1 /*
2 * Copyright (c) 2015 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29
30 /*
31 *
32 * THE KCDATA MANIFESTO
33 *
34 * Kcdata is a self-describing data serialization format. It is meant to get
35 * nested data structures out of xnu with minimum fuss, but also for that data
36 * to be easy to parse. It is also meant to allow us to add new fields and
37 * evolve the data format without breaking old parsers.
38 *
39 * Kcdata is a permanent data format suitable for long-term storage including
40 * in files. It is very important that we continue to be able to parse old
41 * versions of kcdata-based formats. To this end, there are several
42 * invariants you MUST MAINTAIN if you alter this file.
43 *
44 * * None of the magic numbers should ever be a byteswap of themselves or
45 * of any of the other magic numbers.
46 *
47 * * Never remove any type.
48 *
49 * * All kcdata structs must be packed, and must exclusively use fixed-size
50 * types.
51 *
52 * * Never change the definition of any type, except to add new fields to
53 * the end.
54 *
55 * * If you do add new fields to the end of a type, do not actually change
56 * the definition of the old structure. Instead, define a new structure
57 * with the new fields. See thread_snapshot_v3 as an example. This
58 * provides source compatibility for old readers, and also documents where
59 * the potential size cutoffs are.
60 *
61 * * If you change libkdd, or kcdata.py run the unit tests under libkdd.
62 *
63 * * If you add a type or extend an existing one, add a sample test to
64 * libkdd/tests so future changes to libkdd will always parse your struct
65 * correctly.
66 *
67 * For example to add a field to this:
68 *
69 * struct foobar {
70 * uint32_t baz;
71 * uint32_t quux;
72 * } __attribute__ ((packed));
73 *
74 * Define an evolved structure alongside it like this:
75 *
76 * struct foobar_v2 {
77 * uint32_t baz;
78 * uint32_t quux;
79 * ///////// This is where the original structure's layout ended! sizeof(struct foobar) was 8 ////////
80 * uint32_t frozzle;
81 * } __attribute__ ((packed));
82 *
83 * If you are parsing kcdata formats, you MUST
84 *
85 * * Check the length field of each struct, including array elements. If the
86 * struct is longer than you expect, you must ignore the extra data.
87 *
88 * * Ignore any data types you do not understand.
89 *
90 * Additionally, we want to be as forward compatible as we can. Meaning old
91 * tools should still be able to use new data whenever possible. To this end,
92 * you should:
93 *
94 * * Try not to add new versions of types that supplant old ones. Instead
95 * extend the length of existing types or add supplemental types.
96 *
97 * * Try not to remove information from existing kcdata formats, unless
98 * removal was explicitly asked for. For example it is fine to add a
99 * stackshot flag to remove unwanted information, but you should not
100 * remove it from the default stackshot if the new flag is absent.
101 *
102 * * (TBD) If you do break old readers by removing information or
103 * supplanting old structs, then increase the major version number.
104 *
105 *
106 *
107 * The following is a description of the kcdata format.
108 *
109 *
110 * The format for data is setup in a generic format as follows
111 *
112 * Layout of data structure:
113 *
114 * | 8 - bytes |
115 * | type = MAGIC | LENGTH |
116 * | 0 |
117 * | type | size |
118 * | flags |
119 * | data |
120 * |___________data____________|
121 * | type | size |
122 * | flags |
123 * |___________data____________|
124 * | type = END | size=0 |
125 * | 0 |
126 *
127 *
128 * The type field describes what kind of data is passed. For example type = TASK_CRASHINFO_UUID means the following data is a uuid.
129 * These types need to be defined in task_corpse.h for easy consumption by userspace inspection tools.
130 *
131 * Some range of types is reserved for special types like ints, longs etc. A cool new functionality made possible with this
132 * extensible data format is that kernel can decide to put more information as required without requiring user space tools to
133 * re-compile to be compatible. The case of rusage struct versions could be introduced without breaking existing tools.
134 *
135 * Feature description: Generic data with description
136 * -------------------
137 * Further more generic data with description is very much possible now. For example
138 *
139 * - kcdata_add_uint64_with_description(cdatainfo, 0x700, "NUM MACH PORTS");
140 * - and more functions that allow adding description.
141 * The userspace tools can then look at the description and print the data even if they are not compiled with knowledge of the field apriori.
142 *
143 * Example data:
144 * 0000 57 f1 ad de 00 00 00 00 00 00 00 00 00 00 00 00 W...............
145 * 0010 01 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 ........0.......
146 * 0020 50 49 44 00 00 00 00 00 00 00 00 00 00 00 00 00 PID.............
147 * 0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
148 * 0040 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
149 * 0050 01 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 ........0.......
150 * 0060 50 41 52 45 4e 54 20 50 49 44 00 00 00 00 00 00 PARENT PID......
151 * 0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
152 * 0080 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
153 * 0090 ed 58 91 f1
154 *
155 * Feature description: Container markers for compound data
156 * ------------------
157 * If a given kernel data type is complex and requires adding multiple optional fields inside a container
158 * object for a consumer to understand arbitrary data, we package it using container markers.
159 *
160 * For example, the stackshot code gathers information and describes the state of a given task with respect
161 * to many subsystems. It includes data such as io stats, vm counters, process names/flags and syscall counts.
162 *
163 * kcdata_add_container_marker(kcdata_p, KCDATA_TYPE_CONTAINER_BEGIN, STACKSHOT_KCCONTAINER_TASK, task_uniqueid);
164 * // add multiple data, or add_<type>_with_description()s here
165 *
166 * kcdata_add_container_marker(kcdata_p, KCDATA_TYPE_CONTAINER_END, STACKSHOT_KCCONTAINER_TASK, task_uniqueid);
167 *
168 * Feature description: Custom Data formats on demand
169 * --------------------
170 * With the self describing nature of format, the kernel provider can describe a data type (uniquely identified by a number) and use
171 * it in the buffer for sending data. The consumer can parse the type information and have knowledge of describing incoming data.
172 * Following is an example of how we can describe a kernel specific struct sample_disk_io_stats in buffer.
173 *
174 * struct sample_disk_io_stats {
175 * uint64_t disk_reads_count;
176 * uint64_t disk_reads_size;
177 * uint64_t io_priority_count[4];
178 * uint64_t io_priority_size;
179 * } __attribute__ ((packed));
180 *
181 *
182 * struct kcdata_subtype_descriptor disk_io_stats_def[] = {
183 * {KCS_SUBTYPE_FLAGS_NONE, KC_ST_UINT64, 0 * sizeof(uint64_t), sizeof(uint64_t), "disk_reads_count"},
184 * {KCS_SUBTYPE_FLAGS_NONE, KC_ST_UINT64, 1 * sizeof(uint64_t), sizeof(uint64_t), "disk_reads_size"},
185 * {KCS_SUBTYPE_FLAGS_ARRAY, KC_ST_UINT64, 2 * sizeof(uint64_t), KCS_SUBTYPE_PACK_SIZE(4, sizeof(uint64_t)), "io_priority_count"},
186 * {KCS_SUBTYPE_FLAGS_ARRAY, KC_ST_UINT64, (2 + 4) * sizeof(uint64_t), sizeof(uint64_t), "io_priority_size"},
187 * };
188 *
189 * Now you can add this custom type definition into the buffer as
190 * kcdata_add_type_definition(kcdata_p, KCTYPE_SAMPLE_DISK_IO_STATS, "sample_disk_io_stats",
191 * &disk_io_stats_def[0], sizeof(disk_io_stats_def)/sizeof(struct kcdata_subtype_descriptor));
192 *
193 * Feature description: Compression
194 * --------------------
195 * In order to avoid keeping large amounts of memory reserved for a panic stackshot, kcdata has support
196 * for compressing the buffer in a streaming fashion. New data pushed to the kcdata buffer will be
197 * automatically compressed using an algorithm selected by the API user (currently, we only support
198 * pass-through and zlib, in the future we plan to add WKDM support, see: 57913859).
199 *
200 * To start using compression, call:
201 * kcdata_init_compress(kcdata_p, hdr_tag, memcpy_f, comp_type);
202 * where:
203 * `kcdata_p` is the kcdata buffer that will be used
204 * `hdr_tag` is the usual header tag denoting what type of kcdata buffer this will be
205 * `memcpy_f` a memcpy(3) function to use to copy into the buffer, optional.
206 * `compy_type` is the compression type, see KCDCT_ZLIB for an example.
207 *
208 * Once compression is initialized:
209 * (1) all self-describing APIs will automatically compress
210 * (2) you can now use the following APIs to compress data into the buffer:
211 * (None of the following will compress unless kcdata_init_compress() has been called)
212 *
213 * - kcdata_push_data(kcdata_descriptor_t data, uint32_t type, uint32_t size, const void *input_data)
214 * Pushes the buffer of kctype @type at[@input_data, @input_data + @size]
215 * into the kcdata buffer @data, compressing if needed.
216 *
217 * - kcdata_push_array(kcdata_descriptor_t data, uint32_t type_of_element,
218 * uint32_t size_of_element, uint32_t count, const void *input_data)
219 * Pushes the array found at @input_data, with element type @type_of_element, where
220 * each element is of size @size_of_element and there are @count elements into the kcdata buffer
221 * at @data.
222 *
223 * - kcdata_compression_window_open/close(kcdata_descriptor_t data)
224 * In case the data you are trying to push to the kcdata buffer @data is difficult to predict,
225 * you can open a "compression window". Between an open and a close, no compression will be done.
226 * Once you close the window, the underlying compression algorithm will compress the data into the buffer
227 * and automatically rewind the current end marker of the kcdata buffer.
228 * There is an ASCII art in kern_cdata.c to aid the reader in understanding
229 * this.
230 *
231 * - kcdata_finish_compression(kcdata_descriptor_t data)
232 * Must be called at the end to flush any underlying buffers used by the compression algorithms.
233 * This function will also add some statistics about the compression to the buffer which helps with
234 * decompressing later.
235 *
236 */
237
238
239 #ifndef _KCDATA_H_
240 #define _KCDATA_H_
241
242 #include <stdint.h>
243 #include <string.h>
244 #include <uuid/uuid.h>
245
246
247
248 #define KCDATA_DESC_MAXLEN 32 /* including NULL byte at end */
249
250 #define KCDATA_FLAGS_STRUCT_PADDING_MASK 0xf
251 #define KCDATA_FLAGS_STRUCT_HAS_PADDING 0x80
252
253 /*
254 * kcdata aligns elements to 16 byte boundaries.
255 */
256 #define KCDATA_ALIGNMENT_SIZE 0x10
257
258 struct kcdata_item {
259 uint32_t type;
260 uint32_t size; /* len(data) */
261 /* flags.
262 *
263 * For structures:
264 * padding = flags & 0xf
265 * has_padding = (flags & 0x80) >> 7
266 *
267 * has_padding is needed to disambiguate cases such as
268 * thread_snapshot_v2 and thread_snapshot_v3. Their
269 * respective sizes are 0x68 and 0x70, and thread_snapshot_v2
270 * was emitted by old kernels *before* we started recording
271 * padding. Since legacy thread_snapsht_v2 and modern
272 * thread_snapshot_v3 will both record 0 for the padding
273 * flags, we need some other bit which will be nonzero in the
274 * flags to disambiguate.
275 *
276 * This is why we hardcode a special case for
277 * STACKSHOT_KCTYPE_THREAD_SNAPSHOT into the iterator
278 * functions below. There is only a finite number of such
279 * hardcodings which will ever be needed. They can occur
280 * when:
281 *
282 * * We have a legacy structure that predates padding flags
283 *
284 * * which we want to extend without changing the kcdata type
285 *
286 * * by only so many bytes as would fit in the space that
287 * was previously unused padding.
288 *
289 * For containers:
290 * container_id = flags
291 *
292 * For arrays:
293 * element_count = flags & UINT32_MAX
294 * element_type = (flags >> 32) & UINT32_MAX
295 */
296 uint64_t flags;
297 char data[]; /* must be at the end */
298 };
299
300 typedef struct kcdata_item * kcdata_item_t;
301
302 enum KCDATA_SUBTYPE_TYPES { KC_ST_CHAR = 1, KC_ST_INT8, KC_ST_UINT8, KC_ST_INT16, KC_ST_UINT16, KC_ST_INT32, KC_ST_UINT32, KC_ST_INT64, KC_ST_UINT64 };
303 typedef enum KCDATA_SUBTYPE_TYPES kctype_subtype_t;
304
305 /*
306 * A subtype description structure that defines
307 * how a compound data is laid out in memory. This
308 * provides on the fly definition of types and consumption
309 * by the parser.
310 */
311 struct kcdata_subtype_descriptor {
312 uint8_t kcs_flags;
313 #define KCS_SUBTYPE_FLAGS_NONE 0x0
314 #define KCS_SUBTYPE_FLAGS_ARRAY 0x1
315 /* Force struct type even if only one element.
316 *
317 * Normally a kcdata_type_definition is treated as a structure if it has
318 * more than one subtype descriptor. Otherwise it is treated as a simple
319 * type. For example libkdd will represent a simple integer 42 as simply
320 * 42, but it will represent a structure containing an integer 42 as
321 * {"field_name": 42}..
322 *
323 * If a kcdata_type_definition has only single subtype, then it will be
324 * treated as a structure iff KCS_SUBTYPE_FLAGS_STRUCT is set. If it has
325 * multiple subtypes, it will always be treated as a structure.
326 *
327 * KCS_SUBTYPE_FLAGS_MERGE has the opposite effect. If this flag is used then
328 * even if there are multiple elements, they will all be treated as individual
329 * properties of the parent dictionary.
330 */
331 #define KCS_SUBTYPE_FLAGS_STRUCT 0x2 /* force struct type even if only one element */
332 #define KCS_SUBTYPE_FLAGS_MERGE 0x4 /* treat as multiple elements of parents instead of struct */
333 uint8_t kcs_elem_type; /* restricted to kctype_subtype_t */
334 uint16_t kcs_elem_offset; /* offset in struct where data is found */
335 uint32_t kcs_elem_size; /* size of element (or) packed state for array type */
336 char kcs_name[KCDATA_DESC_MAXLEN]; /* max 31 bytes for name of field */
337 };
338
339 typedef struct kcdata_subtype_descriptor * kcdata_subtype_descriptor_t;
340
341 /*
342 * In case of array of basic c types in kctype_subtype_t,
343 * size is packed in lower 16 bits and
344 * count is packed in upper 16 bits of kcs_elem_size field.
345 */
346 #define KCS_SUBTYPE_PACK_SIZE(e_count, e_size) (((e_count)&0xffffu) << 16 | ((e_size)&0xffffu))
347
348 static inline uint32_t
kcs_get_elem_size(kcdata_subtype_descriptor_t d)349 kcs_get_elem_size(kcdata_subtype_descriptor_t d)
350 {
351 if (d->kcs_flags & KCS_SUBTYPE_FLAGS_ARRAY) {
352 /* size is composed as ((count &0xffff)<<16 | (elem_size & 0xffff)) */
353 return (uint32_t)((d->kcs_elem_size & 0xffff) * ((d->kcs_elem_size & 0xffff0000) >> 16));
354 }
355 return d->kcs_elem_size;
356 }
357
358 static inline uint32_t
kcs_get_elem_count(kcdata_subtype_descriptor_t d)359 kcs_get_elem_count(kcdata_subtype_descriptor_t d)
360 {
361 if (d->kcs_flags & KCS_SUBTYPE_FLAGS_ARRAY) {
362 return (d->kcs_elem_size >> 16) & 0xffff;
363 }
364 return 1;
365 }
366
367 static inline int
kcs_set_elem_size(kcdata_subtype_descriptor_t d,uint32_t size,uint32_t count)368 kcs_set_elem_size(kcdata_subtype_descriptor_t d, uint32_t size, uint32_t count)
369 {
370 if (count > 1) {
371 /* means we are setting up an array */
372 if (size > 0xffff || count > 0xffff) {
373 return -1; //invalid argument
374 }
375 d->kcs_elem_size = ((count & 0xffff) << 16 | (size & 0xffff));
376 } else {
377 d->kcs_elem_size = size;
378 }
379 return 0;
380 }
381
382 struct kcdata_type_definition {
383 uint32_t kct_type_identifier;
384 uint32_t kct_num_elements;
385 char kct_name[KCDATA_DESC_MAXLEN];
386 struct kcdata_subtype_descriptor kct_elements[];
387 };
388
389
390 /* chunk type definitions. 0 - 0x7ff are reserved and defined here
391 * NOTE: Please update kcdata/libkdd/kcdtypes.c if you make any changes
392 * in STACKSHOT_KCTYPE_* types.
393 */
394
395 /*
396 * Types with description value.
397 * these will have KCDATA_DESC_MAXLEN-1 length string description
398 * and rest of kcdata_iter_size() - KCDATA_DESC_MAXLEN bytes as data
399 */
400 #define KCDATA_TYPE_INVALID 0x0u
401 #define KCDATA_TYPE_STRING_DESC 0x1u
402 #define KCDATA_TYPE_UINT32_DESC 0x2u
403 #define KCDATA_TYPE_UINT64_DESC 0x3u
404 #define KCDATA_TYPE_INT32_DESC 0x4u
405 #define KCDATA_TYPE_INT64_DESC 0x5u
406 #define KCDATA_TYPE_BINDATA_DESC 0x6u
407
408 /*
409 * Compound type definitions
410 */
411 #define KCDATA_TYPE_ARRAY 0x11u /* Array of data OBSOLETE DONT USE THIS*/
412 #define KCDATA_TYPE_TYPEDEFINTION 0x12u /* Meta type that describes a type on the fly. */
413 #define KCDATA_TYPE_CONTAINER_BEGIN \
414 0x13u /* Container type which has corresponding CONTAINER_END header. \
415 * KCDATA_TYPE_CONTAINER_BEGIN has type in the data segment. \
416 * Both headers have (uint64_t) ID for matching up nested data. \
417 */
418 #define KCDATA_TYPE_CONTAINER_END 0x14u
419
420 #define KCDATA_TYPE_ARRAY_PAD0 0x20u /* Array of data with 0 byte of padding*/
421 #define KCDATA_TYPE_ARRAY_PAD1 0x21u /* Array of data with 1 byte of padding*/
422 #define KCDATA_TYPE_ARRAY_PAD2 0x22u /* Array of data with 2 byte of padding*/
423 #define KCDATA_TYPE_ARRAY_PAD3 0x23u /* Array of data with 3 byte of padding*/
424 #define KCDATA_TYPE_ARRAY_PAD4 0x24u /* Array of data with 4 byte of padding*/
425 #define KCDATA_TYPE_ARRAY_PAD5 0x25u /* Array of data with 5 byte of padding*/
426 #define KCDATA_TYPE_ARRAY_PAD6 0x26u /* Array of data with 6 byte of padding*/
427 #define KCDATA_TYPE_ARRAY_PAD7 0x27u /* Array of data with 7 byte of padding*/
428 #define KCDATA_TYPE_ARRAY_PAD8 0x28u /* Array of data with 8 byte of padding*/
429 #define KCDATA_TYPE_ARRAY_PAD9 0x29u /* Array of data with 9 byte of padding*/
430 #define KCDATA_TYPE_ARRAY_PADa 0x2au /* Array of data with a byte of padding*/
431 #define KCDATA_TYPE_ARRAY_PADb 0x2bu /* Array of data with b byte of padding*/
432 #define KCDATA_TYPE_ARRAY_PADc 0x2cu /* Array of data with c byte of padding*/
433 #define KCDATA_TYPE_ARRAY_PADd 0x2du /* Array of data with d byte of padding*/
434 #define KCDATA_TYPE_ARRAY_PADe 0x2eu /* Array of data with e byte of padding*/
435 #define KCDATA_TYPE_ARRAY_PADf 0x2fu /* Array of data with f byte of padding*/
436
437 /*
438 * Generic data types that are most commonly used
439 */
440 #define KCDATA_TYPE_LIBRARY_LOADINFO 0x30u /* struct dyld_uuid_info_32 */
441 #define KCDATA_TYPE_LIBRARY_LOADINFO64 0x31u /* struct dyld_uuid_info_64 */
442 #define KCDATA_TYPE_TIMEBASE 0x32u /* struct mach_timebase_info */
443 #define KCDATA_TYPE_MACH_ABSOLUTE_TIME 0x33u /* uint64_t */
444 #define KCDATA_TYPE_TIMEVAL 0x34u /* struct timeval64 */
445 #define KCDATA_TYPE_USECS_SINCE_EPOCH 0x35u /* time in usecs uint64_t */
446 #define KCDATA_TYPE_PID 0x36u /* int32_t */
447 #define KCDATA_TYPE_PROCNAME 0x37u /* char * */
448 #define KCDATA_TYPE_NESTED_KCDATA 0x38u /* nested kcdata buffer */
449 #define KCDATA_TYPE_LIBRARY_AOTINFO 0x39u /* struct user64_dyld_aot_info */
450
451 #define KCDATA_TYPE_BUFFER_END 0xF19158EDu
452
453 /* MAGIC numbers defined for each class of chunked data
454 *
455 * To future-proof against big-endian arches, make sure none of these magic
456 * numbers are byteswaps of each other
457 */
458
459 #define KCDATA_BUFFER_BEGIN_CRASHINFO 0xDEADF157u /* owner: corpses/task_corpse.h */
460 /* type-range: 0x800 - 0x8ff */
461 #define KCDATA_BUFFER_BEGIN_STACKSHOT 0x59a25807u /* owner: sys/stackshot.h */
462 /* type-range: 0x900 - 0x93f */
463 #define KCDATA_BUFFER_BEGIN_COMPRESSED 0x434f4d50u /* owner: sys/stackshot.h */
464 /* type-range: 0x900 - 0x93f */
465 #define KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT 0xDE17A59Au /* owner: sys/stackshot.h */
466 /* type-range: 0x940 - 0x9ff */
467 #define KCDATA_BUFFER_BEGIN_BTINFO 0x46414E47u /* owner: kern/kern_exit.c */
468 /* type-range: 0xa01 - 0xaff */
469 #define KCDATA_BUFFER_BEGIN_OS_REASON 0x53A20900u /* owner: sys/reason.h */
470 /* type-range: 0x1000-0x103f */
471 #define KCDATA_BUFFER_BEGIN_XNUPOST_CONFIG 0x1e21c09fu /* owner: osfmk/tests/kernel_tests.c */
472 /* type-range: 0x1040-0x105f */
473
474 /* next type range number available 0x1060 */
475 /**************** definitions for XNUPOST *********************/
476 #define XNUPOST_KCTYPE_TESTCONFIG 0x1040
477
478 /**************** definitions for stackshot *********************/
479
480 /* This value must always match IO_NUM_PRIORITIES defined in thread_info.h */
481 #define STACKSHOT_IO_NUM_PRIORITIES 4
482 /* This value must always match MAXTHREADNAMESIZE used in bsd */
483 #define STACKSHOT_MAX_THREAD_NAME_SIZE 64
484
485 /*
486 * NOTE: Please update kcdata/libkdd/kcdtypes.c if you make any changes
487 * in STACKSHOT_KCTYPE_* types.
488 */
489 #define STACKSHOT_KCTYPE_IOSTATS 0x901u /* io_stats_snapshot */
490 #define STACKSHOT_KCTYPE_GLOBAL_MEM_STATS 0x902u /* struct mem_and_io_snapshot */
491 #define STACKSHOT_KCCONTAINER_TASK 0x903u
492 #define STACKSHOT_KCCONTAINER_THREAD 0x904u
493 #define STACKSHOT_KCTYPE_TASK_SNAPSHOT 0x905u /* task_snapshot_v2 */
494 #define STACKSHOT_KCTYPE_THREAD_SNAPSHOT 0x906u /* thread_snapshot_v2, thread_snapshot_v3 */
495 #define STACKSHOT_KCTYPE_DONATING_PIDS 0x907u /* int[] */
496 #define STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO 0x908u /* dyld_shared_cache_loadinfo */
497 #define STACKSHOT_KCTYPE_THREAD_NAME 0x909u /* char[] */
498 #define STACKSHOT_KCTYPE_KERN_STACKFRAME 0x90Au /* struct stack_snapshot_frame32 */
499 #define STACKSHOT_KCTYPE_KERN_STACKFRAME64 0x90Bu /* struct stack_snapshot_frame64 */
500 #define STACKSHOT_KCTYPE_USER_STACKFRAME 0x90Cu /* struct stack_snapshot_frame32 */
501 #define STACKSHOT_KCTYPE_USER_STACKFRAME64 0x90Du /* struct stack_snapshot_frame64 */
502 #define STACKSHOT_KCTYPE_BOOTARGS 0x90Eu /* boot args string */
503 #define STACKSHOT_KCTYPE_OSVERSION 0x90Fu /* os version string, same as running uname -a */
504 #define STACKSHOT_KCTYPE_KERN_PAGE_SIZE 0x910u /* kernel page size in uint32_t */
505 #define STACKSHOT_KCTYPE_JETSAM_LEVEL 0x911u /* jetsam level in uint32_t */
506 #define STACKSHOT_KCTYPE_DELTA_SINCE_TIMESTAMP 0x912u /* timestamp used for the delta stackshot */
507 #define STACKSHOT_KCTYPE_KERN_STACKLR 0x913u /* uint32_t */
508 #define STACKSHOT_KCTYPE_KERN_STACKLR64 0x914u /* uint64_t */
509 #define STACKSHOT_KCTYPE_USER_STACKLR 0x915u /* uint32_t */
510 #define STACKSHOT_KCTYPE_USER_STACKLR64 0x916u /* uint64_t */
511 #define STACKSHOT_KCTYPE_NONRUNNABLE_TIDS 0x917u /* uint64_t */
512 #define STACKSHOT_KCTYPE_NONRUNNABLE_TASKS 0x918u /* uint64_t */
513 #define STACKSHOT_KCTYPE_CPU_TIMES 0x919u /* struct stackshot_cpu_times or stackshot_cpu_times_v2 */
514 #define STACKSHOT_KCTYPE_STACKSHOT_DURATION 0x91au /* struct stackshot_duration */
515 #define STACKSHOT_KCTYPE_STACKSHOT_FAULT_STATS 0x91bu /* struct stackshot_fault_stats */
516 #define STACKSHOT_KCTYPE_KERNELCACHE_LOADINFO 0x91cu /* kernelcache UUID -- same as KCDATA_TYPE_LIBRARY_LOADINFO64 */
517 #define STACKSHOT_KCTYPE_THREAD_WAITINFO 0x91du /* struct stackshot_thread_waitinfo */
518 #define STACKSHOT_KCTYPE_THREAD_GROUP_SNAPSHOT 0x91eu /* struct thread_group_snapshot{,_v2,_v3} */
519 #define STACKSHOT_KCTYPE_THREAD_GROUP 0x91fu /* uint64_t */
520 #define STACKSHOT_KCTYPE_JETSAM_COALITION_SNAPSHOT 0x920u /* struct jetsam_coalition_snapshot */
521 #define STACKSHOT_KCTYPE_JETSAM_COALITION 0x921u /* uint64_t */
522 #define STACKSHOT_KCTYPE_THREAD_POLICY_VERSION 0x922u /* THREAD_POLICY_INTERNAL_STRUCT_VERSION in uint32 */
523 #define STACKSHOT_KCTYPE_INSTRS_CYCLES 0x923u /* struct instrs_cycles_snapshot_v2 */
524 #define STACKSHOT_KCTYPE_USER_STACKTOP 0x924u /* struct stack_snapshot_stacktop */
525 #define STACKSHOT_KCTYPE_ASID 0x925u /* uint32_t */
526 #define STACKSHOT_KCTYPE_PAGE_TABLES 0x926u /* uint64_t */
527 #define STACKSHOT_KCTYPE_SYS_SHAREDCACHE_LAYOUT 0x927u /* same as KCDATA_TYPE_LIBRARY_LOADINFO64 */
528 #define STACKSHOT_KCTYPE_THREAD_DISPATCH_QUEUE_LABEL 0x928u /* dispatch queue label */
529 #define STACKSHOT_KCTYPE_THREAD_TURNSTILEINFO 0x929u /* struct stackshot_thread_turnstileinfo */
530 #define STACKSHOT_KCTYPE_TASK_CPU_ARCHITECTURE 0x92au /* struct stackshot_cpu_architecture */
531 #define STACKSHOT_KCTYPE_LATENCY_INFO 0x92bu /* struct stackshot_latency_collection_v2 */
532 #define STACKSHOT_KCTYPE_LATENCY_INFO_TASK 0x92cu /* struct stackshot_latency_task */
533 #define STACKSHOT_KCTYPE_LATENCY_INFO_THREAD 0x92du /* struct stackshot_latency_thread */
534 #define STACKSHOT_KCTYPE_LOADINFO64_TEXT_EXEC 0x92eu /* TEXT_EXEC load info -- same as KCDATA_TYPE_LIBRARY_LOADINFO64 */
535 #define STACKSHOT_KCTYPE_AOTCACHE_LOADINFO 0x92fu /* struct dyld_aot_cache_uuid_info */
536 #define STACKSHOT_KCTYPE_TRANSITIONING_TASK_SNAPSHOT 0x930u /* transitioning_task_snapshot */
537 #define STACKSHOT_KCCONTAINER_TRANSITIONING_TASK 0x931u
538 #define STACKSHOT_KCTYPE_USER_ASYNC_START_INDEX 0x932u /* uint32_t index in user_stack of beginning of async stack */
539 #define STACKSHOT_KCTYPE_USER_ASYNC_STACKLR64 0x933u /* uint64_t async stack pointers */
540 #define STACKSHOT_KCCONTAINER_PORTLABEL 0x934u /* container for port label info */
541 #define STACKSHOT_KCTYPE_PORTLABEL 0x935u /* struct stackshot_portlabel */
542 #define STACKSHOT_KCTYPE_PORTLABEL_NAME 0x936u /* string port name */
543 #define STACKSHOT_KCTYPE_DYLD_COMPACTINFO 0x937u /* binary blob of dyld info (variable size) */
544 #define STACKSHOT_KCTYPE_SUSPENSION_INFO 0x938u /* struct stackshot_suspension_info */
545 #define STACKSHOT_KCTYPE_SUSPENSION_SOURCE 0x939u /* struct stackshot_suspension_source */
546
547 #define STACKSHOT_KCTYPE_TASK_DELTA_SNAPSHOT 0x940u /* task_delta_snapshot_v2 */
548 #define STACKSHOT_KCTYPE_THREAD_DELTA_SNAPSHOT 0x941u /* thread_delta_snapshot_v* */
549 #define STACKSHOT_KCCONTAINER_SHAREDCACHE 0x942u /* container for shared cache info */
550 #define STACKSHOT_KCTYPE_SHAREDCACHE_INFO 0x943u /* dyld_shared_cache_loadinfo_v2 */
551 #define STACKSHOT_KCTYPE_SHAREDCACHE_AOTINFO 0x944u /* struct dyld_aot_cache_uuid_info */
552 #define STACKSHOT_KCTYPE_SHAREDCACHE_ID 0x945u /* uint32_t in task: if we aren't attached to Primary, which one */
553 #define STACKSHOT_KCTYPE_CODESIGNING_INFO 0x946u /* struct stackshot_task_codesigning_info */
554 #define STACKSHOT_KCTYPE_OS_BUILD_VERSION 0x947u /* os build version string (ex: 20A123) */
555 #define STACKSHOT_KCTYPE_KERN_EXCLAVES_THREADINFO 0x948u /* struct thread_exclaves_info */
556 #define STACKSHOT_KCCONTAINER_EXCLAVES 0x949u /* exclave threads info */
557 #define STACKSHOT_KCCONTAINER_EXCLAVE_SCRESULT 0x94au /* exclave thread container for one scid */
558 #define STACKSHOT_KCTYPE_EXCLAVE_SCRESULT_INFO 0x94bu /* struct exclave_scresult_info */
559 #define STACKSHOT_KCCONTAINER_EXCLAVE_IPCSTACKENTRY 0x94cu /* container for one chunk of exclave IPC chain */
560 #define STACKSHOT_KCTYPE_EXCLAVE_IPCSTACKENTRY_INFO 0x94du /* struct exclave_ipcstackentry_info */
561 #define STACKSHOT_KCTYPE_EXCLAVE_IPCSTACKENTRY_ECSTACK 0x94eu /* exclave_ecstackentry_addr_t */
562 #define STACKSHOT_KCCONTAINER_EXCLAVE_ADDRESSSPACE 0x94fu /* exclave address space container */
563 #define STACKSHOT_KCTYPE_EXCLAVE_ADDRESSSPACE_INFO 0x950u /* struct exclave_addressspace_info */
564 #define STACKSHOT_KCTYPE_EXCLAVE_ADDRESSSPACE_NAME 0x951u /* exclave component name */
565 #define STACKSHOT_KCCONTAINER_EXCLAVE_TEXTLAYOUT 0x952u /* exclave text layout container */
566 #define STACKSHOT_KCTYPE_EXCLAVE_TEXTLAYOUT_INFO 0x953u /* struct exclave_textlayout_info */
567 #define STACKSHOT_KCTYPE_EXCLAVE_TEXTLAYOUT_SEGMENTS 0x954u /* struct exclave_textlayout_segment_v2 */
568 #define STACKSHOT_KCTYPE_KERN_EXCLAVES_CRASH_THREADINFO 0x955u /* struct thread_crash_exclaves_info */
569 #define STACKSHOT_KCTYPE_LATENCY_INFO_CPU 0x956u /* struct stackshot_latency_cpu */
570 #define STACKSHOT_KCTYPE_TASK_EXEC_META 0x957u /* struct task_exec_meta */
571
572
573 struct stack_snapshot_frame32 {
574 uint32_t lr;
575 uint32_t sp;
576 };
577
578 struct stack_snapshot_frame64 {
579 uint64_t lr;
580 uint64_t sp;
581 };
582
583 struct dyld_uuid_info_32 {
584 uint32_t imageLoadAddress; /* base address image is mapped at */
585 uuid_t imageUUID;
586 };
587
588 struct dyld_uuid_info_64 {
589 uint64_t imageLoadAddress; /* XXX image slide */
590 uuid_t imageUUID;
591 };
592
593 /*
594 * N.B.: Newer kernels output dyld_shared_cache_loadinfo structures
595 * instead of this, since the field names match their contents better.
596 */
597 struct dyld_uuid_info_64_v2 {
598 uint64_t imageLoadAddress; /* XXX image slide */
599 uuid_t imageUUID;
600 /* end of version 1 of dyld_uuid_info_64. sizeof v1 was 24 */
601 uint64_t imageSlidBaseAddress; /* slid base address or slid first mapping of image */
602 };
603
604 enum dyld_shared_cache_flags {
605 kSharedCacheSystemPrimary = 0x1, /* primary shared cache on the system; attached tasks will have kTaskSharedRegionSystem set */
606 kSharedCacheDriverkit = 0x2, /* driverkit shared cache */
607 kSharedCacheAOT = 0x4, /* Rosetta shared cache */
608 };
609
610 /*
611 * This is the renamed version of dyld_uuid_info_64 with more accurate
612 * field names, for STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO. Any users
613 * must be aware of the dyld_uuid_info_64* version history and ensure
614 * the fields they are accessing are within the actual bounds.
615 *
616 * OLD_FIELD NEW_FIELD
617 * imageLoadAddress sharedCacheSlide
618 * imageUUID sharedCacheUUID
619 * imageSlidBaseAddress sharedCacheUnreliableSlidBaseAddress
620 * - sharedCacheSlidFirstMapping
621 * - sharedCacheID
622 * - sharedCacheFlags
623 */
624 struct dyld_shared_cache_loadinfo_v2 {
625 uint64_t sharedCacheSlide; /* image slide value */
626 uuid_t sharedCacheUUID;
627 /* end of version 1 of dyld_uuid_info_64. sizeof v1 was 24 */
628 uint64_t sharedCacheUnreliableSlidBaseAddress; /* for backwards-compatibility; use sharedCacheSlidFirstMapping if available */
629 /* end of version 2 of dyld_uuid_info_64. sizeof v2 was 32 */
630 uint64_t sharedCacheSlidFirstMapping; /* slid base address of first mapping */
631 /* end of version 1 of dyld_shared_cache_loadinfo. sizeof was 40 */
632 uint32_t sharedCacheID; /* ID of shared cache */
633 uint32_t sharedCacheFlags;
634 };
635
636 struct dyld_shared_cache_loadinfo {
637 uint64_t sharedCacheSlide; /* image slide value */
638 uuid_t sharedCacheUUID;
639 /* end of version 1 of dyld_uuid_info_64. sizeof v1 was 24 */
640 uint64_t sharedCacheUnreliableSlidBaseAddress; /* for backwards-compatibility; use sharedCacheSlidFirstMapping if available */
641 /* end of version 2 of dyld_uuid_info_64. sizeof v2 was 32 */
642 uint64_t sharedCacheSlidFirstMapping; /* slid base address of first mapping */
643 };
644
645 struct dyld_aot_cache_uuid_info {
646 uint64_t x86SlidBaseAddress; /* slid first mapping address of x86 shared cache */
647 uuid_t x86UUID; /* UUID of x86 shared cache */
648 uint64_t aotSlidBaseAddress; /* slide first mapping address of aot cache */
649 uuid_t aotUUID; /* UUID of aot shared cache */
650 };
651
652 struct user32_dyld_uuid_info {
653 uint32_t imageLoadAddress; /* base address image is mapped into */
654 uuid_t imageUUID; /* UUID of image */
655 };
656
657 struct user64_dyld_uuid_info {
658 uint64_t imageLoadAddress; /* base address image is mapped into */
659 uuid_t imageUUID; /* UUID of image */
660 };
661
662 #define DYLD_AOT_IMAGE_KEY_SIZE 32
663
664 struct user64_dyld_aot_info {
665 uint64_t x86LoadAddress;
666 uint64_t aotLoadAddress;
667 uint64_t aotImageSize;
668 uint8_t aotImageKey[DYLD_AOT_IMAGE_KEY_SIZE];
669 };
670
671 enum task_snapshot_flags {
672 /* k{User,Kernel}64_p (values 0x1 and 0x2) are defined in generic_snapshot_flags */
673 kTaskRsrcFlagged = 0x4, // In the EXC_RESOURCE danger zone?
674 kTerminatedSnapshot = 0x8,
675 kPidSuspended = 0x10, // true for suspended task
676 kFrozen = 0x20, // true for hibernated task (along with pidsuspended)
677 kTaskDarwinBG = 0x40,
678 kTaskExtDarwinBG = 0x80,
679 kTaskVisVisible = 0x100,
680 kTaskVisNonvisible = 0x200,
681 kTaskIsForeground = 0x400,
682 kTaskIsBoosted = 0x800,
683 kTaskIsSuppressed = 0x1000,
684 kTaskIsTimerThrottled = 0x2000, /* deprecated */
685 kTaskIsImpDonor = 0x4000,
686 kTaskIsLiveImpDonor = 0x8000,
687 kTaskIsDirty = 0x10000,
688 kTaskWqExceededConstrainedThreadLimit = 0x20000,
689 kTaskWqExceededTotalThreadLimit = 0x40000,
690 kTaskWqFlagsAvailable = 0x80000,
691 kTaskUUIDInfoFaultedIn = 0x100000, /* successfully faulted in some UUID info */
692 kTaskUUIDInfoMissing = 0x200000, /* some UUID info was paged out */
693 kTaskUUIDInfoTriedFault = 0x400000, /* tried to fault in UUID info */
694 kTaskSharedRegionInfoUnavailable = 0x800000, /* shared region info unavailable */
695 kTaskTALEngaged = 0x1000000,
696 /* 0x2000000 unused */
697 kTaskIsDirtyTracked = 0x4000000,
698 kTaskAllowIdleExit = 0x8000000,
699 kTaskIsTranslated = 0x10000000,
700 kTaskSharedRegionNone = 0x20000000, /* task doesn't have a shared region */
701 kTaskSharedRegionSystem = 0x40000000, /* task attached to region with kSharedCacheSystemPrimary set */
702 kTaskSharedRegionOther = 0x80000000, /* task is attached to a different shared region */
703 kTaskDyldCompactInfoNone = 0x100000000,
704 kTaskDyldCompactInfoTooBig = 0x200000000,
705 kTaskDyldCompactInfoFaultedIn = 0x400000000,
706 kTaskDyldCompactInfoMissing = 0x800000000,
707 kTaskDyldCompactInfoTriedFault = 0x1000000000,
708 kTaskWqExceededCooperativeThreadLimit = 0x2000000000,
709 kTaskWqExceededActiveConstrainedThreadLimit = 0x4000000000,
710 }; // Note: Add any new flags to kcdata.py (ts_ss_flags)
711
712 enum task_transition_type {
713 kTaskIsTerminated = 0x1,// Past LPEXIT
714 };
715
716 /* See kcdata_private.h for more flag definitions */
717 enum task_exec_flags : uint64_t {
718 kTaskExecTranslated = 0x01, /* Task is running under translation (eg, Rosetta) */
719 kTaskExecHardenedHeap = 0x02, /* Task has the hardened heap security feature */
720 kTaskExecReserved00 = 0x04,
721 kTaskExecReserved01 = 0x08,
722 kTaskExecReserved02 = 0x10,
723 kTaskExecReserved03 = 0x20
724 };
725
726 /* metadata about a task that is fixed at spawn/exec time */
727 struct task_exec_meta {
728 uint64_t tem_flags; /* task_exec_flags */
729 } __attribute__((packed));
730
731
732
733 enum thread_snapshot_flags {
734 /* k{User,Kernel}64_p (values 0x1 and 0x2) are defined in generic_snapshot_flags */
735 kHasDispatchSerial = 0x4,
736 kStacksPCOnly = 0x8, /* Stack traces have no frame pointers. */
737 kThreadDarwinBG = 0x10, /* Thread is darwinbg */
738 kThreadIOPassive = 0x20, /* Thread uses passive IO */
739 kThreadSuspended = 0x40, /* Thread is suspended */
740 kThreadTruncatedBT = 0x80, /* Unmapped pages caused truncated backtrace */
741 kGlobalForcedIdle = 0x100, /* Thread performs global forced idle */
742 kThreadFaultedBT = 0x200, /* Some thread stack pages were faulted in as part of BT */
743 kThreadTriedFaultBT = 0x400, /* We tried to fault in thread stack pages as part of BT */
744 kThreadOnCore = 0x800, /* Thread was on-core when we entered debugger context */
745 kThreadIdleWorker = 0x1000, /* Thread is an idle libpthread worker thread */
746 kThreadMain = 0x2000, /* Thread is the main thread */
747 kThreadTruncKernBT = 0x4000, /* Unmapped pages caused truncated kernel BT */
748 kThreadTruncUserBT = 0x8000, /* Unmapped pages caused truncated user BT */
749 kThreadTruncUserAsyncBT = 0x10000, /* Unmapped pages caused truncated user async BT */
750 }; // Note: Add any new flags to kcdata.py (ths_ss_flags)
751
752 struct mem_and_io_snapshot {
753 uint32_t snapshot_magic;
754 uint32_t free_pages;
755 uint32_t active_pages;
756 uint32_t inactive_pages;
757 uint32_t purgeable_pages;
758 uint32_t wired_pages;
759 uint32_t speculative_pages;
760 uint32_t throttled_pages;
761 uint32_t filebacked_pages;
762 uint32_t compressions;
763 uint32_t decompressions;
764 uint32_t compressor_size;
765 int32_t busy_buffer_count;
766 uint32_t pages_wanted;
767 uint32_t pages_reclaimed;
768 uint8_t pages_wanted_reclaimed_valid; // did mach_vm_pressure_monitor succeed?
769 } __attribute__((packed));
770
771 /* SS_TH_* macros are for ths_state */
772 #define SS_TH_WAIT 0x01 /* queued for waiting */
773 #define SS_TH_SUSP 0x02 /* stopped or requested to stop */
774 #define SS_TH_RUN 0x04 /* running or on runq */
775 #define SS_TH_UNINT 0x08 /* waiting uninteruptibly */
776 #define SS_TH_TERMINATE 0x10 /* halted at termination */
777 #define SS_TH_TERMINATE2 0x20 /* added to termination queue */
778 #define SS_TH_IDLE 0x80 /* idling processor */
779
780 struct thread_snapshot_v2 {
781 uint64_t ths_thread_id;
782 uint64_t ths_wait_event;
783 uint64_t ths_continuation;
784 uint64_t ths_total_syscalls;
785 uint64_t ths_voucher_identifier;
786 uint64_t ths_dqserialnum;
787 uint64_t ths_user_time;
788 uint64_t ths_sys_time;
789 uint64_t ths_ss_flags;
790 uint64_t ths_last_run_time;
791 uint64_t ths_last_made_runnable_time;
792 uint32_t ths_state;
793 uint32_t ths_sched_flags;
794 int16_t ths_base_priority;
795 int16_t ths_sched_priority;
796 uint8_t ths_eqos;
797 uint8_t ths_rqos;
798 uint8_t ths_rqos_override;
799 uint8_t ths_io_tier;
800 } __attribute__((packed));
801
802 struct thread_snapshot_v3 {
803 uint64_t ths_thread_id;
804 uint64_t ths_wait_event;
805 uint64_t ths_continuation;
806 uint64_t ths_total_syscalls;
807 uint64_t ths_voucher_identifier;
808 uint64_t ths_dqserialnum;
809 uint64_t ths_user_time;
810 uint64_t ths_sys_time;
811 uint64_t ths_ss_flags;
812 uint64_t ths_last_run_time;
813 uint64_t ths_last_made_runnable_time;
814 uint32_t ths_state;
815 uint32_t ths_sched_flags;
816 int16_t ths_base_priority;
817 int16_t ths_sched_priority;
818 uint8_t ths_eqos;
819 uint8_t ths_rqos;
820 uint8_t ths_rqos_override;
821 uint8_t ths_io_tier;
822 uint64_t ths_thread_t;
823 } __attribute__((packed));
824
825
826 struct thread_snapshot_v4 {
827 uint64_t ths_thread_id;
828 uint64_t ths_wait_event;
829 uint64_t ths_continuation;
830 uint64_t ths_total_syscalls;
831 uint64_t ths_voucher_identifier;
832 uint64_t ths_dqserialnum;
833 uint64_t ths_user_time;
834 uint64_t ths_sys_time;
835 uint64_t ths_ss_flags;
836 uint64_t ths_last_run_time;
837 uint64_t ths_last_made_runnable_time;
838 uint32_t ths_state;
839 uint32_t ths_sched_flags;
840 int16_t ths_base_priority;
841 int16_t ths_sched_priority;
842 uint8_t ths_eqos;
843 uint8_t ths_rqos;
844 uint8_t ths_rqos_override;
845 uint8_t ths_io_tier;
846 uint64_t ths_thread_t;
847 uint64_t ths_requested_policy;
848 uint64_t ths_effective_policy;
849 } __attribute__((packed));
850
851
852 struct thread_group_snapshot {
853 uint64_t tgs_id;
854 char tgs_name[16];
855 } __attribute__((packed));
856
857 /*
858 * In general these flags mirror their THREAD_GROUP_FLAGS_ counterparts.
859 * THREAD_GROUP_FLAGS_UI_APP was repurposed and THREAD_GROUP_FLAGS_APPLICATION
860 * introduced to take its place. To remain compatible, kThreadGroupUIApp is
861 * kept around and kThreadGroupUIApplication introduced.
862 */
863 enum thread_group_flags {
864 kThreadGroupEfficient = 0x1,
865 kThreadGroupApplication = 0x2,
866 kThreadGroupUIApp = 0x2,
867 kThreadGroupCritical = 0x4,
868 kThreadGroupBestEffort = 0x8,
869 kThreadGroupUIApplication = 0x100,
870 kThreadGroupManaged = 0x200,
871 kThreadGroupStrictTimers = 0x400,
872 }; // Note: Add any new flags to kcdata.py (tgs_flags)
873
874 struct thread_group_snapshot_v2 {
875 uint64_t tgs_id;
876 char tgs_name[16];
877 uint64_t tgs_flags;
878 } __attribute__((packed));
879
880 struct thread_group_snapshot_v3 {
881 uint64_t tgs_id;
882 char tgs_name[16];
883 uint64_t tgs_flags;
884 char tgs_name_cont[16];
885 } __attribute__((packed));
886
887 enum coalition_flags {
888 kCoalitionTermRequested = 0x1,
889 kCoalitionTerminated = 0x2,
890 kCoalitionReaped = 0x4,
891 kCoalitionPrivileged = 0x8,
892 }; // Note: Add any new flags to kcdata.py (jcs_flags)
893
894 struct jetsam_coalition_snapshot {
895 uint64_t jcs_id;
896 uint64_t jcs_flags;
897 uint64_t jcs_thread_group;
898 uint64_t jcs_leader_task_uniqueid;
899 } __attribute__((packed));
900
901 struct instrs_cycles_snapshot {
902 uint64_t ics_instructions;
903 uint64_t ics_cycles;
904 } __attribute__((packed));
905
906 struct instrs_cycles_snapshot_v2 {
907 uint64_t ics_instructions;
908 uint64_t ics_cycles;
909 uint64_t ics_p_instructions;
910 uint64_t ics_p_cycles;
911 } __attribute__((packed));
912
913 struct thread_delta_snapshot_v2 {
914 uint64_t tds_thread_id;
915 uint64_t tds_voucher_identifier;
916 uint64_t tds_ss_flags;
917 uint64_t tds_last_made_runnable_time;
918 uint32_t tds_state;
919 uint32_t tds_sched_flags;
920 int16_t tds_base_priority;
921 int16_t tds_sched_priority;
922 uint8_t tds_eqos;
923 uint8_t tds_rqos;
924 uint8_t tds_rqos_override;
925 uint8_t tds_io_tier;
926 } __attribute__ ((packed));
927
928 struct thread_delta_snapshot_v3 {
929 uint64_t tds_thread_id;
930 uint64_t tds_voucher_identifier;
931 uint64_t tds_ss_flags;
932 uint64_t tds_last_made_runnable_time;
933 uint32_t tds_state;
934 uint32_t tds_sched_flags;
935 int16_t tds_base_priority;
936 int16_t tds_sched_priority;
937 uint8_t tds_eqos;
938 uint8_t tds_rqos;
939 uint8_t tds_rqos_override;
940 uint8_t tds_io_tier;
941 uint64_t tds_requested_policy;
942 uint64_t tds_effective_policy;
943 } __attribute__ ((packed));
944
945 struct io_stats_snapshot {
946 /*
947 * I/O Statistics
948 * XXX: These fields must be together.
949 */
950 uint64_t ss_disk_reads_count;
951 uint64_t ss_disk_reads_size;
952 uint64_t ss_disk_writes_count;
953 uint64_t ss_disk_writes_size;
954 uint64_t ss_io_priority_count[STACKSHOT_IO_NUM_PRIORITIES];
955 uint64_t ss_io_priority_size[STACKSHOT_IO_NUM_PRIORITIES];
956 uint64_t ss_paging_count;
957 uint64_t ss_paging_size;
958 uint64_t ss_non_paging_count;
959 uint64_t ss_non_paging_size;
960 uint64_t ss_data_count;
961 uint64_t ss_data_size;
962 uint64_t ss_metadata_count;
963 uint64_t ss_metadata_size;
964 /* XXX: I/O Statistics end */
965 } __attribute__ ((packed));
966
967 struct task_snapshot_v2 {
968 uint64_t ts_unique_pid;
969 uint64_t ts_ss_flags;
970 uint64_t ts_user_time_in_terminated_threads;
971 uint64_t ts_system_time_in_terminated_threads;
972 uint64_t ts_p_start_sec;
973 uint64_t ts_task_size;
974 uint64_t ts_max_resident_size;
975 uint32_t ts_suspend_count;
976 uint32_t ts_faults;
977 uint32_t ts_pageins;
978 uint32_t ts_cow_faults;
979 uint32_t ts_was_throttled;
980 uint32_t ts_did_throttle;
981 uint32_t ts_latency_qos;
982 int32_t ts_pid;
983 char ts_p_comm[32];
984 } __attribute__ ((packed));
985
986 struct transitioning_task_snapshot {
987 uint64_t tts_unique_pid;
988 uint64_t tts_ss_flags;
989 uint64_t tts_transition_type;
990 int32_t tts_pid;
991 char tts_p_comm[32];
992 } __attribute__ ((packed));
993
994 struct task_delta_snapshot_v2 {
995 uint64_t tds_unique_pid;
996 uint64_t tds_ss_flags;
997 uint64_t tds_user_time_in_terminated_threads;
998 uint64_t tds_system_time_in_terminated_threads;
999 uint64_t tds_task_size;
1000 uint64_t tds_max_resident_size;
1001 uint32_t tds_suspend_count;
1002 uint32_t tds_faults;
1003 uint32_t tds_pageins;
1004 uint32_t tds_cow_faults;
1005 uint32_t tds_was_throttled;
1006 uint32_t tds_did_throttle;
1007 uint32_t tds_latency_qos;
1008 } __attribute__ ((packed));
1009
1010 #define KCDATA_INVALID_CS_TRUST_LEVEL 0xffffffff
1011 struct stackshot_task_codesigning_info {
1012 uint64_t csflags;
1013 uint32_t cs_trust_level;
1014 } __attribute__ ((packed));
1015
1016 struct stackshot_cpu_times {
1017 uint64_t user_usec;
1018 uint64_t system_usec;
1019 } __attribute__((packed));
1020
1021 struct stackshot_cpu_times_v2 {
1022 uint64_t user_usec;
1023 uint64_t system_usec;
1024 uint64_t runnable_usec;
1025 } __attribute__((packed));
1026
1027 struct stackshot_duration {
1028 uint64_t stackshot_duration;
1029 uint64_t stackshot_duration_outer;
1030 } __attribute__((packed));
1031
1032 struct stackshot_duration_v2 {
1033 uint64_t stackshot_duration;
1034 uint64_t stackshot_duration_outer;
1035 uint64_t stackshot_duration_prior;
1036 } __attribute__((packed));
1037
1038 struct stackshot_fault_stats {
1039 uint32_t sfs_pages_faulted_in; /* number of pages faulted in using KDP fault path */
1040 uint64_t sfs_time_spent_faulting; /* MATUs spent faulting */
1041 uint64_t sfs_system_max_fault_time; /* MATUs fault time limit per stackshot */
1042 uint8_t sfs_stopped_faulting; /* we stopped decompressing because we hit the limit */
1043 } __attribute__((packed));
1044
1045 typedef struct stackshot_thread_waitinfo {
1046 uint64_t owner; /* The thread that owns the object */
1047 uint64_t waiter; /* The thread that's waiting on the object */
1048 uint64_t context; /* A context uniquely identifying the object */
1049 uint8_t wait_type; /* The type of object that the thread is waiting on */
1050 } __attribute__((packed)) thread_waitinfo_t;
1051
1052 typedef struct stackshot_thread_waitinfo_v2 {
1053 uint64_t owner; /* The thread that owns the object */
1054 uint64_t waiter; /* The thread that's waiting on the object */
1055 uint64_t context; /* A context uniquely identifying the object */
1056 uint8_t wait_type; /* The type of object that the thread is waiting on */
1057 int16_t portlabel_id; /* matches to a stackshot_portlabel, or NONE or MISSING */
1058 uint32_t wait_flags; /* info about the wait */
1059 #define STACKSHOT_WAITINFO_FLAGS_SPECIALREPLY 0x1 /* We're waiting on a special reply port */
1060 } __attribute__((packed)) thread_waitinfo_v2_t;
1061
1062
1063 typedef struct stackshot_thread_turnstileinfo {
1064 uint64_t waiter; /* The thread that's waiting on the object */
1065 uint64_t turnstile_context; /* Associated data (either thread id, or workq addr) */
1066 uint8_t turnstile_priority;
1067 uint8_t number_of_hops;
1068 uint64_t turnstile_flags; /* see below */
1069 } __attribute__((packed)) thread_turnstileinfo_t;
1070
1071 typedef struct stackshot_thread_turnstileinfo_v2 {
1072 uint64_t waiter; /* The thread that's waiting on the object */
1073 uint64_t turnstile_context; /* Associated data (either thread id, or workq addr) */
1074 uint8_t turnstile_priority;
1075 uint8_t number_of_hops;
1076 #define STACKSHOT_TURNSTILE_STATUS_UNKNOWN 0x01 /* The final inheritor is unknown (bug?) */
1077 #define STACKSHOT_TURNSTILE_STATUS_LOCKED_WAITQ 0x02 /* A waitq was found to be locked */
1078 #define STACKSHOT_TURNSTILE_STATUS_WORKQUEUE 0x04 /* The final inheritor is a workqueue */
1079 #define STACKSHOT_TURNSTILE_STATUS_THREAD 0x08 /* The final inheritor is a thread */
1080 #define STACKSHOT_TURNSTILE_STATUS_BLOCKED_ON_TASK 0x10 /* blocked on task, dind't find thread */
1081 #define STACKSHOT_TURNSTILE_STATUS_HELD_IPLOCK 0x20 /* the ip_lock was held */
1082 #define STACKSHOT_TURNSTILE_STATUS_SENDPORT 0x40 /* port_labelid was from a send port */
1083 #define STACKSHOT_TURNSTILE_STATUS_RECEIVEPORT 0x80 /* port_labelid was from a receive port */
1084 uint64_t turnstile_flags; // Note: Add any new flags to kcdata.py (turnstile_flags)
1085 int16_t portlabel_id; /* matches to a stackshot_portlabel, or NONE or MISSING */
1086 } __attribute__((packed)) thread_turnstileinfo_v2_t;
1087
1088 #define STACKSHOT_TURNSTILE_STATUS_PORTFLAGS (STACKSHOT_TURNSTILE_STATUS_SENDPORT | STACKSHOT_TURNSTILE_STATUS_RECEIVEPORT)
1089
1090 #define STACKSHOT_PORTLABELID_NONE (0) /* No port label found */
1091 #define STACKSHOT_PORTLABELID_MISSING (-1) /* portlabel found, but stackshot ran out of space to track it */
1092
1093 #define STACKSHOT_WAITOWNER_KERNEL (UINT64_MAX - 1)
1094 #define STACKSHOT_WAITOWNER_PORT_LOCKED (UINT64_MAX - 2)
1095 #define STACKSHOT_WAITOWNER_PSET_LOCKED (UINT64_MAX - 3)
1096 #define STACKSHOT_WAITOWNER_INTRANSIT (UINT64_MAX - 4)
1097 #define STACKSHOT_WAITOWNER_MTXSPIN (UINT64_MAX - 5)
1098 #define STACKSHOT_WAITOWNER_THREQUESTED (UINT64_MAX - 6) /* workloop waiting for a new worker thread */
1099 #define STACKSHOT_WAITOWNER_SUSPENDED (UINT64_MAX - 7) /* workloop is suspended */
1100
1101 #define STACKSHOT_PORTLABEL_READFAILED 0x1 /* could not read port information */
1102 #define STACKSHOT_PORTLABEL_THROTTLED 0x2 /* service port is marked as throttled */
1103
1104 struct portlabel_info {
1105 int16_t portlabel_id; /* kcdata-specific ID for this port label */
1106 uint16_t portlabel_flags; /* STACKSHOT_PORTLABEL_* */
1107 uint8_t portlabel_domain; /* launchd domain */
1108 } __attribute__((packed));
1109
1110 struct stackshot_cpu_architecture {
1111 int32_t cputype;
1112 int32_t cpusubtype;
1113 } __attribute__((packed));
1114
1115 struct stack_snapshot_stacktop {
1116 uint64_t sp;
1117 uint8_t stack_contents[8];
1118 };
1119
1120 /* only collected if STACKSHOT_COLLECTS_LATENCY_INFO is set to !0 */
1121 struct stackshot_latency_collection {
1122 uint64_t latency_version;
1123 uint64_t setup_latency;
1124 uint64_t total_task_iteration_latency;
1125 uint64_t total_terminated_task_iteration_latency;
1126 } __attribute__((packed));
1127
1128 /* only collected if STACKSHOT_COLLECTS_LATENCY_INFO is set to !0 */
1129 struct stackshot_latency_collection_v2 {
1130 uint64_t latency_version;
1131 uint64_t setup_latency_mt;
1132 uint64_t total_task_iteration_latency_mt;
1133 uint64_t total_terminated_task_iteration_latency_mt;
1134 uint64_t task_queue_building_latency_mt;
1135 uint64_t terminated_task_queue_building_latency_mt;
1136 uint64_t cpu_wait_latency_mt;
1137 int32_t main_cpu_number;
1138 int32_t calling_cpu_number;
1139 uint64_t buffer_size;
1140 uint64_t buffer_used;
1141 uint64_t buffer_overhead;
1142 uint64_t buffer_count;
1143 } __attribute__((packed));
1144
1145 /* only collected if STACKSHOT_COLLECTS_LATENCY_INFO is set to !0 */
1146 struct stackshot_latency_cpu {
1147 int32_t cpu_number;
1148 int32_t cluster_type;
1149 uint64_t init_latency_mt;
1150 uint64_t workqueue_latency_mt;
1151 uint64_t total_latency_mt;
1152 uint64_t total_cycles;
1153 uint64_t total_instrs;
1154 uint64_t tasks_processed;
1155 uint64_t threads_processed;
1156 uint64_t faulting_time_mt;
1157 uint64_t total_buf;
1158 uint64_t intercluster_buf_used;
1159 } __attribute__((packed));
1160
1161 /* only collected if STACKSHOT_COLLECTS_LATENCY_INFO is set to !0 */
1162 struct stackshot_latency_task {
1163 uint64_t task_uniqueid;
1164 uint64_t setup_latency;
1165 uint64_t task_thread_count_loop_latency;
1166 uint64_t task_thread_data_loop_latency;
1167 uint64_t cur_tsnap_latency;
1168 uint64_t pmap_latency;
1169 uint64_t bsd_proc_ids_latency;
1170 uint64_t misc_latency;
1171 uint64_t misc2_latency;
1172 uint64_t end_latency;
1173 } __attribute__((packed));
1174
1175 /* only collected if STACKSHOT_COLLECTS_LATENCY_INFO is set to !0 */
1176 struct stackshot_latency_thread {
1177 uint64_t thread_id;
1178 uint64_t cur_thsnap1_latency;
1179 uint64_t dispatch_serial_latency;
1180 uint64_t dispatch_label_latency;
1181 uint64_t cur_thsnap2_latency;
1182 uint64_t thread_name_latency;
1183 uint64_t sur_times_latency;
1184 uint64_t user_stack_latency;
1185 uint64_t kernel_stack_latency;
1186 uint64_t misc_latency;
1187 } __attribute__((packed));
1188
1189 struct stackshot_suspension_info {
1190 uint64_t tss_last_start; /* mach_absolute_time of beginning of last suspension*/
1191 uint64_t tss_last_end; /* mach_absolute_time of end of last suspension */
1192 uint64_t tss_count; /* number of times this task has been suspended */
1193 uint64_t tss_duration; /* sum(mach_absolute_time) of time spend suspended */
1194 } __attribute__((packed));
1195
1196 struct stackshot_suspension_source {
1197 uint64_t tss_time; /* mach_absolute_time of suspend */
1198 uint64_t tss_tid; /* tid of suspending thread */
1199 int tss_pid; /* pid of suspending task */
1200 char tss_procname[65]; /* name of suspending task */
1201 } __attribute__((packed));
1202
1203 /**************** definitions for exclaves *********************/
1204
1205 enum thread_exclaves_flags : uint32_t {
1206 kExclaveRPCActive = 0x1, /* Thread is handling RPC call in secure world */
1207 kExclaveUpcallActive = 0x2, /* Thread has upcalled back into xnu while handling RPC */
1208 kExclaveSchedulerRequest = 0x4, /* Thread is handling scheduler request */
1209 };
1210
1211 struct thread_exclaves_info {
1212 uint64_t tei_scid; /* Scheduling context for exclave IPC stack */
1213 uint32_t tei_thread_offset; /* # frames from top of stack exclave frames should be inserted */
1214 uint32_t tei_flags; /* A combination of enum thread_exclaves_flags values */
1215 } __attribute__((packed));
1216
1217 struct thread_crash_exclaves_info {
1218 uint64_t tcei_scid; /* Scheduling context for exclave IPC stack */
1219 uint64_t tcei_thread_id; /* Corresponding xnu thread id */
1220 uint32_t tcei_flags; /* A combination of enum thread_exclaves_flags values */
1221 } __attribute__((packed));
1222
1223 enum exclave_scresult_flags : uint64_t {
1224 kExclaveScresultHaveIPCStack = 0x1,
1225 };
1226
1227 struct exclave_scresult_info {
1228 uint64_t esc_id;
1229 uint64_t esc_flags; /* A combination of enum exclave_scresult_flags values */
1230 } __attribute__((packed));
1231
1232 enum exclave_ipcstackentry_flags : uint64_t {
1233 kExclaveIpcStackEntryHaveInvocationID = 0x1,
1234 kExclaveIpcStackEntryHaveStack = 0x2,
1235 };
1236
1237 struct exclave_ipcstackentry_info {
1238 uint64_t eise_asid; /* ASID */
1239 uint64_t eise_tnid; /* Thread numeric ID, may be UINT64_MAX if ommitted */
1240 uint64_t eise_invocationid; /* Invocation ID, may be UINT64_MAX if ommitted */
1241 uint64_t eise_flags; /* A combination of enum exclave_ipcstackentry_flags values */
1242 } __attribute__((packed));
1243
1244 typedef uint64_t exclave_ecstackentry_addr_t;
1245
1246 enum exclave_addressspace_flags : uint64_t {
1247 kExclaveAddressSpaceHaveSlide = 0x1, /* slide info provided */
1248 };
1249
1250 struct exclave_addressspace_info {
1251 uint64_t eas_id; /* ASID */
1252 uint64_t eas_flags; /* A combination of enum exclave_addressspace_flags values */
1253 uint64_t eas_layoutid; /* textLayout for this address space */
1254 uint64_t eas_slide; /* slide to apply to textlayout, or UINT64_MAX if omitted */
1255 uint64_t eas_asroot; /* ASRoot/TTBR0 value used as an identifier for the address space by cL4 */
1256 } __attribute__((packed));
1257
1258 enum exclave_textlayout_flags : uint64_t {
1259 kExclaveTextLayoutLoadAddressesSynthetic = 0x1, /* Load Addresses are synthetic */
1260 kExclaveTextLayoutLoadAddressesUnslid = 0x2, /* Load Addresses are accurate and unslid */
1261 kExclaveTextLayoutHasSharedCache = 0x4, /* sharedcache_index is valid, refers to entry # in STACKSHOT_KCTYPE_EXCLAVE_TEXTLAYOUT_SEGMENTS array */
1262 };
1263
1264 struct exclave_textlayout_info_v1 {
1265 uint64_t layout_id;
1266 uint64_t etl_flags; /* A combination of enum exclave_textlayout_flags values */
1267 } __attribute__((packed));
1268
1269 struct exclave_textlayout_info {
1270 uint64_t layout_id;
1271 uint64_t etl_flags; /* A combination of enum exclave_textlayout_flags values */
1272 uint32_t sharedcache_index; /* index in SEGMENTs, or UINT32_MAX */
1273 } __attribute__((packed));
1274
1275 struct exclave_textlayout_segment {
1276 uuid_t layoutSegment_uuid;
1277 uint64_t layoutSegment_loadAddress; /* Synthetic Load Address */
1278 } __attribute__((packed));
1279
1280 struct exclave_textlayout_segment_v2 {
1281 uuid_t layoutSegment_uuid;
1282 uint64_t layoutSegment_loadAddress; /* Synthetic Load Address */
1283 uint64_t layoutSegment_rawLoadAddress; /* Raw Load Address when unslided */
1284 } __attribute__((packed));
1285
1286 /**************** definitions for crashinfo *********************/
1287
1288 /*
1289 * NOTE: Please update kcdata/libkdd/kcdtypes.c if you make any changes
1290 * in TASK_CRASHINFO_* types.
1291 */
1292
1293 /* FIXME some of these types aren't clean (fixed width, packed, and defined *here*) */
1294
1295 struct crashinfo_proc_uniqidentifierinfo {
1296 uint8_t p_uuid[16]; /* UUID of the main executable */
1297 uint64_t p_uniqueid; /* 64 bit unique identifier for process */
1298 uint64_t p_puniqueid; /* unique identifier for process's parent */
1299 uint64_t p_reserve2; /* reserved for future use */
1300 uint64_t p_reserve3; /* reserved for future use */
1301 uint64_t p_reserve4; /* reserved for future use */
1302 } __attribute__((packed));
1303
1304 #define MAX_TRIAGE_STRING_LEN (128)
1305
1306 struct kernel_triage_info_v1 {
1307 char triage_string1[MAX_TRIAGE_STRING_LEN];
1308 char triage_string2[MAX_TRIAGE_STRING_LEN];
1309 char triage_string3[MAX_TRIAGE_STRING_LEN];
1310 char triage_string4[MAX_TRIAGE_STRING_LEN];
1311 char triage_string5[MAX_TRIAGE_STRING_LEN];
1312 } __attribute__((packed));
1313
1314 struct crashinfo_jit_address_range {
1315 uint64_t start_address;
1316 uint64_t end_address;
1317 } __attribute__((packed));
1318
1319 struct crashinfo_mb {
1320 uint64_t start_address;
1321 uint64_t data[64];
1322 } __attribute__((packed));
1323
1324
1325 #define MAX_CRASHINFO_SIGNING_ID_LEN 64
1326 #define MAX_CRASHINFO_TEAM_ID_LEN 32
1327
1328 #define TASK_CRASHINFO_BEGIN KCDATA_BUFFER_BEGIN_CRASHINFO
1329 #define TASK_CRASHINFO_STRING_DESC KCDATA_TYPE_STRING_DESC
1330 #define TASK_CRASHINFO_UINT32_DESC KCDATA_TYPE_UINT32_DESC
1331 #define TASK_CRASHINFO_UINT64_DESC KCDATA_TYPE_UINT64_DESC
1332
1333 #define TASK_CRASHINFO_EXTMODINFO 0x801
1334 #define TASK_CRASHINFO_BSDINFOWITHUNIQID 0x802 /* struct crashinfo_proc_uniqidentifierinfo */
1335 #define TASK_CRASHINFO_TASKDYLD_INFO 0x803
1336 #define TASK_CRASHINFO_UUID 0x804
1337 #define TASK_CRASHINFO_PID 0x805
1338 #define TASK_CRASHINFO_PPID 0x806
1339 #define TASK_CRASHINFO_RUSAGE 0x807 /* struct rusage DEPRECATED do not use.
1340 * This struct has longs in it */
1341 #define TASK_CRASHINFO_RUSAGE_INFO 0x808 /* struct rusage_info_v3 from resource.h */
1342 #define TASK_CRASHINFO_PROC_NAME 0x809 /* char * */
1343 #define TASK_CRASHINFO_PROC_STARTTIME 0x80B /* struct timeval64 */
1344 #define TASK_CRASHINFO_USERSTACK 0x80C /* uint64_t */
1345 #define TASK_CRASHINFO_ARGSLEN 0x80D
1346 #define TASK_CRASHINFO_EXCEPTION_CODES 0x80E /* mach_exception_data_t */
1347 #define TASK_CRASHINFO_PROC_PATH 0x80F /* string of len MAXPATHLEN */
1348 #define TASK_CRASHINFO_PROC_CSFLAGS 0x810 /* uint32_t */
1349 #define TASK_CRASHINFO_PROC_STATUS 0x811 /* char */
1350 #define TASK_CRASHINFO_UID 0x812 /* uid_t */
1351 #define TASK_CRASHINFO_GID 0x813 /* gid_t */
1352 #define TASK_CRASHINFO_PROC_ARGC 0x814 /* int */
1353 #define TASK_CRASHINFO_PROC_FLAGS 0x815 /* unsigned int */
1354 #define TASK_CRASHINFO_CPUTYPE 0x816 /* cpu_type_t */
1355 #define TASK_CRASHINFO_WORKQUEUEINFO 0x817 /* struct proc_workqueueinfo */
1356 #define TASK_CRASHINFO_RESPONSIBLE_PID 0x818 /* pid_t */
1357 #define TASK_CRASHINFO_DIRTY_FLAGS 0x819 /* int */
1358 #define TASK_CRASHINFO_CRASHED_THREADID 0x81A /* uint64_t */
1359 #define TASK_CRASHINFO_COALITION_ID 0x81B /* uint64_t */
1360 #define TASK_CRASHINFO_UDATA_PTRS 0x81C /* uint64_t */
1361 #define TASK_CRASHINFO_MEMORY_LIMIT 0x81D /* uint64_t */
1362
1363 #define TASK_CRASHINFO_LEDGER_INTERNAL 0x81E /* uint64_t */
1364 #define TASK_CRASHINFO_LEDGER_INTERNAL_COMPRESSED 0x81F /* uint64_t */
1365 #define TASK_CRASHINFO_LEDGER_IOKIT_MAPPED 0x820 /* uint64_t */
1366 #define TASK_CRASHINFO_LEDGER_ALTERNATE_ACCOUNTING 0x821 /* uint64_t */
1367 #define TASK_CRASHINFO_LEDGER_ALTERNATE_ACCOUNTING_COMPRESSED 0x822 /* uint64_t */
1368 #define TASK_CRASHINFO_LEDGER_PURGEABLE_NONVOLATILE 0x823 /* uint64_t */
1369 #define TASK_CRASHINFO_LEDGER_PURGEABLE_NONVOLATILE_COMPRESSED 0x824 /* uint64_t */
1370 #define TASK_CRASHINFO_LEDGER_PAGE_TABLE 0x825 /* uint64_t */
1371 #define TASK_CRASHINFO_LEDGER_PHYS_FOOTPRINT 0x826 /* uint64_t */
1372 #define TASK_CRASHINFO_LEDGER_PHYS_FOOTPRINT_LIFETIME_MAX 0x827 /* uint64_t */
1373 #define TASK_CRASHINFO_LEDGER_NETWORK_NONVOLATILE 0x828 /* uint64_t */
1374 #define TASK_CRASHINFO_LEDGER_NETWORK_NONVOLATILE_COMPRESSED 0x829 /* uint64_t */
1375 #define TASK_CRASHINFO_LEDGER_WIRED_MEM 0x82A /* uint64_t */
1376 #define TASK_CRASHINFO_PROC_PERSONA_ID 0x82B /* uid_t */
1377 #define TASK_CRASHINFO_MEMORY_LIMIT_INCREASE 0x82C /* uint32_t */
1378 #define TASK_CRASHINFO_LEDGER_TAGGED_FOOTPRINT 0x82D /* uint64_t */
1379 #define TASK_CRASHINFO_LEDGER_TAGGED_FOOTPRINT_COMPRESSED 0x82E /* uint64_t */
1380 #define TASK_CRASHINFO_LEDGER_MEDIA_FOOTPRINT 0x82F /* uint64_t */
1381 #define TASK_CRASHINFO_LEDGER_MEDIA_FOOTPRINT_COMPRESSED 0x830 /* uint64_t */
1382 #define TASK_CRASHINFO_LEDGER_GRAPHICS_FOOTPRINT 0x831 /* uint64_t */
1383 #define TASK_CRASHINFO_LEDGER_GRAPHICS_FOOTPRINT_COMPRESSED 0x832 /* uint64_t */
1384 #define TASK_CRASHINFO_LEDGER_NEURAL_FOOTPRINT 0x833 /* uint64_t */
1385 #define TASK_CRASHINFO_LEDGER_NEURAL_FOOTPRINT_COMPRESSED 0x834 /* uint64_t */
1386 #define TASK_CRASHINFO_MEMORYSTATUS_EFFECTIVE_PRIORITY 0x835 /* int32_t */
1387 #define TASK_CRASHINFO_KERNEL_TRIAGE_INFO_V1 0x836 /* struct kernel_triage_info_v1 */
1388
1389 #define TASK_CRASHINFO_TASK_IS_CORPSE_FORK 0x837 /* boolean_t */
1390 #define TASK_CRASHINFO_EXCEPTION_TYPE 0x838 /* int */
1391
1392 #define TASK_CRASHINFO_CRASH_COUNT 0x839 /* int */
1393 #define TASK_CRASHINFO_THROTTLE_TIMEOUT 0x83A /* int */
1394
1395 #define TASK_CRASHINFO_CS_SIGNING_ID 0x83B /* string of len MAX_CRASHINFO_SIGNING_ID_LEN */
1396 #define TASK_CRASHINFO_CS_TEAM_ID 0x83C /* string of len MAX_CRASHINFO_TEAM_ID_LEN */
1397 #define TASK_CRASHINFO_CS_VALIDATION_CATEGORY 0x83D /* uint32_t */
1398 #define TASK_CRASHINFO_CS_TRUST_LEVEL 0x83E /* uint32_t */
1399 #define TASK_CRASHINFO_PROC_CPUTYPE 0x83F /* cpu_type_t */
1400 #define TASK_CRASHINFO_JIT_ADDRESS_RANGE 0x840 /* struct crashinfo_jit_address_range */
1401 #define TASK_CRASHINFO_MB 0x841 /* struct crashinfo_mb */
1402 #define TASK_CRASHINFO_CS_AUXILIARY_INFO 0x842 /* uint64_t */
1403
1404 #define TASK_CRASHINFO_END KCDATA_TYPE_BUFFER_END
1405
1406 /**************** definitions for backtrace info *********************/
1407
1408 /* tstate is variable length with count elements */
1409 struct btinfo_thread_state_data_t {
1410 uint32_t flavor;
1411 uint32_t count;
1412 int tstate[];
1413 };
1414
1415 struct btinfo_sc_load_info64 {
1416 uint64_t sharedCacheSlide;
1417 uuid_t sharedCacheUUID;
1418 uint64_t sharedCacheBaseAddress;
1419 };
1420
1421 struct btinfo_sc_load_info {
1422 uint32_t sharedCacheSlide;
1423 uuid_t sharedCacheUUID;
1424 uint32_t sharedCacheBaseAddress;
1425 };
1426
1427 #define TASK_BTINFO_BEGIN KCDATA_BUFFER_BEGIN_BTINFO
1428
1429 /* Shared keys with CRASHINFO */
1430 #define TASK_BTINFO_PID 0xA01
1431 #define TASK_BTINFO_PPID 0xA02
1432 #define TASK_BTINFO_PROC_NAME 0xA03
1433 #define TASK_BTINFO_PROC_PATH 0xA04
1434 #define TASK_BTINFO_UID 0xA05
1435 #define TASK_BTINFO_GID 0xA06
1436 #define TASK_BTINFO_PROC_FLAGS 0xA07
1437 #define TASK_BTINFO_CPUTYPE 0xA08
1438 #define TASK_BTINFO_EXCEPTION_CODES 0xA09
1439 #define TASK_BTINFO_EXCEPTION_TYPE 0xA0A
1440 #define TASK_BTINFO_RUSAGE_INFO 0xA0B
1441 #define TASK_BTINFO_COALITION_ID 0xA0C
1442 #define TASK_BTINFO_CRASH_COUNT 0xA0D
1443 #define TASK_BTINFO_THROTTLE_TIMEOUT 0xA0E
1444
1445 /* Only in BTINFO */
1446 #define TASK_BTINFO_THREAD_ID 0xA20 /* uint64_t */
1447 #define TASK_BTINFO_THREAD_NAME 0xA21 /* string of len MAXTHREADNAMESIZE */
1448 #define TASK_BTINFO_THREAD_STATE 0xA22 /* struct btinfo_thread_state_data_t */
1449 #define TASK_BTINFO_THREAD_EXCEPTION_STATE 0xA23 /* struct btinfo_thread_state_data_t */
1450 #define TASK_BTINFO_BACKTRACE 0xA24 /* array of uintptr_t */
1451 #define TASK_BTINFO_BACKTRACE64 0xA25 /* array of uintptr_t */
1452 #define TASK_BTINFO_ASYNC_BACKTRACE64 0xA26 /* array of uintptr_t */
1453 #define TASK_BTINFO_ASYNC_START_INDEX 0xA27 /* uint32_t */
1454 #define TASK_BTINFO_PLATFORM 0xA28 /* uint32_t */
1455 #define TASK_BTINFO_SC_LOADINFO 0xA29 /* struct btinfo_sc_load_info */
1456 #define TASK_BTINFO_SC_LOADINFO64 0xA2A /* struct btinfo_sc_load_info64 */
1457
1458 #define TASK_BTINFO_DYLD_LOADINFO KCDATA_TYPE_LIBRARY_LOADINFO
1459 #define TASK_BTINFO_DYLD_LOADINFO64 KCDATA_TYPE_LIBRARY_LOADINFO64
1460
1461 /* Last one */
1462 #define TASK_BTINFO_FLAGS 0xAFF /* uint32_t */
1463 #define TASK_BTINFO_FLAG_BT_TRUNCATED 0x1
1464 #define TASK_BTINFO_FLAG_ASYNC_BT_TRUNCATED 0x2
1465 #define TASK_BTINFO_FLAG_TASK_TERMINATED 0x4 /* task is terminated */
1466 #define TASK_BTINFO_FLAG_KCDATA_INCOMPLETE 0x8 /* lw corpse collection is incomplete */
1467
1468 #define TASK_BTINFO_END KCDATA_TYPE_BUFFER_END
1469
1470 /**************** definitions for os reasons *********************/
1471
1472 #define EXIT_REASON_SNAPSHOT 0x1001
1473 #define EXIT_REASON_USER_DESC 0x1002 /* string description of reason */
1474 #define EXIT_REASON_USER_PAYLOAD 0x1003 /* user payload data */
1475 #define EXIT_REASON_CODESIGNING_INFO 0x1004
1476 #define EXIT_REASON_WORKLOOP_ID 0x1005
1477 #define EXIT_REASON_DISPATCH_QUEUE_NO 0x1006
1478
1479 struct exit_reason_snapshot {
1480 uint32_t ers_namespace;
1481 uint64_t ers_code;
1482 /* end of version 1 of exit_reason_snapshot. sizeof v1 was 12 */
1483 uint64_t ers_flags;
1484 } __attribute__((packed));
1485
1486 #define EXIT_REASON_CODESIG_PATH_MAX 1024
1487
1488 struct codesigning_exit_reason_info {
1489 uint64_t ceri_virt_addr;
1490 uint64_t ceri_file_offset;
1491 char ceri_pathname[EXIT_REASON_CODESIG_PATH_MAX];
1492 char ceri_filename[EXIT_REASON_CODESIG_PATH_MAX];
1493 uint64_t ceri_codesig_modtime_secs;
1494 uint64_t ceri_codesig_modtime_nsecs;
1495 uint64_t ceri_page_modtime_secs;
1496 uint64_t ceri_page_modtime_nsecs;
1497 uint8_t ceri_path_truncated;
1498 uint8_t ceri_object_codesigned;
1499 uint8_t ceri_page_codesig_validated;
1500 uint8_t ceri_page_codesig_tainted;
1501 uint8_t ceri_page_codesig_nx;
1502 uint8_t ceri_page_wpmapped;
1503 uint8_t ceri_page_slid;
1504 uint8_t ceri_page_dirty;
1505 uint32_t ceri_page_shadow_depth;
1506 } __attribute__((packed));
1507
1508 #define EXIT_REASON_USER_DESC_MAX_LEN 1024
1509 #define EXIT_REASON_PAYLOAD_MAX_LEN 2048
1510 /**************** safe iterators *********************/
1511 #if !__has_ptrcheck
1512
1513 typedef struct kcdata_iter {
1514 kcdata_item_t item;
1515 void *end;
1516 } kcdata_iter_t;
1517
1518
1519 static inline
1520 kcdata_iter_t
kcdata_iter(void * buffer,unsigned long size)1521 kcdata_iter(void *buffer, unsigned long size)
1522 {
1523 kcdata_iter_t iter;
1524 iter.item = (kcdata_item_t) buffer;
1525 iter.end = (void*) (((uintptr_t)buffer) + size);
1526 return iter;
1527 }
1528
1529 static inline
1530 kcdata_iter_t kcdata_iter_unsafe(void *buffer) __attribute__((deprecated));
1531
1532 static inline
1533 kcdata_iter_t
kcdata_iter_unsafe(void * buffer)1534 kcdata_iter_unsafe(void *buffer)
1535 {
1536 kcdata_iter_t iter;
1537 iter.item = (kcdata_item_t) buffer;
1538 iter.end = (void*) (uintptr_t) ~0;
1539 return iter;
1540 }
1541
1542 static const kcdata_iter_t kcdata_invalid_iter = { .item = NULL, .end = NULL };
1543
1544 static inline
1545 int
kcdata_iter_valid(kcdata_iter_t iter)1546 kcdata_iter_valid(kcdata_iter_t iter)
1547 {
1548 return
1549 ((uintptr_t)iter.item + sizeof(struct kcdata_item) <= (uintptr_t)iter.end) &&
1550 ((uintptr_t)iter.item + sizeof(struct kcdata_item) + iter.item->size <= (uintptr_t)iter.end);
1551 }
1552
1553
1554 static inline
1555 kcdata_iter_t
kcdata_iter_next(kcdata_iter_t iter)1556 kcdata_iter_next(kcdata_iter_t iter)
1557 {
1558 iter.item = (kcdata_item_t) (((uintptr_t)iter.item) + sizeof(struct kcdata_item) + (iter.item->size));
1559 return iter;
1560 }
1561
1562 static inline uint32_t
kcdata_iter_type(kcdata_iter_t iter)1563 kcdata_iter_type(kcdata_iter_t iter)
1564 {
1565 if ((iter.item->type & ~0xfu) == KCDATA_TYPE_ARRAY_PAD0) {
1566 return KCDATA_TYPE_ARRAY;
1567 } else {
1568 return iter.item->type;
1569 }
1570 }
1571
1572 static inline uint32_t
kcdata_calc_padding(uint32_t size)1573 kcdata_calc_padding(uint32_t size)
1574 {
1575 /* calculate number of bytes to add to size to get something divisible by 16 */
1576 return (-size) & 0xf;
1577 }
1578
1579 static inline uint32_t
kcdata_flags_get_padding(uint64_t flags)1580 kcdata_flags_get_padding(uint64_t flags)
1581 {
1582 return flags & KCDATA_FLAGS_STRUCT_PADDING_MASK;
1583 }
1584
1585 /* see comment above about has_padding */
1586 static inline int
kcdata_iter_is_legacy_item(kcdata_iter_t iter,uint32_t legacy_size)1587 kcdata_iter_is_legacy_item(kcdata_iter_t iter, uint32_t legacy_size)
1588 {
1589 uint32_t legacy_size_padded = legacy_size + kcdata_calc_padding(legacy_size);
1590 return iter.item->size == legacy_size_padded &&
1591 (iter.item->flags & (KCDATA_FLAGS_STRUCT_PADDING_MASK | KCDATA_FLAGS_STRUCT_HAS_PADDING)) == 0;
1592 }
1593
1594 static inline uint32_t
kcdata_iter_size(kcdata_iter_t iter)1595 kcdata_iter_size(kcdata_iter_t iter)
1596 {
1597 uint32_t legacy_size = 0;
1598
1599 switch (kcdata_iter_type(iter)) {
1600 case KCDATA_TYPE_ARRAY:
1601 case KCDATA_TYPE_CONTAINER_BEGIN:
1602 return iter.item->size;
1603 case STACKSHOT_KCTYPE_THREAD_SNAPSHOT: {
1604 legacy_size = sizeof(struct thread_snapshot_v2);
1605 if (kcdata_iter_is_legacy_item(iter, legacy_size)) {
1606 return legacy_size;
1607 }
1608
1609 goto not_legacy;
1610 }
1611 case STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO: {
1612 legacy_size = sizeof(struct dyld_uuid_info_64);
1613 if (kcdata_iter_is_legacy_item(iter, legacy_size)) {
1614 return legacy_size;
1615 }
1616
1617 goto not_legacy;
1618 }
1619 not_legacy:
1620 default:
1621 if (iter.item->size < kcdata_flags_get_padding(iter.item->flags)) {
1622 return 0;
1623 } else {
1624 return iter.item->size - kcdata_flags_get_padding(iter.item->flags);
1625 }
1626 }
1627 }
1628
1629 static inline uint64_t
kcdata_iter_flags(kcdata_iter_t iter)1630 kcdata_iter_flags(kcdata_iter_t iter)
1631 {
1632 return iter.item->flags;
1633 }
1634
1635 static inline
1636 void *
kcdata_iter_payload(kcdata_iter_t iter)1637 kcdata_iter_payload(kcdata_iter_t iter)
1638 {
1639 return &iter.item->data;
1640 }
1641
1642
1643 static inline
1644 uint32_t
kcdata_iter_array_elem_type(kcdata_iter_t iter)1645 kcdata_iter_array_elem_type(kcdata_iter_t iter)
1646 {
1647 return (iter.item->flags >> 32) & UINT32_MAX;
1648 }
1649
1650 static inline
1651 uint32_t
kcdata_iter_array_elem_count(kcdata_iter_t iter)1652 kcdata_iter_array_elem_count(kcdata_iter_t iter)
1653 {
1654 return (iter.item->flags) & UINT32_MAX;
1655 }
1656
1657 /* KCDATA_TYPE_ARRAY is ambiguous about the size of the array elements. Size is
1658 * calculated as total_size / elements_count, but total size got padded out to a
1659 * 16 byte alignment. New kernels will generate KCDATA_TYPE_ARRAY_PAD* instead
1660 * to explicitly tell us how much padding was used. Here we have a fixed, never
1661 * to be altered list of the sizes of array elements that were used before I
1662 * discovered this issue. If you find a KCDATA_TYPE_ARRAY that is not one of
1663 * these types, treat it as invalid data. */
1664
1665 static inline
1666 uint32_t
kcdata_iter_array_size_switch(kcdata_iter_t iter)1667 kcdata_iter_array_size_switch(kcdata_iter_t iter)
1668 {
1669 switch (kcdata_iter_array_elem_type(iter)) {
1670 case KCDATA_TYPE_LIBRARY_LOADINFO:
1671 return sizeof(struct dyld_uuid_info_32);
1672 case KCDATA_TYPE_LIBRARY_LOADINFO64:
1673 return sizeof(struct dyld_uuid_info_64);
1674 case STACKSHOT_KCTYPE_KERN_STACKFRAME:
1675 case STACKSHOT_KCTYPE_USER_STACKFRAME:
1676 return sizeof(struct stack_snapshot_frame32);
1677 case STACKSHOT_KCTYPE_KERN_STACKFRAME64:
1678 case STACKSHOT_KCTYPE_USER_STACKFRAME64:
1679 return sizeof(struct stack_snapshot_frame64);
1680 case STACKSHOT_KCTYPE_DONATING_PIDS:
1681 return sizeof(int32_t);
1682 case STACKSHOT_KCTYPE_THREAD_DELTA_SNAPSHOT:
1683 return sizeof(struct thread_delta_snapshot_v2);
1684 // This one is only here to make some unit tests work. It should be OK to
1685 // remove.
1686 case TASK_CRASHINFO_CRASHED_THREADID:
1687 return sizeof(uint64_t);
1688 default:
1689 return 0;
1690 }
1691 }
1692
1693 static inline
1694 int
kcdata_iter_array_valid(kcdata_iter_t iter)1695 kcdata_iter_array_valid(kcdata_iter_t iter)
1696 {
1697 if (!kcdata_iter_valid(iter)) {
1698 return 0;
1699 }
1700 if (kcdata_iter_type(iter) != KCDATA_TYPE_ARRAY) {
1701 return 0;
1702 }
1703 if (kcdata_iter_array_elem_count(iter) == 0) {
1704 return iter.item->size == 0;
1705 }
1706 if (iter.item->type == KCDATA_TYPE_ARRAY) {
1707 uint32_t elem_size = kcdata_iter_array_size_switch(iter);
1708 if (elem_size == 0) {
1709 return 0;
1710 }
1711 /* sizes get aligned to the nearest 16. */
1712 return
1713 kcdata_iter_array_elem_count(iter) <= iter.item->size / elem_size &&
1714 iter.item->size % kcdata_iter_array_elem_count(iter) < 16;
1715 } else {
1716 return
1717 (iter.item->type & 0xf) <= iter.item->size &&
1718 kcdata_iter_array_elem_count(iter) <= iter.item->size - (iter.item->type & 0xf) &&
1719 (iter.item->size - (iter.item->type & 0xf)) % kcdata_iter_array_elem_count(iter) == 0;
1720 }
1721 }
1722
1723
1724 static inline
1725 uint32_t
kcdata_iter_array_elem_size(kcdata_iter_t iter)1726 kcdata_iter_array_elem_size(kcdata_iter_t iter)
1727 {
1728 if (iter.item->type == KCDATA_TYPE_ARRAY) {
1729 return kcdata_iter_array_size_switch(iter);
1730 }
1731 if (kcdata_iter_array_elem_count(iter) == 0) {
1732 return 0;
1733 }
1734 return (iter.item->size - (iter.item->type & 0xf)) / kcdata_iter_array_elem_count(iter);
1735 }
1736
1737 static inline
1738 int
kcdata_iter_container_valid(kcdata_iter_t iter)1739 kcdata_iter_container_valid(kcdata_iter_t iter)
1740 {
1741 return
1742 kcdata_iter_valid(iter) &&
1743 kcdata_iter_type(iter) == KCDATA_TYPE_CONTAINER_BEGIN &&
1744 iter.item->size >= sizeof(uint32_t);
1745 }
1746
1747 static inline
1748 uint32_t
kcdata_iter_container_type(kcdata_iter_t iter)1749 kcdata_iter_container_type(kcdata_iter_t iter)
1750 {
1751 return *(uint32_t *) kcdata_iter_payload(iter);
1752 }
1753
1754 static inline
1755 uint64_t
kcdata_iter_container_id(kcdata_iter_t iter)1756 kcdata_iter_container_id(kcdata_iter_t iter)
1757 {
1758 return iter.item->flags;
1759 }
1760
1761
1762 #define KCDATA_ITER_FOREACH(iter) for(; kcdata_iter_valid(iter) && iter.item->type != KCDATA_TYPE_BUFFER_END; iter = kcdata_iter_next(iter))
1763 #define KCDATA_ITER_FOREACH_FAILED(iter) (!kcdata_iter_valid(iter) || (iter).item->type != KCDATA_TYPE_BUFFER_END)
1764
1765 static inline
1766 kcdata_iter_t
kcdata_iter_find_type(kcdata_iter_t iter,uint32_t type)1767 kcdata_iter_find_type(kcdata_iter_t iter, uint32_t type)
1768 {
1769 KCDATA_ITER_FOREACH(iter)
1770 {
1771 if (kcdata_iter_type(iter) == type) {
1772 return iter;
1773 }
1774 }
1775 return kcdata_invalid_iter;
1776 }
1777
1778 static inline
1779 int
kcdata_iter_data_with_desc_valid(kcdata_iter_t iter,uint32_t minsize)1780 kcdata_iter_data_with_desc_valid(kcdata_iter_t iter, uint32_t minsize)
1781 {
1782 return
1783 kcdata_iter_valid(iter) &&
1784 kcdata_iter_size(iter) >= KCDATA_DESC_MAXLEN + minsize &&
1785 ((char*)kcdata_iter_payload(iter))[KCDATA_DESC_MAXLEN - 1] == 0;
1786 }
1787
1788 static inline
1789 char *
kcdata_iter_string(kcdata_iter_t iter,uint32_t offset)1790 kcdata_iter_string(kcdata_iter_t iter, uint32_t offset)
1791 {
1792 if (offset > kcdata_iter_size(iter)) {
1793 return NULL;
1794 }
1795 uint32_t maxlen = kcdata_iter_size(iter) - offset;
1796 char *s = ((char*)kcdata_iter_payload(iter)) + offset;
1797 if (strnlen(s, maxlen) < maxlen) {
1798 return s;
1799 } else {
1800 return NULL;
1801 }
1802 }
1803
1804 static inline void
kcdata_iter_get_data_with_desc(kcdata_iter_t iter,char ** desc_ptr,void ** data_ptr,uint32_t * size_ptr)1805 kcdata_iter_get_data_with_desc(kcdata_iter_t iter, char **desc_ptr, void **data_ptr, uint32_t *size_ptr)
1806 {
1807 if (desc_ptr) {
1808 *desc_ptr = (char *)kcdata_iter_payload(iter);
1809 }
1810 if (data_ptr) {
1811 *data_ptr = (void *)((uintptr_t)kcdata_iter_payload(iter) + KCDATA_DESC_MAXLEN);
1812 }
1813 if (size_ptr) {
1814 *size_ptr = kcdata_iter_size(iter) - KCDATA_DESC_MAXLEN;
1815 }
1816 }
1817
1818 #endif /* !__has_ptrcheck */
1819 #endif
1820