macOS: harden volume discovery and FUSE-T teardown

Run display discovery asynchronously and bound batched disk-image inventory
queries. Filter auxiliary mounts by basename, filesystem and owner, and
keep unresolved candidates separate from verified volumes. Allow targeted
dismounts despite incomplete discovery while requiring complete results
for slot allocation and empty-inventory decisions.

Use nonthrowing GUI snapshots with monotonic freshness, completion events
and safe window lifetimes. Suspend inactivity decisions while the snapshot
is stale, without restarting idle timers: activity counters are cumulative
per volume instance. Refresh logout targets and retry only failed ones.
Show a progress dialog for interactive unmounts, but keep automatic ones
synchronous, so a quit or logout request that arrives meanwhile is handled
afterwards rather than refused. Guard core operations against reentry and
route wait-dialog requests only from worker threads, so a main-thread
message cannot wait for itself.

Bind teardown to captured mount and service identities, including process
start time. Report a service exit that cannot be confirmed after auxiliary
mount removal as a distinct error that keeps the original details. Such
volumes are not retried, and a multi-volume unmount reports all of them
together with any other failure or a declined prompt. Warn about it after
automatic unmounts and at quit, and keep the background application until
the warning is acknowledged. Keep rollback responsive, and let services
remove their auxiliary directories without probing mounted paths. Preserve
released /control compatibility and perform best-effort cleanup for older
services.

Reap bounded subprocesses as soon as their output ends. A child that
survives SIGKILL is reaped by a later call, which starts no new child until
then. Keep subjects and subprocess command, status and error output when
formatting exceptions for wrapping and logs. Clarify discovery and rollback
diagnostics. Fix the localization-dependent busy-volume regression
assertion and extend discovery, snapshot, process identity, cleanup, GUI
lifecycle, inactivity and teardown coverage.

src/Main/Forms/MainFrame.cpp

@@ -21,6 +21,7 @@
 
 #include "Common/SecurityToken.h"
 #include "Platform/SystemLog.h"
+#include "Platform/SerializerFactory.h"
 #include "Main/Main.h"
 #include "Main/Resources.h"
 #include "Main/Application.h"
@@ -38,12 +39,66 @@
 #include "SecurityTokenKeyfilesDialog.h"
 #include "VolumeCreationWizard.h"
 #include "VolumePropertiesDialog.h"
+#ifdef TC_MACOSX
+#include <chrono>
+#include "Core/Unix/MacOSX/CoreMacOSX.h"
+#endif
 
 namespace VeraCrypt
 {
+#ifdef TC_MACOSX
+	struct VolumeDiscoveryState
+	{
+		VolumeDiscoveryState (wxEvtHandler *target) : Running (false), Completed (false), Succeeded (false), HasResult (false), Generation (0), ResultGeneration (0), Started (chrono::steady_clock::now()), NotificationTarget (target)
+		{
+			// A kernel-blocked metadata read may outlive GUI shutdown. Retain the
+			// read-only serializer registry until process exit as well as this state;
+			// static teardown must not delete it underneath the detached worker.
+			static const bool registryRetained = [] () { SerializerFactory::Initialize(); return true; } ();
+			(void) registryRetained;
+		}
+		// Constructed on the GUI thread (CoreUnix initializes locale state).
+		CoreMacOSX DiscoveryCore;
+		Mutex AccessMutex;
+		bool Running, Completed, Succeeded, HasResult;
+		uint64 Generation, ResultGeneration;
+		chrono::steady_clock::time_point Started;
+		VolumeDiscoveryResult Result;
+		wxEvtHandler *NotificationTarget;
+	};
+
+	class VolumeDiscoveryTask : public Functor
+	{
+	public:
+		VolumeDiscoveryTask (shared_ptr <VolumeDiscoveryState> state, uint64 generation) : State (state), Generation (generation) { }
+		virtual void operator() ()
+		{
+			VolumeDiscoveryResult result;
+			bool succeeded = false;
+			try { result = State->DiscoveryCore.GetMountedVolumesWithStatus(); succeeded = true; }
+			catch (exception &e) { SystemLog::WriteException (e); }
+			catch (...) { }
+			ScopeLock lock (State->AccessMutex);
+			State->Result = result;
+			State->Succeeded = succeeded;
+			State->HasResult = true;
+			State->ResultGeneration = Generation;
+			State->Completed = true;
+			State->Running = false;
+			// Destruction clears this pointer under the same lock before the
+			// window's event handler is destroyed. Never post to a dead window.
+			if (State->NotificationTarget)
+				wxQueueEvent (State->NotificationTarget, new wxCommandEvent (wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED));
+		}
+	private:
+		shared_ptr <VolumeDiscoveryState> State;
+		uint64 Generation;
+	};
+#endif
 	DEFINE_EVENT_TYPE(wxEVT_COMMAND_UPDATE_VOLUME_LIST)
 	DEFINE_EVENT_TYPE(wxEVT_COMMAND_PREF_UPDATED)
 	DEFINE_EVENT_TYPE(wxEVT_COMMAND_OPEN_VOLUME_REQUEST)
+	DEFINE_EVENT_TYPE(wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED)
 	DEFINE_EVENT_TYPE(wxEVT_COMMAND_SHOW_WARNING)
 
 	MainFrame::MainFrame (wxWindow* parent) : MainFrameBase (parent),
@@ -56,6 +111,9 @@ namespace VeraCrypt
 		indicator_item_exit (NULL),
 #endif
 		ListItemRightClickEventPending (false),
+#ifdef TC_MACOSX
+		VolumeDiscovery (new VolumeDiscoveryState (this)),
+#endif
 		SelectedItemIndex (-1),
 		SelectedSlotNumber (0),
 		ShowRequestFifo (-1)
@@ -65,6 +123,9 @@ namespace VeraCrypt
 		SetName (Application::GetName());
 		SetTitle (Application::GetName());
 		SetIcon (Resources::GetVeraCryptIcon());
+#ifdef TC_MACOSX
+		CreateStatusBar();
+#endif
 
 #if defined(TC_UNIX) && !defined(TC_MACOSX)
 		try
@@ -105,7 +166,8 @@ namespace VeraCrypt
 		}
 
 		Connect( wxID_EXIT, wxEVT_COMMAND_MENU_SELECTED, wxCommandEventHandler( MainFrame::OnQuit ) );
-		Connect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxCommandEventHandler( MainFrame::OnUpdateVolumeList ) );
+		Connect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxThreadEventHandler( MainFrame::OnUpdateVolumeList ) );
+		Connect( wxID_ANY, wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED, wxCommandEventHandler( MainFrame::OnVolumeDiscoveryCompleted ) );
 		Connect( wxID_ANY, wxEVT_COMMAND_PREF_UPDATED, wxCommandEventHandler( MainFrame::OnPreferencesUpdated ) );
 		Connect( wxID_ANY, wxEVT_COMMAND_OPEN_VOLUME_REQUEST, wxCommandEventHandler( MainFrame::OnOpenVolumeSystemRequest ) );
 
@@ -116,6 +178,12 @@ namespace VeraCrypt
 
 	MainFrame::~MainFrame ()
 	{
+#ifdef TC_MACOSX
+		{
+			ScopeLock lock (VolumeDiscovery->AccessMutex);
+			VolumeDiscovery->NotificationTarget = nullptr;
+		}
+#endif
 #if defined(TC_UNIX) && !defined(TC_MACOSX)
 		if (ShowRequestFifo != -1)
 		{
@@ -129,7 +197,8 @@ namespace VeraCrypt
 #endif
 
 		Disconnect( wxID_EXIT, wxEVT_COMMAND_MENU_SELECTED, wxCommandEventHandler( MainFrame::OnQuit ) );
-		Disconnect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxCommandEventHandler( MainFrame::OnUpdateVolumeList ) );
+		Disconnect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxThreadEventHandler( MainFrame::OnUpdateVolumeList ) );
+		Disconnect( wxID_ANY, wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED, wxCommandEventHandler( MainFrame::OnVolumeDiscoveryCompleted ) );
 		Disconnect( wxID_ANY, wxEVT_COMMAND_PREF_UPDATED, wxCommandEventHandler( MainFrame::OnPreferencesUpdated ) );
 		Disconnect( wxID_ANY, wxEVT_COMMAND_OPEN_VOLUME_REQUEST, wxCommandEventHandler( MainFrame::OnOpenVolumeSystemRequest ) );
 #ifdef TC_MACOSX
@@ -268,9 +337,27 @@ namespace VeraCrypt
 		}
 	}
 
+	bool MainFrame::CanConfirmNoMountedVolumes () const
+	{
+#ifdef TC_MACOSX
+		// An unacknowledged unconfirmed cleanup must not disappear with the app.
+		return VolumeSnapshot.CanConfirmEmpty (MountedVolumes.empty()) && !Gui->HasUnconfirmedCleanupWarnings();
+#else
+		return MountedVolumes.empty();
+#endif
+	}
+
 	shared_ptr <VolumeInfo> MainFrame::GetSelectedVolume () const
 	{
+#ifdef TC_MACOSX
+		// Keep selection tied to the displayed instance. Core operations validate
+		// its serial and resolve current image ownership again before acting.
+		foreach (shared_ptr <VolumeInfo> volume, MountedVolumes)
+			if (volume->SlotNumber == SelectedSlotNumber) return volume;
+		return shared_ptr <VolumeInfo>();
+#else
 		return Core->GetMountedVolume (SelectedSlotNumber);
+#endif
 	}
 
 	void MainFrame::InitControls ()
@@ -530,12 +617,13 @@ namespace VeraCrypt
 			wxMenu *CreatePopupMenu ()
 			{
 				unique_ptr <wxMenu> popup (new wxMenu);
+				const bool operationsEnabled = !Busy && !Gui->GetWaitDialog();
 
 				Gui->AppendToMenu (*popup, LangString[Gui->IsInBackgroundMode() ? "SHOW_TC" : "HIDE_TC"], this, wxCommandEventHandler (TaskBarIcon::OnShowHideMenuItemSelected));
 
 				popup->AppendSeparator();
-				Gui->AppendToMenu (*popup, LangString["IDM_MOUNT_FAVORITE_VOLUMES"], this, wxCommandEventHandler (TaskBarIcon::OnMountAllFavoritesMenuItemSelected))->Enable (!Busy);
-				Gui->AppendToMenu (*popup, LangString["HK_UNMOUNT_ALL"], this, wxCommandEventHandler (TaskBarIcon::OnDismountAllMenuItemSelected))->Enable (!Busy);
+				Gui->AppendToMenu (*popup, LangString["IDM_MOUNT_FAVORITE_VOLUMES"], this, wxCommandEventHandler (TaskBarIcon::OnMountAllFavoritesMenuItemSelected))->Enable (operationsEnabled);
+				Gui->AppendToMenu (*popup, LangString["HK_UNMOUNT_ALL"], this, wxCommandEventHandler (TaskBarIcon::OnDismountAllMenuItemSelected))->Enable (operationsEnabled);
 
 				// Favorite volumes
 				if (Gui->GetPreferences().BackgroundTaskMenuMountItemsEnabled && !Frame->FavoriteVolumesMenuMap.empty())
@@ -546,12 +634,12 @@ namespace VeraCrypt
 					{
 						//TBH Gui->AppendToMenu (*popup, LangString["MOUNT"] + L" " + wstring (fp.second.Path) + (fp.second.MountPoint.IsEmpty() ? L"" : L"  " + wstring (fp.second.MountPoint)),
 						Gui->AppendToMenu (*popup, LangString["MOUNT_BUTTON"] + L" " + wstring (fp.second.Path) + (fp.second.MountPoint.IsEmpty() ? L"" : L"  " + wstring (fp.second.MountPoint)),
-							this, wxCommandEventHandler (TaskBarIcon::OnFavoriteVolumeMenuItemSelected), fp.first)->Enable (!Busy);
+							this, wxCommandEventHandler (TaskBarIcon::OnFavoriteVolumeMenuItemSelected), fp.first)->Enable (operationsEnabled);
 					}
 				}
 
 				// Mounted volumes
-				VolumeInfoList mountedVolumes = Core->GetMountedVolumes();
+				VolumeInfoList mountedVolumes = Gui->GetMountedVolumesForUI();
 				if (!mountedVolumes.empty())
 				{
 					if (Gui->GetPreferences().BackgroundTaskMenuOpenItemsEnabled)
@@ -583,14 +671,14 @@ namespace VeraCrypt
 								label += wstring (volume->Path);
 
 							wxMenuItem *item = Gui->AppendToMenu (*popup, label, this, wxCommandEventHandler (TaskBarIcon::OnDismountMenuItemSelected));
-							item->Enable (!Busy);
+							item->Enable (operationsEnabled);
 							DismountMap[item->GetId()] = volume;
 						}
 					}
 				}
 
 				popup->AppendSeparator();
-				Gui->AppendToMenu (*popup, LangString["IDM_PREFERENCES"], this, wxCommandEventHandler (TaskBarIcon::OnPreferencesMenuItemSelected))->Enable (!Busy);
+				Gui->AppendToMenu (*popup, LangString["IDM_PREFERENCES"], this, wxCommandEventHandler (TaskBarIcon::OnPreferencesMenuItemSelected))->Enable (operationsEnabled);
 #ifndef TC_MACOSX
 				popup->AppendSeparator();
 				Gui->AppendToMenu (*popup, LangString["EXIT"], this, wxCommandEventHandler (TaskBarIcon::OnExitMenuItemSelected))->Enable (!Busy && Frame->CanExit());
@@ -808,6 +896,13 @@ namespace VeraCrypt
 
 	void MainFrame::OnClose (wxCloseEvent& event)
 	{
+		// Do not start another core operation from a nested wait event loop.
+		if (Gui->GetWaitDialog())
+		{
+			if (event.CanVeto())
+				event.Veto();
+			return;
+		}
 		if (GetPreferences().WipeCacheOnClose)
 			Core->WipePasswordCache();
 
@@ -816,7 +911,7 @@ namespace VeraCrypt
 		{
 			try
 			{
-				Gui->DismountVolumes (Core->GetMountedVolumes(), GetPreferences().ForceAutoDismount, false);
+				Gui->OnLogOff();
 			}
 			catch (exception &e) { SystemLog::WriteException (e); }
 			catch (...) { SystemLog::WriteException (UnknownException (SRC_POS)); }
@@ -848,7 +943,7 @@ namespace VeraCrypt
 			}
 		}
 		else if (event.CanVeto() && GetPreferences().BackgroundTaskEnabled
-			&& (!GetPreferences().CloseBackgroundTaskOnNoVolumes || !MountedVolumes.empty()))
+			&& (!GetPreferences().CloseBackgroundTaskOnNoVolumes || !CanConfirmNoMountedVolumes()))
 		{
 			// Enter background mode
 			if (!Gui->IsInBackgroundMode())
@@ -1377,18 +1472,37 @@ namespace VeraCrypt
 			UpdateVolumeList();
 			UpdateWipeCacheButton();
 
-			if (GetPreferences().BackgroundTaskEnabled)
+			if (GetPreferences().BackgroundTaskEnabled && !Gui->GetWaitDialog())
 			{
 				// Inactivity auto-dismount
-				if (GetPreferences().DismountOnInactivity)
+				if (GetPreferences().DismountOnInactivity
+#ifdef TC_MACOSX
+					&& VolumeSnapshot.IsFresh()
+#endif
+					)
 				{
 					VolumeInfoList inactiveVolumes;
+#ifdef TC_MACOSX
+					wxLongLong currentTime = chrono::duration_cast <chrono::milliseconds> (chrono::steady_clock::now().time_since_epoch()).count();
+#else
 					wxLongLong currentTime = wxGetLocalTimeMillis().GetValue();
+#endif
 
 					map <wstring, VolumeActivityMapEntry> newActivityTimeMap;
 
 					foreach (shared_ptr <VolumeInfo> volume, MountedVolumes)
 					{
+#ifdef TC_MACOSX
+						// A retained entry has no current counters. Keep its idle state until
+						// they can be read again: unchanged cumulative counters prove idleness.
+						if (volume->Discovery == VolumeInfo::ControlUnavailable)
+						{
+							map <wstring, VolumeActivityMapEntry>::const_iterator entry = VolumeActivityMap.find (volume->Path);
+							if (entry != VolumeActivityMap.end() && entry->second.SerialInstanceNumber == volume->SerialInstanceNumber)
+								newActivityTimeMap[volume->Path] = entry->second;
+							continue;
+						}
+#endif
 						if (VolumeActivityMap.find (volume->Path) != VolumeActivityMap.end()
 							&& VolumeActivityMap[volume->Path].SerialInstanceNumber == volume->SerialInstanceNumber)
 						{
@@ -1447,7 +1561,8 @@ namespace VeraCrypt
 				{
 					Close (true);
 				}
-				else if (MountedVolumes.empty() && (GetPreferences().CloseBackgroundTaskOnNoVolumes || Core->IsInPortableMode()))
+				else if (CanConfirmNoMountedVolumes()
+					&& (GetPreferences().CloseBackgroundTaskOnNoVolumes || Core->IsInPortableMode()))
 				{
 					Close (true);
 				}
@@ -1683,19 +1798,94 @@ namespace VeraCrypt
 		UpdateWipeCacheButton();
 	}
 
-	void MainFrame::UpdateVolumeList ()
+	void MainFrame::OnUpdateVolumeList (wxThreadEvent& event)
+	{
+#ifdef TC_MACOSX
+		{
+			ScopeLock lock (VolumeDiscovery->AccessMutex);
+			++VolumeDiscovery->Generation;
+		}
+		VolumeSnapshot.Invalidate();
+		VolumeListChange change = event.GetPayload <VolumeListChange>();
+		MountedVolumes.remove_if ([&change] (shared_ptr <VolumeInfo> volume) { return volume->SerialInstanceNumber == change.Volume->SerialInstanceNumber; });
+		if (change.Mounted) MountedVolumes.push_back (change.Volume);
+#endif
+		UpdateVolumeList();
+	}
+
+	void MainFrame::OnVolumeDiscoveryCompleted (wxCommandEvent& event)
+	{
+		try { UpdateVolumeList (false); }
+		catch (exception &e) { SystemLog::WriteException (e); }
+		catch (...) { }
+	}
+
+	void MainFrame::UpdateVolumeList (bool startDiscovery)
 	{
 		static Mutex mutex;
 		ScopeLock lock (mutex);
 
 		bool listChanged = false;
 
+#ifdef TC_MACOSX
+		{
+			ScopeLock discoveryLock (VolumeDiscovery->AccessMutex);
+			auto now = chrono::steady_clock::now();
+			if (VolumeDiscovery->Completed)
+			{
+				if (VolumeDiscovery->Succeeded && VolumeDiscovery->ResultGeneration == VolumeDiscovery->Generation)
+				{
+					VolumeDiscoveryResult &result = VolumeDiscovery->Result;
+					// Retain the identity of previously seen but now unreadable services.
+					// New unresolved candidates remain separate, without invented slots.
+					foreach (shared_ptr <VolumeInfo> old, MountedVolumes)
+						if (find (result.UnresolvedMounts.begin(), result.UnresolvedMounts.end(), old->AuxMountPoint) != result.UnresolvedMounts.end()
+							&& none_of (result.Volumes.begin(), result.Volumes.end(), [&old] (shared_ptr <VolumeInfo> volume) { return volume->SerialInstanceNumber == old->SerialInstanceNumber; }))
+						{
+							shared_ptr <VolumeInfo> unknown = old->Clone();
+							unknown->Discovery = VolumeInfo::ControlUnavailable;
+							unknown->VirtualDevice = DevicePath();
+							unknown->MountPoint = DirectoryPath();
+							result.Volumes.push_back (unknown);
+						}
+					MountedVolumes.swap (result.Volumes);
+					VolumeSnapshot.RecordSample (VolumeDiscovery->Started, result.IsComplete());
+				}
+				else
+				{
+					VolumeSnapshot.Invalidate();
+					// A volume event invalidated an in-flight result. Start the
+					// replacement immediately, without waiting for the next timer.
+					if (VolumeDiscovery->ResultGeneration != VolumeDiscovery->Generation) startDiscovery = true;
+				}
+				VolumeDiscovery->Completed = false;
+			}
+			bool stale = !VolumeSnapshot.IsFresh (now);
+			SetStatusText (stale ? LangString[!VolumeDiscovery->HasResult && now - VolumeDiscovery->Started < chrono::seconds (6)
+				? "VOLUME_DISCOVERY_PENDING" : "VOLUME_DISCOVERY_STALLED"]
+				: (VolumeSnapshot.IsComplete() ? wxString() : LangString["VOLUME_DISCOVERY_PARTIAL"]));
+			if (startDiscovery && !VolumeDiscovery->Running)
+			{
+				VolumeDiscovery->Started = now;
+				VolumeDiscovery->Running = true;
+				unique_ptr <Functor> task (new VolumeDiscoveryTask (VolumeDiscovery, VolumeDiscovery->Generation));
+				Thread thread;
+				try { thread.Start (task.get()); }
+				catch (...) { VolumeDiscovery->Running = false; throw; }
+				task.release();
+				thread.Detach();
+			}
+		}
+#else
 		MountedVolumes = Core->GetMountedVolumes();
+#endif
 
 		map < VolumeSlotNumber, shared_ptr <VolumeInfo> > mountedVolumesMap;
 		foreach (shared_ptr <VolumeInfo> volume, MountedVolumes)
 		{
-			mountedVolumesMap[volume->SlotNumber] = volume;
+			// A live replacement may share a slot with a retained unreadable entry.
+			// Keep the visible row and selection on the first (live) instance.
+			mountedVolumesMap.insert (make_pair (volume->SlotNumber, volume));
 		}
 
 		VolumeInfoList protectionTriggeredVolumes;
@@ -1717,6 +1907,12 @@ namespace VeraCrypt
 #else
 				fields[ColumnSlot] = StringConverter::FromNumber (slotNumber);
 				fields[ColumnMountPoint] = volume->MountPoint;
+#ifdef TC_MACOSX
+				if (volume->Discovery == VolumeInfo::DiscoveryUnknown || volume->Discovery == VolumeInfo::ControlUnavailable)
+					fields[ColumnMountPoint] = LangString["VOLUME_STATUS_UNKNOWN"];
+				else if (volume->Discovery == VolumeInfo::ImageAbsent)
+					fields[ColumnMountPoint] = LangString["VOLUME_IMAGE_ABSENT"];
+#endif
 #endif
 				fields[ColumnPath] = volume->Path;
 				fields[ColumnSize] = Gui->SizeToString (volume->Size);