]> git.saurik.com Git - apple/xnu.git/blob - osfmk/i386/AT386/model_dep.c
projects / apple / xnu.git / blob
? search:


5aae6aaeedaa76365def0a6e705f2ad7b9c01cd2
[apple/xnu.git] / osfmk / i386 / AT386 / model_dep.c
1 /*
2 * Copyright (c) 2000-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * @OSF_COPYRIGHT@
30 */
31 /*
32 * Mach Operating System
33 * Copyright (c) 1991,1990,1989, 1988 Carnegie Mellon University
34 * All Rights Reserved.
35 *
36 * Permission to use, copy, modify and distribute this software and its
37 * documentation is hereby granted, provided that both the copyright
38 * notice and this permission notice appear in all copies of the
39 * software, derivative works or modified versions, and any portions
40 * thereof, and that both notices appear in supporting documentation.
41 *
42 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
45 *
46 * Carnegie Mellon requests users of this software to return to
47 *
48 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU
49 * School of Computer Science
50 * Carnegie Mellon University
51 * Pittsburgh PA 15213-3890
52 *
53 * any improvements or extensions that they make and grant Carnegie Mellon
54 * the rights to redistribute these changes.
55 */
56
57 /*
58 */
59
60 /*
61 * File: model_dep.c
62 * Author: Avadis Tevanian, Jr., Michael Wayne Young
63 *
64 * Copyright (C) 1986, Avadis Tevanian, Jr., Michael Wayne Young
65 *
66 * Basic initialization for I386 - ISA bus machines.
67 */
68
69
70 #define __APPLE_API_PRIVATE 1
71 #define __APPLE_API_UNSTABLE 1
72 #include <kern/debug.h>
73
74 #include <mach/i386/vm_param.h>
75
76 #include <string.h>
77 #include <mach/vm_param.h>
78 #include <mach/vm_prot.h>
79 #include <mach/machine.h>
80 #include <mach/time_value.h>
81 #include <sys/kdebug.h>
82 #include <kern/spl.h>
83 #include <kern/assert.h>
84 #include <kern/lock_group.h>
85 #include <kern/misc_protos.h>
86 #include <kern/startup.h>
87 #include <kern/clock.h>
88 #include <kern/cpu_data.h>
89 #include <kern/machine.h>
90 #include <i386/postcode.h>
91 #include <i386/mp_desc.h>
92 #include <i386/misc_protos.h>
93 #include <i386/thread.h>
94 #include <i386/trap.h>
95 #include <i386/machine_routines.h>
96 #include <i386/mp.h> /* mp_rendezvous_break_lock */
97 #include <i386/cpuid.h>
98 #include <i386/fpu.h>
99 #include <i386/machine_cpu.h>
100 #include <i386/pmap.h>
101 #if CONFIG_MTRR
102 #include <i386/mtrr.h>
103 #endif
104 #include <i386/ucode.h>
105 #include <i386/pmCPU.h>
106 #include <i386/panic_hooks.h>
107
108 #include <architecture/i386/pio.h> /* inb() */
109 #include <pexpert/i386/boot.h>
110
111 #include <kdp/kdp_dyld.h>
112 #include <kdp/kdp_core.h>
113 #include <vm/pmap.h>
114 #include <vm/vm_map.h>
115 #include <vm/vm_kern.h>
116
117 #include <IOKit/IOBSD.h>
118 #include <IOKit/IOPlatformExpert.h>
119 #include <IOKit/IOHibernatePrivate.h>
120
121 #include <pexpert/i386/efi.h>
122
123 #include <kern/thread.h>
124 #include <kern/sched.h>
125 #include <mach-o/loader.h>
126 #include <mach-o/nlist.h>
127
128 #include <libkern/kernel_mach_header.h>
129 #include <libkern/OSKextLibPrivate.h>
130 #include <libkern/crc.h>
131
132 #if DEBUG || DEVELOPMENT
133 #define DPRINTF(x...) kprintf(x)
134 #else
135 #define DPRINTF(x...)
136 #endif
137
138 #ifndef ROUNDUP
139 #define ROUNDUP(a, b) (((a) + ((b) - 1)) & (~((b) - 1)))
140 #endif
141
142 #ifndef ROUNDDOWN
143 #define ROUNDDOWN(x, y) (((x)/(y))*(y))
144 #endif
145
146 static void machine_conf(void);
147 void panic_print_symbol_name(vm_address_t search);
148 void RecordPanicStackshot(void);
149
150 typedef enum paniclog_flush_type {
151 kPaniclogFlushBase = 1,/* Flush the initial log and paniclog header */
152 kPaniclogFlushStackshot = 2,/* Flush only the stackshot data, then flush the header */
153 kPaniclogFlushOtherLog = 3/* Flush the other log, then flush the header */
154 } paniclog_flush_type_t;
155
156 void paniclog_flush_internal(paniclog_flush_type_t variant);
157
158 extern const char version[];
159 extern char osversion[];
160 extern int max_unsafe_quanta;
161 extern int max_poll_quanta;
162 extern unsigned int panic_is_inited;
163
164 extern int proc_pid(void *p);
165
166 /* Definitions for frame pointers */
167 #define FP_ALIGNMENT_MASK ((uint32_t)(0x3))
168 #define FP_LR_OFFSET ((uint32_t)4)
169 #define FP_LR_OFFSET64 ((uint32_t)8)
170 #define FP_MAX_NUM_TO_EVALUATE (50)
171
172 volatile int pbtcpu = -1;
173 hw_lock_data_t pbtlock; /* backtrace print lock */
174 uint32_t pbtcnt = 0;
175
176 volatile int panic_double_fault_cpu = -1;
177
178 #define PRINT_ARGS_FROM_STACK_FRAME 0
179
180 typedef struct _cframe_t {
181 struct _cframe_t *prev;
182 uintptr_t caller;
183 #if PRINT_ARGS_FROM_STACK_FRAME
184 unsigned args[0];
185 #endif
186 } cframe_t;
187
188 static unsigned panic_io_port;
189 static unsigned commit_paniclog_to_nvram;
190 boolean_t coprocessor_paniclog_flush = FALSE;
191
192 struct kcdata_descriptor kc_panic_data;
193 static boolean_t begun_panic_stackshot = FALSE;
194 extern kern_return_t do_stackshot(void *);
195
196 extern void kdp_snapshot_preflight(int pid, void *tracebuf,
197 uint32_t tracebuf_size, uint32_t flags,
198 kcdata_descriptor_t data_p,
199 boolean_t enable_faulting);
200 extern int kdp_stack_snapshot_bytes_traced(void);
201
202 vm_offset_t panic_stackshot_buf = 0;
203 size_t panic_stackshot_buf_len = 0;
204
205 size_t panic_stackshot_len = 0;
206 /*
207 * Backtrace a single frame.
208 */
209 void
210 print_one_backtrace(pmap_t pmap, vm_offset_t topfp, const char *cur_marker,
211 boolean_t is_64_bit)
212 {
213 int i = 0;
214 addr64_t lr;
215 addr64_t fp;
216 addr64_t fp_for_ppn;
217 ppnum_t ppn;
218 boolean_t dump_kernel_stack;
219
220 fp = topfp;
221 fp_for_ppn = 0;
222 ppn = (ppnum_t)NULL;
223
224 if (fp >= VM_MIN_KERNEL_ADDRESS) {
225 dump_kernel_stack = TRUE;
226 } else {
227 dump_kernel_stack = FALSE;
228 }
229
230 do {
231 if ((fp == 0) || ((fp & FP_ALIGNMENT_MASK) != 0)) {
232 break;
233 }
234 if (dump_kernel_stack && ((fp < VM_MIN_KERNEL_ADDRESS) || (fp > VM_MAX_KERNEL_ADDRESS))) {
235 break;
236 }
237 if ((!dump_kernel_stack) && (fp >= VM_MIN_KERNEL_ADDRESS)) {
238 break;
239 }
240
241 /* Check to see if current address will result in a different
242 * ppn than previously computed (to avoid recomputation) via
243 * (addr) ^ fp_for_ppn) >> PAGE_SHIFT) */
244
245 if ((((fp + FP_LR_OFFSET) ^ fp_for_ppn) >> PAGE_SHIFT) != 0x0U) {
246 ppn = pmap_find_phys(pmap, fp + FP_LR_OFFSET);
247 fp_for_ppn = fp + (is_64_bit ? FP_LR_OFFSET64 : FP_LR_OFFSET);
248 }
249 if (ppn != (ppnum_t)NULL) {
250 if (is_64_bit) {
251 lr = ml_phys_read_double_64(((((vm_offset_t)ppn) << PAGE_SHIFT)) | ((fp + FP_LR_OFFSET64) & PAGE_MASK));
252 } else {
253 lr = ml_phys_read_word(((((vm_offset_t)ppn) << PAGE_SHIFT)) | ((fp + FP_LR_OFFSET) & PAGE_MASK));
254 }
255 } else {
256 if (is_64_bit) {
257 paniclog_append_noflush("%s\t Could not read LR from frame at 0x%016llx\n", cur_marker, fp + FP_LR_OFFSET64);
258 } else {
259 paniclog_append_noflush("%s\t Could not read LR from frame at 0x%08x\n", cur_marker, (uint32_t)(fp + FP_LR_OFFSET));
260 }
261 break;
262 }
263 if (((fp ^ fp_for_ppn) >> PAGE_SHIFT) != 0x0U) {
264 ppn = pmap_find_phys(pmap, fp);
265 fp_for_ppn = fp;
266 }
267 if (ppn != (ppnum_t)NULL) {
268 if (is_64_bit) {
269 fp = ml_phys_read_double_64(((((vm_offset_t)ppn) << PAGE_SHIFT)) | (fp & PAGE_MASK));
270 } else {
271 fp = ml_phys_read_word(((((vm_offset_t)ppn) << PAGE_SHIFT)) | (fp & PAGE_MASK));
272 }
273 } else {
274 if (is_64_bit) {
275 paniclog_append_noflush("%s\t Could not read FP from frame at 0x%016llx\n", cur_marker, fp);
276 } else {
277 paniclog_append_noflush("%s\t Could not read FP from frame at 0x%08x\n", cur_marker, (uint32_t)fp);
278 }
279 break;
280 }
281
282 if (is_64_bit) {
283 paniclog_append_noflush("%s\t0x%016llx\n", cur_marker, lr);
284 } else {
285 paniclog_append_noflush("%s\t0x%08x\n", cur_marker, (uint32_t)lr);
286 }
287 } while ((++i < FP_MAX_NUM_TO_EVALUATE) && (fp != topfp));
288 }
289 void
290 machine_startup(void)
291 {
292 int boot_arg;
293
294 #if 0
295 if (PE_get_hotkey( kPEControlKey )) {
296 halt_in_debugger = halt_in_debugger ? 0 : 1;
297 }
298 #endif
299
300 if (!PE_parse_boot_argn("nvram_paniclog", &commit_paniclog_to_nvram, sizeof(commit_paniclog_to_nvram))) {
301 commit_paniclog_to_nvram = 1;
302 }
303
304 /*
305 * Entering the debugger will put the CPUs into a "safe"
306 * power mode.
307 */
308 if (PE_parse_boot_argn("pmsafe_debug", &boot_arg, sizeof(boot_arg))) {
309 pmsafe_debug = boot_arg;
310 }
311
312 hw_lock_init(&pbtlock); /* initialize print backtrace lock */
313
314 if (PE_parse_boot_argn("preempt", &boot_arg, sizeof(boot_arg))) {
315 default_preemption_rate = boot_arg;
316 }
317 if (PE_parse_boot_argn("unsafe", &boot_arg, sizeof(boot_arg))) {
318 max_unsafe_quanta = boot_arg;
319 }
320 if (PE_parse_boot_argn("poll", &boot_arg, sizeof(boot_arg))) {
321 max_poll_quanta = boot_arg;
322 }
323 if (PE_parse_boot_argn("yield", &boot_arg, sizeof(boot_arg))) {
324 sched_poll_yield_shift = boot_arg;
325 }
326 /* The I/O port to issue a read from, in the event of a panic. Useful for
327 * triggering logic analyzers.
328 */
329 if (PE_parse_boot_argn("panic_io_port", &boot_arg, sizeof(boot_arg))) {
330 /*I/O ports range from 0 through 0xFFFF */
331 panic_io_port = boot_arg & 0xffff;
332 }
333
334 machine_conf();
335
336 panic_hooks_init();
337
338 /*
339 * Start the system.
340 */
341 kernel_bootstrap();
342 /*NOTREACHED*/
343 }
344
345
346 static void
347 machine_conf(void)
348 {
349 machine_info.memory_size = (typeof(machine_info.memory_size))mem_size;
350 }
351
352 extern void *gPEEFIRuntimeServices;
353 extern void *gPEEFISystemTable;
354
355 static void
356 efi_set_tables_64(EFI_SYSTEM_TABLE_64 * system_table)
357 {
358 EFI_RUNTIME_SERVICES_64 *runtime;
359 uint32_t hdr_cksum;
360 uint32_t cksum;
361
362 DPRINTF("Processing 64-bit EFI tables at %p\n", system_table);
363 do {
364 DPRINTF("Header:\n");
365 DPRINTF(" Signature: 0x%016llx\n", system_table->Hdr.Signature);
366 DPRINTF(" Revision: 0x%08x\n", system_table->Hdr.Revision);
367 DPRINTF(" HeaderSize: 0x%08x\n", system_table->Hdr.HeaderSize);
368 DPRINTF(" CRC32: 0x%08x\n", system_table->Hdr.CRC32);
369 DPRINTF("RuntimeServices: 0x%016llx\n", system_table->RuntimeServices);
370 if (system_table->Hdr.Signature != EFI_SYSTEM_TABLE_SIGNATURE) {
371 kprintf("Bad EFI system table signature\n");
372 break;
373 }
374 // Verify signature of the system table
375 hdr_cksum = system_table->Hdr.CRC32;
376 system_table->Hdr.CRC32 = 0;
377 cksum = crc32(0L, system_table, system_table->Hdr.HeaderSize);
378
379 DPRINTF("System table calculated CRC32 = 0x%x, header = 0x%x\n", cksum, hdr_cksum);
380 system_table->Hdr.CRC32 = hdr_cksum;
381 if (cksum != hdr_cksum) {
382 kprintf("Bad EFI system table checksum\n");
383 break;
384 }
385
386 gPEEFISystemTable = system_table;
387
388 if (system_table->RuntimeServices == 0) {
389 kprintf("No runtime table present\n");
390 break;
391 }
392 DPRINTF("RuntimeServices table at 0x%qx\n", system_table->RuntimeServices);
393 // 64-bit virtual address is OK for 64-bit EFI and 64/32-bit kernel.
394 runtime = (EFI_RUNTIME_SERVICES_64 *) (uintptr_t)system_table->RuntimeServices;
395 DPRINTF("Checking runtime services table %p\n", runtime);
396 if (runtime->Hdr.Signature != EFI_RUNTIME_SERVICES_SIGNATURE) {
397 kprintf("Bad EFI runtime table signature\n");
398 break;
399 }
400
401 // Verify signature of runtime services table
402 hdr_cksum = runtime->Hdr.CRC32;
403 runtime->Hdr.CRC32 = 0;
404 cksum = crc32(0L, runtime, runtime->Hdr.HeaderSize);
405
406 DPRINTF("Runtime table calculated CRC32 = 0x%x, header = 0x%x\n", cksum, hdr_cksum);
407 runtime->Hdr.CRC32 = hdr_cksum;
408 if (cksum != hdr_cksum) {
409 kprintf("Bad EFI runtime table checksum\n");
410 break;
411 }
412
413 gPEEFIRuntimeServices = runtime;
414 }while (FALSE);
415 }
416
417 static void
418 efi_set_tables_32(EFI_SYSTEM_TABLE_32 * system_table)
419 {
420 EFI_RUNTIME_SERVICES_32 *runtime;
421 uint32_t hdr_cksum;
422 uint32_t cksum;
423
424 DPRINTF("Processing 32-bit EFI tables at %p\n", system_table);
425 do {
426 DPRINTF("Header:\n");
427 DPRINTF(" Signature: 0x%016llx\n", system_table->Hdr.Signature);
428 DPRINTF(" Revision: 0x%08x\n", system_table->Hdr.Revision);
429 DPRINTF(" HeaderSize: 0x%08x\n", system_table->Hdr.HeaderSize);
430 DPRINTF(" CRC32: 0x%08x\n", system_table->Hdr.CRC32);
431 DPRINTF("RuntimeServices: 0x%08x\n", system_table->RuntimeServices);
432 if (system_table->Hdr.Signature != EFI_SYSTEM_TABLE_SIGNATURE) {
433 kprintf("Bad EFI system table signature\n");
434 break;
435 }
436 // Verify signature of the system table
437 hdr_cksum = system_table->Hdr.CRC32;
438 system_table->Hdr.CRC32 = 0;
439 DPRINTF("System table at %p HeaderSize 0x%x\n", system_table, system_table->Hdr.HeaderSize);
440 cksum = crc32(0L, system_table, system_table->Hdr.HeaderSize);
441
442 DPRINTF("System table calculated CRC32 = 0x%x, header = 0x%x\n", cksum, hdr_cksum);
443 system_table->Hdr.CRC32 = hdr_cksum;
444 if (cksum != hdr_cksum) {
445 kprintf("Bad EFI system table checksum\n");
446 break;
447 }
448
449 gPEEFISystemTable = system_table;
450
451 if (system_table->RuntimeServices == 0) {
452 kprintf("No runtime table present\n");
453 break;
454 }
455 DPRINTF("RuntimeServices table at 0x%x\n", system_table->RuntimeServices);
456 // 32-bit virtual address is OK for 32-bit EFI and 32-bit kernel.
457 // For a 64-bit kernel, booter provides a virtual address mod 4G
458 runtime = (EFI_RUNTIME_SERVICES_32 *)
459 (system_table->RuntimeServices | VM_MIN_KERNEL_ADDRESS);
460 DPRINTF("Runtime table addressed at %p\n", runtime);
461 if (runtime->Hdr.Signature != EFI_RUNTIME_SERVICES_SIGNATURE) {
462 kprintf("Bad EFI runtime table signature\n");
463 break;
464 }
465
466 // Verify signature of runtime services table
467 hdr_cksum = runtime->Hdr.CRC32;
468 runtime->Hdr.CRC32 = 0;
469 cksum = crc32(0L, runtime, runtime->Hdr.HeaderSize);
470
471 DPRINTF("Runtime table calculated CRC32 = 0x%x, header = 0x%x\n", cksum, hdr_cksum);
472 runtime->Hdr.CRC32 = hdr_cksum;
473 if (cksum != hdr_cksum) {
474 kprintf("Bad EFI runtime table checksum\n");
475 break;
476 }
477
478 DPRINTF("Runtime functions\n");
479 DPRINTF(" GetTime : 0x%x\n", runtime->GetTime);
480 DPRINTF(" SetTime : 0x%x\n", runtime->SetTime);
481 DPRINTF(" GetWakeupTime : 0x%x\n", runtime->GetWakeupTime);
482 DPRINTF(" SetWakeupTime : 0x%x\n", runtime->SetWakeupTime);
483 DPRINTF(" SetVirtualAddressMap : 0x%x\n", runtime->SetVirtualAddressMap);
484 DPRINTF(" ConvertPointer : 0x%x\n", runtime->ConvertPointer);
485 DPRINTF(" GetVariable : 0x%x\n", runtime->GetVariable);
486 DPRINTF(" GetNextVariableName : 0x%x\n", runtime->GetNextVariableName);
487 DPRINTF(" SetVariable : 0x%x\n", runtime->SetVariable);
488 DPRINTF(" GetNextHighMonotonicCount: 0x%x\n", runtime->GetNextHighMonotonicCount);
489 DPRINTF(" ResetSystem : 0x%x\n", runtime->ResetSystem);
490
491 gPEEFIRuntimeServices = runtime;
492 }while (FALSE);
493 }
494
495
496 /* Map in EFI runtime areas. */
497 static void
498 efi_init(void)
499 {
500 boot_args *args = (boot_args *)PE_state.bootArgs;
501
502 kprintf("Initializing EFI runtime services\n");
503
504 do{
505 vm_offset_t vm_size, vm_addr;
506 vm_map_offset_t phys_addr;
507 EfiMemoryRange *mptr;
508 unsigned int msize, mcount;
509 unsigned int i;
510
511 msize = args->MemoryMapDescriptorSize;
512 mcount = args->MemoryMapSize / msize;
513
514 DPRINTF("efi_init() kernel base: 0x%x size: 0x%x\n",
515 args->kaddr, args->ksize);
516 DPRINTF(" efiSystemTable physical: 0x%x virtual: %p\n",
517 args->efiSystemTable,
518 (void *) ml_static_ptovirt(args->efiSystemTable));
519 DPRINTF(" efiRuntimeServicesPageStart: 0x%x\n",
520 args->efiRuntimeServicesPageStart);
521 DPRINTF(" efiRuntimeServicesPageCount: 0x%x\n",
522 args->efiRuntimeServicesPageCount);
523 DPRINTF(" efiRuntimeServicesVirtualPageStart: 0x%016llx\n",
524 args->efiRuntimeServicesVirtualPageStart);
525 mptr = (EfiMemoryRange *)ml_static_ptovirt(args->MemoryMap);
526 for (i = 0; i < mcount; i++, mptr = (EfiMemoryRange *)(((vm_offset_t)mptr) + msize)) {
527 if (((mptr->Attribute & EFI_MEMORY_RUNTIME) == EFI_MEMORY_RUNTIME)) {
528 vm_size = (vm_offset_t)i386_ptob((uint32_t)mptr->NumberOfPages);
529 vm_addr = (vm_offset_t) mptr->VirtualStart;
530 /* For K64 on EFI32, shadow-map into high KVA */
531 if (vm_addr < VM_MIN_KERNEL_ADDRESS) {
532 vm_addr |= VM_MIN_KERNEL_ADDRESS;
533 }
534 phys_addr = (vm_map_offset_t) mptr->PhysicalStart;
535 DPRINTF(" Type: %x phys: %p EFIv: %p kv: %p size: %p\n",
536 mptr->Type,
537 (void *) (uintptr_t) phys_addr,
538 (void *) (uintptr_t) mptr->VirtualStart,
539 (void *) vm_addr,
540 (void *) vm_size);
541 pmap_map_bd(vm_addr, phys_addr, phys_addr + round_page(vm_size),
542 (mptr->Type == kEfiRuntimeServicesCode) ? VM_PROT_READ | VM_PROT_EXECUTE : VM_PROT_READ | VM_PROT_WRITE,
543 (mptr->Type == EfiMemoryMappedIO) ? VM_WIMG_IO : VM_WIMG_USE_DEFAULT);
544 }
545 }
546
547 if (args->Version != kBootArgsVersion2) {
548 panic("Incompatible boot args version %d revision %d\n", args->Version, args->Revision);
549 }
550
551 DPRINTF("Boot args version %d revision %d mode %d\n", args->Version, args->Revision, args->efiMode);
552 if (args->efiMode == kBootArgsEfiMode64) {
553 efi_set_tables_64((EFI_SYSTEM_TABLE_64 *) ml_static_ptovirt(args->efiSystemTable));
554 } else {
555 efi_set_tables_32((EFI_SYSTEM_TABLE_32 *) ml_static_ptovirt(args->efiSystemTable));
556 }
557 }while (FALSE);
558
559 return;
560 }
561
562 /* Returns TRUE if a page belongs to the EFI Runtime Services (code or data) */
563 boolean_t
564 bootloader_valid_page(ppnum_t ppn)
565 {
566 boot_args *args = (boot_args *)PE_state.bootArgs;
567 ppnum_t pstart = args->efiRuntimeServicesPageStart;
568 ppnum_t pend = pstart + args->efiRuntimeServicesPageCount;
569
570 return pstart <= ppn && ppn < pend;
571 }
572
573 /* Remap EFI runtime areas. */
574 void
575 hibernate_newruntime_map(void * map, vm_size_t map_size, uint32_t system_table_offset)
576 {
577 boot_args *args = (boot_args *)PE_state.bootArgs;
578
579 kprintf("Reinitializing EFI runtime services\n");
580
581 do{
582 vm_offset_t vm_size, vm_addr;
583 vm_map_offset_t phys_addr;
584 EfiMemoryRange *mptr;
585 unsigned int msize, mcount;
586 unsigned int i;
587
588 gPEEFISystemTable = 0;
589 gPEEFIRuntimeServices = 0;
590
591 system_table_offset += ptoa_32(args->efiRuntimeServicesPageStart);
592
593 kprintf("Old system table 0x%x, new 0x%x\n",
594 (uint32_t)args->efiSystemTable, system_table_offset);
595
596 args->efiSystemTable = system_table_offset;
597
598 kprintf("Old map:\n");
599 msize = args->MemoryMapDescriptorSize;
600 mcount = args->MemoryMapSize / msize;
601 mptr = (EfiMemoryRange *)ml_static_ptovirt(args->MemoryMap);
602 for (i = 0; i < mcount; i++, mptr = (EfiMemoryRange *)(((vm_offset_t)mptr) + msize)) {
603 if ((mptr->Attribute & EFI_MEMORY_RUNTIME) == EFI_MEMORY_RUNTIME) {
604 vm_size = (vm_offset_t)i386_ptob((uint32_t)mptr->NumberOfPages);
605 vm_addr = (vm_offset_t) mptr->VirtualStart;
606 /* K64 on EFI32 */
607 if (vm_addr < VM_MIN_KERNEL_ADDRESS) {
608 vm_addr |= VM_MIN_KERNEL_ADDRESS;
609 }
610 phys_addr = (vm_map_offset_t) mptr->PhysicalStart;
611
612 kprintf("mapping[%u] %qx @ %lx, %llu\n", mptr->Type, phys_addr, (unsigned long)vm_addr, mptr->NumberOfPages);
613 }
614 }
615
616 pmap_remove(kernel_pmap, i386_ptob(args->efiRuntimeServicesPageStart),
617 i386_ptob(args->efiRuntimeServicesPageStart + args->efiRuntimeServicesPageCount));
618
619 kprintf("New map:\n");
620 msize = args->MemoryMapDescriptorSize;
621 mcount = (unsigned int)(map_size / msize);
622 mptr = map;
623 for (i = 0; i < mcount; i++, mptr = (EfiMemoryRange *)(((vm_offset_t)mptr) + msize)) {
624 if ((mptr->Attribute & EFI_MEMORY_RUNTIME) == EFI_MEMORY_RUNTIME) {
625 vm_size = (vm_offset_t)i386_ptob((uint32_t)mptr->NumberOfPages);
626 vm_addr = (vm_offset_t) mptr->VirtualStart;
627 if (vm_addr < VM_MIN_KERNEL_ADDRESS) {
628 vm_addr |= VM_MIN_KERNEL_ADDRESS;
629 }
630 phys_addr = (vm_map_offset_t) mptr->PhysicalStart;
631
632 kprintf("mapping[%u] %qx @ %lx, %llu\n", mptr->Type, phys_addr, (unsigned long)vm_addr, mptr->NumberOfPages);
633
634 pmap_map(vm_addr, phys_addr, phys_addr + round_page(vm_size),
635 (mptr->Type == kEfiRuntimeServicesCode) ? VM_PROT_READ | VM_PROT_EXECUTE : VM_PROT_READ | VM_PROT_WRITE,
636 (mptr->Type == EfiMemoryMappedIO) ? VM_WIMG_IO : VM_WIMG_USE_DEFAULT);
637 }
638 }
639
640 if (args->Version != kBootArgsVersion2) {
641 panic("Incompatible boot args version %d revision %d\n", args->Version, args->Revision);
642 }
643
644 kprintf("Boot args version %d revision %d mode %d\n", args->Version, args->Revision, args->efiMode);
645 if (args->efiMode == kBootArgsEfiMode64) {
646 efi_set_tables_64((EFI_SYSTEM_TABLE_64 *) ml_static_ptovirt(args->efiSystemTable));
647 } else {
648 efi_set_tables_32((EFI_SYSTEM_TABLE_32 *) ml_static_ptovirt(args->efiSystemTable));
649 }
650 }while (FALSE);
651
652 kprintf("Done reinitializing EFI runtime services\n");
653
654 return;
655 }
656
657 /*
658 * Find devices. The system is alive.
659 */
660 void
661 machine_init(void)
662 {
663 /* Now with VM up, switch to dynamically allocated cpu data */
664 cpu_data_realloc();
665
666 /* Ensure panic buffer is initialized. */
667 debug_log_init();
668
669 /*
670 * Display CPU identification
671 */
672 cpuid_cpu_display("CPU identification");
673 cpuid_feature_display("CPU features");
674 cpuid_extfeature_display("CPU extended features");
675
676 /*
677 * Initialize EFI runtime services.
678 */
679 efi_init();
680
681 smp_init();
682
683 /*
684 * Set up to use floating point.
685 */
686 init_fpu();
687
688 /*
689 * Configure clock devices.
690 */
691 clock_config();
692
693 #if CONFIG_MTRR
694 /*
695 * Initialize MTRR from boot processor.
696 */
697 mtrr_init();
698
699 /*
700 * Set up PAT for boot processor.
701 */
702 pat_init();
703 #endif
704
705 /*
706 * Free lowmem pages and complete other setup
707 */
708 pmap_lowmem_finalize();
709 }
710
711 /*
712 * Halt a cpu.
713 */
714 void
715 halt_cpu(void)
716 {
717 halt_all_cpus(FALSE);
718 }
719
720 int reset_mem_on_reboot = 1;
721
722 /*
723 * Halt the system or reboot.
724 */
725 __attribute__((noreturn))
726 void
727 halt_all_cpus(boolean_t reboot)
728 {
729 if (reboot) {
730 printf("MACH Reboot\n");
731 PEHaltRestart( kPERestartCPU );
732 } else {
733 printf("CPU halted\n");
734 PEHaltRestart( kPEHaltCPU );
735 }
736 while (1) {
737 ;
738 }
739 }
740
741
742 /* Issue an I/O port read if one has been requested - this is an event logic
743 * analyzers can use as a trigger point.
744 */
745
746 void
747 panic_io_port_read(void)
748 {
749 if (panic_io_port) {
750 (void)inb(panic_io_port);
751 }
752 }
753
754 /* For use with the MP rendezvous mechanism
755 */
756
757 uint64_t panic_restart_timeout = ~(0ULL);
758
759 #define PANIC_RESTART_TIMEOUT (3ULL * NSEC_PER_SEC)
760
761 /*
762 * We should always return from this function with the other log offset
763 * set in the panic_info structure.
764 */
765 void
766 RecordPanicStackshot()
767 {
768 int err = 0;
769 size_t bytes_traced = 0, bytes_used = 0, bytes_remaining = 0;
770 char *stackshot_begin_loc = NULL;
771
772 /* Don't re-enter this code if we panic here */
773 if (begun_panic_stackshot) {
774 if (panic_info->mph_other_log_offset == 0) {
775 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
776 }
777 return;
778 }
779 begun_panic_stackshot = TRUE;
780
781 /* The panic log length should have been set before we came to capture a stackshot */
782 if (panic_info->mph_panic_log_len == 0) {
783 kdb_printf("Found zero length panic log, skipping capturing panic stackshot\n");
784 if (panic_info->mph_other_log_offset == 0) {
785 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
786 }
787 return;
788 }
789
790 if (stackshot_active()) {
791 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_NESTED;
792 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
793 kdb_printf("Panicked during stackshot, skipping panic stackshot\n");
794 return;
795 }
796
797 /* Try to capture an in memory panic_stackshot */
798 if (extended_debug_log_enabled) {
799 /* On coprocessor systems we write this into the extended debug log */
800 stackshot_begin_loc = debug_buf_ptr;
801 bytes_remaining = debug_buf_size - (unsigned int)((uintptr_t)stackshot_begin_loc - (uintptr_t)debug_buf_base);
802 } else if (panic_stackshot_buf != 0) {
803 /* On other systems we use the panic stackshot_buf */
804 stackshot_begin_loc = (char *) panic_stackshot_buf;
805 bytes_remaining = panic_stackshot_buf_len;
806 } else {
807 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
808 return;
809 }
810
811
812 err = kcdata_memory_static_init(&kc_panic_data, (mach_vm_address_t)stackshot_begin_loc,
813 KCDATA_BUFFER_BEGIN_STACKSHOT, (unsigned int) bytes_remaining, KCFLAG_USE_MEMCOPY);
814 if (err != KERN_SUCCESS) {
815 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR;
816 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
817 kdb_printf("Failed to initialize kcdata buffer for in-memory panic stackshot, skipping ...\n");
818 return;
819 }
820
821 uint32_t stackshot_flags = (STACKSHOT_SAVE_KEXT_LOADINFO | STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT |
822 STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING | STACKSHOT_FROM_PANIC |
823 STACKSHOT_NO_IO_STATS | STACKSHOT_THREAD_WAITINFO);
824 #if DEVELOPMENT
825 /*
826 * Include the shared cache layout in panic stackshots on DEVELOPMENT kernels so that we can symbolicate
827 * panic stackshots from corefiles.
828 */
829 stackshot_flags |= STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT;
830 #endif
831
832 kdp_snapshot_preflight(-1, (void *) stackshot_begin_loc, (uint32_t) bytes_remaining, stackshot_flags, &kc_panic_data, 0);
833 err = do_stackshot(NULL);
834 bytes_traced = (int) kdp_stack_snapshot_bytes_traced();
835 bytes_used = (int) kcdata_memory_get_used_bytes(&kc_panic_data);
836
837 if ((err != KERN_SUCCESS) && (bytes_used > 0)) {
838 /*
839 * We ran out of space while trying to capture a stackshot, try again without user frames.
840 * It's not safe to log from here (in case we're writing in the middle of the debug buffer on coprocessor systems)
841 * but append a flag to the panic flags.
842 */
843 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_KERNEL_ONLY;
844 panic_stackshot_reset_state();
845
846 /* Erase the stackshot data (this region is pre-populated with the NULL character) */
847 memset(stackshot_begin_loc, '\0', bytes_used);
848
849 err = kcdata_memory_static_init(&kc_panic_data, (mach_vm_address_t)stackshot_begin_loc,
850 KCDATA_BUFFER_BEGIN_STACKSHOT, (unsigned int) bytes_remaining, KCFLAG_USE_MEMCOPY);
851 if (err != KERN_SUCCESS) {
852 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR;
853 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
854 kdb_printf("Failed to re-initialize kcdata buffer for kernel only in-memory panic stackshot, skipping ...\n");
855 return;
856 }
857
858 stackshot_flags = (STACKSHOT_SAVE_KEXT_LOADINFO | STACKSHOT_KCDATA_FORMAT | STACKSHOT_FROM_PANIC |
859 STACKSHOT_NO_IO_STATS | STACKSHOT_THREAD_WAITINFO | STACKSHOT_ACTIVE_KERNEL_THREADS_ONLY);
860 #if DEVELOPMENT
861 /*
862 * Include the shared cache layout in panic stackshots on DEVELOPMENT kernels so that we can symbolicate
863 * panic stackshots from corefiles.
864 */
865 stackshot_flags |= STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT;
866 #endif
867
868 kdp_snapshot_preflight(-1, (void *) stackshot_begin_loc, (uint32_t) bytes_remaining, stackshot_flags, &kc_panic_data, 0);
869 err = do_stackshot(NULL);
870 bytes_traced = (int) kdp_stack_snapshot_bytes_traced();
871 bytes_used = (int) kcdata_memory_get_used_bytes(&kc_panic_data);
872 }
873
874 if (err == KERN_SUCCESS) {
875 if (extended_debug_log_enabled) {
876 debug_buf_ptr += bytes_traced;
877 }
878 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_SUCCEEDED;
879 panic_info->mph_stackshot_offset = PE_get_offset_into_panic_region(stackshot_begin_loc);
880 panic_info->mph_stackshot_len = (uint32_t) bytes_traced;
881
882 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
883 kdb_printf("\n** In Memory Panic Stackshot Succeeded ** Bytes Traced %zu **\n", bytes_traced);
884
885 /* Used by the code that writes the buffer to disk */
886 panic_stackshot_buf = (vm_offset_t) stackshot_begin_loc;
887 panic_stackshot_len = bytes_traced;
888
889 if (!extended_debug_log_enabled && (gIOPolledCoreFileMode == kIOPolledCoreFileModeStackshot)) {
890 /* System configured to write panic stackshot to disk */
891 kern_dump(KERN_DUMP_STACKSHOT_DISK);
892 }
893 } else {
894 if (bytes_used > 0) {
895 /* Erase the stackshot data (this region is pre-populated with the NULL character) */
896 memset(stackshot_begin_loc, '\0', bytes_used);
897 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_INCOMPLETE;
898
899 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
900 kdb_printf("\n** In Memory Panic Stackshot Incomplete ** Bytes Filled %zu ** Err %d\n", bytes_used, err);
901 } else {
902 bzero(stackshot_begin_loc, bytes_used);
903 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR;
904
905 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
906 kdb_printf("\n** In Memory Panic Stackshot Failed ** Bytes Traced %zu, err %d\n", bytes_traced, err);
907 }
908 }
909
910 return;
911 }
912
913 void
914 SavePanicInfo(
915 __unused const char *message, void *panic_data, uint64_t panic_options)
916 {
917 void *stackptr = NULL;
918 thread_t thread_to_trace = (thread_t) panic_data;
919 cframe_t synthetic_stack_frame = { };
920 char *debugger_msg = NULL;
921 int cn = cpu_number();
922
923 /*
924 * Issue an I/O port read if one has been requested - this is an event logic
925 * analyzers can use as a trigger point.
926 */
927 panic_io_port_read();
928
929 /* Obtain frame pointer for stack to trace */
930 if (panic_options & DEBUGGER_INTERNAL_OPTION_THREAD_BACKTRACE) {
931 if (!mp_kdp_all_cpus_halted()) {
932 debugger_msg = "Backtracing panicked thread because failed to halt all CPUs\n";
933 } else if (thread_to_trace == THREAD_NULL) {
934 debugger_msg = "Backtracing panicked thread because no thread pointer provided\n";
935 } else if (kvtophys((vm_offset_t)thread_to_trace) == 0ULL) {
936 debugger_msg = "Backtracing panicked thread because unable to access specified thread\n";
937 } else if (thread_to_trace->kernel_stack == 0) {
938 debugger_msg = "Backtracing panicked thread because kernel_stack is NULL for specified thread\n";
939 } else if (kvtophys(STACK_IKS(thread_to_trace->kernel_stack) == 0ULL)) {
940 debugger_msg = "Backtracing panicked thread because unable to access kernel_stack for specified thread\n";
941 } else {
942 debugger_msg = "Backtracing specified thread\n";
943 /* We construct a synthetic stack frame so we can include the current instruction pointer */
944 synthetic_stack_frame.prev = (cframe_t *)STACK_IKS(thread_to_trace->kernel_stack)->k_rbp;
945 synthetic_stack_frame.caller = (uintptr_t) STACK_IKS(thread_to_trace->kernel_stack)->k_rip;
946 stackptr = (void *) &synthetic_stack_frame;
947 }
948 }
949
950 if (stackptr == NULL) {
951 __asm__ volatile ("movq %%rbp, %0" : "=m" (stackptr));
952 }
953
954 /* Print backtrace - callee is internally synchronized */
955 if (panic_options & DEBUGGER_OPTION_INITPROC_PANIC) {
956 /* Special handling of launchd died panics */
957 print_launchd_info();
958 } else {
959 panic_i386_backtrace(stackptr, ((panic_double_fault_cpu == cn) ? 80: 48), debugger_msg, FALSE, NULL);
960 }
961
962 if (panic_options & DEBUGGER_OPTION_COPROC_INITIATED_PANIC) {
963 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_COPROC_INITIATED_PANIC;
964 }
965
966 if (PE_get_offset_into_panic_region(debug_buf_ptr) < panic_info->mph_panic_log_offset) {
967 kdb_printf("Invalid panic log offset found (not properly initialized?): debug_buf_ptr : 0x%p, panic_info: 0x%p mph_panic_log_offset: 0x%x\n",
968 debug_buf_ptr, panic_info, panic_info->mph_panic_log_offset);
969 panic_info->mph_panic_log_len = 0;
970 } else {
971 panic_info->mph_panic_log_len = PE_get_offset_into_panic_region(debug_buf_ptr) - panic_info->mph_panic_log_offset;
972 }
973
974 /* Flush the panic log */
975 paniclog_flush_internal(kPaniclogFlushBase);
976
977 /* Try to take a panic stackshot */
978 RecordPanicStackshot();
979
980 /*
981 * Flush the panic log again with the stackshot or any relevant logging
982 * from when we tried to capture it.
983 */
984 paniclog_flush_internal(kPaniclogFlushStackshot);
985 }
986
987 void
988 paniclog_flush_internal(paniclog_flush_type_t variant)
989 {
990 /* Update the other log offset if we've opened the other log */
991 if (panic_info->mph_other_log_offset != 0) {
992 panic_info->mph_other_log_len = PE_get_offset_into_panic_region(debug_buf_ptr) - panic_info->mph_other_log_offset;
993 }
994
995 /*
996 * If we've detected that we're on a co-processor system, we flush the panic log via the kPEPanicSync
997 * panic callbacks, otherwise we flush via nvram (unless that has been disabled).
998 */
999 if (coprocessor_paniclog_flush) {
1000 uint32_t overall_buffer_size = debug_buf_size;
1001 uint32_t size_to_flush = 0, offset_to_flush = 0;
1002 if (extended_debug_log_enabled) {
1003 /*
1004 * debug_buf_size for the extended log does not include the length of the header.
1005 * There may be some extra data at the end of the 'basic' log that wouldn't get flushed
1006 * for the non-extended case (this is a concession we make to not shrink the paniclog data
1007 * for non-coprocessor systems that only use the basic log).
1008 */
1009 overall_buffer_size = debug_buf_size + sizeof(struct macos_panic_header);
1010 }
1011
1012 /* Update the CRC */
1013 panic_info->mph_crc = crc32(0L, &panic_info->mph_version, (overall_buffer_size - offsetof(struct macos_panic_header, mph_version)));
1014
1015 if (variant == kPaniclogFlushBase) {
1016 /* Flush the header and base panic log. */
1017 kprintf("Flushing base panic log\n");
1018 size_to_flush = ROUNDUP((panic_info->mph_panic_log_offset + panic_info->mph_panic_log_len), PANIC_FLUSH_BOUNDARY);
1019 offset_to_flush = 0;
1020 PESavePanicInfoAction(panic_info, offset_to_flush, size_to_flush);
1021 } else if ((variant == kPaniclogFlushStackshot) || (variant == kPaniclogFlushOtherLog)) {
1022 if (variant == kPaniclogFlushStackshot) {
1023 /*
1024 * We flush the stackshot before flushing the updated header because the stackshot
1025 * can take a while to flush. We want the paniclog header to be as consistent as possible even
1026 * if the stackshot isn't flushed completely. Flush starting from the end of the panic log.
1027 */
1028 kprintf("Flushing panic log stackshot\n");
1029 offset_to_flush = ROUNDDOWN((panic_info->mph_panic_log_offset + panic_info->mph_panic_log_len), PANIC_FLUSH_BOUNDARY);
1030 size_to_flush = ROUNDUP((panic_info->mph_stackshot_len + (panic_info->mph_stackshot_offset - offset_to_flush)), PANIC_FLUSH_BOUNDARY);
1031 PESavePanicInfoAction(panic_info, offset_to_flush, size_to_flush);
1032 }
1033
1034 /* Flush the other log -- everything after the stackshot */
1035 kprintf("Flushing panic 'other' log\n");
1036 offset_to_flush = ROUNDDOWN((panic_info->mph_stackshot_offset + panic_info->mph_stackshot_len), PANIC_FLUSH_BOUNDARY);
1037 size_to_flush = ROUNDUP((panic_info->mph_other_log_len + (panic_info->mph_other_log_offset - offset_to_flush)), PANIC_FLUSH_BOUNDARY);
1038 PESavePanicInfoAction(panic_info, offset_to_flush, size_to_flush);
1039
1040 /* Flush the header -- everything before the paniclog */
1041 kprintf("Flushing panic log header\n");
1042 size_to_flush = ROUNDUP(panic_info->mph_panic_log_offset, PANIC_FLUSH_BOUNDARY);
1043 offset_to_flush = 0;
1044 PESavePanicInfoAction(panic_info, offset_to_flush, size_to_flush);
1045 }
1046 } else if (commit_paniclog_to_nvram) {
1047 assert(debug_buf_size != 0);
1048 unsigned int bufpos;
1049 unsigned long pi_size = 0;
1050 uintptr_t cr0;
1051
1052 debug_putc(0);
1053
1054 /*
1055 * Now call the compressor
1056 * XXX Consider using the WKdm compressor in the
1057 * future, rather than just packing - would need to
1058 * be co-ordinated with crashreporter, which decodes
1059 * this post-restart. The compressor should be
1060 * capable of in-place compression.
1061 *
1062 * Don't include the macOS panic header (for co-processor systems only)
1063 */
1064 bufpos = packA(debug_buf_base, (unsigned int) (debug_buf_ptr - debug_buf_base),
1065 debug_buf_size);
1066 /*
1067 * If compression was successful, use the compressed length
1068 */
1069 pi_size = bufpos ? bufpos : (unsigned) (debug_buf_ptr - debug_buf_base);
1070
1071 /*
1072 * The following sequence is a workaround for:
1073 * <rdar://problem/5915669> SnowLeopard10A67: AppleEFINVRAM should not invoke
1074 * any routines that use floating point (MMX in this case) when saving panic
1075 * logs to nvram/flash.
1076 */
1077 cr0 = get_cr0();
1078 clear_ts();
1079
1080 /*
1081 * Save panic log to non-volatile store
1082 * Panic info handler must truncate data that is
1083 * too long for this platform.
1084 * This call must save data synchronously,
1085 * since we can subsequently halt the system.
1086 */
1087 kprintf("Attempting to commit panic log to NVRAM\n");
1088 pi_size = PESavePanicInfo((unsigned char *)debug_buf_base,
1089 (uint32_t)pi_size );
1090 set_cr0(cr0);
1091
1092 /*
1093 * Uncompress in-place, to permit examination of
1094 * the panic log by debuggers.
1095 */
1096 if (bufpos) {
1097 unpackA(debug_buf_base, bufpos);
1098 }
1099 }
1100 }
1101
1102 void
1103 paniclog_flush()
1104 {
1105 /* Called outside of this file to update logging appended to the "other" log */
1106 paniclog_flush_internal(kPaniclogFlushOtherLog);
1107 return;
1108 }
1109
1110 char *
1111 machine_boot_info(char *buf, __unused vm_size_t size)
1112 {
1113 *buf = '\0';
1114 return buf;
1115 }
1116
1117 /* Routines for address - symbol translation. Not called unless the "keepsyms"
1118 * boot-arg is supplied.
1119 */
1120
1121 static int
1122 panic_print_macho_symbol_name(kernel_mach_header_t *mh, vm_address_t search, const char *module_name)
1123 {
1124 kernel_nlist_t *sym = NULL;
1125 struct load_command *cmd;
1126 kernel_segment_command_t *orig_ts = NULL, *orig_le = NULL;
1127 struct symtab_command *orig_st = NULL;
1128 unsigned int i;
1129 char *strings, *bestsym = NULL;
1130 vm_address_t bestaddr = 0, diff, curdiff;
1131
1132 /* Assume that if it's loaded and linked into the kernel, it's a valid Mach-O */
1133
1134 cmd = (struct load_command *) &mh[1];
1135 for (i = 0; i < mh->ncmds; i++) {
1136 if (cmd->cmd == LC_SEGMENT_KERNEL) {
1137 kernel_segment_command_t *orig_sg = (kernel_segment_command_t *) cmd;
1138
1139 if (strncmp(SEG_TEXT, orig_sg->segname,
1140 sizeof(orig_sg->segname)) == 0) {
1141 orig_ts = orig_sg;
1142 } else if (strncmp(SEG_LINKEDIT, orig_sg->segname,
1143 sizeof(orig_sg->segname)) == 0) {
1144 orig_le = orig_sg;
1145 } else if (strncmp("", orig_sg->segname,
1146 sizeof(orig_sg->segname)) == 0) {
1147 orig_ts = orig_sg; /* pre-Lion i386 kexts have a single unnamed segment */
1148 }
1149 } else if (cmd->cmd == LC_SYMTAB) {
1150 orig_st = (struct symtab_command *) cmd;
1151 }
1152
1153 cmd = (struct load_command *) ((uintptr_t) cmd + cmd->cmdsize);
1154 }
1155
1156 if ((orig_ts == NULL) || (orig_st == NULL) || (orig_le == NULL)) {
1157 return 0;
1158 }
1159
1160 if ((search < orig_ts->vmaddr) ||
1161 (search >= orig_ts->vmaddr + orig_ts->vmsize)) {
1162 /* search out of range for this mach header */
1163 return 0;
1164 }
1165
1166 sym = (kernel_nlist_t *)(uintptr_t)(orig_le->vmaddr + orig_st->symoff - orig_le->fileoff);
1167 strings = (char *)(uintptr_t)(orig_le->vmaddr + orig_st->stroff - orig_le->fileoff);
1168 diff = search;
1169
1170 for (i = 0; i < orig_st->nsyms; i++) {
1171 if (sym[i].n_type & N_STAB) {
1172 continue;
1173 }
1174
1175 if (sym[i].n_value <= search) {
1176 curdiff = search - (vm_address_t)sym[i].n_value;
1177 if (curdiff < diff) {
1178 diff = curdiff;
1179 bestaddr = sym[i].n_value;
1180 bestsym = strings + sym[i].n_un.n_strx;
1181 }
1182 }
1183 }
1184
1185 if (bestsym != NULL) {
1186 if (diff != 0) {
1187 paniclog_append_noflush("%s : %s + 0x%lx", module_name, bestsym, (unsigned long)diff);
1188 } else {
1189 paniclog_append_noflush("%s : %s", module_name, bestsym);
1190 }
1191 return 1;
1192 }
1193 return 0;
1194 }
1195
1196 extern kmod_info_t * kmod; /* the list of modules */
1197
1198 static void
1199 panic_print_kmod_symbol_name(vm_address_t search)
1200 {
1201 u_int i;
1202
1203 if (gLoadedKextSummaries == NULL) {
1204 return;
1205 }
1206 for (i = 0; i < gLoadedKextSummaries->numSummaries; ++i) {
1207 OSKextLoadedKextSummary *summary = gLoadedKextSummaries->summaries + i;
1208
1209 if ((search >= summary->address) &&
1210 (search < (summary->address + summary->size))) {
1211 kernel_mach_header_t *header = (kernel_mach_header_t *)(uintptr_t) summary->address;
1212 if (panic_print_macho_symbol_name(header, search, summary->name) == 0) {
1213 paniclog_append_noflush("%s + %llu", summary->name, (unsigned long)search - summary->address);
1214 }
1215 break;
1216 }
1217 }
1218 }
1219
1220 void
1221 panic_print_symbol_name(vm_address_t search)
1222 {
1223 /* try searching in the kernel */
1224 if (panic_print_macho_symbol_name(&_mh_execute_header, search, "mach_kernel") == 0) {
1225 /* that failed, now try to search for the right kext */
1226 panic_print_kmod_symbol_name(search);
1227 }
1228 }
1229
1230 /* Generate a backtrace, given a frame pointer - this routine
1231 * should walk the stack safely. The trace is appended to the panic log
1232 * and conditionally, to the console. If the trace contains kernel module
1233 * addresses, display the module name, load address and dependencies.
1234 */
1235
1236 #define DUMPFRAMES 32
1237 #define PBT_TIMEOUT_CYCLES (5 * 1000 * 1000 * 1000ULL)
1238 void
1239 panic_i386_backtrace(void *_frame, int nframes, const char *msg, boolean_t regdump, x86_saved_state_t *regs)
1240 {
1241 cframe_t *frame = (cframe_t *)_frame;
1242 vm_offset_t raddrs[DUMPFRAMES];
1243 vm_offset_t PC = 0;
1244 int frame_index;
1245 volatile uint32_t *ppbtcnt = &pbtcnt;
1246 uint64_t bt_tsc_timeout;
1247 boolean_t keepsyms = FALSE;
1248 int cn = cpu_number();
1249 boolean_t old_doprnt_hide_pointers = doprnt_hide_pointers;
1250
1251 if (pbtcpu != cn) {
1252 os_atomic_inc(&pbtcnt, relaxed);
1253 /* Spin on print backtrace lock, which serializes output
1254 * Continue anyway if a timeout occurs.
1255 */
1256 hw_lock_to(&pbtlock, ~0U, LCK_GRP_NULL);
1257 pbtcpu = cn;
1258 }
1259
1260 if (__improbable(doprnt_hide_pointers == TRUE)) {
1261 /* If we're called directly, the Debugger() function will not be called,
1262 * so we need to reset the value in here. */
1263 doprnt_hide_pointers = FALSE;
1264 }
1265
1266 panic_check_hook();
1267
1268 PE_parse_boot_argn("keepsyms", &keepsyms, sizeof(keepsyms));
1269
1270 if (msg != NULL) {
1271 paniclog_append_noflush("%s", msg);
1272 }
1273
1274 if ((regdump == TRUE) && (regs != NULL)) {
1275 x86_saved_state64_t *ss64p = saved_state64(regs);
1276 paniclog_append_noflush(
1277 "RAX: 0x%016llx, RBX: 0x%016llx, RCX: 0x%016llx, RDX: 0x%016llx\n"
1278 "RSP: 0x%016llx, RBP: 0x%016llx, RSI: 0x%016llx, RDI: 0x%016llx\n"
1279 "R8: 0x%016llx, R9: 0x%016llx, R10: 0x%016llx, R11: 0x%016llx\n"
1280 "R12: 0x%016llx, R13: 0x%016llx, R14: 0x%016llx, R15: 0x%016llx\n"
1281 "RFL: 0x%016llx, RIP: 0x%016llx, CS: 0x%016llx, SS: 0x%016llx\n",
1282 ss64p->rax, ss64p->rbx, ss64p->rcx, ss64p->rdx,
1283 ss64p->isf.rsp, ss64p->rbp, ss64p->rsi, ss64p->rdi,
1284 ss64p->r8, ss64p->r9, ss64p->r10, ss64p->r11,
1285 ss64p->r12, ss64p->r13, ss64p->r14, ss64p->r15,
1286 ss64p->isf.rflags, ss64p->isf.rip, ss64p->isf.cs,
1287 ss64p->isf.ss);
1288 PC = ss64p->isf.rip;
1289 }
1290
1291 paniclog_append_noflush("Backtrace (CPU %d), "
1292 #if PRINT_ARGS_FROM_STACK_FRAME
1293 "Frame : Return Address (4 potential args on stack)\n", cn);
1294 #else
1295 "Frame : Return Address\n", cn);
1296 #endif
1297
1298 for (frame_index = 0; frame_index < nframes; frame_index++) {
1299 vm_offset_t curframep = (vm_offset_t) frame;
1300
1301 if (!curframep) {
1302 break;
1303 }
1304
1305 if (curframep & 0x3) {
1306 paniclog_append_noflush("Unaligned frame\n");
1307 goto invalid;
1308 }
1309
1310 if (!kvtophys(curframep) ||
1311 !kvtophys(curframep + sizeof(cframe_t) - 1)) {
1312 paniclog_append_noflush("No mapping exists for frame pointer\n");
1313 goto invalid;
1314 }
1315
1316 paniclog_append_noflush("%p : 0x%lx ", frame, frame->caller);
1317 if (frame_index < DUMPFRAMES) {
1318 raddrs[frame_index] = frame->caller;
1319 }
1320
1321 #if PRINT_ARGS_FROM_STACK_FRAME
1322 if (kvtophys((vm_offset_t)&(frame->args[3]))) {
1323 paniclog_append_noflush("(0x%x 0x%x 0x%x 0x%x) ",
1324 frame->args[0], frame->args[1],
1325 frame->args[2], frame->args[3]);
1326 }
1327 #endif
1328
1329 /* Display address-symbol translation only if the "keepsyms"
1330 * boot-arg is suppplied, since we unload LINKEDIT otherwise.
1331 * This routine is potentially unsafe; also, function
1332 * boundary identification is unreliable after a strip -x.
1333 */
1334 if (keepsyms) {
1335 panic_print_symbol_name((vm_address_t)frame->caller);
1336 }
1337
1338 paniclog_append_noflush("\n");
1339
1340 frame = frame->prev;
1341 }
1342
1343 if (frame_index >= nframes) {
1344 paniclog_append_noflush("\tBacktrace continues...\n");
1345 }
1346
1347 goto out;
1348
1349 invalid:
1350 paniclog_append_noflush("Backtrace terminated-invalid frame pointer %p\n", frame);
1351 out:
1352
1353 /* Identify kernel modules in the backtrace and display their
1354 * load addresses and dependencies. This routine should walk
1355 * the kmod list safely.
1356 */
1357 if (frame_index) {
1358 kmod_panic_dump((vm_offset_t *)&raddrs[0], frame_index);
1359 }
1360
1361 if (PC != 0) {
1362 kmod_panic_dump(&PC, 1);
1363 }
1364
1365 panic_display_system_configuration(FALSE);
1366
1367 doprnt_hide_pointers = old_doprnt_hide_pointers;
1368
1369 /* Release print backtrace lock, to permit other callers in the
1370 * event of panics on multiple processors.
1371 */
1372 hw_lock_unlock(&pbtlock);
1373 os_atomic_dec(&pbtcnt, relaxed);
1374 /* Wait for other processors to complete output
1375 * Timeout and continue after PBT_TIMEOUT_CYCLES.
1376 */
1377 bt_tsc_timeout = rdtsc64() + PBT_TIMEOUT_CYCLES;
1378 while (*ppbtcnt && (rdtsc64() < bt_tsc_timeout)) {
1379 ;
1380 }
1381 }
1382
1383 static boolean_t
1384 debug_copyin(pmap_t p, uint64_t uaddr, void *dest, size_t size)
1385 {
1386 size_t rem = size;
1387 char *kvaddr = dest;
1388
1389 while (rem) {
1390 ppnum_t upn = pmap_find_phys(p, uaddr);
1391 uint64_t phys_src = ptoa_64(upn) | (uaddr & PAGE_MASK);
1392 uint64_t phys_dest = kvtophys((vm_offset_t)kvaddr);
1393 uint64_t src_rem = PAGE_SIZE - (phys_src & PAGE_MASK);
1394 uint64_t dst_rem = PAGE_SIZE - (phys_dest & PAGE_MASK);
1395 size_t cur_size = (uint32_t) MIN(src_rem, dst_rem);
1396 cur_size = MIN(cur_size, rem);
1397
1398 if (upn && pmap_valid_page(upn) && phys_dest) {
1399 bcopy_phys(phys_src, phys_dest, cur_size);
1400 } else {
1401 break;
1402 }
1403 uaddr += cur_size;
1404 kvaddr += cur_size;
1405 rem -= cur_size;
1406 }
1407 return rem == 0;
1408 }
1409
1410 void
1411 print_threads_registers(thread_t thread)
1412 {
1413 x86_saved_state_t *savestate;
1414
1415 savestate = get_user_regs(thread);
1416 paniclog_append_noflush(
1417 "\nRAX: 0x%016llx, RBX: 0x%016llx, RCX: 0x%016llx, RDX: 0x%016llx\n"
1418 "RSP: 0x%016llx, RBP: 0x%016llx, RSI: 0x%016llx, RDI: 0x%016llx\n"
1419 "R8: 0x%016llx, R9: 0x%016llx, R10: 0x%016llx, R11: 0x%016llx\n"
1420 "R12: 0x%016llx, R13: 0x%016llx, R14: 0x%016llx, R15: 0x%016llx\n"
1421 "RFL: 0x%016llx, RIP: 0x%016llx, CS: 0x%016llx, SS: 0x%016llx\n\n",
1422 savestate->ss_64.rax, savestate->ss_64.rbx, savestate->ss_64.rcx, savestate->ss_64.rdx,
1423 savestate->ss_64.isf.rsp, savestate->ss_64.rbp, savestate->ss_64.rsi, savestate->ss_64.rdi,
1424 savestate->ss_64.r8, savestate->ss_64.r9, savestate->ss_64.r10, savestate->ss_64.r11,
1425 savestate->ss_64.r12, savestate->ss_64.r13, savestate->ss_64.r14, savestate->ss_64.r15,
1426 savestate->ss_64.isf.rflags, savestate->ss_64.isf.rip, savestate->ss_64.isf.cs,
1427 savestate->ss_64.isf.ss);
1428 }
1429
1430 void
1431 print_tasks_user_threads(task_t task)
1432 {
1433 thread_t thread = current_thread();
1434 x86_saved_state_t *savestate;
1435 pmap_t pmap = 0;
1436 uint64_t rbp;
1437 const char *cur_marker = 0;
1438 int j;
1439
1440 for (j = 0, thread = (thread_t) queue_first(&task->threads); j < task->thread_count;
1441 ++j, thread = (thread_t) queue_next(&thread->task_threads)) {
1442 paniclog_append_noflush("Thread %d: %p\n", j, thread);
1443 pmap = get_task_pmap(task);
1444 savestate = get_user_regs(thread);
1445 rbp = savestate->ss_64.rbp;
1446 paniclog_append_noflush("\t0x%016llx\n", savestate->ss_64.isf.rip);
1447 print_one_backtrace(pmap, (vm_offset_t)rbp, cur_marker, TRUE);
1448 paniclog_append_noflush("\n");
1449 }
1450 }
1451
1452 void
1453 print_thread_num_that_crashed(task_t task)
1454 {
1455 thread_t c_thread = current_thread();
1456 thread_t thread;
1457 int j;
1458
1459 for (j = 0, thread = (thread_t) queue_first(&task->threads); j < task->thread_count;
1460 ++j, thread = (thread_t) queue_next(&thread->task_threads)) {
1461 if (c_thread == thread) {
1462 paniclog_append_noflush("\nThread %d crashed\n", j);
1463 break;
1464 }
1465 }
1466 }
1467
1468 #define PANICLOG_UUID_BUF_SIZE 256
1469
1470 void
1471 print_uuid_info(task_t task)
1472 {
1473 uint32_t uuid_info_count = 0;
1474 mach_vm_address_t uuid_info_addr = 0;
1475 boolean_t have_map = (task->map != NULL) && (ml_validate_nofault((vm_offset_t)(task->map), sizeof(struct _vm_map)));
1476 boolean_t have_pmap = have_map && (task->map->pmap != NULL) && (ml_validate_nofault((vm_offset_t)(task->map->pmap), sizeof(struct pmap)));
1477 int task_pid = pid_from_task(task);
1478 char uuidbuf[PANICLOG_UUID_BUF_SIZE] = {0};
1479 char *uuidbufptr = uuidbuf;
1480 uint32_t k;
1481
1482 if (have_pmap && task->active && task_pid > 0) {
1483 /* Read dyld_all_image_infos struct from task memory to get UUID array count & location */
1484 struct user64_dyld_all_image_infos task_image_infos;
1485 if (debug_copyin(task->map->pmap, task->all_image_info_addr,
1486 &task_image_infos, sizeof(struct user64_dyld_all_image_infos))) {
1487 uuid_info_count = (uint32_t)task_image_infos.uuidArrayCount;
1488 uuid_info_addr = task_image_infos.uuidArray;
1489 }
1490
1491 /* If we get a NULL uuid_info_addr (which can happen when we catch dyld
1492 * in the middle of updating this data structure), we zero the
1493 * uuid_info_count so that we won't even try to save load info for this task
1494 */
1495 if (!uuid_info_addr) {
1496 uuid_info_count = 0;
1497 }
1498 }
1499
1500 if (task_pid > 0 && uuid_info_count > 0) {
1501 uint32_t uuid_info_size = sizeof(struct user64_dyld_uuid_info);
1502 uint32_t uuid_array_size = uuid_info_count * uuid_info_size;
1503 uint32_t uuid_copy_size = 0;
1504 uint32_t uuid_image_count = 0;
1505 char *current_uuid_buffer = NULL;
1506 /* Copy in the UUID info array. It may be nonresident, in which case just fix up nloadinfos to 0 */
1507
1508 paniclog_append_noflush("\nuuid info:\n");
1509 while (uuid_array_size) {
1510 if (uuid_array_size <= PANICLOG_UUID_BUF_SIZE) {
1511 uuid_copy_size = uuid_array_size;
1512 uuid_image_count = uuid_array_size / uuid_info_size;
1513 } else {
1514 uuid_image_count = PANICLOG_UUID_BUF_SIZE / uuid_info_size;
1515 uuid_copy_size = uuid_image_count * uuid_info_size;
1516 }
1517 if (have_pmap && !debug_copyin(task->map->pmap, uuid_info_addr, uuidbufptr,
1518 uuid_copy_size)) {
1519 paniclog_append_noflush("Error!! Failed to copy UUID info for task %p pid %d\n", task, task_pid);
1520 uuid_image_count = 0;
1521 break;
1522 }
1523
1524 if (uuid_image_count > 0) {
1525 current_uuid_buffer = uuidbufptr;
1526 for (k = 0; k < uuid_image_count; k++) {
1527 paniclog_append_noflush(" %#llx", *(uint64_t *)current_uuid_buffer);
1528 current_uuid_buffer += sizeof(uint64_t);
1529 uint8_t *uuid = (uint8_t *)current_uuid_buffer;
1530 paniclog_append_noflush("\tuuid = <%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x>\n",
1531 uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5], uuid[6], uuid[7], uuid[8],
1532 uuid[9], uuid[10], uuid[11], uuid[12], uuid[13], uuid[14], uuid[15]);
1533 current_uuid_buffer += 16;
1534 }
1535 bzero(&uuidbuf, sizeof(uuidbuf));
1536 }
1537 uuid_info_addr += uuid_copy_size;
1538 uuid_array_size -= uuid_copy_size;
1539 }
1540 }
1541 }
1542
1543 void
1544 print_launchd_info(void)
1545 {
1546 task_t task = current_task();
1547 thread_t thread = current_thread();
1548 volatile uint32_t *ppbtcnt = &pbtcnt;
1549 uint64_t bt_tsc_timeout;
1550 int cn = cpu_number();
1551
1552 if (pbtcpu != cn) {
1553 os_atomic_inc(&pbtcnt, relaxed);
1554 /* Spin on print backtrace lock, which serializes output
1555 * Continue anyway if a timeout occurs.
1556 */
1557 hw_lock_to(&pbtlock, ~0U, LCK_GRP_NULL);
1558 pbtcpu = cn;
1559 }
1560
1561 print_uuid_info(task);
1562 print_thread_num_that_crashed(task);
1563 print_threads_registers(thread);
1564 print_tasks_user_threads(task);
1565
1566 panic_display_system_configuration(TRUE);
1567
1568 /* Release print backtrace lock, to permit other callers in the
1569 * event of panics on multiple processors.
1570 */
1571 hw_lock_unlock(&pbtlock);
1572 os_atomic_dec(&pbtcnt, relaxed);
1573 /* Wait for other processors to complete output
1574 * Timeout and continue after PBT_TIMEOUT_CYCLES.
1575 */
1576 bt_tsc_timeout = rdtsc64() + PBT_TIMEOUT_CYCLES;
1577 while (*ppbtcnt && (rdtsc64() < bt_tsc_timeout)) {
1578 ;
1579 }
1580 }
mirror of XNU