1/*
2 * Copyright (c) 2000-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * @OSF_COPYRIGHT@
30 */
31/*
32 * Mach Operating System
33 * Copyright (c) 1991,1990,1989, 1988 Carnegie Mellon University
34 * All Rights Reserved.
35 *
36 * Permission to use, copy, modify and distribute this software and its
37 * documentation is hereby granted, provided that both the copyright
38 * notice and this permission notice appear in all copies of the
39 * software, derivative works or modified versions, and any portions
40 * thereof, and that both notices appear in supporting documentation.
41 *
42 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
45 *
46 * Carnegie Mellon requests users of this software to return to
47 *
48 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU
49 * School of Computer Science
50 * Carnegie Mellon University
51 * Pittsburgh PA 15213-3890
52 *
53 * any improvements or extensions that they make and grant Carnegie Mellon
54 * the rights to redistribute these changes.
55 */
56
57/*
58 */
59
60/*
61 * File: model_dep.c
62 * Author: Avadis Tevanian, Jr., Michael Wayne Young
63 *
64 * Copyright (C) 1986, Avadis Tevanian, Jr., Michael Wayne Young
65 *
66 * Basic initialization for I386 - ISA bus machines.
67 */
68
69
70#define __APPLE_API_PRIVATE 1
71#define __APPLE_API_UNSTABLE 1
72#include <kern/debug.h>
73
74#include <mach/i386/vm_param.h>
75
76#include <string.h>
77#include <mach/vm_param.h>
78#include <mach/vm_prot.h>
79#include <mach/machine.h>
80#include <mach/time_value.h>
81#include <sys/kdebug.h>
82#include <kern/spl.h>
83#include <kern/assert.h>
84#include <kern/misc_protos.h>
85#include <kern/startup.h>
86#include <kern/clock.h>
87#include <kern/cpu_data.h>
88#include <kern/machine.h>
89#include <i386/postcode.h>
90#include <i386/mp_desc.h>
91#include <i386/misc_protos.h>
92#include <i386/thread.h>
93#include <i386/trap.h>
94#include <i386/machine_routines.h>
95#include <i386/mp.h> /* mp_rendezvous_break_lock */
96#include <i386/cpuid.h>
97#include <i386/fpu.h>
98#include <i386/machine_cpu.h>
99#include <i386/pmap.h>
100#if CONFIG_MTRR
101#include <i386/mtrr.h>
102#endif
103#include <i386/ucode.h>
104#include <i386/pmCPU.h>
105#include <i386/panic_hooks.h>
106
107#include <architecture/i386/pio.h> /* inb() */
108#include <pexpert/i386/boot.h>
109
110#include <kdp/kdp_dyld.h>
111#include <kdp/kdp_core.h>
112#include <vm/pmap.h>
113#include <vm/vm_map.h>
114#include <vm/vm_kern.h>
115
116#include <IOKit/IOPlatformExpert.h>
117#include <IOKit/IOHibernatePrivate.h>
118
119#include <pexpert/i386/efi.h>
120
121#include <kern/thread.h>
122#include <kern/sched.h>
123#include <mach-o/loader.h>
124#include <mach-o/nlist.h>
125
126#include <libkern/kernel_mach_header.h>
127#include <libkern/OSKextLibPrivate.h>
128#include <libkern/crc.h>
129
130#if DEBUG || DEVELOPMENT
131#define DPRINTF(x...) kprintf(x)
132#else
133#define DPRINTF(x...)
134#endif
135
136#ifndef ROUNDUP
137#define ROUNDUP(a, b) (((a) + ((b) - 1)) & (~((b) - 1)))
138#endif
139
140#ifndef ROUNDDOWN
141#define ROUNDDOWN(x,y) (((x)/(y))*(y))
142#endif
143
144static void machine_conf(void);
145void panic_print_symbol_name(vm_address_t search);
146void RecordPanicStackshot(void);
147
148typedef enum paniclog_flush_type {
149 kPaniclogFlushBase = 1, /* Flush the initial log and paniclog header */
150 kPaniclogFlushStackshot = 2, /* Flush only the stackshot data, then flush the header */
151 kPaniclogFlushOtherLog = 3 /* Flush the other log, then flush the header */
152} paniclog_flush_type_t;
153
154void paniclog_flush_internal(paniclog_flush_type_t variant);
155
156extern const char version[];
157extern char osversion[];
158extern int max_unsafe_quanta;
159extern int max_poll_quanta;
160extern unsigned int panic_is_inited;
161
162extern int proc_pid(void *p);
163
164/* Definitions for frame pointers */
165#define FP_ALIGNMENT_MASK ((uint32_t)(0x3))
166#define FP_LR_OFFSET ((uint32_t)4)
167#define FP_LR_OFFSET64 ((uint32_t)8)
168#define FP_MAX_NUM_TO_EVALUATE (50)
169
170volatile int pbtcpu = -1;
171hw_lock_data_t pbtlock; /* backtrace print lock */
172uint32_t pbtcnt = 0;
173
174volatile int panic_double_fault_cpu = -1;
175
176#define PRINT_ARGS_FROM_STACK_FRAME 0
177
178typedef struct _cframe_t {
179 struct _cframe_t *prev;
180 uintptr_t caller;
181#if PRINT_ARGS_FROM_STACK_FRAME
182 unsigned args[0];
183#endif
184} cframe_t;
185
186static unsigned panic_io_port;
187static unsigned commit_paniclog_to_nvram;
188boolean_t coprocessor_paniclog_flush = FALSE;
189
190struct kcdata_descriptor kc_panic_data;
191static boolean_t begun_panic_stackshot = FALSE;
192extern kern_return_t do_stackshot(void *);
193
194extern void kdp_snapshot_preflight(int pid, void *tracebuf,
195 uint32_t tracebuf_size, uint32_t flags,
196 kcdata_descriptor_t data_p,
197 boolean_t enable_faulting);
198extern int kdp_stack_snapshot_bytes_traced(void);
199
200#if DEVELOPMENT || DEBUG
201vm_offset_t panic_stackshot_buf = 0;
202size_t panic_stackshot_len = 0;
203#endif
204
205/*
206 * Backtrace a single frame.
207 */
208void
209print_one_backtrace(pmap_t pmap, vm_offset_t topfp, const char *cur_marker,
210 boolean_t is_64_bit)
211{
212 int i = 0;
213 addr64_t lr;
214 addr64_t fp;
215 addr64_t fp_for_ppn;
216 ppnum_t ppn;
217 boolean_t dump_kernel_stack;
218
219 fp = topfp;
220 fp_for_ppn = 0;
221 ppn = (ppnum_t)NULL;
222
223 if (fp >= VM_MIN_KERNEL_ADDRESS)
224 dump_kernel_stack = TRUE;
225 else
226 dump_kernel_stack = FALSE;
227
228 do {
229 if ((fp == 0) || ((fp & FP_ALIGNMENT_MASK) != 0))
230 break;
231 if (dump_kernel_stack && ((fp < VM_MIN_KERNEL_ADDRESS) || (fp > VM_MAX_KERNEL_ADDRESS)))
232 break;
233 if ((!dump_kernel_stack) && (fp >=VM_MIN_KERNEL_ADDRESS))
234 break;
235
236 /* Check to see if current address will result in a different
237 ppn than previously computed (to avoid recomputation) via
238 (addr) ^ fp_for_ppn) >> PAGE_SHIFT) */
239
240 if ((((fp + FP_LR_OFFSET) ^ fp_for_ppn) >> PAGE_SHIFT) != 0x0U) {
241 ppn = pmap_find_phys(pmap, fp + FP_LR_OFFSET);
242 fp_for_ppn = fp + (is_64_bit ? FP_LR_OFFSET64 : FP_LR_OFFSET);
243 }
244 if (ppn != (ppnum_t)NULL) {
245 if (is_64_bit) {
246 lr = ml_phys_read_double_64(((((vm_offset_t)ppn) << PAGE_SHIFT)) | ((fp + FP_LR_OFFSET64) & PAGE_MASK));
247 } else {
248 lr = ml_phys_read_word(((((vm_offset_t)ppn) << PAGE_SHIFT)) | ((fp + FP_LR_OFFSET) & PAGE_MASK));
249 }
250 } else {
251 if (is_64_bit) {
252 paniclog_append_noflush("%s\t Could not read LR from frame at 0x%016llx\n", cur_marker, fp + FP_LR_OFFSET64);
253 } else {
254 paniclog_append_noflush("%s\t Could not read LR from frame at 0x%08x\n", cur_marker, (uint32_t)(fp + FP_LR_OFFSET));
255 }
256 break;
257 }
258 if (((fp ^ fp_for_ppn) >> PAGE_SHIFT) != 0x0U) {
259 ppn = pmap_find_phys(pmap, fp);
260 fp_for_ppn = fp;
261 }
262 if (ppn != (ppnum_t)NULL) {
263 if (is_64_bit) {
264 fp = ml_phys_read_double_64(((((vm_offset_t)ppn) << PAGE_SHIFT)) | (fp & PAGE_MASK));
265 } else {
266 fp = ml_phys_read_word(((((vm_offset_t)ppn) << PAGE_SHIFT)) | (fp & PAGE_MASK));
267 }
268 } else {
269 if (is_64_bit) {
270 paniclog_append_noflush("%s\t Could not read FP from frame at 0x%016llx\n", cur_marker, fp);
271 } else {
272 paniclog_append_noflush("%s\t Could not read FP from frame at 0x%08x\n", cur_marker, (uint32_t)fp);
273 }
274 break;
275 }
276
277 if (is_64_bit) {
278 paniclog_append_noflush("%s\t0x%016llx\n", cur_marker, lr);
279 } else {
280 paniclog_append_noflush("%s\t0x%08x\n", cur_marker, (uint32_t)lr);
281 }
282 } while ((++i < FP_MAX_NUM_TO_EVALUATE) && (fp != topfp));
283}
284void
285machine_startup(void)
286{
287 int boot_arg;
288
289#if 0
290 if( PE_get_hotkey( kPEControlKey ))
291 halt_in_debugger = halt_in_debugger ? 0 : 1;
292#endif
293
294 if (!PE_parse_boot_argn("nvram_paniclog", &commit_paniclog_to_nvram, sizeof (commit_paniclog_to_nvram)))
295 commit_paniclog_to_nvram = 1;
296
297 /*
298 * Entering the debugger will put the CPUs into a "safe"
299 * power mode.
300 */
301 if (PE_parse_boot_argn("pmsafe_debug", &boot_arg, sizeof (boot_arg)))
302 pmsafe_debug = boot_arg;
303
304 hw_lock_init(&pbtlock); /* initialize print backtrace lock */
305
306 if (PE_parse_boot_argn("preempt", &boot_arg, sizeof (boot_arg))) {
307 default_preemption_rate = boot_arg;
308 }
309 if (PE_parse_boot_argn("unsafe", &boot_arg, sizeof (boot_arg))) {
310 max_unsafe_quanta = boot_arg;
311 }
312 if (PE_parse_boot_argn("poll", &boot_arg, sizeof (boot_arg))) {
313 max_poll_quanta = boot_arg;
314 }
315 if (PE_parse_boot_argn("yield", &boot_arg, sizeof (boot_arg))) {
316 sched_poll_yield_shift = boot_arg;
317 }
318/* The I/O port to issue a read from, in the event of a panic. Useful for
319 * triggering logic analyzers.
320 */
321 if (PE_parse_boot_argn("panic_io_port", &boot_arg, sizeof (boot_arg))) {
322 /*I/O ports range from 0 through 0xFFFF */
323 panic_io_port = boot_arg & 0xffff;
324 }
325
326 machine_conf();
327
328 panic_hooks_init();
329
330 /*
331 * Start the system.
332 */
333 kernel_bootstrap();
334 /*NOTREACHED*/
335}
336
337
338static void
339machine_conf(void)
340{
341 machine_info.memory_size = (typeof(machine_info.memory_size))mem_size;
342}
343
344extern void *gPEEFIRuntimeServices;
345extern void *gPEEFISystemTable;
346
347static void
348efi_set_tables_64(EFI_SYSTEM_TABLE_64 * system_table)
349{
350 EFI_RUNTIME_SERVICES_64 *runtime;
351 uint32_t hdr_cksum;
352 uint32_t cksum;
353
354 DPRINTF("Processing 64-bit EFI tables at %p\n", system_table);
355 do {
356 DPRINTF("Header:\n");
357 DPRINTF(" Signature: 0x%016llx\n", system_table->Hdr.Signature);
358 DPRINTF(" Revision: 0x%08x\n", system_table->Hdr.Revision);
359 DPRINTF(" HeaderSize: 0x%08x\n", system_table->Hdr.HeaderSize);
360 DPRINTF(" CRC32: 0x%08x\n", system_table->Hdr.CRC32);
361 DPRINTF("RuntimeServices: 0x%016llx\n", system_table->RuntimeServices);
362 if (system_table->Hdr.Signature != EFI_SYSTEM_TABLE_SIGNATURE) {
363 kprintf("Bad EFI system table signature\n");
364 break;
365 }
366 // Verify signature of the system table
367 hdr_cksum = system_table->Hdr.CRC32;
368 system_table->Hdr.CRC32 = 0;
369 cksum = crc32(0L, system_table, system_table->Hdr.HeaderSize);
370
371 DPRINTF("System table calculated CRC32 = 0x%x, header = 0x%x\n", cksum, hdr_cksum);
372 system_table->Hdr.CRC32 = hdr_cksum;
373 if (cksum != hdr_cksum) {
374 kprintf("Bad EFI system table checksum\n");
375 break;
376 }
377
378 gPEEFISystemTable = system_table;
379
380 if(system_table->RuntimeServices == 0) {
381 kprintf("No runtime table present\n");
382 break;
383 }
384 DPRINTF("RuntimeServices table at 0x%qx\n", system_table->RuntimeServices);
385 // 64-bit virtual address is OK for 64-bit EFI and 64/32-bit kernel.
386 runtime = (EFI_RUNTIME_SERVICES_64 *) (uintptr_t)system_table->RuntimeServices;
387 DPRINTF("Checking runtime services table %p\n", runtime);
388 if (runtime->Hdr.Signature != EFI_RUNTIME_SERVICES_SIGNATURE) {
389 kprintf("Bad EFI runtime table signature\n");
390 break;
391 }
392
393 // Verify signature of runtime services table
394 hdr_cksum = runtime->Hdr.CRC32;
395 runtime->Hdr.CRC32 = 0;
396 cksum = crc32(0L, runtime, runtime->Hdr.HeaderSize);
397
398 DPRINTF("Runtime table calculated CRC32 = 0x%x, header = 0x%x\n", cksum, hdr_cksum);
399 runtime->Hdr.CRC32 = hdr_cksum;
400 if (cksum != hdr_cksum) {
401 kprintf("Bad EFI runtime table checksum\n");
402 break;
403 }
404
405 gPEEFIRuntimeServices = runtime;
406 }
407 while (FALSE);
408}
409
410static void
411efi_set_tables_32(EFI_SYSTEM_TABLE_32 * system_table)
412{
413 EFI_RUNTIME_SERVICES_32 *runtime;
414 uint32_t hdr_cksum;
415 uint32_t cksum;
416
417 DPRINTF("Processing 32-bit EFI tables at %p\n", system_table);
418 do {
419 DPRINTF("Header:\n");
420 DPRINTF(" Signature: 0x%016llx\n", system_table->Hdr.Signature);
421 DPRINTF(" Revision: 0x%08x\n", system_table->Hdr.Revision);
422 DPRINTF(" HeaderSize: 0x%08x\n", system_table->Hdr.HeaderSize);
423 DPRINTF(" CRC32: 0x%08x\n", system_table->Hdr.CRC32);
424 DPRINTF("RuntimeServices: 0x%08x\n", system_table->RuntimeServices);
425 if (system_table->Hdr.Signature != EFI_SYSTEM_TABLE_SIGNATURE) {
426 kprintf("Bad EFI system table signature\n");
427 break;
428 }
429 // Verify signature of the system table
430 hdr_cksum = system_table->Hdr.CRC32;
431 system_table->Hdr.CRC32 = 0;
432 DPRINTF("System table at %p HeaderSize 0x%x\n", system_table, system_table->Hdr.HeaderSize);
433 cksum = crc32(0L, system_table, system_table->Hdr.HeaderSize);
434
435 DPRINTF("System table calculated CRC32 = 0x%x, header = 0x%x\n", cksum, hdr_cksum);
436 system_table->Hdr.CRC32 = hdr_cksum;
437 if (cksum != hdr_cksum) {
438 kprintf("Bad EFI system table checksum\n");
439 break;
440 }
441
442 gPEEFISystemTable = system_table;
443
444 if(system_table->RuntimeServices == 0) {
445 kprintf("No runtime table present\n");
446 break;
447 }
448 DPRINTF("RuntimeServices table at 0x%x\n", system_table->RuntimeServices);
449 // 32-bit virtual address is OK for 32-bit EFI and 32-bit kernel.
450 // For a 64-bit kernel, booter provides a virtual address mod 4G
451 runtime = (EFI_RUNTIME_SERVICES_32 *)
452 (system_table->RuntimeServices | VM_MIN_KERNEL_ADDRESS);
453 DPRINTF("Runtime table addressed at %p\n", runtime);
454 if (runtime->Hdr.Signature != EFI_RUNTIME_SERVICES_SIGNATURE) {
455 kprintf("Bad EFI runtime table signature\n");
456 break;
457 }
458
459 // Verify signature of runtime services table
460 hdr_cksum = runtime->Hdr.CRC32;
461 runtime->Hdr.CRC32 = 0;
462 cksum = crc32(0L, runtime, runtime->Hdr.HeaderSize);
463
464 DPRINTF("Runtime table calculated CRC32 = 0x%x, header = 0x%x\n", cksum, hdr_cksum);
465 runtime->Hdr.CRC32 = hdr_cksum;
466 if (cksum != hdr_cksum) {
467 kprintf("Bad EFI runtime table checksum\n");
468 break;
469 }
470
471 DPRINTF("Runtime functions\n");
472 DPRINTF(" GetTime : 0x%x\n", runtime->GetTime);
473 DPRINTF(" SetTime : 0x%x\n", runtime->SetTime);
474 DPRINTF(" GetWakeupTime : 0x%x\n", runtime->GetWakeupTime);
475 DPRINTF(" SetWakeupTime : 0x%x\n", runtime->SetWakeupTime);
476 DPRINTF(" SetVirtualAddressMap : 0x%x\n", runtime->SetVirtualAddressMap);
477 DPRINTF(" ConvertPointer : 0x%x\n", runtime->ConvertPointer);
478 DPRINTF(" GetVariable : 0x%x\n", runtime->GetVariable);
479 DPRINTF(" GetNextVariableName : 0x%x\n", runtime->GetNextVariableName);
480 DPRINTF(" SetVariable : 0x%x\n", runtime->SetVariable);
481 DPRINTF(" GetNextHighMonotonicCount: 0x%x\n", runtime->GetNextHighMonotonicCount);
482 DPRINTF(" ResetSystem : 0x%x\n", runtime->ResetSystem);
483
484 gPEEFIRuntimeServices = runtime;
485 }
486 while (FALSE);
487}
488
489
490/* Map in EFI runtime areas. */
491static void
492efi_init(void)
493{
494 boot_args *args = (boot_args *)PE_state.bootArgs;
495
496 kprintf("Initializing EFI runtime services\n");
497
498 do
499 {
500 vm_offset_t vm_size, vm_addr;
501 vm_map_offset_t phys_addr;
502 EfiMemoryRange *mptr;
503 unsigned int msize, mcount;
504 unsigned int i;
505
506 msize = args->MemoryMapDescriptorSize;
507 mcount = args->MemoryMapSize / msize;
508
509 DPRINTF("efi_init() kernel base: 0x%x size: 0x%x\n",
510 args->kaddr, args->ksize);
511 DPRINTF(" efiSystemTable physical: 0x%x virtual: %p\n",
512 args->efiSystemTable,
513 (void *) ml_static_ptovirt(args->efiSystemTable));
514 DPRINTF(" efiRuntimeServicesPageStart: 0x%x\n",
515 args->efiRuntimeServicesPageStart);
516 DPRINTF(" efiRuntimeServicesPageCount: 0x%x\n",
517 args->efiRuntimeServicesPageCount);
518 DPRINTF(" efiRuntimeServicesVirtualPageStart: 0x%016llx\n",
519 args->efiRuntimeServicesVirtualPageStart);
520 mptr = (EfiMemoryRange *)ml_static_ptovirt(args->MemoryMap);
521 for (i=0; i < mcount; i++, mptr = (EfiMemoryRange *)(((vm_offset_t)mptr) + msize)) {
522 if (((mptr->Attribute & EFI_MEMORY_RUNTIME) == EFI_MEMORY_RUNTIME) ) {
523 vm_size = (vm_offset_t)i386_ptob((uint32_t)mptr->NumberOfPages);
524 vm_addr = (vm_offset_t) mptr->VirtualStart;
525 /* For K64 on EFI32, shadow-map into high KVA */
526 if (vm_addr < VM_MIN_KERNEL_ADDRESS)
527 vm_addr |= VM_MIN_KERNEL_ADDRESS;
528 phys_addr = (vm_map_offset_t) mptr->PhysicalStart;
529 DPRINTF(" Type: %x phys: %p EFIv: %p kv: %p size: %p\n",
530 mptr->Type,
531 (void *) (uintptr_t) phys_addr,
532 (void *) (uintptr_t) mptr->VirtualStart,
533 (void *) vm_addr,
534 (void *) vm_size);
535 pmap_map_bd(vm_addr, phys_addr, phys_addr + round_page(vm_size),
536 (mptr->Type == kEfiRuntimeServicesCode) ? VM_PROT_READ | VM_PROT_EXECUTE : VM_PROT_READ|VM_PROT_WRITE,
537 (mptr->Type == EfiMemoryMappedIO) ? VM_WIMG_IO : VM_WIMG_USE_DEFAULT);
538 }
539 }
540
541 if (args->Version != kBootArgsVersion2)
542 panic("Incompatible boot args version %d revision %d\n", args->Version, args->Revision);
543
544 DPRINTF("Boot args version %d revision %d mode %d\n", args->Version, args->Revision, args->efiMode);
545 if (args->efiMode == kBootArgsEfiMode64) {
546 efi_set_tables_64((EFI_SYSTEM_TABLE_64 *) ml_static_ptovirt(args->efiSystemTable));
547 } else {
548 efi_set_tables_32((EFI_SYSTEM_TABLE_32 *) ml_static_ptovirt(args->efiSystemTable));
549 }
550 }
551 while (FALSE);
552
553 return;
554}
555
556/* Returns TRUE if a page belongs to the EFI Runtime Services (code or data) */
557boolean_t
558efi_valid_page(ppnum_t ppn)
559{
560 boot_args *args = (boot_args *)PE_state.bootArgs;
561 ppnum_t pstart = args->efiRuntimeServicesPageStart;
562 ppnum_t pend = pstart + args->efiRuntimeServicesPageCount;
563
564 return pstart <= ppn && ppn < pend;
565}
566
567/* Remap EFI runtime areas. */
568void
569hibernate_newruntime_map(void * map, vm_size_t map_size, uint32_t system_table_offset)
570{
571 boot_args *args = (boot_args *)PE_state.bootArgs;
572
573 kprintf("Reinitializing EFI runtime services\n");
574
575 do
576 {
577 vm_offset_t vm_size, vm_addr;
578 vm_map_offset_t phys_addr;
579 EfiMemoryRange *mptr;
580 unsigned int msize, mcount;
581 unsigned int i;
582
583 gPEEFISystemTable = 0;
584 gPEEFIRuntimeServices = 0;
585
586 system_table_offset += ptoa_32(args->efiRuntimeServicesPageStart);
587
588 kprintf("Old system table 0x%x, new 0x%x\n",
589 (uint32_t)args->efiSystemTable, system_table_offset);
590
591 args->efiSystemTable = system_table_offset;
592
593 kprintf("Old map:\n");
594 msize = args->MemoryMapDescriptorSize;
595 mcount = args->MemoryMapSize / msize;
596 mptr = (EfiMemoryRange *)ml_static_ptovirt(args->MemoryMap);
597 for (i=0; i < mcount; i++, mptr = (EfiMemoryRange *)(((vm_offset_t)mptr) + msize)) {
598 if ((mptr->Attribute & EFI_MEMORY_RUNTIME) == EFI_MEMORY_RUNTIME) {
599
600 vm_size = (vm_offset_t)i386_ptob((uint32_t)mptr->NumberOfPages);
601 vm_addr = (vm_offset_t) mptr->VirtualStart;
602 /* K64 on EFI32 */
603 if (vm_addr < VM_MIN_KERNEL_ADDRESS)
604 vm_addr |= VM_MIN_KERNEL_ADDRESS;
605 phys_addr = (vm_map_offset_t) mptr->PhysicalStart;
606
607 kprintf("mapping[%u] %qx @ %lx, %llu\n", mptr->Type, phys_addr, (unsigned long)vm_addr, mptr->NumberOfPages);
608 }
609 }
610
611 pmap_remove(kernel_pmap, i386_ptob(args->efiRuntimeServicesPageStart),
612 i386_ptob(args->efiRuntimeServicesPageStart + args->efiRuntimeServicesPageCount));
613
614 kprintf("New map:\n");
615 msize = args->MemoryMapDescriptorSize;
616 mcount = (unsigned int )(map_size / msize);
617 mptr = map;
618 for (i=0; i < mcount; i++, mptr = (EfiMemoryRange *)(((vm_offset_t)mptr) + msize)) {
619 if ((mptr->Attribute & EFI_MEMORY_RUNTIME) == EFI_MEMORY_RUNTIME) {
620
621 vm_size = (vm_offset_t)i386_ptob((uint32_t)mptr->NumberOfPages);
622 vm_addr = (vm_offset_t) mptr->VirtualStart;
623 if (vm_addr < VM_MIN_KERNEL_ADDRESS)
624 vm_addr |= VM_MIN_KERNEL_ADDRESS;
625 phys_addr = (vm_map_offset_t) mptr->PhysicalStart;
626
627 kprintf("mapping[%u] %qx @ %lx, %llu\n", mptr->Type, phys_addr, (unsigned long)vm_addr, mptr->NumberOfPages);
628
629 pmap_map(vm_addr, phys_addr, phys_addr + round_page(vm_size),
630 (mptr->Type == kEfiRuntimeServicesCode) ? VM_PROT_READ | VM_PROT_EXECUTE : VM_PROT_READ|VM_PROT_WRITE,
631 (mptr->Type == EfiMemoryMappedIO) ? VM_WIMG_IO : VM_WIMG_USE_DEFAULT);
632 }
633 }
634
635 if (args->Version != kBootArgsVersion2)
636 panic("Incompatible boot args version %d revision %d\n", args->Version, args->Revision);
637
638 kprintf("Boot args version %d revision %d mode %d\n", args->Version, args->Revision, args->efiMode);
639 if (args->efiMode == kBootArgsEfiMode64) {
640 efi_set_tables_64((EFI_SYSTEM_TABLE_64 *) ml_static_ptovirt(args->efiSystemTable));
641 } else {
642 efi_set_tables_32((EFI_SYSTEM_TABLE_32 *) ml_static_ptovirt(args->efiSystemTable));
643 }
644 }
645 while (FALSE);
646
647 kprintf("Done reinitializing EFI runtime services\n");
648
649 return;
650}
651
652/*
653 * Find devices. The system is alive.
654 */
655void
656machine_init(void)
657{
658 /* Now with VM up, switch to dynamically allocated cpu data */
659 cpu_data_realloc();
660
661 /* Ensure panic buffer is initialized. */
662 debug_log_init();
663
664 /*
665 * Display CPU identification
666 */
667 cpuid_cpu_display("CPU identification");
668 cpuid_feature_display("CPU features");
669 cpuid_extfeature_display("CPU extended features");
670
671 /*
672 * Initialize EFI runtime services.
673 */
674 efi_init();
675
676 smp_init();
677
678 /*
679 * Set up to use floating point.
680 */
681 init_fpu();
682
683 /*
684 * Configure clock devices.
685 */
686 clock_config();
687
688#if CONFIG_MTRR
689 /*
690 * Initialize MTRR from boot processor.
691 */
692 mtrr_init();
693
694 /*
695 * Set up PAT for boot processor.
696 */
697 pat_init();
698#endif
699
700 /*
701 * Free lowmem pages and complete other setup
702 */
703 pmap_lowmem_finalize();
704}
705
706/*
707 * Halt a cpu.
708 */
709void
710halt_cpu(void)
711{
712 halt_all_cpus(FALSE);
713}
714
715int reset_mem_on_reboot = 1;
716
717/*
718 * Halt the system or reboot.
719 */
720__attribute__((noreturn))
721void
722halt_all_cpus(boolean_t reboot)
723{
724 if (reboot) {
725 printf("MACH Reboot\n");
726 PEHaltRestart( kPERestartCPU );
727 } else {
728 printf("CPU halted\n");
729 PEHaltRestart( kPEHaltCPU );
730 }
731 while(1);
732}
733
734
735/* Issue an I/O port read if one has been requested - this is an event logic
736 * analyzers can use as a trigger point.
737 */
738
739void
740panic_io_port_read(void) {
741 if (panic_io_port)
742 (void)inb(panic_io_port);
743}
744
745/* For use with the MP rendezvous mechanism
746 */
747
748uint64_t panic_restart_timeout = ~(0ULL);
749
750#define PANIC_RESTART_TIMEOUT (3ULL * NSEC_PER_SEC)
751
752/*
753 * We should always return from this function with the other log offset
754 * set in the panic_info structure.
755 */
756void
757RecordPanicStackshot()
758{
759 int err = 0, bytes_traced = 0, bytes_used = 0, bytes_remaining = 0;
760 char *stackshot_begin_loc = NULL;
761
762 /* Don't re-enter this code if we panic here */
763 if (begun_panic_stackshot) {
764 if (panic_info->mph_other_log_offset == 0) {
765 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
766 }
767 return;
768 }
769 begun_panic_stackshot = TRUE;
770
771 /* The panic log length should have been set before we came to capture a stackshot */
772 if (panic_info->mph_panic_log_len == 0) {
773 kdb_printf("Found zero length panic log, skipping capturing panic stackshot\n");
774 if (panic_info->mph_other_log_offset == 0) {
775 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
776 }
777 return;
778 }
779
780 /*
781 * Try to capture an in memory panic_stackshot (enabled during boot
782 * on systems with co-processors).
783 */
784 if (extended_debug_log_enabled) {
785 if (stackshot_active()) {
786 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_NESTED;
787 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
788 kdb_printf("Panicked during stackshot, skipping panic stackshot\n");
789 return;
790 } else {
791 stackshot_begin_loc = debug_buf_ptr;
792
793 bytes_remaining = debug_buf_size - (unsigned int)((uintptr_t)stackshot_begin_loc - (uintptr_t)debug_buf_base);
794 err = kcdata_memory_static_init(&kc_panic_data, (mach_vm_address_t)stackshot_begin_loc,
795 KCDATA_BUFFER_BEGIN_STACKSHOT, bytes_remaining, KCFLAG_USE_MEMCOPY);
796 if (err != KERN_SUCCESS) {
797 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR;
798 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
799 kdb_printf("Failed to initialize kcdata buffer for in-memory panic stackshot, skipping ...\n");
800 return;
801 }
802
803 kdp_snapshot_preflight(-1, (void *) stackshot_begin_loc, bytes_remaining,
804 (STACKSHOT_SAVE_KEXT_LOADINFO | STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT |
805 STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING | STACKSHOT_FROM_PANIC |
806 STACKSHOT_NO_IO_STATS | STACKSHOT_THREAD_WAITINFO), &kc_panic_data, 0);
807 err = do_stackshot(NULL);
808 bytes_traced = (int) kdp_stack_snapshot_bytes_traced();
809 bytes_used = (int) kcdata_memory_get_used_bytes(&kc_panic_data);
810
811 if ((err != KERN_SUCCESS) && (bytes_used > 0)) {
812 /*
813 * We ran out of space while trying to capture a stackshot, try again without user frames.
814 * It's not safe to log from here, but append a flag to the panic flags.
815 */
816 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_KERNEL_ONLY;
817 panic_stackshot_reset_state();
818
819 /* Erase the stackshot data (this region is pre-populated with the NULL character) */
820 memset(stackshot_begin_loc, '\0', bytes_used);
821
822 err = kcdata_memory_static_init(&kc_panic_data, (mach_vm_address_t)stackshot_begin_loc,
823 KCDATA_BUFFER_BEGIN_STACKSHOT, bytes_remaining, KCFLAG_USE_MEMCOPY);
824 if (err != KERN_SUCCESS) {
825 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR;
826 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
827 kdb_printf("Failed to re-initialize kcdata buffer for kernel only in-memory panic stackshot, skipping ...\n");
828 return;
829 }
830
831 kdp_snapshot_preflight(-1, (void *) stackshot_begin_loc, bytes_remaining, (STACKSHOT_KCDATA_FORMAT |
832 STACKSHOT_NO_IO_STATS | STACKSHOT_SAVE_KEXT_LOADINFO | STACKSHOT_ACTIVE_KERNEL_THREADS_ONLY |
833 STACKSHOT_FROM_PANIC | STACKSHOT_THREAD_WAITINFO), &kc_panic_data, 0);
834 err = do_stackshot(NULL);
835 bytes_traced = (int) kdp_stack_snapshot_bytes_traced();
836 bytes_used = (int) kcdata_memory_get_used_bytes(&kc_panic_data);
837 }
838
839 if (err == KERN_SUCCESS) {
840 debug_buf_ptr += bytes_traced;
841 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_SUCCEEDED;
842 panic_info->mph_stackshot_offset = PE_get_offset_into_panic_region(stackshot_begin_loc);
843 panic_info->mph_stackshot_len = bytes_traced;
844
845 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
846 kdb_printf("\n** In Memory Panic Stackshot Succeeded ** Bytes Traced %d **\n", bytes_traced);
847 } else {
848 if (bytes_used > 0) {
849 /* Erase the stackshot data (this region is pre-populated with the NULL character) */
850 memset(stackshot_begin_loc, '\0', bytes_used);
851 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_INCOMPLETE;
852
853 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
854 kdb_printf("\n** In Memory Panic Stackshot Incomplete ** Bytes Filled %d ** Err %d\n", bytes_used, err);
855 } else {
856 bzero(stackshot_begin_loc, bytes_used);
857 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_STACKSHOT_FAILED_ERROR;
858
859 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
860 kdb_printf("\n** In Memory Panic Stackshot Failed ** Bytes Traced %d, err %d\n", bytes_traced, err);
861 }
862 }
863 }
864#if DEVELOPMENT || DEBUG
865 if (panic_stackshot_buf != 0) {
866 /* We're going to try to take another stackshot, reset the state. */
867 panic_stackshot_reset_state();
868 }
869#endif /* DEVELOPMENT || DEBUG */
870 } else {
871 panic_info->mph_other_log_offset = PE_get_offset_into_panic_region(debug_buf_ptr);
872 }
873
874#if DEVELOPMENT || DEBUG
875
876 if (panic_stackshot_buf == 0) {
877 kdb_printf("No stackshot buffer allocated for file backed panic stackshot, skipping...\n");
878 return;
879 }
880
881 if (stackshot_active()) {
882 kdb_printf("Panicked during stackshot, skipping file backed panic stackshot\n");
883 return;
884 }
885
886 err = kcdata_memory_static_init(&kc_panic_data, (mach_vm_address_t)panic_stackshot_buf, KCDATA_BUFFER_BEGIN_STACKSHOT,
887 PANIC_STACKSHOT_BUFSIZE, KCFLAG_USE_MEMCOPY);
888 if (err != KERN_SUCCESS) {
889 kdb_printf("Failed to initialize kcdata buffer for file backed panic stackshot, skipping ...\n");
890 return;
891 }
892
893 kdp_snapshot_preflight(-1, (void *) panic_stackshot_buf, PANIC_STACKSHOT_BUFSIZE, (STACKSHOT_GET_GLOBAL_MEM_STATS | STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT |
894 STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING | STACKSHOT_FROM_PANIC | STACKSHOT_NO_IO_STATS
895 | STACKSHOT_THREAD_WAITINFO), &kc_panic_data, 0);
896 err = do_stackshot(NULL);
897 bytes_traced = (int) kdp_stack_snapshot_bytes_traced();
898 if (bytes_traced > 0 && !err) {
899 panic_stackshot_len = bytes_traced;
900 kdb_printf("File backed panic stackshot succeeded, length: %u bytes\n", bytes_traced);
901 } else {
902 bytes_used = (int) kcdata_memory_get_used_bytes(&kc_panic_data);
903 if (bytes_used > 0) {
904 kdb_printf("File backed panic stackshot incomplete, consumed %u bytes, error : %d \n", bytes_used, err);
905 } else {
906 kdb_printf("File backed panic stackshot incomplete, consumed %u bytes, error : %d \n", bytes_used, err);
907 }
908 }
909#endif /* DEVELOPMENT || DEBUG */
910
911 return;
912}
913
914void
915SavePanicInfo(
916 __unused const char *message, void *panic_data, uint64_t panic_options)
917{
918 void *stackptr = NULL;
919 thread_t thread_to_trace = (thread_t) panic_data;
920 cframe_t synthetic_stack_frame = { };
921 char *debugger_msg = NULL;
922 int cn = cpu_number();
923
924 /*
925 * Issue an I/O port read if one has been requested - this is an event logic
926 * analyzers can use as a trigger point.
927 */
928 panic_io_port_read();
929
930 /* Obtain frame pointer for stack to trace */
931 if (panic_options & DEBUGGER_INTERNAL_OPTION_THREAD_BACKTRACE) {
932 if (!mp_kdp_all_cpus_halted()) {
933 debugger_msg = "Backtracing panicked thread because failed to halt all CPUs\n";
934 } else if (thread_to_trace == THREAD_NULL) {
935 debugger_msg = "Backtracing panicked thread because no thread pointer provided\n";
936 } else if (kvtophys((vm_offset_t)thread_to_trace) == 0ULL) {
937 debugger_msg = "Backtracing panicked thread because unable to access specified thread\n";
938 } else if (thread_to_trace->kernel_stack == 0) {
939 debugger_msg = "Backtracing panicked thread because kernel_stack is NULL for specified thread\n";
940 } else if (kvtophys(STACK_IKS(thread_to_trace->kernel_stack) == 0ULL)) {
941 debugger_msg = "Backtracing panicked thread because unable to access kernel_stack for specified thread\n";
942 } else {
943 debugger_msg = "Backtracing specified thread\n";
944 /* We construct a synthetic stack frame so we can include the current instruction pointer */
945 synthetic_stack_frame.prev = (cframe_t *)STACK_IKS(thread_to_trace->kernel_stack)->k_rbp;
946 synthetic_stack_frame.caller = (uintptr_t) STACK_IKS(thread_to_trace->kernel_stack)->k_rip;
947 stackptr = (void *) &synthetic_stack_frame;
948 }
949 }
950
951 if (stackptr == NULL) {
952 __asm__ volatile("movq %%rbp, %0" : "=m" (stackptr));
953 }
954
955 /* Print backtrace - callee is internally synchronized */
956 if (panic_options & DEBUGGER_OPTION_INITPROC_PANIC) {
957 /* Special handling of launchd died panics */
958 print_launchd_info();
959 } else {
960 panic_i386_backtrace(stackptr, ((panic_double_fault_cpu == cn) ? 80: 48), debugger_msg, FALSE, NULL);
961 }
962
963 if (panic_options & DEBUGGER_OPTION_COPROC_INITIATED_PANIC) {
964 panic_info->mph_panic_flags |= MACOS_PANIC_HEADER_FLAG_COPROC_INITIATED_PANIC;
965 }
966
967 if (PE_get_offset_into_panic_region(debug_buf_ptr) < panic_info->mph_panic_log_offset) {
968 kdb_printf("Invalid panic log offset found (not properly initialized?): debug_buf_ptr : 0x%p, panic_info: 0x%p mph_panic_log_offset: 0x%x\n",
969 debug_buf_ptr, panic_info, panic_info->mph_panic_log_offset);
970 panic_info->mph_panic_log_len = 0;
971 } else {
972 panic_info->mph_panic_log_len = PE_get_offset_into_panic_region(debug_buf_ptr) - panic_info->mph_panic_log_offset;
973 }
974
975 /* Flush the panic log */
976 paniclog_flush_internal(kPaniclogFlushBase);
977
978 /* Try to take a panic stackshot */
979 RecordPanicStackshot();
980
981 /*
982 * Flush the panic log again with the stackshot or any relevant logging
983 * from when we tried to capture it.
984 */
985 if (extended_debug_log_enabled) {
986 paniclog_flush_internal(kPaniclogFlushStackshot);
987 }
988}
989
990void paniclog_flush_internal(paniclog_flush_type_t variant)
991{
992 /* Update the other log offset if we've opened the other log */
993 if (panic_info->mph_other_log_offset != 0) {
994 panic_info->mph_other_log_len = PE_get_offset_into_panic_region(debug_buf_ptr) - panic_info->mph_other_log_offset;
995 }
996
997 /*
998 * If we've detected that we're on a co-processor system, we flush the panic log via the kPEPanicSync
999 * panic callbacks, otherwise we flush via nvram (unless that has been disabled).
1000 */
1001 if (coprocessor_paniclog_flush) {
1002 uint32_t overall_buffer_size = debug_buf_size;
1003 uint32_t size_to_flush = 0, offset_to_flush = 0;
1004 if (extended_debug_log_enabled) {
1005 /*
1006 * debug_buf_size for the extended log does not include the length of the header.
1007 * There may be some extra data at the end of the 'basic' log that wouldn't get flushed
1008 * for the non-extended case (this is a concession we make to not shrink the paniclog data
1009 * for non-coprocessor systems that only use the basic log).
1010 */
1011 overall_buffer_size = debug_buf_size + sizeof(struct macos_panic_header);
1012 }
1013
1014 /* Update the CRC */
1015 panic_info->mph_crc = crc32(0L, &panic_info->mph_version, (overall_buffer_size - offsetof(struct macos_panic_header, mph_version)));
1016
1017 if (variant == kPaniclogFlushBase) {
1018 /* Flush the header and base panic log. */
1019 kprintf("Flushing base panic log\n");
1020 size_to_flush = ROUNDUP((panic_info->mph_panic_log_offset + panic_info->mph_panic_log_len), PANIC_FLUSH_BOUNDARY);
1021 offset_to_flush = 0;
1022 PESavePanicInfoAction(panic_info, offset_to_flush, size_to_flush);
1023 } else if ((variant == kPaniclogFlushStackshot) || (variant == kPaniclogFlushOtherLog)) {
1024 if (variant == kPaniclogFlushStackshot) {
1025 /*
1026 * We flush the stackshot before flushing the updated header because the stackshot
1027 * can take a while to flush. We want the paniclog header to be as consistent as possible even
1028 * if the stackshot isn't flushed completely. Flush starting from the end of the panic log.
1029 */
1030 kprintf("Flushing panic log stackshot\n");
1031 offset_to_flush = ROUNDDOWN((panic_info->mph_panic_log_offset + panic_info->mph_panic_log_len), PANIC_FLUSH_BOUNDARY);
1032 size_to_flush = ROUNDUP((panic_info->mph_stackshot_len + (panic_info->mph_stackshot_offset - offset_to_flush)), PANIC_FLUSH_BOUNDARY);
1033 PESavePanicInfoAction(panic_info, offset_to_flush, size_to_flush);
1034 }
1035
1036 /* Flush the other log -- everything after the stackshot */
1037 kprintf("Flushing panic 'other' log\n");
1038 offset_to_flush = ROUNDDOWN((panic_info->mph_stackshot_offset + panic_info->mph_stackshot_len), PANIC_FLUSH_BOUNDARY);
1039 size_to_flush = ROUNDUP((panic_info->mph_other_log_len + (panic_info->mph_other_log_offset - offset_to_flush)), PANIC_FLUSH_BOUNDARY);
1040 PESavePanicInfoAction(panic_info, offset_to_flush, size_to_flush);
1041
1042 /* Flush the header -- everything before the paniclog */
1043 kprintf("Flushing panic log header\n");
1044 size_to_flush = ROUNDUP(panic_info->mph_panic_log_offset, PANIC_FLUSH_BOUNDARY);
1045 offset_to_flush = 0;
1046 PESavePanicInfoAction(panic_info, offset_to_flush, size_to_flush);
1047 }
1048 } else if (commit_paniclog_to_nvram) {
1049 assert(debug_buf_size != 0);
1050 unsigned int bufpos;
1051 unsigned long pi_size = 0;
1052 uintptr_t cr0;
1053
1054 debug_putc(0);
1055
1056 /*
1057 * Now call the compressor
1058 * XXX Consider using the WKdm compressor in the
1059 * future, rather than just packing - would need to
1060 * be co-ordinated with crashreporter, which decodes
1061 * this post-restart. The compressor should be
1062 * capable of in-place compression.
1063 *
1064 * Don't include the macOS panic header (for co-processor systems only)
1065 */
1066 bufpos = packA(debug_buf_base, (unsigned int) (debug_buf_ptr - debug_buf_base),
1067 debug_buf_size);
1068 /*
1069 * If compression was successful, use the compressed length
1070 */
1071 pi_size = bufpos ? bufpos : (unsigned) (debug_buf_ptr - debug_buf_base);
1072
1073 /*
1074 * The following sequence is a workaround for:
1075 * <rdar://problem/5915669> SnowLeopard10A67: AppleEFINVRAM should not invoke
1076 * any routines that use floating point (MMX in this case) when saving panic
1077 * logs to nvram/flash.
1078 */
1079 cr0 = get_cr0();
1080 clear_ts();
1081
1082 /*
1083 * Save panic log to non-volatile store
1084 * Panic info handler must truncate data that is
1085 * too long for this platform.
1086 * This call must save data synchronously,
1087 * since we can subsequently halt the system.
1088 */
1089 kprintf("Attempting to commit panic log to NVRAM\n");
1090 pi_size = PESavePanicInfo((unsigned char *)debug_buf_base,
1091 (uint32_t)pi_size );
1092 set_cr0(cr0);
1093
1094 /*
1095 * Uncompress in-place, to permit examination of
1096 * the panic log by debuggers.
1097 */
1098 if (bufpos) {
1099 unpackA(debug_buf_base, bufpos);
1100 }
1101 }
1102}
1103
1104void
1105paniclog_flush()
1106{
1107 /* Called outside of this file to update logging appended to the "other" log */
1108 paniclog_flush_internal(kPaniclogFlushOtherLog);
1109 return;
1110}
1111
1112char *
1113machine_boot_info(char *buf, __unused vm_size_t size)
1114{
1115 *buf ='\0';
1116 return buf;
1117}
1118
1119/* Routines for address - symbol translation. Not called unless the "keepsyms"
1120 * boot-arg is supplied.
1121 */
1122
1123static int
1124panic_print_macho_symbol_name(kernel_mach_header_t *mh, vm_address_t search, const char *module_name)
1125{
1126 kernel_nlist_t *sym = NULL;
1127 struct load_command *cmd;
1128 kernel_segment_command_t *orig_ts = NULL, *orig_le = NULL;
1129 struct symtab_command *orig_st = NULL;
1130 unsigned int i;
1131 char *strings, *bestsym = NULL;
1132 vm_address_t bestaddr = 0, diff, curdiff;
1133
1134 /* Assume that if it's loaded and linked into the kernel, it's a valid Mach-O */
1135
1136 cmd = (struct load_command *) &mh[1];
1137 for (i = 0; i < mh->ncmds; i++) {
1138 if (cmd->cmd == LC_SEGMENT_KERNEL) {
1139 kernel_segment_command_t *orig_sg = (kernel_segment_command_t *) cmd;
1140
1141 if (strncmp(SEG_TEXT, orig_sg->segname,
1142 sizeof(orig_sg->segname)) == 0)
1143 orig_ts = orig_sg;
1144 else if (strncmp(SEG_LINKEDIT, orig_sg->segname,
1145 sizeof(orig_sg->segname)) == 0)
1146 orig_le = orig_sg;
1147 else if (strncmp("", orig_sg->segname,
1148 sizeof(orig_sg->segname)) == 0)
1149 orig_ts = orig_sg; /* pre-Lion i386 kexts have a single unnamed segment */
1150 }
1151 else if (cmd->cmd == LC_SYMTAB)
1152 orig_st = (struct symtab_command *) cmd;
1153
1154 cmd = (struct load_command *) ((uintptr_t) cmd + cmd->cmdsize);
1155 }
1156
1157 if ((orig_ts == NULL) || (orig_st == NULL) || (orig_le == NULL))
1158 return 0;
1159
1160 if ((search < orig_ts->vmaddr) ||
1161 (search >= orig_ts->vmaddr + orig_ts->vmsize)) {
1162 /* search out of range for this mach header */
1163 return 0;
1164 }
1165
1166 sym = (kernel_nlist_t *)(uintptr_t)(orig_le->vmaddr + orig_st->symoff - orig_le->fileoff);
1167 strings = (char *)(uintptr_t)(orig_le->vmaddr + orig_st->stroff - orig_le->fileoff);
1168 diff = search;
1169
1170 for (i = 0; i < orig_st->nsyms; i++) {
1171 if (sym[i].n_type & N_STAB) continue;
1172
1173 if (sym[i].n_value <= search) {
1174 curdiff = search - (vm_address_t)sym[i].n_value;
1175 if (curdiff < diff) {
1176 diff = curdiff;
1177 bestaddr = sym[i].n_value;
1178 bestsym = strings + sym[i].n_un.n_strx;
1179 }
1180 }
1181 }
1182
1183 if (bestsym != NULL) {
1184 if (diff != 0) {
1185 paniclog_append_noflush("%s : %s + 0x%lx", module_name, bestsym, (unsigned long)diff);
1186 } else {
1187 paniclog_append_noflush("%s : %s", module_name, bestsym);
1188 }
1189 return 1;
1190 }
1191 return 0;
1192}
1193
1194extern kmod_info_t * kmod; /* the list of modules */
1195
1196static void
1197panic_print_kmod_symbol_name(vm_address_t search)
1198{
1199 u_int i;
1200
1201 if (gLoadedKextSummaries == NULL)
1202 return;
1203 for (i = 0; i < gLoadedKextSummaries->numSummaries; ++i) {
1204 OSKextLoadedKextSummary *summary = gLoadedKextSummaries->summaries + i;
1205
1206 if ((search >= summary->address) &&
1207 (search < (summary->address + summary->size)))
1208 {
1209 kernel_mach_header_t *header = (kernel_mach_header_t *)(uintptr_t) summary->address;
1210 if (panic_print_macho_symbol_name(header, search, summary->name) == 0) {
1211 paniclog_append_noflush("%s + %llu", summary->name, (unsigned long)search - summary->address);
1212 }
1213 break;
1214 }
1215 }
1216}
1217
1218void
1219panic_print_symbol_name(vm_address_t search)
1220{
1221 /* try searching in the kernel */
1222 if (panic_print_macho_symbol_name(&_mh_execute_header, search, "mach_kernel") == 0) {
1223 /* that failed, now try to search for the right kext */
1224 panic_print_kmod_symbol_name(search);
1225 }
1226}
1227
1228/* Generate a backtrace, given a frame pointer - this routine
1229 * should walk the stack safely. The trace is appended to the panic log
1230 * and conditionally, to the console. If the trace contains kernel module
1231 * addresses, display the module name, load address and dependencies.
1232 */
1233
1234#define DUMPFRAMES 32
1235#define PBT_TIMEOUT_CYCLES (5 * 1000 * 1000 * 1000ULL)
1236void
1237panic_i386_backtrace(void *_frame, int nframes, const char *msg, boolean_t regdump, x86_saved_state_t *regs)
1238{
1239 cframe_t *frame = (cframe_t *)_frame;
1240 vm_offset_t raddrs[DUMPFRAMES];
1241 vm_offset_t PC = 0;
1242 int frame_index;
1243 volatile uint32_t *ppbtcnt = &pbtcnt;
1244 uint64_t bt_tsc_timeout;
1245 boolean_t keepsyms = FALSE;
1246 int cn = cpu_number();
1247 boolean_t old_doprnt_hide_pointers = doprnt_hide_pointers;
1248
1249 if(pbtcpu != cn) {
1250 hw_atomic_add(&pbtcnt, 1);
1251 /* Spin on print backtrace lock, which serializes output
1252 * Continue anyway if a timeout occurs.
1253 */
1254 hw_lock_to(&pbtlock, ~0U);
1255 pbtcpu = cn;
1256 }
1257
1258 if (__improbable(doprnt_hide_pointers == TRUE)) {
1259 /* If we're called directly, the Debugger() function will not be called,
1260 * so we need to reset the value in here. */
1261 doprnt_hide_pointers = FALSE;
1262 }
1263
1264 panic_check_hook();
1265
1266 PE_parse_boot_argn("keepsyms", &keepsyms, sizeof (keepsyms));
1267
1268 if (msg != NULL) {
1269 paniclog_append_noflush("%s", msg);
1270 }
1271
1272 if ((regdump == TRUE) && (regs != NULL)) {
1273 x86_saved_state64_t *ss64p = saved_state64(regs);
1274 paniclog_append_noflush(
1275 "RAX: 0x%016llx, RBX: 0x%016llx, RCX: 0x%016llx, RDX: 0x%016llx\n"
1276 "RSP: 0x%016llx, RBP: 0x%016llx, RSI: 0x%016llx, RDI: 0x%016llx\n"
1277 "R8: 0x%016llx, R9: 0x%016llx, R10: 0x%016llx, R11: 0x%016llx\n"
1278 "R12: 0x%016llx, R13: 0x%016llx, R14: 0x%016llx, R15: 0x%016llx\n"
1279 "RFL: 0x%016llx, RIP: 0x%016llx, CS: 0x%016llx, SS: 0x%016llx\n",
1280 ss64p->rax, ss64p->rbx, ss64p->rcx, ss64p->rdx,
1281 ss64p->isf.rsp, ss64p->rbp, ss64p->rsi, ss64p->rdi,
1282 ss64p->r8, ss64p->r9, ss64p->r10, ss64p->r11,
1283 ss64p->r12, ss64p->r13, ss64p->r14, ss64p->r15,
1284 ss64p->isf.rflags, ss64p->isf.rip, ss64p->isf.cs,
1285 ss64p->isf.ss);
1286 PC = ss64p->isf.rip;
1287 }
1288
1289 paniclog_append_noflush("Backtrace (CPU %d), "
1290#if PRINT_ARGS_FROM_STACK_FRAME
1291 "Frame : Return Address (4 potential args on stack)\n", cn);
1292#else
1293 "Frame : Return Address\n", cn);
1294#endif
1295
1296 for (frame_index = 0; frame_index < nframes; frame_index++) {
1297 vm_offset_t curframep = (vm_offset_t) frame;
1298
1299 if (!curframep)
1300 break;
1301
1302 if (curframep & 0x3) {
1303 paniclog_append_noflush("Unaligned frame\n");
1304 goto invalid;
1305 }
1306
1307 if (!kvtophys(curframep) ||
1308 !kvtophys(curframep + sizeof(cframe_t) - 1)) {
1309 paniclog_append_noflush("No mapping exists for frame pointer\n");
1310 goto invalid;
1311 }
1312
1313 paniclog_append_noflush("%p : 0x%lx ", frame, frame->caller);
1314 if (frame_index < DUMPFRAMES)
1315 raddrs[frame_index] = frame->caller;
1316
1317#if PRINT_ARGS_FROM_STACK_FRAME
1318 if (kvtophys((vm_offset_t)&(frame->args[3])))
1319 paniclog_append_noflush("(0x%x 0x%x 0x%x 0x%x) ",
1320 frame->args[0], frame->args[1],
1321 frame->args[2], frame->args[3]);
1322#endif
1323
1324 /* Display address-symbol translation only if the "keepsyms"
1325 * boot-arg is suppplied, since we unload LINKEDIT otherwise.
1326 * This routine is potentially unsafe; also, function
1327 * boundary identification is unreliable after a strip -x.
1328 */
1329 if (keepsyms)
1330 panic_print_symbol_name((vm_address_t)frame->caller);
1331
1332 paniclog_append_noflush("\n");
1333
1334 frame = frame->prev;
1335 }
1336
1337 if (frame_index >= nframes)
1338 paniclog_append_noflush("\tBacktrace continues...\n");
1339
1340 goto out;
1341
1342invalid:
1343 paniclog_append_noflush("Backtrace terminated-invalid frame pointer %p\n",frame);
1344out:
1345
1346 /* Identify kernel modules in the backtrace and display their
1347 * load addresses and dependencies. This routine should walk
1348 * the kmod list safely.
1349 */
1350 if (frame_index)
1351 kmod_panic_dump((vm_offset_t *)&raddrs[0], frame_index);
1352
1353 if (PC != 0)
1354 kmod_panic_dump(&PC, 1);
1355
1356 panic_display_system_configuration(FALSE);
1357
1358 doprnt_hide_pointers = old_doprnt_hide_pointers;
1359
1360 /* Release print backtrace lock, to permit other callers in the
1361 * event of panics on multiple processors.
1362 */
1363 hw_lock_unlock(&pbtlock);
1364 hw_atomic_sub(&pbtcnt, 1);
1365 /* Wait for other processors to complete output
1366 * Timeout and continue after PBT_TIMEOUT_CYCLES.
1367 */
1368 bt_tsc_timeout = rdtsc64() + PBT_TIMEOUT_CYCLES;
1369 while(*ppbtcnt && (rdtsc64() < bt_tsc_timeout));
1370}
1371
1372static boolean_t
1373debug_copyin(pmap_t p, uint64_t uaddr, void *dest, size_t size)
1374{
1375 size_t rem = size;
1376 char *kvaddr = dest;
1377
1378 while (rem) {
1379 ppnum_t upn = pmap_find_phys(p, uaddr);
1380 uint64_t phys_src = ptoa_64(upn) | (uaddr & PAGE_MASK);
1381 uint64_t phys_dest = kvtophys((vm_offset_t)kvaddr);
1382 uint64_t src_rem = PAGE_SIZE - (phys_src & PAGE_MASK);
1383 uint64_t dst_rem = PAGE_SIZE - (phys_dest & PAGE_MASK);
1384 size_t cur_size = (uint32_t) MIN(src_rem, dst_rem);
1385 cur_size = MIN(cur_size, rem);
1386
1387 if (upn && pmap_valid_page(upn) && phys_dest) {
1388 bcopy_phys(phys_src, phys_dest, cur_size);
1389 }
1390 else
1391 break;
1392 uaddr += cur_size;
1393 kvaddr += cur_size;
1394 rem -= cur_size;
1395 }
1396 return (rem == 0);
1397}
1398
1399void
1400print_threads_registers(thread_t thread)
1401{
1402 x86_saved_state_t *savestate;
1403
1404 savestate = get_user_regs(thread);
1405 paniclog_append_noflush(
1406 "\nRAX: 0x%016llx, RBX: 0x%016llx, RCX: 0x%016llx, RDX: 0x%016llx\n"
1407 "RSP: 0x%016llx, RBP: 0x%016llx, RSI: 0x%016llx, RDI: 0x%016llx\n"
1408 "R8: 0x%016llx, R9: 0x%016llx, R10: 0x%016llx, R11: 0x%016llx\n"
1409 "R12: 0x%016llx, R13: 0x%016llx, R14: 0x%016llx, R15: 0x%016llx\n"
1410 "RFL: 0x%016llx, RIP: 0x%016llx, CS: 0x%016llx, SS: 0x%016llx\n\n",
1411 savestate->ss_64.rax, savestate->ss_64.rbx, savestate->ss_64.rcx, savestate->ss_64.rdx,
1412 savestate->ss_64.isf.rsp, savestate->ss_64.rbp, savestate->ss_64.rsi, savestate->ss_64.rdi,
1413 savestate->ss_64.r8, savestate->ss_64.r9, savestate->ss_64.r10, savestate->ss_64.r11,
1414 savestate->ss_64.r12, savestate->ss_64.r13, savestate->ss_64.r14, savestate->ss_64.r15,
1415 savestate->ss_64.isf.rflags, savestate->ss_64.isf.rip, savestate->ss_64.isf.cs,
1416 savestate->ss_64.isf.ss);
1417}
1418
1419void
1420print_tasks_user_threads(task_t task)
1421{
1422 thread_t thread = current_thread();
1423 x86_saved_state_t *savestate;
1424 pmap_t pmap = 0;
1425 uint64_t rbp;
1426 const char *cur_marker = 0;
1427 int j;
1428
1429 for (j = 0, thread = (thread_t) queue_first(&task->threads); j < task->thread_count;
1430 ++j, thread = (thread_t) queue_next(&thread->task_threads)) {
1431
1432 paniclog_append_noflush("Thread %d: %p\n", j, thread);
1433 pmap = get_task_pmap(task);
1434 savestate = get_user_regs(thread);
1435 rbp = savestate->ss_64.rbp;
1436 paniclog_append_noflush("\t0x%016llx\n", savestate->ss_64.isf.rip);
1437 print_one_backtrace(pmap, (vm_offset_t)rbp, cur_marker, TRUE);
1438 paniclog_append_noflush("\n");
1439 }
1440}
1441
1442void
1443print_thread_num_that_crashed(task_t task)
1444{
1445 thread_t c_thread = current_thread();
1446 thread_t thread;
1447 int j;
1448
1449 for (j = 0, thread = (thread_t) queue_first(&task->threads); j < task->thread_count;
1450 ++j, thread = (thread_t) queue_next(&thread->task_threads)) {
1451
1452 if (c_thread == thread) {
1453 paniclog_append_noflush("\nThread %d crashed\n", j);
1454 break;
1455 }
1456 }
1457}
1458
1459#define PANICLOG_UUID_BUF_SIZE 256
1460
1461void print_uuid_info(task_t task)
1462{
1463 uint32_t uuid_info_count = 0;
1464 mach_vm_address_t uuid_info_addr = 0;
1465 boolean_t have_map = (task->map != NULL) && (ml_validate_nofault((vm_offset_t)(task->map), sizeof(struct _vm_map)));
1466 boolean_t have_pmap = have_map && (task->map->pmap != NULL) && (ml_validate_nofault((vm_offset_t)(task->map->pmap), sizeof(struct pmap)));
1467 int task_pid = pid_from_task(task);
1468 char uuidbuf[PANICLOG_UUID_BUF_SIZE] = {0};
1469 char *uuidbufptr = uuidbuf;
1470 uint32_t k;
1471
1472 if (have_pmap && task->active && task_pid > 0) {
1473 /* Read dyld_all_image_infos struct from task memory to get UUID array count & location */
1474 struct user64_dyld_all_image_infos task_image_infos;
1475 if (debug_copyin(task->map->pmap, task->all_image_info_addr,
1476 &task_image_infos, sizeof(struct user64_dyld_all_image_infos))) {
1477 uuid_info_count = (uint32_t)task_image_infos.uuidArrayCount;
1478 uuid_info_addr = task_image_infos.uuidArray;
1479 }
1480
1481 /* If we get a NULL uuid_info_addr (which can happen when we catch dyld
1482 * in the middle of updating this data structure), we zero the
1483 * uuid_info_count so that we won't even try to save load info for this task
1484 */
1485 if (!uuid_info_addr) {
1486 uuid_info_count = 0;
1487 }
1488 }
1489
1490 if (task_pid > 0 && uuid_info_count > 0) {
1491 uint32_t uuid_info_size = sizeof(struct user64_dyld_uuid_info);
1492 uint32_t uuid_array_size = uuid_info_count * uuid_info_size;
1493 uint32_t uuid_copy_size = 0;
1494 uint32_t uuid_image_count = 0;
1495 char *current_uuid_buffer = NULL;
1496 /* Copy in the UUID info array. It may be nonresident, in which case just fix up nloadinfos to 0 */
1497
1498 paniclog_append_noflush("\nuuid info:\n");
1499 while (uuid_array_size) {
1500 if (uuid_array_size <= PANICLOG_UUID_BUF_SIZE) {
1501 uuid_copy_size = uuid_array_size;
1502 uuid_image_count = uuid_array_size/uuid_info_size;
1503 } else {
1504 uuid_image_count = PANICLOG_UUID_BUF_SIZE/uuid_info_size;
1505 uuid_copy_size = uuid_image_count * uuid_info_size;
1506 }
1507 if (have_pmap && !debug_copyin(task->map->pmap, uuid_info_addr, uuidbufptr,
1508 uuid_copy_size)) {
1509 paniclog_append_noflush("Error!! Failed to copy UUID info for task %p pid %d\n", task, task_pid);
1510 uuid_image_count = 0;
1511 break;
1512 }
1513
1514 if (uuid_image_count > 0) {
1515 current_uuid_buffer = uuidbufptr;
1516 for (k = 0; k < uuid_image_count; k++) {
1517 paniclog_append_noflush(" %#llx", *(uint64_t *)current_uuid_buffer);
1518 current_uuid_buffer += sizeof(uint64_t);
1519 uint8_t *uuid = (uint8_t *)current_uuid_buffer;
1520 paniclog_append_noflush("\tuuid = <%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x>\n",
1521 uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5], uuid[6], uuid[7], uuid[8],
1522 uuid[9], uuid[10], uuid[11], uuid[12], uuid[13], uuid[14], uuid[15]);
1523 current_uuid_buffer += 16;
1524 }
1525 bzero(&uuidbuf, sizeof(uuidbuf));
1526 }
1527 uuid_info_addr += uuid_copy_size;
1528 uuid_array_size -= uuid_copy_size;
1529 }
1530 }
1531}
1532
1533void print_launchd_info(void)
1534{
1535 task_t task = current_task();
1536 thread_t thread = current_thread();
1537 volatile uint32_t *ppbtcnt = &pbtcnt;
1538 uint64_t bt_tsc_timeout;
1539 int cn = cpu_number();
1540
1541 if(pbtcpu != cn) {
1542 hw_atomic_add(&pbtcnt, 1);
1543 /* Spin on print backtrace lock, which serializes output
1544 * Continue anyway if a timeout occurs.
1545 */
1546 hw_lock_to(&pbtlock, ~0U);
1547 pbtcpu = cn;
1548 }
1549
1550 print_uuid_info(task);
1551 print_thread_num_that_crashed(task);
1552 print_threads_registers(thread);
1553 print_tasks_user_threads(task);
1554
1555 panic_display_system_configuration(TRUE);
1556
1557 /* Release print backtrace lock, to permit other callers in the
1558 * event of panics on multiple processors.
1559 */
1560 hw_lock_unlock(&pbtlock);
1561 hw_atomic_sub(&pbtcnt, 1);
1562 /* Wait for other processors to complete output
1563 * Timeout and continue after PBT_TIMEOUT_CYCLES.
1564 */
1565 bt_tsc_timeout = rdtsc64() + PBT_TIMEOUT_CYCLES;
1566 while(*ppbtcnt && (rdtsc64() < bt_tsc_timeout));
1567
1568}
1569