+ DEBUG_INFO("Use given guid\n");
uuid_copy(destGuid, varGuid);
}
}
@@ -588,7 +553,7 @@
* @return false if varName/varGuid/veChecked was NULL or if entitlement check returned false
*/
static bool
-verifyVarEntitlement(const uuid_t varGuid, const char *varName, IONVRAMOperation op, bool systemActive, bool *veChecked, bool log)
+verifyVarEntitlement(const uuid_t varGuid, const char *varName, IONVRAMOperation op, bool systemActive, bool *veChecked)
{
if (varGuid == nullptr || varName == nullptr || veChecked == nullptr) {
DEBUG_ERROR("nullptr passed as an argument\n");
@@ -599,7 +564,7 @@
const VariableEntitlementEntry *entry;
*veChecked = false;
- translateGUID(varGuid, varName, translatedGuid, systemActive, log);
+ translateGUID(varGuid, varName, translatedGuid, systemActive);
entry = gVariableEntitlements;
while ((entry != nullptr) && (entry->varName != nullptr)) {
@@ -607,7 +572,7 @@
// check if task entitlement check is required for this operation
if (entry->checkOp & (1 << op)) {
*veChecked = true;
- DEBUG_INFO_IF(log, "Checking entitlement %s for %s for operation %s\n", entry->varEntitlement, varName, getNVRAMOpString(op));
+ DEBUG_INFO("Checking entitlement %s for %s for operation %s\n", entry->varEntitlement, varName, getNVRAMOpString(op));
return IOCurrentTaskHasEntitlement(entry->varEntitlement);
}
break;
@@ -619,7 +584,7 @@
}
static bool
-kernelOnlyVar(const char *varName)
+kernelOnlyVar(const uuid_t varGuid, const char *varName)
{
if (strncmp(varName, KERNEL_ONLY_VAR_NAME_PREFIX, sizeof(KERNEL_ONLY_VAR_NAME_PREFIX) - 1) == 0) {
return true;
@@ -629,34 +594,29 @@
}
static bool
-verifyPermission(IONVRAMOperation op, const uuid_t varGuid, const char *varName, const bool systemActive, bool log)
+verifyPermission(IONVRAMOperation op, const uuid_t varGuid, const char *varName, const bool systemActive)
{
VariablePermission perm;
bool kernel, varEntitled, writeEntitled = false, readEntitled = false, allowList, systemGuid = false, systemEntitled = false, systemInternalEntitled = false, systemAllow, systemReadHiddenAllow = false;
bool admin = false;
bool ok = false;
- if (verifyVarEntitlement(varGuid, varName, op, systemActive, &varEntitled, log) == false) {
+ if (verifyVarEntitlement(varGuid, varName, op, systemActive, &varEntitled) == false) {
goto exit;
}
perm = getVariablePermission(varName);
kernel = current_task() == kernel_task;
- if (perm.Bits.KernelOnly || kernelOnlyVar(varName)) {
- DEBUG_INFO_IF(log, "KernelOnly access for %s, kernel=%d\n", varName, kernel);
+
+ if (perm.Bits.KernelOnly || kernelOnlyVar(varGuid, varName)) {
+ DEBUG_INFO("KernelOnly access for %s, kernel=%d\n", varName, kernel);
ok = kernel;
goto exit;
}
- if (perm.Bits.RestoreModifyOnly && (OP_MOD & (1 << op))) {
- DEBUG_INFO_IF(log, "RestoreModifyOnly access for %s, gRestoreBoot=%d\n", varName, gRestoreBoot);
- ok = gRestoreBoot;
- goto exit;
- }
-
if (perm.Bits.InternalOnly && !gInternalBuild) {
- DEBUG_INFO_IF(log, "InternalOnly access for %s, gInternalBuild=%d\n", varName, gInternalBuild);
+ DEBUG_INFO("InternalOnly access for %s, gInternalBuild=%d\n", varName, gInternalBuild);
goto exit;
}
@@ -688,7 +648,7 @@
DEBUG_ERROR("Allowed write to system region when NOT entitled for %s\n", varName);
}
} else if (varEntitled) {
- DEBUG_INFO_IF(log, "Allowed write to system region using variable specific entitlement for %s\n", varName);
+ DEBUG_INFO("Allowed write to system region using variable specific entitlement for %s\n", varName);
} else if (!systemAllow) {
DEBUG_ERROR("Not entitled for system region writes for %s\n", varName);
break;
@@ -702,13 +662,13 @@
case kIONVRAMOperationObliterate:
case kIONVRAMOperationReset:
if (perm.Bits.NeverAllowedToDelete) {
- DEBUG_INFO_IF(log, "Never allowed to delete %s\n", varName);
+ DEBUG_INFO("Never allowed to delete %s\n", varName);
break;
} else if ((op == kIONVRAMOperationObliterate) && perm.Bits.ResetNVRAMOnlyDelete) {
- DEBUG_INFO_IF(log, "Not allowed to obliterate %s\n", varName);
+ DEBUG_INFO("Not allowed to obliterate %s\n", varName);
break;
} else if ((op == kIONVRAMOperationDelete) && perm.Bits.ResetNVRAMOnlyDelete) {
- DEBUG_INFO_IF(log, "Only allowed to delete %s via NVRAM reset\n", varName);
+ DEBUG_INFO("Only allowed to delete %s via NVRAM reset\n", varName);
break;
}
@@ -719,7 +679,7 @@
DEBUG_ERROR("Allowed delete to system region when NOT entitled for %s\n", varName);
}
} else if (varEntitled) {
- DEBUG_INFO_IF(log, "Allowed delete to system region using variable specific entitlement for %s\n", varName);
+ DEBUG_INFO("Allowed delete to system region using variable specific entitlement for %s\n", varName);
} else if (!systemAllow) {
DEBUG_ERROR("Not entitled for system region deletes for %s\n", varName);
break;
@@ -734,8 +694,8 @@
}
exit:
- DEBUG_INFO_IF(log, "Permission for %s of %s %s: I=%d R=%d kern=%d, adm=%d, wE=%d, rE=%d, sG=%d, sEd=%d, sIEd=%d, sRHA=%d, UW=%d, vE=%d\n", getNVRAMOpString(op), varName, ok ? "granted" : "denied",
- gInternalBuild, gRestoreBoot, kernel, admin, writeEntitled, readEntitled, systemGuid, systemEntitled, systemInternalEntitled, systemReadHiddenAllow, perm.Bits.UserWrite, varEntitled);
+ DEBUG_INFO("Permission for %s of %s %s: I=%d kern=%d, adm=%d, wE=%d, rE=%d, sG=%d, sEd=%d, sIEd=%d, sRHA=%d, UW=%d, vE=%d\n", getNVRAMOpString(op), varName, ok ? "granted" : "denied",
+ gInternalBuild, kernel, admin, writeEntitled, readEntitled, systemGuid, systemEntitled, systemInternalEntitled, systemReadHiddenAllow, perm.Bits.UserWrite, varEntitled);
return ok;
}
@@ -748,7 +708,7 @@
parseVariableName(canonicalKey->getCStringNoCopy(), &varGuid, &varName);
- return verifyPermission(op, varGuid, varName, systemActive, true);
+ return verifyPermission(op, varGuid, varName, systemActive);
}
static bool
@@ -777,7 +737,7 @@
length = sizeof(uuid_string_t) - 1 + sizeof(':') + strlen(cstring) + 1;
- canonicalString = (char *) IOMallocZeroData(length);
+ canonicalString = (char *) IOMallocData(length);
if (canonicalString == nullptr) {
return NULL;
}
@@ -811,52 +771,6 @@
exit:
return;
}
-
-static void
-dumpData(const char *name, OSSharedPtr<OSData> propData)
-{
- if (!IS_LOG_BIT_SET(kIONVRAMDataHexDump) || !propData) {
- return;
- }
-
- uint8_t *dataBuf = (uint8_t *)propData->getBytesNoCopy();
- size_t propDataSize = propData->getLength();
-
- if (dataBuf == nullptr || propDataSize == 0) {
- return;
- }
-
- IOLog("%s:%s:%u - %s: ", __FILE_NAME__, __FUNCTION__, __LINE__, name);
- for (size_t i = 0; i < propDataSize; i++) {
- // if printable character, use that
- if ((dataBuf[i] >= 0x20 && dataBuf[i] <= 0x7e) && dataBuf[i] != '%') {
- IOLog("%c", dataBuf[i]);
- } else {
- IOLog("%%%02x", dataBuf[i]);
- }
- }
- IOLog("\n");
-}
-
-
-typedef struct {
- const char *name;
- OSSharedPtr<OSObject> value;
-} ephDMAllowListEntry;
-
-// common region variables to preserve on ephemeral boot
-static
-ephDMAllowListEntry ephDMEntries[] = {
- // Mobile Obliteration clears the following variables after it runs
- { .name = "oblit-begins" },
- { .name = "orig-oblit" },
- { .name = "oblit-failure" },
- { .name = "oblit-inprogress" },
- { .name = "obliteration" },
- // darwin-init is used for configuring internal builds
- { .name = "darwin-init" },
- { .name = "darwin-init-system" }
-};
// ************************** IODTNVRAMPlatformNotifier ****************************
// private IOService based class for passing notifications to IODTNVRAM
@@ -957,7 +871,7 @@
public:
bool start(IOService * provider) APPLE_KEXT_OVERRIDE;
- void logVariable(NVRAMPartitionType region, IONVRAMOperation op, const char *name, void *data = nullptr, void *offset = nullptr);
+ void logVariable(NVRAMPartitionType region, IONVRAMOperation op, const char *name, void *data);
};
OSDefineMetaClassAndStructors(IODTNVRAMDiags, IOService)
@@ -994,22 +908,21 @@
}
void
-IODTNVRAMDiags::logVariable(NVRAMPartitionType region, IONVRAMOperation op, const char *name, void *data, void *offset)
+IODTNVRAMDiags::logVariable(NVRAMPartitionType region, IONVRAMOperation op, const char *name, void *data)
{
// "Stats" : OSDictionary
// - "XX:varName" : OSDictionary, XX is the region value prefix to distinguish which dictionary the variable is in
- // - "Init" : OSNumber variable offset (in the proxy image passed via EDT) if variable is present at initialization (unserialize)
+ // - "Init" : OSBoolean True/present if variable present at initialization
// - "Read" : OSNumber count
// - "Write" : OSNumber count
// - "Delete" : OSNumber count
- // - "Size" : OSNumber data size, latest size from either init or write
+ // - "Size" : OSNumber size, latest size from either init or write
// - "Present" : OSBoolean True/False if variable is present or not
char *entryKey;
size_t entryKeySize;
OSSharedPtr<OSDictionary> existingEntry;
OSSharedPtr<OSNumber> currentCount;
OSSharedPtr<OSNumber> varSize;
- OSSharedPtr<OSNumber> varOffset;
const char *opCountKey = nullptr;
entryKeySize = strlen("XX:") + strlen(name) + 1;
@@ -1046,8 +959,7 @@
break;
case kIONVRAMOperationInit:
varSize = OSNumber::withNumber((size_t)data, 64);
- varOffset = OSNumber::withNumber((size_t)offset, 64);
- existingEntry->setObject(kIODTNVRAMDiagsInitKey, varOffset);
+ existingEntry->setObject(kIODTNVRAMDiagsInitKey, varSize);
existingEntry->setObject(kIODTNVRAMDiagsSizeKey, varSize);
existingEntry->setObject(kIODTNVRAMDiagsPresentKey, kOSBooleanTrue);
break;
@@ -1293,7 +1205,6 @@
virtual uint32_t getCommonUsed(void) const = 0;
virtual bool getSystemPartitionActive(void) const = 0;
virtual IOReturn getVarDict(OSSharedPtr<OSDictionary> &varDictCopy) = 0;
- IOReturn handleEphDM(void);
};
IODTNVRAMFormatHandler::~IODTNVRAMFormatHandler()
@@ -1341,67 +1252,6 @@
exit:
return ok;
-}
-
-IOReturn
-IODTNVRAMFormatHandler::handleEphDM(void)
-{
- OSSharedPtr<IORegistryEntry> entry;
- OSData* data;
- OSSharedPtr<OSObject> prop;
- uint32_t ephDM = 0;
- IOReturn ret = kIOReturnSuccess;
- OSSharedPtr<const OSSymbol> canonicalKey;
- uint32_t skip = 0;
- OSSharedPtr<OSDictionary> varDict;
-
- // For ephemeral data mode, NVRAM needs to be cleared on every boot
- // For system region supported targets, iBoot clears the system region
- // For other targets, iBoot clears all the persistent variables
- // So xnu only needs to clear the common region
- entry = IORegistryEntry::fromPath("/product", gIODTPlane);
- if (entry) {
- prop = entry->copyProperty("ephemeral-data-mode");
- if (prop) {
- data = OSDynamicCast(OSData, prop.get());
- if (data) {
- ephDM = *((uint32_t *)data->getBytesNoCopy());
- }
- }
- }
-
- require_action(ephDM != 0, exit, DEBUG_ALWAYS("ephemeral-data-mode not supported\n"));
- require_action(getSystemPartitionActive(), exit, DEBUG_ALWAYS("No system region, no need to clear\n"));
-
- if (PE_parse_boot_argn("epdm-skip-nvram", &skip, sizeof(skip))) {
- require_action(!(gInternalBuild && (skip == 1)), exit, DEBUG_ALWAYS("Internal build + epdm-skip-nvram set to true, skip nvram clearing\n"));
- }
-
- // Get the current variable dictionary
- ret = getVarDict(varDict);
- require_noerr_action(ret, exit, DEBUG_ERROR("Failed to get variable dictionary for EphDM handling\n"));
-
- // Go through the allowlist and stash the values
- for (uint32_t entry = 0; entry < ARRAY_SIZE(ephDMEntries); entry++) {
- canonicalKey = keyWithGuidAndCString(gAppleNVRAMGuid, ephDMEntries[entry].name);
- ephDMEntries[entry].value.reset(OSDynamicCast(OSData, varDict->getObject(canonicalKey.get())), OSRetain);
- }
-
- DEBUG_ALWAYS("Obliterating common region\n");
- ret = flush(gAppleNVRAMGuid, kIONVRAMOperationObliterate);
- require_noerr_action(ret, exit, DEBUG_ERROR("Flushing common region failed, ret=%#08x\n", ret));
-
- // Now write the allowlist variables back
- for (uint32_t entry = 0; entry < ARRAY_SIZE(ephDMEntries); entry++) {
- if (ephDMEntries[entry].value.get() == nullptr) {
- continue;
- }
- ret = setVariable(gAppleNVRAMGuid, ephDMEntries[entry].name, ephDMEntries[entry].value.get());
- require_noerr_action(ret, exit, DEBUG_ERROR("Setting allowlist variable %s failed, ret=%#08x\n", ephDMEntries[entry].name, ret));
- }
-
-exit:
- return ret;
}
#include "IONVRAMCHRPHandler.cpp"
@@ -1721,6 +1571,7 @@
uuid_t varGuid;
const char * varName;
IOReturn status;
+
require_action(_format, exit, DEBUG_ERROR("Handler not initialized yet\n"));
status = _format->getVarDict(localVarDict);
@@ -1737,7 +1588,7 @@
parseVariableName(canonicalKey, &varGuid, &varName);
if ((uuid_compare(varGuid, gAppleSystemVariableGuid) == 0) &&
- verifyPermission(kIONVRAMOperationRead, varGuid, varName, _format->getSystemPartitionActive(), false)) {
+ verifyPermission(kIONVRAMOperationRead, varGuid, varName, _format->getSystemPartitionActive())) {
OSSharedPtr<const OSSymbol> returnKey = OSSymbol::withCString(varName);
returnDict->setObject(returnKey.get(), localVarDict->getObject(canonicalKey));
}
@@ -1757,7 +1608,7 @@
continue;
}
- if (verifyPermission(kIONVRAMOperationRead, varGuid, varName, _format->getSystemPartitionActive(), false)) {
+ if (verifyPermission(kIONVRAMOperationRead, varGuid, varName, _format->getSystemPartitionActive())) {
OSSharedPtr<const OSSymbol> returnKey = OSSymbol::withCString(varName);
returnDict->setObject(returnKey.get(), localVarDict->getObject(canonicalKey));
}
@@ -1847,19 +1698,19 @@
status = _format->getVarDict(localVarDict);
require_noerr_action(status, exit, DEBUG_ERROR("Failed to get variable dictionary\n"));
- if (!verifyPermission(kIONVRAMOperationRead, guid, name, _format->getSystemPartitionActive(), true)) {
+ if (!verifyPermission(kIONVRAMOperationRead, guid, name, _format->getSystemPartitionActive())) {
DEBUG_INFO("Not privileged\n");
goto exit;
}
- translateGUID(guid, name, newGuid, _format->getSystemPartitionActive(), true);
+ translateGUID(guid, name, newGuid, _format->getSystemPartitionActive());
canonicalKey = keyWithGuidAndCString(newGuid, name);
theObject.reset(localVarDict->getObject(canonicalKey.get()), OSRetain);
if (_diags) {
- _diags->logVariable(getPartitionTypeForGUID(newGuid), kIONVRAMOperationRead, name);
+ _diags->logVariable(getPartitionTypeForGUID(newGuid), kIONVRAMOperationRead, name, NULL);
}
if (theObject != nullptr) {
@@ -1920,29 +1771,6 @@
OSSharedPtr<OSObject> theObject = copyProperty(aKey);
return theObject.get();
-}
-
-IOReturn
-IODTNVRAM::clearTestVars(const uuid_t guid)
-{
- const VariablePermissionEntry *entry;
- IOReturn ret = kIOReturnSuccess;
- uuid_t newGuid;
-
- entry = gVariablePermissions;
- require_action(gInternalBuild, exit, DEBUG_INFO("Internal build only\n"));
- require_action(_format != nullptr, exit, (ret = kIOReturnNotReady, DEBUG_ERROR("Handler not initialized yet\n")));
-
- while ((entry != nullptr) && (entry->name != nullptr)) {
- if (entry->p.Bits.TestingOnly) {
- translateGUID(guid, entry->name, newGuid, _format->getSystemPartitionActive(), true);
- ret = _format->setVariable(newGuid, entry->name, nullptr);
- }
- entry++;
- }
-
-exit:
- return ret;
}
IOReturn
@@ -1959,11 +1787,6 @@
uuid_t newGuid;
require_action(_format != nullptr, exit, (ret = kIOReturnNotReady, DEBUG_ERROR("Handler not initialized yet\n")));
-
- if (strncmp(name, kNVRAMClearTestVarKey, sizeof(kNVRAMClearTestVarKey)) == 0) {
- ret = clearTestVars(guid);
- goto exit;
- }
deletePropertyKey = strncmp(name, kIONVRAMDeletePropertyKey, sizeof(kIONVRAMDeletePropertyKey)) == 0;
deletePropertyKeyWRet = strncmp(name, kIONVRAMDeletePropertyKeyWRet, sizeof(kIONVRAMDeletePropertyKeyWRet)) == 0;
@@ -2016,7 +1839,7 @@
goto exit;
}
- if (!verifyPermission(kIONVRAMOperationWrite, guid, name, _format->getSystemPartitionActive(), true)) {
+ if (!verifyPermission(kIONVRAMOperationWrite, guid, name, _format->getSystemPartitionActive())) {
DEBUG_INFO("Not privileged\n");
ret = kIOReturnNotPrivileged;
goto exit;
@@ -2064,10 +1887,8 @@
}
if (propObject != nullptr) {
- OSSharedPtr<OSData> propData = OSDynamicPtrCast<OSData>(propObject);
- propDataSize = propData->getLength();
- record_system_event(SYSTEM_EVENT_TYPE_INFO, SYSTEM_EVENT_SUBSYSTEM_NVRAM, "write", "%s as data with size %zu", name, propDataSize);
- dumpData(name, propData);
+ propDataSize = (OSDynamicPtrCast<OSData>(propObject))->getLength();
+ record_system_event(SYSTEM_EVENT_TYPE_INFO, SYSTEM_EVENT_SUBSYSTEM_NVRAM, "write", "%s as data with size %#x", name, ((OSData *)propObject.get())->getLength());
}
#if defined(XNU_TARGET_OS_OSX)
@@ -2101,7 +1922,7 @@
if (remove == false) {
DEBUG_INFO("Adding object\n");
- translateGUID(guid, name, newGuid, _format->getSystemPartitionActive(), true);
+ translateGUID(guid, name, newGuid, _format->getSystemPartitionActive());
ret = _format->setVariable(newGuid, name, propObject.get());
} else {
DEBUG_INFO("Removing object\n");
@@ -2158,13 +1979,13 @@
DEBUG_INFO("name=%s\n", name);
require_action(_format != nullptr, exit, (ret = kIOReturnNotReady, DEBUG_ERROR("Handler not initialized yet\n")));
- if (!verifyPermission(kIONVRAMOperationDelete, guid, name, _format->getSystemPartitionActive(), true)) {
+ if (!verifyPermission(kIONVRAMOperationDelete, guid, name, _format->getSystemPartitionActive())) {
DEBUG_INFO("Not privileged\n");
ret = kIOReturnNotPrivileged;
goto exit;
}
- translateGUID(guid, name, newGuid, _format->getSystemPartitionActive(), true);
+ translateGUID(guid, name, newGuid, _format->getSystemPartitionActive());
ret = _format->setVariable(newGuid, name, nullptr);
if (ret != kIOReturnSuccess) {