1#include <darwintest.h> 2#include <darwintest_utils.h> 3#include <darwintest_multiprocess.h> 4#include <kern/debug.h> 5#include <kern/kern_cdata.h> 6#include <kern/block_hint.h> 7#include <kdd.h> 8#include <libproc.h> 9#include <mach-o/dyld.h> 10#include <mach-o/dyld_images.h> 11#include <mach-o/dyld_priv.h> 12#include <sys/syscall.h> 13#include <sys/stackshot.h> 14#include <uuid/uuid.h> 15#include <servers/bootstrap.h> 16#include <pthread/workqueue_private.h> 17#include <dispatch/private.h> 18#include <stdalign.h> 19#import <zlib.h> 20#import <IOKit/IOKitLib.h> 21#import <IOKit/IOKitLibPrivate.h> 22#import <IOKit/IOKitKeysPrivate.h> 23 24T_GLOBAL_META( 25 T_META_NAMESPACE("xnu.stackshot"), 26 T_META_RADAR_COMPONENT_NAME("xnu"), 27 T_META_RADAR_COMPONENT_VERSION("stackshot"), 28 T_META_OWNER("jonathan_w_adams"), 29 T_META_CHECK_LEAKS(false), 30 T_META_ASROOT(true) 31 ); 32 33static const char *current_process_name(void); 34static void verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count); 35static void parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra); 36static void parse_thread_group_stackshot(void **sbuf, size_t sslen); 37static uint64_t stackshot_timestamp(void *ssbuf, size_t sslen); 38static void initialize_thread(void); 39 40static uint64_t global_flags = 0; 41 42#define DEFAULT_STACKSHOT_BUFFER_SIZE (1024 * 1024) 43#define MAX_STACKSHOT_BUFFER_SIZE (6 * 1024 * 1024) 44 45#define SRP_SERVICE_NAME "com.apple.xnu.test.stackshot.special_reply_port" 46 47/* bit flags for parse_stackshot */ 48#define PARSE_STACKSHOT_DELTA 0x01 49#define PARSE_STACKSHOT_ZOMBIE 0x02 50#define PARSE_STACKSHOT_SHAREDCACHE_LAYOUT 0x04 51#define PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL 0x08 52#define PARSE_STACKSHOT_TURNSTILEINFO 0x10 53#define PARSE_STACKSHOT_POSTEXEC 0x20 54#define PARSE_STACKSHOT_WAITINFO_CSEG 0x40 55#define PARSE_STACKSHOT_WAITINFO_SRP 0x80 56#define PARSE_STACKSHOT_TRANSLATED 0x100 57#define PARSE_STACKSHOT_SHAREDCACHE_FLAGS 0x200 58#define PARSE_STACKSHOT_EXEC_INPROGRESS 0x400 59#define PARSE_STACKSHOT_TRANSITIONING 0x800 60#define PARSE_STACKSHOT_ASYNCSTACK 0x1000 61#define PARSE_STACKSHOT_COMPACTINFO 0x2000 /* TODO: rdar://88789261 */ 62#define PARSE_STACKSHOT_DRIVERKIT 0x4000 63#define PARSE_STACKSHOT_THROTTLED_SP 0x8000 64#define PARSE_STACKSHOT_SUSPENDINFO 0x10000 65 66/* keys for 'extra' dictionary for parse_stackshot */ 67static const NSString* zombie_child_pid_key = @"zombie_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_ZOMBIE 68static const NSString* postexec_child_unique_pid_key = @"postexec_child_unique_pid"; // -> @(unique_pid), required for PARSE_STACKSHOT_POSTEXEC 69static const NSString* cseg_expected_threadid_key = @"cseg_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_WAITINFO_CSEG 70static const NSString* srp_expected_threadid_key = @"srp_expected_threadid"; // -> @(tid), this or ..._pid required for PARSE_STACKSHOT_WAITINFO_SRP 71static const NSString* srp_expected_pid_key = @"srp_expected_pid"; // -> @(pid), this or ..._threadid required for PARSE_STACKSHOT_WAITINFO_SRP 72static const NSString* translated_child_pid_key = @"translated_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSLATED 73static const NSString* sharedcache_child_pid_key = @"sharedcache_child_pid"; // @(pid), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS 74static const NSString* sharedcache_child_sameaddr_key = @"sharedcache_child_sameaddr"; // @(0 or 1), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS 75static const NSString* exec_inprogress_pid_key = @"exec_inprogress_pid"; 76static const NSString* exec_inprogress_found_key = @"exec_inprogress_found"; // callback when inprogress is found 77static const NSString* transitioning_pid_key = @"transitioning_task_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSITIONING 78static const NSString* asyncstack_expected_threadid_key = @"asyncstack_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_ASYNCSTACK 79static const NSString* asyncstack_expected_stack_key = @"asyncstack_expected_stack"; // -> @[pc...]), expected PCs for asyncstack 80static const NSString* driverkit_found_key = @"driverkit_found_key"; // callback when driverkit process is found. argument is the process pid. 81static const NSString* sp_throttled_expected_ctxt_key = @"sp_throttled_expected_ctxt_key"; // -> @(ctxt), required for PARSE_STACKSHOT_THROTTLED_SP 82static const NSString* sp_throttled_expect_flag = @"sp_throttled_expect_flag"; // -> @(is_throttled), required for PARSE_STACKSHOT_THROTTLED_SP 83 84 85#define TEST_STACKSHOT_QUEUE_LABEL "houston.we.had.a.problem" 86#define TEST_STACKSHOT_QUEUE_LABEL_LENGTH sizeof(TEST_STACKSHOT_QUEUE_LABEL) 87 88#define THROTTLED_SERVICE_NAME "com.apple.xnu.test.stackshot.throttled_service" 89 90T_DECL(microstackshots, "test the microstackshot syscall") 91{ 92 void *buf = NULL; 93 unsigned int size = DEFAULT_STACKSHOT_BUFFER_SIZE; 94 95 while (1) { 96 buf = malloc(size); 97 T_QUIET; T_ASSERT_NOTNULL(buf, "allocated stackshot buffer"); 98 99#pragma clang diagnostic push 100#pragma clang diagnostic ignored "-Wdeprecated-declarations" 101 int len = syscall(SYS_microstackshot, buf, size, 102 (uint32_t) STACKSHOT_GET_MICROSTACKSHOT); 103#pragma clang diagnostic pop 104 if (len == ENOSYS) { 105 T_SKIP("microstackshot syscall failed, likely not compiled with CONFIG_TELEMETRY"); 106 } 107 if (len == -1 && errno == ENOSPC) { 108 /* syscall failed because buffer wasn't large enough, try again */ 109 free(buf); 110 buf = NULL; 111 size *= 2; 112 T_ASSERT_LE(size, (unsigned int)MAX_STACKSHOT_BUFFER_SIZE, 113 "growing stackshot buffer to sane size"); 114 continue; 115 } 116 T_ASSERT_POSIX_SUCCESS(len, "called microstackshot syscall"); 117 break; 118 } 119 120 T_EXPECT_EQ(*(uint32_t *)buf, 121 (uint32_t)STACKSHOT_MICRO_SNAPSHOT_MAGIC, 122 "magic value for microstackshot matches"); 123 124 free(buf); 125} 126 127struct scenario { 128 const char *name; 129 uint64_t flags; 130 bool quiet; 131 bool should_fail; 132 bool maybe_unsupported; 133 bool maybe_enomem; 134 bool no_recordfile; 135 pid_t target_pid; 136 bool target_kernel; 137 uint64_t since_timestamp; 138 uint32_t size_hint; 139 dt_stat_time_t timer; 140}; 141 142static void 143quiet(struct scenario *scenario) 144{ 145 if (scenario->timer || scenario->quiet) { 146 T_QUIET; 147 } 148} 149 150static void 151take_stackshot(struct scenario *scenario, bool compress_ok, void (^cb)(void *buf, size_t size)) 152{ 153start: 154 initialize_thread(); 155 156 void *config = stackshot_config_create(); 157 quiet(scenario); 158 T_ASSERT_NOTNULL(config, "created stackshot config"); 159 160 int ret = stackshot_config_set_flags(config, scenario->flags | global_flags); 161 quiet(scenario); 162 T_ASSERT_POSIX_ZERO(ret, "set flags %#llx on stackshot config", scenario->flags); 163 164 if (scenario->size_hint > 0) { 165 ret = stackshot_config_set_size_hint(config, scenario->size_hint); 166 quiet(scenario); 167 T_ASSERT_POSIX_ZERO(ret, "set size hint %" PRIu32 " on stackshot config", 168 scenario->size_hint); 169 } 170 171 if (scenario->target_pid > 0) { 172 ret = stackshot_config_set_pid(config, scenario->target_pid); 173 quiet(scenario); 174 T_ASSERT_POSIX_ZERO(ret, "set target pid %d on stackshot config", 175 scenario->target_pid); 176 } else if (scenario->target_kernel) { 177 ret = stackshot_config_set_pid(config, 0); 178 quiet(scenario); 179 T_ASSERT_POSIX_ZERO(ret, "set kernel target on stackshot config"); 180 } 181 182 if (scenario->since_timestamp > 0) { 183 ret = stackshot_config_set_delta_timestamp(config, scenario->since_timestamp); 184 quiet(scenario); 185 T_ASSERT_POSIX_ZERO(ret, "set since timestamp %" PRIu64 " on stackshot config", 186 scenario->since_timestamp); 187 } 188 189 int retries_remaining = 5; 190 191retry: ; 192 uint64_t start_time = mach_absolute_time(); 193 ret = stackshot_capture_with_config(config); 194 uint64_t end_time = mach_absolute_time(); 195 196 if (scenario->should_fail) { 197 T_EXPECTFAIL; 198 T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config"); 199 return; 200 } 201 202 if (ret == EBUSY || ret == ETIMEDOUT) { 203 if (retries_remaining > 0) { 204 if (!scenario->timer) { 205 T_LOG("stackshot_capture_with_config failed with %s (%d), retrying", 206 strerror(ret), ret); 207 } 208 209 retries_remaining--; 210 goto retry; 211 } else { 212 T_ASSERT_POSIX_ZERO(ret, 213 "called stackshot_capture_with_config (no retries remaining)"); 214 } 215 } else if ((ret == ENOTSUP) && scenario->maybe_unsupported) { 216 T_SKIP("kernel indicated this stackshot configuration is not supported"); 217 } else if ((ret == ENOMEM) && scenario->maybe_enomem) { 218 T_SKIP("insufficient available memory to run test"); 219 } else { 220 quiet(scenario); 221 T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config"); 222 } 223 224 if (scenario->timer) { 225 dt_stat_mach_time_add(scenario->timer, end_time - start_time); 226 } 227 void *buf = stackshot_config_get_stackshot_buffer(config); 228 size_t size = stackshot_config_get_stackshot_size(config); 229 if (scenario->name && !scenario->no_recordfile) { 230 char sspath[MAXPATHLEN]; 231 strlcpy(sspath, scenario->name, sizeof(sspath)); 232 strlcat(sspath, ".kcdata", sizeof(sspath)); 233 T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(sspath, sizeof(sspath)), 234 "create result file path"); 235 236 if (!scenario->quiet) { 237 T_LOG("writing stackshot to %s", sspath); 238 } 239 240 FILE *f = fopen(sspath, "w"); 241 T_WITH_ERRNO; T_QUIET; T_ASSERT_NOTNULL(f, 242 "open stackshot output file"); 243 244 size_t written = fwrite(buf, size, 1, f); 245 T_QUIET; T_ASSERT_POSIX_SUCCESS(written, "wrote stackshot to file"); 246 247 fclose(f); 248 } 249 cb(buf, size); 250 if (compress_ok) { 251 if (global_flags == 0) { 252 T_LOG("Restarting test with compression"); 253 global_flags |= STACKSHOT_DO_COMPRESS; 254 goto start; 255 } else { 256 global_flags = 0; 257 } 258 } 259 260 ret = stackshot_config_dealloc(config); 261 T_QUIET; T_EXPECT_POSIX_ZERO(ret, "deallocated stackshot config"); 262} 263 264T_DECL(simple_compressed, "take a simple compressed stackshot") 265{ 266 struct scenario scenario = { 267 .name = "kcdata_compressed", 268 .flags = (STACKSHOT_DO_COMPRESS | STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS | 269 STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 270 }; 271 272 T_LOG("taking compressed kcdata stackshot"); 273 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 274 parse_stackshot(0, ssbuf, sslen, nil); 275 }); 276} 277 278T_DECL(panic_compressed, "take a compressed stackshot with the same flags as a panic stackshot") 279{ 280 uint64_t stackshot_flags = (STACKSHOT_SAVE_KEXT_LOADINFO | 281 STACKSHOT_SAVE_LOADINFO | 282 STACKSHOT_KCDATA_FORMAT | 283 STACKSHOT_ENABLE_BT_FAULTING | 284 STACKSHOT_ENABLE_UUID_FAULTING | 285 STACKSHOT_DO_COMPRESS | 286 STACKSHOT_NO_IO_STATS | 287 STACKSHOT_THREAD_WAITINFO | 288#if TARGET_OS_MAC 289 STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT | 290#endif 291 STACKSHOT_DISABLE_LATENCY_INFO); 292 293 struct scenario scenario = { 294 .name = "kcdata_panic_compressed", 295 .flags = stackshot_flags, 296 }; 297 298 T_LOG("taking compressed kcdata stackshot with panic flags"); 299 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 300 parse_stackshot(0, ssbuf, sslen, nil); 301 }); 302} 303 304T_DECL(kcdata, "test that kcdata stackshots can be taken and parsed") 305{ 306 struct scenario scenario = { 307 .name = "kcdata", 308 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS | 309 STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 310 }; 311 312 T_LOG("taking kcdata stackshot"); 313 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 314 parse_stackshot(0, ssbuf, sslen, nil); 315 }); 316} 317 318static void 319get_stats(stackshot_stats_t *_Nonnull out) 320{ 321 size_t oldlen = sizeof (*out); 322 bzero(out, oldlen); 323 int result = sysctlbyname("kern.stackshot_stats", out, &oldlen, NULL, 0); 324 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(result, "reading \"kern.stackshot_stats\" sysctl should succeed"); 325 T_EXPECT_EQ(oldlen, sizeof (*out), "kernel should update full stats structure"); 326} 327 328static void 329log_stats(mach_timebase_info_data_t timebase, uint64_t now, const char *name, stackshot_stats_t stat) 330{ 331 uint64_t last_ago = (now - stat.ss_last_start) * timebase.numer / timebase.denom; 332 uint64_t last_duration = (stat.ss_last_end - stat.ss_last_start) * timebase.numer / timebase.denom; 333 uint64_t total_duration = (stat.ss_duration) * timebase.numer / timebase.denom; 334 335 uint64_t nanosec = 1000000000llu; 336 T_LOG("%s: %8lld stackshots, %10lld.%09lld total nsecs, last %lld.%09lld secs ago, %lld.%09lld secs long", 337 name, stat.ss_count, 338 total_duration / nanosec, total_duration % nanosec, 339 last_ago / nanosec, last_ago % nanosec, 340 last_duration / nanosec, last_duration % nanosec); 341} 342 343T_DECL(stats, "test that stackshot stats can be read out and change when a stackshot occurs") 344{ 345 mach_timebase_info_data_t timebase = {0, 0}; 346 mach_timebase_info(&timebase); 347 348 struct scenario scenario = { 349 .name = "kcdata", 350 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 351 }; 352 353 stackshot_stats_t pre, post; 354 355 get_stats(&pre); 356 357 T_LOG("taking kcdata stackshot"); 358 take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) { 359 (void)0; 360 }); 361 362 get_stats(&post); 363 364 uint64_t now = mach_absolute_time(); 365 366 log_stats(timebase, now, " pre", pre); 367 log_stats(timebase, now, " post", post); 368 369 int64_t delta_stackshots = (int64_t)(post.ss_count - pre.ss_count); 370 int64_t delta_duration = (int64_t)(post.ss_duration - pre.ss_duration) * (int64_t)timebase.numer / (int64_t)timebase.denom; 371 int64_t delta_nsec = delta_duration % 1000000000ll; 372 if (delta_nsec < 0) { 373 delta_nsec += 1000000000ll; 374 } 375 T_LOG("delta: %+8lld stackshots, %+10lld.%09lld total nsecs", delta_stackshots, delta_duration / 1000000000ll, delta_nsec); 376 377 T_EXPECT_LT(pre.ss_last_start, pre.ss_last_end, "pre: stackshot should take time"); 378 T_EXPECT_LT(pre.ss_count, post.ss_count, "stackshot count should increase when a stackshot is taken"); 379 T_EXPECT_LT(pre.ss_duration, post.ss_duration, "stackshot duration should increase when a stackshot is taken"); 380 T_EXPECT_LT(pre.ss_last_end, post.ss_last_start, "previous end should be less than new start after a stackshot"); 381 T_EXPECT_LT(post.ss_last_start, post.ss_last_end, "post: stackshot should take time"); 382} 383 384T_DECL(kcdata_faulting, "test that kcdata stackshots while faulting can be taken and parsed") 385{ 386 struct scenario scenario = { 387 .name = "faulting", 388 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 389 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT 390 | STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING), 391 }; 392 393 T_LOG("taking faulting stackshot"); 394 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 395 parse_stackshot(0, ssbuf, sslen, nil); 396 }); 397} 398 399T_DECL(bad_flags, "test a poorly-formed stackshot syscall") 400{ 401 struct scenario scenario = { 402 .flags = STACKSHOT_SAVE_IN_KERNEL_BUFFER /* not allowed from user space */, 403 .should_fail = true, 404 }; 405 406 T_LOG("attempting to take stackshot with kernel-only flag"); 407 take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) { 408 T_ASSERT_FAIL("stackshot data callback called"); 409 }); 410} 411 412T_DECL(delta, "test delta stackshots") 413{ 414 struct scenario scenario = { 415 .name = "delta", 416 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 417 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 418 }; 419 420 T_LOG("taking full stackshot"); 421 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 422 uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen); 423 424 T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time); 425 426 parse_stackshot(0, ssbuf, sslen, nil); 427 428 struct scenario delta_scenario = { 429 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 430 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT 431 | STACKSHOT_COLLECT_DELTA_SNAPSHOT), 432 .since_timestamp = stackshot_time 433 }; 434 435 take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) { 436 parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil); 437 }); 438 }); 439} 440 441T_DECL(shared_cache_layout, "test stackshot inclusion of shared cache layout") 442{ 443 struct scenario scenario = { 444 .name = "shared_cache_layout", 445 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 446 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT | 447 STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT), 448 }; 449 450 size_t shared_cache_length; 451 const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length); 452 if (cache_header == NULL) { 453 T_SKIP("Device not running with shared cache, skipping test..."); 454 } 455 456 if (shared_cache_length == 0) { 457 T_SKIP("dyld reports that currently running shared cache has zero length"); 458 } 459 460 T_LOG("taking stackshot with STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT set"); 461 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 462 parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_LAYOUT, ssbuf, sslen, nil); 463 }); 464} 465 466T_DECL(stress, "test that taking stackshots for 60 seconds doesn't crash the system") 467{ 468 uint64_t max_diff_time = 60ULL /* seconds */ * 1000000000ULL; 469 uint64_t start_time; 470 471 struct scenario scenario = { 472 .name = "stress", 473 .quiet = true, 474 .flags = (STACKSHOT_KCDATA_FORMAT | 475 STACKSHOT_THREAD_WAITINFO | 476 STACKSHOT_SAVE_LOADINFO | 477 STACKSHOT_SAVE_KEXT_LOADINFO | 478 STACKSHOT_GET_GLOBAL_MEM_STATS | 479 STACKSHOT_SAVE_IMP_DONATION_PIDS | 480 STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT | 481 STACKSHOT_THREAD_GROUP | 482 STACKSHOT_SAVE_JETSAM_COALITIONS | 483 STACKSHOT_ASID | 484 0), 485 }; 486 487 start_time = clock_gettime_nsec_np(CLOCK_MONOTONIC); 488 while (clock_gettime_nsec_np(CLOCK_MONOTONIC) - start_time < max_diff_time) { 489 take_stackshot(&scenario, false, ^(void * __unused ssbuf, 490 size_t __unused sslen) { 491 printf("."); 492 fflush(stdout); 493 }); 494 495 /* 496 * After the first stackshot, there's no point in continuing to 497 * write them to disk, and it wears down the SSDs. 498 */ 499 scenario.no_recordfile = true; 500 501 /* Leave some time for the testing infrastructure to catch up */ 502 usleep(10000); 503 504 } 505 printf("\n"); 506} 507 508T_DECL(dispatch_queue_label, "test that kcdata stackshots contain libdispatch queue labels") 509{ 510 struct scenario scenario = { 511 .name = "kcdata", 512 .flags = (STACKSHOT_GET_DQ | STACKSHOT_KCDATA_FORMAT), 513 }; 514 dispatch_semaphore_t child_ready_sem, parent_done_sem; 515 dispatch_queue_t dq; 516 517#if TARGET_OS_WATCH 518 T_SKIP("This test is flaky on watches: 51663346"); 519#endif 520 521 child_ready_sem = dispatch_semaphore_create(0); 522 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "dqlabel child semaphore"); 523 524 parent_done_sem = dispatch_semaphore_create(0); 525 T_QUIET; T_ASSERT_NOTNULL(parent_done_sem, "dqlabel parent semaphore"); 526 527 dq = dispatch_queue_create(TEST_STACKSHOT_QUEUE_LABEL, NULL); 528 T_QUIET; T_ASSERT_NOTNULL(dq, "dispatch queue"); 529 530 /* start the helper thread */ 531 dispatch_async(dq, ^{ 532 dispatch_semaphore_signal(child_ready_sem); 533 534 dispatch_semaphore_wait(parent_done_sem, DISPATCH_TIME_FOREVER); 535 }); 536 537 /* block behind the child starting up */ 538 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 539 540 T_LOG("taking kcdata stackshot with libdispatch queue labels"); 541 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 542 parse_stackshot(PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL, ssbuf, sslen, nil); 543 }); 544 545 dispatch_semaphore_signal(parent_done_sem); 546} 547 548#define CACHEADDR_ENV "STACKSHOT_TEST_DYLDADDR" 549T_HELPER_DECL(spawn_reslide_child, "child process to spawn with alternate slide") 550{ 551 size_t shared_cache_len; 552 const void *addr, *prevaddr; 553 uintmax_t v; 554 char *endptr; 555 556 const char *cacheaddr_env = getenv(CACHEADDR_ENV); 557 T_QUIET; T_ASSERT_NOTNULL(cacheaddr_env, "getenv("CACHEADDR_ENV")"); 558 errno = 0; 559 endptr = NULL; 560 v = strtoumax(cacheaddr_env, &endptr, 16); /* read hex value */ 561 T_WITH_ERRNO; T_QUIET; T_ASSERT_NE(v, 0l, "getenv(%s) = \"%s\" should be a non-zero hex number", CACHEADDR_ENV, cacheaddr_env); 562 T_QUIET; T_ASSERT_EQ(*endptr, 0, "getenv(%s) = \"%s\" endptr \"%s\" should be empty", CACHEADDR_ENV, cacheaddr_env, endptr); 563 564 prevaddr = (const void *)v; 565 addr = _dyld_get_shared_cache_range(&shared_cache_len); 566 T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address"); 567 568 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(getppid(), (addr == prevaddr) ? SIGUSR2 : SIGUSR1), "signaled parent to take stackshot"); 569 for (;;) { 570 (void) pause(); /* parent will kill -9 us */ 571 } 572} 573 574T_DECL(shared_cache_flags, "tests stackshot's task_ss_flags for the shared cache") 575{ 576 posix_spawnattr_t attr; 577 char *env_addr; 578 char path[PATH_MAX]; 579 __block bool child_same_addr = false; 580 581 uint32_t path_size = sizeof(path); 582 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 583 char *args[] = { path, "-n", "spawn_reslide_child", NULL }; 584 pid_t pid; 585 size_t shared_cache_len; 586 const void *addr; 587 588 dispatch_source_t child_diffsig_src, child_samesig_src; 589 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 590 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "shared_cache child semaphore"); 591 592 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 593 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 594 595 signal(SIGUSR1, SIG_IGN); 596 signal(SIGUSR2, SIG_IGN); 597 child_samesig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 598 T_QUIET; T_ASSERT_NOTNULL(child_samesig_src, "dispatch_source_create (child_samesig_src)"); 599 child_diffsig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR2, 0, signal_processing_q); 600 T_QUIET; T_ASSERT_NOTNULL(child_diffsig_src, "dispatch_source_create (child_diffsig_src)"); 601 602 /* child will signal us depending on if their addr is the same or different */ 603 dispatch_source_set_event_handler(child_samesig_src, ^{ child_same_addr = false; dispatch_semaphore_signal(child_ready_sem); }); 604 dispatch_source_set_event_handler(child_diffsig_src, ^{ child_same_addr = true; dispatch_semaphore_signal(child_ready_sem); }); 605 dispatch_activate(child_samesig_src); 606 dispatch_activate(child_diffsig_src); 607 608 addr = _dyld_get_shared_cache_range(&shared_cache_len); 609 T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address"); 610 611 T_QUIET; T_ASSERT_POSIX_SUCCESS(asprintf(&env_addr, "%p", addr), "asprintf of env_addr succeeded"); 612 T_QUIET; T_ASSERT_POSIX_SUCCESS(setenv(CACHEADDR_ENV, env_addr, true), "setting "CACHEADDR_ENV" to %s", env_addr); 613 614 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&attr), "posix_spawnattr_init"); 615 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_setflags(&attr, _POSIX_SPAWN_RESLIDE), "posix_spawnattr_setflags"); 616 int sp_ret = posix_spawn(&pid, path, NULL, &attr, args, environ); 617 T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 618 619 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 620 T_LOG("received signal from child (%s), capturing stackshot", child_same_addr ? "same shared cache addr" : "different shared cache addr"); 621 622 struct scenario scenario = { 623 .name = "shared_cache_flags", 624 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 625 | STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT 626 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 627 }; 628 629 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 630 int status; 631 /* First kill the child so we can reap it */ 632 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing spawned process"); 633 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on spawned child"); 634 T_QUIET; T_ASSERT_EQ(!!WIFSIGNALED(status), 1, "waitpid status should be signalled"); 635 T_QUIET; T_ASSERT_EQ(WTERMSIG(status), SIGKILL, "waitpid status should be SIGKILLed"); 636 637 parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_FLAGS, ssbuf, sslen, 638 @{sharedcache_child_pid_key: @(pid), sharedcache_child_sameaddr_key: @(child_same_addr ? 1 : 0)}); 639 }); 640} 641 642T_DECL(transitioning_tasks, "test that stackshot contains transitioning task info", T_META_BOOTARGS_SET("enable_proc_exit_lpexit_spin=1")) 643{ 644 int32_t sysctlValue = -1, numAttempts =0; 645 char path[PATH_MAX]; 646 uint32_t path_size = sizeof(path); 647 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 648 char *args[] = { path, "-n", "exec_child_preexec", NULL }; 649 650 dispatch_source_t child_sig_src; 651 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 652 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore"); 653 654 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 655 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 656 657 pid_t pid; 658 659 signal(SIGUSR1, SIG_IGN); 660 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 661 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 662 663 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 664 dispatch_activate(child_sig_src); 665 666 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), "set debug.proc_exit_lpexit_spin_pid=-1"); 667 668 int proc_exit_spin_pos = 0 ; 669 670 while (0 == sysctlbyname("debug.proc_exit_lpexit_spin_pos", NULL, NULL, &proc_exit_spin_pos, sizeof(proc_exit_spin_pos))) { 671 672 T_LOG(" ##### Testing while spinning in proc_exit at position %d ##### ", proc_exit_spin_pos); 673 674 int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL); 675 T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 676 677 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 678 679 struct proc_uniqidentifierinfo proc_info_data = { }; 680 int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data)); 681 T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO"); 682 T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data"); 683 684 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec"); 685 686 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 687 688 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &pid, sizeof(pid)), "set debug.proc_exit_lpexit_spin_pid = %d, ", pid); 689 690 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid); 691 692 sysctlValue = 0; 693 size_t len = sizeof(sysctlValue); 694 while (numAttempts < 5) { 695 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValue, &len, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning"); 696 if (sysctlValue != 1) numAttempts++; 697 else break; 698 sleep(1); 699 } 700 701 T_ASSERT_EQ_UINT(sysctlValue, 1, "find spinning task in proc_exit()"); 702 703 struct scenario scenario = { 704 .name = "transitioning_tasks", 705 .flags = (STACKSHOT_KCDATA_FORMAT) 706 }; 707 708 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 709 parse_stackshot(PARSE_STACKSHOT_TRANSITIONING, ssbuf, sslen, @{transitioning_pid_key: @(pid)}); 710 711 // Kill the child 712 int sysctlValueB = -1; 713 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValueB, sizeof(sysctlValueB)), "set debug.proc_exit_lpexit_spin_pid=-1"); 714 sleep(1); 715 size_t blen = sizeof(sysctlValueB); 716 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValueB, &blen, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning"); 717 T_ASSERT_EQ_UINT(sysctlValueB, 0, "make sure nothing is spining in proc_exit()"); 718 int status; 719 T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child"); 720 }); 721 722 proc_exit_spin_pos++; 723 } 724 725} 726 727static void *stuck_sysctl_thread(void *arg) { 728 int val = 1; 729 dispatch_semaphore_t child_thread_started = *(dispatch_semaphore_t *)arg; 730 731 dispatch_semaphore_signal(child_thread_started); 732 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread"); 733 734 return NULL; 735} 736 737T_HELPER_DECL(zombie_child, "child process to sample as a zombie") 738{ 739 pthread_t pthread; 740 dispatch_semaphore_t child_thread_started = dispatch_semaphore_create(0); 741 T_QUIET; T_ASSERT_NOTNULL(child_thread_started, "zombie child thread semaphore"); 742 743 /* spawn another thread to get stuck in the kernel, then call exit() to become a zombie */ 744 T_QUIET; T_ASSERT_POSIX_SUCCESS(pthread_create(&pthread, NULL, stuck_sysctl_thread, &child_thread_started), "pthread_create"); 745 746 dispatch_semaphore_wait(child_thread_started, DISPATCH_TIME_FOREVER); 747 748 /* sleep for a bit in the hope of ensuring that the other thread has called the sysctl before we signal the parent */ 749 usleep(100); 750 T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot"); 751 752 exit(0); 753} 754 755T_DECL(zombie, "tests a stackshot of a zombie task with a thread stuck in the kernel") 756{ 757 char path[PATH_MAX]; 758 uint32_t path_size = sizeof(path); 759 T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 760 char *args[] = { path, "-n", "zombie_child", NULL }; 761 762 dispatch_source_t child_sig_src; 763 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 764 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "zombie child semaphore"); 765 766 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 767 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 768 769 pid_t pid; 770 771 T_LOG("spawning a child"); 772 773 signal(SIGUSR1, SIG_IGN); 774 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 775 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 776 777 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 778 dispatch_activate(child_sig_src); 779 780 int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL); 781 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 782 783 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 784 785 T_LOG("received signal from child, capturing stackshot"); 786 787 struct proc_bsdshortinfo bsdshortinfo; 788 int retval, iterations_to_wait = 10; 789 790 while (iterations_to_wait > 0) { 791 retval = proc_pidinfo(pid, PROC_PIDT_SHORTBSDINFO, 0, &bsdshortinfo, sizeof(bsdshortinfo)); 792 if ((retval == 0) && errno == ESRCH) { 793 T_LOG("unable to find child using proc_pidinfo, assuming zombie"); 794 break; 795 } 796 797 T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDT_SHORTBSDINFO) returned a value > 0"); 798 T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(bsdshortinfo), "proc_pidinfo call for PROC_PIDT_SHORTBSDINFO returned expected size"); 799 800 if (bsdshortinfo.pbsi_flags & PROC_FLAG_INEXIT) { 801 T_LOG("child proc info marked as in exit"); 802 break; 803 } 804 805 iterations_to_wait--; 806 if (iterations_to_wait == 0) { 807 /* 808 * This will mark the test as failed but let it continue so we 809 * don't leave a process stuck in the kernel. 810 */ 811 T_FAIL("unable to discover that child is marked as exiting"); 812 } 813 814 /* Give the child a few more seconds to make it to exit */ 815 sleep(5); 816 } 817 818 /* Give the child some more time to make it through exit */ 819 sleep(10); 820 821 struct scenario scenario = { 822 .name = "zombie", 823 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 824 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 825 }; 826 827 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 828 /* First unwedge the child so we can reap it */ 829 int val = 1, status; 830 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child"); 831 832 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on zombie child"); 833 834 parse_stackshot(PARSE_STACKSHOT_ZOMBIE, ssbuf, sslen, @{zombie_child_pid_key: @(pid)}); 835 }); 836} 837 838T_HELPER_DECL(exec_child_preexec, "child process pre-exec") 839{ 840 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 841 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 842 843 signal(SIGUSR1, SIG_IGN); 844 dispatch_source_t parent_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 845 T_QUIET; T_ASSERT_NOTNULL(parent_sig_src, "dispatch_source_create (child_sig_src)"); 846 dispatch_source_set_event_handler(parent_sig_src, ^{ 847 848 // Parent took a timestamp then signaled us: exec into the next process 849 850 char path[PATH_MAX]; 851 uint32_t path_size = sizeof(path); 852 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 853 char *args[] = { path, "-n", "exec_child_postexec", NULL }; 854 855 T_QUIET; T_ASSERT_POSIX_ZERO(execve(args[0], args, NULL), "execing into exec_child_postexec"); 856 }); 857 dispatch_activate(parent_sig_src); 858 859 T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take timestamp"); 860 861 sleep(100); 862 // Should never get here 863 T_FAIL("Received signal to exec from parent"); 864} 865 866T_HELPER_DECL(exec_child_postexec, "child process post-exec to sample") 867{ 868 T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot"); 869 sleep(100); 870 // Should never get here 871 T_FAIL("Killed by parent"); 872} 873 874T_DECL(exec, "test getting full task snapshots for a task that execs") 875{ 876 char path[PATH_MAX]; 877 uint32_t path_size = sizeof(path); 878 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 879 char *args[] = { path, "-n", "exec_child_preexec", NULL }; 880 881 dispatch_source_t child_sig_src; 882 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 883 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore"); 884 885 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 886 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 887 888 pid_t pid; 889 890 T_LOG("spawning a child"); 891 892 signal(SIGUSR1, SIG_IGN); 893 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 894 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 895 896 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 897 dispatch_activate(child_sig_src); 898 899 int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL); 900 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 901 902 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 903 uint64_t start_time = mach_absolute_time(); 904 905 struct proc_uniqidentifierinfo proc_info_data = { }; 906 int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data)); 907 T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO"); 908 T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data"); 909 uint64_t unique_pid = proc_info_data.p_uniqueid; 910 911 T_LOG("received signal from pre-exec child, unique_pid is %llu, timestamp is %llu", unique_pid, start_time); 912 913 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec"); 914 915 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 916 917 T_LOG("received signal from post-exec child, capturing stackshot"); 918 919 struct scenario scenario = { 920 .name = "exec", 921 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 922 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT 923 | STACKSHOT_COLLECT_DELTA_SNAPSHOT), 924 .since_timestamp = start_time 925 }; 926 927 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 928 // Kill the child 929 int status; 930 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid); 931 T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child"); 932 933 parse_stackshot(PARSE_STACKSHOT_POSTEXEC | PARSE_STACKSHOT_DELTA, ssbuf, sslen, @{postexec_child_unique_pid_key: @(unique_pid)}); 934 }); 935} 936 937T_DECL(exec_inprogress, "test stackshots of processes in the middle of exec") 938{ 939 pid_t pid; 940 /* a BASH quine which execs itself as long as the parent doesn't exit */ 941 char *bash_prog = "[[ $PPID -ne 1 ]] && exec /bin/bash -c \"$0\" \"$0\""; 942 char *args[] = { "/bin/bash", "-c", bash_prog, bash_prog, NULL }; 943 944 posix_spawnattr_t sattr; 945 T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&sattr), "posix_spawnattr_init"); 946 T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, &sattr, args, NULL), "spawn exec_inprogress_child"); 947 948 struct scenario scenario = { 949 .name = "exec_inprogress", 950 .flags = (STACKSHOT_KCDATA_FORMAT), 951 .target_pid = pid, 952 }; 953 954 int tries = 0; 955 int tries_limit = 30; 956 __block bool found = false; 957 __block uint64_t cid1 = 0, cid2 = 0; 958 959 for (tries = 0; !found && tries < tries_limit; tries++) { 960 take_stackshot(&scenario, false, 961 ^( void *ssbuf, size_t sslen) { 962 parse_stackshot(PARSE_STACKSHOT_EXEC_INPROGRESS, 963 ssbuf, sslen, @{ 964 exec_inprogress_pid_key: @(pid), 965 exec_inprogress_found_key: ^(uint64_t id1, uint64_t id2) { found = true; cid1 = id1; cid2 = id2; }}); 966 }); 967 } 968 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing exec loop"); 969 T_ASSERT_TRUE(found, "able to find our execing process mid-exec in %d tries", tries); 970 T_ASSERT_NE(cid1, cid2, "container IDs for in-progress exec are unique"); 971 T_PASS("found mid-exec process in %d tries", tries); 972} 973 974#ifdef _LP64 975#if __has_feature(ptrauth_calls) 976#define __ptrauth_swift_async_context_parent \ 977 __ptrauth(ptrauth_key_process_independent_data, 1, 0xbda2) 978#define __ptrauth_swift_async_context_resume \ 979 __ptrauth(ptrauth_key_function_pointer, 1, 0xd707) 980#else 981#define __ptrauth_swift_async_context_parent 982#define __ptrauth_swift_async_context_resume 983#endif 984// Add 1 to match the symbolication aid added by the stackshot backtracer. 985#define asyncstack_frame(x) ((uintptr_t)(void *)ptrauth_strip((void *)(x), ptrauth_key_function_pointer) + 1) 986 987// This struct fakes the Swift AsyncContext struct which is used by 988// the Swift concurrency runtime. We only care about the first 2 fields. 989struct fake_async_context { 990 struct fake_async_context* __ptrauth_swift_async_context_parent next; 991 void(*__ptrauth_swift_async_context_resume resume_pc)(void); 992}; 993 994static void 995level1_func() 996{ 997} 998static void 999level2_func() 1000{ 1001} 1002 1003// Create a chain of fake async contexts; sync with asyncstack_expected_stack below 1004static alignas(16) struct fake_async_context level1 = { 0, level1_func }; 1005static alignas(16) struct fake_async_context level2 = { &level1, level2_func }; 1006 1007struct async_test_semaphores { 1008 dispatch_semaphore_t child_ready_sem; /* signal parent we're ready */ 1009 dispatch_semaphore_t child_exit_sem; /* parent tells us to go away */ 1010}; 1011 1012#define ASYNCSTACK_THREAD_NAME "asyncstack_thread" 1013 1014static void __attribute__((noinline, not_tail_called)) 1015expect_asyncstack(void *arg) 1016{ 1017 struct async_test_semaphores *async_ts = arg; 1018 1019 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_setname_np(ASYNCSTACK_THREAD_NAME), 1020 "set thread name to %s", ASYNCSTACK_THREAD_NAME); 1021 1022 /* Tell the main thread we're all set up, then wait for permission to exit */ 1023 dispatch_semaphore_signal(async_ts->child_ready_sem); 1024 dispatch_semaphore_wait(async_ts->child_exit_sem, DISPATCH_TIME_FOREVER); 1025 usleep(1); /* make sure we don't tailcall semaphore_wait */ 1026} 1027 1028static void * 1029asyncstack_thread(void *arg) 1030{ 1031 uint64_t *fp = __builtin_frame_address(0); 1032 // We cannot use a variable of pointer type, because this ABI is valid 1033 // on arm64_32 where pointers are 32bits, but the context pointer will 1034 // still be stored in a 64bits slot on the stack. 1035#if __has_feature(ptrauth_calls) 1036#define __stack_context_auth __ptrauth(ptrauth_key_process_dependent_data, 1, \ 1037 0xc31a) 1038 struct fake_async_context * __stack_context_auth ctx = &level2; 1039#else // __has_feature(ptrauth_calls) 1040 /* struct fake_async_context * */uint64_t ctx = (uintptr_t)&level2; 1041#endif // !__has_feature(ptrauth_calls) 1042 1043 // The signature of an async frame on the OS stack is: 1044 // [ <AsyncContext address>, <Saved FP | (1<<60)>, <return address> ] 1045 // The Async context must be right before the saved FP on the stack. This 1046 // should happen naturally in an optimized build as it is the only 1047 // variable on the stack. 1048 // This function cannot use T_ASSERT_* becuse it changes the stack 1049 // layout. 1050 assert((uintptr_t)fp - (uintptr_t)&ctx == 8); 1051 1052 // Modify the saved FP on the stack to include the async frame marker 1053 *fp |= (0x1ULL << 60); 1054 expect_asyncstack(arg); 1055 return NULL; 1056} 1057 1058T_DECL(asyncstack, "test swift async stack entries") 1059{ 1060 struct scenario scenario = { 1061 .name = "asyncstack", 1062 .flags = STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO, 1063 }; 1064 struct async_test_semaphores async_ts = { 1065 .child_ready_sem = dispatch_semaphore_create(0), 1066 .child_exit_sem = dispatch_semaphore_create(0), 1067 }; 1068 T_QUIET; T_ASSERT_NOTNULL(async_ts.child_ready_sem, "child_ready_sem alloc"); 1069 T_QUIET; T_ASSERT_NOTNULL(async_ts.child_exit_sem, "child_exit_sem alloc"); 1070 1071 pthread_t pthread; 1072 __block uint64_t threadid = 0; 1073 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_create(&pthread, NULL, asyncstack_thread, &async_ts), "pthread_create"); 1074 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_threadid_np(pthread, &threadid), "pthread_threadid_np"); 1075 1076 dispatch_semaphore_wait(async_ts.child_ready_sem, DISPATCH_TIME_FOREVER); 1077 1078 take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) { 1079 parse_stackshot(PARSE_STACKSHOT_ASYNCSTACK, ssbuf, sslen, @{ 1080 asyncstack_expected_threadid_key: @(threadid), 1081 asyncstack_expected_stack_key: @[ @(asyncstack_frame(level2_func)), @(asyncstack_frame(level1_func)) ], 1082 }); 1083 }); 1084 1085 dispatch_semaphore_signal(async_ts.child_exit_sem); 1086 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_join(pthread, NULL), "wait for thread"); 1087 1088} 1089#endif 1090 1091static uint32_t 1092get_user_promotion_basepri(void) 1093{ 1094 mach_msg_type_number_t count = THREAD_POLICY_STATE_COUNT; 1095 struct thread_policy_state thread_policy; 1096 boolean_t get_default = FALSE; 1097 mach_port_t thread_port = pthread_mach_thread_np(pthread_self()); 1098 1099 kern_return_t kr = thread_policy_get(thread_port, THREAD_POLICY_STATE, 1100 (thread_policy_t)&thread_policy, &count, &get_default); 1101 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_policy_get"); 1102 return thread_policy.thps_user_promotion_basepri; 1103} 1104 1105static int 1106get_pri(thread_t thread_port) 1107{ 1108 kern_return_t kr; 1109 1110 thread_extended_info_data_t extended_info; 1111 mach_msg_type_number_t count = THREAD_EXTENDED_INFO_COUNT; 1112 kr = thread_info(thread_port, THREAD_EXTENDED_INFO, 1113 (thread_info_t)&extended_info, &count); 1114 1115 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_info"); 1116 1117 return extended_info.pth_curpri; 1118} 1119 1120 1121T_DECL(turnstile_singlehop, "turnstile single hop test") 1122{ 1123 dispatch_queue_t dq1, dq2; 1124 dispatch_semaphore_t sema_x; 1125 dispatch_queue_attr_t dq1_attr, dq2_attr; 1126 __block qos_class_t main_qos = 0; 1127 __block int main_relpri = 0, main_relpri2 = 0, main_afterpri = 0; 1128 struct scenario scenario = { 1129 .name = "turnstile_singlehop", 1130 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 1131 }; 1132 dq1_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_UTILITY, 0); 1133 dq2_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_USER_INITIATED, 0); 1134 pthread_mutex_t lock_a = PTHREAD_MUTEX_INITIALIZER; 1135 pthread_mutex_t lock_b = PTHREAD_MUTEX_INITIALIZER; 1136 1137 pthread_mutex_t *lockap = &lock_a, *lockbp = &lock_b; 1138 1139 dq1 = dispatch_queue_create("q1", dq1_attr); 1140 dq2 = dispatch_queue_create("q2", dq2_attr); 1141 sema_x = dispatch_semaphore_create(0); 1142 1143 pthread_mutex_lock(lockap); 1144 dispatch_async(dq1, ^{ 1145 pthread_mutex_lock(lockbp); 1146 T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class"); 1147 T_LOG("The priority of q1 is %d\n", get_pri(mach_thread_self())); 1148 dispatch_semaphore_signal(sema_x); 1149 pthread_mutex_lock(lockap); 1150 }); 1151 dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER); 1152 1153 T_LOG("Async1 completed"); 1154 1155 pthread_set_qos_class_self_np(QOS_CLASS_UTILITY, 0); 1156 T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class"); 1157 T_LOG("The priority of main is %d\n", get_pri(mach_thread_self())); 1158 main_relpri = get_pri(mach_thread_self()); 1159 1160 dispatch_async(dq2, ^{ 1161 T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri2), "get qos class"); 1162 T_LOG("The priority of q2 is %d\n", get_pri(mach_thread_self())); 1163 dispatch_semaphore_signal(sema_x); 1164 pthread_mutex_lock(lockbp); 1165 }); 1166 dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER); 1167 1168 T_LOG("Async2 completed"); 1169 1170 while (1) { 1171 main_afterpri = (int) get_user_promotion_basepri(); 1172 if (main_relpri != main_afterpri) { 1173 T_LOG("Success with promotion pri is %d", main_afterpri); 1174 break; 1175 } 1176 1177 usleep(100); 1178 } 1179 1180 take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) { 1181 parse_stackshot(PARSE_STACKSHOT_TURNSTILEINFO, ssbuf, sslen, nil); 1182 }); 1183} 1184 1185 1186static void 1187expect_instrs_cycles_in_stackshot(void *ssbuf, size_t sslen) 1188{ 1189 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 1190 1191 bool in_task = false; 1192 bool in_thread = false; 1193 bool saw_instrs_cycles = false; 1194 iter = kcdata_iter_next(iter); 1195 1196 KCDATA_ITER_FOREACH(iter) { 1197 switch (kcdata_iter_type(iter)) { 1198 case KCDATA_TYPE_CONTAINER_BEGIN: 1199 switch (kcdata_iter_container_type(iter)) { 1200 case STACKSHOT_KCCONTAINER_TASK: 1201 in_task = true; 1202 saw_instrs_cycles = false; 1203 break; 1204 1205 case STACKSHOT_KCCONTAINER_THREAD: 1206 in_thread = true; 1207 saw_instrs_cycles = false; 1208 break; 1209 1210 default: 1211 break; 1212 } 1213 break; 1214 1215 case STACKSHOT_KCTYPE_INSTRS_CYCLES: 1216 saw_instrs_cycles = true; 1217 break; 1218 1219 case KCDATA_TYPE_CONTAINER_END: 1220 if (in_thread) { 1221 T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles, 1222 "saw instructions and cycles in thread"); 1223 in_thread = false; 1224 } else if (in_task) { 1225 T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles, 1226 "saw instructions and cycles in task"); 1227 in_task = false; 1228 } 1229 1230 default: 1231 break; 1232 } 1233 } 1234} 1235 1236static void 1237skip_if_monotonic_unsupported(void) 1238{ 1239 int supported = 0; 1240 size_t supported_size = sizeof(supported); 1241 int ret = sysctlbyname("kern.monotonic.supported", &supported, 1242 &supported_size, 0, 0); 1243 if (ret < 0 || !supported) { 1244 T_SKIP("monotonic is unsupported"); 1245 } 1246} 1247 1248T_DECL(instrs_cycles, "test a getting instructions and cycles in stackshot") 1249{ 1250 skip_if_monotonic_unsupported(); 1251 1252 struct scenario scenario = { 1253 .name = "instrs-cycles", 1254 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES 1255 | STACKSHOT_KCDATA_FORMAT), 1256 }; 1257 1258 T_LOG("attempting to take stackshot with instructions and cycles"); 1259 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1260 parse_stackshot(0, ssbuf, sslen, nil); 1261 expect_instrs_cycles_in_stackshot(ssbuf, sslen); 1262 }); 1263} 1264 1265T_DECL(delta_instrs_cycles, 1266 "test delta stackshots with instructions and cycles") 1267{ 1268 skip_if_monotonic_unsupported(); 1269 1270 struct scenario scenario = { 1271 .name = "delta-instrs-cycles", 1272 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES 1273 | STACKSHOT_KCDATA_FORMAT), 1274 }; 1275 1276 T_LOG("taking full stackshot"); 1277 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1278 uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen); 1279 1280 T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time); 1281 1282 parse_stackshot(0, ssbuf, sslen, nil); 1283 expect_instrs_cycles_in_stackshot(ssbuf, sslen); 1284 1285 struct scenario delta_scenario = { 1286 .name = "delta-instrs-cycles-next", 1287 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES 1288 | STACKSHOT_KCDATA_FORMAT 1289 | STACKSHOT_COLLECT_DELTA_SNAPSHOT), 1290 .since_timestamp = stackshot_time, 1291 }; 1292 1293 take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) { 1294 parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil); 1295 expect_instrs_cycles_in_stackshot(dssbuf, dsslen); 1296 }); 1297 }); 1298} 1299 1300static void 1301check_thread_groups_supported() 1302{ 1303 int err; 1304 int supported = 0; 1305 size_t supported_size = sizeof(supported); 1306 err = sysctlbyname("kern.thread_groups_supported", &supported, &supported_size, NULL, 0); 1307 1308 if (err || !supported) 1309 T_SKIP("thread groups not supported on this system"); 1310} 1311 1312T_DECL(thread_groups, "test getting thread groups in stackshot") 1313{ 1314 check_thread_groups_supported(); 1315 1316 struct scenario scenario = { 1317 .name = "thread-groups", 1318 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_GROUP 1319 | STACKSHOT_KCDATA_FORMAT), 1320 }; 1321 1322 T_LOG("attempting to take stackshot with thread group flag"); 1323 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1324 parse_thread_group_stackshot(ssbuf, sslen); 1325 }); 1326} 1327 1328T_DECL(compactinfo, "test compactinfo inclusion") 1329{ 1330 struct scenario scenario = { 1331 .name = "compactinfo", 1332 .target_pid = getpid(), 1333 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_SAVE_DYLD_COMPACTINFO 1334 | STACKSHOT_KCDATA_FORMAT), 1335 }; 1336 1337 T_LOG("attempting to take stackshot with compactinfo flag"); 1338 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1339 parse_stackshot(PARSE_STACKSHOT_COMPACTINFO, ssbuf, sslen, nil); 1340 }); 1341} 1342 1343T_DECL(suspendinfo, "test task suspend info inclusion") 1344{ 1345 struct scenario scenario = { 1346 .name = "suspendinfo", 1347 .target_pid = getpid(), 1348 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 1349 }; 1350 1351 T_LOG("attempting to take stackshot with suspendinfo flag"); 1352 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1353 parse_stackshot(PARSE_STACKSHOT_SUSPENDINFO, ssbuf, sslen, nil); 1354 }); 1355} 1356 1357static NSMutableSet * find_driverkit_pids(io_registry_entry_t root) { 1358 NSMutableSet * driverkit_pids = [NSMutableSet setWithCapacity:3]; 1359 io_registry_entry_t current = IO_OBJECT_NULL; 1360 io_iterator_t iter = IO_OBJECT_NULL; 1361 1362 T_EXPECT_MACH_SUCCESS(IORegistryEntryGetChildIterator(root, kIOServicePlane, &iter), "get registry iterator"); 1363 1364 while ((current = IOIteratorNext(iter)) != IO_OBJECT_NULL) { 1365 if (_IOObjectConformsTo(current, "IOUserServer", kIOClassNameOverrideNone)) { 1366 CFMutableDictionaryRef cfProperties = NULL; 1367 NSMutableDictionary * properties; 1368 NSString * client_creator_info; 1369 NSArray<NSString *> *creator_info_array; 1370 pid_t pid; 1371 1372 T_QUIET; T_EXPECT_MACH_SUCCESS(IORegistryEntryCreateCFProperties(current, &cfProperties, kCFAllocatorDefault, kNilOptions), "get properties"); 1373 properties = CFBridgingRelease(cfProperties); 1374 T_QUIET; T_ASSERT_NOTNULL(properties, "properties is not null"); 1375 client_creator_info = properties[@kIOUserClientCreatorKey]; 1376 creator_info_array = [client_creator_info componentsSeparatedByString:@","]; 1377 if ([creator_info_array[0] hasPrefix:@"pid"]) { 1378 NSArray<NSString *> *pid_info = [creator_info_array[0] componentsSeparatedByString:@" "]; 1379 T_QUIET; T_ASSERT_EQ(pid_info.count, 2UL, "Get pid info components from %s", creator_info_array[0].UTF8String); 1380 pid = pid_info[1].intValue; 1381 } else { 1382 T_ASSERT_FAIL("No pid info in client creator info: %s", client_creator_info.UTF8String); 1383 } 1384 T_LOG("Found driver pid %d", pid); 1385 [driverkit_pids addObject:[NSNumber numberWithInt:pid]]; 1386 } else { 1387 [driverkit_pids unionSet:find_driverkit_pids(current)]; 1388 } 1389 IOObjectRelease(current); 1390 } 1391 1392 IOObjectRelease(iter); 1393 return driverkit_pids; 1394} 1395 1396T_DECL(driverkit, "test driverkit inclusion") 1397{ 1398 struct scenario scenario = { 1399 .name = "driverkit", 1400 .target_kernel = true, 1401 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT 1402 | STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL), 1403 }; 1404 1405 io_registry_entry_t root = IORegistryGetRootEntry(kIOMainPortDefault); 1406 NSMutableSet * driverkit_pids = find_driverkit_pids(root); 1407 IOObjectRelease(root); 1408 1409 T_LOG("expecting to find %lu driverkit processes", [driverkit_pids count]); 1410 T_LOG("attempting to take stackshot with STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL flag"); 1411 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1412 parse_stackshot(PARSE_STACKSHOT_DRIVERKIT, ssbuf, sslen, @{ 1413 driverkit_found_key: ^(pid_t pid) { 1414 [driverkit_pids removeObject:[NSNumber numberWithInt:pid]]; 1415 }}); 1416 }); 1417 1418 T_EXPECT_EQ([driverkit_pids count], (NSUInteger)0, "found expected number of driverkit processes"); 1419} 1420 1421static void 1422parse_page_table_asid_stackshot(void **ssbuf, size_t sslen) 1423{ 1424 bool seen_asid = false; 1425 bool seen_page_table_snapshot = false; 1426 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 1427 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, 1428 "buffer provided is a stackshot"); 1429 1430 iter = kcdata_iter_next(iter); 1431 KCDATA_ITER_FOREACH(iter) { 1432 switch (kcdata_iter_type(iter)) { 1433 case KCDATA_TYPE_ARRAY: { 1434 T_QUIET; 1435 T_ASSERT_TRUE(kcdata_iter_array_valid(iter), 1436 "checked that array is valid"); 1437 1438 if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_PAGE_TABLES) { 1439 continue; 1440 } 1441 1442 T_ASSERT_FALSE(seen_page_table_snapshot, "check that we haven't yet seen a page table snapshot"); 1443 seen_page_table_snapshot = true; 1444 1445 T_ASSERT_EQ((size_t) kcdata_iter_array_elem_size(iter), sizeof(uint64_t), 1446 "check that each element of the pagetable dump is the expected size"); 1447 1448 uint64_t *pt_array = kcdata_iter_payload(iter); 1449 uint32_t elem_count = kcdata_iter_array_elem_count(iter); 1450 uint32_t j; 1451 bool nonzero_tte = false; 1452 for (j = 0; j < elem_count;) { 1453 T_QUIET; T_ASSERT_LE(j + 4, elem_count, "check for valid page table segment header"); 1454 uint64_t pa = pt_array[j]; 1455 uint64_t num_entries = pt_array[j + 1]; 1456 uint64_t start_va = pt_array[j + 2]; 1457 uint64_t end_va = pt_array[j + 3]; 1458 1459 T_QUIET; T_ASSERT_NE(pa, (uint64_t) 0, "check that the pagetable physical address is non-zero"); 1460 T_QUIET; T_ASSERT_EQ(pa % (num_entries * sizeof(uint64_t)), (uint64_t) 0, "check that the pagetable physical address is correctly aligned"); 1461 T_QUIET; T_ASSERT_NE(num_entries, (uint64_t) 0, "check that a pagetable region has more than 0 entries"); 1462 T_QUIET; T_ASSERT_LE(j + 4 + num_entries, (uint64_t) elem_count, "check for sufficient space in page table array"); 1463 T_QUIET; T_ASSERT_GT(end_va, start_va, "check for valid VA bounds in page table segment header"); 1464 1465 for (uint32_t k = j + 4; k < (j + 4 + num_entries); ++k) { 1466 if (pt_array[k] != 0) { 1467 nonzero_tte = true; 1468 T_QUIET; T_ASSERT_EQ((pt_array[k] >> 48) & 0xf, (uint64_t) 0, "check that bits[48:51] of arm64 TTE are clear"); 1469 // L0-L2 table and non-compressed L3 block entries should always have bit 1 set; assumes L0-L2 blocks will not be used outside the kernel 1470 bool table = ((pt_array[k] & 0x2) != 0); 1471 if (table) { 1472 T_QUIET; T_ASSERT_NE(pt_array[k] & ((1ULL << 48) - 1) & ~((1ULL << 12) - 1), (uint64_t) 0, "check that arm64 TTE physical address is non-zero"); 1473 } else { // should be a compressed PTE 1474 T_QUIET; T_ASSERT_NE(pt_array[k] & 0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has at least one of bits [63:62] set"); 1475 T_QUIET; T_ASSERT_EQ(pt_array[k] & ~0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has no other bits besides [63:62] set"); 1476 } 1477 } 1478 } 1479 1480 j += (4 + num_entries); 1481 } 1482 T_ASSERT_TRUE(nonzero_tte, "check that we saw at least one non-empty TTE"); 1483 T_ASSERT_EQ(j, elem_count, "check that page table dump size matches extent of last header"); 1484 break; 1485 } 1486 case STACKSHOT_KCTYPE_ASID: { 1487 T_ASSERT_FALSE(seen_asid, "check that we haven't yet seen an ASID"); 1488 seen_asid = true; 1489 } 1490 } 1491 } 1492 T_ASSERT_TRUE(seen_page_table_snapshot, "check that we have seen a page table snapshot"); 1493 T_ASSERT_TRUE(seen_asid, "check that we have seen an ASID"); 1494} 1495 1496T_DECL(dump_page_tables, "test stackshot page table dumping support") 1497{ 1498 struct scenario scenario = { 1499 .name = "asid-page-tables", 1500 .flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_ASID | STACKSHOT_PAGE_TABLES), 1501 .size_hint = (9ull << 20), // 9 MB 1502 .target_pid = getpid(), 1503 .maybe_unsupported = true, 1504 .maybe_enomem = true, 1505 }; 1506 1507 T_LOG("attempting to take stackshot with ASID and page table flags"); 1508 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1509 parse_page_table_asid_stackshot(ssbuf, sslen); 1510 }); 1511} 1512 1513static void stackshot_verify_current_proc_uuid_info(void **ssbuf, size_t sslen, uint64_t expected_offset, const struct proc_uniqidentifierinfo *proc_info_data) 1514{ 1515 const uuid_t *current_uuid = (const uuid_t *)(&proc_info_data->p_uuid); 1516 1517 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 1518 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "buffer provided is a stackshot"); 1519 1520 iter = kcdata_iter_next(iter); 1521 1522 KCDATA_ITER_FOREACH(iter) { 1523 switch (kcdata_iter_type(iter)) { 1524 case KCDATA_TYPE_ARRAY: { 1525 T_QUIET; T_ASSERT_TRUE(kcdata_iter_array_valid(iter), "checked that array is valid"); 1526 if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO64) { 1527 struct user64_dyld_uuid_info *info = (struct user64_dyld_uuid_info *) kcdata_iter_payload(iter); 1528 if (uuid_compare(*current_uuid, info->imageUUID) == 0) { 1529 T_ASSERT_EQ(expected_offset, info->imageLoadAddress, "found matching UUID with matching binary offset"); 1530 return; 1531 } 1532 } else if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO) { 1533 struct user32_dyld_uuid_info *info = (struct user32_dyld_uuid_info *) kcdata_iter_payload(iter); 1534 if (uuid_compare(*current_uuid, info->imageUUID) == 0) { 1535 T_ASSERT_EQ(expected_offset, ((uint64_t) info->imageLoadAddress), "found matching UUID with matching binary offset"); 1536 return; 1537 } 1538 } 1539 break; 1540 } 1541 default: 1542 break; 1543 } 1544 } 1545 1546 T_FAIL("failed to find matching UUID in stackshot data"); 1547} 1548 1549T_DECL(translated, "tests translated bit is set correctly") 1550{ 1551#if !(TARGET_OS_OSX && TARGET_CPU_ARM64) 1552 T_SKIP("Only valid on Apple silicon Macs") 1553#endif 1554 // Get path of stackshot_translated_child helper binary 1555 char path[PATH_MAX]; 1556 uint32_t path_size = sizeof(path); 1557 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 1558 char* binary_name = strrchr(path, '/'); 1559 if (binary_name) binary_name++; 1560 T_QUIET; T_ASSERT_NOTNULL(binary_name, "Find basename in path '%s'", path); 1561 strlcpy(binary_name, "stackshot_translated_child", path_size - (binary_name - path)); 1562 char *args[] = { path, NULL }; 1563 1564 dispatch_source_t child_sig_src; 1565 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 1566 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore"); 1567 1568 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 1569 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 1570 1571 signal(SIGUSR1, SIG_IGN); 1572 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 1573 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 1574 1575 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 1576 dispatch_activate(child_sig_src); 1577 1578 // Spawn child 1579 pid_t pid; 1580 T_LOG("spawning translated child"); 1581 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, NULL, args, NULL), "spawned process '%s' with PID %d", args[0], pid); 1582 1583 // Wait for the the child to spawn up 1584 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 1585 1586 // Make sure the child is running and is translated 1587 int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, pid }; 1588 struct kinfo_proc process_info; 1589 size_t bufsize = sizeof(process_info); 1590 T_QUIET; T_ASSERT_POSIX_SUCCESS(sysctl(mib, (unsigned)(sizeof(mib)/sizeof(int)), &process_info, &bufsize, NULL, 0), "get translated child process info"); 1591 T_QUIET; T_ASSERT_GT(bufsize, (size_t)0, "process info is not empty"); 1592 T_QUIET; T_ASSERT_TRUE((process_info.kp_proc.p_flag & P_TRANSLATED), "KERN_PROC_PID reports child is translated"); 1593 1594 T_LOG("capturing stackshot"); 1595 1596 struct scenario scenario = { 1597 .name = "translated", 1598 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 1599 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 1600 }; 1601 1602 take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) { 1603 parse_stackshot(PARSE_STACKSHOT_TRANSLATED, ssbuf, sslen, @{translated_child_pid_key: @(pid)}); 1604 }); 1605 1606 // Kill the child 1607 int status; 1608 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGTERM), "kill translated child"); 1609 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on translated child"); 1610 1611} 1612 1613T_DECL(proc_uuid_info, "tests that the main binary UUID for a proc is always populated") 1614{ 1615 struct proc_uniqidentifierinfo proc_info_data = { }; 1616 mach_msg_type_number_t count; 1617 kern_return_t kernel_status; 1618 task_dyld_info_data_t task_dyld_info; 1619 struct dyld_all_image_infos *target_infos; 1620 int retval; 1621 bool found_image_in_image_infos = false; 1622 uint64_t expected_mach_header_offset = 0; 1623 1624 /* Find the UUID of our main binary */ 1625 retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data)); 1626 T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO"); 1627 T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data"); 1628 1629 uuid_string_t str = {}; 1630 uuid_unparse(*(uuid_t*)&proc_info_data.p_uuid, str); 1631 T_LOG("Found current UUID is %s", str); 1632 1633 /* Find the location of the dyld image info metadata */ 1634 count = TASK_DYLD_INFO_COUNT; 1635 kernel_status = task_info(mach_task_self(), TASK_DYLD_INFO, (task_info_t)&task_dyld_info, &count); 1636 T_QUIET; T_ASSERT_EQ(kernel_status, KERN_SUCCESS, "retrieve task_info for TASK_DYLD_INFO"); 1637 1638 target_infos = (struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr; 1639 1640 /* Find our binary in the dyld image info array */ 1641 for (int i = 0; i < (int) target_infos->uuidArrayCount; i++) { 1642 if (uuid_compare(target_infos->uuidArray[i].imageUUID, *(uuid_t*)&proc_info_data.p_uuid) == 0) { 1643 expected_mach_header_offset = (uint64_t) target_infos->uuidArray[i].imageLoadAddress; 1644 found_image_in_image_infos = true; 1645 } 1646 } 1647 1648 T_ASSERT_TRUE(found_image_in_image_infos, "found binary image in dyld image info list"); 1649 1650 /* Overwrite the dyld image info data so the kernel has to fallback to the UUID stored in the proc structure */ 1651 target_infos->uuidArrayCount = 0; 1652 1653 struct scenario scenario = { 1654 .name = "proc_uuid_info", 1655 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 1656 .target_pid = getpid(), 1657 }; 1658 1659 T_LOG("attempting to take stackshot for current PID"); 1660 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1661 stackshot_verify_current_proc_uuid_info(ssbuf, sslen, expected_mach_header_offset, &proc_info_data); 1662 }); 1663} 1664 1665T_DECL(cseg_waitinfo, "test that threads stuck in the compressor report correct waitinfo") 1666{ 1667 struct scenario scenario = { 1668 .name = "cseg_waitinfo", 1669 .quiet = false, 1670 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 1671 }; 1672 __block uint64_t thread_id = 0; 1673 1674 dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot.cseg_waitinfo", NULL); 1675 dispatch_semaphore_t child_ok = dispatch_semaphore_create(0); 1676 1677 dispatch_async(dq, ^{ 1678 pthread_threadid_np(NULL, &thread_id); 1679 dispatch_semaphore_signal(child_ok); 1680 int val = 1; 1681 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread"); 1682 }); 1683 1684 dispatch_semaphore_wait(child_ok, DISPATCH_TIME_FOREVER); 1685 sleep(1); 1686 1687 T_LOG("taking stackshot"); 1688 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1689 int val = 1; 1690 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child thread"); 1691 parse_stackshot(PARSE_STACKSHOT_WAITINFO_CSEG, ssbuf, sslen, @{cseg_expected_threadid_key: @(thread_id)}); 1692 }); 1693} 1694 1695static void 1696srp_send( 1697 mach_port_t send_port, 1698 mach_port_t reply_port, 1699 mach_port_t msg_port) 1700{ 1701 kern_return_t ret = 0; 1702 1703 struct test_msg { 1704 mach_msg_header_t header; 1705 mach_msg_body_t body; 1706 mach_msg_port_descriptor_t port_descriptor; 1707 }; 1708 struct test_msg send_msg = { 1709 .header = { 1710 .msgh_remote_port = send_port, 1711 .msgh_local_port = reply_port, 1712 .msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, 1713 reply_port ? MACH_MSG_TYPE_MAKE_SEND_ONCE : 0, 1714 MACH_MSG_TYPE_MOVE_SEND, 1715 MACH_MSGH_BITS_COMPLEX), 1716 .msgh_id = 0x100, 1717 .msgh_size = sizeof(send_msg), 1718 }, 1719 .body = { 1720 .msgh_descriptor_count = 1, 1721 }, 1722 .port_descriptor = { 1723 .name = msg_port, 1724 .disposition = MACH_MSG_TYPE_MOVE_RECEIVE, 1725 .type = MACH_MSG_PORT_DESCRIPTOR, 1726 }, 1727 }; 1728 1729 if (msg_port == MACH_PORT_NULL) { 1730 send_msg.body.msgh_descriptor_count = 0; 1731 } 1732 1733 ret = mach_msg(&(send_msg.header), 1734 MACH_SEND_MSG | 1735 MACH_SEND_TIMEOUT | 1736 MACH_SEND_OVERRIDE, 1737 send_msg.header.msgh_size, 1738 0, 1739 MACH_PORT_NULL, 1740 10000, 1741 0); 1742 1743 T_ASSERT_MACH_SUCCESS(ret, "client mach_msg"); 1744} 1745 1746T_HELPER_DECL(srp_client, 1747 "Client used for the special_reply_port test") 1748{ 1749 pid_t ppid = getppid(); 1750 dispatch_semaphore_t can_continue = dispatch_semaphore_create(0); 1751 dispatch_queue_t dq = dispatch_queue_create("client_signalqueue", NULL); 1752 dispatch_source_t sig_src; 1753 1754 mach_msg_return_t mr; 1755 mach_port_t service_port; 1756 mach_port_t conn_port; 1757 mach_port_t special_reply_port; 1758 mach_port_options_t opts = { 1759 .flags = MPO_INSERT_SEND_RIGHT, 1760 }; 1761 1762 signal(SIGUSR1, SIG_IGN); 1763 sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq); 1764 1765 dispatch_source_set_event_handler(sig_src, ^{ 1766 dispatch_semaphore_signal(can_continue); 1767 }); 1768 dispatch_activate(sig_src); 1769 1770 /* lookup the mach service port for the parent */ 1771 kern_return_t kr = bootstrap_look_up(bootstrap_port, 1772 SRP_SERVICE_NAME, &service_port); 1773 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "client bootstrap_look_up"); 1774 1775 /* create the send-once right (special reply port) and message to send to the server */ 1776 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port); 1777 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct"); 1778 1779 special_reply_port = thread_get_special_reply_port(); 1780 T_QUIET; T_ASSERT_TRUE(MACH_PORT_VALID(special_reply_port), "get_thread_special_reply_port"); 1781 1782 /* send the message with the special reply port */ 1783 srp_send(service_port, special_reply_port, conn_port); 1784 1785 /* signal the parent to continue */ 1786 kill(ppid, SIGUSR1); 1787 1788 struct { 1789 mach_msg_header_t header; 1790 mach_msg_body_t body; 1791 mach_msg_port_descriptor_t port_descriptor; 1792 } rcv_msg = { 1793 .header = 1794 { 1795 .msgh_remote_port = MACH_PORT_NULL, 1796 .msgh_local_port = special_reply_port, 1797 .msgh_size = sizeof(rcv_msg), 1798 }, 1799 }; 1800 1801 /* wait on the reply from the parent (that we will never receive) */ 1802 mr = mach_msg(&(rcv_msg.header), 1803 (MACH_RCV_MSG | MACH_RCV_SYNC_WAIT), 1804 0, 1805 rcv_msg.header.msgh_size, 1806 special_reply_port, 1807 MACH_MSG_TIMEOUT_NONE, 1808 service_port); 1809 1810 /* not expected to execute as parent will SIGKILL client... */ 1811 T_LOG("client process exiting after sending message to parent (server)"); 1812} 1813 1814enum srp_test_type { 1815 SRP_TEST_THREAD, /* expect waiter on current thread */ 1816 SRP_TEST_PID, /* expect waiter on current PID */ 1817 SRP_TEST_EITHER, /* waiter could be on either */ 1818}; 1819 1820static void 1821check_srp_test(const char *name, enum srp_test_type ty) 1822{ 1823 struct scenario scenario = { 1824 .name = name, 1825 .quiet = false, 1826 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 1827 }; 1828 uint64_t thread_id = 0; 1829 pthread_threadid_np(NULL, &thread_id); 1830 if (ty == SRP_TEST_THREAD) { 1831 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1832 parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen, 1833 @{srp_expected_threadid_key: @(thread_id)}); 1834 }); 1835 } else if (ty == SRP_TEST_PID) { 1836 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1837 parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen, 1838 @{srp_expected_pid_key: @(getpid())}); 1839 }); 1840 } else { 1841 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1842 parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen, 1843 @{srp_expected_pid_key: @(getpid()), srp_expected_threadid_key: @(thread_id)}); 1844 }); 1845 } 1846 1847} 1848 1849 1850/* 1851 * Tests the stackshot wait info plumbing for synchronous IPC that doesn't use kevent on the server. 1852 * 1853 * (part 1): tests the scenario where a client sends a request that includes a special reply port 1854 * to a server that doesn't receive the message and doesn't copy the send-once right 1855 * into its address space as a result. for this case the special reply port is enqueued 1856 * in a port and we check which task has that receive right and use that info. (rdar://60440338) 1857 * (part 2): tests the scenario where a client sends a request that includes a special reply port 1858 * to a server that receives the message and copies in the send-once right, but doesn't 1859 * reply to the client. for this case the special reply port is copied out and the kernel 1860 * stashes the info about which task copied out the send once right. (rdar://60440592) 1861 * (part 3): tests the same as part 2, but uses kevents, which allow for 1862 * priority inheritance 1863 */ 1864T_DECL(special_reply_port, "test that tasks using special reply ports have correct waitinfo") 1865{ 1866 dispatch_semaphore_t can_continue = dispatch_semaphore_create(0); 1867 dispatch_queue_t dq = dispatch_queue_create("signalqueue", NULL); 1868 dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL); 1869 dispatch_source_t sig_src; 1870 char path[PATH_MAX]; 1871 uint32_t path_size = sizeof(path); 1872 T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 1873 char *client_args[] = { path, "-n", "srp_client", NULL }; 1874 pid_t client_pid; 1875 int sp_ret; 1876 kern_return_t kr; 1877 mach_port_t port; 1878 1879 /* setup the signal handler in the parent (server) */ 1880 T_LOG("setup sig handlers"); 1881 signal(SIGUSR1, SIG_IGN); 1882 sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq); 1883 1884 dispatch_source_set_event_handler(sig_src, ^{ 1885 dispatch_semaphore_signal(can_continue); 1886 }); 1887 dispatch_activate(sig_src); 1888 1889 /* register with the mach service name so the client can lookup and send a message to the parent (server) */ 1890 T_LOG("Server about to check in"); 1891 kr = bootstrap_check_in(bootstrap_port, SRP_SERVICE_NAME, &port); 1892 T_ASSERT_MACH_SUCCESS(kr, "server bootstrap_check_in"); 1893 1894 T_LOG("Launching client"); 1895 sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL); 1896 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid); 1897 T_LOG("Spawned client as PID %d", client_pid); 1898 1899 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 1900 T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear"); 1901 1902 /* 1903 * can_continue indicates the client has signaled us, but we want to make 1904 * sure they've actually blocked sending their mach message. It's cheesy, but 1905 * sleep() works for this. 1906 */ 1907 sleep(1); 1908 1909 /* 1910 * take the stackshot without calling receive to verify that the stackshot wait 1911 * info shows our (the server) thread for the scenario where the server has yet to 1912 * receive the message. 1913 */ 1914 T_LOG("Taking stackshot for part 1 coverage"); 1915 check_srp_test("srp", SRP_TEST_THREAD); 1916 1917 /* 1918 * receive the message from the client (which should copy the send once right into 1919 * our address space). 1920 */ 1921 struct { 1922 mach_msg_header_t header; 1923 mach_msg_body_t body; 1924 mach_msg_port_descriptor_t port_descriptor; 1925 } rcv_msg = { 1926 .header = 1927 { 1928 .msgh_remote_port = MACH_PORT_NULL, 1929 .msgh_local_port = port, 1930 .msgh_size = sizeof(rcv_msg), 1931 }, 1932 }; 1933 1934 T_LOG("server: starting sync receive\n"); 1935 1936 mach_msg_return_t mr; 1937 mr = mach_msg(&(rcv_msg.header), 1938 (MACH_RCV_MSG | MACH_RCV_TIMEOUT), 1939 0, 1940 4096, 1941 port, 1942 10000, 1943 MACH_PORT_NULL); 1944 T_QUIET; T_ASSERT_MACH_SUCCESS(mr, "mach_msg() recieve of message from client"); 1945 1946 /* 1947 * take the stackshot to verify that the stackshot wait info shows our (the server) PID 1948 * for the scenario where the server has received the message and copied in the send-once right. 1949 */ 1950 T_LOG("Taking stackshot for part 2 coverage"); 1951 check_srp_test("srp", SRP_TEST_PID); 1952 1953 /* cleanup - kill the client */ 1954 T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client"); 1955 T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit"); 1956 1957 // do it again, but using kevents 1958 T_LOG("Launching client"); 1959 sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL); 1960 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid); 1961 T_LOG("Spawned client as PID %d", client_pid); 1962 1963 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 1964 T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear"); 1965 1966 /* 1967 * can_continue indicates the client has signaled us, but we want to make 1968 * sure they've actually blocked sending their mach message. It's cheesy, but 1969 * sleep() works for this. 1970 */ 1971 sleep(1); 1972 1973 dispatch_mach_t dispatch_mach = dispatch_mach_create(SRP_SERVICE_NAME, machdq, 1974 ^(dispatch_mach_reason_t reason, 1975 dispatch_mach_msg_t message, 1976 mach_error_t error __unused) { 1977 switch (reason) { 1978 case DISPATCH_MACH_MESSAGE_RECEIVED: { 1979 size_t size = 0; 1980 mach_msg_header_t *msg __unused = dispatch_mach_msg_get_msg(message, &size); 1981 T_LOG("server: recieved %ld byte message", size); 1982 check_srp_test("turnstile_port_thread", SRP_TEST_THREAD); 1983 T_LOG("server: letting client go"); 1984 // drop the message on the ground, we'll kill the client later 1985 dispatch_semaphore_signal(can_continue); 1986 break; 1987 } 1988 default: 1989 break; 1990 } 1991 }); 1992 1993 dispatch_mach_connect(dispatch_mach, port, MACH_PORT_NULL, NULL); 1994 1995 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 1996 1997 /* cleanup - kill the client */ 1998 T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client"); 1999 T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit"); 2000} 2001 2002T_HELPER_DECL(throtlled_sp_client, 2003 "client that uses a connection port to send a message to a server") 2004{ 2005 mach_port_t conn_port, service_port, reply_port, *stash; 2006 mach_msg_type_number_t stash_cnt = 0; 2007 2008 kern_return_t kr = mach_ports_lookup(mach_task_self(), &stash, &stash_cnt); 2009 T_ASSERT_MACH_SUCCESS(kr, "mach_ports_lookup"); 2010 2011 service_port = stash[0]; 2012 T_ASSERT_TRUE(MACH_PORT_VALID(service_port), "valid service port"); 2013 mig_deallocate((vm_address_t)stash, stash_cnt * sizeof(stash[0])); 2014 2015 mach_port_options_t opts = { 2016 .flags = MPO_INSERT_SEND_RIGHT 2017 | MPO_CONNECTION_PORT, 2018 .service_port_name = service_port, 2019 }; 2020 2021 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port); 2022 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct"); 2023 2024 mach_port_options_t opts2 = { 2025 .flags = MPO_REPLY_PORT 2026 }; 2027 kr = mach_port_construct(mach_task_self(), &opts2, 0ull, &reply_port); 2028 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct"); 2029 2030 /* XPC-like check-in message */ 2031 struct { 2032 mach_msg_header_t header; 2033 mach_msg_port_descriptor_t recvp; 2034 mach_msg_port_descriptor_t sendp; 2035 } checkin_message = { 2036 .header = 2037 { 2038 .msgh_remote_port = service_port, 2039 .msgh_local_port = MACH_PORT_NULL, 2040 .msgh_size = sizeof(checkin_message), 2041 .msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0), 2042 }, 2043 .recvp = 2044 { 2045 .type = MACH_MSG_PORT_DESCRIPTOR, 2046 .name = conn_port, 2047 .disposition = MACH_MSG_TYPE_MOVE_RECEIVE, 2048 }, 2049 .sendp = 2050 { 2051 .type = MACH_MSG_PORT_DESCRIPTOR, 2052 .name = reply_port, 2053 .disposition = MACH_MSG_TYPE_MAKE_SEND, 2054 } 2055 }; 2056 dispatch_mach_msg_t dmsg = dispatch_mach_msg_create((mach_msg_header_t *)&checkin_message, sizeof(checkin_message), 2057 DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL); 2058 2059 dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL); 2060 dispatch_mach_t dchannel = dispatch_mach_create(THROTTLED_SERVICE_NAME, machdq, 2061 ^(dispatch_mach_reason_t reason, 2062 dispatch_mach_msg_t message __unused, 2063 mach_error_t error __unused) { 2064 switch (reason) { 2065 case DISPATCH_MACH_CONNECTED: 2066 T_LOG("mach channel connected"); 2067 break; 2068 case DISPATCH_MACH_MESSAGE_SENT: 2069 T_LOG("sent mach message"); 2070 break; 2071 default: 2072 T_ASSERT_FAIL("Unexpected reply to channel reason %lu", reason); 2073 } 2074 }); 2075 dispatch_mach_connect(dchannel, reply_port, service_port, dmsg); 2076 dispatch_release(dmsg); 2077 2078 struct { 2079 mach_msg_header_t header; 2080 uint64_t request_id; 2081 } request = { 2082 .header = 2083 { 2084 .msgh_size = sizeof(request), 2085 .msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE), 2086 }, 2087 .request_id = 1, 2088 }; 2089 dispatch_mach_msg_t dmsg2 = dispatch_mach_msg_create((mach_msg_header_t *)&request, sizeof(request), 2090 DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL); 2091 2092 dispatch_mach_reason_t reason; 2093 mach_error_t error; 2094 2095 /* send the check-in message and the request message */ 2096 dispatch_mach_msg_t dreply = dispatch_mach_send_with_result_and_wait_for_reply(dchannel, 2097 dmsg2, 0, DISPATCH_MACH_SEND_DEFAULT, &reason, &error); 2098 dispatch_release(dmsg2); 2099 2100 /* not expected to execute as parent will SIGKILL client */ 2101 T_ASSERT_FAIL("client process exiting after receiving %s reply", dreply ? "non-null" : "null"); 2102} 2103 2104static void 2105check_throttled_sp(const char *test_name, uint64_t context, bool is_throttled) 2106{ 2107 struct scenario scenario = { 2108 .name = test_name, 2109 .quiet = false, 2110 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 2111 }; 2112 2113 T_LOG("taking stackshot %s", test_name); 2114 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2115 parse_stackshot(PARSE_STACKSHOT_THROTTLED_SP, ssbuf, sslen, 2116 @{sp_throttled_expected_ctxt_key: @(context), 2117 sp_throttled_expect_flag: @(is_throttled)}); 2118 }); 2119} 2120 2121/* Take stackshot when a client is blocked on the service port of a process, in the scenario when 2122 * the process with the receive right for the service port is: 2123 * (a) Monitoring the service port using kevents 2124 * (b) Not monitoring the service port 2125 */ 2126T_DECL(throttled_sp, 2127 "test that service port throttled flag is propagated to the stackshot correctly") 2128{ 2129 mach_port_t service_port; 2130 __block dispatch_semaphore_t can_continue = dispatch_semaphore_create(0); 2131 2132 char path[PATH_MAX]; 2133 uint32_t path_size = sizeof(path); 2134 T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 2135 char *client_args[] = { path, "-n", "throtlled_sp_client", NULL }; 2136 2137 __block uint64_t thread_id = 0; 2138 pid_t client_pid; 2139 int mark_throttled; 2140 2141 struct mach_service_port_info sp_info = {}; 2142 strcpy(sp_info.mspi_string_name, THROTTLED_SERVICE_NAME); 2143 sp_info.mspi_domain_type = (uint8_t)1; 2144 kern_return_t kr; 2145 2146 mach_port_options_t opts = { 2147 .flags = MPO_SERVICE_PORT | MPO_INSERT_SEND_RIGHT | MPO_CONTEXT_AS_GUARD | MPO_STRICT | MPO_TEMPOWNER, 2148 .service_port_info = &sp_info, 2149 }; 2150 2151 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &service_port); 2152 T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct %u", service_port); 2153 2154 /* Setup a dispatch source to monitor the service port similar to how launchd does. */ 2155 dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL); 2156 dispatch_source_t mach_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_MACH_RECV, service_port, 2157 DISPATCH_MACH_RECV_SYNC_PEEK, machdq); 2158 dispatch_source_set_event_handler(mach_src, ^{ 2159 pthread_threadid_np(NULL, &thread_id); 2160 dispatch_semaphore_signal(can_continue); 2161 }); 2162 dispatch_activate(mach_src); 2163 2164 /* Stash the port in task to make sure child also gets it */ 2165 kr = mach_ports_register(mach_task_self(), &service_port, 1); 2166 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_ports_register service port"); 2167 2168 mark_throttled = 1; 2169 kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled), 2170 MACH_PORT_SERVICE_THROTTLED_COUNT); 2171 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mark service port as throttled"); 2172 2173 int rc = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL); 2174 T_QUIET; T_ASSERT_POSIX_ZERO(rc, "spawned process '%s' with PID %d", client_args[0], client_pid); 2175 T_LOG("Spawned client as PID %d", client_pid); 2176 2177 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 2178 2179 /* The service port has received the check-in message. Take stackshot for scenario (a). */ 2180 check_throttled_sp("throttled_service_port_monitored", thread_id, true); 2181 2182 /* This simulates a throttled spawn when the service port is no longer monitored. */ 2183 dispatch_source_cancel(mach_src); 2184 2185 /* Take stackshot for scenario (b) */ 2186 check_throttled_sp("throttled_service_port_unmonitored", (uint64_t)getpid(), true); 2187 2188 mark_throttled = 0; 2189 kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled), 2190 MACH_PORT_SERVICE_THROTTLED_COUNT); 2191 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "unmark service port as throttled"); 2192 2193 /* Throttled flag should not be set when the port is not throttled. */ 2194 check_throttled_sp("unthrottled_service_port_unmonitored", (uint64_t)getpid(), false); 2195 2196 /* cleanup - kill the client */ 2197 T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client"); 2198 T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit"); 2199} 2200 2201#pragma mark performance tests 2202 2203#define SHOULD_REUSE_SIZE_HINT 0x01 2204#define SHOULD_USE_DELTA 0x02 2205#define SHOULD_TARGET_SELF 0x04 2206 2207static void 2208stackshot_perf(unsigned int options) 2209{ 2210 struct scenario scenario = { 2211 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 2212 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 2213 }; 2214 2215 dt_stat_t size = dt_stat_create("bytes", "size"); 2216 dt_stat_time_t duration = dt_stat_time_create("duration"); 2217 scenario.timer = duration; 2218 2219 if (options & SHOULD_TARGET_SELF) { 2220 scenario.target_pid = getpid(); 2221 } 2222 2223 while (!dt_stat_stable(duration) || !dt_stat_stable(size)) { 2224 __block uint64_t last_time = 0; 2225 __block uint32_t size_hint = 0; 2226 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2227 dt_stat_add(size, (double)sslen); 2228 last_time = stackshot_timestamp(ssbuf, sslen); 2229 size_hint = (uint32_t)sslen; 2230 }); 2231 if (options & SHOULD_USE_DELTA) { 2232 scenario.since_timestamp = last_time; 2233 scenario.flags |= STACKSHOT_COLLECT_DELTA_SNAPSHOT; 2234 } 2235 if (options & SHOULD_REUSE_SIZE_HINT) { 2236 scenario.size_hint = size_hint; 2237 } 2238 } 2239 2240 dt_stat_finalize(duration); 2241 dt_stat_finalize(size); 2242} 2243 2244static void 2245stackshot_flag_perf_noclobber(uint64_t flag, char *flagname) 2246{ 2247 struct scenario scenario = { 2248 .quiet = true, 2249 .flags = (flag | STACKSHOT_KCDATA_FORMAT), 2250 }; 2251 2252 dt_stat_t duration = dt_stat_create("nanoseconds per thread", "%s_duration", flagname); 2253 dt_stat_t size = dt_stat_create("bytes per thread", "%s_size", flagname); 2254 T_LOG("Testing \"%s\" = 0x%" PRIx64, flagname, flag); 2255 2256 while (!dt_stat_stable(duration) || !dt_stat_stable(size)) { 2257 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2258 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2259 unsigned long no_threads = 0; 2260 mach_timebase_info_data_t timebase = {0, 0}; 2261 uint64_t stackshot_duration = 0; 2262 int found = 0; 2263 T_QUIET; T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "stackshot buffer"); 2264 2265 KCDATA_ITER_FOREACH(iter) { 2266 switch(kcdata_iter_type(iter)) { 2267 case STACKSHOT_KCTYPE_THREAD_SNAPSHOT: { 2268 found |= 1; 2269 no_threads ++; 2270 break; 2271 } 2272 case STACKSHOT_KCTYPE_STACKSHOT_DURATION: { 2273 struct stackshot_duration *ssd = kcdata_iter_payload(iter); 2274 stackshot_duration = ssd->stackshot_duration; 2275 found |= 2; 2276 break; 2277 } 2278 case KCDATA_TYPE_TIMEBASE: { 2279 found |= 4; 2280 mach_timebase_info_data_t *tb = kcdata_iter_payload(iter); 2281 memcpy(&timebase, tb, sizeof(timebase)); 2282 break; 2283 } 2284 } 2285 } 2286 2287 T_QUIET; T_ASSERT_EQ(found, 0x7, "found everything needed"); 2288 2289 uint64_t ns = (stackshot_duration * timebase.numer) / timebase.denom; 2290 uint64_t per_thread_ns = ns / no_threads; 2291 uint64_t per_thread_size = sslen / no_threads; 2292 2293 dt_stat_add(duration, per_thread_ns); 2294 dt_stat_add(size, per_thread_size); 2295 }); 2296 } 2297 2298 dt_stat_finalize(duration); 2299 dt_stat_finalize(size); 2300} 2301 2302static void 2303stackshot_flag_perf(uint64_t flag, char *flagname) 2304{ 2305 /* 2306 * STACKSHOT_NO_IO_STATS disables data collection, so set it for 2307 * more accurate perfdata collection. 2308 */ 2309 flag |= STACKSHOT_NO_IO_STATS; 2310 2311 stackshot_flag_perf_noclobber(flag, flagname); 2312} 2313 2314 2315T_DECL(flag_perf, "test stackshot performance with different flags set", T_META_TAG_PERF) 2316{ 2317 stackshot_flag_perf_noclobber(STACKSHOT_NO_IO_STATS, "baseline"); 2318 stackshot_flag_perf_noclobber(0, "io_stats"); 2319 2320 stackshot_flag_perf(STACKSHOT_THREAD_WAITINFO, "thread_waitinfo"); 2321 stackshot_flag_perf(STACKSHOT_GET_DQ, "get_dq"); 2322 stackshot_flag_perf(STACKSHOT_SAVE_LOADINFO, "save_loadinfo"); 2323 stackshot_flag_perf(STACKSHOT_GET_GLOBAL_MEM_STATS, "get_global_mem_stats"); 2324 stackshot_flag_perf(STACKSHOT_SAVE_KEXT_LOADINFO, "save_kext_loadinfo"); 2325 stackshot_flag_perf(STACKSHOT_SAVE_IMP_DONATION_PIDS, "save_imp_donation_pids"); 2326 stackshot_flag_perf(STACKSHOT_ENABLE_BT_FAULTING, "enable_bt_faulting"); 2327 stackshot_flag_perf(STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT, "collect_sharedcache_layout"); 2328 stackshot_flag_perf(STACKSHOT_ENABLE_UUID_FAULTING, "enable_uuid_faulting"); 2329 stackshot_flag_perf(STACKSHOT_THREAD_GROUP, "thread_group"); 2330 stackshot_flag_perf(STACKSHOT_SAVE_JETSAM_COALITIONS, "save_jetsam_coalitions"); 2331 stackshot_flag_perf(STACKSHOT_INSTRS_CYCLES, "instrs_cycles"); 2332 stackshot_flag_perf(STACKSHOT_ASID, "asid"); 2333} 2334 2335T_DECL(perf_no_size_hint, "test stackshot performance with no size hint", 2336 T_META_TAG_PERF) 2337{ 2338 stackshot_perf(0); 2339} 2340 2341T_DECL(perf_size_hint, "test stackshot performance with size hint", 2342 T_META_TAG_PERF) 2343{ 2344 stackshot_perf(SHOULD_REUSE_SIZE_HINT); 2345} 2346 2347T_DECL(perf_process, "test stackshot performance targeted at process", 2348 T_META_TAG_PERF) 2349{ 2350 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_TARGET_SELF); 2351} 2352 2353T_DECL(perf_delta, "test delta stackshot performance", 2354 T_META_TAG_PERF) 2355{ 2356 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA); 2357} 2358 2359T_DECL(perf_delta_process, "test delta stackshot performance targeted at a process", 2360 T_META_TAG_PERF) 2361{ 2362 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | SHOULD_TARGET_SELF); 2363} 2364 2365T_DECL(stackshot_entitlement_report_test, "test stackshot entitlement report") 2366{ 2367 int sysctlValue = 1; 2368 T_ASSERT_POSIX_SUCCESS( 2369 sysctlbyname("debug.stackshot_entitlement_send_batch", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), 2370 "set debug.stackshot_entitlement_send_batch=1"); 2371 // having a way to verify that the coreanalytics event was received would be even better 2372 // See rdar://74197197 2373 T_PASS("entitlement test ran"); 2374} 2375 2376static uint64_t 2377stackshot_timestamp(void *ssbuf, size_t sslen) 2378{ 2379 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2380 2381 uint32_t type = kcdata_iter_type(iter); 2382 if (type != KCDATA_BUFFER_BEGIN_STACKSHOT && type != KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT) { 2383 T_ASSERT_FAIL("invalid kcdata type %u", kcdata_iter_type(iter)); 2384 } 2385 2386 iter = kcdata_iter_find_type(iter, KCDATA_TYPE_MACH_ABSOLUTE_TIME); 2387 T_QUIET; 2388 T_ASSERT_TRUE(kcdata_iter_valid(iter), "timestamp found in stackshot"); 2389 2390 return *(uint64_t *)kcdata_iter_payload(iter); 2391} 2392 2393#define TEST_THREAD_NAME "stackshot_test_thread" 2394 2395static void 2396parse_thread_group_stackshot(void **ssbuf, size_t sslen) 2397{ 2398 bool seen_thread_group_snapshot = false; 2399 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2400 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, 2401 "buffer provided is a stackshot"); 2402 2403 NSMutableSet *thread_groups = [[NSMutableSet alloc] init]; 2404 2405 iter = kcdata_iter_next(iter); 2406 KCDATA_ITER_FOREACH(iter) { 2407 switch (kcdata_iter_type(iter)) { 2408 case KCDATA_TYPE_ARRAY: { 2409 T_QUIET; 2410 T_ASSERT_TRUE(kcdata_iter_array_valid(iter), 2411 "checked that array is valid"); 2412 2413 if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_THREAD_GROUP_SNAPSHOT) { 2414 continue; 2415 } 2416 2417 seen_thread_group_snapshot = true; 2418 2419 if (kcdata_iter_array_elem_size(iter) >= sizeof(struct thread_group_snapshot_v3)) { 2420 struct thread_group_snapshot_v3 *tgs_array = kcdata_iter_payload(iter); 2421 for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) { 2422 struct thread_group_snapshot_v3 *tgs = tgs_array + j; 2423 [thread_groups addObject:@(tgs->tgs_id)]; 2424 } 2425 } 2426 else { 2427 struct thread_group_snapshot *tgs_array = kcdata_iter_payload(iter); 2428 for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) { 2429 struct thread_group_snapshot *tgs = tgs_array + j; 2430 [thread_groups addObject:@(tgs->tgs_id)]; 2431 } 2432 } 2433 break; 2434 } 2435 } 2436 } 2437 KCDATA_ITER_FOREACH(iter) { 2438 NSError *error = nil; 2439 2440 switch (kcdata_iter_type(iter)) { 2441 2442 case KCDATA_TYPE_CONTAINER_BEGIN: { 2443 T_QUIET; 2444 T_ASSERT_TRUE(kcdata_iter_container_valid(iter), 2445 "checked that container is valid"); 2446 2447 if (kcdata_iter_container_type(iter) != STACKSHOT_KCCONTAINER_THREAD) { 2448 break; 2449 } 2450 2451 NSDictionary *container = parseKCDataContainer(&iter, &error); 2452 T_QUIET; T_ASSERT_NOTNULL(container, "parsed thread container from stackshot"); 2453 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container"); 2454 2455 int tg = [container[@"thread_snapshots"][@"thread_group"] intValue]; 2456 2457 T_ASSERT_TRUE([thread_groups containsObject:@(tg)], "check that the thread group the thread is in exists"); 2458 2459 break; 2460 }; 2461 2462 } 2463 } 2464 T_ASSERT_TRUE(seen_thread_group_snapshot, "check that we have seen a thread group snapshot"); 2465} 2466 2467static void 2468verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count) 2469{ 2470 uuid_t cur_shared_cache_uuid; 2471 __block uint32_t lib_index = 0, libs_found = 0; 2472 2473 _dyld_get_shared_cache_uuid(cur_shared_cache_uuid); 2474 int result = dyld_shared_cache_iterate_text(cur_shared_cache_uuid, ^(const dyld_shared_cache_dylib_text_info* info) { 2475 T_QUIET; T_ASSERT_LT(lib_index, uuid_count, "dyld_shared_cache_iterate_text exceeded number of libraries returned by kernel"); 2476 2477 libs_found++; 2478 struct dyld_uuid_info_64 *cur_stackshot_uuid_entry = &uuids[lib_index]; 2479 T_QUIET; T_ASSERT_EQ(memcmp(info->dylibUuid, cur_stackshot_uuid_entry->imageUUID, sizeof(info->dylibUuid)), 0, 2480 "dyld returned UUID doesn't match kernel returned UUID"); 2481 T_QUIET; T_ASSERT_EQ(info->loadAddressUnslid, cur_stackshot_uuid_entry->imageLoadAddress, 2482 "dyld returned load address doesn't match kernel returned load address"); 2483 lib_index++; 2484 }); 2485 2486 T_ASSERT_EQ(result, 0, "iterate shared cache layout"); 2487 T_ASSERT_EQ(libs_found, uuid_count, "dyld iterator returned same number of libraries as kernel"); 2488 2489 T_LOG("verified %d libraries from dyld shared cache", libs_found); 2490} 2491 2492static void 2493check_shared_cache_uuid(uuid_t imageUUID) 2494{ 2495 static uuid_t shared_cache_uuid; 2496 static dispatch_once_t read_shared_cache_uuid; 2497 2498 dispatch_once(&read_shared_cache_uuid, ^{ 2499 T_QUIET; 2500 T_ASSERT_TRUE(_dyld_get_shared_cache_uuid(shared_cache_uuid), "retrieve current shared cache UUID"); 2501 }); 2502 T_QUIET; T_ASSERT_EQ(uuid_compare(shared_cache_uuid, imageUUID), 0, 2503 "dyld returned UUID doesn't match kernel returned UUID for system shared cache"); 2504} 2505 2506/* 2507 * extra dictionary contains data relevant for the given flags: 2508 * PARSE_STACKSHOT_ZOMBIE: zombie_child_pid_key -> @(pid) 2509 * PARSE_STACKSHOT_POSTEXEC: postexec_child_unique_pid_key -> @(unique_pid) 2510 */ 2511static void 2512parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra) 2513{ 2514 bool delta = (stackshot_parsing_flags & PARSE_STACKSHOT_DELTA); 2515 bool expect_sharedcache_child = (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_FLAGS); 2516 bool expect_zombie_child = (stackshot_parsing_flags & PARSE_STACKSHOT_ZOMBIE); 2517 bool expect_postexec_child = (stackshot_parsing_flags & PARSE_STACKSHOT_POSTEXEC); 2518 bool expect_cseg_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_CSEG); 2519 bool expect_translated_child = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSLATED); 2520 bool expect_shared_cache_layout = false; 2521 bool expect_shared_cache_uuid = !delta; 2522 bool expect_dispatch_queue_label = (stackshot_parsing_flags & PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL); 2523 bool expect_turnstile_lock = (stackshot_parsing_flags & PARSE_STACKSHOT_TURNSTILEINFO); 2524 bool expect_srp_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_SRP); 2525 bool expect_sp_throttled = (stackshot_parsing_flags & PARSE_STACKSHOT_THROTTLED_SP); 2526 bool expect_exec_inprogress = (stackshot_parsing_flags & PARSE_STACKSHOT_EXEC_INPROGRESS); 2527 bool expect_transitioning_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSITIONING); 2528 bool expect_asyncstack = (stackshot_parsing_flags & PARSE_STACKSHOT_ASYNCSTACK); 2529 bool expect_driverkit = (stackshot_parsing_flags & PARSE_STACKSHOT_DRIVERKIT); 2530 bool expect_suspendinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_SUSPENDINFO); 2531 bool found_zombie_child = false, found_postexec_child = false, found_shared_cache_layout = false, found_shared_cache_uuid = false; 2532 bool found_translated_child = false, found_transitioning_task = false; 2533 bool found_dispatch_queue_label = false, found_turnstile_lock = false; 2534 bool found_cseg_waitinfo = false, found_srp_waitinfo = false; 2535 bool found_sharedcache_child = false, found_sharedcache_badflags = false, found_sharedcache_self = false; 2536 bool found_asyncstack = false; 2537 bool found_throttled_service = false; 2538 uint64_t srp_expected_threadid = 0; 2539 pid_t zombie_child_pid = -1, srp_expected_pid = -1, sharedcache_child_pid = -1, throttled_service_ctx = -1; 2540 pid_t translated_child_pid = -1, transistioning_task_pid = -1; 2541 bool sharedcache_child_sameaddr = false, is_throttled = false; 2542 uint64_t postexec_child_unique_pid = 0, cseg_expected_threadid = 0; 2543 uint64_t sharedcache_child_flags = 0, sharedcache_self_flags = 0; 2544 uint64_t asyncstack_threadid = 0; 2545 NSArray *asyncstack_stack = nil; 2546 char *inflatedBufferBase = NULL; 2547 pid_t exec_inprogress_pid = -1; 2548 void (^exec_inprogress_cb)(uint64_t, uint64_t) = NULL; 2549 int exec_inprogress_found = 0; 2550 uint64_t exec_inprogress_containerid = 0; 2551 void (^driverkit_cb)(pid_t) = NULL; 2552 NSMutableDictionary *sharedCaches = [NSMutableDictionary new]; 2553 2554 if (expect_shared_cache_uuid) { 2555 uuid_t shared_cache_uuid; 2556 if (!_dyld_get_shared_cache_uuid(shared_cache_uuid)) { 2557 T_LOG("Skipping verifying shared cache UUID in stackshot data because not running with a shared cache"); 2558 expect_shared_cache_uuid = false; 2559 } 2560 } 2561 2562 if (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_LAYOUT) { 2563 size_t shared_cache_length = 0; 2564 const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length); 2565 T_QUIET; T_ASSERT_NOTNULL(cache_header, "current process running with shared cache"); 2566 T_QUIET; T_ASSERT_GT(shared_cache_length, sizeof(struct _dyld_cache_header), "valid shared cache length populated by _dyld_get_shared_cache_range"); 2567 2568 if (_dyld_shared_cache_is_locally_built()) { 2569 T_LOG("device running with locally built shared cache, expect shared cache layout"); 2570 expect_shared_cache_layout = true; 2571 } else { 2572 T_LOG("device running with B&I built shared-cache, no shared cache layout expected"); 2573 } 2574 } 2575 2576 if (expect_sharedcache_child) { 2577 NSNumber* pid_num = extra[sharedcache_child_pid_key]; 2578 NSNumber* sameaddr_num = extra[sharedcache_child_sameaddr_key]; 2579 T_QUIET; T_ASSERT_NOTNULL(pid_num, "sharedcache child pid provided"); 2580 T_QUIET; T_ASSERT_NOTNULL(sameaddr_num, "sharedcache child addrsame provided"); 2581 sharedcache_child_pid = [pid_num intValue]; 2582 T_QUIET; T_ASSERT_GT(sharedcache_child_pid, 0, "sharedcache child pid greater than zero"); 2583 sharedcache_child_sameaddr = [sameaddr_num intValue]; 2584 T_QUIET; T_ASSERT_GE([sameaddr_num intValue], 0, "sharedcache child sameaddr is boolean (0 or 1)"); 2585 T_QUIET; T_ASSERT_LE([sameaddr_num intValue], 1, "sharedcache child sameaddr is boolean (0 or 1)"); 2586 } 2587 2588 if (expect_transitioning_task) { 2589 NSNumber* pid_num = extra[transitioning_pid_key]; 2590 T_ASSERT_NOTNULL(pid_num, "transitioning task pid provided"); 2591 transistioning_task_pid = [pid_num intValue]; 2592 } 2593 2594 if (expect_zombie_child) { 2595 NSNumber* pid_num = extra[zombie_child_pid_key]; 2596 T_QUIET; T_ASSERT_NOTNULL(pid_num, "zombie child pid provided"); 2597 zombie_child_pid = [pid_num intValue]; 2598 T_QUIET; T_ASSERT_GT(zombie_child_pid, 0, "zombie child pid greater than zero"); 2599 } 2600 2601 if (expect_postexec_child) { 2602 NSNumber* unique_pid_num = extra[postexec_child_unique_pid_key]; 2603 T_QUIET; T_ASSERT_NOTNULL(unique_pid_num, "postexec child unique pid provided"); 2604 postexec_child_unique_pid = [unique_pid_num unsignedLongLongValue]; 2605 T_QUIET; T_ASSERT_GT(postexec_child_unique_pid, 0ull, "postexec child unique pid greater than zero"); 2606 } 2607 2608 if (expect_cseg_waitinfo) { 2609 NSNumber* tid_num = extra[cseg_expected_threadid_key]; 2610 T_QUIET; T_ASSERT_NOTNULL(tid_num, "cseg's expected thread id provided"); 2611 cseg_expected_threadid = tid_num.unsignedLongValue; 2612 T_QUIET; T_ASSERT_GT(cseg_expected_threadid, UINT64_C(0), "compressor segment thread is present"); 2613 } 2614 2615 if (expect_srp_waitinfo) { 2616 NSNumber* threadid_num = extra[srp_expected_threadid_key]; 2617 NSNumber* pid_num = extra[srp_expected_pid_key]; 2618 T_QUIET; T_ASSERT_TRUE(threadid_num != nil || pid_num != nil, "expected SRP threadid or pid"); 2619 if (threadid_num != nil) { 2620 srp_expected_threadid = [threadid_num unsignedLongLongValue]; 2621 T_QUIET; T_ASSERT_GT(srp_expected_threadid, 0ull, "srp_expected_threadid greater than zero"); 2622 } 2623 if (pid_num != nil) { 2624 srp_expected_pid = [pid_num intValue]; 2625 T_QUIET; T_ASSERT_GT(srp_expected_pid, 0, "srp_expected_pid greater than zero"); 2626 } 2627 T_LOG("looking for SRP pid: %d threadid: %llu", srp_expected_pid, srp_expected_threadid); 2628 } 2629 2630 if (expect_sp_throttled) { 2631 NSNumber* ctx = extra[sp_throttled_expected_ctxt_key]; 2632 T_QUIET; T_ASSERT_TRUE(ctx != nil, "expected pid"); 2633 throttled_service_ctx = [ctx intValue]; 2634 T_QUIET; T_ASSERT_GT(throttled_service_ctx, 0, "expected pid greater than zero"); 2635 2636 NSNumber *throttled = extra[sp_throttled_expect_flag]; 2637 T_QUIET; T_ASSERT_TRUE(throttled != nil, "expected flag value"); 2638 is_throttled = ([throttled intValue] != 0); 2639 2640 T_LOG("Looking for service with ctxt: %d, thottled:%d", throttled_service_ctx, is_throttled); 2641 } 2642 2643 if (expect_translated_child) { 2644 NSNumber* pid_num = extra[translated_child_pid_key]; 2645 T_QUIET; T_ASSERT_NOTNULL(pid_num, "translated child pid provided"); 2646 translated_child_pid = [pid_num intValue]; 2647 T_QUIET; T_ASSERT_GT(translated_child_pid, 0, "translated child pid greater than zero"); 2648 } 2649 if (expect_exec_inprogress) { 2650 NSNumber* pid_num = extra[exec_inprogress_pid_key]; 2651 T_QUIET; T_ASSERT_NOTNULL(pid_num, "exec inprogress pid provided"); 2652 exec_inprogress_pid = [pid_num intValue]; 2653 T_QUIET; T_ASSERT_GT(exec_inprogress_pid, 0, "exec inprogress pid greater than zero"); 2654 2655 exec_inprogress_cb = extra[exec_inprogress_found_key]; 2656 T_QUIET; T_ASSERT_NOTNULL(exec_inprogress_cb, "exec inprogress found callback provided"); 2657 } 2658 if (expect_driverkit) { 2659 driverkit_cb = extra[driverkit_found_key]; 2660 T_QUIET; T_ASSERT_NOTNULL(driverkit_cb, "driverkit found callback provided"); 2661 } 2662 2663 if (expect_asyncstack) { 2664 NSNumber* threadid_id = extra[asyncstack_expected_threadid_key]; 2665 T_QUIET; T_ASSERT_NOTNULL(threadid_id, "asyncstack threadid provided"); 2666 asyncstack_threadid = [threadid_id unsignedLongLongValue]; 2667 asyncstack_stack = extra[asyncstack_expected_stack_key]; 2668 T_QUIET; T_ASSERT_NOTNULL(asyncstack_stack, "asyncstack expected stack provided"); 2669 } 2670 2671 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2672 if (delta) { 2673 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT, 2674 "buffer provided is a delta stackshot"); 2675 2676 iter = kcdata_iter_next(iter); 2677 } else { 2678 if (kcdata_iter_type(iter) != KCDATA_BUFFER_BEGIN_COMPRESSED) { 2679 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, 2680 "buffer provided is a stackshot"); 2681 2682 iter = kcdata_iter_next(iter); 2683 } else { 2684 /* we are dealing with a compressed buffer */ 2685 iter = kcdata_iter_next(iter); 2686 uint64_t compression_type = 0, totalout = 0, totalin = 0; 2687 2688 uint64_t *data; 2689 char *desc; 2690 for (int i = 0; i < 3; i ++) { 2691 kcdata_iter_get_data_with_desc(iter, &desc, (void **)&data, NULL); 2692 if (strcmp(desc, "kcd_c_type") == 0) { 2693 compression_type = *data; 2694 } else if (strcmp(desc, "kcd_c_totalout") == 0){ 2695 totalout = *data; 2696 } else if (strcmp(desc, "kcd_c_totalin") == 0){ 2697 totalin = *data; 2698 } 2699 2700 iter = kcdata_iter_next(iter); 2701 } 2702 2703 T_ASSERT_EQ(compression_type, UINT64_C(1), "zlib compression is used"); 2704 T_ASSERT_GT(totalout, UINT64_C(0), "successfully gathered how long the compressed buffer is"); 2705 T_ASSERT_GT(totalin, UINT64_C(0), "successfully gathered how long the uncompressed buffer will be at least"); 2706 2707 /* progress to the next kcdata item */ 2708 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "compressed stackshot found"); 2709 2710 char *bufferBase = kcdata_iter_payload(iter); 2711 2712 /* 2713 * zlib is used, allocate a buffer based on the metadata, plus 2714 * extra scratch space (+12.5%) in case totalin was inconsistent 2715 */ 2716 size_t inflatedBufferSize = totalin + (totalin >> 3); 2717 inflatedBufferBase = malloc(inflatedBufferSize); 2718 T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(inflatedBufferBase, "allocated temporary output buffer"); 2719 2720 z_stream zs; 2721 memset(&zs, 0, sizeof(zs)); 2722 T_QUIET; T_ASSERT_EQ(inflateInit(&zs), Z_OK, "inflateInit OK"); 2723 zs.next_in = (unsigned char *)bufferBase; 2724 T_QUIET; T_ASSERT_LE(totalout, (uint64_t)UINT_MAX, "stackshot is not too large"); 2725 zs.avail_in = (uInt)totalout; 2726 zs.next_out = (unsigned char *)inflatedBufferBase; 2727 T_QUIET; T_ASSERT_LE(inflatedBufferSize, (size_t)UINT_MAX, "output region is not too large"); 2728 zs.avail_out = (uInt)inflatedBufferSize; 2729 T_ASSERT_EQ(inflate(&zs, Z_FINISH), Z_STREAM_END, "inflated buffer"); 2730 inflateEnd(&zs); 2731 2732 T_ASSERT_EQ((uint64_t)zs.total_out, totalin, "expected number of bytes inflated"); 2733 2734 /* copy the data after the compressed area */ 2735 T_QUIET; T_ASSERT_GE((void *)bufferBase, ssbuf, 2736 "base of compressed stackshot is after the returned stackshot buffer"); 2737 size_t header_size = (size_t)(bufferBase - (char *)ssbuf); 2738 size_t data_after_compressed_size = sslen - totalout - header_size; 2739 T_QUIET; T_ASSERT_LE(data_after_compressed_size, 2740 inflatedBufferSize - zs.total_out, 2741 "footer fits in the buffer"); 2742 memcpy(inflatedBufferBase + zs.total_out, 2743 bufferBase + totalout, 2744 data_after_compressed_size); 2745 2746 iter = kcdata_iter(inflatedBufferBase, inflatedBufferSize); 2747 } 2748 } 2749 2750 KCDATA_ITER_FOREACH(iter) { 2751 NSError *error = nil; 2752 2753 switch (kcdata_iter_type(iter)) { 2754 case KCDATA_TYPE_ARRAY: { 2755 T_QUIET; 2756 T_ASSERT_TRUE(kcdata_iter_array_valid(iter), 2757 "checked that array is valid"); 2758 2759 NSMutableDictionary *array = parseKCDataArray(iter, &error); 2760 T_QUIET; T_ASSERT_NOTNULL(array, "parsed array from stackshot"); 2761 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing array"); 2762 2763 if (kcdata_iter_array_elem_type(iter) == STACKSHOT_KCTYPE_SYS_SHAREDCACHE_LAYOUT) { 2764 struct dyld_uuid_info_64 *shared_cache_uuids = kcdata_iter_payload(iter); 2765 uint32_t uuid_count = kcdata_iter_array_elem_count(iter); 2766 T_ASSERT_NOTNULL(shared_cache_uuids, "parsed shared cache layout array"); 2767 T_ASSERT_GT(uuid_count, 0, "returned valid number of UUIDs from shared cache"); 2768 verify_stackshot_sharedcache_layout(shared_cache_uuids, uuid_count); 2769 found_shared_cache_layout = true; 2770 } 2771 2772 break; 2773 } 2774 2775 case KCDATA_TYPE_CONTAINER_BEGIN: { 2776 T_QUIET; 2777 T_ASSERT_TRUE(kcdata_iter_container_valid(iter), 2778 "checked that container is valid"); 2779 2780 uint64_t containerid = kcdata_iter_container_id(iter); 2781 uint32_t container_type = kcdata_iter_container_type(iter); 2782 2783 if (container_type == STACKSHOT_KCCONTAINER_SHAREDCACHE) { 2784 NSDictionary *container = parseKCDataContainer(&iter, &error); 2785 T_QUIET; T_ASSERT_NOTNULL(container, "parsed sharedcache container from stackshot"); 2786 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing sharedcache container"); 2787 T_QUIET; T_EXPECT_EQ(sharedCaches[@(containerid)], nil, "sharedcache containerid %lld should be unique", containerid); 2788 sharedCaches[@(containerid)] = container; 2789 break; 2790 } 2791 2792 /* 2793 * treat containers other than tasks/transitioning_tasks 2794 * as expanded in-line. 2795 */ 2796 if (container_type != STACKSHOT_KCCONTAINER_TASK && 2797 container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK) { 2798 T_LOG("container skipped: %d", container_type); 2799 break; 2800 } 2801 NSDictionary *container = parseKCDataContainer(&iter, &error); 2802 T_QUIET; T_ASSERT_NOTNULL(container, "parsed task/transitioning_task container from stackshot"); 2803 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container"); 2804 2805 NSDictionary* task_snapshot = container[@"task_snapshots"][@"task_snapshot"]; 2806 NSDictionary* task_delta_snapshot = container[@"task_snapshots"][@"task_delta_snapshot"]; 2807 NSDictionary* transitioning_task_snapshot = container[@"transitioning_task_snapshots"][@"transitioning_task_snapshot"]; 2808 2809 /* 2810 * Having processed the container, we now only check it 2811 * if it's the correct type. 2812 */ 2813 if ((!expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TASK)) || 2814 (expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK))) { 2815 break; 2816 } 2817 if (!expect_transitioning_task) { 2818 T_QUIET; T_ASSERT_TRUE(!!task_snapshot != !!task_delta_snapshot, "Either task_snapshot xor task_delta_snapshot provided"); 2819 } 2820 2821 if (expect_dispatch_queue_label && !found_dispatch_queue_label) { 2822 for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) { 2823 NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key]; 2824 NSString *dql = thread[@"dispatch_queue_label"]; 2825 2826 if ([dql isEqualToString:@TEST_STACKSHOT_QUEUE_LABEL]) { 2827 found_dispatch_queue_label = true; 2828 break; 2829 } 2830 } 2831 } 2832 2833 if (expect_transitioning_task && !found_transitioning_task) { 2834 if (transitioning_task_snapshot) { 2835 uint64_t the_pid = [transitioning_task_snapshot[@"tts_pid"] unsignedLongLongValue]; 2836 if (the_pid == (uint64_t)transistioning_task_pid) { 2837 found_transitioning_task = true; 2838 T_PASS("FOUND Transitioning task %llu has a transitioning task snapshot", (uint64_t) transistioning_task_pid); 2839 break; 2840 } 2841 } 2842 } 2843 2844 if (expect_postexec_child && !found_postexec_child) { 2845 if (task_snapshot) { 2846 uint64_t unique_pid = [task_snapshot[@"ts_unique_pid"] unsignedLongLongValue]; 2847 if (unique_pid == postexec_child_unique_pid) { 2848 found_postexec_child = true; 2849 2850 T_PASS("post-exec child %llu has a task snapshot", postexec_child_unique_pid); 2851 2852 break; 2853 } 2854 } 2855 2856 if (task_delta_snapshot) { 2857 uint64_t unique_pid = [task_delta_snapshot[@"tds_unique_pid"] unsignedLongLongValue]; 2858 if (unique_pid == postexec_child_unique_pid) { 2859 found_postexec_child = true; 2860 2861 T_FAIL("post-exec child %llu shouldn't have a delta task snapshot", postexec_child_unique_pid); 2862 2863 break; 2864 } 2865 } 2866 } 2867 2868 if (!task_snapshot) { 2869 break; 2870 } 2871 2872 int pid = [task_snapshot[@"ts_pid"] intValue]; 2873 2874 if (pid && expect_shared_cache_uuid && !found_shared_cache_uuid) { 2875 id ptr = container[@"task_snapshots"][@"shared_cache_dyld_load_info"]; 2876 if (ptr) { 2877 id uuid = ptr[@"imageUUID"]; 2878 2879 uint8_t uuid_p[16]; 2880 for (unsigned int i = 0; i < 16; i ++) { 2881 NSNumber *uuidByte = uuid[i]; 2882 uuid_p[i] = (uint8_t)uuidByte.charValue; 2883 } 2884 2885 check_shared_cache_uuid(uuid_p); 2886 2887 uint64_t baseAddress = (uint64_t)((NSNumber *)ptr[@"imageSlidBaseAddress"]).longLongValue; 2888 uint64_t firstMapping = (uint64_t)((NSNumber *)ptr[@"sharedCacheSlidFirstMapping"]).longLongValue; 2889 2890 T_EXPECT_LE(baseAddress, firstMapping, 2891 "in per-task shared_cache_dyld_load_info, " 2892 "baseAddress <= firstMapping"); 2893 T_EXPECT_GE(baseAddress + (7ull << 32) + (1ull << 29), 2894 firstMapping, 2895 "in per-task shared_cache_dyld_load_info, " 2896 "baseAddress + 28.5gig >= firstMapping"); 2897 2898 size_t shared_cache_len; 2899 const void *addr = _dyld_get_shared_cache_range(&shared_cache_len); 2900 T_EXPECT_EQ((uint64_t)addr, firstMapping, 2901 "SlidFirstMapping should match shared_cache_range"); 2902 2903 /* 2904 * check_shared_cache_uuid() will assert on failure, so if 2905 * we get here, then we have found the shared cache UUID 2906 * and it's correct 2907 */ 2908 found_shared_cache_uuid = true; 2909 } 2910 } 2911 2912 if (expect_sharedcache_child) { 2913 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 2914 uint64_t sharedregion_flags = (task_flags & (kTaskSharedRegionNone | kTaskSharedRegionSystem | kTaskSharedRegionOther)); 2915 id sharedregion_info = container[@"task_snapshots"][@"shared_cache_dyld_load_info"]; 2916 id sharedcache_id = container[@"task_snapshots"][@"sharedCacheID"]; 2917 if (!found_sharedcache_badflags) { 2918 T_QUIET; T_EXPECT_NE(sharedregion_flags, 0ll, "one of the kTaskSharedRegion flags should be set on all tasks"); 2919 bool multiple = (sharedregion_flags & (sharedregion_flags - 1)) != 0; 2920 T_QUIET; T_EXPECT_FALSE(multiple, "only one kTaskSharedRegion flag should be set on each task"); 2921 found_sharedcache_badflags = (sharedregion_flags == 0 || multiple); 2922 } 2923 if (pid == 0) { 2924 T_ASSERT_EQ(sharedregion_flags, (uint64_t)kTaskSharedRegionNone, "Kernel proc (pid 0) should have no shared region"); 2925 } else if (pid == sharedcache_child_pid) { 2926 found_sharedcache_child = true; 2927 sharedcache_child_flags = sharedregion_flags; 2928 } else if (pid == getpid()) { 2929 found_sharedcache_self = true; 2930 sharedcache_self_flags = sharedregion_flags; 2931 } 2932 if (sharedregion_flags == kTaskSharedRegionOther && !(task_flags & kTaskSharedRegionInfoUnavailable)) { 2933 T_QUIET; T_EXPECT_NOTNULL(sharedregion_info, "kTaskSharedRegionOther should have a shared_cache_dyld_load_info struct"); 2934 T_QUIET; T_EXPECT_NOTNULL(sharedcache_id, "kTaskSharedRegionOther should have a sharedCacheID"); 2935 if (sharedcache_id != nil) { 2936 T_QUIET; T_EXPECT_NOTNULL(sharedCaches[sharedcache_id], "sharedCacheID %d should exist", [sharedcache_id intValue]); 2937 } 2938 } else { 2939 T_QUIET; T_EXPECT_NULL(sharedregion_info, "non-kTaskSharedRegionOther should have no shared_cache_dyld_load_info struct"); 2940 T_QUIET; T_EXPECT_NULL(sharedcache_id, "non-kTaskSharedRegionOther should have no sharedCacheID"); 2941 } 2942 } 2943 2944 if (expect_zombie_child && (pid == zombie_child_pid)) { 2945 found_zombie_child = true; 2946 2947 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 2948 T_ASSERT_TRUE((task_flags & kTerminatedSnapshot) == kTerminatedSnapshot, "child zombie marked as terminated"); 2949 2950 continue; 2951 } 2952 2953 if (expect_translated_child && (pid == translated_child_pid)) { 2954 found_translated_child = true; 2955 2956 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 2957 T_EXPECT_BITS_SET(task_flags, kTaskIsTranslated, "child marked as translated"); 2958 2959 continue; 2960 } 2961 if (expect_exec_inprogress && (pid == exec_inprogress_pid || pid == -exec_inprogress_pid)) { 2962 exec_inprogress_found++; 2963 T_LOG("found exec task with pid %d, instance %d", pid, exec_inprogress_found); 2964 T_QUIET; T_ASSERT_LE(exec_inprogress_found, 2, "no more than two with the expected pid"); 2965 if (exec_inprogress_found == 2) { 2966 T_LOG("found 2 tasks with pid %d", exec_inprogress_pid); 2967 exec_inprogress_cb(containerid, exec_inprogress_containerid); 2968 } else { 2969 exec_inprogress_containerid = containerid; 2970 } 2971 } 2972 if (expect_driverkit && driverkit_cb != NULL) { 2973 driverkit_cb(pid); 2974 } 2975 if (expect_cseg_waitinfo) { 2976 NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"]; 2977 2978 for (id i in winfos) { 2979 NSNumber *waitType = i[@"wait_type"]; 2980 NSNumber *owner = i[@"owner"]; 2981 if (waitType.intValue == kThreadWaitCompressor && 2982 owner.unsignedLongValue == cseg_expected_threadid) { 2983 found_cseg_waitinfo = true; 2984 break; 2985 } 2986 } 2987 } 2988 2989 if (expect_srp_waitinfo) { 2990 NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"]; 2991 NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"]; 2992 for (id i in tinfos) { 2993 if (!found_srp_waitinfo) { 2994 bool found_thread = false; 2995 bool found_pid = false; 2996 if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_THREAD) && 2997 [i[@"turnstile_context"] unsignedLongLongValue] == srp_expected_threadid && 2998 srp_expected_threadid != 0) { 2999 found_thread = true; 3000 } 3001 if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_BLOCKED_ON_TASK) && 3002 [i[@"turnstile_context"] intValue] == srp_expected_pid && 3003 srp_expected_pid != -1) { 3004 found_pid = true; 3005 } 3006 if (found_pid || found_thread) { 3007 T_LOG("found SRP %s %lld waiter: %d", (found_thread ? "thread" : "pid"), 3008 [i[@"turnstile_context"] unsignedLongLongValue], [i[@"waiter"] intValue]); 3009 /* we found something that is blocking the correct threadid */ 3010 for (id j in winfos) { 3011 if ([j[@"waiter"] intValue] == [i[@"waiter"] intValue] && 3012 [j[@"wait_type"] intValue] == kThreadWaitPortReceive) { 3013 found_srp_waitinfo = true; 3014 T_EXPECT_EQ([j[@"wait_flags"] intValue], STACKSHOT_WAITINFO_FLAGS_SPECIALREPLY, 3015 "SRP waitinfo should be marked as a special reply"); 3016 break; 3017 } 3018 } 3019 3020 if (found_srp_waitinfo) { 3021 break; 3022 } 3023 } 3024 } 3025 } 3026 } 3027 3028 if (expect_sp_throttled) { 3029 NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"]; 3030 for (id i in tinfos) { 3031 if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_PORTFLAGS) 3032 && [i[@"turnstile_context"] intValue] == throttled_service_ctx) { 3033 int portlabel_id = [i[@"portlabel_id"] intValue]; 3034 T_LOG("[pid:%d] Turnstile (flags = 0x%x, ctx = %d, portlabel_id = %d)", pid, 3035 [i[@"turnstile_flags"] intValue], [i[@"turnstile_context"] intValue], portlabel_id); 3036 for (id portid in container[@"task_snapshots"][@"portlabels"]) { 3037 if (portlabel_id != [portid intValue]) { 3038 continue; 3039 } 3040 3041 NSMutableDictionary *portlabel = container[@"task_snapshots"][@"portlabels"][portid]; 3042 T_ASSERT_TRUE(portlabel != nil, "Found portlabel id: %d", [portid intValue]); 3043 NSString *portlabel_name = portlabel[@"portlabel_name"]; 3044 T_EXPECT_TRUE(portlabel_name != nil, "Found portlabel %s", portlabel_name.UTF8String); 3045 T_EXPECT_EQ_STR(portlabel_name.UTF8String, THROTTLED_SERVICE_NAME, "throttled service port name matches"); 3046 T_EXPECT_EQ(([portlabel[@"portlabel_flags"] intValue] & STACKSHOT_PORTLABEL_THROTTLED) != 0, 3047 is_throttled, "Port %s throttled", is_throttled ? "is" : "isn't"); 3048 found_throttled_service = true; 3049 break; 3050 } 3051 } 3052 3053 if (found_throttled_service) { 3054 break; 3055 } 3056 } 3057 } 3058 3059 if (expect_suspendinfo) { 3060 // TODO: rdar://112563110 3061 } 3062 3063 if (pid != getpid()) { 3064 break; 3065 } 3066 3067 T_EXPECT_EQ_STR(current_process_name(), 3068 [task_snapshot[@"ts_p_comm"] UTF8String], 3069 "current process name matches in stackshot"); 3070 3071 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 3072 T_ASSERT_BITS_NOTSET(task_flags, kTerminatedSnapshot, "current process not marked as terminated"); 3073 T_ASSERT_BITS_NOTSET(task_flags, kTaskIsTranslated, "current process not marked as translated"); 3074 3075 T_QUIET; 3076 T_EXPECT_LE(pid, [task_snapshot[@"ts_unique_pid"] intValue], 3077 "unique pid is greater than pid"); 3078 3079 NSDictionary* task_cpu_architecture = container[@"task_snapshots"][@"task_cpu_architecture"]; 3080 T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cputype"], "have cputype"); 3081 T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cpusubtype"], "have cputype"); 3082 int cputype = [task_cpu_architecture[@"cputype"] intValue]; 3083 int cpusubtype = [task_cpu_architecture[@"cpusubtype"] intValue]; 3084 3085 struct proc_archinfo archinfo; 3086 int retval = proc_pidinfo(pid, PROC_PIDARCHINFO, 0, &archinfo, sizeof(archinfo)); 3087 T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDARCHINFO) returned a value > 0"); 3088 T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(struct proc_archinfo), "proc_pidinfo call for PROC_PIDARCHINFO returned expected size"); 3089 T_QUIET; T_EXPECT_EQ(cputype, archinfo.p_cputype, "cpu type is correct"); 3090 T_QUIET; T_EXPECT_EQ(cpusubtype, archinfo.p_cpusubtype, "cpu subtype is correct"); 3091 3092 NSDictionary * codesigning_info = container[@"task_snapshots"][@"stackshot_task_codesigning_info"]; 3093 T_QUIET; T_ASSERT_NOTNULL(codesigning_info[@"csflags"], "have csflags"); 3094 uint64_t flags = [codesigning_info[@"csflags"] unsignedLongLongValue]; 3095 T_QUIET; T_EXPECT_GT(flags, 0, "nonzero csflags"); 3096 3097 T_QUIET; T_ASSERT_NOTNULL(container[@"task_snapshots"][@"jetsam_coalition"], "have jetsam coalition"); 3098 uint64_t jetsam_coalition = [container[@"task_snapshots"][@"jetsam_coalition"] unsignedLongLongValue]; 3099 T_QUIET; T_EXPECT_GT(jetsam_coalition, 0, "nonzero jetsam coalition"); 3100 3101 bool found_main_thread = false; 3102 uint64_t main_thread_id = -1ULL; 3103 bool found_null_kernel_frame = false; 3104 for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) { 3105 NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key]; 3106 NSDictionary *thread_snap = thread[@"thread_snapshot"]; 3107 3108 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_thread_id"] intValue], 0, 3109 "thread ID of thread in current task is valid"); 3110 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_base_priority"] intValue], 0, 3111 "base priority of thread in current task is valid"); 3112 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_sched_priority"] intValue], 0, 3113 "scheduling priority of thread in current task is valid"); 3114 3115 NSString *pth_name = thread[@"pth_name"]; 3116 if (pth_name != nil && [pth_name isEqualToString:@TEST_THREAD_NAME]) { 3117 found_main_thread = true; 3118 main_thread_id = [thread_snap[@"ths_thread_id"] unsignedLongLongValue]; 3119 3120 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_total_syscalls"] intValue], 0, 3121 "total syscalls of current thread is valid"); 3122 3123 NSDictionary *cpu_times = thread[@"cpu_times"]; 3124 T_EXPECT_GE([cpu_times[@"runnable_time"] intValue], 3125 [cpu_times[@"system_time"] intValue] + 3126 [cpu_times[@"user_time"] intValue], 3127 "runnable time of current thread is valid"); 3128 } 3129 if (!found_null_kernel_frame) { 3130 for (NSNumber *frame in thread[@"kernel_frames"]) { 3131 if (frame.unsignedLongValue == 0) { 3132 found_null_kernel_frame = true; 3133 break; 3134 } 3135 } 3136 } 3137 if (expect_asyncstack && !found_asyncstack && 3138 asyncstack_threadid == [thread_snap[@"ths_thread_id"] unsignedLongLongValue]) { 3139 found_asyncstack = true; 3140 NSArray* async_stack = thread[@"user_async_stack_frames"]; 3141 NSNumber* start_idx = thread[@"user_async_start_index"]; 3142 NSArray* user_stack = thread[@"user_stack_frames"]; 3143 T_QUIET; T_ASSERT_NOTNULL(async_stack, "async thread %#llx has user_async_stack_frames", asyncstack_threadid); 3144 T_QUIET; T_ASSERT_NOTNULL(start_idx, "async thread %#llx has user_async_start_index", asyncstack_threadid); 3145 T_QUIET; T_ASSERT_NOTNULL(user_stack, "async thread %#llx has user_stack_frames", asyncstack_threadid); 3146 T_QUIET; T_ASSERT_EQ(async_stack.count, asyncstack_stack.count, 3147 "actual async_stack count == expected async_stack count"); 3148 for (size_t i = 0; i < async_stack.count; i++) { 3149 T_EXPECT_EQ([async_stack[i][@"lr"] unsignedLongLongValue], 3150 [asyncstack_stack[i] unsignedLongLongValue], "frame %zu matches", i); 3151 } 3152 } 3153 } 3154 T_EXPECT_TRUE(found_main_thread, "found main thread for current task in stackshot"); 3155 T_EXPECT_FALSE(found_null_kernel_frame, "should not see any NULL kernel frames"); 3156 3157 if (expect_turnstile_lock && !found_turnstile_lock) { 3158 NSArray *tsinfos = container[@"task_snapshots"][@"thread_turnstileinfo"]; 3159 3160 for (id i in tsinfos) { 3161 if ([i[@"turnstile_context"] unsignedLongLongValue] == main_thread_id) { 3162 found_turnstile_lock = true; 3163 break; 3164 } 3165 } 3166 } 3167 break; 3168 } 3169 case STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO: { 3170 // Legacy shared cache info 3171 struct dyld_shared_cache_loadinfo *payload = kcdata_iter_payload(iter); 3172 T_ASSERT_EQ((size_t)kcdata_iter_size(iter), sizeof(*payload), "valid dyld_shared_cache_loadinfo struct"); 3173 3174 check_shared_cache_uuid(payload->sharedCacheUUID); 3175 3176 T_EXPECT_LE(payload->sharedCacheUnreliableSlidBaseAddress, 3177 payload->sharedCacheSlidFirstMapping, 3178 "SlidBaseAddress <= SlidFirstMapping"); 3179 T_EXPECT_GE(payload->sharedCacheUnreliableSlidBaseAddress + (7ull << 32) + (1ull << 29), 3180 payload->sharedCacheSlidFirstMapping, 3181 "SlidFirstMapping should be within 28.5gigs of SlidBaseAddress"); 3182 3183 size_t shared_cache_len; 3184 const void *addr = _dyld_get_shared_cache_range(&shared_cache_len); 3185 T_EXPECT_EQ((uint64_t)addr, payload->sharedCacheSlidFirstMapping, 3186 "SlidFirstMapping should match shared_cache_range"); 3187 3188 /* 3189 * check_shared_cache_uuid() asserts on failure, so we must have 3190 * found the shared cache UUID to be correct. 3191 */ 3192 found_shared_cache_uuid = true; 3193 break; 3194 } 3195 } 3196 } 3197 3198 if (expect_sharedcache_child) { 3199 T_QUIET; T_ASSERT_TRUE(found_sharedcache_child, "found sharedcache child in kcdata"); 3200 T_QUIET; T_ASSERT_TRUE(found_sharedcache_self, "found self in kcdata"); 3201 if (found_sharedcache_child && found_sharedcache_self) { 3202 T_QUIET; T_ASSERT_NE(sharedcache_child_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache child should have shared region"); 3203 T_QUIET; T_ASSERT_NE(sharedcache_self_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache: self should have shared region"); 3204 if (sharedcache_self_flags == kTaskSharedRegionSystem && !sharedcache_child_sameaddr) { 3205 /* If we're in the system shared region, and the child has a different address, child must have an Other shared region */ 3206 T_ASSERT_EQ(sharedcache_child_flags, (uint64_t)kTaskSharedRegionOther, 3207 "sharedcache child should have Other shared region"); 3208 } 3209 } 3210 } 3211 3212 if (expect_transitioning_task) { 3213 T_QUIET; T_ASSERT_TRUE(found_transitioning_task, "found transitioning_task child in kcdata"); 3214 } 3215 3216 if (expect_exec_inprogress) { 3217 T_QUIET; T_ASSERT_GT(exec_inprogress_found, 0, "found at least 1 task for execing process"); 3218 } 3219 3220 if (expect_zombie_child) { 3221 T_QUIET; T_ASSERT_TRUE(found_zombie_child, "found zombie child in kcdata"); 3222 } 3223 3224 if (expect_postexec_child) { 3225 T_QUIET; T_ASSERT_TRUE(found_postexec_child, "found post-exec child in kcdata"); 3226 } 3227 3228 if (expect_translated_child) { 3229 T_QUIET; T_ASSERT_TRUE(found_translated_child, "found translated child in kcdata"); 3230 } 3231 3232 if (expect_shared_cache_layout) { 3233 T_QUIET; T_ASSERT_TRUE(found_shared_cache_layout, "shared cache layout found in kcdata"); 3234 } 3235 3236 if (expect_shared_cache_uuid) { 3237 T_QUIET; T_ASSERT_TRUE(found_shared_cache_uuid, "shared cache UUID found in kcdata"); 3238 } 3239 3240 if (expect_dispatch_queue_label) { 3241 T_QUIET; T_ASSERT_TRUE(found_dispatch_queue_label, "dispatch queue label found in kcdata"); 3242 } 3243 3244 if (expect_turnstile_lock) { 3245 T_QUIET; T_ASSERT_TRUE(found_turnstile_lock, "found expected deadlock"); 3246 } 3247 3248 if (expect_cseg_waitinfo) { 3249 T_QUIET; T_ASSERT_TRUE(found_cseg_waitinfo, "found c_seg waitinfo"); 3250 } 3251 3252 if (expect_srp_waitinfo) { 3253 T_QUIET; T_ASSERT_TRUE(found_srp_waitinfo, "found special reply port waitinfo"); 3254 } 3255 3256 if (expect_sp_throttled) { 3257 T_QUIET; T_ASSERT_TRUE(found_throttled_service, "found the throttled service"); 3258 } 3259 3260 if (expect_asyncstack) { 3261 T_QUIET; T_ASSERT_TRUE(found_asyncstack, "found async stack threadid"); 3262 } 3263 3264 T_ASSERT_FALSE(KCDATA_ITER_FOREACH_FAILED(iter), "successfully iterated kcdata"); 3265 3266 free(inflatedBufferBase); 3267} 3268 3269static const char * 3270current_process_name(void) 3271{ 3272 static char name[64]; 3273 3274 if (!name[0]) { 3275 int ret = proc_name(getpid(), name, sizeof(name)); 3276 T_QUIET; 3277 T_ASSERT_POSIX_SUCCESS(ret, "proc_name failed for current process"); 3278 } 3279 3280 return name; 3281} 3282 3283static void 3284initialize_thread(void) 3285{ 3286 int ret = pthread_setname_np(TEST_THREAD_NAME); 3287 T_QUIET; 3288 T_ASSERT_POSIX_ZERO(ret, "set thread name to %s", TEST_THREAD_NAME); 3289} 3290