search

steven-michaud / HookCase

Tool for reverse engineering macOS/OS X
746 stars 110 forks source link

Intermittent double fault kernel panics #42

Open sdwannfv opened 1 year ago

sdwannfv commented 1 year ago 
panic(cpu 4 caller 0xffffff800ffcfa67): Double fault at 0xffffff800ffc3424, registers:
CR0: 0x000000008001003b, CR2: 0xffffffcb3eedfff8, CR3: 0x000000000e6f51d5, CR4: 0x00000000003626e0
RAX: 0x0000000000000001, RBX: 0x0000000000000000, RCX: 0x0000000000000001, RDX: 0x0000000000011bed
RSP: 0xffffffcb3eee0000, RBP: 0xffffffcb3eee0000, RSI: 0xffffffb0c0837000, RDI: 0xffffffa02cbcb010
R8:  0xffffff800ffc3390, R9:  0xffffffcb3eee0290, R10: 0xffffffcb3eee02b8, R11: 0xffffff8b636e9230
R12: 0x0400000000000000, R13: 0xffffffb0c0837000, R14: 0x0000000000011bed, R15: 0x0000000000000000
RFL: 0x0000000000010246, RIP: 0xffffff800ffc3424, CS:  0x0000000000000008, SS:  0x0000000000000000
Error code: 0x0000000000000000
 @trap_native.c:168
Panicked task 0xffffff902a3ab380: 1 threads: pid 1729: stat
Backtrace (CPU 4), panicked thread: 0xffffff8b5fb40000, Frame : Return Address
0xffffff800fd0e240 : 0xffffff800fe7cead mach_kernel : _handle_debugger_trap + 0x41d
0xffffff800fd0e290 : 0xffffff800ffdf5d6 mach_kernel : _kdp_i386_trap + 0x116
0xffffff800fd0e2d0 : 0xffffff800ffce943 mach_kernel : _kernel_trap + 0x4d3
0xffffff800fd0e320 : 0xffffff800fe1ca70 mach_kernel : _return_from_trap + 0xe0
0xffffff800fd0e340 : 0xffffff800fe7d27d mach_kernel : _DebuggerTrapWithState + 0xad
0xffffff800fd0e460 : 0xffffff800fe7ca36 mach_kernel : _panic_trap_to_debugger + 0x2b6
0xffffff800fd0e4c0 : 0xffffff8010714ed3 mach_kernel : _panic + 0x84
0xffffff800fd0e5b0 : 0xffffff800ffcfa67 mach_kernel : _sync_iss_to_iks_unconditionally + 0x167
0xffffff800fd0e6c0 : 0xffffff801071ccb8 mach_kernel : _panic_double_fault64 + 0x27
0xffffff800fd0e6d0 : 0xffffff800fe1d2ef mach_kernel : _hndl_double_fault + 0xf
0xffffffcb3eee0000 : 0xffffff8012a4aaf6 com.apple.iokit.IOPCIFamily : __ZN8AppleVTD10space_freeEP9vtd_spacejj + 0x44
0xffffffcb3eee0040 : 0xffffff8012a4a724 com.apple.iokit.IOPCIFamily : __ZN8AppleVTD9checkFreeEP9vtd_spacej + 0xca
0xffffffcb3eee0080 : 0xffffff8012a4a1a7 com.apple.iokit.IOPCIFamily : __ZN8AppleVTD11space_allocEP9vtd_spacejjjPK21IODMAMapSpecificationPK13upl_page_info + 0x125
0xffffffcb3eee0120 : 0xffffff8012a4cbc9 com.apple.iokit.IOPCIFamily : __ZN8AppleVTD14spaceMapMemoryEP9vtd_spaceP18IOMemoryDescriptoryyjPK21IODMAMapSpecificationP12IODMACommandPK16IODMAMapPageListPySC_ + 0x23b
0xffffffcb3eee0220 : 0xffffff8012a4d157 com.apple.iokit.IOPCIFamily : __ZN8AppleVTD13iovmMapMemoryEP18IOMemoryDescriptoryyjPK21IODMAMapSpecificationP12IODMACommandPK16IODMAMapPageListPySA_ + 0x43
0xffffffcb3eee0260 : 0xffffff801065bdbf mach_kernel : __ZN25IOGeneralMemoryDescriptor6dmaMapEP8IOMapperP18IOMemoryDescriptorP12IODMACommandPK21IODMAMapSpecificationyyPyS9_ + 0x1df
0xffffffcb3eee02f0 : 0xffffff8010657713 mach_kernel : __ZNK25IOGeneralMemoryDescriptor19dmaCommandOperationEjPvj + 0x463
0xffffffcb3eee03a0 : 0xffffff8010657dba mach_kernel : __ZN25IOGeneralMemoryDescriptor18getPhysicalSegmentEyPyj + 0x1da
0xffffffcb3eee0480 : 0xffffff801065b63c mach_kernel : __ZN18IOMemoryDescriptor26ktraceEmitPhysicalSegmentsEv + 0x2ac
0xffffffcb3eee0530 : 0xffffff8010658163 mach_kernel : __ZN25IOGeneralMemoryDescriptor7prepareEj + 0x103
0xffffffcb3eee0560 : 0xffffff8012b8a462 com.apple.iokit.IOStorageFamily : __ZL11dkreadwritePv9dkrtype_t + 0x44a
0xffffffcb3eee0620 : 0xffffff8010168468 mach_kernel : _spec_strategy + 0x448
0xffffffcb3eee0680 : 0xffffff801015eb92 mach_kernel : _VNOP_STRATEGY + 0x42
0xffffffcb3eee06c0 : 0xffffff8013110e07 com.apple.filesystems.apfs : _nx_bio_doread + 0x1b5
0xffffffcb3eee0710 : 0xffffff8013110871 com.apple.filesystems.apfs : __vnode_dev_read + 0x2a5
0xffffffcb3eee07a0 : 0xffffff801310f562 com.apple.filesystems.apfs : _vnode_dev_read + 0x15
0xffffffcb3eee07c0 : 0xffffff801322a9cc com.apple.filesystems.apfs : _obj_read + 0x16a
0xffffffcb3eee0810 : 0xffffff8013229c2d com.apple.filesystems.apfs : _obj_get + 0x76d
0xffffffcb3eee0930 : 0xffffff8013201095 com.apple.filesystems.apfs : _btree_node_get_internal + 0x1a3
0xffffffcb3eee0a20 : 0xffffff8013200ee3 com.apple.filesystems.apfs : _btree_node_get + 0x76
0xffffffcb3eee0aa0 : 0xffffff801320b91e com.apple.filesystems.apfs : __bt_lookup_variant + 0x3c4
0xffffffcb3eee0bc0 : 0xffffff80131f5bb9 com.apple.filesystems.apfs : _tree_lookup_le + 0x2c
0xffffffcb3eee0bf0 : 0xffffff80131c733a com.apple.filesystems.apfs : _lookup_file_extent + 0x233
0xffffffcb3eee0c90 : 0xffffff801314b7dc com.apple.filesystems.apfs : _apfs_vnop_blockmap + 0xbd5
0xffffffcb3eee0df0 : 0xffffff801015eaf1 mach_kernel : _VNOP_BLOCKMAP + 0xf1
0xffffffcb3eee0e80 : 0xffffff8010109a75 mach_kernel : _cluster_pageout_ext + 0x875
0xffffffcb3eee1000 : 0xffffff8010110898 mach_kernel : _cluster_read_ext + 0xf08
0xffffffcb3eee11e0 : 0xffffff801010fb04 mach_kernel : _cluster_read_ext + 0x174
0xffffffcb3eee1250 : 0xffffff80131569a4 com.apple.filesystems.apfs : _apfs_nstream_read + 0x295
0xffffffcb3eee1320 : 0xffffff801315791c com.apple.filesystems.apfs : _apfs_inode_getxattr + 0x1a7
0xffffffcb3eee1400 : 0xffffff801315776a com.apple.filesystems.apfs : _apfs_vnop_getxattr + 0xa3
0xffffffcb3eee1430 : 0xffffff801015e5ca mach_kernel : _VNOP_GETXATTR + 0x5a
0xffffffcb3eee14a0 : 0xffffff80113f1e5b com.apple.AppleFSCompression.AppleFSCompressionTypeZlib : _compression_decode_buffer + 0xc3d
0xffffffcb3eee1500 : 0xffffff80113f21ae com.apple.AppleFSCompression.AppleFSCompressionTypeZlib : _compression_decode_buffer + 0xf90
0xffffffcb3eee15c0 : 0xffffff80113f1b25 com.apple.AppleFSCompression.AppleFSCompressionTypeZlib : _compression_decode_buffer + 0x907
0xffffffcb3eee1650 : 0xffffff8010172e0e mach_kernel : _decmpfs_pagein_compressed + 0x83e
0xffffffcb3eee17d0 : 0xffffff801317314b com.apple.filesystems.apfs : _apfs_pagein_with_verification + 0x386
0xffffffcb3eee1900 : 0xffffff8013172c4d com.apple.filesystems.apfs : _apfs_pagein + 0x816
0xffffffcb3eee1a00 : 0xffffff80104fa4b9 mach_kernel : _vnode_pagein + 0x689
0xffffffcb3eee1b00 : 0xffffff800ff10878 mach_kernel : _vnode_pager_cluster_read + 0x48
0xffffffcb3eee1b60 : 0xffffff800ff259e3 mach_kernel : _vm_fault_page + 0x963
0xffffffcb3eee1c80 : 0xffffff800ff21604 mach_kernel : _vm_fault$XNU_INTERNAL + 0x16e4
0xffffffcb3eee1f10 : 0xffffff800ffce6de mach_kernel : _kernel_trap + 0x26e
0xffffffcb3eee1f80 : 0xffffff800fe1ca70 mach_kernel : _return_from_trap + 0xe0
0xffffffcb3eee1fa0 : 0xffffff800fe1bdeb mach_kernel : __bcopy + 0xb
0xffffffcb3eee2120 : 0xffffff800ff2d8a3 mach_kernel : _kmem_free + 0x183
0xffffffcb3eee2160 : 0xffffff800ff3ff6e mach_kernel : _vm_map_copyin_internal + 0x18e
0xffffffcb3eee2270 : 0xffffff7fa9fe1918 org.smichaud.HookCase.kext : __Z15get_module_infoP4procPKcyP12_module_info + 0x778
0xffffffcb3eee3830 : 0xffffff7fa9fe69db org.smichaud.HookCase.kext : __Z15maybe_cast_hookP4proc + 0x64b
0xffffffcb3eee5dd0 : 0xffffff7fa9feeedb org.smichaud.HookCase.kext : __Z28thread_bootstrap_return_hookP17x86_saved_state_tP10_kern_hook + 0xbb
0xffffffcb3eee5e10 : 0xffffff7fa9fe52cb org.smichaud.HookCase.kext : __Z12do_kern_hookP17x86_saved_state_t + 0xcb
0xffffffcb3eee5e50 : 0xffffff7fa9ff1785 org.smichaud.HookCase.kext : _handle_kernel_hc_int1 + 0x15
0xffffffcb3eee5e70 : 0xffffff7fa9fd34f5 org.smichaud.HookCase.kext : _kernel_trampoline + 0x25
0xffffffcb3eee5fa0 : 0xffffff800fe1c19e mach_kernel : _call_continuation + 0x2e
      Kernel Extensions in backtrace:
         com.apple.iokit.IOPCIFamily(2.9)[27B9FAE8-483C-3208-B216-3133690B25AC]@0xffffff8012a36000->0xffffff8012a62fff
         com.apple.iokit.IOStorageFamily(2.1)[9911895E-CCD2-3899-AB5C-D500919F59AA]@0xffffff8012b7b000->0xffffff8012b91fff
         com.apple.filesystems.apfs(1934.141.2)[2C7FD87C-9D3C-3B49-BB05-4B0EAC7A1183]@0xffffff801310b000->0xffffff8013289fff
            dependency: com.apple.driver.AppleEFINVRAM(2.1)[5886368A-14F0-320E-8427-C8EB472E76B7]@0xffffff80113b2000->0xffffff80113bbfff
            dependency: com.apple.driver.AppleEffaceableStorage(1.0)[DED354B0-1079-3746-90DC-DDF419DEA2D4]@0xffffff80113c8000->0xffffff80113cdfff
            dependency: com.apple.iokit.CoreAnalyticsFamily(1)[D9B274C7-317C-3CA7-B51B-F6F60AABBBD5]@0xffffff80118d3000->0xffffff80118dafff
            dependency: com.apple.iokit.IOStorageFamily(2.1)[9911895E-CCD2-3899-AB5C-D500919F59AA]@0xffffff8012b7b000->0xffffff8012b91fff
            dependency: com.apple.kec.corecrypto(12.0)[D5F1BD46-6F9D-3F71-982E-15DA8EDA4FC1]@0xffffff80132c3000->0xffffff8013343fff
            dependency: com.apple.security.AppleImage4(4.2.0)[57D034A4-4514-3C5F-90ED-F0CA0199E865]@0xffffff801144f000->0xffffff8011467fff

Process name corresponding to current thread (0xffffff8b5fb40000): stat
Boot args: keepsyms=1 kernel_stack_pages=6  chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
21G320

Kernel version:
Darwin Kernel Version 21.6.0: Sun Nov  6 23:31:16 PST 2022; root:xnu-8020.240.14~1/RELEASE_X86_64
Kernel UUID: F831C932-31CA-3F2C-9E4C-2304C5641587
KernelCache slide: 0x000000000fc00000
KernelCache base:  0xffffff800fe00000
Kernel slide:      0x000000000fc10000
Kernel text base:  0xffffff800fe10000
__HIB  text base: 0xffffff800fd00000
System model name: MacBookPro15,2 (Mac-827FB448E656EC26)
System shutdown begun: NO
Hibernation exit count: 0

System uptime in nanoseconds: 1691739115792
Last Sleep:           absolute           base_tsc          base_nano
  Uptime  : 0x00000189e38253cf
  Sleep   : 0x0000000000000000 0x0000000000000000 0x0000000000000000
  Wake    : 0x0000000000000000 0x00000009bcbf4432 0x0000000000000000
Compressor Info: 2% of compressed pages limit (OK) and 2% of segments limit (OK) with 1 swapfiles and OK swap space
Zone info:
  Zone map: 0xffffff802cc39000 - 0xffffffa02cc39000
  . PGZ   : 0xffffff802cc39000 - 0xffffff802dc3a000
  . VM    : 0xffffff802dc3a000 - 0xffffff84fa6a0000
  . RO    : 0xffffff84fa6a0000 - 0xffffff8693f6c000
  . GEN0  : 0xffffff8693f6c000 - 0xffffff8b609d2000
  . GEN1  : 0xffffff8b609d2000 - 0xffffff902d438000
  . GEN2  : 0xffffff902d438000 - 0xffffff94f9e9e000
  . GEN3  : 0xffffff94f9e9e000 - 0xffffff99c6905000
  . DATA  : 0xffffff99c6905000 - 0xffffffa02cc39000
  Metadata: 0xffffffb099689000 - 0xffffffb0b9689000
  Bitmaps : 0xffffffb0b9689000 - 0xffffffb0bc689000

last started kext at 740128815770: org.smichaud.HookCase.kext   7.1.0 (addr 0xffffff7fa9fd2000, size 135168)
loaded kexts:
org.smichaud.HookCase.kext  7.1.0
@filesystems.smbfs  4.0
>AGPM   129
>!APlatformEnabler  2.7.0d0
>X86PlatformShim    1.0.0
@filesystems.autofs 3.0
>!ATopCaseHIDEventDriver    5450.8
>!AHIDALSService    1
>!AUpstreamUserClient   3.6.9
>!A!IKBLGraphics    18.0.8
>!AGraphicsDevicePolicy 6.5.7
>!AGFXHDA   140.3
@AGDCPluginDisplayMetrics   6.5.7
>!ABridgeAudio!C    240.6
>pmtelemetry    1
|IOUserEthernet 1.0.1
>usb.!UUserHCI  1
>AGDCBacklightControl   6.5.7
>!ABacklight    180.8
>!AMCCSControl  1.16
>!AFIVRDriver   4.1.0
>ACPI_SMC_PlatformPlugin    1.0.0
>!A!ICFLGraphicsFramebuffer 18.0.8
>BridgeAudioCommunication   240.6
>!AAVEBridge    6.1
>!AHV   1
>!ADiskImages2  126.141.2
>!A!IPCHPMC 2.0.1
>!A!ISlowAdaptiveClocking   4.0.0
>!AThunderboltIP    4.0.3
@UVCService 1
|SCSITaskUserClient 456.140.3
>BCMWLANFirmware4387.Hashstore  1
>BCMWLANFirmware4378.Hashstore  1
>BCMWLANFirmware4377.Hashstore  1
>BCMWLANFirmware4364.Hashstore  1
>BCMWLANFirmware4355.Hashstore  1
>!AFileSystemDriver 3.0.1
@filesystems.tmpfs  1
@filesystems.lifs   1
@filesystems.hfs.kext   583.100.10
@BootCache  40
@!AFSCompression.!AFSCompressionTypeZlib    1.0.0
@!AFSCompression.!AFSCompressionTypeDataless    1.0.0d1
@filesystems.apfs   1934.141.2
>!ABCMWLANBusInterfacePCIeMac   1
@private.KextAudit  1.0
>!ASmartBatteryManager  161.0.0
>!AACPIButtons  6.1
>!ASMBIOS   2.1
>!AACPIEC   6.1
>!AAPIC 1.7
@!ASystemPolicy 2.0.0
@nke.applicationfirewall    402
|IOKitRegistryCompatibility 1
|EndpointSecurity   1
@Dont_Steal_Mac_OS_X    7.0.0
@kec.!AEncryptedArchive 1
>driverkit.serial   6.0.0
@kext.triggers  1.0
>!AHIDKeyboard  228.2
>!AActuatorDriver   5460.1
>!AMultitouchDriver 5460.1
>!AInputDeviceSupport   5460.1
>!AHS!BDriver   5450.8
>IO!BHIDDriver  9.0.0
>!AGraphicsControl  6.5.7
>!AHDA!C    340.2
|IOHDA!F    340.2
>!A!ILpssUARTv1 3.0.60
>!A!ILpssUARTCommon 3.0.60
>!AOnboardSerial    1.0
>!UAudio    416.2
|IOAudio!F  340.2
@vecLib.kext    1.2.0
>!AAudioClockLibs   140.1
|IO!BSerialManager  9.0.0
|IO!BPacketLogger   9.0.0
|IO!BHost!CUSBTransport 9.0.0
|IO!BHost!CUARTTransport    9.0.0
>!ABacklightExpert  1.1.0
|IONDRVSupport  597
>!ASMBus!C  1.0.18d1
>!ASMBusPCI 1.0.14d1
>IOPlatformPluginLegacy 1.0.0
>X86PlatformPlugin  1.0.0
|IO!BHost!CTransport    9.0.0
>IO!BHost!CPCIeTransport    9.0.0
|IOAccelerator!F2   462.8
|IOAVB!F    1040.6
@plugin.IOgPTPPlugin    1040.3
|IOEthernetAVB!C    1.1.0
|CSR!BHost!CUSBTransport    9.0.0
|Broadcom!BHost!CUSBTransport   9.0.0
|Broadcom!B20703USBTransport    9.0.0
>!AIPAppender   1.0
>IOPlatformPlugin!F 6.0.0d8
@!AGPUWrangler  6.5.7
@!AGraphicsDeviceControl    6.5.7
|IOGraphics!F   597
|IOSlowAdaptiveClocking!F   1.0.0
>!AThunderboltEDMSink   5.0.3
>!AThunderboltDPOutAdapter  8.5.1
>usb.IOUSBHostHIDDevice 1.2
>usb.cdc.ecm    5.0.0
>usb.cdc.ncm    5.0.0
>usb.!UHub  1.2
>usb.cdc    5.0.0
>usb.networking 5.0.0
>usb.!UHostCompositeDevice  1.2
>!AThunderboltPCIDownAdapter    4.1.1
>!AThunderboltDPInAdapter   8.5.1
>!AThunderboltDPAdapter!F   8.5.1
>!AHPM  3.4.4
>!A!ILpssI2C!C  3.0.60
>!A!ILpssDmac   3.0.60
>!ABSDKextStarter   3
|IOSurface  302.14
@filesystems.hfs.encodings.kext 1
>!AXsanScheme   3
>!AThunderboltNHI   7.2.81
|IOThunderbolt!F    9.3.3
>usb.!UVHCIBCE  1.2
>usb.!UVHCICommonBCE    1.0
>usb.!UVHCI 1.2
>usb.!UVHCICommon   1.0
>!AEffaceableNOR    1.0
|IOBufferCopy!C 1.1.0
|IOBufferCopyEngine!F   1
|IONVMe!F   2.1.0
>!ABCMWLANCoreMac   1.0.0
|IOSerial!F 11
|IO80211!F  1200.12.2b2
|IOSkywalk!F    1.0
>mDNSOffloadUserClient  1.0.1b8
>IOImageLoader  1.0.0
>!AOLYHALMac    1
>corecapture    1.0.4
>usb.!UHostPacketFilter 1.0
|IOUSB!F    900.4.2
>!A!ILpssI2C    3.0.60
>!A!ILpssGspi   3.0.60
>usb.!UXHCIPCI  1.2
>usb.!UXHCI 1.2
>!AEFINVRAM 2.1
>!AEFIRuntime   2.1
>!ASMCRTC   1.0
|IOSMBus!F  1.1
|IOHID!F    2.0.0
|IOTimeSync!F   1040.3
|IONetworking!F 3.4
>DiskImages 493.0.0
|IO!B!F 9.0.0
|IOReport!F 47
$quarantine 4
$sandbox    300.0
@kext.!AMatch   1.0.0d1
|CoreAnalytics!F    1
>!ASSE  1.0
>!AKeyStore 2
>!UTDM  533.120.2
|IOUSBMass!SDriver  210.120.3
|IOSCSIBlockCommandsDevice  456.140.3
|IO!S!F 2.1
|IOSCSIArchitectureModel!F  456.140.3
>!AMobileFileIntegrity  1.0.5
$!AImage4   4.2.0
@kext.CoreTrust 1
>!AFDEKeyStore  28.30
>!AEffaceable!S 1.0
>!ACredentialManager    1.0
>KernelRelayHost    1
|IOUSBHost!F    1.2
>!UHostMergeProperties  1.2
>usb.!UCommon   1.0
>!ABusPower!C   1.0
>!ASEPManager   1.0.1
>IOSlaveProcessor   1
>!AACPIPlatform 6.1
>!ASMC  3.1.9
|IOPCI!F    2.9
|IOACPI!F   1.4
>watchdog   1
@kec.pthread    1
@kec.Libm   1
@kec.corecrypto 12.0
steven-michaud commented 1 year ago

I've never seen anything like this. It happens so deep in system code that it probably isn't due to a bug in HookCase.

Please provide as much information as possible about what you were doing when this kernel panic happened. Were you trying to load a hook library? If so please post its source code, and let me know which process you were loading it into?

The stack trace indicates the OS was working with compressed files, and checking the amount of free space on some drive. How much free space do you have on your boot drive?

Is your Mac by any chance a Hackintosh? :-)

sdwannfv commented 1 year ago

not Hackintosh, but my macos system is on external udisk, maybe it cause this, i will put more message if i can reproduce it

steven-michaud commented 1 year ago

I've finally figured out these kernel panics. You're using the OpenCore Legacy Patcher. For now at least, HookCase is incompatible with it.

I just used OCLP myself to install macOS Ventura 13.3.1 on a machine that Apple says doesn't support Ventura -- a "mid-2015 MacBook Pro", model id MacBookPro11,5. I get exactly the same kernel panics. I haven't (yet) found a workaround.

steven-michaud commented 1 year ago

Actually, I'm no longer sure you're using the OpenCore Legacy Patcher. Your MacBook Pro (model id MacBookPro15,2) supports macOS 12 natively, so you don't have any need for OCLP.

Instead you have kernel boot-args (chunklist-security-epoch=0 -chunklist-no-rev2-dev) that are associated with lots of kernel panics, most of which have nothing to do with HookCase. Do you know where these boot-args come from? I haven't (yet) been able to find out on my own. They're not set on the Mac where I'm using OCLP, and they don't appear to be related to it.

To see the other kernel panics, do a search on "chunklist-security-epoch=0".

Here are a couple that are symbolicated:

https://openzfsonosx.org/forum/viewtopic.php?f=26&t=3669 https://github.com/OpenIntelWireless/IntelBluetoothFirmware/issues/335

steven-michaud commented 1 year ago

I've found a reference to those puzzling kernel boot-args, in source code for macOS 12's xnu kernel. They seem to belong to Apple's boot.efi. I still don't know what they mean, but it's pretty clear they're Apple-native. Though it's possible they were set by third-party software -- for example OpenCore.

/*
 * Boot argument for disabling trust in rev2 development key(s)
 * Set by boot.efi
 */
#define CHUNKLIST_NO_REV2_DEV           "-chunklist-no-rev2-dev"

/*
 * Boot argument for disabling trust in rev1 chunklists
 * Set by boot.efi
 */
#define CHUNKLIST_NO_REV1               "-chunklist-no-rev1"

/*
 * Boot argument for obtaining current security epoch
 * Set by boot.efi
 */
#define CHUNKLIST_SECURITY_EPOCH        "chunklist-security-epoch"
#define CHUNKLIST_MIN_SECURITY_EPOCH    0
steven-michaud commented 1 year ago

I'm recategorizing this yet again. I no longer believe you're using OCLP, though I can't help but think there's something nonstandard about your setup (which might explain your "chunklist" kernel boot args).

I'm about to release a new version of HookCase that works with OCLP. I found I needed use a kernel_stack_pages=16 boot arg. If you see this panic again, you should try that. Please also try the new version, once I release it.

steven-michaud commented 1 year ago

I've just released HookCase 7.3. Please try it out. If you really are using OCLP, see Using the OpenCore Legacy Patcher for detailed instructions on how to set kernel_stack_pages.

steven-michaud commented 1 year ago

It turns out that "chunklist-security-epoch=0" and similar boot args are unrelated to this bug. I now always see them on macOS 11 and 12 -- whenever I've booted from real SSDs (internal or external). The only time I don't see them is when I'm running these versions of macOS in a virtual machine (where I've booted from virtual hardware).

Previously I used nvram boot-args to detect my kernel boot args. But it reports only the ones you've set explicitly (using sudo nvram boot-args=[whatever]). To see your actual boot args run sysctl kern.bootargs.

They seem to have disappeared with macOS 13. I don't know why.