2 * Copyright (c) 2000-2017 Apple Inc. All rights reserved.
4 * arm platform expert initialization.
7 #include <sys/kdebug.h>
8 #include <mach/vm_param.h>
9 #include <pexpert/protos.h>
10 #include <pexpert/pexpert.h>
11 #include <pexpert/boot.h>
12 #include <pexpert/device_tree.h>
13 #include <pexpert/pe_images.h>
14 #include <kern/sched_prim.h>
15 #include <machine/machine_routines.h>
16 #include <arm/caches_internal.h>
17 #include <kern/debug.h>
18 #include <libkern/section_keywords.h>
21 #include <pexpert/arm/board_config.h>
22 #elif defined __arm64__
23 #include <pexpert/arm64/board_config.h>
27 /* extern references */
28 extern void pe_identify_machine(boot_args
*bootArgs
);
30 /* static references */
31 static void pe_prepare_images(void);
34 SECURITY_READ_ONLY_LATE(PE_state_t
) PE_state
;
35 #define FW_VERS_LEN 128
36 char firmware_version
[FW_VERS_LEN
];
39 * This variable is only modified once, when the BSP starts executing. We put it in __TEXT
40 * as page protections on kernel text early in startup are read-write. The kernel is
41 * locked down later in start-up, said mappings become RO and thus this
42 * variable becomes immutable.
44 * See osfmk/arm/arm_vm_init.c for more information.
46 SECURITY_READ_ONLY_SPECIAL_SECTION(volatile uint32_t, "__TEXT,__const") debug_enabled
= FALSE
;
48 uint8_t gPlatformECID
[8];
49 uint32_t gPlatformMemoryID
;
50 static boolean_t vc_progress_initialized
= FALSE
;
51 uint64_t last_hwaccess_thread
= 0;
52 char gTargetTypeBuffer
[8];
53 char gModelTypeBuffer
[32];
55 /* Clock Frequency Info */
56 clock_frequency_info_t gPEClockFrequencyInfo
;
58 vm_offset_t gPanicBase
;
59 unsigned int gPanicSize
;
60 struct embedded_panic_header
*panic_info
= NULL
;
62 #if (DEVELOPMENT || DEBUG) && defined(XNU_TARGET_OS_BRIDGE)
64 * On DEVELOPMENT bridgeOS, we map the x86 panic region
65 * so we can include this data in bridgeOS corefiles
67 uint64_t macos_panic_base
= 0;
68 unsigned int macos_panic_size
= 0;
70 struct macos_panic_header
*mac_panic_header
= NULL
;
73 /* Maximum size of panic log excluding headers, in bytes */
74 static unsigned int panic_text_len
;
76 /* Whether a console is standing by for panic logging */
77 static boolean_t panic_console_available
= FALSE
;
79 extern uint32_t crc32(uint32_t crc
, const void *buf
, size_t size
);
81 void PE_slide_devicetree(vm_offset_t
);
84 check_for_panic_log(void)
86 #ifdef PLATFORM_PANIC_LOG_PADDR
87 gPanicBase
= ml_io_map_wcomb(PLATFORM_PANIC_LOG_PADDR
, PLATFORM_PANIC_LOG_SIZE
);
88 panic_text_len
= PLATFORM_PANIC_LOG_SIZE
- sizeof(struct embedded_panic_header
);
89 gPanicSize
= PLATFORM_PANIC_LOG_SIZE
;
91 DTEntry entry
, chosen
;
94 uint32_t *panic_region_length
;
97 * DT properties for the panic region are populated by UpdateDeviceTree() in iBoot:
100 * embedded-panic-log-size = <0x00080000>;
101 * [a bunch of other stuff]
105 * reg = <0x00000008_fbc48000 0x00000000_000b4000>;
108 * reg[0] is the physical address
109 * reg[1] is the size of iBoot's kMemoryRegion_Panic (not used)
110 * embedded-panic-log-size is the maximum amount of data to store in the buffer
112 if (kSuccess
!= DTLookupEntry(0, "pram", &entry
)) {
116 if (kSuccess
!= DTGetProperty(entry
, "reg", (void **)®_prop
, &size
)) {
120 if (kSuccess
!= DTLookupEntry(0, "/chosen", &chosen
)) {
124 if (kSuccess
!= DTGetProperty(chosen
, "embedded-panic-log-size", (void **) &panic_region_length
, &size
)) {
128 gPanicBase
= ml_io_map_wcomb(reg_prop
[0], panic_region_length
[0]);
130 /* Deduct the size of the panic header from the panic region size */
131 panic_text_len
= panic_region_length
[0] - sizeof(struct embedded_panic_header
);
132 gPanicSize
= panic_region_length
[0];
134 #if DEVELOPMENT && defined(XNU_TARGET_OS_BRIDGE)
135 if (PE_consistent_debug_enabled()) {
136 uint64_t macos_panic_physbase
= 0;
137 uint64_t macos_panic_physlen
= 0;
138 /* Populate the macOS panic region data if it's present in consistent debug */
139 if (PE_consistent_debug_lookup_entry(kDbgIdMacOSPanicRegion
, &macos_panic_physbase
, &macos_panic_physlen
)) {
140 macos_panic_base
= ml_io_map_with_prot(macos_panic_physbase
, macos_panic_physlen
, VM_PROT_READ
);
141 mac_panic_header
= (struct macos_panic_header
*) ((void *) macos_panic_base
);
142 macos_panic_size
= macos_panic_physlen
;
145 #endif /* DEVELOPMENT && defined(XNU_TARGET_OS_BRIDGE) */
148 panic_info
= (struct embedded_panic_header
*)gPanicBase
;
150 /* Check if a shared memory console is running in the panic buffer */
151 if (panic_info
->eph_magic
== 'SHMC') {
152 panic_console_available
= TRUE
;
156 /* Check if there's a boot profile in the panic buffer */
157 if (panic_info
->eph_magic
== 'BTRC') {
162 * Check to see if a panic (FUNK) is in VRAM from the last time
164 if (panic_info
->eph_magic
== EMBEDDED_PANIC_MAGIC
) {
165 printf("iBoot didn't extract panic log from previous session crash, this is bad\n");
168 /* Clear panic region */
169 bzero((void *)gPanicBase
, gPanicSize
);
173 PE_initialize_console(PE_Video
* info
, int op
)
175 static int last_console
= -1;
177 if (info
&& (info
!= &PE_state
.video
)) {
178 info
->v_scale
= PE_state
.video
.v_scale
;
182 case kPEDisableScreen
:
183 initialize_screen(info
, op
);
184 last_console
= switch_to_serial_console();
185 kprintf("kPEDisableScreen %d\n", last_console
);
188 case kPEEnableScreen
:
189 initialize_screen(info
, op
);
191 PE_state
.video
= *info
;
193 kprintf("kPEEnableScreen %d\n", last_console
);
194 if (last_console
!= -1) {
195 switch_to_old_console(last_console
);
199 case kPEReleaseScreen
:
201 * we don't show the progress indicator on boot, but want to
202 * show it afterwards.
204 if (!vc_progress_initialized
) {
205 default_progress
.dx
= 0;
206 default_progress
.dy
= 0;
207 vc_progress_initialize(&default_progress
,
208 default_progress_data1x
,
209 default_progress_data2x
,
210 default_progress_data3x
,
211 (unsigned char *) appleClut8
);
212 vc_progress_initialized
= TRUE
;
214 initialize_screen(info
, op
);
218 initialize_screen(info
, op
);
229 unsigned int size
, scale
;
230 unsigned long display_size
;
232 unsigned int show_progress
;
233 int *delta
, image_size
, flip
;
234 uint32_t start_time_value
= 0;
235 uint32_t debug_wait_start_value
= 0;
236 uint32_t load_kernel_start_value
= 0;
237 uint32_t populate_registry_time_value
= 0;
239 PE_init_kprintf(TRUE
);
240 PE_init_printf(TRUE
);
242 printf("iBoot version: %s\n", firmware_version
);
244 if (kSuccess
== DTLookupEntry(0, "/chosen/memory-map", &entry
)) {
245 boot_progress_element
*bootPict
;
247 if (kSuccess
== DTGetProperty(entry
, "BootCLUT", (void **) &map
, &size
)) {
248 bcopy(map
[0], appleClut8
, sizeof(appleClut8
));
251 if (kSuccess
== DTGetProperty(entry
, "Pict-FailedBoot", (void **) &map
, &size
)) {
252 bootPict
= (boot_progress_element
*) map
[0];
253 default_noroot
.width
= bootPict
->width
;
254 default_noroot
.height
= bootPict
->height
;
255 default_noroot
.dx
= 0;
256 default_noroot
.dy
= bootPict
->yOffset
;
257 default_noroot_data
= &bootPict
->data
[0];
263 scale
= PE_state
.video
.v_scale
;
266 if (PE_parse_boot_argn("-progress", &show_progress
, sizeof(show_progress
)) && show_progress
) {
267 /* Rotation: 0:normal, 1:right 90, 2:left 180, 3:left 90 */
268 switch (PE_state
.video
.v_rotate
) {
273 display_size
= PE_state
.video
.v_height
;
274 image_size
= default_progress
.height
;
275 delta
= &default_progress
.dy
;
282 display_size
= PE_state
.video
.v_width
;
283 image_size
= default_progress
.width
;
284 delta
= &default_progress
.dx
;
287 while (((unsigned)(*delta
+ image_size
)) >= (display_size
/ 2)) {
288 *delta
-= 50 * scale
;
293 /* Check for DT-defined progress y delta */
294 PE_get_default("progress-dy", &default_progress
.dy
, sizeof(default_progress
.dy
));
296 vc_progress_initialize(&default_progress
,
297 default_progress_data1x
,
298 default_progress_data2x
,
299 default_progress_data3x
,
300 (unsigned char *) appleClut8
);
301 vc_progress_initialized
= TRUE
;
304 if (kdebug_enable
&& kdebug_debugid_enabled(IOKDBG_CODE(DBG_BOOTER
, 0))) {
305 /* Trace iBoot-provided timing information. */
306 if (kSuccess
== DTLookupEntry(0, "/chosen/iBoot", &entry
)) {
307 uint32_t * value_ptr
;
309 if (kSuccess
== DTGetProperty(entry
, "start-time", (void **)&value_ptr
, &size
)) {
310 if (size
== sizeof(start_time_value
)) {
311 start_time_value
= *value_ptr
;
315 if (kSuccess
== DTGetProperty(entry
, "debug-wait-start", (void **)&value_ptr
, &size
)) {
316 if (size
== sizeof(debug_wait_start_value
)) {
317 debug_wait_start_value
= *value_ptr
;
321 if (kSuccess
== DTGetProperty(entry
, "load-kernel-start", (void **)&value_ptr
, &size
)) {
322 if (size
== sizeof(load_kernel_start_value
)) {
323 load_kernel_start_value
= *value_ptr
;
327 if (kSuccess
== DTGetProperty(entry
, "populate-registry-time", (void **)&value_ptr
, &size
)) {
328 if (size
== sizeof(populate_registry_time_value
)) {
329 populate_registry_time_value
= *value_ptr
;
334 KDBG_RELEASE(IOKDBG_CODE(DBG_BOOTER
, 0), start_time_value
, debug_wait_start_value
, load_kernel_start_value
, populate_registry_time_value
);
337 StartIOKit(PE_state
.deviceTreeHead
, PE_state
.bootArgs
, (void *) 0, (void *) 0);
341 PE_slide_devicetree(vm_offset_t slide
)
343 assert(PE_state
.initialized
);
344 PE_state
.deviceTreeHead
+= slide
;
345 DTInit(PE_state
.deviceTreeHead
);
349 PE_init_platform(boolean_t vm_initialized
, void *args
)
354 boot_args
*boot_args_ptr
= (boot_args
*) args
;
356 if (PE_state
.initialized
== FALSE
) {
357 PE_state
.initialized
= TRUE
;
358 PE_state
.bootArgs
= boot_args_ptr
;
359 PE_state
.deviceTreeHead
= boot_args_ptr
->deviceTreeP
;
360 PE_state
.video
.v_baseAddr
= boot_args_ptr
->Video
.v_baseAddr
;
361 PE_state
.video
.v_rowBytes
= boot_args_ptr
->Video
.v_rowBytes
;
362 PE_state
.video
.v_width
= boot_args_ptr
->Video
.v_width
;
363 PE_state
.video
.v_height
= boot_args_ptr
->Video
.v_height
;
364 PE_state
.video
.v_depth
= (boot_args_ptr
->Video
.v_depth
>> kBootVideoDepthDepthShift
) & kBootVideoDepthMask
;
365 PE_state
.video
.v_rotate
= (boot_args_ptr
->Video
.v_depth
>> kBootVideoDepthRotateShift
) & kBootVideoDepthMask
;
366 PE_state
.video
.v_scale
= ((boot_args_ptr
->Video
.v_depth
>> kBootVideoDepthScaleShift
) & kBootVideoDepthMask
) + 1;
367 PE_state
.video
.v_display
= boot_args_ptr
->Video
.v_display
;
368 strlcpy(PE_state
.video
.v_pixelFormat
, "BBBBBBBBGGGGGGGGRRRRRRRR", sizeof(PE_state
.video
.v_pixelFormat
));
370 if (!vm_initialized
) {
372 * Setup the Device Tree routines
373 * so the console can be found and the right I/O space
376 DTInit(PE_state
.deviceTreeHead
);
377 pe_identify_machine(boot_args_ptr
);
379 pe_arm_init_interrupts(args
);
380 pe_arm_init_debug(args
);
383 if (!vm_initialized
) {
384 if (kSuccess
== (DTFindEntry("name", "device-tree", &entry
))) {
385 if (kSuccess
== DTGetProperty(entry
, "target-type",
386 (void **)&prop
, &size
)) {
387 if (size
> sizeof(gTargetTypeBuffer
)) {
388 size
= sizeof(gTargetTypeBuffer
);
390 bcopy(prop
, gTargetTypeBuffer
, size
);
391 gTargetTypeBuffer
[size
- 1] = '\0';
394 if (kSuccess
== (DTFindEntry("name", "device-tree", &entry
))) {
395 if (kSuccess
== DTGetProperty(entry
, "model",
396 (void **)&prop
, &size
)) {
397 if (size
> sizeof(gModelTypeBuffer
)) {
398 size
= sizeof(gModelTypeBuffer
);
400 bcopy(prop
, gModelTypeBuffer
, size
);
401 gModelTypeBuffer
[size
- 1] = '\0';
404 if (kSuccess
== DTLookupEntry(NULL
, "/chosen", &entry
)) {
405 if (kSuccess
== DTGetProperty(entry
, "debug-enabled",
406 (void **) &prop
, &size
)) {
408 * We purposefully modify a constified variable as
409 * it will get locked down by a trusted monitor or
410 * via page table mappings. We don't want people easily
411 * modifying this variable...
413 #pragma clang diagnostic push
414 #pragma clang diagnostic ignored "-Wcast-qual"
415 boolean_t
*modify_debug_enabled
= (boolean_t
*) &debug_enabled
;
416 if (size
> sizeof(uint32_t)) {
417 size
= sizeof(uint32_t);
419 bcopy(prop
, modify_debug_enabled
, size
);
420 #pragma clang diagnostic pop
422 if (kSuccess
== DTGetProperty(entry
, "firmware-version",
423 (void **) &prop
, &size
)) {
424 if (size
> sizeof(firmware_version
)) {
425 size
= sizeof(firmware_version
);
427 bcopy(prop
, firmware_version
, size
);
428 firmware_version
[size
- 1] = '\0';
430 if (kSuccess
== DTGetProperty(entry
, "unique-chip-id",
431 (void **) &prop
, &size
)) {
432 if (size
> sizeof(gPlatformECID
)) {
433 size
= sizeof(gPlatformECID
);
435 bcopy(prop
, gPlatformECID
, size
);
437 if (kSuccess
== DTGetProperty(entry
, "dram-vendor-id",
438 (void **) &prop
, &size
)) {
439 if (size
> sizeof(gPlatformMemoryID
)) {
440 size
= sizeof(gPlatformMemoryID
);
442 bcopy(prop
, &gPlatformMemoryID
, size
);
450 PE_create_console(void)
453 * Check the head of VRAM for a panic log saved on last panic.
454 * Do this before the VRAM is trashed.
456 check_for_panic_log();
458 if (PE_state
.video
.v_display
) {
459 PE_initialize_console(&PE_state
.video
, kPEGraphicsMode
);
461 PE_initialize_console(&PE_state
.video
, kPETextMode
);
466 PE_current_console(PE_Video
* info
)
468 *info
= PE_state
.video
;
473 PE_display_icon(__unused
unsigned int flags
, __unused
const char *name
)
475 if (default_noroot_data
) {
476 vc_display_icon(&default_noroot
, default_noroot_data
);
481 PE_get_hotkey(__unused
unsigned char key
)
486 static timebase_callback_func gTimebaseCallback
;
489 PE_register_timebase_callback(timebase_callback_func callback
)
491 gTimebaseCallback
= callback
;
493 PE_call_timebase_callback();
497 PE_call_timebase_callback(void)
499 struct timebase_freq_t timebase_freq
;
501 timebase_freq
.timebase_num
= gPEClockFrequencyInfo
.timebase_frequency_hz
;
502 timebase_freq
.timebase_den
= 1;
504 if (gTimebaseCallback
) {
505 gTimebaseCallback(&timebase_freq
);
510 * The default PE_poll_input handler.
513 PE_stub_poll_input(__unused
unsigned int options
, char *c
)
516 return 0; /* 0 for success, 1 for unsupported */
520 * This routine will return 1 if you are running on a device with a variant
521 * of iBoot that allows debugging. This is typically not the case on production
522 * fused parts (even when running development variants of iBoot).
524 * The routine takes an optional argument of the flags passed to debug="" so
525 * kexts don't have to parse the boot arg themselves.
528 PE_i_can_has_debugger(uint32_t *debug_flags
)
531 #if DEVELOPMENT || DEBUG
532 assert(debug_boot_arg_inited
);
535 *debug_flags
= debug_boot_arg
;
540 return debug_enabled
;
544 * This routine returns TRUE if the device is configured
545 * with panic debugging enabled.
548 PE_panic_debugging_enabled()
550 return panicDebugging
;
554 PE_save_buffer_to_vram(unsigned char *buf
, unsigned int *size
)
556 if (!panic_info
|| !size
) {
561 *size
= panic_text_len
;
569 *size
= *size
> panic_text_len
? panic_text_len
: *size
;
570 if (panic_info
->eph_magic
!= EMBEDDED_PANIC_MAGIC
) {
571 printf("Error!! Current Magic 0x%X, expected value 0x%x", panic_info
->eph_magic
, EMBEDDED_PANIC_MAGIC
);
574 /* CRC everything after the CRC itself - starting with the panic header version */
575 panic_info
->eph_crc
= crc32(0L, &panic_info
->eph_version
, (panic_text_len
+
576 sizeof(struct embedded_panic_header
) - offsetof(struct embedded_panic_header
, eph_version
)));
580 PE_get_offset_into_panic_region(char *location
)
582 assert(panic_info
!= NULL
);
583 assert(location
> (char *) panic_info
);
584 assert((unsigned int)(location
- (char *) panic_info
) < panic_text_len
);
586 return (uint32_t) (location
- gPanicBase
);
590 PE_init_panicheader()
596 bzero(panic_info
, sizeof(struct embedded_panic_header
));
599 * The panic log begins immediately after the panic header -- debugger synchronization and other functions
600 * may log into this region before we've become the exclusive panicking CPU and initialize the header here.
602 panic_info
->eph_panic_log_offset
= PE_get_offset_into_panic_region(debug_buf_base
);
604 panic_info
->eph_magic
= EMBEDDED_PANIC_MAGIC
;
605 panic_info
->eph_version
= EMBEDDED_PANIC_HEADER_CURRENT_VERSION
;
611 * Tries to update the panic header to keep it consistent on nested panics.
613 * NOTE: The purpose of this function is NOT to detect/correct corruption in the panic region,
614 * it is to update the panic header to make it consistent when we nest panics.
617 PE_update_panicheader_nestedpanic()
624 * If the panic log offset is not set, re-init the panic header
626 if (panic_info
->eph_panic_log_offset
== 0) {
627 PE_init_panicheader();
628 panic_info
->eph_panic_flags
|= EMBEDDED_PANIC_HEADER_FLAG_NESTED_PANIC
;
632 panic_info
->eph_panic_flags
|= EMBEDDED_PANIC_HEADER_FLAG_NESTED_PANIC
;
635 * If the panic log length is not set, set the end to
636 * the current location of the debug_buf_ptr to close it.
638 if (panic_info
->eph_panic_log_len
== 0) {
639 panic_info
->eph_panic_log_len
= PE_get_offset_into_panic_region(debug_buf_ptr
);
641 /* If this assert fires, it's indicative of corruption in the panic region */
642 assert(panic_info
->eph_other_log_offset
== panic_info
->eph_other_log_len
== 0);
645 /* If this assert fires, it's likely indicative of corruption in the panic region */
646 assert(((panic_info
->eph_stackshot_offset
== 0) && (panic_info
->eph_stackshot_len
== 0)) ||
647 ((panic_info
->eph_stackshot_offset
!= 0) && (panic_info
->eph_stackshot_len
!= 0)));
650 * If we haven't set up the other log yet, set the beginning of the other log
651 * to the current location of the debug_buf_ptr
653 if (panic_info
->eph_other_log_offset
== 0) {
654 panic_info
->eph_other_log_offset
= PE_get_offset_into_panic_region(debug_buf_ptr
);
656 /* If this assert fires, it's indicative of corruption in the panic region */
657 assert(panic_info
->eph_other_log_len
== 0);
664 PE_reboot_on_panic(void)
666 uint32_t debug_flags
;
668 if (PE_i_can_has_debugger(&debug_flags
)
669 && (debug_flags
& DB_NMI
)) {
670 /* kernel debugging is active */
678 PE_sync_panic_buffers(void)
681 * rdar://problem/26453070:
682 * The iBoot panic region is write-combined on arm64. We must flush dirty lines
683 * from L1/L2 as late as possible before reset, with no further reads of the panic
684 * region between the flush and the reset. Some targets have an additional memcache (L3),
685 * and a read may bring dirty lines out of L3 and back into L1/L2, causing the lines to
686 * be discarded on reset. If we can make sure the lines are flushed to L3/DRAM,
687 * the platform reset handler will flush any L3.
690 CleanPoC_DcacheRegion_Force(gPanicBase
, gPanicSize
);
695 pe_prepare_images(void)
697 if ((1 & PE_state
.video
.v_rotate
) != 0) {
698 // Only square square images with radial symmetry are supported
699 // No need to actually rotate the data
701 // Swap the dx and dy offsets
702 uint32_t tmp
= default_progress
.dx
;
703 default_progress
.dx
= default_progress
.dy
;
704 default_progress
.dy
= tmp
;
707 uint32_t cnt
, cnt2
, cnt3
, cnt4
;
708 uint32_t tmp
, width
, height
;
709 uint8_t data
, *new_data
;
710 const uint8_t *old_data
;
712 width
= default_progress
.width
;
713 height
= default_progress
.height
* default_progress
.count
;
715 // Scale images if the UI is being scaled
716 if (PE_state
.video
.v_scale
> 1) {
717 new_data
= kalloc(width
* height
* scale
* scale
);
719 old_data
= default_progress_data
;
720 default_progress_data
= new_data
;
721 for (cnt
= 0; cnt
< height
; cnt
++) {
722 for (cnt2
= 0; cnt2
< width
; cnt2
++) {
723 data
= *(old_data
++);
724 for (cnt3
= 0; cnt3
< scale
; cnt3
++) {
725 for (cnt4
= 0; cnt4
< scale
; cnt4
++) {
726 new_data
[width
* scale
* cnt3
+ cnt4
] = data
;
731 new_data
+= width
* scale
* (scale
- 1);
733 default_progress
.width
*= scale
;
734 default_progress
.height
*= scale
;
735 default_progress
.dx
*= scale
;
736 default_progress
.dy
*= scale
;
743 PE_mark_hwaccess(uint64_t thread
)
745 last_hwaccess_thread
= thread
;
746 asm volatile ("dmb ish");