xnu-792.25.20.tar.gz

[apple/xnu.git] / iokit / Kernel / IONVRAM.cpp

diff --git a/iokit/Kernel/IONVRAM.cpp b/iokit/Kernel/IONVRAM.cpp
index 703dc94f47daa86189b228547a9b47e5402f2e5b..315aefe11a2dfd5b6dc594f6920545a77cd36652 100644 (file)
--- a/iokit/Kernel/IONVRAM.cpp
+++ b/iokit/Kernel/IONVRAM.cpp
@@ -28,6 +28,10 @@
 
 #define super IOService
 
 
 #define super IOService
 

+#define kIONVRAMPrivilege      kIOClientPrivilegeAdministrator
+//#define kIONVRAMPrivilege    kIOClientPrivilegeLocalUser
+
+

 OSDefineMetaClassAndStructors(IODTNVRAM, IOService);
 
 bool IODTNVRAM::init(IORegistryEntry *old, const IORegistryPlane *plane)
 OSDefineMetaClassAndStructors(IODTNVRAM, IOService);
 
 bool IODTNVRAM::init(IORegistryEntry *old, const IORegistryPlane *plane)


@@ -42,7 +46,13 @@ bool IODTNVRAM::init(IORegistryEntry *old, const IORegistryPlane *plane)
   
   _nvramImage = IONew(UInt8, kIODTNVRAMImageSize);
   if (_nvramImage == 0) return false;
   
   _nvramImage = IONew(UInt8, kIODTNVRAMImageSize);
   if (_nvramImage == 0) return false;

-
+  
+  _nvramPartitionOffsets = OSDictionary::withCapacity(1);
+  if (_nvramPartitionOffsets == 0) return false;
+  
+  _nvramPartitionLengths = OSDictionary::withCapacity(1);
+  if (_nvramPartitionLengths == 0) return false;
+  

   _registryPropertiesKey = OSSymbol::withCStringNoCopy("aapl,pci");
   if (_registryPropertiesKey == 0) return false;
   
   _registryPropertiesKey = OSSymbol::withCStringNoCopy("aapl,pci");
   if (_registryPropertiesKey == 0) return false;
   


@@ -51,7 +61,11 @@ bool IODTNVRAM::init(IORegistryEntry *old, const IORegistryPlane *plane)
 
 void IODTNVRAM::registerNVRAMController(IONVRAMController *nvram)
 {
 
 void IODTNVRAM::registerNVRAMController(IONVRAMController *nvram)
 {

-  UInt32 currentOffset = 0;
+  char   partitionID[18];
+  UInt32 partitionOffset, partitionLength;
+  UInt32 freePartitionOffset, freePartitionSize;
+  UInt32 currentLength, currentOffset = 0;
+  OSNumber *partitionOffsetNumber, *partitionLengthNumber;

   
   if (_nvramController != 0) return;
   
   
   if (_nvramController != 0) return;
   


@@ -59,26 +73,58 @@ void IODTNVRAM::registerNVRAMController(IONVRAMController *nvram)
   
   _nvramController->read(0, _nvramImage, kIODTNVRAMImageSize);
   
   
   _nvramController->read(0, _nvramImage, kIODTNVRAMImageSize);
   

-  // Find the offsets for the OF, XPRAM and NameRegistry partitions in NVRAM.
+  // Find the offsets for the OF, XPRAM, NameRegistry and PanicInfo partitions.

   _ofPartitionOffset = 0xFFFFFFFF;
   _xpramPartitionOffset = 0xFFFFFFFF;
   _nrPartitionOffset = 0xFFFFFFFF;
   _ofPartitionOffset = 0xFFFFFFFF;
   _xpramPartitionOffset = 0xFFFFFFFF;
   _nrPartitionOffset = 0xFFFFFFFF;

+  _piPartitionOffset = 0xFFFFFFFF;
+  freePartitionOffset = 0xFFFFFFFF;
+  freePartitionSize = 0;

   if (getPlatform()->getBootROMType()) {
     // Look through the partitions to find the OF, MacOS partitions.
     while (currentOffset < kIODTNVRAMImageSize) {
   if (getPlatform()->getBootROMType()) {
     // Look through the partitions to find the OF, MacOS partitions.
     while (currentOffset < kIODTNVRAMImageSize) {

-      if (strcmp((const char *)_nvramImage + currentOffset + 4, "common") == 0) {
-       _ofPartitionOffset = currentOffset + 16;
-       _ofPartitionSize =
-         (((UInt16 *)(_nvramImage + currentOffset))[1] - 1) * 0x10;
-      } else if (strcmp((const char *)_nvramImage + currentOffset + 4, "APL,MacOS75") == 0) {
-       _xpramPartitionOffset = currentOffset + 16;
+      currentLength = ((UInt16 *)(_nvramImage + currentOffset))[1] * 16;
+      
+      partitionOffset = currentOffset + 16;
+      partitionLength = currentLength - 16;
+      
+      if (strncmp((const char *)_nvramImage + currentOffset + 4,
+                 kIODTNVRAMOFPartitionName, 12) == 0) {
+       _ofPartitionOffset = partitionOffset;
+       _ofPartitionSize = partitionLength;
+      } else if (strncmp((const char *)_nvramImage + currentOffset + 4,
+                        kIODTNVRAMXPRAMPartitionName, 12) == 0) {
+       _xpramPartitionOffset = partitionOffset;

        _xpramPartitionSize = kIODTNVRAMXPRAMSize;
        _nrPartitionOffset = _xpramPartitionOffset + _xpramPartitionSize;
        _xpramPartitionSize = kIODTNVRAMXPRAMSize;
        _nrPartitionOffset = _xpramPartitionOffset + _xpramPartitionSize;

-       _nrPartitionSize =
-         (((UInt16 *)(_nvramImage + currentOffset))[1] - 1) * 0x10 -
-         _xpramPartitionSize;
+       _nrPartitionSize = partitionLength - _xpramPartitionSize;
+      } else if (strncmp((const char *)_nvramImage + currentOffset + 4,
+                        kIODTNVRAMPanicInfoPartitonName, 12) == 0) {
+       _piPartitionOffset = partitionOffset;
+       _piPartitionSize = partitionLength;
+      } else if (strncmp((const char *)_nvramImage + currentOffset + 4,
+                        kIODTNVRAMFreePartitionName, 12) == 0) {
+       freePartitionOffset = currentOffset;
+       freePartitionSize = currentLength;
+      } else {
+       // Construct the partition ID from the signature and name.
+       sprintf(partitionID, "0x%02x,",
+               *(UInt8 *)(_nvramImage + currentOffset));
+       strncpy(partitionID + 5,
+               (const char *)(_nvramImage + currentOffset + 4), 12);
+       partitionID[17] = '\0';
+       
+       partitionOffsetNumber = OSNumber::withNumber(partitionOffset, 32);
+       partitionLengthNumber = OSNumber::withNumber(partitionLength, 32);
+       
+       // Save the partition offset and length
+       _nvramPartitionOffsets->setObject(partitionID, partitionOffsetNumber);
+       _nvramPartitionLengths->setObject(partitionID, partitionLengthNumber);
+       
+       partitionOffsetNumber->release();
+       partitionLengthNumber->release();

       }
       }

-      currentOffset += ((short *)(_nvramImage + currentOffset))[1] * 16;
+      currentOffset += currentLength;

     }
   } else {
     // Use the fixed address for old world machines.
     }
   } else {
     // Use the fixed address for old world machines.


@@ -97,6 +143,60 @@ void IODTNVRAM::registerNVRAMController(IONVRAMController *nvram)
   if (_nrPartitionOffset != 0xFFFFFFFF)
     _nrImage    = _nvramImage + _nrPartitionOffset;
   
   if (_nrPartitionOffset != 0xFFFFFFFF)
     _nrImage    = _nvramImage + _nrPartitionOffset;
   

+  if (_piPartitionOffset == 0xFFFFFFFF) {
+    if (freePartitionSize > 0x20) {
+      // Set the signature to 0xa1.
+      _nvramImage[freePartitionOffset] = 0xa1;
+      // Set the checksum to 0.
+      _nvramImage[freePartitionOffset + 1] = 0;
+      // Set the name for the Panic Info partition.
+      strncpy((char *)(_nvramImage + freePartitionOffset + 4),
+             kIODTNVRAMPanicInfoPartitonName, 12);
+      
+      // Calculate the partition offset and size.
+      _piPartitionOffset = freePartitionOffset + 0x10;
+      _piPartitionSize = 0x800;
+      if (_piPartitionSize + 0x20 > freePartitionSize)
+       _piPartitionSize = freePartitionSize - 0x20;
+      
+      _piImage = _nvramImage + _piPartitionOffset;
+      
+      // Zero the new partition.
+      bzero(_piImage, _piPartitionSize);
+      
+      // Set the partition size.
+      *(UInt16 *)(_nvramImage + freePartitionOffset + 2) =
+       (_piPartitionSize / 0x10) + 1;
+      
+      // Set the partition checksum.
+      _nvramImage[freePartitionOffset + 1] =
+       calculatePartitionChecksum(_nvramImage + freePartitionOffset);
+      
+      // Calculate the free partition offset and size.
+      freePartitionOffset += _piPartitionSize + 0x10;
+      freePartitionSize -= _piPartitionSize + 0x10;
+      
+      // Set the signature to 0x7f.
+      _nvramImage[freePartitionOffset] = 0x7f;
+      // Set the checksum to 0.
+      _nvramImage[freePartitionOffset + 1] = 0;
+      // Set the name for the free partition.
+      strncpy((char *)(_nvramImage + freePartitionOffset + 4),
+             kIODTNVRAMFreePartitionName, 12);
+      // Set the partition size.
+      *(UInt16 *)(_nvramImage + freePartitionOffset + 2) =
+       freePartitionSize / 0x10;
+      // Set the partition checksum.
+      _nvramImage[freePartitionOffset + 1] =
+       calculatePartitionChecksum(_nvramImage + freePartitionOffset);
+      
+      // Set the nvram image as dirty.
+      _nvramImageDirty = true;
+    }
+  } else {
+    _piImage = _nvramImage + _piPartitionOffset;
+  }
+  

   initOFVariables();
 }
 
   initOFVariables();
 }
 


@@ -104,7 +204,8 @@ void IODTNVRAM::sync(void)
 {
   if (!_nvramImageDirty && !_ofImageDirty) return;
   
 {
   if (!_nvramImageDirty && !_ofImageDirty) return;
   

-  syncOFVariables();
+  // Don't try to sync OF Variables if the system has already paniced.
+  if (!_systemPaniced) syncOFVariables();

   
   _nvramController->write(0, _nvramImage, kIODTNVRAMImageSize);
   _nvramController->sync();
   
   _nvramController->write(0, _nvramImage, kIODTNVRAMImageSize);
   _nvramController->sync();


@@ -112,7 +213,7 @@ void IODTNVRAM::sync(void)
   _nvramImageDirty = false;
 }
 
   _nvramImageDirty = false;
 }
 

-bool IODTNVRAM::serializeProperties(OSSerialize *serialize) const
+bool IODTNVRAM::serializeProperties(OSSerialize *s) const

 {
   bool                 result;
   UInt32               variablePerm;
 {
   bool                 result;
   UInt32               variablePerm;


@@ -123,7 +224,7 @@ bool IODTNVRAM::serializeProperties(OSSerialize *serialize) const
   if (_ofDict == 0) return false;
   
   // Verify permissions.
   if (_ofDict == 0) return false;
   
   // Verify permissions.

-  result = IOUserClient::clientHasPrivilege(current_task(), kIOClientPrivilegeAdministrator);
+  result = IOUserClient::clientHasPrivilege(current_task(), kIONVRAMPrivilege);

   if (result != kIOReturnSuccess) {
     tmpDict = OSDictionary::withCapacity(1);
     if (tmpDict == 0) return false;
   if (result != kIOReturnSuccess) {
     tmpDict = OSDictionary::withCapacity(1);
     if (tmpDict == 0) return false;


@@ -145,7 +246,7 @@ bool IODTNVRAM::serializeProperties(OSSerialize *serialize) const
     dict = _ofDict;
   }
   
     dict = _ofDict;
   }
   

-  result = dict->serialize(serialize);
+  result = dict->serialize(s);

   
   if (tmpDict != 0) tmpDict->release();
   if (iter != 0) iter->release();
   
   if (tmpDict != 0) tmpDict->release();
   if (iter != 0) iter->release();


@@ -161,7 +262,7 @@ OSObject *IODTNVRAM::getProperty(const OSSymbol *aKey) const
   if (_ofDict == 0) return 0;
   
   // Verify permissions.
   if (_ofDict == 0) return 0;
   
   // Verify permissions.

-  result = IOUserClient::clientHasPrivilege(current_task(), "root");
+  result = IOUserClient::clientHasPrivilege(current_task(), kIONVRAMPrivilege);

   if (result != kIOReturnSuccess) {
     variablePerm = getOFVariablePerm(aKey);
     if (variablePerm == kOFVariablePermRootOnly) return 0;
   if (result != kIOReturnSuccess) {
     variablePerm = getOFVariablePerm(aKey);
     if (variablePerm == kOFVariablePermRootOnly) return 0;


@@ -194,7 +295,7 @@ bool IODTNVRAM::setProperty(const OSSymbol *aKey, OSObject *anObject)
   if (_ofDict == 0) return false;
   
   // Verify permissions.
   if (_ofDict == 0) return false;
   
   // Verify permissions.

-  result = IOUserClient::clientHasPrivilege(current_task(), "root");
+  result = IOUserClient::clientHasPrivilege(current_task(), kIONVRAMPrivilege);

   if (result != kIOReturnSuccess) {
     propPerm = getOFVariablePerm(aKey);
     if (propPerm != kOFVariablePermUserWrite) return false;
   if (result != kIOReturnSuccess) {
     propPerm = getOFVariablePerm(aKey);
     if (propPerm != kOFVariablePermUserWrite) return false;


@@ -205,6 +306,9 @@ bool IODTNVRAM::setProperty(const OSSymbol *aKey, OSObject *anObject)
     if (_ofDict->getObject(aKey) == 0) return false;
   }
   
     if (_ofDict->getObject(aKey) == 0) return false;
   }
   

+  // Don't allow change of 'aapl,panic-info'.
+  if (aKey->isEqualTo(kIODTNVRAMPanicInfoKey)) return false;
+  

   // Make sure the object is of the correct type.
   propType = getOFVariableType(aKey);
   switch (propType) {
   // Make sure the object is of the correct type.
   propType = getOFVariableType(aKey);
   switch (propType) {


@@ -247,11 +351,41 @@ bool IODTNVRAM::setProperty(const OSSymbol *aKey, OSObject *anObject)
   return result;
 }
 
   return result;
 }
 

+void IODTNVRAM::removeProperty(const OSSymbol *aKey)
+{
+  bool     result;
+  UInt32   propPerm;
+  
+  if (_ofDict == 0) return;
+  
+  // Verify permissions.
+  result = IOUserClient::clientHasPrivilege(current_task(), kIOClientPrivilegeAdministrator);
+  if (result != kIOReturnSuccess) {
+    propPerm = getOFVariablePerm(aKey);
+    if (propPerm != kOFVariablePermUserWrite) return;
+  }
+  
+  // Don't allow removal of properties on old world machines.
+  if (getPlatform()->getBootROMType() == 0) return;
+  
+  // Don't allow change of 'aapl,panic-info'.
+  if (aKey->isEqualTo(kIODTNVRAMPanicInfoKey)) return;
+  
+  // If the object exists, remove it from the dictionary.
+  result = _ofDict->getObject(aKey) != 0;
+  if (result) {
+    _ofDict->removeObject(aKey);
+    
+    _ofImageDirty = true;
+  }
+}
+

 IOReturn IODTNVRAM::setProperties(OSObject *properties)
 {
   bool                 result = true;
   OSObject             *object;
   const OSSymbol       *key;
 IOReturn IODTNVRAM::setProperties(OSObject *properties)
 {
   bool                 result = true;
   OSObject             *object;
   const OSSymbol       *key;

+  const OSString       *tmpStr;

   OSDictionary         *dict;
   OSCollectionIterator *iter;
   
   OSDictionary         *dict;
   OSCollectionIterator *iter;
   


@@ -268,7 +402,19 @@ IOReturn IODTNVRAM::setProperties(OSObject *properties)
     object = dict->getObject(key);
     if (object == 0) continue;
     
     object = dict->getObject(key);
     if (object == 0) continue;
     

-    result = setProperty(key, object);
+    if (key->isEqualTo(kIONVRAMDeletePropertyKey)) {
+      tmpStr = OSDynamicCast(OSString, object);
+      if (tmpStr != 0) {
+       key = OSSymbol::withString(tmpStr);
+       removeProperty(key);
+       key->release();
+       result = true;
+      } else {
+       result = false;
+      }
+    } else {
+      result = setProperty(key, object);
+    }

   }
   
   iter->release();
   }
   
   iter->release();


@@ -282,7 +428,7 @@ IOReturn IODTNVRAM::readXPRAM(IOByteCount offset, UInt8 *buffer,
 {
   if (_xpramImage == 0) return kIOReturnUnsupported;
   
 {
   if (_xpramImage == 0) return kIOReturnUnsupported;
   

-  if ((buffer == 0) || (length <= 0) || (offset < 0) ||
+  if ((buffer == 0) || (length == 0) ||

       (offset + length > kIODTNVRAMXPRAMSize))
     return kIOReturnBadArgument;
   
       (offset + length > kIODTNVRAMXPRAMSize))
     return kIOReturnBadArgument;
   


@@ -296,7 +442,7 @@ IOReturn IODTNVRAM::writeXPRAM(IOByteCount offset, UInt8 *buffer,
 {
   if (_xpramImage == 0) return kIOReturnUnsupported;
   
 {
   if (_xpramImage == 0) return kIOReturnUnsupported;
   

-  if ((buffer == 0) || (length <= 0) || (offset < 0) ||
+  if ((buffer == 0) || (length == 0) ||

       (offset + length > kIODTNVRAMXPRAMSize))
     return kIOReturnBadArgument;
   
       (offset + length > kIODTNVRAMXPRAMSize))
     return kIOReturnBadArgument;
   


@@ -335,9 +481,101 @@ IOReturn IODTNVRAM::writeNVRAMProperty(IORegistryEntry *entry,
   return err;
 }
 
   return err;
 }
 

+OSDictionary *IODTNVRAM::getNVRAMPartitions(void)
+{
+  return _nvramPartitionLengths;
+}

 
 

+IOReturn IODTNVRAM::readNVRAMPartition(const OSSymbol *partitionID,
+                                      IOByteCount offset, UInt8 *buffer,
+                                      IOByteCount length)
+{
+  OSNumber *partitionOffsetNumber, *partitionLengthNumber;
+  UInt32   partitionOffset, partitionLength;
+  
+  partitionOffsetNumber =
+    (OSNumber *)_nvramPartitionOffsets->getObject(partitionID);
+  partitionLengthNumber =
+    (OSNumber *)_nvramPartitionLengths->getObject(partitionID);
+  
+  if ((partitionOffsetNumber == 0) || (partitionLengthNumber == 0))
+    return kIOReturnNotFound;
+  
+  partitionOffset = partitionOffsetNumber->unsigned32BitValue();
+  partitionLength = partitionLengthNumber->unsigned32BitValue();
+  
+  if ((buffer == 0) || (length == 0) ||
+      (offset + length > partitionLength))
+    return kIOReturnBadArgument;
+  
+  bcopy(_nvramImage + partitionOffset + offset, buffer, length);
+  
+  return kIOReturnSuccess;
+}

 
 

-// Private methods for Open Firmware variable access.
+IOReturn IODTNVRAM::writeNVRAMPartition(const OSSymbol *partitionID,
+                                       IOByteCount offset, UInt8 *buffer,
+                                       IOByteCount length)
+{
+  OSNumber *partitionOffsetNumber, *partitionLengthNumber;
+  UInt32   partitionOffset, partitionLength;
+  
+  partitionOffsetNumber =
+    (OSNumber *)_nvramPartitionOffsets->getObject(partitionID);
+  partitionLengthNumber =
+    (OSNumber *)_nvramPartitionLengths->getObject(partitionID);
+  
+  if ((partitionOffsetNumber == 0) || (partitionLengthNumber == 0))
+    return kIOReturnNotFound;
+  
+  partitionOffset = partitionOffsetNumber->unsigned32BitValue();
+  partitionLength = partitionLengthNumber->unsigned32BitValue();
+  
+  if ((buffer == 0) || (length == 0) ||
+      (offset + length > partitionLength))
+    return kIOReturnBadArgument;
+  
+  bcopy(buffer, _nvramImage + partitionOffset + offset, length);
+  
+  _nvramImageDirty = true;
+  
+  return kIOReturnSuccess;
+}
+
+UInt32 IODTNVRAM::savePanicInfo(UInt8 *buffer, IOByteCount length)
+{
+  if ((_piImage == 0) || (length <= 0)) return 0;
+  
+  if (length > (_piPartitionSize - 4))
+    length = _piPartitionSize - 4;
+  
+  // Save the Panic Info.
+  bcopy(buffer, _piImage + 4, length);
+  
+  // Save the Panic Info length.
+  *(UInt32 *)_piImage = length;
+  
+  _nvramImageDirty = true;
+  
+  _systemPaniced = true;
+  
+  return length;
+}
+
+// Private methods
+
+UInt8 IODTNVRAM::calculatePartitionChecksum(UInt8 *partitionHeader)
+{
+  UInt8 cnt, isum, csum = 0;
+  
+  for (cnt = 0; cnt < 0x10; cnt++) {
+    isum = csum + partitionHeader[cnt];
+    if (isum < csum) isum++;
+    csum = isum;
+  }
+  
+  return csum;
+}

 
 struct OWVariablesHeader {
   UInt16   owMagic;
 
 struct OWVariablesHeader {
   UInt16   owMagic;


@@ -414,6 +652,20 @@ IOReturn IODTNVRAM::initOFVariables(void)
        propObject->release();
       }
     }
        propObject->release();
       }
     }

+    
+    // Create the 'aapl,panic-info' property if needed.
+    if (_piImage != 0) {
+      propDataLength = *(UInt32 *)_piImage;
+      if ((propDataLength != 0) && (propDataLength < (_piPartitionSize - 4))) {
+       propObject = OSData::withBytes(_piImage + 4, propDataLength);
+       _ofDict->setObject(kIODTNVRAMPanicInfoKey, propObject);
+       propObject->release();
+       
+       // Clear the length from _piImage and mark dirty.
+       *(UInt32 *)_piImage = 0;
+       _nvramImageDirty = true;
+      }
+    }

   } else {
     owHeader = (OWVariablesHeader *)_ofImage;
     if (!validateOWChecksum(_ofImage)) {
   } else {
     owHeader = (OWVariablesHeader *)_ofImage;
     if (!validateOWChecksum(_ofImage)) {


@@ -476,7 +728,8 @@ IOReturn IODTNVRAM::syncOFVariables(void)
   bool                 ok;
   UInt32               cnt, length, maxLength;
   UInt32               curOffset, tmpOffset, tmpType, tmpDataLength;
   bool                 ok;
   UInt32               cnt, length, maxLength;
   UInt32               curOffset, tmpOffset, tmpType, tmpDataLength;

-  UInt8                *buffer, *tmpBuffer, *tmpData;
+  UInt8                *buffer, *tmpBuffer;
+  const UInt8          *tmpData;

   const OSSymbol       *tmpSymbol;
   OSObject             *tmpObject;
   OSBoolean            *tmpBoolean;
   const OSSymbol       *tmpSymbol;
   OSObject             *tmpObject;
   OSBoolean            *tmpBoolean;


@@ -504,6 +757,9 @@ IOReturn IODTNVRAM::syncOFVariables(void)
       tmpSymbol = OSDynamicCast(OSSymbol, iter->getNextObject());
       if (tmpSymbol == 0) break;
       
       tmpSymbol = OSDynamicCast(OSSymbol, iter->getNextObject());
       if (tmpSymbol == 0) break;
       

+      // Don't save 'aapl,panic-info'.
+      if (tmpSymbol->isEqualTo(kIODTNVRAMPanicInfoKey)) continue;
+      

       tmpObject = _ofDict->getObject(tmpSymbol);
       
       length = maxLength;
       tmpObject = _ofDict->getObject(tmpSymbol);
       
       length = maxLength;


@@ -557,7 +813,7 @@ IOReturn IODTNVRAM::syncOFVariables(void)
        
       case kOFVariableTypeString :
        tmpString = OSDynamicCast(OSString, tmpObject);
        
       case kOFVariableTypeString :
        tmpString = OSDynamicCast(OSString, tmpObject);

-       tmpData = (UInt8 *) tmpString->getCStringNoCopy();
+       tmpData = (const UInt8 *)tmpString->getCStringNoCopy();

        tmpDataLength = tmpString->getLength();
        
        if ((curOffset - tmpDataLength) < sizeof(OWVariablesHeader)) {
        tmpDataLength = tmpString->getLength();
        
        if ((curOffset - tmpDataLength) < sizeof(OWVariablesHeader)) {


@@ -597,10 +853,10 @@ IOReturn IODTNVRAM::syncOFVariables(void)
 }
 
 struct OFVariable {
 }
 
 struct OFVariable {

-  char   *variableName;
-  UInt32 variableType;
-  UInt32 variablePerm;
-  SInt32 variableOffset;
+  const char *variableName;
+  UInt32     variableType;
+  UInt32     variablePerm;
+  SInt32     variableOffset;

 };
 typedef struct OFVariable OFVariable;
 
 };
 typedef struct OFVariable OFVariable;
 


@@ -655,6 +911,7 @@ OFVariable gOFVariables[] = {
   {"aapl,pci", kOFVariableTypeData, kOFVariablePermRootOnly, -1},
   {"security-mode", kOFVariableTypeString, kOFVariablePermUserRead, -1},
   {"security-password", kOFVariableTypeData, kOFVariablePermRootOnly, -1},
   {"aapl,pci", kOFVariableTypeData, kOFVariablePermRootOnly, -1},
   {"security-mode", kOFVariableTypeString, kOFVariablePermUserRead, -1},
   {"security-password", kOFVariableTypeData, kOFVariablePermRootOnly, -1},

+  {"boot-image", kOFVariableTypeData, kOFVariablePermUserWrite, -1},

   {0, kOFVariableTypeData, kOFVariablePermUserRead, -1}
 };
 
   {0, kOFVariableTypeData, kOFVariablePermUserRead, -1}
 };
 


@@ -781,7 +1038,7 @@ bool IODTNVRAM::convertPropToObject(UInt8 *propName, UInt32 propNameLength,
 bool IODTNVRAM::convertObjectToProp(UInt8 *buffer, UInt32 *length,
                                    const OSSymbol *propSymbol, OSObject *propObject)
 {
 bool IODTNVRAM::convertObjectToProp(UInt8 *buffer, UInt32 *length,
                                    const OSSymbol *propSymbol, OSObject *propObject)
 {

-  UInt8          *propName;
+  const UInt8    *propName;

   UInt32         propNameLength, propDataLength;
   UInt32         propType, tmpValue;
   OSBoolean      *tmpBoolean = 0;
   UInt32         propNameLength, propDataLength;
   UInt32         propType, tmpValue;
   OSBoolean      *tmpBoolean = 0;


@@ -789,7 +1046,7 @@ bool IODTNVRAM::convertObjectToProp(UInt8 *buffer, UInt32 *length,
   OSString       *tmpString = 0;
   OSData         *tmpData = 0;
   
   OSString       *tmpString = 0;
   OSData         *tmpData = 0;
   

-  propName = (UInt8 *)propSymbol->getCStringNoCopy();
+  propName = (const UInt8 *)propSymbol->getCStringNoCopy();

   propNameLength = propSymbol->getLength();
   propType = getOFVariableType(propSymbol);
   
   propNameLength = propSymbol->getLength();
   propType = getOFVariableType(propSymbol);
   


@@ -894,11 +1151,12 @@ bool IODTNVRAM::validateOWChecksum(UInt8 *buffer)
 
 void IODTNVRAM::updateOWBootArgs(const OSSymbol *key, OSObject *value)
 {
 
 void IODTNVRAM::updateOWBootArgs(const OSSymbol *key, OSObject *value)
 {

-  bool     wasBootArgs, bootr = false;
-  UInt32   cnt;
-  OSString *tmpString, *bootCommand, *bootArgs = 0;
-  UInt8    *bootCommandData, *bootArgsData, *tmpData;
-  UInt32   bootCommandDataLength, bootArgsDataLength, tmpDataLength;
+  bool        wasBootArgs, bootr = false;
+  UInt32      cnt;
+  OSString    *tmpString, *bootCommand, *bootArgs = 0;
+  const UInt8 *bootCommandData, *bootArgsData;
+  UInt8       *tmpData;
+  UInt32      bootCommandDataLength, bootArgsDataLength, tmpDataLength;

   
   tmpString = OSDynamicCast(OSString, value);
   if (tmpString == 0) return;
   
   tmpString = OSDynamicCast(OSString, value);
   if (tmpString == 0) return;


@@ -913,7 +1171,7 @@ void IODTNVRAM::updateOWBootArgs(const OSSymbol *key, OSObject *value)
     if (bootCommand == 0) return;
   } else return;
   
     if (bootCommand == 0) return;
   } else return;
   

-  bootCommandData = (UInt8 *)bootCommand->getCStringNoCopy();
+  bootCommandData = (const UInt8 *)bootCommand->getCStringNoCopy();

   bootCommandDataLength = bootCommand->getLength();
   
   if (bootCommandData == 0) return;
   bootCommandDataLength = bootCommand->getLength();
   
   if (bootCommandData == 0) return;


@@ -933,7 +1191,7 @@ void IODTNVRAM::updateOWBootArgs(const OSSymbol *key, OSObject *value)
   }
   
   if (wasBootArgs) {
   }
   
   if (wasBootArgs) {

-    bootArgsData = (UInt8 *)bootArgs->getCStringNoCopy();
+    bootArgsData = (const UInt8 *)bootArgs->getCStringNoCopy();

     bootArgsDataLength = bootArgs->getLength();
     if (bootArgsData == 0) return;
     
     bootArgsDataLength = bootArgs->getLength();
     if (bootArgsData == 0) return;
     


@@ -1099,7 +1357,7 @@ IOReturn IODTNVRAM::writeNVRAMPropertyType0(IORegistryEntry *entry,
   return err;
 }
 
   return err;
 }
 

-OSData *IODTNVRAM::unescapeBytesToData(UInt8 *bytes, UInt32 length)
+OSData *IODTNVRAM::unescapeBytesToData(const UInt8 *bytes, UInt32 length)

 {
   OSData *data = 0;
   UInt32 totalLength = 0;
 {
   OSData *data = 0;
   UInt32 totalLength = 0;


@@ -1146,29 +1404,29 @@ OSData *IODTNVRAM::unescapeBytesToData(UInt8 *bytes, UInt32 length)
 
 OSData * IODTNVRAM::escapeDataToData(OSData * value)
 {
 
 OSData * IODTNVRAM::escapeDataToData(OSData * value)
 {

-  OSData * result;
-  UInt8 *  start;
-  UInt8 *  end;
-  UInt8 *  where;
-  UInt8    byte;
-  bool    ok = true;
+  OSData *       result;
+  const UInt8 *  startPtr;
+  const UInt8 *  endPtr;
+  const UInt8 *  wherePtr;
+  UInt8          byte;
+  bool          ok = true;

 
 

-  where = (UInt8 *) value->getBytesNoCopy();
-  end = where + value->getLength();
+  wherePtr = (const UInt8 *) value->getBytesNoCopy();
+  endPtr = wherePtr + value->getLength();

 
 

-  result = OSData::withCapacity(end - where);
+  result = OSData::withCapacity(endPtr - wherePtr);

   if (!result)
     return result;
 
   if (!result)
     return result;
 

-  while (where < end) {
-    start = where;
-    byte = *where++;
+  while (wherePtr < endPtr) {
+    startPtr = wherePtr;
+    byte = *wherePtr++;

     if ((byte == 0x00) || (byte == 0xFF)) {
       for (;
     if ((byte == 0x00) || (byte == 0xFF)) {
       for (;

-            ((where - start) < 0x80) && (where < end) && (byte == *where);
-            where++)   {}
+            ((wherePtr - startPtr) < 0x80) && (wherePtr < endPtr) && (byte == *wherePtr);
+            wherePtr++)        {}

       ok &= result->appendByte(0xff, 1);
       ok &= result->appendByte(0xff, 1);

-      byte = (byte & 0x80) | (where - start);
+      byte = (byte & 0x80) | (wherePtr - startPtr);

     }
     ok &= result->appendByte(byte, 1);
   }
     }
     ok &= result->appendByte(byte, 1);
   }


@@ -1182,51 +1440,77 @@ OSData * IODTNVRAM::escapeDataToData(OSData * value)
   return result;
 }
 
   return result;
 }
 

+static bool IsApplePropertyName(const char * propName)
+{
+  char c;
+  while ((c = *propName++)) {
+    if ((c >= 'A') && (c <= 'Z'))
+      break;
+  }
+
+  return (c == 0);
+}
+

 IOReturn IODTNVRAM::readNVRAMPropertyType1(IORegistryEntry *entry,
                                           const OSSymbol **name,
                                           OSData **value)
 {
 IOReturn IODTNVRAM::readNVRAMPropertyType1(IORegistryEntry *entry,
                                           const OSSymbol **name,
                                           OSData **value)
 {

-  IOReturn err = kIOReturnNoResources;
-  OSData   *data;
-  UInt8    *start;
-  UInt8    *end;
-  UInt8    *where;
-  UInt8    *nvPath = 0;
-  UInt8    *nvName = 0;
-  UInt8    byte;
+  IOReturn    err = kIOReturnNoResources;
+  OSData      *data;
+  const UInt8 *startPtr;
+  const UInt8 *endPtr;
+  const UInt8 *wherePtr;
+  const UInt8 *nvPath = 0;
+  const char  *nvName = 0;
+  const char  *resultName = 0;
+  const UInt8 *resultValue = 0;
+  UInt32       resultValueLen = 0;
+  UInt8       byte;

 
   if (_ofDict == 0) return err;
   data = OSDynamicCast(OSData, _ofDict->getObject(_registryPropertiesKey));
   if (data == 0) return err;
   
 
   if (_ofDict == 0) return err;
   data = OSDynamicCast(OSData, _ofDict->getObject(_registryPropertiesKey));
   if (data == 0) return err;
   

-  start = (UInt8 *) data->getBytesNoCopy();
-  end = start + data->getLength();
+  startPtr = (const UInt8 *) data->getBytesNoCopy();
+  endPtr = startPtr + data->getLength();

 
 

-  where = start;
-  while (where < end) {
-    byte = *(where++);
+  wherePtr = startPtr;
+  while (wherePtr < endPtr) {
+    byte = *(wherePtr++);

     if (byte)
       continue;
     
     if (nvPath == 0)
     if (byte)
       continue;
     
     if (nvPath == 0)

-      nvPath = start;
+      nvPath = startPtr;

     else if (nvName == 0)
     else if (nvName == 0)

-      nvName = start;
-    else if (entry ==
-            IORegistryEntry::fromPath((const char *) nvPath, gIODTPlane)) {
-      *name = OSSymbol::withCString((const char *) nvName);
-      *value = unescapeBytesToData(start, where - start - 1);
-      if ((*name != 0) && (*value != 0))
-        err = kIOReturnSuccess;
-      else
-        err = kIOReturnNoMemory;
-      break;
-    } else
-      nvPath = nvName = 0;
-    
-    start = where;
+      nvName = (const char *) startPtr;
+    else {
+      IORegistryEntry * compareEntry = IORegistryEntry::fromPath((const char *) nvPath, gIODTPlane);
+      if (compareEntry)
+        compareEntry->release();
+      if (entry == compareEntry) {
+        bool appleProp = IsApplePropertyName(nvName);
+        if (!appleProp || !resultName) {
+          resultName     = nvName;
+          resultValue    = startPtr;
+          resultValueLen = wherePtr - startPtr - 1;
+        }
+        if (!appleProp)
+          break;
+      }
+      nvPath = 0;
+      nvName = 0;
+    }
+    startPtr = wherePtr;
+  }
+  if (resultName) {
+    *name = OSSymbol::withCString(resultName);
+    *value = unescapeBytesToData(resultValue, resultValueLen);
+    if ((*name != 0) && (*value != 0))
+      err = kIOReturnSuccess;
+    else
+      err = kIOReturnNoMemory;

   }
   }

-

   return err;
 }
 
   return err;
 }
 


@@ -1234,49 +1518,60 @@ IOReturn IODTNVRAM::writeNVRAMPropertyType1(IORegistryEntry *entry,
                                            const OSSymbol *propName,
                                            OSData *value)
 {
                                            const OSSymbol *propName,
                                            OSData *value)
 {

-  OSData   *oldData;
-  OSData   *data = 0;
-  UInt8    *start;
-  UInt8    *propStart;
-  UInt8    *end;
-  UInt8    *where;
-  UInt8    *nvPath = 0;
-  UInt8    *nvName = 0;
+  OSData       *oldData;
+  OSData       *data = 0;
+  const UInt8  *startPtr;
+  const UInt8  *propStart;
+  const UInt8  *endPtr;
+  const UInt8  *wherePtr;
+  const UInt8  *nvPath = 0;
+  const char   *nvName = 0;

   const char * comp;
   const char * name;
   const char * comp;
   const char * name;

-  UInt8     byte;
-  bool      ok = true;
+  UInt8        byte;
+  bool         ok = true;
+  bool         settingAppleProp;

 
   if (_ofDict == 0) return kIOReturnNoResources;
 
 
   if (_ofDict == 0) return kIOReturnNoResources;
 

+  settingAppleProp = IsApplePropertyName(propName->getCStringNoCopy());
+

   // copy over existing properties for other entries
 
   oldData = OSDynamicCast(OSData, _ofDict->getObject(_registryPropertiesKey));
   if (oldData) {
   // copy over existing properties for other entries
 
   oldData = OSDynamicCast(OSData, _ofDict->getObject(_registryPropertiesKey));
   if (oldData) {

-    start = (UInt8 *) oldData->getBytesNoCopy();
-    end = start + oldData->getLength();
+    startPtr = (const UInt8 *) oldData->getBytesNoCopy();
+    endPtr = startPtr + oldData->getLength();

     
     

-    propStart = start;
-    where = start;
-    while (where < end) {
-      byte = *(where++);
+    propStart = startPtr;
+    wherePtr = startPtr;
+    while (wherePtr < endPtr) {
+      byte = *(wherePtr++);

       if (byte)
         continue;
       if (nvPath == 0)
       if (byte)
         continue;
       if (nvPath == 0)

-        nvPath = start;
+        nvPath = startPtr;

       else if (nvName == 0)
       else if (nvName == 0)

-        nvName = start;
-      else if (entry ==
-                IORegistryEntry::fromPath((const char *) nvPath, gIODTPlane)) {
-        // delete old property (nvPath -> where)
-        data = OSData::withBytes(propStart, nvPath - propStart);
-        if (data)
-          ok &= data->appendBytes(where, end - where);
-        break;
-      } else
-        nvPath = nvName = 0;
+        nvName = (const char *) startPtr;
+      else {
+        IORegistryEntry * compareEntry = IORegistryEntry::fromPath((const char *) nvPath, gIODTPlane);
+        if (compareEntry)
+          compareEntry->release();
+        if (entry == compareEntry) {
+          if ((settingAppleProp && propName->isEqualTo(nvName))
+           || (!settingAppleProp && !IsApplePropertyName(nvName))) {
+             // delete old property (nvPath -> wherePtr)
+             data = OSData::withBytes(propStart, nvPath - propStart);
+             if (data)
+               ok &= data->appendBytes(wherePtr, endPtr - wherePtr);
+             break;
+          }
+        }
+        nvPath = 0;
+        nvName = 0;
+      }

         
         

-      start = where;
+      startPtr = wherePtr;

     }
   }
 
     }
   }
 


@@ -1291,51 +1586,52 @@ IOReturn IODTNVRAM::writeNVRAMPropertyType1(IORegistryEntry *entry,
       return kIOReturnNoMemory;
   }
 
       return kIOReturnNoMemory;
   }
 

-  // get entries in path
-  OSArray *array = OSArray::withCapacity(5);
-  if (!array) {
-    data->release();
-    return kIOReturnNoMemory;
-  }
-  do
-    array->setObject(entry);
-  while ((entry = entry->getParentEntry(gIODTPlane)));
-
-  // append path
-  for (int i = array->getCount() - 3;
-        (entry = (IORegistryEntry *) array->getObject(i));
-        i--) {
-
-    name = entry->getName(gIODTPlane);
-    comp = entry->getLocation(gIODTPlane);
-    if( comp && (0 == strcmp("pci", name))
-     && (0 == strcmp("80000000", comp))) {
-      // yosemite hack
-      comp = "/pci@80000000";
-    } else {
-      if (comp)
-        ok &= data->appendBytes("/@", 2);
-      else {
-        if (!name)
-          continue;
-        ok &= data->appendByte('/', 1);
-        comp = name;
-      }
-    }
-    ok &= data->appendBytes(comp, strlen(comp));
-  }
-  ok &= data->appendByte(0, 1);
-  array->release();
-
-  // append prop name
-  ok &= data->appendBytes(propName->getCStringNoCopy(), propName->getLength() + 1);
-  
-  // append escaped data
-  oldData = escapeDataToData(value);
-  ok &= (oldData != 0);
-  if (ok)
-    ok &= data->appendBytes(oldData);
-
+  if (value && value->getLength()) {
+               // get entries in path
+               OSArray *array = OSArray::withCapacity(5);
+               if (!array) {
+                       data->release();
+                       return kIOReturnNoMemory;
+               }
+               do
+                       array->setObject(entry);
+               while ((entry = entry->getParentEntry(gIODTPlane)));
+
+               // append path
+               for (int i = array->getCount() - 3;
+                                       (entry = (IORegistryEntry *) array->getObject(i));
+                                       i--) {
+
+                       name = entry->getName(gIODTPlane);
+                       comp = entry->getLocation(gIODTPlane);
+                       if( comp && (0 == strcmp("pci", name))
+                        && (0 == strcmp("80000000", comp))) {
+                               // yosemite hack
+                               comp = "/pci@80000000";
+                       } else {
+                               if (comp)
+                                       ok &= data->appendBytes("/@", 2);
+                               else {
+                                       if (!name)
+                                               continue;
+                                       ok &= data->appendByte('/', 1);
+                                       comp = name;
+                               }
+                       }
+                       ok &= data->appendBytes(comp, strlen(comp));
+               }
+               ok &= data->appendByte(0, 1);
+               array->release();
+
+               // append prop name
+               ok &= data->appendBytes(propName->getCStringNoCopy(), propName->getLength() + 1);
+               
+               // append escaped data
+               oldData = escapeDataToData(value);
+               ok &= (oldData != 0);
+               if (ok)
+                       ok &= data->appendBytes(oldData);
+       }

   if (ok) {
     ok = _ofDict->setObject(_registryPropertiesKey, data);
     if (ok)
   if (ok) {
     ok = _ofDict->setObject(_registryPropertiesKey, data);
     if (ok)