IOUserClient

IOUserClient is a kernel-side class in the IOKit framework that represents a per-process connection between user space and a kernel extension (kext). It provides the interface through which user-space code can invoke kernel methods exposed by an IOService-based provider. A user client is created when a user-space application opens an IOService that implements an IOUserClient subclass, typically via IOServiceOpen or similar IOKit APIs, and is identified by a task port representing the calling process.

In operation, an IOUserClient holds a reference to its owning provider and the client task (the user process) and is responsible for dispatching user requests to kernel methods. The user-facing methods are exposed through a set of external methods described by IOExternalMethod structures or IOExternalTrap entries. Each method entry specifies parameters such as the selector, input and output sizes, and whether memory is validated or mapped. The client can also request memory mapping of kernel buffers, subject to security checks.

Lifecycle and security are central concerns. The IOUserClient instance is created by the provider during an open operation and is destroyed when the client closes, the process terminates, or the kernel decides to terminate the connection. Security checks are performed to ensure the calling process holds appropriate privileges or entitlements and that the clientTask is allowed to perform the requested operations. The client can override or implement methods such as clientDied and clientClose to clean up resources.

Common usage patterns involve a kernel driver exposing device-like services to user space, where applications obtain a connection to the IOService and call established methods through IOConnectCallMethod or equivalent APIs. IOUserClient forms a foundational mechanism for controlled, structured user-kernel communication in IOKit.