IOCoreSurfaceRoot

IOCoreSurfaceRoot is a kernel-extension for managing pixel buffers. It is controlled by the user-land framework IOSurface. You should use the IOSurface framework instead of directly operating on this service.

When opening the service, you can specify a non-0 type to open a surface-specific connection corresponding whose IOSurfaceID is equal to the type you specified.

Methods

For iOS 3.x and up:

Selector	Action	Input	Output
0	create	struct IOSurfaceCreateArg	struct IOSurfaceData
1	release	IOSurfaceID surfaceID	-
2	lock	struct IOSurfaceLockArg	struct IOSurfaceData
3	unlock	struct IOSurfaceLockArg	struct IOSurfaceLockSeedArg
4	lockPlane	struct IOSurfaceLockArg	struct IOSurfaceData
5	unlockPlane	struct IOSurfaceLockArg	struct IOSurfaceLockSeedArg
6	lookup	IOSurfaceID surfaceID	struct IOSurfaceData
7	setYCbCrMatrix	IOSurfaceID surfaceID, uint32_t YCbCrMatrix	-
8	wrapClientImage	struct IOSurfaceWrapArg	struct IOSurfaceData
9	wrapClientMemory	void* param0, void* param1	1,208 bytes of stuff
10	getYCbCrMatrix	IOSurfaceID surfaceID	uint32_t YCbCrMatrix
11	setValue	struct IOSurfaceSetValueArg	-
12	copyValue	struct IOSurfaceCopyValueArg	struct IOSurfaceCopyValueRetArg
13	kIOSurfaceMethodRemoveValue	?	-
14	bindAccel	IOSurfaceID surfaceID, void* unknown0, void* unknown4	-
15	bindAccelOnPlane	IOSurfaceID surfaceID, void* param1, void* param2, size_t planeIndex	-
16	readLimits	-	struct IOSurfaceLimits
17	kIOSurfaceMethodIncrementUseCount	IOSurfaceID surfaceID	-
18	kIOSurfaceMethodDecrementUseCount	IOSurfaceID surfaceID	-
19	?	void* ???	void* ???
20	setSurfaceNotify	24 bytes of stuff	-
21	removeSurfaceNotify	24 bytes of stuff	-
22	?	?	?
23	?	?	?
24	setTiled	IOSurfaceID surfaceID, uint32_t tileMode	-
25	isTiled	IOSurfaceID surfaceID	uint32_t tileMode

For iOS 3.x and up, surface-specific connection:

Selector	Action	Input	Output
0	lookupFromMachPort	-	struct IOSurfaceData

For iOS 2.x only:

Selector	Action	Input	Output
0	create	struct IOSurfaceCreateArg	IOSurfaceID surfaceID
1	release	IOSurfaceID surfaceID	-
2	lock	struct IOCoreSurfaceLockArg	struct IOSurfaceData
3	unlock	struct IOCoreSurfaceLockArg	-
4	lookup	IOSurfaceID surfaceID	-
5	?	?	?
6	wrapClientImage	struct IOSurfaceWrapArg	IOSurfaceID surfaceID
7	?	?	?
8	getYCbCrMatrix	IOSurfaceID surfaceID	uint32_t YCbCrMatrix

where

struct IOSurfaceData {

#if IOS_VERSION >= 5.0
  uint64_t address;
#else
  size_t address;
#endif

#if IOS_VERSION >= 6.0
  uint64_t sharedData; // pointer to IOSurfaceSharedData, driver-mapped
#endif

#if IOS_VERSION >= 3.0
  IOSurfaceID surfaceId;
#endif

  uint32_t allocSize;
  uint32_t width;
  uint32_t height;
  uint32_t rowBytes;
  uint32_t offset;
  uint32_t format; // 4cc, e.g. 'BGRA'
  uint32_t ???; // might be allocSize, rounded up to page size?
  uint32_t numPlanes;
  uint32_t ???;

#if IOS_VERSION >= 3.0
  uint16_t elementBytes;
  uint8_t elementWidth;
  uint8_t elementHeight;

#if IOS_VERSION >= 6.0
  uint32_t cacheMode;
  uint32_t ???[2]; // one of these might be 'seed'
#else
  uint32_t seed;
#endif

#if IOS_VERSION < 6.0
#if IOS_VERSION >= 5.0
  uint64_t sharedData; // pointer to IOSurfaceSharedData, driver-mapped
#else
  uint32_t sharedData; // pointer to IOSurfaceSharedData, driver-mapped
#endif
#endif

#endif

  struct IOSurfacePlaneData planes[32]; // only 'numPlanes' planes are populated

#if IOS_VERSION >= 3.2 && IOS_VERSION < 5.0
  uint32_t isTiled;
#endif
};

struct IOSurfacePlaneData {

#if IOS_VERSION >= 5.0
  uint64_t sharedData; // pointer to IOSurfaceSharedData, driver-mapped
#else
  uint32_t sharedData; // pointer to IOSurfaceSharedData, driver-mapped
#endif

  uint32_t width;
  uint32_t height;
  uint32_t ???;
  uint32_t offset;
  uint32_t rowBytes;
  uint32_t ???;

#if IOS_VERSION >= 3.0
  uint16_t elementBytes;
  uint8_t elementWidth;
  uint8_t elementHeight;

  uint32_t seed;
#endif

  // The ??? are likely the plane base & plane size
};

struct IOSurfaceLimits {
  uint32_t addressAlignMask; // e.g. 3 for 4-byte alignment
  uint32_t rowBytesAlignMask; // e.g. 3 for 4-byte alignment
  uint32_t rowBytesMax;
  uint32_t widthMax;
  uint32_t heightMax;
};

// This struct resides in driver-mapped memory, it's presumably read-only in user mode
// (Note - not all these fields will exist in older iOS versions)
struct IOSurfaceSharedData {
  uint32_t ???[2]; // related to IOAccelerator
  uint32_t seed;
  uint32_t useCount;
  uint32_t YCbCrMatrix;
  uint32_t maxValueSizeHint; // hint - maximum serialized size of any surface value (aka - those set via setValue)
};

struct IOSrufaceWrapArg {
#if IOS_VERSION >= 6.0
  uint64_t address;
#endif
  uint32_t width;
  uint32_t height;
  uint32_t format; // 4cc code, e.g. 'BGRA'
#if IOS_VERSION >= 3.0
  uint32_t elementBytes;
#endif
  uint32_t rowBytes;
  uint32_t allocSize;
#if IOS_VERSION < 6.0
  size_t address;
#endif
};

struct IOSurfaceCreateArg {
  // XML PList dictionary with keys:
  //   IOSurfaceWidth
  //   IOSurfaceHeight
  //   IOSurfaceBytesPerRow
  //   IOSurfaceBytesPerElement
  //   IOSurfaceElementWidth
  //   IOSurfaceElementHeight
  //   IOSurfacePixelFormat
  //   IOSurfaceAllocSize
  //   IOSurfaceTileMode (also IOSurfaceBufferTileMode?)
  //   IOSurfaceCacheMode
  //   IOSurfaceOffset
  //   IOSurfaceIsGlobal
  //   IOSurfaceMemoryRegion
  //   IOSurfacePurgeWhenNotInUse
  //   IOSurfacePlaneInfo - array of dictionaries with keys:
  //     IOSurfacePlaneWidth
  //     IOSurfacePlaneHeight
  //     IOSurfacePlaneBytesPerRow
  //     IOSurfacePlaneBytesPerElement
  //     IOSurfacePlaneElementWidth
  //     IOSurfacePlaneElementHeight
  //     IOSurfacePlaneOffset
  //     IOSurfacePlaneBase
  //     IOSurfacePlaneSize
  char createPList[0];
};

struct IOSurfaceSetValueArg {
  IOSurfaceID surfaceID

  // XML PList - array of size 2
  //   [0] - value (any object)
  //   [1] - key (string)  
  char setValuePList[0];
};

struct IOSurfaceCopyValueArg {
  IOSurfaceID surfaceID 
  char keyName[0];
};

struct IOSurfaceCopyValueRetArg {
  // XML PList - value (any object)
  char copyValuePList[0];
};

struct IOSurfaceLockArg {
  IOSurfaceID surfaceID;
  uint32_t    lockOptions;
  size_t      planeIndex;
};

struct IOSurfaceLockSeedArg {
  uint32_t    seed;
};

#if IOS_VERSION < 3.0
struct IOCoreSurfaceLockArg {
  IOSurfaceID surfaceID;
  uint32_t    lockType; // 1 - none, just get data, 2 - read, 3 - read/write
};
#endif