--- xnu/xnu-1504.3.12/libkern/gen/OSDebug.cpp
+++ xnu/xnu-1228/libkern/gen/OSDebug.cpp
@@ -34,14 +34,12 @@
 #include <stdarg.h>
 #include <mach/mach_types.h>
 #include <mach/kmod.h>
-#include <kern/locks.h>
+#include <kern/lock.h>
 
 #include <libkern/libkern.h>	// From bsd's libkern directory
 #include <mach/vm_param.h>
 
 #include <sys/kdebug.h>
-#include <kern/thread.h>
-
 extern int etext;
 __BEGIN_DECLS
 // From osmfk/kern/thread.h but considered to be private
@@ -52,16 +50,17 @@
 extern void kmod_dump_log(vm_offset_t *addr, unsigned int cnt);
 
 extern addr64_t kvtophys(vm_offset_t va);
+#if __arm__
+extern int copyinframe(vm_address_t fp, uint32_t *frame);
+#endif
 
 __END_DECLS
 
-extern lck_grp_t *IOLockGroup;
-
-static lck_mtx_t *sOSReportLock = lck_mtx_alloc_init(IOLockGroup, LCK_ATTR_NULL);
+static mutex_t *sOSReportLock = mutex_alloc(0);
 
 /* Use kernel_debug() to log a backtrace */ 
 void
-trace_backtrace(uint32_t debugid, uint32_t debugid2, uintptr_t size, uintptr_t data) {
+trace_backtrace(unsigned int debugid, unsigned int debugid2, int size, int data) {
 	void *bt[16];
 	const unsigned cnt = sizeof(bt) / sizeof(bt[0]);
   	unsigned i;
@@ -82,7 +81,7 @@
 	 */
 	if (!found) i=2;
 
-#define safe_bt(a) (uintptr_t)(a<cnt ? bt[a] : 0)
+#define safe_bt(a) (int)(a<cnt ? bt[a] : 0)
 	kernel_debug(debugid, data, size, safe_bt(i), safe_bt(i+1), 0);
 	kernel_debug(debugid2, safe_bt(i+2), safe_bt(i+3), safe_bt(i+4), safe_bt(i+5), 0);
 }
@@ -103,13 +102,13 @@
     vsnprintf(buf, sizeof(buf), str, listp);
     va_end(listp);
 
-    lck_mtx_lock(sOSReportLock);
+    mutex_lock(sOSReportLock);
     {
-        printf("%s\nBacktrace %p %p %p %p %p %p %p\n",
-            buf, bt[2], bt[3], bt[4], bt[5], bt[6], bt[7], bt[8]);
-        kmod_dump_log((vm_offset_t *) &bt[2], cnt - 2);
+	printf("%s\nBacktrace %p %p %p %p %p %p %p\n",
+		buf, bt[2], bt[3], bt[4], bt[5], bt[6], bt[7], bt[8]);
+	kmod_dump_log((vm_offset_t *) &bt[2], cnt - 2);
     }
-    lck_mtx_unlock(sOSReportLock);
+    mutex_unlock(sOSReportLock);
 }
 
 static vm_offset_t minstackaddr = min_valid_stack_address();
@@ -143,42 +142,10 @@
 static unsigned int
 i386_validate_raddr(vm_offset_t raddr)
 {
-	return ((raddr > VM_MIN_KERNEL_AND_KEXT_ADDRESS) &&
+	return ((raddr > VM_MIN_KERNEL_ADDRESS) &&
 	    (raddr < VM_MAX_KERNEL_ADDRESS));
 }
 #endif
-
-#if __x86_64__
-#define x86_64_RETURN_OFFSET 8
-static unsigned int
-x86_64_validate_raddr(vm_offset_t raddr)
-{
-	return ((raddr > VM_MIN_KERNEL_AND_KEXT_ADDRESS) &&
-	    (raddr < VM_MAX_KERNEL_ADDRESS));
-}
-static unsigned int
-x86_64_validate_stackptr(vm_offset_t stackptr)
-{
-	/* Existence and alignment check
-	 */
-	if (!stackptr || (stackptr & 0x7) || !x86_64_validate_raddr(stackptr))
-		return 0;
-  
-	/* Is a virtual->physical translation present?
-	 */
-	if (!kvtophys(stackptr))
-		return 0;
-  
-	/* Check if the return address lies on the same page;
-	 * If not, verify that a translation exists.
-	 */
-	if (((PAGE_SIZE - (stackptr & PAGE_MASK)) < x86_64_RETURN_OFFSET) &&
-	    !kvtophys(stackptr + x86_64_RETURN_OFFSET))
-		return 0;
-	return 1;
-}
-#endif
-
 
 unsigned OSBacktrace(void **bt, unsigned maxAddrs)
 {
@@ -201,7 +168,7 @@
 
 	stackptr_prev = stackptr;
 	stackptr = mem[stackptr_prev >> 2];
-	if ((stackptr - stackptr_prev) > 8 * 1024)	// Sanity check
+	if ((stackptr_prev ^ stackptr) > 8 * 1024)	// Sanity check
 	    break;
 
 	vm_offset_t addr = mem[(stackptr >> 2) + 2]; 
@@ -214,7 +181,7 @@
     for ( ; i < maxAddrs; i++)
 	    bt[i] = (void *) 0;
 #elif __i386__
-#define SANE_i386_FRAME_SIZE (kernel_stack_size >> 1)
+#define SANE_i386_FRAME_SIZE 8*1024
     vm_offset_t stackptr, stackptr_prev, raddr;
     unsigned frame_index = 0;
 /* Obtain current frame pointer */
@@ -240,7 +207,7 @@
 	    if (stackptr < stackptr_prev)
 		    break;
 
-	    if ((stackptr - stackptr_prev) > SANE_i386_FRAME_SIZE)
+	    if ((stackptr_prev ^ stackptr) > SANE_i386_FRAME_SIZE)
 		    break;
 
 	    raddr = *((vm_offset_t *) (stackptr + i386_RETURN_OFFSET));
@@ -255,52 +222,32 @@
 
     for ( ; frame_index < maxAddrs; frame_index++)
 	    bt[frame_index] = (void *) 0;
-#elif __x86_64__
-#define SANE_x86_64_FRAME_SIZE (kernel_stack_size >> 1)
-    vm_offset_t stackptr, stackptr_prev, raddr;
-    unsigned frame_index = 0;
-/* Obtain current frame pointer */
-
-    __asm__ volatile("movq %%rbp, %0" : "=m" (stackptr)); 
-
-    if (!x86_64_validate_stackptr(stackptr))
-	    goto pad;
-
-    raddr = *((vm_offset_t *) (stackptr + x86_64_RETURN_OFFSET));
-
-    if (!x86_64_validate_raddr(raddr))
-	    goto pad;
-
-    bt[frame_index++] = (void *) raddr;
-
-    for ( ; frame_index < maxAddrs; frame_index++) {
-	    stackptr_prev = stackptr;
-	    stackptr = *((vm_offset_t *) stackptr_prev);
-
-	    if (!x86_64_validate_stackptr(stackptr))
-		    break;
-	/* Stack grows downwards */
-	    if (stackptr < stackptr_prev)
-		    break;
-
-	    if ((stackptr - stackptr_prev) > SANE_x86_64_FRAME_SIZE)
-		    break;
-
-	    raddr = *((vm_offset_t *) (stackptr + x86_64_RETURN_OFFSET));
-
-	    if (!x86_64_validate_raddr(raddr))
-		    break;
-
-	    bt[frame_index] = (void *) raddr;
-    }
-pad:
-    frame = frame_index;
-
-    for ( ; frame_index < maxAddrs; frame_index++)
-	    bt[frame_index] = (void *) 0;
+#elif __arm__
+    uint32_t i= 0;
+    uint32_t frameb[2];
+    uint32_t fp= 0;
+    
+    // get the current frame pointer for this thread
+    __asm__ volatile("mov %0,r7" : "=r" (fp)); 
+    
+    // now crawl up the stack recording the link value of each frame
+    do {
+      // check bounds
+      if ((fp == 0) || ((fp & 3) != 0) || (fp > VM_MAX_KERNEL_ADDRESS) || (fp < VM_MIN_KERNEL_ADDRESS)) {
+	break;
+      }
+      // safely read frame
+      if (copyinframe(fp, frameb) != 0) {
+	break;
+      }
+      
+      // No need to use copyin as this is always a kernel address, see check above
+      bt[i] = (void*)frameb[1];        // link register
+      fp = frameb[0]; 
+    } while (++i < maxAddrs);
+    frame= i;
 #else
 #error arch
 #endif
     return frame;
 }
-