+def int32(n):
+ n = n & 0xffffffff
+ return (n ^ 0x80000000) - 0x80000000
+
+# Macro: showallprocessors
+
+def ShowGroupSetSummary(runq, task_map):
+ """ Internal function to print summary of group run queue
+ params: runq - value representing struct run_queue *
+ """
+
+ print " runq: count {: <10d} highq: {: <10d} urgency {: <10d}\n".format(runq.count, int32(runq.highq), runq.urgency)
+
+ runq_queue_i = 0
+ runq_queue_count = sizeof(runq.queues)/sizeof(runq.queues[0])
+
+ for runq_queue_i in xrange(runq_queue_count) :
+ runq_queue_head = addressof(runq.queues[runq_queue_i])
+ runq_queue_p = runq_queue_head.next
+
+ if unsigned(runq_queue_p) != unsigned(runq_queue_head):
+ runq_queue_this_count = 0
+
+ for entry in ParanoidIterateLinkageChain(runq_queue_head, "sched_entry_t", "entry_links"):
+ runq_queue_this_count += 1
+
+ print " Queue [{: <#012x}] Priority {: <3d} count {:d}\n".format(runq_queue_head, runq_queue_i, runq_queue_this_count)
+ for entry in ParanoidIterateLinkageChain(runq_queue_head, "sched_entry_t", "entry_links"):
+ group_addr = unsigned(entry) - (sizeof(dereference(entry)) * unsigned(entry.sched_pri))
+ group = kern.GetValueFromAddress(unsigned(group_addr), 'sched_group_t')
+ task = task_map.get(unsigned(group), 0x0)
+ if task == 0x0 :
+ print "Cannot find task for group: {: <#012x}".format(group)
+ print "\tEntry [{: <#012x}] Priority {: <3d} Group {: <#012x} Task {: <#012x}\n".format(unsigned(entry), entry.sched_pri, unsigned(group), unsigned(task))
+
+@lldb_command('showrunq')
+def ShowRunq(cmd_args=None):
+ """ Routine to print information of a runq
+ Usage: showrunq <runq>
+ """
+
+ if not cmd_args:
+ print "No arguments passed"
+ print ShowRunq.__doc__
+ return False
+
+ runq = kern.GetValueFromAddress(cmd_args[0], 'struct run_queue *')
+ ShowRunQSummary(runq)
+
+def ShowRunQSummary(runq):
+ """ Internal function to print summary of run_queue
+ params: runq - value representing struct run_queue *
+ """
+
+ print " runq: count {: <10d} highq: {: <10d} urgency {: <10d}\n".format(runq.count, int32(runq.highq), runq.urgency)
+
+ runq_queue_i = 0
+ runq_queue_count = sizeof(runq.queues)/sizeof(runq.queues[0])
+
+ for runq_queue_i in xrange(runq_queue_count) :
+ runq_queue_head = addressof(runq.queues[runq_queue_i])
+ runq_queue_p = runq_queue_head.next
+
+ if unsigned(runq_queue_p) != unsigned(runq_queue_head):
+ runq_queue_this_count = 0
+
+ for thread in ParanoidIterateLinkageChain(runq_queue_head, "thread_t", "runq_links"):
+ runq_queue_this_count += 1
+
+ print " Queue [{: <#012x}] Priority {: <3d} count {:d}\n".format(runq_queue_head, runq_queue_i, runq_queue_this_count)
+ print "\t" + GetThreadSummary.header + "\n"
+ for thread in ParanoidIterateLinkageChain(runq_queue_head, "thread_t", "runq_links"):
+ print "\t" + GetThreadSummary(thread) + "\n"
+ if config['verbosity'] > vHUMAN :
+ print "\t" + GetThreadBackTrace(thread, prefix="\t\t") + "\n"
+
+def ShowRTRunQSummary(rt_runq):
+ print " Realtime Queue ({:<#012x}) Count {:d}\n".format(addressof(rt_runq.queue), rt_runq.count)
+ if rt_runq.count != 0:
+ print "\t" + GetThreadSummary.header + "\n"
+ for rt_runq_thread in ParanoidIterateLinkageChain(rt_runq.queue, "thread_t", "runq_links"):
+ print "\t" + GetThreadSummary(rt_runq_thread) + "\n"
+
+def ShowGrrrSummary(grrr_runq):
+ """ Internal function to print summary of grrr_run_queue
+ params: grrr_runq - value representing struct grrr_run_queue *
+ """
+ print " GRRR Info: Count {: <10d} Weight {: <10d} Current Group {: <#012x}\n".format(grrr_runq.count,
+ grrr_runq.weight, grrr_runq.current_group)
+ grrr_group_i = 0
+ grrr_group_count = sizeof(grrr_runq.groups)/sizeof(grrr_runq.groups[0])
+ for grrr_group_i in xrange(grrr_group_count) :
+ grrr_group = addressof(grrr_runq.groups[grrr_group_i])
+ if grrr_group.count > 0:
+ print " Group {: <3d} [{: <#012x}] ".format(grrr_group.index, grrr_group)
+ print "Count {:d} Weight {:d}\n".format(grrr_group.count, grrr_group.weight)
+ grrr_group_client_head = addressof(grrr_group.clients)
+ print GetThreadSummary.header
+ for thread in ParanoidIterateLinkageChain(grrr_group_client_head, "thread_t", "runq_links"):
+ print "\t" + GetThreadSummary(thread) + "\n"
+ if config['verbosity'] > vHUMAN :
+ print "\t" + GetThreadBackTrace(thread, prefix="\t\t") + "\n"
+
+def ShowNextThread(processor):
+ if (processor.next_thread != 0) :
+ print " " + "Next thread:\n"
+ print "\t" + GetThreadSummary.header + "\n"
+ print "\t" + GetThreadSummary(processor.next_thread) + "\n"
+
+def ShowActiveThread(processor):
+ if (processor.active_thread != 0) :
+ print "\t" + GetThreadSummary.header + "\n"
+ print "\t" + GetThreadSummary(processor.active_thread) + "\n"
+
+@lldb_command('showallprocessors')
+@lldb_command('showscheduler')
+def ShowScheduler(cmd_args=None):
+ """ Routine to print information of all psets and processors
+ Usage: showscheduler
+ """
+ node = addressof(kern.globals.pset_node0)
+ show_grrr = 0
+ show_priority_runq = 0
+ show_priority_pset_runq = 0
+ show_group_pset_runq = 0
+ if unsigned(kern.globals.sched_current_dispatch) != 0 :
+ sched_string = str(kern.globals.sched_current_dispatch.sched_name)
+ else :
+ sched_string = str(kern.globals.sched_string)
+
+ if sched_string == "traditional":
+ show_priority_runq = 1
+ elif sched_string == "traditional_with_pset_runqueue":
+ show_priority_pset_runq = 1
+ elif sched_string == "grrr":
+ show_grrr = 1
+ elif sched_string == "multiq":
+ show_priority_runq = 1
+ show_group_pset_runq = 1
+ elif sched_string == "dualq":
+ show_priority_pset_runq = 1
+ show_priority_runq = 1
+ elif sched_string == "amp":
+ show_priority_pset_runq = 1
+ show_priority_runq = 1
+ else :
+ print "Unknown sched_string {:s}".format(sched_string)
+
+ if unsigned(kern.globals.sched_current_dispatch) != 0 :
+ print "Scheduler: {:s} ({:s})\n".format(sched_string,
+ kern.Symbolicate(unsigned(kern.globals.sched_current_dispatch)))
+
+ run_buckets = kern.globals.sched_run_buckets
+
+ run_count = run_buckets[GetEnumValue('sched_bucket_t::TH_BUCKET_RUN')]
+ fixpri_count = run_buckets[GetEnumValue('sched_bucket_t::TH_BUCKET_FIXPRI')]
+ share_fg_count = run_buckets[GetEnumValue('sched_bucket_t::TH_BUCKET_SHARE_FG')]
+ share_ut_count = run_buckets[GetEnumValue('sched_bucket_t::TH_BUCKET_SHARE_UT')]
+ share_bg_count = run_buckets[GetEnumValue('sched_bucket_t::TH_BUCKET_SHARE_BG')]
+
+ print "Processors: {g.processor_avail_count:d} Runnable threads: {:d} Fixpri threads: {:d}\n".format(run_count, fixpri_count, g=kern.globals)
+ print "FG Timeshare threads: {:d} UT Timeshare threads: {:d} BG Timeshare threads: {:d}\n".format(share_fg_count, share_ut_count, share_bg_count)
+
+ if show_group_pset_runq:
+ if hasattr(kern.globals, "multiq_sanity_check"):
+ print "multiq scheduler config: deep-drain {g.deep_drain:d}, ceiling {g.drain_ceiling:d}, depth limit {g.drain_depth_limit:d}, band limit {g.drain_band_limit:d}, sanity check {g.multiq_sanity_check:d}\n".format(g=kern.globals)
+ else:
+ print "multiq scheduler config: deep-drain {g.deep_drain:d}, ceiling {g.drain_ceiling:d}, depth limit {g.drain_depth_limit:d}, band limit {g.drain_band_limit:d}\n".format(g=kern.globals)
+
+ # Create a group->task mapping
+ task_map = {}
+ for task in kern.tasks:
+ task_map[unsigned(task.sched_group)] = task
+ for task in kern.terminated_tasks:
+ task_map[unsigned(task.sched_group)] = task
+
+ print " \n"
+
+ while node != 0:
+ pset = node.psets
+ pset = kern.GetValueFromAddress(unsigned(pset), 'struct processor_set *')
+
+ while pset != 0:
+ print "Processor Set {: <#012x} Count {:d} (cpu_id {:<#x}-{:<#x})\n".format(pset,
+ unsigned(pset.cpu_set_count), pset.cpu_set_low, pset.cpu_set_hi)
+
+ rt_runq = kern.GetValueFromAddress(unsigned(addressof(pset.rt_runq)), 'struct rt_queue *')
+ ShowRTRunQSummary(rt_runq)
+
+ if show_priority_pset_runq:
+ runq = kern.GetValueFromAddress(unsigned(addressof(pset.pset_runq)), 'struct run_queue *')
+ ShowRunQSummary(runq)
+
+ if show_group_pset_runq:
+ print "Main Runq:\n"
+ runq = kern.GetValueFromAddress(unsigned(addressof(pset.pset_runq)), 'struct run_queue *')
+ ShowGroupSetSummary(runq, task_map)
+ print "All Groups:\n"
+ # TODO: Possibly output task header for each group
+ for group in IterateQueue(kern.globals.sched_groups, "sched_group_t", "sched_groups"):
+ if (group.runq.count != 0) :
+ task = task_map.get(unsigned(group), "Unknown task!")
+ print "Group {: <#012x} Task {: <#012x}\n".format(unsigned(group), unsigned(task))
+ ShowRunQSummary(group.runq)
+ print " \n"
+
+ print "Active Processors:\n"
+ for processor in ParanoidIterateLinkageChain(pset.active_queue, "processor_t", "processor_queue"):
+ print " " + GetProcessorSummary(processor)
+ ShowActiveThread(processor)
+ ShowNextThread(processor)
+
+ if show_priority_runq:
+ runq = processor.runq
+ ShowRunQSummary(runq)
+ if show_grrr:
+ grrr_runq = processor.grrr_runq
+ ShowGrrrSummary(grrr_runq)
+ print " \n"
+
+
+ print "Idle Processors:\n"
+ for processor in ParanoidIterateLinkageChain(pset.idle_queue, "processor_t", "processor_queue"):
+ print " " + GetProcessorSummary(processor)
+ ShowActiveThread(processor)
+ ShowNextThread(processor)
+
+ if show_priority_runq:
+ ShowRunQSummary(processor.runq)
+ print " \n"
+
+
+ print "Idle Secondary Processors:\n"
+ for processor in ParanoidIterateLinkageChain(pset.idle_secondary_queue, "processor_t", "processor_queue"):
+ print " " + GetProcessorSummary(processor)
+ ShowActiveThread(processor)
+ ShowNextThread(processor)
+
+ if show_priority_runq:
+ print ShowRunQSummary(processor.runq)
+ print " \n"
+
+
+ pset = pset.pset_list
+
+ node = node.node_list
+
+ print "\nTerminate Queue: ({:<#012x})\n".format(addressof(kern.globals.thread_terminate_queue))
+ first = False
+ for thread in ParanoidIterateLinkageChain(kern.globals.thread_terminate_queue, "thread_t", "runq_links"):
+ if first:
+ print "\t" + GetThreadSummary.header + "\n"
+ first = True
+ print "\t" + GetThreadSummary(thread) + "\n"
+
+ print "\nCrashed Threads Queue: ({:<#012x})\n".format(addressof(kern.globals.crashed_threads_queue))
+ first = False
+ for thread in ParanoidIterateLinkageChain(kern.globals.crashed_threads_queue, "thread_t", "runq_links"):
+ if first:
+ print "\t" + GetThreadSummary.header + "\n"
+ first = True
+ print "\t" + GetThreadSummary(thread) + "\n"
+
+ print "\nWaiting For Kernel Stacks Queue: ({:<#012x})\n".format(addressof(kern.globals.thread_stack_queue))
+ first = False
+ for thread in ParanoidIterateLinkageChain(kern.globals.thread_stack_queue, "thread_t", "runq_links"):
+ if first:
+ print "\t" + GetThreadSummary.header + "\n"
+ first = True
+ print "\t" + GetThreadSummary(thread) + "\n"
+
+ print "\n"
+
+ print "\n"
+
+# EndMacro: showallprocessors
+
+
+def ParanoidIterateLinkageChain(queue_head, element_type, field_name, field_ofst=0):
+ """ Iterate over a Linkage Chain queue in kernel of type queue_head_t. (osfmk/kern/queue.h method 1)
+ This is equivalent to the qe_foreach_element() macro
+ Blows up aggressively and descriptively when something goes wrong iterating a queue.
+ Prints correctness errors, and throws exceptions on 'cannot proceed' errors
+ If this is annoying, set the global 'enable_paranoia' to false.
+
+ params:
+ queue_head - value : Value object for queue_head.
+ element_type - lldb.SBType : pointer type of the element which contains the queue_chain_t. Typically its structs like thread, task etc..
+ - str : OR a string describing the type. ex. 'task *'
+ field_name - str : Name of the field (in element) which holds a queue_chain_t
+ field_ofst - int : offset from the 'field_name' (in element) which holds a queue_chain_t
+ This is mostly useful if a particular element contains an array of queue_chain_t
+ returns:
+ A generator does not return. It is used for iterating.
+ value : An object thats of type (element_type). Always a pointer object
+ example usage:
+ for thread in IterateQueue(kern.globals.threads, 'thread *', 'threads'):
+ print thread.thread_id
+ """
+
+ if type(element_type) is str:
+ element_type = gettype(element_type)
+
+ # Some ways of constructing a queue head seem to end up with the
+ # struct object as the value and not a pointer to the struct head
+ # In that case, addressof will give us a pointer to the struct, which is what we need
+ if not queue_head.GetSBValue().GetType().IsPointerType() :
+ queue_head = addressof(queue_head)
+
+ # Mosh the value into a brand new value, to really get rid of its old cvalue history
+ queue_head = kern.GetValueFromAddress(unsigned(queue_head), 'struct queue_entry *')
+
+ if unsigned(queue_head) == 0:
+ if ParanoidIterateLinkageChain.enable_paranoia:
+ print "bad queue_head_t: {:s}".format(queue_head)
+ return
+
+ if element_type.IsPointerType():
+ struct_type = element_type.GetPointeeType()
+ else:
+ struct_type = element_type
+
+ elem_ofst = getfieldoffset(struct_type, field_name) + field_ofst
+
+ try:
+ link = queue_head.next
+ last_link = queue_head
+ try_read_next = unsigned(queue_head.next)
+ except:
+ print "Exception while looking at queue_head: {:>#18x}".format(unsigned(queue_head))
+ raise
+
+ if ParanoidIterateLinkageChain.enable_paranoia:
+ if unsigned(queue_head.next) == 0:
+ raise ValueError("NULL next pointer on head: queue_head {:>#18x} next: {:>#18x} prev: {:>#18x}".format(queue_head, queue_head.next, queue_head.prev))
+ if unsigned(queue_head.prev) == 0:
+ print "NULL prev pointer on head: queue_head {:>#18x} next: {:>#18x} prev: {:>#18x}".format(queue_head, queue_head.next, queue_head.prev)
+ if unsigned(queue_head.next) == unsigned(queue_head) and unsigned(queue_head.prev) != unsigned(queue_head):
+ print "corrupt queue_head {:>#18x} next: {:>#18x} prev: {:>#18x}".format(queue_head, queue_head.next, queue_head.prev)
+
+ if ParanoidIterateLinkageChain.enable_debug :
+ print "starting at queue_head {:>#18x} next: {:>#18x} prev: {:>#18x}".format(queue_head, queue_head.next, queue_head.prev)
+
+ addr = 0
+ obj = 0
+
+ try:
+ while (unsigned(queue_head) != unsigned(link)):
+ if ParanoidIterateLinkageChain.enable_paranoia:
+ if unsigned(link.next) == 0:
+ raise ValueError("NULL next pointer: queue_head {:>#18x} link: {:>#18x} next: {:>#18x} prev: {:>#18x}".format(queue_head, link, link.next, link.prev))
+ if unsigned(link.prev) == 0:
+ print "NULL prev pointer: queue_head {:>#18x} link: {:>#18x} next: {:>#18x} prev: {:>#18x}".format(queue_head, link, link.next, link.prev)
+ if unsigned(last_link) != unsigned(link.prev):
+ print "Corrupt prev pointer: queue_head {:>#18x} link: {:>#18x} next: {:>#18x} prev: {:>#18x} prev link: {:>#18x} ".format(
+ queue_head, link, link.next, link.prev, last_link)
+
+ addr = unsigned(link) - unsigned(elem_ofst);
+ obj = kern.GetValueFromAddress(addr, element_type)
+ if ParanoidIterateLinkageChain.enable_debug :
+ print "yielding link: {:>#18x} next: {:>#18x} prev: {:>#18x} addr: {:>#18x} obj: {:>#18x}".format(link, link.next, link.prev, addr, obj)
+ yield obj
+ last_link = link
+ link = link.next
+ except:
+ exc_info = sys.exc_info()
+ try:
+ print "Exception while iterating queue: {:>#18x} link: {:>#18x} addr: {:>#18x} obj: {:>#18x} last link: {:>#18x}".format(queue_head, link, addr, obj, last_link)
+ except:
+ import traceback
+ traceback.print_exc()
+ raise exc_info[0], exc_info[1], exc_info[2]
+
+ParanoidIterateLinkageChain.enable_paranoia = True
+ParanoidIterateLinkageChain.enable_debug = False
+
+# Macro: showallcallouts
+
+def ShowThreadCall(prefix, call):
+ """
+ Print a description of a thread_call_t and its relationship to its expected fire time
+ """
+ func = call.tc_call.func
+ param0 = call.tc_call.param0
+ param1 = call.tc_call.param1
+
+ iotes_desc = ""
+ iotes_callout = kern.GetLoadAddressForSymbol("_ZN18IOTimerEventSource17timeoutAndReleaseEPvS0_")
+ iotes_callout2 = kern.GetLoadAddressForSymbol("_ZN18IOTimerEventSource15timeoutSignaledEPvS0_")
+
+ if (unsigned(func) == unsigned(iotes_callout) or
+ unsigned(func) == unsigned(iotes_callout2)) :
+ iotes = Cast(call.tc_call.param0, 'IOTimerEventSource*')
+ func = iotes.action
+ param0 = iotes.owner
+ param1 = unsigned(iotes)
+
+ func_name = kern.Symbolicate(func)
+ if (func_name == "") :
+ func_name = FindKmodNameForAddr(func)
+
+ call_entry = call.tc_call
+
+ recent_timestamp = GetRecentTimestamp()
+
+ # THREAD_CALL_CONTINUOUS 0x100
+ kern.globals.mach_absolutetime_asleep
+ if (call.tc_flags & 0x100) :
+ timer_fire = call_entry.deadline - (recent_timestamp + kern.globals.mach_absolutetime_asleep)
+ else :
+ timer_fire = call_entry.deadline - recent_timestamp
+
+ timer_fire_s = kern.GetNanotimeFromAbstime(timer_fire) / 1000000000.0
+
+ ttd_s = kern.GetNanotimeFromAbstime(call.tc_ttd) / 1000000000.0
+
+ print "{:s}{:#018x}: {:18d} {:18d} {:03.06f} {:03.06f} {:#018x}({:#018x},{:#018x}) ({:s})".format(prefix,
+ unsigned(call), call_entry.deadline, call.tc_soft_deadline, ttd_s, timer_fire_s,
+ func, param0, param1, func_name)
+
+@lldb_command('showallcallouts')
+def ShowAllCallouts(cmd_args=None):
+ """ Prints out the pending and delayed thread calls for the thread call groups
+ """
+
+ index_max = GetEnumValue('thread_call_index_t::THREAD_CALL_INDEX_MAX')
+
+ for i in range (0, index_max) :
+ group = kern.globals.thread_call_groups[i]
+
+ print "Group {i:d}: {g.tcg_name:s} ({:>#18x})".format(addressof(group), i=i, g=group)
+ print "\t" +"Active: {g.active_count:d} Idle: {g.idle_count:d}\n".format(g=group)
+ print "\t" +"Blocked: {g.blocked_count:d} Pending: {g.pending_count:d}\n".format(g=group)
+ print "\t" +"Target: {g.target_thread_count:d}\n".format(g=group)
+
+ print "\t" +"Pending Queue: ({:>#18x})\n".format(addressof(group.pending_queue))
+ for call in ParanoidIterateLinkageChain(group.pending_queue, "thread_call_t", "tc_call.q_link"):
+ ShowThreadCall("\t\t", call)
+
+ print "\t" +"Delayed Queue (Absolute Time): ({:>#18x}) timer: ({:>#18x})\n".format(
+ addressof(group.delayed_queues[0]), addressof(group.delayed_timers[0]))
+ for call in ParanoidIterateLinkageChain(group.delayed_queues[0], "thread_call_t", "tc_call.q_link"):
+ ShowThreadCall("\t\t", call)
+
+ print "\t" +"Delayed Queue (Continuous Time): ({:>#18x}) timer: ({:>#18x})\n".format(
+ addressof(group.delayed_queues[1]), addressof(group.delayed_timers[1]))
+ for call in ParanoidIterateLinkageChain(group.delayed_queues[1], "thread_call_t", "tc_call.q_link"):
+ ShowThreadCall("\t\t", call)
+
+# EndMacro: showallcallouts
+