Loading...
libkern/c++/OSKext.cpp xnu-12377.101.15 xnu-8792.41.9
--- xnu/xnu-12377.101.15/libkern/c++/OSKext.cpp
+++ xnu/xnu-8792.41.9/libkern/c++/OSKext.cpp
@@ -36,7 +36,7 @@
 #include <firehose/tracepoint_private.h>
 #include <firehose/chunk_private.h>
 #include <os/firehose_buffer_private.h>
-#include <vm/vm_map_xnu.h>
+#include <vm/vm_map.h>
 #include <kextd/kextd_mach.h>
 #include <libkern/kernel_mach_header.h>
 #include <libkern/kext_panic_report.h>
@@ -50,9 +50,7 @@
 #include <mach/mach_time.h>
 #include <uuid/uuid.h>
 #include <sys/random.h>
-#include <sys/reboot.h>
 #include <pexpert/pexpert.h>
-#include <pexpert/device_tree.h>
 
 #include <sys/pgo.h>
 
@@ -68,7 +66,7 @@
 #include <security/mac_framework.h>
 #endif
 
-#include <vm/vm_kern_xnu.h>
+#include <vm/vm_kern.h>
 #include <sys/sysctl.h>
 #include <kern/task.h>
 #include <os/cpp_util.h>
@@ -88,10 +86,6 @@
 #include <IOKit/IOPlatformExpert.h>
 
 #include <san/kasan.h>
-
-#if CONFIG_SPTM
-#include <arm64/sptm/sptm.h>
-#endif
 
 #if PRAGMA_MARK
 #pragma mark External & Internal Function Protos
@@ -122,6 +116,7 @@
 
 extern unsigned long gVirtBase;
 extern unsigned long gPhysBase;
+extern vm_map_t g_kext_map;
 
 bool pageableKCloaded = false;
 bool auxKCloaded = false;
@@ -363,16 +358,6 @@
  **********/
 static OSKext          * sKernelKext             = NULL;
 
-/* Load Tag IDs used by statically loaded binaries (e.g, the kernel itself). */
-enum : uint32_t {
-	kOSKextKernelLoadTag = 0,
-#if CONFIG_SPTM
-	kOSKextSPTMLoadTag   = 1,
-	kOSKextTXMLoadTag    = 2,
-#endif /* CONFIG_SPTM */
-	kOSKextLoadTagCount
-};
-
 /* Set up a fake kmod_info struct for the kernel.
  * It's used in OSRuntime.cpp to call OSRuntimeInitializeCPP()
  * before OSKext is initialized; that call only needs the name
@@ -388,7 +373,7 @@
 kmod_info_t g_kernel_kmod_info = {
 	.next =            NULL,
 	.info_version =    KMOD_INFO_VERSION,
-	.id =              kOSKextKernelLoadTag,   // loadTag: kernel is always 0
+	.id =              0,             // loadTag: kernel is always 0
 	.name =            kOSKextKernelIdentifier,// bundle identifier
 	.version =         "0",           // filled in in OSKext::initialize()
 	.reference_count = -1,            // never adjusted; kernel never unloads
@@ -399,39 +384,6 @@
 	.start =           NULL,
 	.stop =            NULL
 };
-
-#if CONFIG_SPTM
-/* The SPTM and TXM need fake kmod structures just like the kernel. */
-kmod_info_t g_sptm_kmod_info = {
-	.next =            NULL,
-	.info_version =    KMOD_INFO_VERSION,
-	.id =              kOSKextSPTMLoadTag,   // Always one after the kernel
-	.name =            kOSKextSPTMIdentifier,// bundle identifier
-	.version =         "0",           // filled in by OSKext::initialize()
-	.reference_count = -1,            // never adjusted; SPTM never unloads
-	.reference_list =  NULL,
-	.address =         0,
-	.size =            0,             // filled in by OSKext::initialize()
-	.hdr_size =        0,
-	.start =           NULL,
-	.stop =            NULL
-};
-
-kmod_info_t g_txm_kmod_info = {
-	.next =            NULL,
-	.info_version =    KMOD_INFO_VERSION,
-	.id =              kOSKextTXMLoadTag,   // Always one after the SPTM
-	.name =            kOSKextTXMIdentifier,// bundle identifier
-	.version =         "0",           // filled in by OSKext::initialize()
-	.reference_count = -1,            // never adjusted; TXM never unloads
-	.reference_list =  NULL,
-	.address =         0,
-	.size =            0,             // filled in by OSKext::initialize()
-	.hdr_size =        0,
-	.start =           NULL,
-	.stop =            NULL
-};
-#endif /* CONFIG_SPTM */
 
 /* Set up a fake kmod_info struct for statically linked kexts that don't have one. */
 
@@ -536,9 +488,8 @@
  * to automatically parse the list of loaded kexts.
  **********/
 static IOLock                 * sKextSummariesLock                = NULL;
-extern "C" lck_grp_t            vm_page_lck_grp_bucket;
-static lck_grp_t              * sKextAccountsLockGrp = &vm_page_lck_grp_bucket;
-#define sKextAccountsLock       (&vm_allocation_sites_lock)
+extern "C" lck_ticket_t         vm_allocation_sites_lock;
+static lck_ticket_t           * sKextAccountsLock = &vm_allocation_sites_lock;
 
 void(*const sLoadedKextSummariesUpdated)(void) = OSKextLoadedKextSummariesUpdated;
 OSKextLoadedKextSummaryHeader * gLoadedKextSummaries __attribute__((used)) = NULL;
@@ -552,7 +503,7 @@
 /*********************************************************************
  * sKextLoggingLock protects the logging variables declared immediately below.
  **********/
-__static_testable IOLock      * sKextLoggingLock           = NULL;
+static IOLock                 * sKextLoggingLock           = NULL;
 
 static  const OSKextLogSpec     kDefaultKernelLogFilter    = kOSKextLogBasicLevel |
     kOSKextLogVerboseFlagsMask;
@@ -801,171 +752,13 @@
 
 /*********************************************************************
 *********************************************************************/
-/**
- * Allocate and intialize a fake/representative OSKext object for a statically
- * loaded (by iBoot) binary (e.g., the XNU kernel itself).
- *
- * @param kmod_info Pointer to the kmod_info structure for the binary being
- *                  setup. At least the "name" and "id" fields needs to already
- *                  be set correctly.
- *
- * @return The allocated and initialized OSKext object.
- */
-/* static */
-OSKext *
-OSKext::allocAndInitFakeKext(kmod_info_t *kmod_info)
-{
-	vm_offset_t load_address = 0;
-	const char *bundle_name = NULL;
-	bool macho_is_unslid = false;
-	bool set_custom_path = false;
-	const char *executable_fallback_name = NULL;
-
-	if (kmod_info->id == kOSKextKernelLoadTag) {
-		load_address = (vm_offset_t)&_mh_execute_header;
-		bundle_name = "mach_kernel";
-
-		/* The kernel Mach-O header is fixed up to slide all of its addresses. */
-		macho_is_unslid = false;
-
-		/**
-		 * No path to the binary is set for the kernel in its OSKext object. The
-		 * kernel binary is located in fixed directories depending on the OS.
-		 */
-		set_custom_path = false;
-		executable_fallback_name = NULL;
-#if CONFIG_SPTM
-	} else if (kmod_info->id == kOSKextSPTMLoadTag) {
-		load_address = (vm_offset_t)SPTMArgs->debug_header->image[DEBUG_HEADER_ENTRY_SPTM];
-		bundle_name = "sptm";
-
-		/* The addresses in the SPTM Mach-O header are all unslid. */
-		macho_is_unslid = true;
-
-		set_custom_path = true;
-		executable_fallback_name = "sptm.no.binname.in.macho";
-	} else if (kmod_info->id == kOSKextTXMLoadTag) {
-		load_address = (vm_offset_t)SPTMArgs->debug_header->image[DEBUG_HEADER_ENTRY_TXM];
-		bundle_name = "txm";
-
-		/* The addresses in the TXM Mach-O header are all unslid. */
-		macho_is_unslid = true;
-
-		set_custom_path = true;
-		executable_fallback_name = "txm.no.binname.in.macho";
-#endif /* CONFIG_SPTM */
-	} else {
-		panic("%s: Unsupported kmod_info->id (%d)", __func__, kmod_info->id);
-	}
-
-	/* Set up an OSKext instance to represent the statically loaded binary. */
-	OSKext *fakeKext = new OSKext;
-	assert(fakeKext);
-	assert(load_address != 0);
-
-	/*
-	 * The start address is always a slid address whereas the last VA returned
-	 * by getlastaddr() might be unslid depending on the Mach-O. If the address
-	 * coming from the Mach-O is unslid, then unslide the start address before
-	 * computing the length of the executable.
-	 */
-	size_t binaryLength = getlastaddr((kernel_mach_header_t*)load_address);
-	binaryLength -= (macho_is_unslid) ? ml_static_unslide(load_address) : load_address;
-	assert(binaryLength <= UINT_MAX);
-
-	/**
-	 * The load address is always slid. That value will be unslid before being
-	 * exposed to userspace.
-	 */
-	OSSharedPtr<OSData> executable = OSData::withBytesNoCopy(
-		(void*)load_address, (unsigned int)binaryLength);
-	assert(executable);
-
-	fakeKext->loadTag = sNextLoadTag++;
-	fakeKext->bundleID = OSSymbol::withCString(kmod_info->name);
-
-	fakeKext->version = OSKextParseVersionString(osrelease);
-	fakeKext->compatibleVersion = fakeKext->version;
-	fakeKext->linkedExecutable = os::move(executable);
-	fakeKext->interfaceUUID = fakeKext->copyUUID();
-
-	fakeKext->flags.hasAllDependencies = 1;
-	fakeKext->flags.kernelComponent = 1;
-	fakeKext->flags.prelinked = 0;
-	fakeKext->flags.loaded = 1;
-	fakeKext->flags.started = 1;
-	fakeKext->flags.CPPInitialized = 0;
-	fakeKext->flags.jettisonLinkeditSeg = 0;
-	fakeKext->flags.unslidMachO = macho_is_unslid;
-
-#if CONFIG_SPTM
-	if (set_custom_path) {
-		/* Only SPTM/TXM should have custom paths to their executables set. */
-		assert((kmod_info->id == kOSKextSPTMLoadTag) ||
-		    (kmod_info->id == kOSKextTXMLoadTag));
-
-		/* All SPTM/TXM binaries are placed into the same path on internal systems. */
-		fakeKext->path = OSString::withCStringNoCopy("/usr/appleinternal/standalone/platform");
-
-		/**
-		 * Each SPTM/TXM Mach-O should contain a __TEXT,__binname section which contains
-		 * a character array representing the name of the Mach-O executable.
-		 */
-		kernel_section_t *binname_sect =
-		    getsectbynamefromheader((kernel_mach_header_t*)load_address, "__TEXT", "__binname");
-
-		if (binname_sect != NULL) {
-			const char *binname = (const char *)ml_static_slide(binname_sect->addr);
-			fakeKext->executableRelPath = OSString::withCStringNoCopy(binname);
-		} else {
-			fakeKext->executableRelPath = OSString::withCStringNoCopy(executable_fallback_name);
-		}
-	}
-#endif /* CONFIG_SPTM */
-
-	fakeKext->kmod_info = kmod_info;
-	strlcpy(kmod_info->version, osrelease,
-	    sizeof(kmod_info->version));
-	kmod_info->size = binaryLength;
-	assert(kmod_info->id == fakeKext->loadTag);
-
-	/*
-	 * Con up an info dict, so we don't have to have special-case checking all
-	 * over.
-	 */
-	fakeKext->infoDict = OSDictionary::withCapacity(5);
-	assert(fakeKext->infoDict);
-	bool setResult = fakeKext->infoDict->setObject(kCFBundleIdentifierKey,
-	    fakeKext->bundleID.get());
-	assert(setResult);
-	setResult = fakeKext->infoDict->setObject(kOSKernelResourceKey,
-	    kOSBooleanTrue);
-	assert(setResult);
-
-	{
-		OSSharedPtr<OSString> scratchString(OSString::withCStringNoCopy(osrelease));
-		assert(scratchString);
-		setResult = fakeKext->infoDict->setObject(kCFBundleVersionKey,
-		    scratchString.get());
-		assert(setResult);
-	}
-
-	{
-		OSSharedPtr<OSString> scratchString(OSString::withCStringNoCopy(bundle_name));
-		assert(scratchString);
-		setResult = fakeKext->infoDict->setObject(kCFBundleNameKey,
-		    scratchString.get());
-		assert(setResult);
-	}
-
-	return fakeKext;
-}
-
 /* static */
 void
 OSKext::initialize(void)
 {
 	OSSharedPtr<OSData>     kernelExecutable   = NULL;// do not release
+	u_char          * kernelStart        = NULL;// do not free
+	size_t            kernelLength       = 0;
 	IORegistryEntry * registryRoot       = NULL;// do not release
 	OSSharedPtr<OSNumber> kernelCPUType;
 	OSSharedPtr<OSNumber> kernelCPUSubtype;
@@ -1038,10 +831,10 @@
 		sKeepSymbols = true;
 	}
 #endif /* CONFIG_DTRACE */
-#if KASAN_DYNAMIC_DENYLIST
+#if KASAN_DYNAMIC_BLACKLIST
 	/* needed for function lookup */
 	sKeepSymbols = true;
-#endif /* KASAN_DYNAMIC_DENYLIST */
+#endif
 
 	/*
 	 * Should we panic when the SystemKC is not linked against the
@@ -1052,15 +845,76 @@
 	sPanicOnKCMismatch = PE_parse_boot_argn("-nokcmismatchpanic", bootArgBuffer,
 	    sizeof(bootArgBuffer)) ? false : true;
 
-	/* Set up an OSKext instance to represent the kernel itself. */
-	sKernelKext = allocAndInitFakeKext(&g_kernel_kmod_info);
+	/* Set up an OSKext instance to represent the kernel itself.
+	 */
+	sKernelKext = new OSKext;
 	assert(sKernelKext);
 
-#if CONFIG_SPTM
-	/* Set up OSKext instances to represent the SPTM/TXM. */
-	OSKext *SPTMKext = allocAndInitFakeKext(&g_sptm_kmod_info);
-	OSKext *TXMKext = allocAndInitFakeKext(&g_txm_kmod_info);
+	kernelStart = (u_char *)&_mh_execute_header;
+	kernelLength = getlastaddr() - (vm_offset_t)kernelStart;
+	assert(kernelLength <= UINT_MAX);
+	kernelExecutable = OSData::withBytesNoCopy(
+		kernelStart, (unsigned int)kernelLength);
+	assert(kernelExecutable);
+
+#if KASLR_KEXT_DEBUG
+	IOLog("kaslr: kernel start 0x%lx end 0x%lx length %lu vm_kernel_slide %lu (0x%016lx) \n",
+	    (unsigned long)kernelStart,
+	    (unsigned long)getlastaddr(),
+	    kernelLength,
+	    (unsigned long)vm_kernel_slide,
+	    (unsigned long)vm_kernel_slide);
 #endif
+
+	sKernelKext->loadTag = sNextLoadTag++; // the kernel is load tag 0
+	sKernelKext->bundleID = OSSymbol::withCString(kOSKextKernelIdentifier);
+
+	sKernelKext->version = OSKextParseVersionString(osrelease);
+	sKernelKext->compatibleVersion = sKernelKext->version;
+	sKernelKext->linkedExecutable = os::move(kernelExecutable);
+	sKernelKext->interfaceUUID = sKernelKext->copyUUID();
+
+	sKernelKext->flags.hasAllDependencies = 1;
+	sKernelKext->flags.kernelComponent = 1;
+	sKernelKext->flags.prelinked = 0;
+	sKernelKext->flags.loaded = 1;
+	sKernelKext->flags.started = 1;
+	sKernelKext->flags.CPPInitialized = 0;
+	sKernelKext->flags.jettisonLinkeditSeg = 0;
+
+	sKernelKext->kmod_info = &g_kernel_kmod_info;
+	strlcpy(g_kernel_kmod_info.version, osrelease,
+	    sizeof(g_kernel_kmod_info.version));
+	g_kernel_kmod_info.size = kernelLength;
+	g_kernel_kmod_info.id = sKernelKext->loadTag;
+
+	/* Cons up an info dict, so we don't have to have special-case
+	 * checking all over.
+	 */
+	sKernelKext->infoDict = OSDictionary::withCapacity(5);
+	assert(sKernelKext->infoDict);
+	setResult = sKernelKext->infoDict->setObject(kCFBundleIdentifierKey,
+	    sKernelKext->bundleID.get());
+	assert(setResult);
+	setResult = sKernelKext->infoDict->setObject(kOSKernelResourceKey,
+	    kOSBooleanTrue);
+	assert(setResult);
+
+	{
+		OSSharedPtr<OSString> scratchString(OSString::withCStringNoCopy(osrelease));
+		assert(scratchString);
+		setResult = sKernelKext->infoDict->setObject(kCFBundleVersionKey,
+		    scratchString.get());
+		assert(setResult);
+	}
+
+	{
+		OSSharedPtr<OSString> scratchString(OSString::withCStringNoCopy("mach_kernel"));
+		assert(scratchString);
+		setResult = sKernelKext->infoDict->setObject(kCFBundleNameKey,
+		    scratchString.get());
+		assert(setResult);
+	}
 
 	/* Add the kernel kext to the bookkeeping dictionaries. Note that
 	 * the kernel kext doesn't have a kmod_info struct. copyInfo()
@@ -1071,25 +925,9 @@
 	setResult = sLoadedKexts->setObject(sKernelKext);
 	assert(setResult);
 
-#if CONFIG_SPTM
-	setResult = sKextsByID->setObject(SPTMKext->bundleID.get(), SPTMKext);
-	assert(setResult);
-	setResult = sLoadedKexts->setObject(SPTMKext);
-	assert(setResult);
-
-	setResult = sKextsByID->setObject(TXMKext->bundleID.get(), TXMKext);
-	assert(setResult);
-	setResult = sLoadedKexts->setObject(TXMKext);
-	assert(setResult);
-#endif /* CONFIG_SPTM */
-
 	// XXX: better way with OSSharedPtr?
 	// sKernelKext remains a valid pointer even after the decref
 	sKernelKext->release();
-#if CONFIG_SPTM
-	SPTMKext->release();
-	TXMKext->release();
-#endif /* CONFIG_SPTM */
 
 	registryRoot = IORegistryEntry::getRegistryRoot();
 	kernelCPUType = OSNumber::withNumber(
@@ -1141,10 +979,6 @@
 	    "Kext system initialized.");
 
 	notifyKextLoadObservers(sKernelKext, sKernelKext->kmod_info);
-#if CONFIG_SPTM
-	notifyKextLoadObservers(SPTMKext, SPTMKext->kmod_info);
-	notifyKextLoadObservers(TXMKext, TXMKext->kmod_info);
-#endif
 
 	return;
 }
@@ -1222,7 +1056,7 @@
 #if __arm__ || __arm64__
 	/* Free the memory that was set up by iBoot.
 	 */
-#if !defined(KERNEL_INTEGRITY_KTRR) && !defined(KERNEL_INTEGRITY_CTRR) && !defined(KERNEL_INTEGRITY_PV_CTRR)
+#if !defined(KERNEL_INTEGRITY_KTRR) && !defined(KERNEL_INTEGRITY_CTRR)
 	/* We cannot free the KLD segment with CTRR enabled as it contains text and
 	 * is covered by the contiguous rorgn.
 	 */
@@ -1232,12 +1066,8 @@
 		    (int)segment_size); // calls ml_static_mfree
 	} else if (seg_kld && seg_kld->vmaddr && seg_kld->vmsize) {
 		/* With fileset KCs, the Kernel KLD segment is not recorded in the DT. */
-#if !CONFIG_SPTM
 		ml_static_mfree(ml_static_ptovirt(seg_kld->vmaddr - gVirtBase + gPhysBase),
 		    seg_kld->vmsize);
-#else
-		ml_static_mfree(seg_kld->vmaddr, seg_kld->vmsize);
-#endif
 	}
 #endif
 	dt_segment_name = "Kernel-__KLDDATA";
@@ -1246,12 +1076,8 @@
 		    (int)segment_size);  // calls ml_static_mfree
 	} else if (seg_klddata && seg_klddata->vmaddr && seg_klddata->vmsize) {
 		/* With fileset KCs, the Kernel KLDDATA segment is not recorded in the DT. */
-#if !CONFIG_SPTM
 		ml_static_mfree(ml_static_ptovirt(seg_klddata->vmaddr - gVirtBase + gPhysBase),
 		    seg_klddata->vmsize);
-#else
-		ml_static_mfree(seg_klddata->vmaddr, seg_klddata->vmsize);
-#endif
 	}
 #elif __i386__ || __x86_64__
 	/* On x86, use the mapping data from the segment load command to
@@ -1331,11 +1157,13 @@
 
 		/* Set up the VM region.
 		 */
-		mem_result = mach_vm_map_kernel(
+		mem_result = vm_map_enter_mem_object(
 			kernel_map,
 			&seg_offset,
 			seg_length, /* mask */ 0,
-			VM_MAP_KERNEL_FLAGS_FIXED(.vmf_overwrite = true),
+			VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
+			VM_MAP_KERNEL_FLAGS_NONE,
+			VM_KERN_MEMORY_NONE,
 			(ipc_port_t)NULL,
 			(vm_object_offset_t) 0,
 			/* copy */ FALSE,
@@ -1593,44 +1421,14 @@
 /*********************************************************************
 *********************************************************************/
 /* static */
-
-bool
-OSKext::driverkitEnabled(void)
-{
-	#if XNU_TARGET_OS_WATCH
-	/*
-	 * Driverkit support is available on watchOS only if the device
-	 * tree has the "supports-driverkit" property in its "/product" node
-	 */
-	DTEntry entry;
-	void const *prop = NULL;
-	unsigned int prop_size;
-
-	if (kSuccess != SecureDTLookupEntry(NULL, "/product", &entry)) {
-		return false;
-	}
-	if (kSuccess != SecureDTGetProperty(entry, "supports-driverkit", &prop, &prop_size)) {
-		return false;
-	}
-	#endif /* XNU_TARGET_OS_WATCH */
-
-	return true;
-}
-
-/*********************************************************************
-*********************************************************************/
-/* static */
 bool
 OSKext::iokitDaemonAvailable(void)
 {
-#if XNU_TARGET_OS_XR || XNU_TARGET_OS_BRIDGE
 	int notused;
 	if (PE_parse_boot_argn("-restore", &notused, sizeof(notused))) {
 		return false;
 	}
-#endif /* XNU_TARGET_OS_XR || XNU_TARGET_OS_BRIDGE */
-
-	return driverkitEnabled();
+	return true;
 }
 
 /*********************************************************************
@@ -1696,10 +1494,10 @@
 }
 
 void
-OSKext::setWillUserspaceReboot(void)
+OSKext::willUserspaceReboot(void)
 {
 	OSKext::willShutdown();
-	IOService::setWillUserspaceReboot();
+	IOService::userSpaceWillReboot();
 	gIOCatalogue->terminateDriversForUserspaceReboot();
 }
 
@@ -1719,12 +1517,6 @@
 	OSKext::setKernelRequestsEnabled(true);
 	sOSKextWasResetAfterUserspaceReboot = true;
 	IORecursiveLockUnlock(sKextLock);
-}
-
-extern "C" int
-OSKextIsInUserspaceReboot(void)
-{
-	return IOService::getWillUserspaceReboot();
 }
 
 extern "C" void
@@ -3846,7 +3638,7 @@
 
 	if (KERN_SUCCESS != kmem_alloc(kernel_map,
 	    (vm_offset_t*)&uncompressedDataBuffer, fullSize,
-	    KMA_DATA_SHARED, VM_KERN_MEMORY_OSKEXT)) {
+	    KMA_DATA, VM_KERN_MEMORY_OSKEXT)) {
 		/* How's this for cheesy? The kernel is only asked to extract
 		 * kext plists so we tailor the log messages.
 		 */
@@ -4230,35 +4022,35 @@
 		    "Failed to create serializer on log info for request from user space.");
 		/* Incidental error; we're going to (try to) allow the request
 		 * itself to succeed. */
+	}
+
+	if (!logInfoArray->serialize(serializer.get())) {
+		OSKextLog(/* kext */ NULL,
+		    kOSKextLogErrorLevel |
+		    kOSKextLogIPCFlag,
+		    "Failed to serialize log info for request from user space.");
+		/* Incidental error; we're going to (try to) allow the request
+		 * itself to succeed. */
 	} else {
-		if (!logInfoArray->serialize(serializer.get())) {
+		logInfo = serializer->text();
+		logInfoLength = serializer->getLength();
+
+		kmem_result = kmem_alloc(kernel_map, (vm_offset_t *)&buffer, round_page(logInfoLength),
+		    KMA_DATA, VM_KERN_MEMORY_OSKEXT);
+		if (kmem_result != KERN_SUCCESS) {
 			OSKextLog(/* kext */ NULL,
 			    kOSKextLogErrorLevel |
 			    kOSKextLogIPCFlag,
-			    "Failed to serialize log info for request from user space.");
+			    "Failed to copy log info for request from user space.");
 			/* Incidental error; we're going to (try to) allow the request
-			 * itself to succeed. */
+			 * to succeed. */
 		} else {
-			logInfo = serializer->text();
-			logInfoLength = serializer->getLength();
-
-			kmem_result = kmem_alloc(kernel_map, (vm_offset_t *)&buffer, round_page(logInfoLength),
-			    KMA_DATA_SHARED, VM_KERN_MEMORY_OSKEXT);
-			if (kmem_result != KERN_SUCCESS) {
-				OSKextLog(/* kext */ NULL,
-				    kOSKextLogErrorLevel |
-				    kOSKextLogIPCFlag,
-				    "Failed to copy log info for request from user space.");
-				/* Incidental error; we're going to (try to) allow the request
-				 * to succeed. */
-			} else {
-				/* 11981737 - clear uninitialized data in last page */
-				bzero((void *)(buffer + logInfoLength),
-				    (round_page(logInfoLength) - logInfoLength));
-				memcpy(buffer, logInfo, logInfoLength);
-				*logInfoOut = buffer;
-				*logInfoLengthOut = logInfoLength;
-			}
+			/* 11981737 - clear uninitialized data in last page */
+			bzero((void *)(buffer + logInfoLength),
+			    (round_page(logInfoLength) - logInfoLength));
+			memcpy(buffer, logInfo, logInfoLength);
+			*logInfoOut = buffer;
+			*logInfoLengthOut = logInfoLength;
 		}
 	}
 
@@ -4377,15 +4169,6 @@
 			}
 #if defined(__arm64__)
 			textExecBase = (uintptr_t) getsegdatafromheader((kernel_mach_header_t *)kmod_info->address, "__TEXT_EXEC", &textExecSize);
-
-			/**
-			 * If the addresses within the Mach-O are unslid, then manually
-			 * slide any addresses coming from the Mach-O before usage.
-			 */
-			if (thisKext->flags.unslidMachO) {
-				textExecBase = (uintptr_t) ml_static_slide((vm_offset_t) textExecBase);
-			}
-
 			if ((textExecBase <= address) && (address < textExecBase + textExecSize)) {
 				foundKext.reset(thisKext, OSRetain);
 				goto finish;
@@ -4393,8 +4176,7 @@
 #endif /* defined (__arm64__) */
 		}
 	}
-
-	if (kernel_text_contains(address)) {
+	if ((address >= vm_kernel_stext) && (address < vm_kernel_etext)) {
 		foundKext.reset(sKernelKext, OSRetain);
 		goto finish;
 	}
@@ -4959,15 +4741,6 @@
 #if PRAGMA_MARK
 #pragma mark Accessors
 #endif
-
-/*********************************************************************
-*********************************************************************/
-const OSObject *
-OSKext::getBundleExecutable(void)
-{
-	return infoDict->getObject(kCFBundleExecutableKey);
-}
-
 /*********************************************************************
 *********************************************************************/
 const OSSymbol *
@@ -5129,20 +4902,6 @@
 }
 
 /*********************************************************************
-*********************************************************************/
-bool
-OSKext::isSpecialKernelBinary(void)
-{
-#if CONFIG_SPTM
-	return (this->kmod_info) &&
-	       ((this->kmod_info->id == kOSKextSPTMLoadTag) ||
-	       (this->kmod_info->id == kOSKextTXMLoadTag));
-#else
-	return false;
-#endif
-}
-
-/*********************************************************************
 * We might want to check this recursively for all dependencies,
 * since a subtree of dependencies could get loaded before we hit
 * a dependency that isn't safe-boot-loadable.
@@ -5413,7 +5172,6 @@
 {
 	OSReturn result;
 	const OSSymbol * dextID = olddext->getIdentifier();
-	OSData * oldDextUniqueIdentifier = olddext->getDextUniqueID();
 	OSSharedPtr<OSArray> new_personalities;
 	OSSharedPtr<OSString> kextIdentifier;
 	__assert_only bool lock_held = IORecursiveLockHaveLock(sKextLock);
@@ -5433,10 +5191,6 @@
 		 */
 		new_personalities = newdext->copyPersonalitiesArray();
 		olddext->updatePersonalitiesInCatalog(new_personalities.get());
-	}
-
-	if (NULL != oldDextUniqueIdentifier) {
-		oldDextUniqueIdentifier->retain();
 	}
 
 	/*
@@ -5476,12 +5230,10 @@
 		}
 	} else {
 		// notify dext removal
-		queueKextNotification(kKextRequestPredicateUnloadNotification,
-		    OSDynamicCast(OSString, dextID), oldDextUniqueIdentifier);
+		queueKextNotification(kKextRequestPredicateUnloadNotification, OSDynamicCast(OSString, dextID));
 	}
 
 	OSSafeReleaseNULL(dextID);
-	OSSafeReleaseNULL(oldDextUniqueIdentifier);
 }
 
 /*
@@ -6749,7 +6501,6 @@
 	    "task_%s", getIdentifierCString());
 	account->task_refgrp.grp_name = account->task_refgrp_name;
 	account->task_refgrp.grp_parent = &task_external_refgrp;
-	account->task_refgrp.grp_flags = OS_REFGRP_F_ALWAYS_ENABLED;
 	os_ref_log_init(&account->task_refgrp);
 #endif /* DEVELOPMENT || DEBUG */
 
@@ -6853,7 +6604,7 @@
 		    getIdentifierCString());
 
 		queueKextNotification(kKextRequestPredicateLoadNotification,
-		    OSDynamicCast(OSString, bundleID.get()), getDextUniqueID());
+		    OSDynamicCast(OSString, bundleID.get()));
 	}
 	return result;
 }
@@ -7623,11 +7374,7 @@
 	    linkeditseg->vmaddr, linkeditseg->vmsize);
 #else
 	/* BootKC on arm64 is not vm mapped, but is slid */
-#if !CONFIG_SPTM
 	vm_offset_t linkedit_vmaddr = ml_static_ptovirt((vm_offset_t)(linkeditseg->vmaddr - gVirtBase + gPhysBase));
-#else
-	vm_offset_t linkedit_vmaddr = linkeditseg->vmaddr;
-#endif
 
 	ml_static_mfree(linkedit_vmaddr, (vm_size_t)linkeditseg->vmsize);
 
@@ -7908,13 +7655,11 @@
 	kernel_mach_header_t *kext_mh,
 	vm_map_t   map,
 	vm_map_offset_t    start,
-	vm_map_size_t      size,
+	vm_map_offset_t    end,
 	vm_prot_t  new_prot,
 	boolean_t  set_max,
 	kc_kind_t  kc_type)
 {
-	vm_map_offset_t    end = start + size;
-
 #pragma unused(kext_mh,map,kc_type)
 	assert(map == kernel_map);         // we can handle KEXTs arising from the PRELINK segment and no others
 	assert(start <= end);
@@ -7923,7 +7668,7 @@
 	} else if (set_max) {
 		return KERN_SUCCESS;         // Punt set_max, as there's no mechanism to record that state
 	} else {
-		return ml_static_protect(start, size, new_prot);
+		return ml_static_protect(start, end - start, new_prot);
 	}
 }
 
@@ -7949,13 +7694,11 @@
 	kernel_mach_header_t *kext_mh,
 	vm_map_t   map,
 	vm_map_offset_t    start,
-	vm_map_size_t      size,
+	vm_map_offset_t    end,
 	vm_prot_t  new_prot,
 	boolean_t  set_max,
 	kc_kind_t  kc_type)
 {
-	vm_map_offset_t    end = start + size;
-
 	if (start == end) {         // 10538581
 		return KERN_SUCCESS;
 	}
@@ -7964,9 +7707,9 @@
 		 * XXX: This will probably need to be different for AuxKC and
 		 * pageableKC!
 		 */
-		return ml_static_protect(start, size, new_prot);
-	}
-	return mach_vm_protect(map, start, size, set_max, new_prot);
+		return ml_static_protect(start, end - start, new_prot);
+	}
+	return vm_map_protect(map, start, end, new_prot, set_max);
 }
 
 static inline kern_return_t
@@ -7995,7 +7738,6 @@
 	vm_map_offset_t             start_protect   = 0;
 	vm_map_offset_t             start_wire      = 0;
 	vm_map_offset_t             end_protect     = 0;
-	vm_map_size_t               size_protect    = 0;
 	vm_map_offset_t             end_wire        = 0;
 	OSReturn                    result          = kOSReturnError;
 
@@ -8034,7 +7776,7 @@
 	/* Protect the headers as read-only; they do not need to be wired */
 	result = (protect) ? OSKext_protect((kernel_mach_header_t *)kmod_info->address,
 	    kext_map, kmod_info->address,
-	    kmod_info->hdr_size, VM_PROT_READ, TRUE, kc_type)
+	    kmod_info->address + kmod_info->hdr_size, VM_PROT_READ, TRUE, kc_type)
 	    : KERN_SUCCESS;
 	if (result != KERN_SUCCESS) {
 		goto finish;
@@ -8064,7 +7806,6 @@
 		 */
 		start_protect = round_page(seg->vmaddr);
 		end_protect = trunc_page(seg->vmaddr + seg->vmsize);
-		size_protect = end_protect - start_protect;
 
 		start_wire = trunc_page(seg->vmaddr);
 		end_wire = round_page(seg->vmaddr + seg->vmsize);
@@ -8078,7 +7819,7 @@
 		    strncmp(seg->segname, SEG_LINKINFO, sizeof(seg->segname)) != 0) ||
 		    (kc_type != KCKindPageable && kc_type != KCKindAuxiliary))) {
 			result = OSKext_protect((kernel_mach_header_t *)kmod_info->address,
-			    kext_map, start_protect, size_protect, seg->maxprot, TRUE, kc_type);
+			    kext_map, start_protect, end_protect, seg->maxprot, TRUE, kc_type);
 			if (result != KERN_SUCCESS) {
 				OSKextLog(this,
 				    kOSKextLogErrorLevel |
@@ -8090,7 +7831,7 @@
 			}
 
 			result = OSKext_protect((kernel_mach_header_t *)kmod_info->address,
-			    kext_map, start_protect, size_protect, seg->initprot, FALSE, kc_type);
+			    kext_map, start_protect, end_protect, seg->initprot, FALSE, kc_type);
 			if (result != KERN_SUCCESS) {
 				OSKextLog(this,
 				    kOSKextLogErrorLevel |
@@ -8373,7 +8114,7 @@
 	} else {
 		uuid_info->ftui_address = ml_static_unslide(address);
 	}
-	os_log_encoded_metadata(trace_id, stamp, uuid_info, uuid_info_len);
+	firehose_trace_metadata(firehose_stream_metadata, trace_id, stamp, uuid_info, uuid_info_len);
 	return;
 }
 
@@ -8819,7 +8560,7 @@
 	notifyKextUnloadObservers(this);
 
 	freeAccount = NULL;
-	lck_ticket_lock(sKextAccountsLock, sKextAccountsLockGrp);
+	lck_ticket_lock(sKextAccountsLock, LCK_GRP_NULL);
 	account->kext = NULL;
 	if (account->site.tag) {
 		account->site.flags |= VM_TAG_UNLOAD;
@@ -8947,7 +8688,7 @@
 	    "Kext %s unloaded.", getIdentifierCString());
 
 	queueKextNotification(kKextRequestPredicateUnloadNotification,
-	    OSDynamicCast(OSString, bundleID.get()), getDextUniqueID());
+	    OSDynamicCast(OSString, bundleID.get()));
 
 finish:
 	OSKext::saveLoadedKextPanicList();
@@ -8964,8 +8705,7 @@
 OSReturn
 OSKext::queueKextNotification(
 	const char * notificationName,
-	OSString   * kextIdentifier,
-	OSData     * dextUniqueIdentifier)
+	OSString   * kextIdentifier)
 {
 	OSReturn          result               = kOSReturnError;
 	OSSharedPtr<OSDictionary>    loadRequest;
@@ -8986,13 +8726,6 @@
 	    kKextRequestArgumentBundleIdentifierKey, kextIdentifier)) {
 		result = kOSKextReturnNoMemory;
 		goto finish;
-	}
-	if (NULL != dextUniqueIdentifier) {
-		if (!_OSKextSetRequestArgument(loadRequest.get(),
-		    kKextRequestArgumentDriverUniqueIdentifier, dextUniqueIdentifier)) {
-			result = kOSKextReturnNoMemory;
-			goto finish;
-		}
 	}
 	if (!sKernelRequests->setObject(loadRequest.get())) {
 		result = kOSKextReturnNoMemory;
@@ -10751,7 +10484,7 @@
 		/* This kmem_alloc sets the return value of the function.
 		 */
 		kmem_result = kmem_alloc(kernel_map, (vm_offset_t *)&buffer,
-		    round_page(responseLength), KMA_DATA_SHARED, VM_KERN_MEMORY_OSKEXT);
+		    round_page(responseLength), KMA_DATA, VM_KERN_MEMORY_OSKEXT);
 		if (kmem_result != KERN_SUCCESS) {
 			OSKextLog(/* kext */ NULL,
 			    kOSKextLogErrorLevel |
@@ -11089,30 +10822,21 @@
 
 // #include <InstrProfiling.h>
 extern "C" {
-uint64_t __llvm_profile_get_size_for_buffer_internal(
-	const char *DataBegin,
-	const char *DataEnd,
-	const char *CountersBegin,
-	const char *CountersEnd,
-	const char *BitmapBegin,
-	const char *BitmapEnd,
-	const char *NamesBegin,
-	const char *NamesEnd,
-	const char *VTableBegin,
-	const char *VTableEnd,
-	const char *VNamesBegin,
-	const char *VNamesEnd);
-int __llvm_profile_write_buffer_internal(
-	char *Buffer,
-	const char *DataBegin,
-	const char *DataEnd,
-	const char *CountersBegin,
-	const char *CountersEnd,
-	const char *BitmapBegin,
-	const char *BitmapEnd,
-	const char *NamesBegin,
-	const char *NamesEnd);
-}
+uint64_t __llvm_profile_get_size_for_buffer_internal(const char *DataBegin,
+    const char *DataEnd,
+    const char *CountersBegin,
+    const char *CountersEnd,
+    const char *NamesBegin,
+    const char *NamesEnd);
+int __llvm_profile_write_buffer_internal(char *Buffer,
+    const char *DataBegin,
+    const char *DataEnd,
+    const char *CountersBegin,
+    const char *CountersEnd,
+    const char *NamesBegin,
+    const char *NamesEnd);
+}
+
 
 static
 void
@@ -11239,9 +10963,6 @@
 	}
 	sect_prf_cnts = kext->lookupSection("__DATA", "__llvm_prf_cnts");
 
-	// Ignore some sections used by optional PGO variants.
-	const char *unused_section = NULL;
-
 	if (!sect_prf_data || !sect_prf_name || !sect_prf_cnts) {
 		err = ENOTSUP;
 		goto out;
@@ -11250,10 +10971,7 @@
 	size = __llvm_profile_get_size_for_buffer_internal(
 		(const char*) sect_prf_data->addr, (const char*) sect_prf_data->addr + sect_prf_data->size,
 		(const char*) sect_prf_cnts->addr, (const char*) sect_prf_cnts->addr + sect_prf_cnts->size,
-		unused_section /* bits */, unused_section /* bits end */,
-		(const char*) sect_prf_name->addr, (const char*) sect_prf_name->addr + sect_prf_name->size,
-		unused_section /* vtab */, unused_section /* vtab end */,
-		unused_section /* vnam */, unused_section /* vnam end */);
+		(const char*) sect_prf_name->addr, (const char*) sect_prf_name->addr + sect_prf_name->size);
 
 	if (metadata) {
 		metadata_size = OSKextPgoMetadataSize(kext);
@@ -11276,7 +10994,6 @@
 			pBuffer,
 			(const char*) sect_prf_data->addr, (const char*) sect_prf_data->addr + sect_prf_data->size,
 			(const char*) sect_prf_cnts->addr, (const char*) sect_prf_cnts->addr + sect_prf_cnts->size,
-			unused_section /* bits */, unused_section /* bits end */,
 			(const char*) sect_prf_name->addr, (const char*) sect_prf_name->addr + sect_prf_name->size);
 
 		if (err) {
@@ -12105,7 +11822,7 @@
 				}
 
 				lcp = (struct load_command *) (temp_kext_mach_hdr + 1);
-				for (i = 0; (i < temp_kext_mach_hdr->ncmds) && !flags.unslidMachO; i++) {
+				for (i = 0; i < temp_kext_mach_hdr->ncmds; i++) {
 					if (lcp->cmd == LC_SEGMENT_KERNEL) {
 						kernel_segment_command_t *  segp;
 						kernel_section_t *          secp;
@@ -12180,21 +11897,10 @@
 				bool res;
 
 				os_log_data         = getsectdatafromheader(kext_mach_hdr, "__TEXT", "__os_log", &os_log_size);
+				os_log_offset       = (uintptr_t)os_log_data - (uintptr_t)kext_mach_hdr;
 				cstring_data        = getsectdatafromheader(kext_mach_hdr, "__TEXT", "__cstring", &cstring_size);
+				cstring_offset      = (uintptr_t)cstring_data - (uintptr_t)kext_mach_hdr;
 				asan_cstring_data   = getsectdatafromheader(kext_mach_hdr, "__TEXT", "__asan_cstring", &asan_cstring_size);
-
-				/*
-				 * If the addresses in the Mach-O header are unslid, manually
-				 * slide them to allow for dereferencing.
-				 */
-				if (flags.unslidMachO) {
-					os_log_data = (os_log_data != nullptr) ? (void*)ml_static_slide((vm_offset_t)os_log_data) : nullptr;
-					cstring_data = (cstring_data != nullptr) ? (void*)ml_static_slide((vm_offset_t)cstring_data) : nullptr;
-					asan_cstring_data = (asan_cstring_data != nullptr) ? (void*)ml_static_slide((vm_offset_t)asan_cstring_data) : nullptr;
-				}
-
-				os_log_offset       = (uintptr_t)os_log_data - (uintptr_t)kext_mach_hdr;
-				cstring_offset      = (uintptr_t)cstring_data - (uintptr_t)kext_mach_hdr;
 				asan_cstring_offset = (uintptr_t)asan_cstring_data - (uintptr_t)kext_mach_hdr;
 
 				header             = (osLogDataHeaderRef *) headerBytes;
@@ -12527,7 +12233,7 @@
 				 */
 				for (seg = firstsegfromheader(mh); seg != NULL; seg = nextsegfromheader(mh, seg)) {
 					if (seg->initprot & VM_PROT_EXECUTE) {
-						execLoadAddress = (flags.unslidMachO) ? seg->vmaddr : ml_static_unslide(seg->vmaddr);
+						execLoadAddress = ml_static_unslide(seg->vmaddr);
 						execLoadSize = (uint32_t)seg->vmsize;
 						break;
 					}
@@ -12932,9 +12638,6 @@
 	if (!kextIdentifier || !serverName || !serverTag || !checkInToken) {
 		return kOSKextReturnInvalidArgument;
 	}
-	if (!iokitDaemonAvailable()) {
-		panic("Received unexpected request in environment where " kIOKitDaemonName " is unavailable");
-	}
 
 	if (serverDUI != NULL) {
 		dextUniqueIDCString = getDextUniqueIDCString(serverDUI, &size);
@@ -12987,10 +12690,7 @@
 		result = kOSKextReturnNoMemory;
 		goto finish;
 	}
-	result = OSKext::pingIOKitDaemon();
-	if (result != kOSReturnSuccess) {
-		goto finish;
-	}
+	OSKext::pingIOKitDaemon();
 
 	result = kOSReturnSuccess;
 finish:
@@ -13945,7 +13645,6 @@
 	kernel_segment_command_t  * seg             = NULL;
 	vm_map_offset_t             start           = 0;
 	vm_map_offset_t             end             = 0;
-	vm_map_size_t               size            = 0;
 	OSReturn                    ret             = 0;
 
 	/* Set VM permissions */
@@ -13953,7 +13652,6 @@
 	while (seg) {
 		start = round_page(seg->vmaddr);
 		end = trunc_page(seg->vmaddr + seg->vmsize);
-		size = end - start;
 
 		/*
 		 * Wire down and protect __TEXT, __BRANCH_STUBS and __BRANCH_GOTS
@@ -13966,14 +13664,14 @@
 		    (type == KCKindAuxiliary && !resetAuxKCSegmentOnUnload &&
 		    strncmp(seg->segname, SEG_LINKEDIT, sizeof(seg->segname)) == 0)) {
 			ret = OSKext_protect((kernel_mach_header_t *)mh,
-			    kext_map, start, size, seg->maxprot, TRUE, type);
+			    kext_map, start, end, seg->maxprot, TRUE, type);
 			if (ret != KERN_SUCCESS) {
 				printf("OSKext protect failed with error %d", ret);
 				return kOSKextReturnInvalidArgument;
 			}
 
 			ret = OSKext_protect((kernel_mach_header_t *)mh,
-			    kext_map, start, size, seg->initprot, FALSE, type);
+			    kext_map, start, end, seg->initprot, FALSE, type);
 			if (ret != KERN_SUCCESS) {
 				printf("OSKext protect failed with error %d", ret);
 				return kOSKextReturnInvalidArgument;
@@ -14170,12 +13868,10 @@
 	vm_object_offset_t fileoffset,
 	vm_prot_t          max_prot)
 {
-	vm_map_kernel_flags_t vmk_flags = {
-		.vmf_fixed = true,
-		.vmkf_no_copy_on_read = true,
-		.vmkf_cs_enforcement_override = true,
-		.vm_tag = VM_KERN_MEMORY_OSKEXT,
-	};
+	vm_map_kernel_flags_t vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
+	vmk_flags.vmkf_no_copy_on_read = 1;
+	vmk_flags.vmkf_cs_enforcement = 0;
+	vmk_flags.vmkf_cs_enforcement_override = 1;
 	kern_return_t ret;
 
 	/* Add Write to max prot to allow fixups */
@@ -14191,7 +13887,9 @@
 		start,
 		size,
 		(mach_vm_offset_t)0,
+		VM_FLAGS_FIXED,
 		vmk_flags,
+		VM_KERN_MEMORY_OSKEXT,
 		(memory_object_control_t)control,
 		fileoffset,
 		TRUE,         /* copy */
@@ -15372,6 +15070,8 @@
 	const char     * format,
 	va_list          srcArgList)
 {
+	extern int       disableConsoleOutput;
+
 	bool             logForKernel       = false;
 	bool             logForUser         = false;
 	va_list          argList;
@@ -15440,7 +15140,7 @@
 		/* If we are in console mode and have a custom log filter,
 		 * colorize the log message.
 		 */
-		if (sBootArgLogFilterFound) {
+		if (!disableConsoleOutput && sBootArgLogFilterFound) {
 			const char * color = "";         // do not free
 			color = colorForFlags(msgLogSpec);
 			printf("%s%s%s\n", colorForFlags(msgLogSpec),
@@ -15660,6 +15360,8 @@
 {
 	addr64_t    summary_page = 0;
 	addr64_t    last_summary_page = 0;
+	bool        found_kmod = false;
+	u_int       i = 0;
 
 	if (kPrintKextsLock & flags) {
 		if (!sKextSummariesLock) {
@@ -15683,13 +15385,27 @@
 		}
 	}
 
-	foreachKextInBacktrace(addr, cnt, 0, ^(OSKextLoadedKextSummary *summary, uint32_t index) {
-		if (index == 0 && !(kPrintKextsTerse & flags)) {
-		        (*printf_func)("      Kernel Extensions in backtrace:\n");
+	for (i = 0; i < gLoadedKextSummaries->numSummaries; ++i) {
+		OSKextLoadedKextSummary * summary;
+
+		summary = gLoadedKextSummaries->summaries + i;
+		if (!summary->address) {
+			continue;
+		}
+
+		if (!summaryIsInBacktrace(summary, addr, cnt)) {
+			continue;
+		}
+
+		if (!found_kmod) {
+			if (!(kPrintKextsTerse & flags)) {
+				(*printf_func)("      Kernel Extensions in backtrace:\n");
+			}
+			found_kmod = true;
 		}
 
 		printSummary(summary, printf_func, flags);
-	});
+	}
 
 finish:
 	if (kPrintKextsLock & flags) {
@@ -15697,42 +15413,6 @@
 	}
 
 	return;
-}
-
-void
-OSKext::foreachKextInBacktrace(
-	vm_offset_t   * addr,
-	uint32_t        cnt,
-	uint32_t        flags,
-	void         (^ handler)(OSKextLoadedKextSummary *summary, uint32_t index))
-{
-	uint32_t n = 0;
-
-	if (kPrintKextsLock & flags) {
-		if (!sKextSummariesLock) {
-			return;
-		}
-		IOLockLock(sKextSummariesLock);
-	}
-
-	for (uint32_t i = 0; i < gLoadedKextSummaries->numSummaries; ++i) {
-		OSKextLoadedKextSummary * summary;
-
-		summary = gLoadedKextSummaries->summaries + i;
-		if (!summary->address) {
-			continue;
-		}
-
-		if (!summaryIsInBacktrace(summary, addr, cnt)) {
-			continue;
-		}
-
-		handler(summary, n++);
-	}
-
-	if (kPrintKextsLock & flags) {
-		IOLockUnlock(sKextSummariesLock);
-	}
 }
 
 /*********************************************************************
@@ -15806,6 +15486,7 @@
 void *
 OSKext::kextForAddress(const void *address)
 {
+	void                * image = NULL;
 	OSKextActiveAccount * active;
 	OSKext              * kext = NULL;
 	uint32_t              baseIdx;
@@ -15821,16 +15502,14 @@
 #endif /*  __has_feature(ptrauth_calls) */
 
 	if (sKextAccountsCount) {
-		lck_ticket_lock(sKextAccountsLock, sKextAccountsLockGrp);
+		lck_ticket_lock(sKextAccountsLock, LCK_GRP_NULL);
 		// bsearch sKextAccounts list
 		for (baseIdx = 0, lim = sKextAccountsCount; lim; lim >>= 1) {
 			active = &sKextAccounts[baseIdx + (lim >> 1)];
 			if ((addr >= active->address) && (addr < active->address_end)) {
-				if (active->account &&
-				    (kext = active->account->kext) &&
-				    kext->kmod_info) {
-					lck_ticket_unlock(sKextAccountsLock);
-					return (void *)kext->kmod_info->address;
+				kext = active->account->kext;
+				if (kext && kext->kmod_info) {
+					image = (void *) kext->kmod_info->address;
 				}
 				break;
 			} else if (addr > active->address) {
@@ -15842,56 +15521,21 @@
 		}
 		lck_ticket_unlock(sKextAccountsLock);
 	}
-	if (kernel_text_contains(addr)) {
-		return (void *)&_mh_execute_header;
-	}
-	if (gLoadedKextSummaries) {
+	if (!image && (addr >= vm_kernel_stext) && (addr < vm_kernel_etext)) {
+		image = (void *) &_mh_execute_header;
+	}
+	if (!image && gLoadedKextSummaries) {
 		IOLockLock(sKextSummariesLock);
 		for (i = 0; i < gLoadedKextSummaries->numSummaries; i++) {
 			OSKextLoadedKextSummary *summary = gLoadedKextSummaries->summaries + i;
 			if (addr >= summary->address && addr < summary->address + summary->size) {
-				void *kextAddress = (void *)summary->address;
-				IOLockUnlock(sKextSummariesLock);
-				return kextAddress;
+				image = (void *)summary->address;
 			}
 		}
 		IOLockUnlock(sKextSummariesLock);
 	}
 
-	return NULL;
-}
-
-/* static */
-kern_return_t
-OSKext::summaryForAddressExt(
-	const void              * address,
-	OSKextLoadedKextSummary * summary)
-{
-	kern_return_t                   result = KERN_FAILURE;
-	const OSKextLoadedKextSummary * foundSummary = NULL;
-
-	/*
-	 * This needs to be safe to call even before the lock has been initialized
-	 * in OSKext::initialize(), as we might get here from the ksancov runtime
-	 * when instrumenting XNU itself with sanitizer coverage.
-	 */
-	if (!sKextSummariesLock) {
-		return result;
-	}
-
-	IOLockLock(sKextSummariesLock);
-	if (gLoadedKextSummaries) {
-		foundSummary = summaryForAddress((uintptr_t)address);
-		if (foundSummary) {
-			memcpy(summary, foundSummary, sizeof(*summary));
-			result = KERN_SUCCESS;
-		} else {
-			result = KERN_NOT_FOUND;
-		}
-	}
-	IOLockUnlock(sKextSummariesLock);
-
-	return result;
+	return image;
 }
 
 /*
@@ -16364,23 +16008,15 @@
 		    last_unloaded_address, last_unloaded_size);
 	}
 
-	/*
-	 * In most cases the set of loaded kexts is statically determined by the
-	 * Boot KC, so it isn't very interesting to see in the paniclog.
-	 */
-	if (auxKCloaded) {
-		printf_func("loaded kexts:\n");
-		if (loaded_kext_paniclist &&
-		    pmap_find_phys(kernel_pmap, (addr64_t) (uintptr_t) loaded_kext_paniclist) &&
-		    loaded_kext_paniclist[0]) {
-			printf_func("%.*s",
-			    strnlen(loaded_kext_paniclist, loaded_kext_paniclist_size),
-			    loaded_kext_paniclist);
-		} else {
-			printf_func("(none)\n");
-		}
+	printf_func("loaded kexts:\n");
+	if (loaded_kext_paniclist &&
+	    pmap_find_phys(kernel_pmap, (addr64_t) (uintptr_t) loaded_kext_paniclist) &&
+	    loaded_kext_paniclist[0]) {
+		printf_func("%.*s",
+		    strnlen(loaded_kext_paniclist, loaded_kext_paniclist_size),
+		    loaded_kext_paniclist);
 	} else {
-		printf_func("loaded kexts: (skipped, see boot kernelcache)\n");
+		printf_func("(none)\n");
 	}
 	return;
 }
@@ -16396,7 +16032,7 @@
 	OSKextLoadedKextSummaryHeader *summaryHeader = NULL;
 	OSKextLoadedKextSummaryHeader *summaryHeaderAlloc = NULL;
 	OSKext *aKext;
-	vm_map_offset_t start;
+	vm_map_offset_t start, end;
 	size_t summarySize = 0;
 	size_t size;
 	u_int count;
@@ -16420,7 +16056,7 @@
 	count = sLoadedKexts->getCount();
 	for (i = 0, maxKexts = 0; i < count; ++i) {
 		aKext = OSDynamicCast(OSKext, sLoadedKexts->getObject(i));
-		maxKexts += (aKext && (aKext->isExecutable() || aKext->isSpecialKernelBinary()));
+		maxKexts += (aKext && aKext->isExecutable());
 	}
 
 	if (!maxKexts) {
@@ -16445,7 +16081,7 @@
 			sLoadedKextSummariesAllocSize = 0;
 		}
 		result = kmem_alloc(kernel_map, (vm_offset_t *)&summaryHeaderAlloc, size,
-		    KMA_NONE, VM_KERN_MEMORY_OSKEXT);
+		    KMA_DATA, VM_KERN_MEMORY_OSKEXT);
 		if (result != KERN_SUCCESS) {
 			goto finish;
 		}
@@ -16456,11 +16092,12 @@
 		summarySize = sLoadedKextSummariesAllocSize;
 
 		start = (vm_map_offset_t) summaryHeader;
-		result = mach_vm_protect(kernel_map,
+		end = start + summarySize;
+		result = vm_map_protect(kernel_map,
 		    start,
-		    summarySize,
-		    false,
-		    VM_PROT_DEFAULT);
+		    end,
+		    VM_PROT_DEFAULT,
+		    FALSE);
 		if (result != KERN_SUCCESS) {
 			goto finish;
 		}
@@ -16480,7 +16117,7 @@
 	accountingListAlloc = 0;
 	for (i = 0, j = 0; i < count && j < maxKexts; ++i) {
 		aKext = OSDynamicCast(OSKext, sLoadedKexts->getObject(i));
-		if (!aKext || (!aKext->isExecutable() && !aKext->isSpecialKernelBinary())) {
+		if (!aKext || !aKext->isExecutable()) {
 			continue;
 		}
 
@@ -16493,7 +16130,7 @@
 	accountingListCount = 0;
 	for (i = 0, j = 0; i < count && j < maxKexts; ++i) {
 		aKext = OSDynamicCast(OSKext, sLoadedKexts->getObject(i));
-		if (!aKext || (!aKext->isExecutable() && !aKext->isSpecialKernelBinary())) {
+		if (!aKext || !aKext->isExecutable()) {
 			continue;
 		}
 
@@ -16514,8 +16151,9 @@
 	 */
 
 	start = (vm_map_offset_t) summaryHeader;
-
-	result = mach_vm_protect(kernel_map, start, summarySize, false, VM_PROT_READ);
+	end = start + summarySize;
+
+	result = vm_map_protect(kernel_map, start, end, VM_PROT_READ, FALSE);
 	if (result != KERN_SUCCESS) {
 		goto finish;
 	}
@@ -16532,7 +16170,7 @@
 		(*sLoadedKextSummariesUpdated)();
 	}
 
-	lck_ticket_lock(sKextAccountsLock, sKextAccountsLockGrp);
+	lck_ticket_lock(sKextAccountsLock, LCK_GRP_NULL);
 	prevAccountingList      = sKextAccounts;
 	prevAccountingListCount = sKextAccountsCount;
 	sKextAccounts           = accountingList;
@@ -16590,16 +16228,6 @@
 		// Fallback to __TEXT
 		summary->text_exec_address = (uint64_t) getsegdatafromheader((kernel_mach_header_t *)summary->address, "__TEXT", &summary->text_exec_size);
 	}
-
-	/**
-	 * If the addresses within the Mach-O are unslid, then manually slide any
-	 * addresses coming from the Mach-O as higher layer software using these
-	 * summaries expects a slid address here.
-	 */
-	if (flags.unslidMachO) {
-		summary->text_exec_address = (uint64_t) ml_static_slide((vm_offset_t) summary->text_exec_address);
-	}
-
 	return;
 }
 
@@ -16783,7 +16411,7 @@
 	address = (uintptr_t)VM_KERNEL_STRIP_PTR(address);
 #endif /*  __has_feature(ptrauth_calls) */
 
-	lck_ticket_lock(sKextAccountsLock, sKextAccountsLockGrp);
+	lck_ticket_lock(sKextAccountsLock, LCK_GRP_NULL);
 	site = releasesite = NULL;
 
 	// bsearch sKextAccounts list
@@ -16822,7 +16450,7 @@
 	address = (uintptr_t)VM_KERNEL_STRIP_PTR(address);
 #endif /*  __has_feature(ptrauth_calls) */
 
-	lck_ticket_lock(sKextAccountsLock, sKextAccountsLockGrp);
+	lck_ticket_lock(sKextAccountsLock, LCK_GRP_NULL);
 
 	// bsearch sKextAccounts list
 	for (baseIdx = 0, lim = sKextAccountsCount; lim; lim >>= 1) {
@@ -17010,13 +16638,13 @@
 sysctl_willuserspacereboot
 (__unused struct sysctl_oid *oidp, __unused void *arg1, __unused int arg2, struct sysctl_req *req)
 {
-	int new_value = 0, old_value = get_system_inuserspacereboot(), changed = 0;
+	int new_value = 0, old_value = 0, changed = 0;
 	int error = sysctl_io_number(req, old_value, sizeof(int), &new_value, &changed);
 	if (error) {
 		return error;
 	}
 	if (changed) {
-		OSKext::setWillUserspaceReboot();
+		OSKext::willUserspaceReboot();
 	}
 	return 0;
 }