macosiokitdarwinkernel-extension

possible to display debug KEXT symbols in the panic log by default?


Getting back into the swing of things with IOKit (the USB changes that came in with El Capitan seemed pretty sweeping), I'm finding that debugging kext panic logs is a pain in the rear end.

While I'm developing and testing, is it possible to leave symbols IN the kernel extension so that they will print out in the panic.log backtrace?

For my debug KEXT, I tried changing both the "Strip Debug Symbols During Copy" setting (a.k.a. COPY_PHASE_STRIP) and the "Strip Linked Product" (a.k.a. STRIP_INSTALLED_PRODUCT) target settings to NO.

I'm still getting unsymbolicated output in my panic logs. Am I simply out of luck where it's something MacOS simply doesn't do, or is there another setting I am missing?

I.E. instead of:

Anonymous UUID:       A8A49864-0847-0BFD-AE70-67EE1BA71682

Fri Dec 18 07:43:19 2015

*** Panic Report ***
panic(cpu 3 caller 0xffffff8013d98fd9): Kernel trap at 0xffffff7f96f00056, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x0000000000000018, CR3: 0x000000022c105000, CR4: 0x0000000000002660
RAX: 0x00000000c0a8bc01, RBX: 0x0000000000000000, RCX: 0x0000000000000000, RDX: 0x0000000000003dbd
RSP: 0xffffff811dd2b810, RBP: 0xffffff811dd2b8a0, RSI: 0x0000000027a3aee5, RDI: 0x00000000c0a8bc01
R8:  0x0000000000000000, R9:  0x0000000000000000, R10: 0x0000000000000000, R11: 0x0000000000000000
R12: 0xffffff811799b400, R13: 0xffffff8025bb6530, R14: 0x000000000000012c, R15: 0xffffff802a051980
RFL: 0x0000000000010296, RIP: 0xffffff7f96f00056, CS:  0x0000000000000008, SS:  0x0000000000000010
Fault CR2: 0x0000000000000018, Error code: 0x0000000000000000, Fault CPU: 0x3, PL: 0

Backtrace (CPU 3), Frame : Return Address
0xffffff811dd2b4a0 : 0xffffff8013c838c7 
0xffffff811dd2b520 : 0xffffff8013d98fd9 
0xffffff811dd2b700 : 0xffffff8013db7d83 
0xffffff811dd2b720 : 0xffffff7f96f00056 
0xffffff811dd2b8a0 : 0xffffff7f96f00571 
0xffffff811dd2b9a0 : 0xffffff7f96f01490 
0xffffff811dd2ba50 : 0xffffff7f96efaf85 
0xffffff811dd2bab0 : 0xffffff7f94f8ea66 
0xffffff811dd2baf0 : 0xffffff7f94f8e795 
0xffffff811dd2bb50 : 0xffffff7f94f8e9c8 
0xffffff811dd2bb90 : 0xffffff8013f2da05 
0xffffff811dd2bcc0 : 0xffffff8013f16a0e 
0xffffff811dd2bd50 : 0xffffff8013ef5ed0 
0xffffff811dd2bdd0 : 0xffffff8013eeab70 
0xffffff811dd2be50 : 0xffffff801419b207 
0xffffff811dd2bef0 : 0xffffff801419b03e 
0xffffff811dd2bf50 : 0xffffff80141fcf9f 
0xffffff811dd2bfb0 : 0xffffff8013db8586 

I'd love to see:

Anonymous UUID:       A8A49864-0847-0BFD-AE70-67EE1BA71682

Fri Dec 18 07:43:19 2015

*** Panic Report ***
panic(cpu 3 caller 0xffffff8013d98fd9): Kernel trap at 0xffffff7f96f00056, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x0000000000000018, CR3: 0x000000022c105000, CR4: 0x0000000000002660
Fault CR2: 0x0000000000000018, Error code: 0x0000000000000000, Fault CPU: 0x3, PL: 0

Backtrace (CPU 3), Frame : Return Address
MyWorkOfArtKext::doSomething : 0xffffff8013c838c7 
MyWorkOfArtKext::start : 0xffffff8013d98fd9 

Solution

  • Assuming you don't explicitly strip symbols, they'll stay in your kext binary. The problem is the kernel's dynamic loader doesn't retain them in memory. You can however change that by setting the keepsyms=1 kernel argument (either via the nvram boot-args variable, or via com.apple.Boot.plist in /Library/Preferences/SystemConfiguration/) - if you set that flag, the kernel will retain symbols for kexts and the kernel itself, and symbolicate stack traces in panic logs.

    Note that you'll still get the C style symbol names, so you'll need to unmangle any C++ function names using the c++filt command.

    Update: keepsyms=1 does not seem to be respected for Apple Silicon/arm64e kernels, unfortunately.