--- xnu/xnu-3789.31.2/libkern/c++/OSMetaClass.cpp
+++ xnu/xnu-4903.231.4/libkern/c++/OSMetaClass.cpp
@@ -110,6 +110,7 @@
 struct ExpansionData {
     OSOrderedSet    * instances;
     OSKext          * kext;
+    uint32_t          retain;
 #if IOTRACKING
     IOTrackingQueue * tracking;
 #endif
@@ -147,6 +148,66 @@
     { panic("OSMetaClassBase::_RESERVEDOSMetaClassBase%d called.", 6); }
 #endif
 
+
+/*********************************************************************
+*********************************************************************/
+
+#if defined(__arm__) || defined(__arm64__)
+
+
+
+/*
+IHI0059A "C++ Application Binary Interface Standard for the ARM 64 - bit Architecture":
+
+3.2.1 Representation of pointer to member function The generic C++ ABI [GC++ABI]
+specifies that a pointer to member function is a pair of words <ptr, adj>. The
+least significant bit of ptr discriminates between (0) the address of a non-
+virtual member function and (1) the offset in the class's virtual table of the
+address of a virtual function. This encoding cannot work for the AArch64
+instruction set where the architecture reserves all bits of code addresses. This
+ABI specifies that adj contains twice the this adjustment, plus 1 if the member
+function is virtual. The least significant bit of adj then makes exactly the
+same discrimination as the least significant bit of ptr does for Itanium. A
+pointer to member function is NULL when ptr = 0 and the least significant bit of
+adj is zero.
+*/
+
+OSMetaClassBase::_ptf_t
+OSMetaClassBase::_ptmf2ptf(const OSMetaClassBase *self, void (OSMetaClassBase::*func)(void))
+{
+	typedef long int ptrdiff_t;
+    struct ptmf_t {
+        _ptf_t fPFN;
+        ptrdiff_t delta;
+    };
+    union {
+        void (OSMetaClassBase::*fIn)(void);
+        struct ptmf_t pTMF;
+    } map;
+    _ptf_t pfn;
+
+    map.fIn = func;
+    pfn     = map.pTMF.fPFN;
+
+    if (map.pTMF.delta & 1) {
+        // virtual
+        union {
+            const OSMetaClassBase *fObj;
+            _ptf_t **vtablep;
+        } u;
+        u.fObj = self;
+
+        // Virtual member function so dereference table
+        pfn = *(_ptf_t *)(((uintptr_t)*u.vtablep) + (uintptr_t)pfn);
+        return pfn;
+
+    } else {
+        // Not virtual, i.e. plain member func
+        return pfn;
+    }
+}
+
+#endif /* defined(__arm__) || defined(__arm64__) */
 /*********************************************************************
 * These used to be inline in the header but gcc didn't believe us
 * Now we MUST pull the inline out at least until the compiler is
@@ -465,7 +526,7 @@
         if (myKext) {
             sAllClassesDict->removeObject(className);
         } else {
-            sAllClassesDict->removeObject((char *)className);
+            sAllClassesDict->removeObject((const char *)className);
         }
     }
     IOLockUnlock(sAllClassesLock);
@@ -656,7 +717,11 @@
                    /* Log this error here so we can include the class name.
                     * xxx - we should look up the other kext that defines the class
                     */
+#if CONFIG_EMBEDDED
+                    panic(
+#else
                     OSKextLog(myKext, kOSMetaClassLogSpec,
+#endif /* CONFIG_EMBEDDED */
                         "OSMetaClass: Kext %s class %s is a duplicate;"
                         "kext %s already has a class by that name.",
                          sStalled->kextIdentifier, (const char *)me->className,
@@ -946,6 +1011,43 @@
 
 /*********************************************************************
 *********************************************************************/
+bool
+OSMetaClass::removeClasses(OSCollection * metaClasses)
+{
+    OSCollectionIterator * classIterator;
+    OSMetaClass          * checkClass;
+    bool                   result;
+
+    classIterator = OSCollectionIterator::withCollection(metaClasses);
+    if (!classIterator) return (false);
+
+    IOLockLock(sAllClassesLock);
+
+    result = false;
+    do
+    {
+        while ((checkClass = (OSMetaClass *)classIterator->getNextObject())
+            && !checkClass->getInstanceCount()
+            && !checkClass->reserved->retain) {}
+        if (checkClass) break;
+        classIterator->reset();
+        while ((checkClass = (OSMetaClass *)classIterator->getNextObject()))
+        {
+            sAllClassesDict->removeObject(checkClass->className);
+        }
+        result = true;
+    }
+    while (false);
+
+    IOLockUnlock(sAllClassesLock);
+    OSSafeReleaseNULL(classIterator);
+
+    return (result);
+}
+
+
+/*********************************************************************
+*********************************************************************/
 const OSMetaClass *
 OSMetaClass::getMetaClassWithName(const OSSymbol * name)
 {
@@ -966,15 +1068,46 @@
 
 /*********************************************************************
 *********************************************************************/
+const OSMetaClass *
+OSMetaClass::copyMetaClassWithName(const OSSymbol * name)
+{
+    const OSMetaClass * meta;
+
+    if (!name) return (0);
+
+    meta = 0;
+    IOLockLock(sAllClassesLock);
+    if (sAllClassesDict) {
+        meta = (OSMetaClass *) sAllClassesDict->getObject(name);
+        if (meta) OSIncrementAtomic(&meta->reserved->retain);
+    }
+    IOLockUnlock(sAllClassesLock);
+
+    return (meta);
+}
+
+/*********************************************************************
+*********************************************************************/
+void
+OSMetaClass::releaseMetaClass() const
+{
+    OSDecrementAtomic(&reserved->retain);
+}
+
+/*********************************************************************
+*********************************************************************/
 OSObject *
 OSMetaClass::allocClassWithName(const OSSymbol * name)
 {
-    OSObject * result = 0;
-
-    const OSMetaClass * const meta = getMetaClassWithName(name);
-
-    if (meta) {
+    const OSMetaClass * meta;
+    OSObject          * result;
+
+    result = 0;
+    meta = copyMetaClassWithName(name);
+    if (meta)
+    {
         result = meta->alloc();
+        meta->releaseMetaClass();
     }
 
     return result;
@@ -1246,7 +1379,7 @@
 {
     IOTracking * mem = (typeof(mem)) instance; mem--;
 
-    return (IOTrackingAdd(reserved->tracking, mem, classSize, false));
+    return (IOTrackingAdd(reserved->tracking, mem, classSize, false, VM_KERN_MEMORY_NONE));
 }
 
 void OSMetaClass::trackedFree(OSObject * instance) const