+struct _dyld_cache_header
+{
+ char magic[16]; // e.g. "dyld_v0 i386"
+ uint32_t mappingOffset; // file offset to first dyld_cache_mapping_info
+ uint32_t mappingCount; // number of dyld_cache_mapping_info entries
+ uint32_t imagesOffset; // file offset to first dyld_cache_image_info
+ uint32_t imagesCount; // number of dyld_cache_image_info entries
+ uint64_t dyldBaseAddress; // base address of dyld when cache was built
+ uint64_t codeSignatureOffset; // file offset of code signature blob
+ uint64_t codeSignatureSize; // size of code signature blob (zero means to end of file)
+ uint64_t slideInfoOffset; // file offset of kernel slid info
+ uint64_t slideInfoSize; // size of kernel slid info
+ uint64_t localSymbolsOffset; // file offset of where local symbols are stored
+ uint64_t localSymbolsSize; // size of local symbols information
+ uint8_t uuid[16]; // unique value for each shared cache file
+};
+
+
+enum micro_snapshot_flags {
+ kInterruptRecord = 0x1,
+ kTimerArmingRecord = 0x2,
+ kUserMode = 0x4, /* interrupted usermode, or armed by usermode */
+ kIORecord = 0x8,
+};
+
+/*
+ * Flags used in the following assortment of snapshots.
+ */
+enum generic_snapshot_flags {
+ kUser64_p = 0x1,
+ kKernel64_p = 0x2
+};
+
+#define VM_PRESSURE_TIME_WINDOW 5 /* seconds */
+
+enum {
+ STACKSHOT_GET_DQ = 0x01,
+ STACKSHOT_SAVE_LOADINFO = 0x02,
+ STACKSHOT_GET_GLOBAL_MEM_STATS = 0x04,
+ STACKSHOT_SAVE_KEXT_LOADINFO = 0x08,
+ STACKSHOT_GET_MICROSTACKSHOT = 0x10,
+ STACKSHOT_GLOBAL_MICROSTACKSHOT_ENABLE = 0x20,
+ STACKSHOT_GLOBAL_MICROSTACKSHOT_DISABLE = 0x40,
+ STACKSHOT_SET_MICROSTACKSHOT_MARK = 0x80,
+ STACKSHOT_ACTIVE_KERNEL_THREADS_ONLY = 0x100,
+ STACKSHOT_GET_BOOT_PROFILE = 0x200,
+ STACKSHOT_SAVE_IMP_DONATION_PIDS = 0x2000,
+ STACKSHOT_SAVE_IN_KERNEL_BUFFER = 0x4000,
+ STACKSHOT_RETRIEVE_EXISTING_BUFFER = 0x8000,
+ STACKSHOT_KCDATA_FORMAT = 0x10000,
+ STACKSHOT_ENABLE_BT_FAULTING = 0x20000,
+ STACKSHOT_COLLECT_DELTA_SNAPSHOT = 0x40000,
+ /*
+ * STACKSHOT_TAILSPIN flips on several features aimed at minimizing the size
+ * of stackshots. It is meant to be used only by the tailspin daemon. Its
+ * behavior may be changed at any time to suit the needs of the tailspin
+ * daemon. Seriously, if you are not the tailspin daemon, don't use this
+ * flag. If you need these features, ask us to add a stable SPI for what
+ * you need. That being said, the features it turns on are:
+ *
+ * minimize_uuids: If the set of loaded dylibs or kexts has not changed in
+ * the delta period, do then not report them.
+ *
+ * iostats: do not include io statistics.
+ *
+ * trace_fp: do not include the frame pointers in stack traces.
+ *
+ * minimize_nonrunnables: Do not report detailed information about threads
+ * which were not runnable in the delta period.
+ */
+ STACKSHOT_TAILSPIN = 0x80000,
+ /*
+ * Kernel consumers of stackshot (via stack_snapshot_from_kernel) can ask
+ * that we try to take the stackshot lock, and fail if we don't get it.
+ */
+ STACKSHOT_TRYLOCK = 0x100000,
+ STACKSHOT_ENABLE_UUID_FAULTING = 0x200000,
+ STACKSHOT_FROM_PANIC = 0x400000,
+ STACKSHOT_NO_IO_STATS = 0x800000,
+ /* Report owners of and pointers to kernel objects that threads are blocked on */
+ STACKSHOT_THREAD_WAITINFO = 0x1000000,
+ STACKSHOT_THREAD_GROUP = 0x2000000,
+ STACKSHOT_SAVE_JETSAM_COALITIONS = 0x4000000,
+ STACKSHOT_INSTRS_CYCLES = 0x8000000,
+};
+
+#define STACKSHOT_THREAD_SNAPSHOT_MAGIC 0xfeedface
+#define STACKSHOT_TASK_SNAPSHOT_MAGIC 0xdecafbad
+#define STACKSHOT_MEM_AND_IO_SNAPSHOT_MAGIC 0xbfcabcde
+#define STACKSHOT_MICRO_SNAPSHOT_MAGIC 0x31c54011
+
+#define KF_INITIALIZED (0x1)
+#define KF_SERIAL_OVRD (0x2)
+#define KF_PMAPV_OVRD (0x4)
+#define KF_MATV_OVRD (0x8)
+#define KF_STACKSHOT_OVRD (0x10)
+#define KF_COMPRSV_OVRD (0x20)
+
+boolean_t kern_feature_override(uint32_t fmask);
+
+/*
+ * Any updates to this header should be also updated in astris as it can not
+ * grab this header from the SDK.
+ *
+ * NOTE: DO NOT REMOVE OR CHANGE THE MEANING OF ANY FIELDS FROM THIS STRUCTURE.
+ * Any modifications should add new fields at the end, bump the version number
+ * and be done alongside astris and DumpPanic changes.
+ */
+struct embedded_panic_header {
+ uint32_t eph_magic; /* EMBEDDED_PANIC_MAGIC if valid */
+ uint32_t eph_crc; /* CRC of everything following the ph_crc in the header and the contents */
+ uint32_t eph_version; /* embedded_panic_header version */
+ uint64_t eph_panic_flags; /* Flags indicating any state or relevant details */
+ uint32_t eph_panic_log_offset; /* Offset of the beginning of the panic log from the beginning of the header */
+ uint32_t eph_panic_log_len; /* length of the panic log */
+ uint32_t eph_stackshot_offset; /* Offset of the beginning of the panic stackshot from the beginning of the header */
+ uint32_t eph_stackshot_len; /* length of the panic stackshot (0 if not valid ) */
+ uint32_t eph_other_log_offset; /* Offset of the other log (any logging subsequent to the stackshot) from the beginning of the header */
+ uint32_t eph_other_log_len; /* length of the other log */
+ union {
+ struct {
+ uint64_t eph_x86_power_state:8,
+ eph_x86_efi_boot_state:8,
+ eph_x86_system_state:8,
+ eph_x86_unused_bits:40;
+ }; // anonymous struct to group the bitfields together.
+ uint64_t eph_x86_do_not_use; /* Used for offsetof/sizeof when parsing header */
+ };
+} __attribute__((packed));
+
+#define EMBEDDED_PANIC_HEADER_FLAG_COREDUMP_COMPLETE 0x01
+#define EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_SUCCEEDED 0x02
+#define EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_FAILED_DEBUGGERSYNC 0x04
+#define EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR 0x08
+#define EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_FAILED_INCOMPLETE 0x10
+#define EMBEDDED_PANIC_HEADER_FLAG_STACKSHOT_FAILED_NESTED 0x20
+#define EMBEDDED_PANIC_HEADER_FLAG_NESTED_PANIC 0x40
+#define EMBEDDED_PANIC_HEADER_FLAG_BUTTON_RESET_PANIC 0x80
+#define EMBEDDED_PANIC_HEADER_FLAG_COPROC_INITIATED_PANIC 0x100
+#define EMBEDDED_PANIC_HEADER_FLAG_COREDUMP_FAILED 0x200
+
+#define EMBEDDED_PANIC_HEADER_CURRENT_VERSION 2
+#define EMBEDDED_PANIC_MAGIC 0x46554E4B /* FUNK */
+
+struct macos_panic_header {
+ uint32_t mph_magic; /* MACOS_PANIC_MAGIC if valid */
+ uint32_t mph_crc; /* CRC of everything following mph_crc in the header and the contents */
+ uint32_t mph_version; /* macos_panic_header version */
+ uint32_t mph_padding; /* unused */
+ uint64_t mph_panic_flags; /* Flags indicating any state or relevant details */
+ uint32_t mph_panic_log_offset; /* Offset of the panic log from the beginning of the header */
+ uint32_t mph_panic_log_len; /* length of the panic log */
+ uint32_t mph_stackshot_offset; /* Offset of the panic stackshot from the beginning of the header */
+ uint32_t mph_stackshot_len; /* length of the panic stackshot */
+ uint32_t mph_other_log_offset; /* Offset of the other log (any logging subsequent to the stackshot) from the beginning of the header */
+ uint32_t mph_other_log_len; /* length of the other log */
+ char mph_data[]; /* panic data -- DO NOT ACCESS THIS FIELD DIRECTLY. Use the offsets above relative to the beginning of the header */
+} __attribute__((packed));
+
+#define MACOS_PANIC_HEADER_CURRENT_VERSION 2
+#define MACOS_PANIC_MAGIC 0x44454544 /* DEED */
+
+#define MACOS_PANIC_HEADER_FLAG_NESTED_PANIC 0x01
+#define MACOS_PANIC_HEADER_FLAG_COPROC_INITIATED_PANIC 0x02
+#define MACOS_PANIC_HEADER_FLAG_STACKSHOT_SUCCEEDED 0x04
+#define MACOS_PANIC_HEADER_FLAG_STACKSHOT_DATA_COMPRESSED 0x08
+#define MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_DEBUGGERSYNC 0x10
+#define MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR 0x20
+#define MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_INCOMPLETE 0x40
+#define MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_NESTED 0x80
+#define MACOS_PANIC_HEADER_FLAG_COREDUMP_COMPLETE 0x100
+#define MACOS_PANIC_HEADER_FLAG_COREDUMP_FAILED 0x200
+#define MACOS_PANIC_HEADER_FLAG_STACKSHOT_KERNEL_ONLY 0x400
+
+#endif /* __APPLE_API_UNSTABLE */
+#endif /* __APPLE_API_PRIVATE */
+
+#ifdef KERNEL
+
+__BEGIN_DECLS
+
+extern void panic(const char *string, ...) __printflike(1,2);
+
+__END_DECLS
+
+#endif /* KERNEL */
+
+#ifdef KERNEL_PRIVATE
+#if DEBUG
+#ifndef DKPR
+#define DKPR 1
+#endif
+#endif
+
+#if DKPR
+/*
+ * For the DEBUG kernel, support the following:
+ * sysctl -w debug.kprint_syscall=<syscall_mask>
+ * sysctl -w debug.kprint_syscall_process=<p_comm>
+ * <syscall_mask> should be an OR of the masks below
+ * for UNIX, MACH, MDEP, or IPC. This debugging aid
+ * assumes the task/process is locked/wired and will
+ * not go away during evaluation. If no process is
+ * specified, all processes will be traced
+ */
+extern int debug_kprint_syscall;
+extern int debug_kprint_current_process(const char **namep);
+#define DEBUG_KPRINT_SYSCALL_PREDICATE_INTERNAL(mask, namep) \
+ ( (debug_kprint_syscall & (mask)) && debug_kprint_current_process(namep) )
+#define DEBUG_KPRINT_SYSCALL_MASK(mask, fmt, args...) do { \
+ const char *dks_name = NULL; \
+ if (DEBUG_KPRINT_SYSCALL_PREDICATE_INTERNAL(mask, &dks_name)) { \
+ kprintf("[%s%s%p]" fmt, dks_name ? dks_name : "", \
+ dks_name ? "@" : "", current_thread(), args); \
+ } \
+ } while (0)
+#else /* !DEBUG */
+#define DEBUG_KPRINT_SYSCALL_PREDICATE_INTERNAL(mask, namep) (0)
+#define DEBUG_KPRINT_SYSCALL_MASK(mask, fmt, args...) do { } while (0) /* kprintf(fmt, args) */
+#endif /* !DEBUG */
+
+enum {
+ DEBUG_KPRINT_SYSCALL_UNIX_MASK = 1 << 0,
+ DEBUG_KPRINT_SYSCALL_MACH_MASK = 1 << 1,
+ DEBUG_KPRINT_SYSCALL_MDEP_MASK = 1 << 2,
+ DEBUG_KPRINT_SYSCALL_IPC_MASK = 1 << 3
+};
+
+#define DEBUG_KPRINT_SYSCALL_PREDICATE(mask) \
+ DEBUG_KPRINT_SYSCALL_PREDICATE_INTERNAL(mask, NULL)
+#define DEBUG_KPRINT_SYSCALL_UNIX(fmt, args...) \
+ DEBUG_KPRINT_SYSCALL_MASK(DEBUG_KPRINT_SYSCALL_UNIX_MASK,fmt,args)
+#define DEBUG_KPRINT_SYSCALL_MACH(fmt, args...) \
+ DEBUG_KPRINT_SYSCALL_MASK(DEBUG_KPRINT_SYSCALL_MACH_MASK,fmt,args)
+#define DEBUG_KPRINT_SYSCALL_MDEP(fmt, args...) \
+ DEBUG_KPRINT_SYSCALL_MASK(DEBUG_KPRINT_SYSCALL_MDEP_MASK,fmt,args)
+#define DEBUG_KPRINT_SYSCALL_IPC(fmt, args...) \
+ DEBUG_KPRINT_SYSCALL_MASK(DEBUG_KPRINT_SYSCALL_IPC_MASK,fmt,args)
+
+/* Debug boot-args */