Loading...
iokit/Kernel/IONVRAM.cpp xnu-3248.30.4 xnu-344.2
--- xnu/xnu-3248.30.4/iokit/Kernel/IONVRAM.cpp
+++ xnu/xnu-344.2/iokit/Kernel/IONVRAM.cpp
@@ -1,30 +1,23 @@
 /*
- * Copyright (c) 1998-2006 Apple Computer, Inc. All rights reserved.
- * Copyright (c) 2007-2012 Apple Inc. All rights reserved.
+ * Copyright (c) 1998-2000 Apple Computer, Inc. All rights reserved.
  *
- * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
+ * @APPLE_LICENSE_HEADER_START@
  * 
- * This file contains Original Code and/or Modifications of Original Code
- * as defined in and that are subject to the Apple Public Source License
- * Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. The rights granted to you under the License
- * may not be used to create, or enable the creation or redistribution of,
- * unlawful or unlicensed copies of an Apple operating system, or to
- * circumvent, violate, or enable the circumvention or violation of, any
- * terms of an Apple operating system software license agreement.
+ * The contents of this file constitute Original Code as defined in and
+ * are subject to the Apple Public Source License Version 1.1 (the
+ * "License").  You may not use this file except in compliance with the
+ * License.  Please obtain a copy of the License at
+ * http://www.apple.com/publicsource and read it before using this file.
  * 
- * Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this file.
- * 
- * The Original Code and all software distributed under the License are
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * This Original Code and all software distributed under the License are
+ * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
- * Please see the License for the specific language governing rights and
- * limitations under the License.
+ * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
+ * License for the specific language governing rights and limitations
+ * under the License.
  * 
- * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
+ * @APPLE_LICENSE_HEADER_END@
  */
 
 #include <IOKit/IOLib.h>
@@ -32,21 +25,8 @@
 #include <IOKit/IOPlatformExpert.h>
 #include <IOKit/IOUserClient.h>
 #include <IOKit/IOKitKeys.h>
-#include <IOKit/IOKitKeysPrivate.h>
-#include <kern/debug.h>
-#include <pexpert/pexpert.h>
-
-#if CONFIG_MACF
-extern "C" {
-#include <security/mac.h>
-#include <security/mac_framework.h>
-};
-#endif /* MAC */
 
 #define super IOService
-
-#define kIONVRAMPrivilege	kIOClientPrivilegeAdministrator
-//#define kIONVRAMPrivilege	kIOClientPrivilegeLocalUser
 
 OSDefineMetaClassAndStructors(IODTNVRAM, IOService);
 
@@ -72,57 +52,10 @@
   _registryPropertiesKey = OSSymbol::withCStringNoCopy("aapl,pci");
   if (_registryPropertiesKey == 0) return false;
   
-  // <rdar://problem/9529235> race condition possible between
-  // IODTNVRAM and IONVRAMController (restore loses boot-args)
-  initProxyData();
-
   return true;
 }
 
-void IODTNVRAM::initProxyData(void)
-{
-  IORegistryEntry *entry;
-  const char *key = "nvram-proxy-data";
-  OSObject *prop;
-  OSData *data;
-  const void *bytes;
-  
-  entry = IORegistryEntry::fromPath("/chosen", gIODTPlane);
-  if (entry != 0) {
-    prop = entry->getProperty(key);
-    if (prop != 0) {
-      data = OSDynamicCast(OSData, prop);
-      if (data != 0) {
-        bytes = data->getBytesNoCopy();
-        if (bytes != 0) {
-          bcopy(bytes, _nvramImage, data->getLength());
-          initNVRAMImage();
-          _isProxied = true;
-        }
-      }
-    }
-    entry->removeProperty(key);
-    entry->release();
-  }
-}
-
 void IODTNVRAM::registerNVRAMController(IONVRAMController *nvram)
-{
-  if (_nvramController != 0) return;
-  
-  _nvramController = nvram;
-  
-  // <rdar://problem/9529235> race condition possible between
-  // IODTNVRAM and IONVRAMController (restore loses boot-args)
-  if (!_isProxied) {
-    _nvramController->read(0, _nvramImage, kIODTNVRAMImageSize);
-    initNVRAMImage();
-  } else {
-    syncOFVariables();
-  }
-}
-
-void IODTNVRAM::initNVRAMImage(void)
 {
   char   partitionID[18];
   UInt32 partitionOffset, partitionLength;
@@ -130,56 +63,81 @@
   UInt32 currentLength, currentOffset = 0;
   OSNumber *partitionOffsetNumber, *partitionLengthNumber;
   
+  if (_nvramController != 0) return;
+  
+  _nvramController = nvram;
+  
+  _nvramController->read(0, _nvramImage, kIODTNVRAMImageSize);
+  
   // Find the offsets for the OF, XPRAM, NameRegistry and PanicInfo partitions.
   _ofPartitionOffset = 0xFFFFFFFF;
+  _xpramPartitionOffset = 0xFFFFFFFF;
+  _nrPartitionOffset = 0xFFFFFFFF;
   _piPartitionOffset = 0xFFFFFFFF;
   freePartitionOffset = 0xFFFFFFFF;
   freePartitionSize = 0;
-
-  // Look through the partitions to find the OF, MacOS partitions.
-  while (currentOffset < kIODTNVRAMImageSize) {
-    currentLength = ((UInt16 *)(_nvramImage + currentOffset))[1] * 16;
-    
-    partitionOffset = currentOffset + 16;
-    partitionLength = currentLength - 16;
-    
-    if (strncmp((const char *)_nvramImage + currentOffset + 4,
-		kIODTNVRAMOFPartitionName, 12) == 0) {
-      _ofPartitionOffset = partitionOffset;
-      _ofPartitionSize = partitionLength;
-    } else if (strncmp((const char *)_nvramImage + currentOffset + 4,
-		       kIODTNVRAMXPRAMPartitionName, 12) == 0) {
-    } else if (strncmp((const char *)_nvramImage + currentOffset + 4,
-		       kIODTNVRAMPanicInfoPartitonName, 12) == 0) {
-      _piPartitionOffset = partitionOffset;
-      _piPartitionSize = partitionLength;
-    } else if (strncmp((const char *)_nvramImage + currentOffset + 4,
-		       kIODTNVRAMFreePartitionName, 12) == 0) {
-      freePartitionOffset = currentOffset;
-      freePartitionSize = currentLength;
-    } else {
-      // Construct the partition ID from the signature and name.
-      snprintf(partitionID, sizeof(partitionID), "0x%02x,",
-	      *(UInt8 *)(_nvramImage + currentOffset));
-      strncpy(partitionID + 5,
-	      (const char *)(_nvramImage + currentOffset + 4), 12);
-      partitionID[17] = '\0';
-      
-      partitionOffsetNumber = OSNumber::withNumber(partitionOffset, 32);
-      partitionLengthNumber = OSNumber::withNumber(partitionLength, 32);
-      
-      // Save the partition offset and length
-      _nvramPartitionOffsets->setObject(partitionID, partitionOffsetNumber);
-      _nvramPartitionLengths->setObject(partitionID, partitionLengthNumber);
-      
-      partitionOffsetNumber->release();
-      partitionLengthNumber->release();
-    }
-    currentOffset += currentLength;
+  if (getPlatform()->getBootROMType()) {
+    // Look through the partitions to find the OF, MacOS partitions.
+    while (currentOffset < kIODTNVRAMImageSize) {
+      currentLength = ((UInt16 *)(_nvramImage + currentOffset))[1] * 16;
+      
+      partitionOffset = currentOffset + 16;
+      partitionLength = currentLength - 16;
+      
+      if (strncmp((const char *)_nvramImage + currentOffset + 4,
+		  kIODTNVRAMOFPartitionName, 12) == 0) {
+	_ofPartitionOffset = partitionOffset;
+	_ofPartitionSize = partitionLength;
+      } else if (strncmp((const char *)_nvramImage + currentOffset + 4,
+			 kIODTNVRAMXPRAMPartitionName, 12) == 0) {
+	_xpramPartitionOffset = partitionOffset;
+	_xpramPartitionSize = kIODTNVRAMXPRAMSize;
+	_nrPartitionOffset = _xpramPartitionOffset + _xpramPartitionSize;
+	_nrPartitionSize = partitionLength - _xpramPartitionSize;
+      } else if (strncmp((const char *)_nvramImage + currentOffset + 4,
+			 kIODTNVRAMPanicInfoPartitonName, 12) == 0) {
+	_piPartitionOffset = partitionOffset;
+	_piPartitionSize = partitionLength;
+      } else if (strncmp((const char *)_nvramImage + currentOffset + 4,
+			 kIODTNVRAMFreePartitionName, 12) == 0) {
+	freePartitionOffset = currentOffset;
+	freePartitionSize = currentLength;
+      } else {
+	// Construct the partition ID from the signature and name.
+	sprintf(partitionID, "0x%02x,",
+		*(UInt8 *)(_nvramImage + currentOffset));
+	strncpy(partitionID + 5,
+		(const char *)(_nvramImage + currentOffset + 4), 12);
+	partitionID[17] = '\0';
+	
+	partitionOffsetNumber = OSNumber::withNumber(partitionOffset, 32);
+	partitionLengthNumber = OSNumber::withNumber(partitionLength, 32);
+	
+	// Save the partition offset and length
+	_nvramPartitionOffsets->setObject(partitionID, partitionOffsetNumber);
+	_nvramPartitionLengths->setObject(partitionID, partitionLengthNumber);
+	
+	partitionOffsetNumber->release();
+	partitionLengthNumber->release();
+      }
+      currentOffset += currentLength;
+    }
+  } else {
+    // Use the fixed address for old world machines.
+    _ofPartitionOffset    = 0x1800;
+    _ofPartitionSize      = 0x0800;
+    _xpramPartitionOffset = 0x1300;
+    _xpramPartitionSize   = 0x0100;
+    _nrPartitionOffset    = 0x1400;
+    _nrPartitionSize      = 0x0400;
   }
   
   if (_ofPartitionOffset != 0xFFFFFFFF)
     _ofImage    = _nvramImage + _ofPartitionOffset;
+  if (_xpramPartitionOffset != 0xFFFFFFFF)
+    _xpramImage = _nvramImage + _xpramPartitionOffset;
+  if (_nrPartitionOffset != 0xFFFFFFFF)
+    _nrImage    = _nvramImage + _nrPartitionOffset;
   
   if (_piPartitionOffset == 0xFFFFFFFF) {
     if (freePartitionSize > 0x20) {
@@ -227,152 +185,99 @@
       // Set the partition checksum.
       _nvramImage[freePartitionOffset + 1] =
 	calculatePartitionChecksum(_nvramImage + freePartitionOffset);
-
-      if (_nvramController != 0) {
-        _nvramController->write(0, _nvramImage, kIODTNVRAMImageSize);
-      }
+      
+      // Set the nvram image as dirty.
+      _nvramImageDirty = true;
     }
   } else {
     _piImage = _nvramImage + _piPartitionOffset;
   }
   
-  _lastDeviceSync = 0;
-  _freshInterval = TRUE;		// we will allow sync() even before the first 15 minutes have passed.
-
   initOFVariables();
 }
 
-void IODTNVRAM::syncInternal(bool rateLimit)
-{
-  // Don't try to perform controller operations if none has been registered.  
-  if (_nvramController == 0) return;
-
-  // Rate limit requests to sync. Drivers that need this rate limiting will
-  // shadow the data and only write to flash when they get a sync call
-  if (rateLimit && !safeToSync()) return;
-  
+void IODTNVRAM::sync(void)
+{
+  if (!_nvramImageDirty && !_ofImageDirty) return;
+  
+  // Don't try to sync OF Variables if the system has already paniced.
+  if (!_systemPaniced) syncOFVariables();
+  
+  _nvramController->write(0, _nvramImage, kIODTNVRAMImageSize);
   _nvramController->sync();
-}
-
-void IODTNVRAM::sync(void)
-{
-  syncInternal(false);
-}
-
-bool IODTNVRAM::serializeProperties(OSSerialize *s) const
-{
-  bool                 result, hasPrivilege;
+  
+  _nvramImageDirty = false;
+}
+
+bool IODTNVRAM::serializeProperties(OSSerialize *serialize) const
+{
+  bool                 result;
   UInt32               variablePerm;
   const OSSymbol       *key;
-  OSDictionary         *dict;
+  OSDictionary         *dict, *tmpDict = 0;
   OSCollectionIterator *iter = 0;
   
+  if (_ofDict == 0) return false;
+  
   // Verify permissions.
-  hasPrivilege = (kIOReturnSuccess == IOUserClient::clientHasPrivilege(current_task(), kIONVRAMPrivilege));
-
-  if (_ofDict == 0) {
-    /* No nvram. Return an empty dictionary. */
-    dict = OSDictionary::withCapacity(1);
-    if (dict == 0) return false;
-  } else {
-    IOLockLock(_ofLock);
-    dict = OSDictionary::withDictionary(_ofDict);
-    IOLockUnlock(_ofLock);
-    if (dict == 0) return false;
-
-    /* Copy properties with client privilege. */
-    iter = OSCollectionIterator::withCollection(dict);
-    if (iter == 0) {
-      dict->release();
-      return false;
-    }
+  result = IOUserClient::clientHasPrivilege(current_task(), kIOClientPrivilegeAdministrator);
+  if (result != kIOReturnSuccess) {
+    tmpDict = OSDictionary::withCapacity(1);
+    if (tmpDict == 0) return false;
+    
+    iter = OSCollectionIterator::withCollection(_ofDict);
+    if (iter == 0) return false;
+    
     while (1) {
       key = OSDynamicCast(OSSymbol, iter->getNextObject());
       if (key == 0) break;
       
       variablePerm = getOFVariablePerm(key);
-      if ((hasPrivilege || (variablePerm != kOFVariablePermRootOnly)) &&
-	  ( ! (variablePerm == kOFVariablePermKernelOnly && current_task() != kernel_task) )
-#if CONFIG_MACF
-          && (current_task() == kernel_task || mac_iokit_check_nvram_get(kauth_cred_get(), key->getCStringNoCopy()) == 0)
-#endif
-         ) { }
-      else {
-        dict->removeObject(key);
-        iter->reset();
+      if (variablePerm != kOFVariablePermRootOnly) {
+	tmpDict->setObject(key, _ofDict->getObject(key));
       }
     }
-  }
-
-  result = dict->serialize(s);
- 
-  dict->release();
+    dict = tmpDict;
+  } else {
+    dict = _ofDict;
+  }
+  
+  result = dict->serialize(serialize);
+  
+  if (tmpDict != 0) tmpDict->release();
   if (iter != 0) iter->release();
   
   return result;
 }
 
-OSObject *IODTNVRAM::copyProperty(const OSSymbol *aKey) const
+OSObject *IODTNVRAM::getProperty(const OSSymbol *aKey) const
 {
   IOReturn result;
   UInt32   variablePerm;
-  OSObject *theObject;
   
   if (_ofDict == 0) return 0;
   
   // Verify permissions.
-  variablePerm = getOFVariablePerm(aKey);
-  result = IOUserClient::clientHasPrivilege(current_task(), kIONVRAMPrivilege);
+  result = IOUserClient::clientHasPrivilege(current_task(), "root");
   if (result != kIOReturnSuccess) {
+    variablePerm = getOFVariablePerm(aKey);
     if (variablePerm == kOFVariablePermRootOnly) return 0;
   }
-  if (variablePerm == kOFVariablePermKernelOnly && current_task() != kernel_task) return 0;
-
-#if CONFIG_MACF
-  if (current_task() != kernel_task &&
-      mac_iokit_check_nvram_get(kauth_cred_get(), aKey->getCStringNoCopy()) != 0)
-    return 0;
-#endif
-
-  IOLockLock(_ofLock);
-  theObject = _ofDict->getObject(aKey);
-  if (theObject) theObject->retain();
-  IOLockUnlock(_ofLock);
-
-  return theObject;
-}
-
-OSObject *IODTNVRAM::copyProperty(const char *aKey) const
+  
+  return _ofDict->getObject(aKey);
+}
+
+OSObject *IODTNVRAM::getProperty(const char *aKey) const
 {
   const OSSymbol *keySymbol;
   OSObject *theObject = 0;
   
-  keySymbol = OSSymbol::withCString(aKey);
+  keySymbol = OSSymbol::withCStringNoCopy(aKey);
   if (keySymbol != 0) {
-    theObject = copyProperty(keySymbol);
+    theObject = getProperty(keySymbol);
     keySymbol->release();
   }
   
-  return theObject;
-}
-
-OSObject *IODTNVRAM::getProperty(const OSSymbol *aKey) const
-{
-  OSObject *theObject;
-
-  theObject = copyProperty(aKey);
-  if (theObject) theObject->release();
-
-  return theObject;
-}
-
-OSObject *IODTNVRAM::getProperty(const char *aKey) const
-{
-  OSObject *theObject;
-
-  theObject = copyProperty(aKey);
-  if (theObject) theObject->release();
-
   return theObject;
 }
 
@@ -386,21 +291,19 @@
   if (_ofDict == 0) return false;
   
   // Verify permissions.
-  propPerm = getOFVariablePerm(aKey);
-  result = IOUserClient::clientHasPrivilege(current_task(), kIONVRAMPrivilege);
+  result = IOUserClient::clientHasPrivilege(current_task(), "root");
   if (result != kIOReturnSuccess) {
+    propPerm = getOFVariablePerm(aKey);
     if (propPerm != kOFVariablePermUserWrite) return false;
   }
-  if (propPerm == kOFVariablePermKernelOnly && current_task() != kernel_task) return 0;
-
+  
+  // Don't allow creation of new properties on old world machines.
+  if (getPlatform()->getBootROMType() == 0) {
+    if (_ofDict->getObject(aKey) == 0) return false;
+  }
+  
   // Don't allow change of 'aapl,panic-info'.
   if (aKey->isEqualTo(kIODTNVRAMPanicInfoKey)) return false;
-
-#if CONFIG_MACF
-  if (current_task() != kernel_task &&
-      mac_iokit_check_nvram_set(kauth_cred_get(), aKey->getCStringNoCopy(), anObject) != 0)
-    return false;
-#endif
   
   // Make sure the object is of the correct type.
   propType = getOFVariableType(aKey);
@@ -430,54 +333,18 @@
   }
   
   if (propObject == 0) return false;
-
-  IOLockLock(_ofLock);
+  
   result = _ofDict->setObject(aKey, propObject);
-  IOLockUnlock(_ofLock);
-
+  
   if (result) {
-    syncOFVariables();
+    if (getPlatform()->getBootROMType() == 0) {
+      updateOWBootArgs(aKey, propObject);
+    }
+    
+    _ofImageDirty = true;
   }
   
   return result;
-}
-
-void IODTNVRAM::removeProperty(const OSSymbol *aKey)
-{
-  bool     result;
-  UInt32   propPerm;
-  
-  if (_ofDict == 0) return;
-  
-  // Verify permissions.
-  propPerm = getOFVariablePerm(aKey);
-  result = IOUserClient::clientHasPrivilege(current_task(), kIOClientPrivilegeAdministrator);
-  if (result != kIOReturnSuccess) {
-    if (propPerm != kOFVariablePermUserWrite) return;
-  }
-  if (propPerm == kOFVariablePermKernelOnly && current_task() != kernel_task) return;
-  
-  // Don't allow change of 'aapl,panic-info'.
-  if (aKey->isEqualTo(kIODTNVRAMPanicInfoKey)) return;
-  
-#if CONFIG_MACF
-  if (current_task() != kernel_task &&
-      mac_iokit_check_nvram_delete(kauth_cred_get(), aKey->getCStringNoCopy()) != 0)
-    return;
-#endif
-
-  // If the object exists, remove it from the dictionary.
-
-  IOLockLock(_ofLock);
-  result = _ofDict->getObject(aKey) != 0;
-  if (result) {
-    _ofDict->removeObject(aKey);
-  }
-  IOLockUnlock(_ofLock);
-
-  if (result) {
-    syncOFVariables();
-  }
 }
 
 IOReturn IODTNVRAM::setProperties(OSObject *properties)
@@ -485,7 +352,6 @@
   bool                 result = true;
   OSObject             *object;
   const OSSymbol       *key;
-  const OSString       *tmpStr;
   OSDictionary         *dict;
   OSCollectionIterator *iter;
   
@@ -502,34 +368,7 @@
     object = dict->getObject(key);
     if (object == 0) continue;
     
-    if (key->isEqualTo(kIONVRAMDeletePropertyKey)) {
-		tmpStr = OSDynamicCast(OSString, object);
-		if (tmpStr != 0) {
-			key = OSSymbol::withString(tmpStr);
-			removeProperty(key);
-			key->release();
-			result = true;
-		} else {
-			result = false;
-		}
-    } else if(key->isEqualTo(kIONVRAMSyncNowPropertyKey) || key->isEqualTo(kIONVRAMForceSyncNowPropertyKey)) {
-		tmpStr = OSDynamicCast(OSString, object);
-		if (tmpStr != 0) {
-
-			result = true;
-
-      // We still want to throttle NVRAM commit rate for SyncNow. ForceSyncNow is provided as a really big hammer.
-
-			syncInternal(key->isEqualTo(kIONVRAMSyncNowPropertyKey));
-
-		} else {
-			result = false;
-		}
-	}
-	else {
-		result = setProperty(key, object);
-    }
-
+    result = setProperty(key, object);
   }
   
   iter->release();
@@ -541,13 +380,31 @@
 IOReturn IODTNVRAM::readXPRAM(IOByteCount offset, UInt8 *buffer,
 			      IOByteCount length)
 {
-  return kIOReturnUnsupported;
+  if (_xpramImage == 0) return kIOReturnUnsupported;
+  
+  if ((buffer == 0) || (length <= 0) || (offset < 0) ||
+      (offset + length > kIODTNVRAMXPRAMSize))
+    return kIOReturnBadArgument;
+  
+  bcopy(_nvramImage + _xpramPartitionOffset + offset, buffer, length);
+
+  return kIOReturnSuccess;
 }
 
 IOReturn IODTNVRAM::writeXPRAM(IOByteCount offset, UInt8 *buffer,
 			       IOByteCount length)
 {
-  return kIOReturnUnsupported;
+  if (_xpramImage == 0) return kIOReturnUnsupported;
+  
+  if ((buffer == 0) || (length <= 0) || (offset < 0) ||
+      (offset + length > kIODTNVRAMXPRAMSize))
+    return kIOReturnBadArgument;
+  
+  bcopy(buffer, _nvramImage + _xpramPartitionOffset + offset, length);
+
+  _nvramImageDirty = true;
+  
+  return kIOReturnSuccess;
 }
 
 IOReturn IODTNVRAM::readNVRAMProperty(IORegistryEntry *entry,
@@ -556,7 +413,10 @@
 {
   IOReturn err;
 
-  err = readNVRAMPropertyType1(entry, name, value);
+  if (getPlatform()->getBootROMType())
+    err = readNVRAMPropertyType1(entry, name, value);
+  else
+    err = readNVRAMPropertyType0(entry, name, value);
   
   return err;
 }
@@ -567,7 +427,10 @@
 {
   IOReturn err;
   
-  err = writeNVRAMPropertyType1(entry, name, value);
+  if (getPlatform()->getBootROMType())
+    err = writeNVRAMPropertyType1(entry, name, value);
+  else
+    err = writeNVRAMPropertyType0(entry, name, value);
   
   return err;
 }
@@ -595,7 +458,7 @@
   partitionOffset = partitionOffsetNumber->unsigned32BitValue();
   partitionLength = partitionLengthNumber->unsigned32BitValue();
   
-  if ((buffer == 0) || (length == 0) ||
+  if ((buffer == 0) || (length <= 0) || (offset < 0) ||
       (offset + length > partitionLength))
     return kIOReturnBadArgument;
   
@@ -622,20 +485,18 @@
   partitionOffset = partitionOffsetNumber->unsigned32BitValue();
   partitionLength = partitionLengthNumber->unsigned32BitValue();
   
-  if ((buffer == 0) || (length == 0) ||
+  if ((buffer == 0) || (length <= 0) || (offset < 0) ||
       (offset + length > partitionLength))
     return kIOReturnBadArgument;
   
   bcopy(buffer, _nvramImage + partitionOffset + offset, length);
   
-  if (_nvramController != 0) {
-    _nvramController->write(0, _nvramImage, kIODTNVRAMImageSize);
-  }
+  _nvramImageDirty = true;
   
   return kIOReturnSuccess;
 }
 
-IOByteCount IODTNVRAM::savePanicInfo(UInt8 *buffer, IOByteCount length)
+UInt32 IODTNVRAM::savePanicInfo(UInt8 *buffer, IOByteCount length)
 {
   if ((_piImage == 0) || (length <= 0)) return 0;
   
@@ -648,18 +509,10 @@
   // Save the Panic Info length.
   *(UInt32 *)_piImage = length;
   
-  if (_nvramController != 0) {
-    _nvramController->write(0, _nvramImage, kIODTNVRAMImageSize);
-  }
-  /* 
-   * This prevents OF variables from being committed if the system has panicked
-   */
+  _nvramImageDirty = true;
+  
   _systemPaniced = true;
-  /* The call to sync() forces the NVRAM controller to write the panic info
-   * partition to NVRAM.
-   */
-  sync();
-
+  
   return length;
 }
 
@@ -678,144 +531,285 @@
   return csum;
 }
 
+struct OWVariablesHeader {
+  UInt16   owMagic;
+  UInt8    owVersion;
+  UInt8    owPages;
+  UInt16   owChecksum;
+  UInt16   owHere;
+  UInt16   owTop;
+  UInt16   owNext;
+  UInt32   owFlags;
+  UInt32   owNumbers[9];
+  struct {
+    UInt16 offset;
+    UInt16 length;
+  }        owStrings[10];
+};
+typedef struct OWVariablesHeader OWVariablesHeader;
+
 IOReturn IODTNVRAM::initOFVariables(void)
 {
-  UInt32            cnt;
+  UInt32            cnt, propOffset, propType;
   UInt8             *propName, *propData;
   UInt32            propNameLength, propDataLength;
   const OSSymbol    *propSymbol;
   OSObject          *propObject;
+  OWVariablesHeader *owHeader;
 
   if (_ofImage == 0) return kIOReturnNotReady;
   
-  _ofDict = OSDictionary::withCapacity(1);
-  _ofLock = IOLockAlloc();
-  if (!_ofDict || !_ofLock) return kIOReturnNoMemory;
-  
-  cnt = 0;
-  while (cnt < _ofPartitionSize) {
-    // Break if there is no name.
-    if (_ofImage[cnt] == '\0') break;
-    
-    // Find the length of the name.
-    propName = _ofImage + cnt;
-    for (propNameLength = 0; (cnt + propNameLength) < _ofPartitionSize;
-	 propNameLength++) {
-      if (_ofImage[cnt + propNameLength] == '=') break;
-    }
-    
-    // Break if the name goes past the end of the partition.
-    if ((cnt + propNameLength) >= _ofPartitionSize) break;
-    cnt += propNameLength + 1;
-    
-    propData = _ofImage + cnt;
-    for (propDataLength = 0; (cnt + propDataLength) < _ofPartitionSize;
-	 propDataLength++) {
-      if (_ofImage[cnt + propDataLength] == '\0') break;
-    }
-    
-    // Break if the data goes past the end of the partition.
-    if ((cnt + propDataLength) >= _ofPartitionSize) break;
-    cnt += propDataLength + 1;
-    
-    if (convertPropToObject(propName, propNameLength,
-			    propData, propDataLength,
-			    &propSymbol, &propObject)) {
+  _ofDict =  OSDictionary::withCapacity(1);
+  if (_ofDict == 0) return kIOReturnNoMemory;
+  
+  if (getPlatform()->getBootROMType()) {
+    cnt = 0;
+    while (cnt < _ofPartitionSize) {
+      // Break if there is no name.
+      if (_ofImage[cnt] == '\0') break;
+      
+      // Find the length of the name.
+      propName = _ofImage + cnt;
+      for (propNameLength = 0; (cnt + propNameLength) < _ofPartitionSize;
+	   propNameLength++) {
+	if (_ofImage[cnt + propNameLength] == '=') break;
+      }
+      
+      // Break if the name goes past the end of the partition.
+      if ((cnt + propNameLength) >= _ofPartitionSize) break;
+      cnt += propNameLength + 1;
+      
+      propData = _ofImage + cnt;
+      for (propDataLength = 0; (cnt + propDataLength) < _ofPartitionSize;
+	   propDataLength++) {
+	if (_ofImage[cnt + propDataLength] == '\0') break;
+      }
+      
+      // Break if the data goes past the end of the partition.
+      if ((cnt + propDataLength) >= _ofPartitionSize) break;
+      cnt += propDataLength + 1;
+      
+      if (convertPropToObject(propName, propNameLength,
+			      propData, propDataLength,
+			      &propSymbol, &propObject)) {
+	_ofDict->setObject(propSymbol, propObject);
+	propSymbol->release();
+	propObject->release();
+      }
+    }
+    
+    // Create the boot-args property if it is not in the dictionary.
+    if (_ofDict->getObject("boot-args") == 0) {
+      propObject = OSString::withCStringNoCopy("");
+      if (propObject != 0) {
+	_ofDict->setObject("boot-args", propObject);
+	propObject->release();
+      }
+    }
+    
+    // Create the 'aapl,panic-info' property if needed.
+    if (_piImage != 0) {
+      propDataLength = *(UInt32 *)_piImage;
+      if ((propDataLength != 0) && (propDataLength < (_piPartitionSize - 4))) {
+	propObject = OSData::withBytes(_piImage + 4, propDataLength);
+	_ofDict->setObject(kIODTNVRAMPanicInfoKey, propObject);
+	propObject->release();
+	
+	// Clear the length from _piImage and mark dirty.
+	*(UInt32 *)_piImage = 0;
+	_nvramImageDirty = true;
+      }
+    }
+  } else {
+    owHeader = (OWVariablesHeader *)_ofImage;
+    if (!validateOWChecksum(_ofImage)) {
+      _ofDict->release();
+      _ofDict = 0;
+      return kIOReturnBadMedia;
+    }
+    
+    cnt = 0;
+    while (1) {
+      if (!getOWVariableInfo(cnt++, &propSymbol, &propType, &propOffset))
+	break;
+      
+      switch (propType) {
+      case kOFVariableTypeBoolean :
+	propObject = OSBoolean::withBoolean(owHeader->owFlags & propOffset);
+	break;
+	
+      case kOFVariableTypeNumber :
+	propObject = OSNumber::withNumber(owHeader->owNumbers[propOffset], 32);
+	break;
+	
+      case kOFVariableTypeString :
+	propData = _ofImage + owHeader->owStrings[propOffset].offset -
+	  _ofPartitionOffset;
+	propDataLength = owHeader->owStrings[propOffset].length;
+	propName = IONew(UInt8, propDataLength + 1);
+	if (propName != 0) {
+	  strncpy((char *)propName, (const char *)propData, propDataLength);
+	  propName[propDataLength] = '\0';
+	  propObject = OSString::withCString((const char *)propName);
+	  IODelete(propName, UInt8, propDataLength + 1);
+	}
+	break;
+      }
+      
+      if (propObject == 0) break;
+      
       _ofDict->setObject(propSymbol, propObject);
       propSymbol->release();
       propObject->release();
     }
-  }
-  
-  // Create the boot-args property if it is not in the dictionary.
-  if (_ofDict->getObject("boot-args") == 0) {
-    propObject = OSString::withCStringNoCopy("");
-    if (propObject != 0) {
-      _ofDict->setObject("boot-args", propObject);
-      propObject->release();
-    }
-  }
-  
-  // Create the 'aapl,panic-info' property if needed.
-  if (_piImage != 0) {
-    propDataLength = *(UInt32 *)_piImage;
-    if ((propDataLength != 0) && (propDataLength <= (_piPartitionSize - 4))) {
-      propObject = OSData::withBytes(_piImage + 4, propDataLength);
-      _ofDict->setObject(kIODTNVRAMPanicInfoKey, propObject);
-      propObject->release();
-      
-      // Clear the length from _piImage and mark dirty.
-      *(UInt32 *)_piImage = 0;
-      if (_nvramController != 0) {
-        _nvramController->write(0, _nvramImage, kIODTNVRAMImageSize);
+    
+    // Create the boot-args property.
+    propSymbol = OSSymbol::withCString("boot-command");
+    if (propSymbol != 0) {
+      propObject = _ofDict->getObject(propSymbol);
+      if (propObject != 0) {
+	updateOWBootArgs(propSymbol, propObject);
       }
-    }
-  }
-
+      propSymbol->release();
+    }
+  }
+  
   return kIOReturnSuccess;
 }
 
 IOReturn IODTNVRAM::syncOFVariables(void)
 {
   bool                 ok;
-  UInt32               length, maxLength;
-  UInt8                *buffer, *tmpBuffer;
+  UInt32               cnt, length, maxLength;
+  UInt32               curOffset, tmpOffset, tmpType, tmpDataLength;
+  UInt8                *buffer, *tmpBuffer, *tmpData;
   const OSSymbol       *tmpSymbol;
   OSObject             *tmpObject;
+  OSBoolean            *tmpBoolean;
+  OSNumber             *tmpNumber;
+  OSString             *tmpString;
   OSCollectionIterator *iter;
-  
-  if ((_ofImage == 0) || (_ofDict == 0) || _systemPaniced) return kIOReturnNotReady;
-  
-  buffer = tmpBuffer = IONew(UInt8, _ofPartitionSize);
-  if (buffer == 0) return kIOReturnNoMemory;
-  bzero(buffer, _ofPartitionSize);
-  
-  ok = true;
-  maxLength = _ofPartitionSize;
-
-  IOLockLock(_ofLock);
-  iter = OSCollectionIterator::withCollection(_ofDict);
-  if (iter == 0) ok = false;
-  
-  while (ok) {
-    tmpSymbol = OSDynamicCast(OSSymbol, iter->getNextObject());
-    if (tmpSymbol == 0) break;
-    
-    // Don't save 'aapl,panic-info'.
-    if (tmpSymbol->isEqualTo(kIODTNVRAMPanicInfoKey)) continue;
-    
-    tmpObject = _ofDict->getObject(tmpSymbol);
-    
-    length = maxLength;
-    ok = convertObjectToProp(tmpBuffer, &length, tmpSymbol, tmpObject);
+  OWVariablesHeader    *owHeader, *owHeaderOld;
+  
+  if ((_ofImage == 0) || (_ofDict == 0)) return kIOReturnNotReady;
+  
+  if (!_ofImageDirty) return kIOReturnSuccess;
+  
+  if (getPlatform()->getBootROMType()) {
+    buffer = tmpBuffer = IONew(UInt8, _ofPartitionSize);
+    if (buffer == 0) return kIOReturnNoMemory;
+    bzero(buffer, _ofPartitionSize);
+    
+    ok = true;
+    maxLength = _ofPartitionSize;
+    
+    iter = OSCollectionIterator::withCollection(_ofDict);
+    if (iter == 0) ok = false;
+    
+    while (ok) {
+      tmpSymbol = OSDynamicCast(OSSymbol, iter->getNextObject());
+      if (tmpSymbol == 0) break;
+      
+      // Don't save 'aapl,panic-info'.
+      if (tmpSymbol->isEqualTo(kIODTNVRAMPanicInfoKey)) continue;
+      
+      tmpObject = _ofDict->getObject(tmpSymbol);
+      
+      length = maxLength;
+      ok = convertObjectToProp(tmpBuffer, &length, tmpSymbol, tmpObject);
+      if (ok) {
+	tmpBuffer += length;
+	maxLength -= length;
+      }
+    }
+    iter->release();
+    
     if (ok) {
-      tmpBuffer += length;
-      maxLength -= length;
-    }
-  }
-  iter->release();
-  IOLockUnlock(_ofLock);
-  
-  if (ok) {
-    bcopy(buffer, _ofImage, _ofPartitionSize);
-  }
-  
-  IODelete(buffer, UInt8, _ofPartitionSize);
-  
-  if (!ok) return kIOReturnBadArgument;
-  
-  if (_nvramController != 0) {
-    _nvramController->write(0, _nvramImage, kIODTNVRAMImageSize);
-  }
+      bcopy(buffer, _ofImage, _ofPartitionSize);
+    }
+    
+    IODelete(buffer, UInt8, _ofPartitionSize);
+    
+    if (!ok) return kIOReturnBadArgument;
+  } else {
+    buffer = IONew(UInt8, _ofPartitionSize);
+    if (buffer == 0) return kIOReturnNoMemory;
+    bzero(buffer, _ofPartitionSize);
+    
+    owHeader    = (OWVariablesHeader *)buffer;
+    owHeaderOld = (OWVariablesHeader *)_ofImage;
+    
+    owHeader->owMagic = owHeaderOld->owMagic;
+    owHeader->owVersion = owHeaderOld->owVersion;
+    owHeader->owPages = owHeaderOld->owPages;
+    
+    curOffset = _ofPartitionSize;
+    
+    ok = true;
+    cnt = 0;
+    while (ok) {
+      if (!getOWVariableInfo(cnt++, &tmpSymbol, &tmpType, &tmpOffset))
+	break;
+      
+      tmpObject = _ofDict->getObject(tmpSymbol);
+      
+      switch (tmpType) {
+      case kOFVariableTypeBoolean :
+	tmpBoolean = OSDynamicCast(OSBoolean, tmpObject);
+	if (tmpBoolean->getValue()) owHeader->owFlags |= tmpOffset;
+	break;
+	
+      case kOFVariableTypeNumber :
+	tmpNumber = OSDynamicCast(OSNumber, tmpObject);
+	owHeader->owNumbers[tmpOffset] = tmpNumber->unsigned32BitValue();
+        break;
+	
+      case kOFVariableTypeString :
+	tmpString = OSDynamicCast(OSString, tmpObject);
+	tmpData = (UInt8 *) tmpString->getCStringNoCopy();
+	tmpDataLength = tmpString->getLength();
+	
+	if ((curOffset - tmpDataLength) < sizeof(OWVariablesHeader)) {
+	  ok = false;
+	  break;
+	}
+	
+	owHeader->owStrings[tmpOffset].length = tmpDataLength;
+	curOffset -= tmpDataLength;
+	owHeader->owStrings[tmpOffset].offset = curOffset + _ofPartitionOffset;
+	if (tmpDataLength != 0)
+	  bcopy(tmpData, buffer + curOffset, tmpDataLength);
+	break;
+      }
+    }
+    
+    if (ok) {
+      owHeader->owHere = _ofPartitionOffset + sizeof(OWVariablesHeader);
+      owHeader->owTop = _ofPartitionOffset + curOffset;
+      owHeader->owNext = 0;
+      
+      owHeader->owChecksum = 0;
+      owHeader->owChecksum = ~generateOWChecksum(buffer);
+      
+      bcopy(buffer, _ofImage, _ofPartitionSize);
+    }
+    
+    IODelete(buffer, UInt8, _ofPartitionSize);
+    
+    if (!ok) return kIOReturnBadArgument;
+  }
+  
+  _ofImageDirty = false;
+  _nvramImageDirty = true;
   
   return kIOReturnSuccess;
 }
 
 struct OFVariable {
-  const char *variableName;
-  UInt32     variableType;
-  UInt32     variablePerm;
-  SInt32     variableOffset;
+  char   *variableName;
+  UInt32 variableType;
+  UInt32 variablePerm;
+  SInt32 variableOffset;
 };
 typedef struct OFVariable OFVariable;
 
@@ -870,8 +864,6 @@
   {"aapl,pci", kOFVariableTypeData, kOFVariablePermRootOnly, -1},
   {"security-mode", kOFVariableTypeString, kOFVariablePermUserRead, -1},
   {"security-password", kOFVariableTypeData, kOFVariablePermRootOnly, -1},
-  {"boot-image", kOFVariableTypeData, kOFVariablePermUserWrite, -1},
-  {"com.apple.System.fp-state", kOFVariableTypeData, kOFVariablePermKernelOnly, -1},
   {0, kOFVariableTypeData, kOFVariablePermUserRead, -1}
 };
 
@@ -998,7 +990,7 @@
 bool IODTNVRAM::convertObjectToProp(UInt8 *buffer, UInt32 *length,
 				    const OSSymbol *propSymbol, OSObject *propObject)
 {
-  const UInt8    *propName;
+  UInt8          *propName;
   UInt32         propNameLength, propDataLength;
   UInt32         propType, tmpValue;
   OSBoolean      *tmpBoolean = 0;
@@ -1006,7 +998,7 @@
   OSString       *tmpString = 0;
   OSData         *tmpData = 0;
   
-  propName = (const UInt8 *)propSymbol->getCStringNoCopy();
+  propName = (UInt8 *)propSymbol->getCStringNoCopy();
   propNameLength = propSymbol->getLength();
   propType = getOFVariableType(propSymbol);
   
@@ -1042,30 +1034,31 @@
   if ((propNameLength + propDataLength + 2) > *length) return false;
   
   // Copy the property name equal sign.
-  buffer += snprintf((char *)buffer, *length, "%s=", propName);
+  sprintf((char *)buffer, "%s=", propName);
+  buffer += propNameLength + 1;
   
   switch (propType) {
   case kOFVariableTypeBoolean :
     if (tmpBoolean->getValue()) {
-      strlcpy((char *)buffer, "true", *length - propNameLength);
+      strcpy((char *)buffer, "true");
     } else {
-      strlcpy((char *)buffer, "false", *length - propNameLength);
+      strcpy((char *)buffer, "false");
     }
     break;
     
   case kOFVariableTypeNumber :
     tmpValue = tmpNumber->unsigned32BitValue();
     if (tmpValue == 0xFFFFFFFF) {
-      strlcpy((char *)buffer, "-1", *length - propNameLength);
+      strcpy((char *)buffer, "-1");
     } else if (tmpValue < 1000) {
-      snprintf((char *)buffer, *length - propNameLength, "%d", (uint32_t)tmpValue);
+      sprintf((char *)buffer, "%ld", tmpValue);
     } else {
-      snprintf((char *)buffer, *length - propNameLength, "0x%x", (uint32_t)tmpValue);
+      sprintf((char *)buffer, "0x%lx", tmpValue);
     }
     break;
     
   case kOFVariableTypeString :
-    strlcpy((char *)buffer, tmpString->getCStringNoCopy(), *length - propNameLength);
+    strcpy((char *)buffer, tmpString->getCStringNoCopy());
     break;
     
   case kOFVariableTypeData :
@@ -1110,12 +1103,11 @@
 
 void IODTNVRAM::updateOWBootArgs(const OSSymbol *key, OSObject *value)
 {
-  bool        wasBootArgs, bootr = false;
-  UInt32      cnt;
-  OSString    *tmpString, *bootCommand, *bootArgs = 0;
-  const UInt8 *bootCommandData, *bootArgsData;
-  UInt8       *tmpData;
-  UInt32      bootCommandDataLength, bootArgsDataLength, tmpDataLength;
+  bool     wasBootArgs, bootr = false;
+  UInt32   cnt;
+  OSString *tmpString, *bootCommand, *bootArgs = 0;
+  UInt8    *bootCommandData, *bootArgsData, *tmpData;
+  UInt32   bootCommandDataLength, bootArgsDataLength, tmpDataLength;
   
   tmpString = OSDynamicCast(OSString, value);
   if (tmpString == 0) return;
@@ -1130,7 +1122,7 @@
     if (bootCommand == 0) return;
   } else return;
   
-  bootCommandData = (const UInt8 *)bootCommand->getCStringNoCopy();
+  bootCommandData = (UInt8 *)bootCommand->getCStringNoCopy();
   bootCommandDataLength = bootCommand->getLength();
   
   if (bootCommandData == 0) return;
@@ -1150,7 +1142,7 @@
   }
   
   if (wasBootArgs) {
-    bootArgsData = (const UInt8 *)bootArgs->getCStringNoCopy();
+    bootArgsData = (UInt8 *)bootArgs->getCStringNoCopy();
     bootArgsDataLength = bootArgs->getLength();
     if (bootArgsData == 0) return;
     
@@ -1158,8 +1150,9 @@
     tmpData = IONew(UInt8, tmpDataLength + 1);
     if (tmpData == 0) return;
     
-    cnt -= strlcpy((char *)tmpData, (const char *)bootCommandData, cnt);
-    strlcat((char *)tmpData, (const char *)bootArgsData, cnt);
+    strncpy((char *)tmpData, (const char *)bootCommandData, cnt);
+    tmpData[cnt] = '\0';
+    strcat((char *)tmpData, (const char *)bootArgsData);
     
     bootCommand = OSString::withCString((const char *)tmpData);
     if (bootCommand != 0) {
@@ -1177,8 +1170,55 @@
   }
 }
 
+
+// Private methods for Name Registry access.
+
+enum {
+  kMaxNVNameLength = 4,
+  kMaxNVDataLength = 8
+};
+
+#pragma options align=mac68k
+struct NVRAMProperty
+{
+  IONVRAMDescriptor   header;
+  UInt8               nameLength;
+  UInt8               name[ kMaxNVNameLength ];
+  UInt8               dataLength;
+  UInt8               data[ kMaxNVDataLength ];
+};
+#pragma options align=reset
+
 bool IODTNVRAM::searchNVRAMProperty(IONVRAMDescriptor *hdr, UInt32 *where)
 {
+  UInt32 offset;
+  SInt32 nvEnd;
+  
+  nvEnd = *((UInt16 *)_nrImage);
+  if(getPlatform()->getBootROMType()) {
+    // on NewWorld, offset to partition start
+    nvEnd -= 0x100;
+  } else {
+    // on old world, absolute
+    nvEnd -= _nrPartitionOffset;
+  }
+  if((nvEnd < 0) || (nvEnd >= kIODTNVRAMNameRegistrySize))
+    nvEnd = 2;
+  
+  offset = 2;
+  while ((offset + sizeof(NVRAMProperty)) <= (UInt32)nvEnd) {
+    if (bcmp(_nrImage + offset, hdr, sizeof(*hdr)) == 0) {
+      *where = offset;
+      return true;
+    }
+    offset += sizeof(NVRAMProperty);
+  }
+  
+  if ((nvEnd + sizeof(NVRAMProperty)) <= kIODTNVRAMNameRegistrySize)
+    *where = nvEnd;
+  else
+    *where = 0;
+  
   return false;
 }
 
@@ -1186,19 +1226,89 @@
 					   const OSSymbol **name,
 					   OSData **value)
 {
-  return kIOReturnUnsupported;
-}
-
+  IONVRAMDescriptor hdr;
+  NVRAMProperty     *prop;
+  IOByteCount       length;
+  UInt32            offset;
+  IOReturn          err;
+  char              nameBuf[kMaxNVNameLength + 1];
+  
+  if (_nrImage == 0) return kIOReturnUnsupported;
+  if ((entry == 0) || (name == 0) || (value == 0)) return kIOReturnBadArgument;
+  
+  err = IODTMakeNVDescriptor(entry, &hdr);
+  if (err != kIOReturnSuccess) return err;
+  
+  if (searchNVRAMProperty(&hdr, &offset)) {
+    prop = (NVRAMProperty *)(_nrImage + offset);
+    
+    length = prop->nameLength;
+    if (length > kMaxNVNameLength) length = kMaxNVNameLength;
+    strncpy(nameBuf, (const char *)prop->name, length);
+    nameBuf[length] = 0;
+    *name = OSSymbol::withCString(nameBuf);
+    
+    length = prop->dataLength;
+    if (length > kMaxNVDataLength) length = kMaxNVDataLength;
+    *value = OSData::withBytes(prop->data, length);
+    
+    if ((*name != 0) && (*value != 0)) return kIOReturnSuccess;
+    else return kIOReturnNoMemory;
+  }
+  
+  return kIOReturnNoResources;
+}
 
 IOReturn IODTNVRAM::writeNVRAMPropertyType0(IORegistryEntry *entry,
 					    const OSSymbol *name,
 					    OSData *value)
 {
-  return kIOReturnUnsupported;
-}
-
-
-OSData *IODTNVRAM::unescapeBytesToData(const UInt8 *bytes, UInt32 length)
+  IONVRAMDescriptor hdr;
+  NVRAMProperty     *prop;
+  IOByteCount       nameLength;
+  IOByteCount       dataLength;
+  UInt32            offset;
+  IOReturn          err;
+  UInt16            nvLength;
+  bool              exists;
+  
+  if (_nrImage == 0) return kIOReturnUnsupported;
+  if ((entry == 0) || (name == 0) || (value == 0)) return kIOReturnBadArgument;
+  
+  nameLength = name->getLength();
+  dataLength = value->getLength();
+  if (nameLength > kMaxNVNameLength) return kIOReturnNoSpace;
+  if (dataLength > kMaxNVDataLength) return kIOReturnNoSpace;
+  
+  err = IODTMakeNVDescriptor(entry, &hdr);
+  if (err != kIOReturnSuccess) return err;
+  
+  exists = searchNVRAMProperty(&hdr, &offset);
+  if (offset == 0) return kIOReturnNoMemory;
+  
+  prop = (NVRAMProperty *)(_nrImage + offset);
+  if (!exists) bcopy(&hdr, &prop->header, sizeof(hdr));
+  
+  prop->nameLength = nameLength;
+  bcopy(name->getCStringNoCopy(), prop->name, nameLength);
+  prop->dataLength = dataLength;
+  bcopy(value->getBytesNoCopy(), prop->data, dataLength);
+  
+  if (!exists) {
+    nvLength = offset + sizeof(NVRAMProperty);
+    if (getPlatform()->getBootROMType())
+      nvLength += 0x100;
+    else
+      nvLength += _nrPartitionOffset;
+    *((UInt16 *)_nrImage) = nvLength;
+  }
+  
+  _nvramImageDirty = true;
+  
+  return err;
+}
+
+OSData *IODTNVRAM::unescapeBytesToData(UInt8 *bytes, UInt32 length)
 {
   OSData *data = 0;
   UInt32 totalLength = 0;
@@ -1245,29 +1355,29 @@
 
 OSData * IODTNVRAM::escapeDataToData(OSData * value)
 {
-  OSData *       result;
-  const UInt8 *  startPtr;
-  const UInt8 *  endPtr;
-  const UInt8 *  wherePtr;
-  UInt8          byte;
-  bool	         ok = true;
-
-  wherePtr = (const UInt8 *) value->getBytesNoCopy();
-  endPtr = wherePtr + value->getLength();
-
-  result = OSData::withCapacity(endPtr - wherePtr);
+  OSData * result;
+  UInt8 *  start;
+  UInt8 *  end;
+  UInt8 *  where;
+  UInt8    byte;
+  bool	   ok = true;
+
+  where = (UInt8 *) value->getBytesNoCopy();
+  end = where + value->getLength();
+
+  result = OSData::withCapacity(end - where);
   if (!result)
     return result;
 
-  while (wherePtr < endPtr) {
-    startPtr = wherePtr;
-    byte = *wherePtr++;
+  while (where < end) {
+    start = where;
+    byte = *where++;
     if ((byte == 0x00) || (byte == 0xFF)) {
       for (;
-            ((wherePtr - startPtr) < 0x80) && (wherePtr < endPtr) && (byte == *wherePtr);
-            wherePtr++)	{}
+            ((where - start) < 0x80) && (where < end) && (byte == *where);
+            where++)	{}
       ok &= result->appendByte(0xff, 1);
-      byte = (byte & 0x80) | (wherePtr - startPtr);
+      byte = (byte & 0x80) | (where - start);
     }
     ok &= result->appendByte(byte, 1);
   }
@@ -1281,81 +1391,51 @@
   return result;
 }
 
-static bool IsApplePropertyName(const char * propName)
-{
-  char c;
-  while ((c = *propName++)) {
-    if ((c >= 'A') && (c <= 'Z'))
-      break;
-  }
-
-  return (c == 0);
-}
-
 IOReturn IODTNVRAM::readNVRAMPropertyType1(IORegistryEntry *entry,
 					   const OSSymbol **name,
 					   OSData **value)
 {
-  IOReturn    err = kIOReturnNoResources;
-  OSData      *data;
-  const UInt8 *startPtr;
-  const UInt8 *endPtr;
-  const UInt8 *wherePtr;
-  const UInt8 *nvPath = 0;
-  const char  *nvName = 0;
-  const char  *resultName = 0;
-  const UInt8 *resultValue = 0;
-  UInt32       resultValueLen = 0;
-  UInt8       byte;
+  IOReturn err = kIOReturnNoResources;
+  OSData   *data;
+  UInt8    *start;
+  UInt8    *end;
+  UInt8    *where;
+  UInt8    *nvPath = 0;
+  UInt8    *nvName = 0;
+  UInt8    byte;
 
   if (_ofDict == 0) return err;
-
-  IOLockLock(_ofLock);
   data = OSDynamicCast(OSData, _ofDict->getObject(_registryPropertiesKey));
-  IOLockUnlock(_ofLock);
-
   if (data == 0) return err;
   
-  startPtr = (const UInt8 *) data->getBytesNoCopy();
-  endPtr = startPtr + data->getLength();
-
-  wherePtr = startPtr;
-  while (wherePtr < endPtr) {
-    byte = *(wherePtr++);
+  start = (UInt8 *) data->getBytesNoCopy();
+  end = start + data->getLength();
+
+  where = start;
+  while (where < end) {
+    byte = *(where++);
     if (byte)
       continue;
     
     if (nvPath == 0)
-      nvPath = startPtr;
+      nvPath = start;
     else if (nvName == 0)
-      nvName = (const char *) startPtr;
-    else {
-      IORegistryEntry * compareEntry = IORegistryEntry::fromPath((const char *) nvPath, gIODTPlane);
-      if (compareEntry)
-        compareEntry->release();
-      if (entry == compareEntry) {
-        bool appleProp = IsApplePropertyName(nvName);
-        if (!appleProp || !resultName) {
-          resultName     = nvName;
-          resultValue    = startPtr;
-          resultValueLen = wherePtr - startPtr - 1;
-        }
-        if (!appleProp)
-          break;
-      }
-      nvPath = 0;
-      nvName = 0;
-    }
-    startPtr = wherePtr;
-  }
-  if (resultName) {
-    *name = OSSymbol::withCString(resultName);
-    *value = unescapeBytesToData(resultValue, resultValueLen);
-    if ((*name != 0) && (*value != 0))
-      err = kIOReturnSuccess;
-    else
-      err = kIOReturnNoMemory;
-  }
+      nvName = start;
+    else if (entry ==
+	     IORegistryEntry::fromPath((const char *) nvPath, gIODTPlane)) {
+      *name = OSSymbol::withCString((const char *) nvName);
+      *value = unescapeBytesToData(start, where - start - 1);
+      if ((*name != 0) && (*value != 0))
+        err = kIOReturnSuccess;
+      else
+        err = kIOReturnNoMemory;
+      break;
+    } else
+      nvPath = nvName = 0;
+    
+    start = where;
+  }
+
   return err;
 }
 
@@ -1363,62 +1443,49 @@
 					    const OSSymbol *propName,
 					    OSData *value)
 {
-  OSData       *oldData;
-  OSData       *data = 0;
-  const UInt8  *startPtr;
-  const UInt8  *propStart;
-  const UInt8  *endPtr;
-  const UInt8  *wherePtr;
-  const UInt8  *nvPath = 0;
-  const char   *nvName = 0;
+  OSData   *oldData;
+  OSData   *data = 0;
+  UInt8    *start;
+  UInt8    *propStart;
+  UInt8    *end;
+  UInt8    *where;
+  UInt8    *nvPath = 0;
+  UInt8    *nvName = 0;
   const char * comp;
   const char * name;
-  UInt8        byte;
-  bool         ok = true;
-  bool         settingAppleProp;
+  UInt8     byte;
+  bool      ok = true;
 
   if (_ofDict == 0) return kIOReturnNoResources;
 
-  settingAppleProp = IsApplePropertyName(propName->getCStringNoCopy());
-
   // copy over existing properties for other entries
-
-  IOLockLock(_ofLock);
 
   oldData = OSDynamicCast(OSData, _ofDict->getObject(_registryPropertiesKey));
   if (oldData) {
-    startPtr = (const UInt8 *) oldData->getBytesNoCopy();
-    endPtr = startPtr + oldData->getLength();
-    
-    propStart = startPtr;
-    wherePtr = startPtr;
-    while (wherePtr < endPtr) {
-      byte = *(wherePtr++);
+    start = (UInt8 *) oldData->getBytesNoCopy();
+    end = start + oldData->getLength();
+    
+    propStart = start;
+    where = start;
+    while (where < end) {
+      byte = *(where++);
       if (byte)
         continue;
       if (nvPath == 0)
-        nvPath = startPtr;
+        nvPath = start;
       else if (nvName == 0)
-        nvName = (const char *) startPtr;
-      else {
-        IORegistryEntry * compareEntry = IORegistryEntry::fromPath((const char *) nvPath, gIODTPlane);
-        if (compareEntry)
-          compareEntry->release();
-        if (entry == compareEntry) {
-          if ((settingAppleProp && propName->isEqualTo(nvName))
-           || (!settingAppleProp && !IsApplePropertyName(nvName))) {
-             // delete old property (nvPath -> wherePtr)
-             data = OSData::withBytes(propStart, nvPath - propStart);
-             if (data)
-               ok &= data->appendBytes(wherePtr, endPtr - wherePtr);
-             break;
-          }
-        }
-        nvPath = 0;
-        nvName = 0;
-      }
+        nvName = start;
+      else if (entry ==
+                IORegistryEntry::fromPath((const char *) nvPath, gIODTPlane)) {
+        // delete old property (nvPath -> where)
+        data = OSData::withBytes(propStart, nvPath - propStart);
+        if (data)
+          ok &= data->appendBytes(where, end - where);
+        break;
+      } else
+        nvPath = nvName = 0;
         
-      startPtr = wherePtr;
+      start = where;
     }
   }
 
@@ -1429,79 +1496,61 @@
       data = OSData::withData(oldData);
     else
       data = OSData::withCapacity(16);
-    if (!data) ok = false;
-  }
-
-  if (ok && value && value->getLength()) do {
-    // get entries in path
-    OSArray *array = OSArray::withCapacity(5);
-    if (!array) {
-      ok = false;
-      break;
-    }
-    do
-      array->setObject(entry);
-    while ((entry = entry->getParentEntry(gIODTPlane)));
-
-    // append path
-    for (int i = array->getCount() - 3;
-	 (entry = (IORegistryEntry *) array->getObject(i));
-	 i--) {
-
-      name = entry->getName(gIODTPlane);
-      comp = entry->getLocation(gIODTPlane);
-      if (comp) ok &= data->appendBytes("/@", 2);
+    if (!data)
+      return kIOReturnNoMemory;
+  }
+
+  // get entries in path
+  OSArray *array = OSArray::withCapacity(5);
+  if (!array) {
+    data->release();
+    return kIOReturnNoMemory;
+  }
+  do
+    array->setObject(entry);
+  while ((entry = entry->getParentEntry(gIODTPlane)));
+
+  // append path
+  for (int i = array->getCount() - 3;
+        (entry = (IORegistryEntry *) array->getObject(i));
+        i--) {
+
+    name = entry->getName(gIODTPlane);
+    comp = entry->getLocation(gIODTPlane);
+    if( comp && (0 == strcmp("pci", name))
+     && (0 == strcmp("80000000", comp))) {
+      // yosemite hack
+      comp = "/pci@80000000";
+    } else {
+      if (comp)
+        ok &= data->appendBytes("/@", 2);
       else {
-	if (!name) continue;
-	ok &= data->appendByte('/', 1);
-	comp = name;
+        if (!name)
+          continue;
+        ok &= data->appendByte('/', 1);
+        comp = name;
       }
-      ok &= data->appendBytes(comp, strlen(comp));
-    }
-    ok &= data->appendByte(0, 1);
-    array->release();
-
-    // append prop name
-    ok &= data->appendBytes(propName->getCStringNoCopy(), propName->getLength() + 1);
-  
-    // append escaped data
-    oldData = escapeDataToData(value);
-    ok &= (oldData != 0);
-    if (ok) ok &= data->appendBytes(oldData);
-
-  } while (false);
+    }
+    ok &= data->appendBytes(comp, strlen(comp));
+  }
+  ok &= data->appendByte(0, 1);
+  array->release();
+
+  // append prop name
+  ok &= data->appendBytes(propName->getCStringNoCopy(), propName->getLength() + 1);
+  
+  // append escaped data
+  oldData = escapeDataToData(value);
+  ok &= (oldData != 0);
+  if (ok)
+    ok &= data->appendBytes(oldData);
 
   if (ok) {
     ok = _ofDict->setObject(_registryPropertiesKey, data);
-  }
-
-  IOLockUnlock(_ofLock);
-  if (data) data->release();
-
-  if (ok) syncOFVariables();
+    if (ok)
+      _ofImageDirty = true;
+  }
+  data->release();
 
   return ok ? kIOReturnSuccess : kIOReturnNoMemory;
 }
-
-bool IODTNVRAM::safeToSync(void)
-{
-    AbsoluteTime delta;
-    UInt64       delta_ns;
-    SInt32       delta_secs;
-	
-	// delta interval went by
-	clock_get_uptime(&delta);
-	
-    // Figure it in seconds.
-    absolutetime_to_nanoseconds(delta, &delta_ns);
-    delta_secs = (SInt32)(delta_ns / NSEC_PER_SEC);
-
-	if ((delta_secs > (_lastDeviceSync + MIN_SYNC_NOW_INTERVAL)) || _freshInterval)
-	{
-		_lastDeviceSync = delta_secs;
-		_freshInterval = FALSE;
-		return TRUE;
-	}
-
-	return FALSE;
-}