xref: /xnu-10002.41.9/tests/stackshot_tests.m (revision 699cd48037512bf4380799317ca44ca453c82f57)
1#include <darwintest.h>
2#include <darwintest_utils.h>
3#include <darwintest_multiprocess.h>
4#include <kern/debug.h>
5#include <kern/kern_cdata.h>
6#include <kern/block_hint.h>
7#include <kdd.h>
8#include <libproc.h>
9#include <mach-o/dyld.h>
10#include <mach-o/dyld_images.h>
11#include <mach-o/dyld_priv.h>
12#include <sys/syscall.h>
13#include <sys/stackshot.h>
14#include <uuid/uuid.h>
15#include <servers/bootstrap.h>
16#include <pthread/workqueue_private.h>
17#include <dispatch/private.h>
18#include <stdalign.h>
19#import <zlib.h>
20#import <IOKit/IOKitLib.h>
21#import <IOKit/IOKitLibPrivate.h>
22#import <IOKit/IOKitKeysPrivate.h>
23
24T_GLOBAL_META(
25		T_META_NAMESPACE("xnu.stackshot"),
26		T_META_RADAR_COMPONENT_NAME("xnu"),
27		T_META_RADAR_COMPONENT_VERSION("stackshot"),
28		T_META_OWNER("jonathan_w_adams"),
29		T_META_CHECK_LEAKS(false),
30		T_META_ASROOT(true)
31		);
32
33static const char *current_process_name(void);
34static void verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count);
35static void parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra);
36static void parse_thread_group_stackshot(void **sbuf, size_t sslen);
37static uint64_t stackshot_timestamp(void *ssbuf, size_t sslen);
38static void initialize_thread(void);
39
40static uint64_t global_flags = 0;
41
42#define DEFAULT_STACKSHOT_BUFFER_SIZE (1024 * 1024)
43#define MAX_STACKSHOT_BUFFER_SIZE     (6 * 1024 * 1024)
44
45#define SRP_SERVICE_NAME "com.apple.xnu.test.stackshot.special_reply_port"
46
47/* bit flags for parse_stackshot */
48#define PARSE_STACKSHOT_DELTA                0x01
49#define PARSE_STACKSHOT_ZOMBIE               0x02
50#define PARSE_STACKSHOT_SHAREDCACHE_LAYOUT   0x04
51#define PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL 0x08
52#define PARSE_STACKSHOT_TURNSTILEINFO        0x10
53#define PARSE_STACKSHOT_POSTEXEC             0x20
54#define PARSE_STACKSHOT_WAITINFO_CSEG        0x40
55#define PARSE_STACKSHOT_WAITINFO_SRP         0x80
56#define PARSE_STACKSHOT_TRANSLATED           0x100
57#define PARSE_STACKSHOT_SHAREDCACHE_FLAGS    0x200
58#define PARSE_STACKSHOT_EXEC_INPROGRESS      0x400
59#define PARSE_STACKSHOT_TRANSITIONING        0x800
60#define PARSE_STACKSHOT_ASYNCSTACK           0x1000
61#define PARSE_STACKSHOT_COMPACTINFO          0x2000 /* TODO: rdar://88789261 */
62#define PARSE_STACKSHOT_DRIVERKIT            0x4000
63#define PARSE_STACKSHOT_THROTTLED_SP         0x8000
64#define PARSE_STACKSHOT_SUSPENDINFO          0x10000
65
66/* keys for 'extra' dictionary for parse_stackshot */
67static const NSString* zombie_child_pid_key = @"zombie_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_ZOMBIE
68static const NSString* postexec_child_unique_pid_key = @"postexec_child_unique_pid";  // -> @(unique_pid), required for PARSE_STACKSHOT_POSTEXEC
69static const NSString* cseg_expected_threadid_key = @"cseg_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_WAITINFO_CSEG
70static const NSString* srp_expected_threadid_key = @"srp_expected_threadid"; // -> @(tid), this or ..._pid required for PARSE_STACKSHOT_WAITINFO_SRP
71static const NSString* srp_expected_pid_key = @"srp_expected_pid"; // -> @(pid), this or ..._threadid required for PARSE_STACKSHOT_WAITINFO_SRP
72static const NSString* translated_child_pid_key = @"translated_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSLATED
73static const NSString* sharedcache_child_pid_key = @"sharedcache_child_pid"; // @(pid), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS
74static const NSString* sharedcache_child_sameaddr_key = @"sharedcache_child_sameaddr"; // @(0 or 1), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS
75static const NSString* exec_inprogress_pid_key = @"exec_inprogress_pid";
76static const NSString* exec_inprogress_found_key = @"exec_inprogress_found";  // callback when inprogress is found
77static const NSString* transitioning_pid_key = @"transitioning_task_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSITIONING
78static const NSString* asyncstack_expected_threadid_key = @"asyncstack_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_ASYNCSTACK
79static const NSString* asyncstack_expected_stack_key = @"asyncstack_expected_stack"; // -> @[pc...]), expected PCs for asyncstack
80static const NSString* driverkit_found_key = @"driverkit_found_key"; // callback when driverkit process is found. argument is the process pid.
81static const NSString* sp_throttled_expected_ctxt_key = @"sp_throttled_expected_ctxt_key"; // -> @(ctxt), required for PARSE_STACKSHOT_THROTTLED_SP
82static const NSString* sp_throttled_expect_flag = @"sp_throttled_expect_flag"; // -> @(is_throttled), required for PARSE_STACKSHOT_THROTTLED_SP
83
84
85#define TEST_STACKSHOT_QUEUE_LABEL        "houston.we.had.a.problem"
86#define TEST_STACKSHOT_QUEUE_LABEL_LENGTH sizeof(TEST_STACKSHOT_QUEUE_LABEL)
87
88#define THROTTLED_SERVICE_NAME "com.apple.xnu.test.stackshot.throttled_service"
89
90T_DECL(microstackshots, "test the microstackshot syscall")
91{
92	void *buf = NULL;
93	unsigned int size = DEFAULT_STACKSHOT_BUFFER_SIZE;
94
95	while (1) {
96		buf = malloc(size);
97		T_QUIET; T_ASSERT_NOTNULL(buf, "allocated stackshot buffer");
98
99#pragma clang diagnostic push
100#pragma clang diagnostic ignored "-Wdeprecated-declarations"
101		int len = syscall(SYS_microstackshot, buf, size,
102				(uint32_t) STACKSHOT_GET_MICROSTACKSHOT);
103#pragma clang diagnostic pop
104		if (len == ENOSYS) {
105			T_SKIP("microstackshot syscall failed, likely not compiled with CONFIG_TELEMETRY");
106		}
107		if (len == -1 && errno == ENOSPC) {
108			/* syscall failed because buffer wasn't large enough, try again */
109			free(buf);
110			buf = NULL;
111			size *= 2;
112			T_ASSERT_LE(size, (unsigned int)MAX_STACKSHOT_BUFFER_SIZE,
113					"growing stackshot buffer to sane size");
114			continue;
115		}
116		T_ASSERT_POSIX_SUCCESS(len, "called microstackshot syscall");
117		break;
118    }
119
120	T_EXPECT_EQ(*(uint32_t *)buf,
121			(uint32_t)STACKSHOT_MICRO_SNAPSHOT_MAGIC,
122			"magic value for microstackshot matches");
123
124	free(buf);
125}
126
127struct scenario {
128	const char *name;
129	uint64_t flags;
130	bool quiet;
131	bool should_fail;
132	bool maybe_unsupported;
133	bool maybe_enomem;
134	bool no_recordfile;
135	pid_t target_pid;
136	bool target_kernel;
137	uint64_t since_timestamp;
138	uint32_t size_hint;
139	dt_stat_time_t timer;
140};
141
142static void
143quiet(struct scenario *scenario)
144{
145	if (scenario->timer || scenario->quiet) {
146		T_QUIET;
147	}
148}
149
150static void
151take_stackshot(struct scenario *scenario, bool compress_ok, void (^cb)(void *buf, size_t size))
152{
153start:
154	initialize_thread();
155
156	void *config = stackshot_config_create();
157	quiet(scenario);
158	T_ASSERT_NOTNULL(config, "created stackshot config");
159
160	int ret = stackshot_config_set_flags(config, scenario->flags | global_flags);
161	quiet(scenario);
162	T_ASSERT_POSIX_ZERO(ret, "set flags %#llx on stackshot config", scenario->flags);
163
164	if (scenario->size_hint > 0) {
165		ret = stackshot_config_set_size_hint(config, scenario->size_hint);
166		quiet(scenario);
167		T_ASSERT_POSIX_ZERO(ret, "set size hint %" PRIu32 " on stackshot config",
168				scenario->size_hint);
169	}
170
171	if (scenario->target_pid > 0) {
172		ret = stackshot_config_set_pid(config, scenario->target_pid);
173		quiet(scenario);
174		T_ASSERT_POSIX_ZERO(ret, "set target pid %d on stackshot config",
175				scenario->target_pid);
176	} else if (scenario->target_kernel) {
177		ret = stackshot_config_set_pid(config, 0);
178		quiet(scenario);
179		T_ASSERT_POSIX_ZERO(ret, "set kernel target on stackshot config");
180	}
181
182	if (scenario->since_timestamp > 0) {
183		ret = stackshot_config_set_delta_timestamp(config, scenario->since_timestamp);
184		quiet(scenario);
185		T_ASSERT_POSIX_ZERO(ret, "set since timestamp %" PRIu64 " on stackshot config",
186				scenario->since_timestamp);
187	}
188
189	int retries_remaining = 5;
190
191retry: ;
192	uint64_t start_time = mach_absolute_time();
193	ret = stackshot_capture_with_config(config);
194	uint64_t end_time = mach_absolute_time();
195
196	if (scenario->should_fail) {
197		T_EXPECTFAIL;
198		T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config");
199		return;
200	}
201
202	if (ret == EBUSY || ret == ETIMEDOUT) {
203		if (retries_remaining > 0) {
204			if (!scenario->timer) {
205				T_LOG("stackshot_capture_with_config failed with %s (%d), retrying",
206						strerror(ret), ret);
207			}
208
209			retries_remaining--;
210			goto retry;
211		} else {
212			T_ASSERT_POSIX_ZERO(ret,
213					"called stackshot_capture_with_config (no retries remaining)");
214		}
215	} else if ((ret == ENOTSUP) && scenario->maybe_unsupported) {
216		T_SKIP("kernel indicated this stackshot configuration is not supported");
217	} else if ((ret == ENOMEM) && scenario->maybe_enomem) {
218		T_SKIP("insufficient available memory to run test");
219	} else {
220		quiet(scenario);
221		T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config");
222	}
223
224	if (scenario->timer) {
225		dt_stat_mach_time_add(scenario->timer, end_time - start_time);
226	}
227	void *buf = stackshot_config_get_stackshot_buffer(config);
228	size_t size = stackshot_config_get_stackshot_size(config);
229	if (scenario->name && !scenario->no_recordfile) {
230		char sspath[MAXPATHLEN];
231		strlcpy(sspath, scenario->name, sizeof(sspath));
232		strlcat(sspath, ".kcdata", sizeof(sspath));
233		T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(sspath, sizeof(sspath)),
234				"create result file path");
235
236		if (!scenario->quiet) {
237			T_LOG("writing stackshot to %s", sspath);
238		}
239
240		FILE *f = fopen(sspath, "w");
241		T_WITH_ERRNO; T_QUIET; T_ASSERT_NOTNULL(f,
242				"open stackshot output file");
243
244		size_t written = fwrite(buf, size, 1, f);
245		T_QUIET; T_ASSERT_POSIX_SUCCESS(written, "wrote stackshot to file");
246
247		fclose(f);
248	}
249	cb(buf, size);
250	if (compress_ok) {
251		if (global_flags == 0) {
252			T_LOG("Restarting test with compression");
253			global_flags |= STACKSHOT_DO_COMPRESS;
254			goto start;
255		} else {
256			global_flags = 0;
257		}
258	}
259
260	ret = stackshot_config_dealloc(config);
261	T_QUIET; T_EXPECT_POSIX_ZERO(ret, "deallocated stackshot config");
262}
263
264T_DECL(simple_compressed, "take a simple compressed stackshot")
265{
266	struct scenario scenario = {
267		.name = "kcdata_compressed",
268		.flags = (STACKSHOT_DO_COMPRESS | STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS |
269				STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
270	};
271
272	T_LOG("taking compressed kcdata stackshot");
273	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
274		parse_stackshot(0, ssbuf, sslen, nil);
275	});
276}
277
278T_DECL(panic_compressed, "take a compressed stackshot with the same flags as a panic stackshot")
279{
280	uint64_t stackshot_flags = (STACKSHOT_SAVE_KEXT_LOADINFO |
281			STACKSHOT_SAVE_LOADINFO |
282			STACKSHOT_KCDATA_FORMAT |
283			STACKSHOT_ENABLE_BT_FAULTING |
284			STACKSHOT_ENABLE_UUID_FAULTING |
285			STACKSHOT_DO_COMPRESS |
286			STACKSHOT_NO_IO_STATS |
287			STACKSHOT_THREAD_WAITINFO |
288#if TARGET_OS_MAC
289			STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT |
290#endif
291			STACKSHOT_DISABLE_LATENCY_INFO);
292
293	struct scenario scenario = {
294		.name = "kcdata_panic_compressed",
295		.flags = stackshot_flags,
296	};
297
298	T_LOG("taking compressed kcdata stackshot with panic flags");
299	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
300		parse_stackshot(0, ssbuf, sslen, nil);
301	});
302}
303
304T_DECL(kcdata, "test that kcdata stackshots can be taken and parsed")
305{
306	struct scenario scenario = {
307		.name = "kcdata",
308		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS |
309				STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
310	};
311
312	T_LOG("taking kcdata stackshot");
313	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
314		parse_stackshot(0, ssbuf, sslen, nil);
315	});
316}
317
318static void
319get_stats(stackshot_stats_t *_Nonnull out)
320{
321	size_t oldlen = sizeof (*out);
322	bzero(out, oldlen);
323	int result = sysctlbyname("kern.stackshot_stats", out, &oldlen, NULL, 0);
324	T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(result, "reading \"kern.stackshot_stats\" sysctl should succeed");
325	T_EXPECT_EQ(oldlen, sizeof (*out), "kernel should update full stats structure");
326}
327
328static void
329log_stats(mach_timebase_info_data_t timebase, uint64_t now, const char *name, stackshot_stats_t stat)
330{
331	uint64_t last_ago = (now - stat.ss_last_start) * timebase.numer / timebase.denom;
332	uint64_t last_duration = (stat.ss_last_end - stat.ss_last_start) * timebase.numer / timebase.denom;
333	uint64_t total_duration = (stat.ss_duration) * timebase.numer / timebase.denom;
334
335	uint64_t nanosec = 1000000000llu;
336	T_LOG("%s: %8lld stackshots, %10lld.%09lld total nsecs, last %lld.%09lld secs ago, %lld.%09lld secs long",
337		name, stat.ss_count,
338		total_duration / nanosec, total_duration % nanosec,
339		last_ago / nanosec, last_ago % nanosec,
340		last_duration / nanosec, last_duration % nanosec);
341}
342
343T_DECL(stats, "test that stackshot stats can be read out and change when a stackshot occurs")
344{
345	mach_timebase_info_data_t timebase = {0, 0};
346	mach_timebase_info(&timebase);
347
348	struct scenario scenario = {
349		.name = "kcdata",
350		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
351	};
352
353	stackshot_stats_t pre, post;
354
355	get_stats(&pre);
356
357	T_LOG("taking kcdata stackshot");
358	take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) {
359		(void)0;
360	});
361
362	get_stats(&post);
363
364	uint64_t now = mach_absolute_time();
365
366	log_stats(timebase, now, "  pre", pre);
367	log_stats(timebase, now, " post", post);
368
369	int64_t delta_stackshots = (int64_t)(post.ss_count - pre.ss_count);
370	int64_t delta_duration = (int64_t)(post.ss_duration - pre.ss_duration) * (int64_t)timebase.numer / (int64_t)timebase.denom;
371	int64_t delta_nsec = delta_duration % 1000000000ll;
372	if (delta_nsec < 0) {
373	    delta_nsec += 1000000000ll;
374	}
375	T_LOG("delta: %+8lld stackshots, %+10lld.%09lld total nsecs", delta_stackshots, delta_duration / 1000000000ll, delta_nsec);
376
377	T_EXPECT_LT(pre.ss_last_start, pre.ss_last_end, "pre: stackshot should take time");
378	T_EXPECT_LT(pre.ss_count, post.ss_count, "stackshot count should increase when a stackshot is taken");
379	T_EXPECT_LT(pre.ss_duration, post.ss_duration, "stackshot duration should increase when a stackshot is taken");
380	T_EXPECT_LT(pre.ss_last_end, post.ss_last_start, "previous end should be less than new start after a stackshot");
381	T_EXPECT_LT(post.ss_last_start, post.ss_last_end, "post: stackshot should take time");
382}
383
384T_DECL(kcdata_faulting, "test that kcdata stackshots while faulting can be taken and parsed")
385{
386	struct scenario scenario = {
387		.name = "faulting",
388		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
389				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
390				| STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING),
391	};
392
393	T_LOG("taking faulting stackshot");
394	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
395		parse_stackshot(0, ssbuf, sslen, nil);
396	});
397}
398
399T_DECL(bad_flags, "test a poorly-formed stackshot syscall")
400{
401	struct scenario scenario = {
402		.flags = STACKSHOT_SAVE_IN_KERNEL_BUFFER /* not allowed from user space */,
403		.should_fail = true,
404	};
405
406	T_LOG("attempting to take stackshot with kernel-only flag");
407	take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) {
408		T_ASSERT_FAIL("stackshot data callback called");
409	});
410}
411
412T_DECL(delta, "test delta stackshots")
413{
414	struct scenario scenario = {
415		.name = "delta",
416		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
417				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
418	};
419
420	T_LOG("taking full stackshot");
421	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
422		uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen);
423
424		T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time);
425
426		parse_stackshot(0, ssbuf, sslen, nil);
427
428		struct scenario delta_scenario = {
429			.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
430					| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
431					| STACKSHOT_COLLECT_DELTA_SNAPSHOT),
432			.since_timestamp = stackshot_time
433		};
434
435		take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) {
436			parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil);
437		});
438	});
439}
440
441T_DECL(shared_cache_layout, "test stackshot inclusion of shared cache layout")
442{
443	struct scenario scenario = {
444		.name = "shared_cache_layout",
445		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
446				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT |
447				STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT),
448	};
449
450	size_t shared_cache_length;
451	const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length);
452	if (cache_header == NULL) {
453		T_SKIP("Device not running with shared cache, skipping test...");
454	}
455
456	if (shared_cache_length == 0) {
457		T_SKIP("dyld reports that currently running shared cache has zero length");
458	}
459
460	T_LOG("taking stackshot with STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT set");
461	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
462		parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_LAYOUT, ssbuf, sslen, nil);
463	});
464}
465
466T_DECL(stress, "test that taking stackshots for 60 seconds doesn't crash the system")
467{
468	uint64_t max_diff_time = 60ULL /* seconds */ * 1000000000ULL;
469	uint64_t start_time;
470
471	struct scenario scenario = {
472		.name = "stress",
473		.quiet = true,
474		.flags = (STACKSHOT_KCDATA_FORMAT |
475				STACKSHOT_THREAD_WAITINFO |
476				STACKSHOT_SAVE_LOADINFO |
477				STACKSHOT_SAVE_KEXT_LOADINFO |
478				STACKSHOT_GET_GLOBAL_MEM_STATS |
479				STACKSHOT_SAVE_IMP_DONATION_PIDS |
480				STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT |
481				STACKSHOT_THREAD_GROUP |
482				STACKSHOT_SAVE_JETSAM_COALITIONS |
483				STACKSHOT_ASID |
484				0),
485	};
486
487	start_time = clock_gettime_nsec_np(CLOCK_MONOTONIC);
488	while (clock_gettime_nsec_np(CLOCK_MONOTONIC) - start_time < max_diff_time) {
489		take_stackshot(&scenario, false, ^(void * __unused ssbuf,
490				size_t __unused sslen) {
491			printf(".");
492			fflush(stdout);
493		});
494
495		/*
496		 * After the first stackshot, there's no point in continuing to
497		 * write them to disk, and it wears down the SSDs.
498		 */
499		scenario.no_recordfile = true;
500
501		/* Leave some time for the testing infrastructure to catch up */
502		usleep(10000);
503
504	}
505	printf("\n");
506}
507
508T_DECL(dispatch_queue_label, "test that kcdata stackshots contain libdispatch queue labels")
509{
510	struct scenario scenario = {
511		.name = "kcdata",
512		.flags = (STACKSHOT_GET_DQ | STACKSHOT_KCDATA_FORMAT),
513	};
514	dispatch_semaphore_t child_ready_sem, parent_done_sem;
515	dispatch_queue_t dq;
516
517#if TARGET_OS_WATCH
518	T_SKIP("This test is flaky on watches: 51663346");
519#endif
520
521	child_ready_sem = dispatch_semaphore_create(0);
522	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "dqlabel child semaphore");
523
524	parent_done_sem = dispatch_semaphore_create(0);
525	T_QUIET; T_ASSERT_NOTNULL(parent_done_sem, "dqlabel parent semaphore");
526
527	dq = dispatch_queue_create(TEST_STACKSHOT_QUEUE_LABEL, NULL);
528	T_QUIET; T_ASSERT_NOTNULL(dq, "dispatch queue");
529
530	/* start the helper thread */
531	dispatch_async(dq, ^{
532			dispatch_semaphore_signal(child_ready_sem);
533
534			dispatch_semaphore_wait(parent_done_sem, DISPATCH_TIME_FOREVER);
535	});
536
537	/* block behind the child starting up */
538	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
539
540	T_LOG("taking kcdata stackshot with libdispatch queue labels");
541	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
542		parse_stackshot(PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL, ssbuf, sslen, nil);
543	});
544
545	dispatch_semaphore_signal(parent_done_sem);
546}
547
548#define CACHEADDR_ENV "STACKSHOT_TEST_DYLDADDR"
549T_HELPER_DECL(spawn_reslide_child, "child process to spawn with alternate slide")
550{
551	size_t shared_cache_len;
552	const void *addr, *prevaddr;
553	uintmax_t v;
554	char *endptr;
555
556	const char *cacheaddr_env = getenv(CACHEADDR_ENV);
557	T_QUIET; T_ASSERT_NOTNULL(cacheaddr_env, "getenv("CACHEADDR_ENV")");
558	errno = 0;
559	endptr = NULL;
560	v = strtoumax(cacheaddr_env, &endptr, 16);	/* read hex value */
561	T_WITH_ERRNO; T_QUIET; T_ASSERT_NE(v, 0l, "getenv(%s) = \"%s\" should be a non-zero hex number", CACHEADDR_ENV, cacheaddr_env);
562	T_QUIET; T_ASSERT_EQ(*endptr, 0, "getenv(%s) = \"%s\" endptr \"%s\" should be empty", CACHEADDR_ENV, cacheaddr_env, endptr);
563
564	prevaddr = (const void *)v;
565	addr = _dyld_get_shared_cache_range(&shared_cache_len);
566	T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address");
567
568	T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(getppid(), (addr == prevaddr) ? SIGUSR2 : SIGUSR1), "signaled parent to take stackshot");
569	for (;;) {
570		(void) pause();		/* parent will kill -9 us */
571	}
572}
573
574T_DECL(shared_cache_flags, "tests stackshot's task_ss_flags for the shared cache")
575{
576	posix_spawnattr_t		attr;
577	char *env_addr;
578	char path[PATH_MAX];
579	__block bool child_same_addr = false;
580
581	uint32_t path_size = sizeof(path);
582	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
583	char *args[] = { path, "-n", "spawn_reslide_child", NULL };
584	pid_t pid;
585	size_t shared_cache_len;
586	const void *addr;
587
588	dispatch_source_t child_diffsig_src, child_samesig_src;
589	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
590	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "shared_cache child semaphore");
591
592	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
593	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
594
595	signal(SIGUSR1, SIG_IGN);
596	signal(SIGUSR2, SIG_IGN);
597	child_samesig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
598	T_QUIET; T_ASSERT_NOTNULL(child_samesig_src, "dispatch_source_create (child_samesig_src)");
599	child_diffsig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR2, 0, signal_processing_q);
600	T_QUIET; T_ASSERT_NOTNULL(child_diffsig_src, "dispatch_source_create (child_diffsig_src)");
601
602	/* child will signal us depending on if their addr is the same or different */
603	dispatch_source_set_event_handler(child_samesig_src, ^{ child_same_addr = false; dispatch_semaphore_signal(child_ready_sem); });
604	dispatch_source_set_event_handler(child_diffsig_src, ^{ child_same_addr = true; dispatch_semaphore_signal(child_ready_sem); });
605	dispatch_activate(child_samesig_src);
606	dispatch_activate(child_diffsig_src);
607
608	addr = _dyld_get_shared_cache_range(&shared_cache_len);
609	T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address");
610
611	T_QUIET; T_ASSERT_POSIX_SUCCESS(asprintf(&env_addr, "%p", addr), "asprintf of env_addr succeeded");
612	T_QUIET; T_ASSERT_POSIX_SUCCESS(setenv(CACHEADDR_ENV, env_addr, true), "setting "CACHEADDR_ENV" to %s", env_addr);
613
614	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&attr), "posix_spawnattr_init");
615	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_setflags(&attr, _POSIX_SPAWN_RESLIDE), "posix_spawnattr_setflags");
616	int sp_ret = posix_spawn(&pid, path, NULL, &attr, args, environ);
617	T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
618
619	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
620	T_LOG("received signal from child (%s), capturing stackshot", child_same_addr ? "same shared cache addr" : "different shared cache addr");
621
622	struct scenario scenario = {
623		.name = "shared_cache_flags",
624		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
625				| STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT
626				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
627	};
628
629	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
630		int status;
631		/* First kill the child so we can reap it */
632		T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing spawned process");
633		T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on spawned child");
634		T_QUIET; T_ASSERT_EQ(!!WIFSIGNALED(status), 1, "waitpid status should be signalled");
635		T_QUIET; T_ASSERT_EQ(WTERMSIG(status), SIGKILL, "waitpid status should be SIGKILLed");
636
637		parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_FLAGS, ssbuf, sslen,
638			@{sharedcache_child_pid_key: @(pid), sharedcache_child_sameaddr_key: @(child_same_addr ? 1 : 0)});
639	});
640}
641
642T_DECL(transitioning_tasks, "test that stackshot contains transitioning task info", T_META_BOOTARGS_SET("enable_proc_exit_lpexit_spin=1"))
643{
644    int32_t sysctlValue = -1, numAttempts =0;
645    char path[PATH_MAX];
646    uint32_t path_size = sizeof(path);
647    T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
648    char *args[] = { path, "-n", "exec_child_preexec", NULL };
649
650    dispatch_source_t child_sig_src;
651    dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
652    T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
653
654    dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
655    T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
656
657    pid_t pid;
658
659    signal(SIGUSR1, SIG_IGN);
660    child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
661    T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
662
663    dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
664    dispatch_activate(child_sig_src);
665
666    T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), "set debug.proc_exit_lpexit_spin_pid=-1");
667
668    int proc_exit_spin_pos = 0 ;
669
670    while (0 == sysctlbyname("debug.proc_exit_lpexit_spin_pos", NULL, NULL, &proc_exit_spin_pos, sizeof(proc_exit_spin_pos))) {
671
672        T_LOG(" ##### Testing while spinning in proc_exit at position %d ##### ", proc_exit_spin_pos);
673
674        int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
675        T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
676
677        dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
678
679        struct proc_uniqidentifierinfo proc_info_data = { };
680        int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
681        T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
682        T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
683
684        T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec");
685
686        dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
687
688        T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &pid, sizeof(pid)), "set debug.proc_exit_lpexit_spin_pid =  %d, ", pid);
689
690        T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid);
691
692        sysctlValue = 0;
693        size_t len = sizeof(sysctlValue);
694        while (numAttempts < 5) {
695            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValue, &len, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning");
696            if (sysctlValue != 1) numAttempts++;
697            else break;
698            sleep(1);
699        }
700
701        T_ASSERT_EQ_UINT(sysctlValue, 1, "find spinning task in proc_exit()");
702
703        struct scenario scenario = {
704            .name = "transitioning_tasks",
705            .flags = (STACKSHOT_KCDATA_FORMAT)
706        };
707
708        take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
709            parse_stackshot(PARSE_STACKSHOT_TRANSITIONING, ssbuf, sslen, @{transitioning_pid_key: @(pid)});
710
711            // Kill the child
712            int sysctlValueB = -1;
713            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValueB, sizeof(sysctlValueB)), "set debug.proc_exit_lpexit_spin_pid=-1");
714            sleep(1);
715            size_t blen = sizeof(sysctlValueB);
716            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValueB, &blen, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning");
717            T_ASSERT_EQ_UINT(sysctlValueB, 0, "make sure nothing is spining in proc_exit()");
718            int status;
719            T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child");
720        });
721
722        proc_exit_spin_pos++;
723    }
724
725}
726
727static void *stuck_sysctl_thread(void *arg) {
728	int val = 1;
729	dispatch_semaphore_t child_thread_started = *(dispatch_semaphore_t *)arg;
730
731	dispatch_semaphore_signal(child_thread_started);
732	T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread");
733
734	return NULL;
735}
736
737T_HELPER_DECL(zombie_child, "child process to sample as a zombie")
738{
739	pthread_t pthread;
740	dispatch_semaphore_t child_thread_started = dispatch_semaphore_create(0);
741	T_QUIET; T_ASSERT_NOTNULL(child_thread_started, "zombie child thread semaphore");
742
743	/* spawn another thread to get stuck in the kernel, then call exit() to become a zombie */
744	T_QUIET; T_ASSERT_POSIX_SUCCESS(pthread_create(&pthread, NULL, stuck_sysctl_thread, &child_thread_started), "pthread_create");
745
746	dispatch_semaphore_wait(child_thread_started, DISPATCH_TIME_FOREVER);
747
748	/* sleep for a bit in the hope of ensuring that the other thread has called the sysctl before we signal the parent */
749	usleep(100);
750	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot");
751
752	exit(0);
753}
754
755T_DECL(zombie, "tests a stackshot of a zombie task with a thread stuck in the kernel")
756{
757	char path[PATH_MAX];
758	uint32_t path_size = sizeof(path);
759	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
760	char *args[] = { path, "-n", "zombie_child", NULL };
761
762	dispatch_source_t child_sig_src;
763	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
764	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "zombie child semaphore");
765
766	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
767	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
768
769	pid_t pid;
770
771	T_LOG("spawning a child");
772
773	signal(SIGUSR1, SIG_IGN);
774	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
775	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
776
777	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
778	dispatch_activate(child_sig_src);
779
780	int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
781	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
782
783	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
784
785	T_LOG("received signal from child, capturing stackshot");
786
787	struct proc_bsdshortinfo bsdshortinfo;
788	int retval, iterations_to_wait = 10;
789
790	while (iterations_to_wait > 0) {
791		retval = proc_pidinfo(pid, PROC_PIDT_SHORTBSDINFO, 0, &bsdshortinfo, sizeof(bsdshortinfo));
792		if ((retval == 0) && errno == ESRCH) {
793			T_LOG("unable to find child using proc_pidinfo, assuming zombie");
794			break;
795		}
796
797		T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDT_SHORTBSDINFO) returned a value > 0");
798		T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(bsdshortinfo), "proc_pidinfo call for PROC_PIDT_SHORTBSDINFO returned expected size");
799
800		if (bsdshortinfo.pbsi_flags & PROC_FLAG_INEXIT) {
801			T_LOG("child proc info marked as in exit");
802			break;
803		}
804
805		iterations_to_wait--;
806		if (iterations_to_wait == 0) {
807			/*
808			 * This will mark the test as failed but let it continue so we
809			 * don't leave a process stuck in the kernel.
810			 */
811			T_FAIL("unable to discover that child is marked as exiting");
812		}
813
814		/* Give the child a few more seconds to make it to exit */
815		sleep(5);
816	}
817
818	/* Give the child some more time to make it through exit */
819	sleep(10);
820
821	struct scenario scenario = {
822		.name = "zombie",
823		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
824				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
825	};
826
827	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
828		/* First unwedge the child so we can reap it */
829		int val = 1, status;
830		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child");
831
832		T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on zombie child");
833
834		parse_stackshot(PARSE_STACKSHOT_ZOMBIE, ssbuf, sslen, @{zombie_child_pid_key: @(pid)});
835	});
836}
837
838T_HELPER_DECL(exec_child_preexec, "child process pre-exec")
839{
840	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
841	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
842
843	signal(SIGUSR1, SIG_IGN);
844	dispatch_source_t parent_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
845	T_QUIET; T_ASSERT_NOTNULL(parent_sig_src, "dispatch_source_create (child_sig_src)");
846	dispatch_source_set_event_handler(parent_sig_src, ^{
847
848		// Parent took a timestamp then signaled us: exec into the next process
849
850		char path[PATH_MAX];
851		uint32_t path_size = sizeof(path);
852		T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
853		char *args[] = { path, "-n", "exec_child_postexec", NULL };
854
855		T_QUIET; T_ASSERT_POSIX_ZERO(execve(args[0], args, NULL), "execing into exec_child_postexec");
856	});
857	dispatch_activate(parent_sig_src);
858
859	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take timestamp");
860
861	sleep(100);
862	// Should never get here
863	T_FAIL("Received signal to exec from parent");
864}
865
866T_HELPER_DECL(exec_child_postexec, "child process post-exec to sample")
867{
868	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot");
869	sleep(100);
870	// Should never get here
871	T_FAIL("Killed by parent");
872}
873
874T_DECL(exec, "test getting full task snapshots for a task that execs")
875{
876	char path[PATH_MAX];
877	uint32_t path_size = sizeof(path);
878	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
879	char *args[] = { path, "-n", "exec_child_preexec", NULL };
880
881	dispatch_source_t child_sig_src;
882	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
883	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
884
885	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
886	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
887
888	pid_t pid;
889
890	T_LOG("spawning a child");
891
892	signal(SIGUSR1, SIG_IGN);
893	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
894	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
895
896	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
897	dispatch_activate(child_sig_src);
898
899	int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
900	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
901
902	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
903	uint64_t start_time = mach_absolute_time();
904
905	struct proc_uniqidentifierinfo proc_info_data = { };
906	int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
907	T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
908	T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
909	uint64_t unique_pid = proc_info_data.p_uniqueid;
910
911	T_LOG("received signal from pre-exec child, unique_pid is %llu, timestamp is %llu", unique_pid, start_time);
912
913	T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec");
914
915	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
916
917	T_LOG("received signal from post-exec child, capturing stackshot");
918
919	struct scenario scenario = {
920		.name = "exec",
921		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
922				  | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
923				  | STACKSHOT_COLLECT_DELTA_SNAPSHOT),
924		.since_timestamp = start_time
925	};
926
927	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
928		// Kill the child
929		int status;
930		T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid);
931		T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child");
932
933		parse_stackshot(PARSE_STACKSHOT_POSTEXEC | PARSE_STACKSHOT_DELTA, ssbuf, sslen, @{postexec_child_unique_pid_key: @(unique_pid)});
934	});
935}
936
937T_DECL(exec_inprogress, "test stackshots of processes in the middle of exec")
938{
939	pid_t pid;
940	/* a BASH quine which execs itself as long as the parent doesn't exit */
941        char *bash_prog = "[[ $PPID -ne 1 ]] && exec /bin/bash -c \"$0\" \"$0\"";
942	char *args[] = { "/bin/bash", "-c", bash_prog, bash_prog, NULL };
943
944	posix_spawnattr_t sattr;
945	T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&sattr), "posix_spawnattr_init");
946	T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, &sattr, args, NULL), "spawn exec_inprogress_child");
947
948	struct scenario scenario = {
949		.name = "exec_inprogress",
950		.flags = (STACKSHOT_KCDATA_FORMAT),
951		.target_pid = pid,
952	};
953
954	int tries = 0;
955	int tries_limit = 30;
956	__block bool found = false;
957	__block uint64_t cid1 = 0, cid2 = 0;
958
959	for (tries = 0; !found && tries < tries_limit; tries++) {
960		take_stackshot(&scenario, false,
961		    ^( void *ssbuf, size_t sslen) {
962			parse_stackshot(PARSE_STACKSHOT_EXEC_INPROGRESS,
963			    ssbuf, sslen, @{
964				exec_inprogress_pid_key: @(pid),
965				exec_inprogress_found_key: ^(uint64_t id1, uint64_t id2) { found = true; cid1 = id1; cid2 = id2; }});
966		});
967	}
968	T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing exec loop");
969	T_ASSERT_TRUE(found, "able to find our execing process mid-exec in %d tries", tries);
970	T_ASSERT_NE(cid1, cid2, "container IDs for in-progress exec are unique");
971	T_PASS("found mid-exec process in %d tries", tries);
972}
973
974#ifdef _LP64
975#if __has_feature(ptrauth_calls)
976#define __ptrauth_swift_async_context_parent \
977  __ptrauth(ptrauth_key_process_independent_data, 1, 0xbda2)
978#define __ptrauth_swift_async_context_resume \
979  __ptrauth(ptrauth_key_function_pointer, 1, 0xd707)
980#else
981#define __ptrauth_swift_async_context_parent
982#define __ptrauth_swift_async_context_resume
983#endif
984// Add 1 to match the symbolication aid added by the stackshot backtracer.
985#define asyncstack_frame(x) ((uintptr_t)(void *)ptrauth_strip((void *)(x), ptrauth_key_function_pointer) + 1)
986
987// This struct fakes the Swift AsyncContext struct which is used by
988// the Swift concurrency runtime. We only care about the first 2 fields.
989struct fake_async_context {
990	struct fake_async_context* __ptrauth_swift_async_context_parent next;
991	void(*__ptrauth_swift_async_context_resume resume_pc)(void);
992};
993
994static void
995level1_func()
996{
997}
998static void
999level2_func()
1000{
1001}
1002
1003// Create a chain of fake async contexts; sync with asyncstack_expected_stack below
1004static alignas(16) struct fake_async_context level1 = { 0, level1_func };
1005static alignas(16) struct fake_async_context level2 = { &level1, level2_func };
1006
1007struct async_test_semaphores {
1008	dispatch_semaphore_t child_ready_sem;	/* signal parent we're ready */
1009	dispatch_semaphore_t child_exit_sem;	/* parent tells us to go away */
1010};
1011
1012#define	ASYNCSTACK_THREAD_NAME "asyncstack_thread"
1013
1014static void __attribute__((noinline, not_tail_called))
1015expect_asyncstack(void *arg)
1016{
1017	struct async_test_semaphores *async_ts = arg;
1018
1019	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_setname_np(ASYNCSTACK_THREAD_NAME),
1020	     "set thread name to %s", ASYNCSTACK_THREAD_NAME);
1021
1022	/* Tell the main thread we're all set up, then wait for permission to exit */
1023	dispatch_semaphore_signal(async_ts->child_ready_sem);
1024	dispatch_semaphore_wait(async_ts->child_exit_sem, DISPATCH_TIME_FOREVER);
1025	usleep(1);	/* make sure we don't tailcall semaphore_wait */
1026}
1027
1028static void *
1029asyncstack_thread(void *arg)
1030{
1031	uint64_t *fp = __builtin_frame_address(0);
1032	// We cannot use a variable of pointer type, because this ABI is valid
1033	// on arm64_32 where pointers are 32bits, but the context pointer will
1034	// still be stored in a 64bits slot on the stack.
1035#if __has_feature(ptrauth_calls)
1036#define __stack_context_auth __ptrauth(ptrauth_key_process_dependent_data, 1, \
1037	        0xc31a)
1038	struct fake_async_context * __stack_context_auth ctx = &level2;
1039#else // __has_feature(ptrauth_calls)
1040	/* struct fake_async_context * */uint64_t ctx  = (uintptr_t)&level2;
1041#endif // !__has_feature(ptrauth_calls)
1042
1043	// The signature of an async frame on the OS stack is:
1044	// [ <AsyncContext address>, <Saved FP | (1<<60)>, <return address> ]
1045	// The Async context must be right before the saved FP on the stack. This
1046	// should happen naturally in an optimized build as it is the only
1047	// variable on the stack.
1048	// This function cannot use T_ASSERT_* becuse it changes the stack
1049	// layout.
1050	assert((uintptr_t)fp - (uintptr_t)&ctx == 8);
1051
1052	// Modify the saved FP on the stack to include the async frame marker
1053	*fp |= (0x1ULL << 60);
1054	expect_asyncstack(arg);
1055	return NULL;
1056}
1057
1058T_DECL(asyncstack, "test swift async stack entries")
1059{
1060	struct scenario scenario = {
1061		.name = "asyncstack",
1062		.flags = STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO,
1063	};
1064	struct async_test_semaphores async_ts = {
1065	    .child_ready_sem = dispatch_semaphore_create(0),
1066	    .child_exit_sem = dispatch_semaphore_create(0),
1067	};
1068	T_QUIET; T_ASSERT_NOTNULL(async_ts.child_ready_sem, "child_ready_sem alloc");
1069	T_QUIET; T_ASSERT_NOTNULL(async_ts.child_exit_sem, "child_exit_sem alloc");
1070
1071	pthread_t pthread;
1072	__block uint64_t threadid = 0;
1073	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_create(&pthread, NULL, asyncstack_thread, &async_ts), "pthread_create");
1074	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_threadid_np(pthread, &threadid), "pthread_threadid_np");
1075
1076	dispatch_semaphore_wait(async_ts.child_ready_sem, DISPATCH_TIME_FOREVER);
1077
1078	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1079		parse_stackshot(PARSE_STACKSHOT_ASYNCSTACK, ssbuf, sslen, @{
1080		    asyncstack_expected_threadid_key: @(threadid),
1081		       asyncstack_expected_stack_key: @[ @(asyncstack_frame(level2_func)), @(asyncstack_frame(level1_func)) ],
1082		});
1083	});
1084
1085	dispatch_semaphore_signal(async_ts.child_exit_sem);
1086	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_join(pthread, NULL), "wait for thread");
1087
1088}
1089#endif
1090
1091static uint32_t
1092get_user_promotion_basepri(void)
1093{
1094	mach_msg_type_number_t count = THREAD_POLICY_STATE_COUNT;
1095	struct thread_policy_state thread_policy;
1096	boolean_t get_default = FALSE;
1097	mach_port_t thread_port = pthread_mach_thread_np(pthread_self());
1098
1099	kern_return_t kr = thread_policy_get(thread_port, THREAD_POLICY_STATE,
1100	    (thread_policy_t)&thread_policy, &count, &get_default);
1101	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_policy_get");
1102	return thread_policy.thps_user_promotion_basepri;
1103}
1104
1105static int
1106get_pri(thread_t thread_port)
1107{
1108	kern_return_t kr;
1109
1110	thread_extended_info_data_t extended_info;
1111	mach_msg_type_number_t count = THREAD_EXTENDED_INFO_COUNT;
1112	kr = thread_info(thread_port, THREAD_EXTENDED_INFO,
1113	    (thread_info_t)&extended_info, &count);
1114
1115	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_info");
1116
1117	return extended_info.pth_curpri;
1118}
1119
1120
1121T_DECL(turnstile_singlehop, "turnstile single hop test")
1122{
1123	dispatch_queue_t dq1, dq2;
1124	dispatch_semaphore_t sema_x;
1125	dispatch_queue_attr_t dq1_attr, dq2_attr;
1126	__block qos_class_t main_qos = 0;
1127	__block int main_relpri = 0, main_relpri2 = 0, main_afterpri = 0;
1128	struct scenario scenario = {
1129		.name = "turnstile_singlehop",
1130		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1131	};
1132	dq1_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_UTILITY, 0);
1133	dq2_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_USER_INITIATED, 0);
1134	pthread_mutex_t lock_a = PTHREAD_MUTEX_INITIALIZER;
1135	pthread_mutex_t lock_b = PTHREAD_MUTEX_INITIALIZER;
1136
1137	pthread_mutex_t *lockap = &lock_a, *lockbp = &lock_b;
1138
1139	dq1 = dispatch_queue_create("q1", dq1_attr);
1140	dq2 = dispatch_queue_create("q2", dq2_attr);
1141	sema_x = dispatch_semaphore_create(0);
1142
1143	pthread_mutex_lock(lockap);
1144	dispatch_async(dq1, ^{
1145		pthread_mutex_lock(lockbp);
1146		T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class");
1147		T_LOG("The priority of q1 is %d\n", get_pri(mach_thread_self()));
1148		dispatch_semaphore_signal(sema_x);
1149		pthread_mutex_lock(lockap);
1150	});
1151	dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER);
1152
1153	T_LOG("Async1 completed");
1154
1155	pthread_set_qos_class_self_np(QOS_CLASS_UTILITY, 0);
1156	T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class");
1157	T_LOG("The priority of main is %d\n", get_pri(mach_thread_self()));
1158	main_relpri = get_pri(mach_thread_self());
1159
1160	dispatch_async(dq2, ^{
1161		T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri2), "get qos class");
1162		T_LOG("The priority of q2 is %d\n", get_pri(mach_thread_self()));
1163		dispatch_semaphore_signal(sema_x);
1164		pthread_mutex_lock(lockbp);
1165	});
1166	dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER);
1167
1168	T_LOG("Async2 completed");
1169
1170	while (1) {
1171		main_afterpri = (int) get_user_promotion_basepri();
1172		if (main_relpri != main_afterpri) {
1173			T_LOG("Success with promotion pri is %d", main_afterpri);
1174			break;
1175		}
1176
1177		usleep(100);
1178	}
1179
1180	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1181		parse_stackshot(PARSE_STACKSHOT_TURNSTILEINFO, ssbuf, sslen, nil);
1182	});
1183}
1184
1185
1186static void
1187expect_instrs_cycles_in_stackshot(void *ssbuf, size_t sslen)
1188{
1189	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1190
1191	bool in_task = false;
1192	bool in_thread = false;
1193	bool saw_instrs_cycles = false;
1194	iter = kcdata_iter_next(iter);
1195
1196	KCDATA_ITER_FOREACH(iter) {
1197		switch (kcdata_iter_type(iter)) {
1198		case KCDATA_TYPE_CONTAINER_BEGIN:
1199			switch (kcdata_iter_container_type(iter)) {
1200			case STACKSHOT_KCCONTAINER_TASK:
1201				in_task = true;
1202				saw_instrs_cycles = false;
1203				break;
1204
1205			case STACKSHOT_KCCONTAINER_THREAD:
1206				in_thread = true;
1207				saw_instrs_cycles = false;
1208				break;
1209
1210			default:
1211				break;
1212			}
1213			break;
1214
1215		case STACKSHOT_KCTYPE_INSTRS_CYCLES:
1216			saw_instrs_cycles = true;
1217			break;
1218
1219		case KCDATA_TYPE_CONTAINER_END:
1220			if (in_thread) {
1221				T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles,
1222						"saw instructions and cycles in thread");
1223				in_thread = false;
1224			} else if (in_task) {
1225				T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles,
1226						"saw instructions and cycles in task");
1227				in_task = false;
1228			}
1229
1230		default:
1231			break;
1232		}
1233	}
1234}
1235
1236static void
1237skip_if_monotonic_unsupported(void)
1238{
1239	int supported = 0;
1240	size_t supported_size = sizeof(supported);
1241	int ret = sysctlbyname("kern.monotonic.supported", &supported,
1242			&supported_size, 0, 0);
1243	if (ret < 0 || !supported) {
1244		T_SKIP("monotonic is unsupported");
1245	}
1246}
1247
1248T_DECL(instrs_cycles, "test a getting instructions and cycles in stackshot")
1249{
1250	skip_if_monotonic_unsupported();
1251
1252	struct scenario scenario = {
1253		.name = "instrs-cycles",
1254		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1255				| STACKSHOT_KCDATA_FORMAT),
1256	};
1257
1258	T_LOG("attempting to take stackshot with instructions and cycles");
1259	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1260		parse_stackshot(0, ssbuf, sslen, nil);
1261		expect_instrs_cycles_in_stackshot(ssbuf, sslen);
1262	});
1263}
1264
1265T_DECL(delta_instrs_cycles,
1266		"test delta stackshots with instructions and cycles")
1267{
1268	skip_if_monotonic_unsupported();
1269
1270	struct scenario scenario = {
1271		.name = "delta-instrs-cycles",
1272		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1273				| STACKSHOT_KCDATA_FORMAT),
1274	};
1275
1276	T_LOG("taking full stackshot");
1277	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1278		uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen);
1279
1280		T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time);
1281
1282		parse_stackshot(0, ssbuf, sslen, nil);
1283		expect_instrs_cycles_in_stackshot(ssbuf, sslen);
1284
1285		struct scenario delta_scenario = {
1286			.name = "delta-instrs-cycles-next",
1287			.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1288					| STACKSHOT_KCDATA_FORMAT
1289					| STACKSHOT_COLLECT_DELTA_SNAPSHOT),
1290			.since_timestamp = stackshot_time,
1291		};
1292
1293		take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) {
1294			parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil);
1295			expect_instrs_cycles_in_stackshot(dssbuf, dsslen);
1296		});
1297	});
1298}
1299
1300static void
1301check_thread_groups_supported()
1302{
1303	int err;
1304	int supported = 0;
1305	size_t supported_size = sizeof(supported);
1306	err = sysctlbyname("kern.thread_groups_supported", &supported, &supported_size, NULL, 0);
1307
1308	if (err || !supported)
1309		T_SKIP("thread groups not supported on this system");
1310}
1311
1312T_DECL(thread_groups, "test getting thread groups in stackshot")
1313{
1314	check_thread_groups_supported();
1315
1316	struct scenario scenario = {
1317		.name = "thread-groups",
1318		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_GROUP
1319				| STACKSHOT_KCDATA_FORMAT),
1320	};
1321
1322	T_LOG("attempting to take stackshot with thread group flag");
1323	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1324		parse_thread_group_stackshot(ssbuf, sslen);
1325	});
1326}
1327
1328T_DECL(compactinfo, "test compactinfo inclusion")
1329{
1330	struct scenario scenario = {
1331		.name = "compactinfo",
1332		.target_pid = getpid(),
1333		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_SAVE_DYLD_COMPACTINFO
1334				| STACKSHOT_KCDATA_FORMAT),
1335	};
1336
1337	T_LOG("attempting to take stackshot with compactinfo flag");
1338	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1339		parse_stackshot(PARSE_STACKSHOT_COMPACTINFO, ssbuf, sslen, nil);
1340	});
1341}
1342
1343T_DECL(suspendinfo, "test task suspend info inclusion")
1344{
1345	struct scenario scenario = {
1346		.name = "suspendinfo",
1347		.target_pid = getpid(),
1348		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
1349	};
1350
1351	T_LOG("attempting to take stackshot with suspendinfo flag");
1352	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1353		parse_stackshot(PARSE_STACKSHOT_SUSPENDINFO, ssbuf, sslen, nil);
1354	});
1355}
1356
1357static NSMutableSet * find_driverkit_pids(io_registry_entry_t root) {
1358	NSMutableSet * driverkit_pids = [NSMutableSet setWithCapacity:3];
1359	io_registry_entry_t current = IO_OBJECT_NULL;
1360	io_iterator_t iter = IO_OBJECT_NULL;
1361
1362	T_EXPECT_MACH_SUCCESS(IORegistryEntryGetChildIterator(root, kIOServicePlane, &iter), "get registry iterator");
1363
1364	while ((current = IOIteratorNext(iter)) != IO_OBJECT_NULL) {
1365		if (_IOObjectConformsTo(current, "IOUserServer", kIOClassNameOverrideNone)) {
1366			CFMutableDictionaryRef cfProperties = NULL;
1367			NSMutableDictionary * properties;
1368			NSString * client_creator_info;
1369			NSArray<NSString *> *creator_info_array;
1370			pid_t pid;
1371
1372			T_QUIET; T_EXPECT_MACH_SUCCESS(IORegistryEntryCreateCFProperties(current, &cfProperties, kCFAllocatorDefault, kNilOptions), "get properties");
1373			properties = CFBridgingRelease(cfProperties);
1374			T_QUIET; T_ASSERT_NOTNULL(properties, "properties is not null");
1375			client_creator_info = properties[@kIOUserClientCreatorKey];
1376			creator_info_array = [client_creator_info componentsSeparatedByString:@","];
1377			if ([creator_info_array[0] hasPrefix:@"pid"]) {
1378				NSArray<NSString *> *pid_info = [creator_info_array[0] componentsSeparatedByString:@" "];
1379				T_QUIET; T_ASSERT_EQ(pid_info.count, 2UL, "Get pid info components from %s", creator_info_array[0].UTF8String);
1380				pid = pid_info[1].intValue;
1381			} else {
1382				T_ASSERT_FAIL("No pid info in client creator info: %s", client_creator_info.UTF8String);
1383			}
1384			T_LOG("Found driver pid %d", pid);
1385			[driverkit_pids addObject:[NSNumber numberWithInt:pid]];
1386		} else {
1387			[driverkit_pids unionSet:find_driverkit_pids(current)];
1388		}
1389		IOObjectRelease(current);
1390	}
1391
1392	IOObjectRelease(iter);
1393	return driverkit_pids;
1394}
1395
1396T_DECL(driverkit, "test driverkit inclusion")
1397{
1398	struct scenario scenario = {
1399		.name = "driverkit",
1400		.target_kernel = true,
1401		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT
1402			    | STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL),
1403	};
1404
1405	io_registry_entry_t root = IORegistryGetRootEntry(kIOMainPortDefault);
1406	NSMutableSet * driverkit_pids = find_driverkit_pids(root);
1407	IOObjectRelease(root);
1408
1409	T_LOG("expecting to find %lu driverkit processes", [driverkit_pids count]);
1410	T_LOG("attempting to take stackshot with STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL flag");
1411	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1412		parse_stackshot(PARSE_STACKSHOT_DRIVERKIT, ssbuf, sslen, @{
1413			driverkit_found_key: ^(pid_t pid) {
1414				[driverkit_pids removeObject:[NSNumber numberWithInt:pid]];
1415		}});
1416	});
1417
1418	T_EXPECT_EQ([driverkit_pids count], (NSUInteger)0, "found expected number of driverkit processes");
1419}
1420
1421static void
1422parse_page_table_asid_stackshot(void **ssbuf, size_t sslen)
1423{
1424	bool seen_asid = false;
1425	bool seen_page_table_snapshot = false;
1426	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1427	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
1428			"buffer provided is a stackshot");
1429
1430	iter = kcdata_iter_next(iter);
1431	KCDATA_ITER_FOREACH(iter) {
1432		switch (kcdata_iter_type(iter)) {
1433		case KCDATA_TYPE_ARRAY: {
1434			T_QUIET;
1435			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
1436					"checked that array is valid");
1437
1438			if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_PAGE_TABLES) {
1439				continue;
1440			}
1441
1442			T_ASSERT_FALSE(seen_page_table_snapshot, "check that we haven't yet seen a page table snapshot");
1443			seen_page_table_snapshot = true;
1444
1445			T_ASSERT_EQ((size_t) kcdata_iter_array_elem_size(iter), sizeof(uint64_t),
1446				"check that each element of the pagetable dump is the expected size");
1447
1448			uint64_t *pt_array = kcdata_iter_payload(iter);
1449			uint32_t elem_count = kcdata_iter_array_elem_count(iter);
1450			uint32_t j;
1451			bool nonzero_tte = false;
1452			for (j = 0; j < elem_count;) {
1453				T_QUIET; T_ASSERT_LE(j + 4, elem_count, "check for valid page table segment header");
1454				uint64_t pa = pt_array[j];
1455				uint64_t num_entries = pt_array[j + 1];
1456				uint64_t start_va = pt_array[j + 2];
1457				uint64_t end_va = pt_array[j + 3];
1458
1459				T_QUIET; T_ASSERT_NE(pa, (uint64_t) 0, "check that the pagetable physical address is non-zero");
1460				T_QUIET; T_ASSERT_EQ(pa % (num_entries * sizeof(uint64_t)), (uint64_t) 0, "check that the pagetable physical address is correctly aligned");
1461				T_QUIET; T_ASSERT_NE(num_entries, (uint64_t) 0, "check that a pagetable region has more than 0 entries");
1462				T_QUIET; T_ASSERT_LE(j + 4 + num_entries, (uint64_t) elem_count, "check for sufficient space in page table array");
1463				T_QUIET; T_ASSERT_GT(end_va, start_va, "check for valid VA bounds in page table segment header");
1464
1465				for (uint32_t k = j + 4; k < (j + 4 + num_entries); ++k) {
1466					if (pt_array[k] != 0) {
1467						nonzero_tte = true;
1468						T_QUIET; T_ASSERT_EQ((pt_array[k] >> 48) & 0xf, (uint64_t) 0, "check that bits[48:51] of arm64 TTE are clear");
1469						// L0-L2 table and non-compressed L3 block entries should always have bit 1 set; assumes L0-L2 blocks will not be used outside the kernel
1470						bool table = ((pt_array[k] & 0x2) != 0);
1471						if (table) {
1472							T_QUIET; T_ASSERT_NE(pt_array[k] & ((1ULL << 48) - 1) & ~((1ULL << 12) - 1), (uint64_t) 0, "check that arm64 TTE physical address is non-zero");
1473						} else { // should be a compressed PTE
1474							T_QUIET; T_ASSERT_NE(pt_array[k] & 0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has at least one of bits [63:62] set");
1475							T_QUIET; T_ASSERT_EQ(pt_array[k] & ~0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has no other bits besides [63:62] set");
1476						}
1477					}
1478				}
1479
1480				j += (4 + num_entries);
1481			}
1482			T_ASSERT_TRUE(nonzero_tte, "check that we saw at least one non-empty TTE");
1483			T_ASSERT_EQ(j, elem_count, "check that page table dump size matches extent of last header");
1484			break;
1485		}
1486		case STACKSHOT_KCTYPE_ASID: {
1487			T_ASSERT_FALSE(seen_asid, "check that we haven't yet seen an ASID");
1488			seen_asid = true;
1489		}
1490		}
1491	}
1492	T_ASSERT_TRUE(seen_page_table_snapshot, "check that we have seen a page table snapshot");
1493	T_ASSERT_TRUE(seen_asid, "check that we have seen an ASID");
1494}
1495
1496T_DECL(dump_page_tables, "test stackshot page table dumping support")
1497{
1498	struct scenario scenario = {
1499		.name = "asid-page-tables",
1500		.flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_ASID | STACKSHOT_PAGE_TABLES),
1501		.size_hint = (9ull << 20), // 9 MB
1502		.target_pid = getpid(),
1503		.maybe_unsupported = true,
1504		.maybe_enomem = true,
1505	};
1506
1507	T_LOG("attempting to take stackshot with ASID and page table flags");
1508	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1509		parse_page_table_asid_stackshot(ssbuf, sslen);
1510	});
1511}
1512
1513static void stackshot_verify_current_proc_uuid_info(void **ssbuf, size_t sslen, uint64_t expected_offset, const struct proc_uniqidentifierinfo *proc_info_data)
1514{
1515	const uuid_t *current_uuid = (const uuid_t *)(&proc_info_data->p_uuid);
1516
1517	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1518	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "buffer provided is a stackshot");
1519
1520	iter = kcdata_iter_next(iter);
1521
1522	KCDATA_ITER_FOREACH(iter) {
1523		switch (kcdata_iter_type(iter)) {
1524			case KCDATA_TYPE_ARRAY: {
1525				T_QUIET; T_ASSERT_TRUE(kcdata_iter_array_valid(iter), "checked that array is valid");
1526				if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO64) {
1527					struct user64_dyld_uuid_info *info = (struct user64_dyld_uuid_info *) kcdata_iter_payload(iter);
1528					if (uuid_compare(*current_uuid, info->imageUUID) == 0) {
1529						T_ASSERT_EQ(expected_offset, info->imageLoadAddress, "found matching UUID with matching binary offset");
1530						return;
1531					}
1532				} else if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO) {
1533					struct user32_dyld_uuid_info *info = (struct user32_dyld_uuid_info *) kcdata_iter_payload(iter);
1534					if (uuid_compare(*current_uuid, info->imageUUID) == 0) {
1535						T_ASSERT_EQ(expected_offset, ((uint64_t) info->imageLoadAddress),  "found matching UUID with matching binary offset");
1536						return;
1537					}
1538				}
1539				break;
1540			}
1541			default:
1542				break;
1543		}
1544	}
1545
1546	T_FAIL("failed to find matching UUID in stackshot data");
1547}
1548
1549T_DECL(translated, "tests translated bit is set correctly")
1550{
1551#if !(TARGET_OS_OSX && TARGET_CPU_ARM64)
1552	T_SKIP("Only valid on Apple silicon Macs")
1553#endif
1554	// Get path of stackshot_translated_child helper binary
1555	char path[PATH_MAX];
1556	uint32_t path_size = sizeof(path);
1557	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
1558	char* binary_name = strrchr(path, '/');
1559	if (binary_name) binary_name++;
1560	T_QUIET; T_ASSERT_NOTNULL(binary_name, "Find basename in path '%s'", path);
1561	strlcpy(binary_name, "stackshot_translated_child", path_size - (binary_name - path));
1562	char *args[] = { path, NULL };
1563
1564	dispatch_source_t child_sig_src;
1565	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
1566	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
1567
1568	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
1569	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
1570
1571	signal(SIGUSR1, SIG_IGN);
1572	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
1573	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
1574
1575	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
1576	dispatch_activate(child_sig_src);
1577
1578	// Spawn child
1579	pid_t pid;
1580	T_LOG("spawning translated child");
1581	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, NULL, args, NULL), "spawned process '%s' with PID %d", args[0], pid);
1582
1583	// Wait for the the child to spawn up
1584	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
1585
1586	// Make sure the child is running and is translated
1587	int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, pid };
1588	struct kinfo_proc process_info;
1589	size_t bufsize = sizeof(process_info);
1590	T_QUIET; T_ASSERT_POSIX_SUCCESS(sysctl(mib, (unsigned)(sizeof(mib)/sizeof(int)), &process_info, &bufsize, NULL, 0), "get translated child process info");
1591	T_QUIET; T_ASSERT_GT(bufsize, (size_t)0, "process info is not empty");
1592	T_QUIET; T_ASSERT_TRUE((process_info.kp_proc.p_flag & P_TRANSLATED), "KERN_PROC_PID reports child is translated");
1593
1594	T_LOG("capturing stackshot");
1595
1596	struct scenario scenario = {
1597		.name = "translated",
1598		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
1599				  | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
1600	};
1601
1602	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1603		parse_stackshot(PARSE_STACKSHOT_TRANSLATED, ssbuf, sslen, @{translated_child_pid_key: @(pid)});
1604	});
1605
1606    // Kill the child
1607    int status;
1608    T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGTERM), "kill translated child");
1609    T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on translated child");
1610
1611}
1612
1613T_DECL(proc_uuid_info, "tests that the main binary UUID for a proc is always populated")
1614{
1615	struct proc_uniqidentifierinfo proc_info_data = { };
1616	mach_msg_type_number_t      count;
1617	kern_return_t               kernel_status;
1618	task_dyld_info_data_t       task_dyld_info;
1619	struct dyld_all_image_infos *target_infos;
1620	int retval;
1621	bool found_image_in_image_infos = false;
1622	uint64_t expected_mach_header_offset = 0;
1623
1624	/* Find the UUID of our main binary */
1625	retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
1626	T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
1627	T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
1628
1629	uuid_string_t str = {};
1630	uuid_unparse(*(uuid_t*)&proc_info_data.p_uuid, str);
1631	T_LOG("Found current UUID is %s", str);
1632
1633	/* Find the location of the dyld image info metadata */
1634	count = TASK_DYLD_INFO_COUNT;
1635	kernel_status = task_info(mach_task_self(), TASK_DYLD_INFO, (task_info_t)&task_dyld_info, &count);
1636	T_QUIET; T_ASSERT_EQ(kernel_status, KERN_SUCCESS, "retrieve task_info for TASK_DYLD_INFO");
1637
1638	target_infos = (struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr;
1639
1640	/* Find our binary in the dyld image info array */
1641	for (int i = 0; i < (int) target_infos->uuidArrayCount; i++) {
1642		if (uuid_compare(target_infos->uuidArray[i].imageUUID, *(uuid_t*)&proc_info_data.p_uuid) == 0) {
1643			expected_mach_header_offset = (uint64_t) target_infos->uuidArray[i].imageLoadAddress;
1644			found_image_in_image_infos = true;
1645		}
1646	}
1647
1648	T_ASSERT_TRUE(found_image_in_image_infos, "found binary image in dyld image info list");
1649
1650	/* Overwrite the dyld image info data so the kernel has to fallback to the UUID stored in the proc structure */
1651	target_infos->uuidArrayCount = 0;
1652
1653	struct scenario scenario = {
1654		.name = "proc_uuid_info",
1655		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
1656		.target_pid = getpid(),
1657	};
1658
1659	T_LOG("attempting to take stackshot for current PID");
1660	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1661		stackshot_verify_current_proc_uuid_info(ssbuf, sslen, expected_mach_header_offset, &proc_info_data);
1662	});
1663}
1664
1665T_DECL(cseg_waitinfo, "test that threads stuck in the compressor report correct waitinfo")
1666{
1667	struct scenario scenario = {
1668		.name = "cseg_waitinfo",
1669		.quiet = false,
1670		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1671	};
1672	__block uint64_t thread_id = 0;
1673
1674	dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot.cseg_waitinfo", NULL);
1675	dispatch_semaphore_t child_ok = dispatch_semaphore_create(0);
1676
1677	dispatch_async(dq, ^{
1678		pthread_threadid_np(NULL, &thread_id);
1679		dispatch_semaphore_signal(child_ok);
1680		int val = 1;
1681		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread");
1682	});
1683
1684	dispatch_semaphore_wait(child_ok, DISPATCH_TIME_FOREVER);
1685	sleep(1);
1686
1687	T_LOG("taking stackshot");
1688	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1689		int val = 1;
1690		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child thread");
1691		parse_stackshot(PARSE_STACKSHOT_WAITINFO_CSEG, ssbuf, sslen, @{cseg_expected_threadid_key: @(thread_id)});
1692	});
1693}
1694
1695static void
1696srp_send(
1697	mach_port_t send_port,
1698	mach_port_t reply_port,
1699	mach_port_t msg_port)
1700{
1701	kern_return_t ret = 0;
1702
1703	struct test_msg {
1704		mach_msg_header_t header;
1705		mach_msg_body_t body;
1706		mach_msg_port_descriptor_t port_descriptor;
1707	};
1708	struct test_msg send_msg = {
1709		.header = {
1710			.msgh_remote_port = send_port,
1711			.msgh_local_port  = reply_port,
1712			.msgh_bits        = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND,
1713	    reply_port ? MACH_MSG_TYPE_MAKE_SEND_ONCE : 0,
1714	    MACH_MSG_TYPE_MOVE_SEND,
1715	    MACH_MSGH_BITS_COMPLEX),
1716			.msgh_id          = 0x100,
1717			.msgh_size        = sizeof(send_msg),
1718		},
1719		.body = {
1720			.msgh_descriptor_count = 1,
1721		},
1722		.port_descriptor = {
1723			.name        = msg_port,
1724			.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
1725			.type        = MACH_MSG_PORT_DESCRIPTOR,
1726		},
1727	};
1728
1729	if (msg_port == MACH_PORT_NULL) {
1730		send_msg.body.msgh_descriptor_count = 0;
1731	}
1732
1733	ret = mach_msg(&(send_msg.header),
1734	    MACH_SEND_MSG |
1735	    MACH_SEND_TIMEOUT |
1736	    MACH_SEND_OVERRIDE,
1737	    send_msg.header.msgh_size,
1738	    0,
1739	    MACH_PORT_NULL,
1740	    10000,
1741	    0);
1742
1743	T_ASSERT_MACH_SUCCESS(ret, "client mach_msg");
1744}
1745
1746T_HELPER_DECL(srp_client,
1747    "Client used for the special_reply_port test")
1748{
1749	pid_t ppid = getppid();
1750	dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
1751	dispatch_queue_t dq = dispatch_queue_create("client_signalqueue", NULL);
1752	dispatch_source_t sig_src;
1753
1754	mach_msg_return_t mr;
1755	mach_port_t service_port;
1756	mach_port_t conn_port;
1757	mach_port_t special_reply_port;
1758	mach_port_options_t opts = {
1759		.flags = MPO_INSERT_SEND_RIGHT,
1760	};
1761
1762	signal(SIGUSR1, SIG_IGN);
1763	sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
1764
1765	dispatch_source_set_event_handler(sig_src, ^{
1766			dispatch_semaphore_signal(can_continue);
1767	});
1768	dispatch_activate(sig_src);
1769
1770	/* lookup the mach service port for the parent */
1771	kern_return_t kr = bootstrap_look_up(bootstrap_port,
1772	    SRP_SERVICE_NAME, &service_port);
1773	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "client bootstrap_look_up");
1774
1775	/* create the send-once right (special reply port) and message to send to the server */
1776	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port);
1777	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
1778
1779	special_reply_port = thread_get_special_reply_port();
1780	T_QUIET; T_ASSERT_TRUE(MACH_PORT_VALID(special_reply_port), "get_thread_special_reply_port");
1781
1782	/* send the message with the special reply port */
1783	srp_send(service_port, special_reply_port, conn_port);
1784
1785	/* signal the parent to continue */
1786	kill(ppid, SIGUSR1);
1787
1788	struct {
1789		mach_msg_header_t header;
1790		mach_msg_body_t body;
1791		mach_msg_port_descriptor_t port_descriptor;
1792	} rcv_msg = {
1793		.header =
1794		{
1795			.msgh_remote_port = MACH_PORT_NULL,
1796			.msgh_local_port  = special_reply_port,
1797			.msgh_size        = sizeof(rcv_msg),
1798		},
1799	};
1800
1801	/* wait on the reply from the parent (that we will never receive) */
1802	mr = mach_msg(&(rcv_msg.header),
1803			(MACH_RCV_MSG | MACH_RCV_SYNC_WAIT),
1804			0,
1805			rcv_msg.header.msgh_size,
1806			special_reply_port,
1807			MACH_MSG_TIMEOUT_NONE,
1808			service_port);
1809
1810	/* not expected to execute as parent will SIGKILL client... */
1811	T_LOG("client process exiting after sending message to parent (server)");
1812}
1813
1814enum srp_test_type {
1815	SRP_TEST_THREAD,	/* expect waiter on current thread */
1816	SRP_TEST_PID,		/* expect waiter on current PID */
1817	SRP_TEST_EITHER,	/* waiter could be on either */
1818};
1819
1820static void
1821check_srp_test(const char *name, enum srp_test_type ty)
1822{
1823	struct scenario scenario = {
1824		.name = name,
1825		.quiet = false,
1826		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1827	};
1828	uint64_t thread_id = 0;
1829	pthread_threadid_np(NULL, &thread_id);
1830	if (ty == SRP_TEST_THREAD) {
1831		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1832			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1833					@{srp_expected_threadid_key: @(thread_id)});
1834		});
1835	} else if (ty == SRP_TEST_PID) {
1836		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1837			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1838					@{srp_expected_pid_key: @(getpid())});
1839		});
1840	} else {
1841		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1842			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1843					@{srp_expected_pid_key: @(getpid()), srp_expected_threadid_key: @(thread_id)});
1844		});
1845	}
1846
1847}
1848
1849
1850/*
1851 * Tests the stackshot wait info plumbing for synchronous IPC that doesn't use kevent on the server.
1852 *
1853 * (part 1): tests the scenario where a client sends a request that includes a special reply port
1854 *           to a server that doesn't receive the message and doesn't copy the send-once right
1855 *           into its address space as a result. for this case the special reply port is enqueued
1856 *           in a port and we check which task has that receive right and use that info. (rdar://60440338)
1857 * (part 2): tests the scenario where a client sends a request that includes a special reply port
1858 *           to a server that receives the message and copies in the send-once right, but doesn't
1859 *           reply to the client. for this case the special reply port is copied out and the kernel
1860 *           stashes the info about which task copied out the send once right. (rdar://60440592)
1861 * (part 3): tests the same as part 2, but uses kevents, which allow for
1862 *           priority inheritance
1863 */
1864T_DECL(special_reply_port, "test that tasks using special reply ports have correct waitinfo")
1865{
1866	dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
1867	dispatch_queue_t dq = dispatch_queue_create("signalqueue", NULL);
1868	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
1869	dispatch_source_t sig_src;
1870	char path[PATH_MAX];
1871	uint32_t path_size = sizeof(path);
1872	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
1873	char *client_args[] = { path, "-n", "srp_client", NULL };
1874	pid_t client_pid;
1875	int sp_ret;
1876	kern_return_t kr;
1877	mach_port_t port;
1878
1879	/* setup the signal handler in the parent (server) */
1880	T_LOG("setup sig handlers");
1881	signal(SIGUSR1, SIG_IGN);
1882	sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
1883
1884	dispatch_source_set_event_handler(sig_src, ^{
1885			dispatch_semaphore_signal(can_continue);
1886	});
1887	dispatch_activate(sig_src);
1888
1889	/* register with the mach service name so the client can lookup and send a message to the parent (server) */
1890	T_LOG("Server about to check in");
1891	kr = bootstrap_check_in(bootstrap_port, SRP_SERVICE_NAME, &port);
1892	T_ASSERT_MACH_SUCCESS(kr, "server bootstrap_check_in");
1893
1894	T_LOG("Launching client");
1895	sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
1896	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid);
1897	T_LOG("Spawned client as PID %d", client_pid);
1898
1899	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
1900	T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear");
1901
1902	/*
1903	 * can_continue indicates the client has signaled us, but we want to make
1904	 * sure they've actually blocked sending their mach message.  It's cheesy, but
1905	 * sleep() works for this.
1906	 */
1907	sleep(1);
1908
1909	/*
1910	 * take the stackshot without calling receive to verify that the stackshot wait
1911	 * info shows our (the server) thread for the scenario where the server has yet to
1912	 * receive the message.
1913	 */
1914	T_LOG("Taking stackshot for part 1 coverage");
1915	check_srp_test("srp", SRP_TEST_THREAD);
1916
1917	/*
1918	 * receive the message from the client (which should copy the send once right into
1919	 * our address space).
1920	 */
1921	struct {
1922		mach_msg_header_t header;
1923		mach_msg_body_t body;
1924		mach_msg_port_descriptor_t port_descriptor;
1925	} rcv_msg = {
1926		.header =
1927		{
1928			.msgh_remote_port = MACH_PORT_NULL,
1929			.msgh_local_port  = port,
1930			.msgh_size        = sizeof(rcv_msg),
1931		},
1932	};
1933
1934	T_LOG("server: starting sync receive\n");
1935
1936	mach_msg_return_t mr;
1937	mr = mach_msg(&(rcv_msg.header),
1938			(MACH_RCV_MSG | MACH_RCV_TIMEOUT),
1939			0,
1940			4096,
1941			port,
1942			10000,
1943			MACH_PORT_NULL);
1944	T_QUIET; T_ASSERT_MACH_SUCCESS(mr, "mach_msg() recieve of message from client");
1945
1946	/*
1947	 * take the stackshot to verify that the stackshot wait info shows our (the server) PID
1948	 * for the scenario where the server has received the message and copied in the send-once right.
1949	 */
1950	T_LOG("Taking stackshot for part 2 coverage");
1951	check_srp_test("srp", SRP_TEST_PID);
1952
1953	/* cleanup - kill the client */
1954	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
1955	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
1956
1957	// do it again, but using kevents
1958	T_LOG("Launching client");
1959	sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
1960	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid);
1961	T_LOG("Spawned client as PID %d", client_pid);
1962
1963	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
1964	T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear");
1965
1966	/*
1967	 * can_continue indicates the client has signaled us, but we want to make
1968	 * sure they've actually blocked sending their mach message.  It's cheesy, but
1969	 * sleep() works for this.
1970	 */
1971	sleep(1);
1972
1973	dispatch_mach_t dispatch_mach = dispatch_mach_create(SRP_SERVICE_NAME, machdq,
1974	    ^(dispatch_mach_reason_t reason,
1975	      dispatch_mach_msg_t message,
1976	      mach_error_t error __unused) {
1977		switch (reason) {
1978		case DISPATCH_MACH_MESSAGE_RECEIVED: {
1979			size_t size = 0;
1980			mach_msg_header_t *msg __unused = dispatch_mach_msg_get_msg(message, &size);
1981			T_LOG("server: recieved %ld byte message", size);
1982			check_srp_test("turnstile_port_thread", SRP_TEST_THREAD);
1983			T_LOG("server: letting client go");
1984			// drop the message on the ground, we'll kill the client later
1985			dispatch_semaphore_signal(can_continue);
1986			break;
1987		}
1988		default:
1989			break;
1990		}
1991	});
1992
1993	dispatch_mach_connect(dispatch_mach, port, MACH_PORT_NULL, NULL);
1994
1995	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
1996
1997	/* cleanup - kill the client */
1998	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
1999	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2000}
2001
2002T_HELPER_DECL(throtlled_sp_client,
2003	"client that uses a connection port to send a message to a server")
2004{
2005	mach_port_t conn_port, service_port, reply_port, *stash;
2006	mach_msg_type_number_t stash_cnt = 0;
2007
2008	kern_return_t kr = mach_ports_lookup(mach_task_self(), &stash, &stash_cnt);
2009	T_ASSERT_MACH_SUCCESS(kr, "mach_ports_lookup");
2010
2011	service_port = stash[0];
2012	T_ASSERT_TRUE(MACH_PORT_VALID(service_port), "valid service port");
2013	mig_deallocate((vm_address_t)stash, stash_cnt * sizeof(stash[0]));
2014
2015	mach_port_options_t opts = {
2016		.flags = MPO_INSERT_SEND_RIGHT
2017			| MPO_CONNECTION_PORT,
2018		.service_port_name = service_port,
2019	};
2020
2021	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port);
2022	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
2023
2024	mach_port_options_t opts2 = {
2025		.flags = MPO_REPLY_PORT
2026	};
2027	kr = mach_port_construct(mach_task_self(), &opts2, 0ull, &reply_port);
2028	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
2029
2030	/* XPC-like check-in message */
2031	struct {
2032		mach_msg_header_t header;
2033		mach_msg_port_descriptor_t recvp;
2034		mach_msg_port_descriptor_t sendp;
2035	} checkin_message = {
2036		.header =
2037		{
2038			.msgh_remote_port = service_port,
2039			.msgh_local_port = MACH_PORT_NULL,
2040			.msgh_size = sizeof(checkin_message),
2041			.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0),
2042		},
2043		.recvp =
2044		{
2045			.type = MACH_MSG_PORT_DESCRIPTOR,
2046			.name = conn_port,
2047			.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
2048		},
2049		.sendp =
2050		{
2051			.type = MACH_MSG_PORT_DESCRIPTOR,
2052			.name = reply_port,
2053			.disposition = MACH_MSG_TYPE_MAKE_SEND,
2054		}
2055	};
2056	dispatch_mach_msg_t dmsg = dispatch_mach_msg_create((mach_msg_header_t *)&checkin_message, sizeof(checkin_message),
2057		DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL);
2058
2059	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
2060	dispatch_mach_t dchannel = dispatch_mach_create(THROTTLED_SERVICE_NAME, machdq,
2061		^(dispatch_mach_reason_t reason,
2062	      dispatch_mach_msg_t message __unused,
2063	      mach_error_t error __unused) {
2064		switch (reason) {
2065			case DISPATCH_MACH_CONNECTED:
2066				T_LOG("mach channel connected");
2067				break;
2068			case DISPATCH_MACH_MESSAGE_SENT:
2069				T_LOG("sent mach message");
2070				break;
2071			default:
2072				T_ASSERT_FAIL("Unexpected reply to channel reason %lu", reason);
2073		}
2074	});
2075	dispatch_mach_connect(dchannel, reply_port, service_port, dmsg);
2076	dispatch_release(dmsg);
2077
2078	struct {
2079		mach_msg_header_t header;
2080		uint64_t request_id;
2081	} request = {
2082		.header =
2083		{
2084			.msgh_size = sizeof(request),
2085			.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE),
2086		},
2087		.request_id = 1,
2088	};
2089	dispatch_mach_msg_t dmsg2 = dispatch_mach_msg_create((mach_msg_header_t *)&request, sizeof(request),
2090		DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL);
2091
2092	dispatch_mach_reason_t reason;
2093	mach_error_t error;
2094
2095	/* send the check-in message and the request message */
2096	dispatch_mach_msg_t dreply = dispatch_mach_send_with_result_and_wait_for_reply(dchannel,
2097			dmsg2, 0, DISPATCH_MACH_SEND_DEFAULT, &reason, &error);
2098	dispatch_release(dmsg2);
2099
2100	/* not expected to execute as parent will SIGKILL client */
2101	T_ASSERT_FAIL("client process exiting after receiving %s reply", dreply ? "non-null" : "null");
2102}
2103
2104static void
2105check_throttled_sp(const char *test_name, uint64_t context, bool is_throttled)
2106{
2107	struct scenario scenario = {
2108		.name = test_name,
2109		.quiet = false,
2110		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
2111	};
2112
2113	T_LOG("taking stackshot %s", test_name);
2114	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2115		parse_stackshot(PARSE_STACKSHOT_THROTTLED_SP, ssbuf, sslen,
2116					@{sp_throttled_expected_ctxt_key: @(context),
2117					sp_throttled_expect_flag: @(is_throttled)});
2118	});
2119}
2120
2121/* Take stackshot when a client is blocked on the service port of a process, in the scenario when
2122 * the process with the receive right for the service port is:
2123 *     (a) Monitoring the service port using kevents
2124 *     (b) Not monitoring the service port
2125 */
2126T_DECL(throttled_sp,
2127	"test that service port throttled flag is propagated to the stackshot correctly")
2128{
2129	mach_port_t service_port;
2130	__block dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
2131
2132	char path[PATH_MAX];
2133	uint32_t path_size = sizeof(path);
2134	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
2135	char *client_args[] = { path, "-n", "throtlled_sp_client", NULL };
2136
2137	__block	uint64_t thread_id = 0;
2138	pid_t client_pid;
2139	int mark_throttled;
2140
2141	struct mach_service_port_info sp_info = {};
2142	strcpy(sp_info.mspi_string_name, THROTTLED_SERVICE_NAME);
2143	sp_info.mspi_domain_type = (uint8_t)1;
2144	kern_return_t kr;
2145
2146	mach_port_options_t opts = {
2147		.flags = MPO_SERVICE_PORT | MPO_INSERT_SEND_RIGHT | MPO_CONTEXT_AS_GUARD | MPO_STRICT | MPO_TEMPOWNER,
2148		.service_port_info = &sp_info,
2149	};
2150
2151	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &service_port);
2152	T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct %u", service_port);
2153
2154	/* Setup a dispatch source to monitor the service port similar to how launchd does. */
2155	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
2156	dispatch_source_t mach_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_MACH_RECV, service_port,
2157		DISPATCH_MACH_RECV_SYNC_PEEK, machdq);
2158	dispatch_source_set_event_handler(mach_src, ^{
2159		pthread_threadid_np(NULL, &thread_id);
2160		dispatch_semaphore_signal(can_continue);
2161	});
2162	dispatch_activate(mach_src);
2163
2164	/* Stash the port in task to make sure child also gets it */
2165	kr = mach_ports_register(mach_task_self(), &service_port, 1);
2166	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_ports_register service port");
2167
2168	mark_throttled = 1;
2169	kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled),
2170	           MACH_PORT_SERVICE_THROTTLED_COUNT);
2171	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mark service port as throttled");
2172
2173	int rc = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
2174	T_QUIET; T_ASSERT_POSIX_ZERO(rc, "spawned process '%s' with PID %d", client_args[0], client_pid);
2175	T_LOG("Spawned client as PID %d", client_pid);
2176
2177	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2178
2179	/* The service port has received the check-in message. Take stackshot for scenario (a). */
2180	check_throttled_sp("throttled_service_port_monitored", thread_id, true);
2181
2182	/* This simulates a throttled spawn when the service port is no longer monitored. */
2183	dispatch_source_cancel(mach_src);
2184
2185	/* Take stackshot for scenario (b) */
2186	check_throttled_sp("throttled_service_port_unmonitored", (uint64_t)getpid(), true);
2187
2188	mark_throttled = 0;
2189	kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled),
2190	           MACH_PORT_SERVICE_THROTTLED_COUNT);
2191	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "unmark service port as throttled");
2192
2193	/* Throttled flag should not be set when the port is not throttled. */
2194	check_throttled_sp("unthrottled_service_port_unmonitored", (uint64_t)getpid(), false);
2195
2196	/* cleanup - kill the client */
2197	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
2198	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2199}
2200
2201#pragma mark performance tests
2202
2203#define SHOULD_REUSE_SIZE_HINT 0x01
2204#define SHOULD_USE_DELTA       0x02
2205#define SHOULD_TARGET_SELF     0x04
2206
2207static void
2208stackshot_perf(unsigned int options)
2209{
2210	struct scenario scenario = {
2211		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
2212			| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
2213	};
2214
2215	dt_stat_t size = dt_stat_create("bytes", "size");
2216	dt_stat_time_t duration = dt_stat_time_create("duration");
2217	scenario.timer = duration;
2218
2219	if (options & SHOULD_TARGET_SELF) {
2220		scenario.target_pid = getpid();
2221	}
2222
2223	while (!dt_stat_stable(duration) || !dt_stat_stable(size)) {
2224		__block uint64_t last_time = 0;
2225		__block uint32_t size_hint = 0;
2226		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2227			dt_stat_add(size, (double)sslen);
2228			last_time = stackshot_timestamp(ssbuf, sslen);
2229			size_hint = (uint32_t)sslen;
2230		});
2231		if (options & SHOULD_USE_DELTA) {
2232			scenario.since_timestamp = last_time;
2233			scenario.flags |= STACKSHOT_COLLECT_DELTA_SNAPSHOT;
2234		}
2235		if (options & SHOULD_REUSE_SIZE_HINT) {
2236			scenario.size_hint = size_hint;
2237		}
2238	}
2239
2240	dt_stat_finalize(duration);
2241	dt_stat_finalize(size);
2242}
2243
2244static void
2245stackshot_flag_perf_noclobber(uint64_t flag, char *flagname)
2246{
2247	struct scenario scenario = {
2248		.quiet = true,
2249		.flags = (flag | STACKSHOT_KCDATA_FORMAT),
2250	};
2251
2252	dt_stat_t duration = dt_stat_create("nanoseconds per thread", "%s_duration", flagname);
2253	dt_stat_t size = dt_stat_create("bytes per thread", "%s_size", flagname);
2254	T_LOG("Testing \"%s\" = 0x%" PRIx64, flagname, flag);
2255
2256	while (!dt_stat_stable(duration) || !dt_stat_stable(size)) {
2257		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2258			kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2259			unsigned long no_threads = 0;
2260			mach_timebase_info_data_t timebase = {0, 0};
2261			uint64_t stackshot_duration = 0;
2262			int found = 0;
2263			T_QUIET; T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "stackshot buffer");
2264
2265			KCDATA_ITER_FOREACH(iter) {
2266				switch(kcdata_iter_type(iter)) {
2267					case STACKSHOT_KCTYPE_THREAD_SNAPSHOT: {
2268						found |= 1;
2269						no_threads ++;
2270						break;
2271					}
2272					case STACKSHOT_KCTYPE_STACKSHOT_DURATION: {
2273						struct stackshot_duration *ssd = kcdata_iter_payload(iter);
2274						stackshot_duration = ssd->stackshot_duration;
2275						found |= 2;
2276						break;
2277					}
2278					case KCDATA_TYPE_TIMEBASE: {
2279						found |= 4;
2280						mach_timebase_info_data_t *tb = kcdata_iter_payload(iter);
2281						memcpy(&timebase, tb, sizeof(timebase));
2282						break;
2283					}
2284				}
2285			}
2286
2287			T_QUIET; T_ASSERT_EQ(found, 0x7, "found everything needed");
2288
2289			uint64_t ns = (stackshot_duration * timebase.numer) / timebase.denom;
2290			uint64_t per_thread_ns = ns / no_threads;
2291			uint64_t per_thread_size = sslen / no_threads;
2292
2293			dt_stat_add(duration, per_thread_ns);
2294			dt_stat_add(size, per_thread_size);
2295		});
2296	}
2297
2298	dt_stat_finalize(duration);
2299	dt_stat_finalize(size);
2300}
2301
2302static void
2303stackshot_flag_perf(uint64_t flag, char *flagname)
2304{
2305	/*
2306	 * STACKSHOT_NO_IO_STATS disables data collection, so set it for
2307	 * more accurate perfdata collection.
2308	 */
2309	flag |= STACKSHOT_NO_IO_STATS;
2310
2311	stackshot_flag_perf_noclobber(flag, flagname);
2312}
2313
2314
2315T_DECL(flag_perf, "test stackshot performance with different flags set", T_META_TAG_PERF)
2316{
2317	stackshot_flag_perf_noclobber(STACKSHOT_NO_IO_STATS, "baseline");
2318	stackshot_flag_perf_noclobber(0, "io_stats");
2319
2320	stackshot_flag_perf(STACKSHOT_THREAD_WAITINFO, "thread_waitinfo");
2321	stackshot_flag_perf(STACKSHOT_GET_DQ, "get_dq");
2322	stackshot_flag_perf(STACKSHOT_SAVE_LOADINFO, "save_loadinfo");
2323	stackshot_flag_perf(STACKSHOT_GET_GLOBAL_MEM_STATS, "get_global_mem_stats");
2324	stackshot_flag_perf(STACKSHOT_SAVE_KEXT_LOADINFO, "save_kext_loadinfo");
2325	stackshot_flag_perf(STACKSHOT_SAVE_IMP_DONATION_PIDS, "save_imp_donation_pids");
2326	stackshot_flag_perf(STACKSHOT_ENABLE_BT_FAULTING, "enable_bt_faulting");
2327	stackshot_flag_perf(STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT, "collect_sharedcache_layout");
2328	stackshot_flag_perf(STACKSHOT_ENABLE_UUID_FAULTING, "enable_uuid_faulting");
2329	stackshot_flag_perf(STACKSHOT_THREAD_GROUP, "thread_group");
2330	stackshot_flag_perf(STACKSHOT_SAVE_JETSAM_COALITIONS, "save_jetsam_coalitions");
2331	stackshot_flag_perf(STACKSHOT_INSTRS_CYCLES, "instrs_cycles");
2332	stackshot_flag_perf(STACKSHOT_ASID, "asid");
2333}
2334
2335T_DECL(perf_no_size_hint, "test stackshot performance with no size hint",
2336		T_META_TAG_PERF)
2337{
2338	stackshot_perf(0);
2339}
2340
2341T_DECL(perf_size_hint, "test stackshot performance with size hint",
2342		T_META_TAG_PERF)
2343{
2344	stackshot_perf(SHOULD_REUSE_SIZE_HINT);
2345}
2346
2347T_DECL(perf_process, "test stackshot performance targeted at process",
2348		T_META_TAG_PERF)
2349{
2350	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_TARGET_SELF);
2351}
2352
2353T_DECL(perf_delta, "test delta stackshot performance",
2354		T_META_TAG_PERF)
2355{
2356	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA);
2357}
2358
2359T_DECL(perf_delta_process, "test delta stackshot performance targeted at a process",
2360		T_META_TAG_PERF)
2361{
2362	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | SHOULD_TARGET_SELF);
2363}
2364
2365T_DECL(stackshot_entitlement_report_test, "test stackshot entitlement report")
2366{
2367	int sysctlValue = 1;
2368	T_ASSERT_POSIX_SUCCESS(
2369	    sysctlbyname("debug.stackshot_entitlement_send_batch", NULL, NULL, &sysctlValue, sizeof(sysctlValue)),
2370	    "set debug.stackshot_entitlement_send_batch=1");
2371	// having a way to verify that the coreanalytics event was received would be even better
2372	// See rdar://74197197
2373	T_PASS("entitlement test ran");
2374}
2375
2376static uint64_t
2377stackshot_timestamp(void *ssbuf, size_t sslen)
2378{
2379	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2380
2381	uint32_t type = kcdata_iter_type(iter);
2382	if (type != KCDATA_BUFFER_BEGIN_STACKSHOT && type != KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT) {
2383		T_ASSERT_FAIL("invalid kcdata type %u", kcdata_iter_type(iter));
2384	}
2385
2386	iter = kcdata_iter_find_type(iter, KCDATA_TYPE_MACH_ABSOLUTE_TIME);
2387	T_QUIET;
2388	T_ASSERT_TRUE(kcdata_iter_valid(iter), "timestamp found in stackshot");
2389
2390	return *(uint64_t *)kcdata_iter_payload(iter);
2391}
2392
2393#define TEST_THREAD_NAME "stackshot_test_thread"
2394
2395static void
2396parse_thread_group_stackshot(void **ssbuf, size_t sslen)
2397{
2398	bool seen_thread_group_snapshot = false;
2399	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2400	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
2401			"buffer provided is a stackshot");
2402
2403	NSMutableSet *thread_groups = [[NSMutableSet alloc] init];
2404
2405	iter = kcdata_iter_next(iter);
2406	KCDATA_ITER_FOREACH(iter) {
2407		switch (kcdata_iter_type(iter)) {
2408		case KCDATA_TYPE_ARRAY: {
2409			T_QUIET;
2410			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
2411					"checked that array is valid");
2412
2413			if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_THREAD_GROUP_SNAPSHOT) {
2414				continue;
2415			}
2416
2417			seen_thread_group_snapshot = true;
2418
2419			if (kcdata_iter_array_elem_size(iter) >= sizeof(struct thread_group_snapshot_v3)) {
2420				struct thread_group_snapshot_v3 *tgs_array = kcdata_iter_payload(iter);
2421				for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) {
2422					struct thread_group_snapshot_v3 *tgs = tgs_array + j;
2423					[thread_groups addObject:@(tgs->tgs_id)];
2424				}
2425			}
2426			else {
2427				struct thread_group_snapshot *tgs_array = kcdata_iter_payload(iter);
2428				for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) {
2429					struct thread_group_snapshot *tgs = tgs_array + j;
2430					[thread_groups addObject:@(tgs->tgs_id)];
2431				}
2432			}
2433			break;
2434		}
2435		}
2436	}
2437	KCDATA_ITER_FOREACH(iter) {
2438		NSError *error = nil;
2439
2440		switch (kcdata_iter_type(iter)) {
2441
2442		case KCDATA_TYPE_CONTAINER_BEGIN: {
2443			T_QUIET;
2444			T_ASSERT_TRUE(kcdata_iter_container_valid(iter),
2445					"checked that container is valid");
2446
2447			if (kcdata_iter_container_type(iter) != STACKSHOT_KCCONTAINER_THREAD) {
2448				break;
2449			}
2450
2451			NSDictionary *container = parseKCDataContainer(&iter, &error);
2452			T_QUIET; T_ASSERT_NOTNULL(container, "parsed thread container from stackshot");
2453			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container");
2454
2455			int tg = [container[@"thread_snapshots"][@"thread_group"] intValue];
2456
2457			T_ASSERT_TRUE([thread_groups containsObject:@(tg)], "check that the thread group the thread is in exists");
2458
2459			break;
2460		};
2461
2462		}
2463	}
2464	T_ASSERT_TRUE(seen_thread_group_snapshot, "check that we have seen a thread group snapshot");
2465}
2466
2467static void
2468verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count)
2469{
2470	uuid_t cur_shared_cache_uuid;
2471	__block uint32_t lib_index = 0, libs_found = 0;
2472
2473	_dyld_get_shared_cache_uuid(cur_shared_cache_uuid);
2474	int result = dyld_shared_cache_iterate_text(cur_shared_cache_uuid, ^(const dyld_shared_cache_dylib_text_info* info) {
2475			T_QUIET; T_ASSERT_LT(lib_index, uuid_count, "dyld_shared_cache_iterate_text exceeded number of libraries returned by kernel");
2476
2477			libs_found++;
2478			struct dyld_uuid_info_64 *cur_stackshot_uuid_entry = &uuids[lib_index];
2479			T_QUIET; T_ASSERT_EQ(memcmp(info->dylibUuid, cur_stackshot_uuid_entry->imageUUID, sizeof(info->dylibUuid)), 0,
2480					"dyld returned UUID doesn't match kernel returned UUID");
2481			T_QUIET; T_ASSERT_EQ(info->loadAddressUnslid, cur_stackshot_uuid_entry->imageLoadAddress,
2482					"dyld returned load address doesn't match kernel returned load address");
2483			lib_index++;
2484		});
2485
2486	T_ASSERT_EQ(result, 0, "iterate shared cache layout");
2487	T_ASSERT_EQ(libs_found, uuid_count, "dyld iterator returned same number of libraries as kernel");
2488
2489	T_LOG("verified %d libraries from dyld shared cache", libs_found);
2490}
2491
2492static void
2493check_shared_cache_uuid(uuid_t imageUUID)
2494{
2495	static uuid_t shared_cache_uuid;
2496	static dispatch_once_t read_shared_cache_uuid;
2497
2498	dispatch_once(&read_shared_cache_uuid, ^{
2499		T_QUIET;
2500		T_ASSERT_TRUE(_dyld_get_shared_cache_uuid(shared_cache_uuid), "retrieve current shared cache UUID");
2501	});
2502	T_QUIET; T_ASSERT_EQ(uuid_compare(shared_cache_uuid, imageUUID), 0,
2503			"dyld returned UUID doesn't match kernel returned UUID for system shared cache");
2504}
2505
2506/*
2507 * extra dictionary contains data relevant for the given flags:
2508 * PARSE_STACKSHOT_ZOMBIE:   zombie_child_pid_key -> @(pid)
2509 * PARSE_STACKSHOT_POSTEXEC: postexec_child_unique_pid_key -> @(unique_pid)
2510 */
2511static void
2512parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra)
2513{
2514	bool delta = (stackshot_parsing_flags & PARSE_STACKSHOT_DELTA);
2515	bool expect_sharedcache_child = (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_FLAGS);
2516	bool expect_zombie_child = (stackshot_parsing_flags & PARSE_STACKSHOT_ZOMBIE);
2517	bool expect_postexec_child = (stackshot_parsing_flags & PARSE_STACKSHOT_POSTEXEC);
2518	bool expect_cseg_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_CSEG);
2519	bool expect_translated_child = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSLATED);
2520	bool expect_shared_cache_layout = false;
2521	bool expect_shared_cache_uuid = !delta;
2522	bool expect_dispatch_queue_label = (stackshot_parsing_flags & PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL);
2523	bool expect_turnstile_lock = (stackshot_parsing_flags & PARSE_STACKSHOT_TURNSTILEINFO);
2524	bool expect_srp_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_SRP);
2525	bool expect_sp_throttled = (stackshot_parsing_flags & PARSE_STACKSHOT_THROTTLED_SP);
2526	bool expect_exec_inprogress = (stackshot_parsing_flags & PARSE_STACKSHOT_EXEC_INPROGRESS);
2527	bool expect_transitioning_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSITIONING);
2528	bool expect_asyncstack = (stackshot_parsing_flags & PARSE_STACKSHOT_ASYNCSTACK);
2529	bool expect_driverkit = (stackshot_parsing_flags & PARSE_STACKSHOT_DRIVERKIT);
2530	bool expect_suspendinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_SUSPENDINFO);
2531	bool found_zombie_child = false, found_postexec_child = false, found_shared_cache_layout = false, found_shared_cache_uuid = false;
2532	bool found_translated_child = false, found_transitioning_task = false;
2533	bool found_dispatch_queue_label = false, found_turnstile_lock = false;
2534	bool found_cseg_waitinfo = false, found_srp_waitinfo = false;
2535	bool found_sharedcache_child = false, found_sharedcache_badflags = false, found_sharedcache_self = false;
2536	bool found_asyncstack = false;
2537	bool found_throttled_service = false;
2538	uint64_t srp_expected_threadid = 0;
2539	pid_t zombie_child_pid = -1, srp_expected_pid = -1, sharedcache_child_pid = -1, throttled_service_ctx = -1;
2540	pid_t translated_child_pid = -1, transistioning_task_pid = -1;
2541	bool sharedcache_child_sameaddr = false, is_throttled = false;
2542	uint64_t postexec_child_unique_pid = 0, cseg_expected_threadid = 0;
2543	uint64_t sharedcache_child_flags = 0, sharedcache_self_flags = 0;
2544	uint64_t asyncstack_threadid = 0;
2545	NSArray *asyncstack_stack = nil;
2546	char *inflatedBufferBase = NULL;
2547	pid_t exec_inprogress_pid = -1;
2548	void (^exec_inprogress_cb)(uint64_t, uint64_t) = NULL;
2549	int exec_inprogress_found = 0;
2550	uint64_t exec_inprogress_containerid = 0;
2551	void (^driverkit_cb)(pid_t) = NULL;
2552	NSMutableDictionary *sharedCaches = [NSMutableDictionary new];
2553
2554	if (expect_shared_cache_uuid) {
2555		uuid_t shared_cache_uuid;
2556		if (!_dyld_get_shared_cache_uuid(shared_cache_uuid)) {
2557			T_LOG("Skipping verifying shared cache UUID in stackshot data because not running with a shared cache");
2558			expect_shared_cache_uuid = false;
2559		}
2560	}
2561
2562	if (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_LAYOUT) {
2563		size_t shared_cache_length = 0;
2564		const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length);
2565		T_QUIET; T_ASSERT_NOTNULL(cache_header, "current process running with shared cache");
2566		T_QUIET; T_ASSERT_GT(shared_cache_length, sizeof(struct _dyld_cache_header), "valid shared cache length populated by _dyld_get_shared_cache_range");
2567
2568		if (_dyld_shared_cache_is_locally_built()) {
2569			T_LOG("device running with locally built shared cache, expect shared cache layout");
2570			expect_shared_cache_layout = true;
2571		} else {
2572			T_LOG("device running with B&I built shared-cache, no shared cache layout expected");
2573		}
2574	}
2575
2576	if (expect_sharedcache_child) {
2577		NSNumber* pid_num = extra[sharedcache_child_pid_key];
2578		NSNumber* sameaddr_num = extra[sharedcache_child_sameaddr_key];
2579		T_QUIET; T_ASSERT_NOTNULL(pid_num, "sharedcache child pid provided");
2580		T_QUIET; T_ASSERT_NOTNULL(sameaddr_num, "sharedcache child addrsame provided");
2581		sharedcache_child_pid = [pid_num intValue];
2582		T_QUIET; T_ASSERT_GT(sharedcache_child_pid, 0, "sharedcache child pid greater than zero");
2583		sharedcache_child_sameaddr = [sameaddr_num intValue];
2584		T_QUIET; T_ASSERT_GE([sameaddr_num intValue], 0, "sharedcache child sameaddr is boolean (0 or 1)");
2585		T_QUIET; T_ASSERT_LE([sameaddr_num intValue], 1, "sharedcache child sameaddr is boolean (0 or 1)");
2586	}
2587
2588    if (expect_transitioning_task) {
2589        NSNumber* pid_num = extra[transitioning_pid_key];
2590        T_ASSERT_NOTNULL(pid_num, "transitioning task pid provided");
2591        transistioning_task_pid = [pid_num intValue];
2592    }
2593
2594	if (expect_zombie_child) {
2595		NSNumber* pid_num = extra[zombie_child_pid_key];
2596		T_QUIET; T_ASSERT_NOTNULL(pid_num, "zombie child pid provided");
2597		zombie_child_pid = [pid_num intValue];
2598		T_QUIET; T_ASSERT_GT(zombie_child_pid, 0, "zombie child pid greater than zero");
2599	}
2600
2601	if (expect_postexec_child) {
2602		NSNumber* unique_pid_num = extra[postexec_child_unique_pid_key];
2603		T_QUIET; T_ASSERT_NOTNULL(unique_pid_num, "postexec child unique pid provided");
2604		postexec_child_unique_pid = [unique_pid_num unsignedLongLongValue];
2605		T_QUIET; T_ASSERT_GT(postexec_child_unique_pid, 0ull, "postexec child unique pid greater than zero");
2606	}
2607
2608	if (expect_cseg_waitinfo) {
2609		NSNumber* tid_num = extra[cseg_expected_threadid_key];
2610		T_QUIET; T_ASSERT_NOTNULL(tid_num, "cseg's expected thread id provided");
2611		cseg_expected_threadid = tid_num.unsignedLongValue;
2612		T_QUIET; T_ASSERT_GT(cseg_expected_threadid, UINT64_C(0), "compressor segment thread is present");
2613	}
2614
2615	if (expect_srp_waitinfo) {
2616		NSNumber* threadid_num = extra[srp_expected_threadid_key];
2617		NSNumber* pid_num = extra[srp_expected_pid_key];
2618		T_QUIET; T_ASSERT_TRUE(threadid_num != nil || pid_num != nil, "expected SRP threadid or pid");
2619		if (threadid_num != nil) {
2620			srp_expected_threadid = [threadid_num unsignedLongLongValue];
2621			T_QUIET; T_ASSERT_GT(srp_expected_threadid, 0ull, "srp_expected_threadid greater than zero");
2622		}
2623		if (pid_num != nil) {
2624			srp_expected_pid = [pid_num intValue];
2625			T_QUIET; T_ASSERT_GT(srp_expected_pid, 0, "srp_expected_pid greater than zero");
2626		}
2627		T_LOG("looking for SRP pid: %d threadid: %llu", srp_expected_pid, srp_expected_threadid);
2628	}
2629
2630	if (expect_sp_throttled) {
2631		NSNumber* ctx = extra[sp_throttled_expected_ctxt_key];
2632		T_QUIET; T_ASSERT_TRUE(ctx != nil, "expected pid");
2633		throttled_service_ctx = [ctx intValue];
2634		T_QUIET; T_ASSERT_GT(throttled_service_ctx, 0, "expected pid greater than zero");
2635
2636		NSNumber *throttled = extra[sp_throttled_expect_flag];
2637		T_QUIET; T_ASSERT_TRUE(throttled != nil, "expected flag value");
2638		is_throttled = ([throttled intValue] != 0);
2639
2640		T_LOG("Looking for service with ctxt: %d, thottled:%d", throttled_service_ctx, is_throttled);
2641	}
2642
2643	if (expect_translated_child) {
2644		NSNumber* pid_num = extra[translated_child_pid_key];
2645		T_QUIET; T_ASSERT_NOTNULL(pid_num, "translated child pid provided");
2646		translated_child_pid = [pid_num intValue];
2647		T_QUIET; T_ASSERT_GT(translated_child_pid, 0, "translated child pid greater than zero");
2648	}
2649	if (expect_exec_inprogress) {
2650		NSNumber* pid_num = extra[exec_inprogress_pid_key];
2651		T_QUIET; T_ASSERT_NOTNULL(pid_num, "exec inprogress pid provided");
2652		exec_inprogress_pid = [pid_num intValue];
2653		T_QUIET; T_ASSERT_GT(exec_inprogress_pid, 0, "exec inprogress pid greater than zero");
2654
2655		exec_inprogress_cb = extra[exec_inprogress_found_key];
2656		T_QUIET; T_ASSERT_NOTNULL(exec_inprogress_cb, "exec inprogress found callback provided");
2657	}
2658	if (expect_driverkit) {
2659		driverkit_cb = extra[driverkit_found_key];
2660		T_QUIET; T_ASSERT_NOTNULL(driverkit_cb, "driverkit found callback provided");
2661	}
2662
2663	if (expect_asyncstack) {
2664		NSNumber* threadid_id = extra[asyncstack_expected_threadid_key];
2665		T_QUIET; T_ASSERT_NOTNULL(threadid_id, "asyncstack threadid provided");
2666		asyncstack_threadid = [threadid_id unsignedLongLongValue];
2667		asyncstack_stack = extra[asyncstack_expected_stack_key];
2668		T_QUIET; T_ASSERT_NOTNULL(asyncstack_stack, "asyncstack expected stack provided");
2669	}
2670
2671	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2672	if (delta) {
2673		T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT,
2674				"buffer provided is a delta stackshot");
2675
2676			iter = kcdata_iter_next(iter);
2677	} else {
2678		if (kcdata_iter_type(iter) != KCDATA_BUFFER_BEGIN_COMPRESSED) {
2679			T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
2680					"buffer provided is a stackshot");
2681
2682			iter = kcdata_iter_next(iter);
2683		} else {
2684			/* we are dealing with a compressed buffer */
2685			iter = kcdata_iter_next(iter);
2686			uint64_t compression_type = 0, totalout = 0, totalin = 0;
2687
2688			uint64_t *data;
2689			char *desc;
2690			for (int i = 0; i < 3; i ++) {
2691				kcdata_iter_get_data_with_desc(iter, &desc, (void **)&data, NULL);
2692				if (strcmp(desc, "kcd_c_type") == 0) {
2693					compression_type = *data;
2694				} else if (strcmp(desc, "kcd_c_totalout") == 0){
2695					totalout = *data;
2696				} else if (strcmp(desc, "kcd_c_totalin") == 0){
2697					totalin = *data;
2698				}
2699
2700				iter = kcdata_iter_next(iter);
2701			}
2702
2703			T_ASSERT_EQ(compression_type, UINT64_C(1), "zlib compression is used");
2704			T_ASSERT_GT(totalout, UINT64_C(0), "successfully gathered how long the compressed buffer is");
2705			T_ASSERT_GT(totalin, UINT64_C(0), "successfully gathered how long the uncompressed buffer will be at least");
2706
2707			/* progress to the next kcdata item */
2708			T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "compressed stackshot found");
2709
2710			char *bufferBase = kcdata_iter_payload(iter);
2711
2712			/*
2713			 * zlib is used, allocate a buffer based on the metadata, plus
2714			 * extra scratch space (+12.5%) in case totalin was inconsistent
2715			 */
2716			size_t inflatedBufferSize = totalin + (totalin >> 3);
2717			inflatedBufferBase = malloc(inflatedBufferSize);
2718			T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(inflatedBufferBase, "allocated temporary output buffer");
2719
2720			z_stream zs;
2721			memset(&zs, 0, sizeof(zs));
2722			T_QUIET; T_ASSERT_EQ(inflateInit(&zs), Z_OK, "inflateInit OK");
2723			zs.next_in = (unsigned char *)bufferBase;
2724			T_QUIET; T_ASSERT_LE(totalout, (uint64_t)UINT_MAX, "stackshot is not too large");
2725			zs.avail_in = (uInt)totalout;
2726			zs.next_out = (unsigned char *)inflatedBufferBase;
2727			T_QUIET; T_ASSERT_LE(inflatedBufferSize, (size_t)UINT_MAX, "output region is not too large");
2728			zs.avail_out = (uInt)inflatedBufferSize;
2729			T_ASSERT_EQ(inflate(&zs, Z_FINISH), Z_STREAM_END, "inflated buffer");
2730			inflateEnd(&zs);
2731
2732			T_ASSERT_EQ((uint64_t)zs.total_out, totalin, "expected number of bytes inflated");
2733
2734			/* copy the data after the compressed area */
2735			T_QUIET; T_ASSERT_GE((void *)bufferBase, ssbuf,
2736					"base of compressed stackshot is after the returned stackshot buffer");
2737			size_t header_size = (size_t)(bufferBase - (char *)ssbuf);
2738			size_t data_after_compressed_size = sslen - totalout - header_size;
2739			T_QUIET; T_ASSERT_LE(data_after_compressed_size,
2740					inflatedBufferSize - zs.total_out,
2741					"footer fits in the buffer");
2742			memcpy(inflatedBufferBase + zs.total_out,
2743					bufferBase + totalout,
2744					data_after_compressed_size);
2745
2746			iter = kcdata_iter(inflatedBufferBase, inflatedBufferSize);
2747		}
2748	}
2749
2750	KCDATA_ITER_FOREACH(iter) {
2751		NSError *error = nil;
2752
2753		switch (kcdata_iter_type(iter)) {
2754		case KCDATA_TYPE_ARRAY: {
2755			T_QUIET;
2756			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
2757					"checked that array is valid");
2758
2759			NSMutableDictionary *array = parseKCDataArray(iter, &error);
2760			T_QUIET; T_ASSERT_NOTNULL(array, "parsed array from stackshot");
2761			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing array");
2762
2763			if (kcdata_iter_array_elem_type(iter) == STACKSHOT_KCTYPE_SYS_SHAREDCACHE_LAYOUT) {
2764				struct dyld_uuid_info_64 *shared_cache_uuids = kcdata_iter_payload(iter);
2765				uint32_t uuid_count = kcdata_iter_array_elem_count(iter);
2766				T_ASSERT_NOTNULL(shared_cache_uuids, "parsed shared cache layout array");
2767				T_ASSERT_GT(uuid_count, 0, "returned valid number of UUIDs from shared cache");
2768				verify_stackshot_sharedcache_layout(shared_cache_uuids, uuid_count);
2769				found_shared_cache_layout = true;
2770			}
2771
2772			break;
2773		}
2774
2775		case KCDATA_TYPE_CONTAINER_BEGIN: {
2776			T_QUIET;
2777			T_ASSERT_TRUE(kcdata_iter_container_valid(iter),
2778					"checked that container is valid");
2779
2780			uint64_t containerid = kcdata_iter_container_id(iter);
2781			uint32_t container_type = kcdata_iter_container_type(iter);
2782
2783			if (container_type == STACKSHOT_KCCONTAINER_SHAREDCACHE) {
2784				NSDictionary *container = parseKCDataContainer(&iter, &error);
2785				T_QUIET; T_ASSERT_NOTNULL(container, "parsed sharedcache container from stackshot");
2786				T_QUIET; T_ASSERT_NULL(error, "error unset after parsing sharedcache container");
2787				T_QUIET; T_EXPECT_EQ(sharedCaches[@(containerid)], nil, "sharedcache containerid %lld should be unique", containerid);
2788				sharedCaches[@(containerid)] = container;
2789				break;
2790			}
2791
2792			/*
2793			 * treat containers other than tasks/transitioning_tasks
2794			 * as expanded in-line.
2795			 */
2796			if (container_type != STACKSHOT_KCCONTAINER_TASK &&
2797			    container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK) {
2798				T_LOG("container skipped: %d", container_type);
2799				break;
2800			}
2801			NSDictionary *container = parseKCDataContainer(&iter, &error);
2802			T_QUIET; T_ASSERT_NOTNULL(container, "parsed task/transitioning_task container from stackshot");
2803			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container");
2804
2805			NSDictionary* task_snapshot = container[@"task_snapshots"][@"task_snapshot"];
2806			NSDictionary* task_delta_snapshot = container[@"task_snapshots"][@"task_delta_snapshot"];
2807			NSDictionary* transitioning_task_snapshot = container[@"transitioning_task_snapshots"][@"transitioning_task_snapshot"];
2808
2809			/*
2810			 * Having processed the container, we now only check it
2811			 * if it's the correct type.
2812			 */
2813			if ((!expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TASK)) ||
2814			    (expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK))) {
2815				break;
2816			}
2817			if (!expect_transitioning_task) {
2818			    	T_QUIET; T_ASSERT_TRUE(!!task_snapshot != !!task_delta_snapshot, "Either task_snapshot xor task_delta_snapshot provided");
2819			}
2820
2821			if (expect_dispatch_queue_label && !found_dispatch_queue_label) {
2822				for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) {
2823					NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key];
2824					NSString *dql = thread[@"dispatch_queue_label"];
2825
2826					if ([dql isEqualToString:@TEST_STACKSHOT_QUEUE_LABEL]) {
2827						found_dispatch_queue_label = true;
2828						break;
2829					}
2830				}
2831			}
2832
2833			if (expect_transitioning_task && !found_transitioning_task) {
2834				if (transitioning_task_snapshot) {
2835					uint64_t the_pid = [transitioning_task_snapshot[@"tts_pid"] unsignedLongLongValue];
2836					if (the_pid == (uint64_t)transistioning_task_pid) {
2837					    found_transitioning_task = true;
2838					    T_PASS("FOUND Transitioning task %llu has a transitioning task snapshot", (uint64_t) transistioning_task_pid);
2839					    break;
2840					}
2841				}
2842			}
2843
2844			if (expect_postexec_child && !found_postexec_child) {
2845				if (task_snapshot) {
2846					uint64_t unique_pid = [task_snapshot[@"ts_unique_pid"] unsignedLongLongValue];
2847					if (unique_pid == postexec_child_unique_pid) {
2848						found_postexec_child = true;
2849
2850						T_PASS("post-exec child %llu has a task snapshot", postexec_child_unique_pid);
2851
2852						break;
2853					}
2854				}
2855
2856				if (task_delta_snapshot) {
2857					uint64_t unique_pid = [task_delta_snapshot[@"tds_unique_pid"] unsignedLongLongValue];
2858					if (unique_pid == postexec_child_unique_pid) {
2859						found_postexec_child = true;
2860
2861						T_FAIL("post-exec child %llu shouldn't have a delta task snapshot", postexec_child_unique_pid);
2862
2863						break;
2864					}
2865				}
2866			}
2867
2868			if (!task_snapshot) {
2869				break;
2870			}
2871
2872			int pid = [task_snapshot[@"ts_pid"] intValue];
2873
2874			if (pid && expect_shared_cache_uuid && !found_shared_cache_uuid) {
2875				id ptr = container[@"task_snapshots"][@"shared_cache_dyld_load_info"];
2876				if (ptr) {
2877					id uuid = ptr[@"imageUUID"];
2878
2879					uint8_t uuid_p[16];
2880					for (unsigned int i = 0; i < 16; i ++) {
2881						NSNumber *uuidByte = uuid[i];
2882						uuid_p[i] = (uint8_t)uuidByte.charValue;
2883					}
2884
2885					check_shared_cache_uuid(uuid_p);
2886
2887					uint64_t baseAddress = (uint64_t)((NSNumber *)ptr[@"imageSlidBaseAddress"]).longLongValue;
2888					uint64_t firstMapping = (uint64_t)((NSNumber *)ptr[@"sharedCacheSlidFirstMapping"]).longLongValue;
2889
2890					T_EXPECT_LE(baseAddress, firstMapping,
2891						"in per-task shared_cache_dyld_load_info, "
2892						"baseAddress <= firstMapping");
2893					T_EXPECT_GE(baseAddress + (7ull << 32) + (1ull << 29),
2894						firstMapping,
2895						"in per-task shared_cache_dyld_load_info, "
2896						"baseAddress + 28.5gig >= firstMapping");
2897
2898					size_t shared_cache_len;
2899					const void *addr = _dyld_get_shared_cache_range(&shared_cache_len);
2900					T_EXPECT_EQ((uint64_t)addr, firstMapping,
2901							"SlidFirstMapping should match shared_cache_range");
2902
2903					/*
2904					 * check_shared_cache_uuid() will assert on failure, so if
2905					 * we get here, then we have found the shared cache UUID
2906					 * and it's correct
2907					 */
2908					found_shared_cache_uuid = true;
2909				}
2910			}
2911
2912			if (expect_sharedcache_child) {
2913				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
2914				uint64_t sharedregion_flags = (task_flags & (kTaskSharedRegionNone | kTaskSharedRegionSystem | kTaskSharedRegionOther));
2915				id sharedregion_info = container[@"task_snapshots"][@"shared_cache_dyld_load_info"];
2916				id sharedcache_id = container[@"task_snapshots"][@"sharedCacheID"];
2917				if (!found_sharedcache_badflags) {
2918					T_QUIET; T_EXPECT_NE(sharedregion_flags, 0ll, "one of the kTaskSharedRegion flags should be set on all tasks");
2919					bool multiple = (sharedregion_flags & (sharedregion_flags - 1)) != 0;
2920					T_QUIET; T_EXPECT_FALSE(multiple, "only one kTaskSharedRegion flag should be set on each task");
2921					found_sharedcache_badflags = (sharedregion_flags == 0 || multiple);
2922				}
2923				if (pid == 0) {
2924					T_ASSERT_EQ(sharedregion_flags, (uint64_t)kTaskSharedRegionNone, "Kernel proc (pid 0) should have no shared region");
2925				} else if (pid == sharedcache_child_pid) {
2926					found_sharedcache_child = true;
2927					sharedcache_child_flags = sharedregion_flags;
2928				} else if (pid == getpid()) {
2929					found_sharedcache_self = true;
2930					sharedcache_self_flags = sharedregion_flags;
2931				}
2932				if (sharedregion_flags == kTaskSharedRegionOther && !(task_flags & kTaskSharedRegionInfoUnavailable)) {
2933					T_QUIET; T_EXPECT_NOTNULL(sharedregion_info, "kTaskSharedRegionOther should have a shared_cache_dyld_load_info struct");
2934					T_QUIET; T_EXPECT_NOTNULL(sharedcache_id, "kTaskSharedRegionOther should have a sharedCacheID");
2935					if (sharedcache_id != nil) {
2936						T_QUIET; T_EXPECT_NOTNULL(sharedCaches[sharedcache_id], "sharedCacheID %d should exist", [sharedcache_id intValue]);
2937					}
2938				} else {
2939					T_QUIET; T_EXPECT_NULL(sharedregion_info, "non-kTaskSharedRegionOther should have no shared_cache_dyld_load_info struct");
2940					T_QUIET; T_EXPECT_NULL(sharedcache_id, "non-kTaskSharedRegionOther should have no sharedCacheID");
2941				}
2942			}
2943
2944			if (expect_zombie_child && (pid == zombie_child_pid)) {
2945				found_zombie_child = true;
2946
2947				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
2948				T_ASSERT_TRUE((task_flags & kTerminatedSnapshot) == kTerminatedSnapshot, "child zombie marked as terminated");
2949
2950				continue;
2951			}
2952
2953			if (expect_translated_child && (pid == translated_child_pid)) {
2954				found_translated_child = true;
2955
2956				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
2957				T_EXPECT_BITS_SET(task_flags, kTaskIsTranslated, "child marked as translated");
2958
2959				continue;
2960			}
2961			if (expect_exec_inprogress && (pid == exec_inprogress_pid || pid == -exec_inprogress_pid)) {
2962				exec_inprogress_found++;
2963				T_LOG("found exec task with pid %d, instance %d", pid, exec_inprogress_found);
2964				T_QUIET; T_ASSERT_LE(exec_inprogress_found, 2, "no more than two with the expected pid");
2965				if (exec_inprogress_found == 2) {
2966					T_LOG("found 2 tasks with pid %d", exec_inprogress_pid);
2967					exec_inprogress_cb(containerid, exec_inprogress_containerid);
2968				} else {
2969					exec_inprogress_containerid = containerid;
2970				}
2971			}
2972			if (expect_driverkit && driverkit_cb != NULL) {
2973				driverkit_cb(pid);
2974			}
2975			if (expect_cseg_waitinfo) {
2976				NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"];
2977
2978				for (id i in winfos) {
2979					NSNumber *waitType = i[@"wait_type"];
2980					NSNumber *owner = i[@"owner"];
2981					if (waitType.intValue == kThreadWaitCompressor &&
2982							owner.unsignedLongValue == cseg_expected_threadid) {
2983						found_cseg_waitinfo = true;
2984						break;
2985					}
2986				}
2987			}
2988
2989			if (expect_srp_waitinfo) {
2990				NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
2991				NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"];
2992				for (id i in tinfos) {
2993					if (!found_srp_waitinfo) {
2994						bool found_thread = false;
2995						bool found_pid = false;
2996						if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_THREAD) &&
2997						    [i[@"turnstile_context"] unsignedLongLongValue] == srp_expected_threadid &&
2998						    srp_expected_threadid != 0) {
2999							found_thread = true;
3000						}
3001						if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_BLOCKED_ON_TASK) &&
3002						    [i[@"turnstile_context"] intValue] == srp_expected_pid &&
3003						    srp_expected_pid != -1) {
3004							found_pid = true;
3005						}
3006						if (found_pid || found_thread) {
3007							T_LOG("found SRP %s %lld waiter: %d", (found_thread ? "thread" : "pid"),
3008							    [i[@"turnstile_context"] unsignedLongLongValue], [i[@"waiter"] intValue]);
3009							/* we found something that is blocking the correct threadid */
3010							for (id j in winfos) {
3011								if ([j[@"waiter"] intValue] == [i[@"waiter"] intValue] &&
3012								    [j[@"wait_type"] intValue] == kThreadWaitPortReceive) {
3013									found_srp_waitinfo = true;
3014									T_EXPECT_EQ([j[@"wait_flags"] intValue], STACKSHOT_WAITINFO_FLAGS_SPECIALREPLY,
3015									    "SRP waitinfo should be marked as a special reply");
3016									break;
3017								}
3018							}
3019
3020							if (found_srp_waitinfo) {
3021								break;
3022							}
3023						}
3024					}
3025				}
3026			}
3027
3028			if (expect_sp_throttled) {
3029				NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3030				for (id i in tinfos) {
3031					if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_PORTFLAGS)
3032						&& [i[@"turnstile_context"] intValue] == throttled_service_ctx) {
3033						int portlabel_id = [i[@"portlabel_id"] intValue];
3034						T_LOG("[pid:%d] Turnstile (flags = 0x%x, ctx = %d, portlabel_id = %d)", pid,
3035							[i[@"turnstile_flags"] intValue], [i[@"turnstile_context"] intValue], portlabel_id);
3036						for (id portid in container[@"task_snapshots"][@"portlabels"]) {
3037							if (portlabel_id != [portid intValue]) {
3038								continue;
3039							}
3040
3041							NSMutableDictionary *portlabel = container[@"task_snapshots"][@"portlabels"][portid];
3042							T_ASSERT_TRUE(portlabel != nil, "Found portlabel id: %d", [portid intValue]);
3043							NSString *portlabel_name = portlabel[@"portlabel_name"];
3044							T_EXPECT_TRUE(portlabel_name != nil, "Found portlabel %s", portlabel_name.UTF8String);
3045							T_EXPECT_EQ_STR(portlabel_name.UTF8String, THROTTLED_SERVICE_NAME, "throttled service port name matches");
3046							T_EXPECT_EQ(([portlabel[@"portlabel_flags"] intValue] & STACKSHOT_PORTLABEL_THROTTLED) != 0,
3047								is_throttled, "Port %s throttled", is_throttled ? "is" : "isn't");
3048							found_throttled_service = true;
3049							break;
3050						}
3051					}
3052
3053					if (found_throttled_service) {
3054						break;
3055					}
3056				}
3057			}
3058
3059			if (expect_suspendinfo) {
3060				// TODO: rdar://112563110
3061			}
3062
3063			if (pid != getpid()) {
3064				break;
3065			}
3066
3067			T_EXPECT_EQ_STR(current_process_name(),
3068					[task_snapshot[@"ts_p_comm"] UTF8String],
3069					"current process name matches in stackshot");
3070
3071			uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3072			T_ASSERT_BITS_NOTSET(task_flags, kTerminatedSnapshot, "current process not marked as terminated");
3073			T_ASSERT_BITS_NOTSET(task_flags, kTaskIsTranslated, "current process not marked as translated");
3074
3075			T_QUIET;
3076			T_EXPECT_LE(pid, [task_snapshot[@"ts_unique_pid"] intValue],
3077					"unique pid is greater than pid");
3078
3079			NSDictionary* task_cpu_architecture = container[@"task_snapshots"][@"task_cpu_architecture"];
3080			T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cputype"], "have cputype");
3081			T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cpusubtype"], "have cputype");
3082			int cputype = [task_cpu_architecture[@"cputype"] intValue];
3083			int cpusubtype = [task_cpu_architecture[@"cpusubtype"] intValue];
3084
3085			struct proc_archinfo archinfo;
3086			int retval = proc_pidinfo(pid, PROC_PIDARCHINFO, 0, &archinfo, sizeof(archinfo));
3087			T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDARCHINFO) returned a value > 0");
3088			T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(struct proc_archinfo), "proc_pidinfo call for PROC_PIDARCHINFO returned expected size");
3089			T_QUIET; T_EXPECT_EQ(cputype, archinfo.p_cputype, "cpu type is correct");
3090			T_QUIET; T_EXPECT_EQ(cpusubtype, archinfo.p_cpusubtype, "cpu subtype is correct");
3091
3092			NSDictionary * codesigning_info = container[@"task_snapshots"][@"stackshot_task_codesigning_info"];
3093			T_QUIET; T_ASSERT_NOTNULL(codesigning_info[@"csflags"], "have csflags");
3094			uint64_t flags = [codesigning_info[@"csflags"] unsignedLongLongValue];
3095			T_QUIET; T_EXPECT_GT(flags, 0, "nonzero csflags");
3096
3097			T_QUIET; T_ASSERT_NOTNULL(container[@"task_snapshots"][@"jetsam_coalition"], "have jetsam coalition");
3098			uint64_t jetsam_coalition = [container[@"task_snapshots"][@"jetsam_coalition"] unsignedLongLongValue];
3099			T_QUIET; T_EXPECT_GT(jetsam_coalition, 0, "nonzero jetsam coalition");
3100
3101			bool found_main_thread = false;
3102			uint64_t main_thread_id = -1ULL;
3103			bool found_null_kernel_frame = false;
3104			for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) {
3105				NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key];
3106				NSDictionary *thread_snap = thread[@"thread_snapshot"];
3107
3108				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_thread_id"] intValue], 0,
3109						"thread ID of thread in current task is valid");
3110				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_base_priority"] intValue], 0,
3111						"base priority of thread in current task is valid");
3112				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_sched_priority"] intValue], 0,
3113						"scheduling priority of thread in current task is valid");
3114
3115				NSString *pth_name = thread[@"pth_name"];
3116				if (pth_name != nil && [pth_name isEqualToString:@TEST_THREAD_NAME]) {
3117					found_main_thread = true;
3118					main_thread_id = [thread_snap[@"ths_thread_id"] unsignedLongLongValue];
3119
3120					T_QUIET; T_EXPECT_GT([thread_snap[@"ths_total_syscalls"] intValue], 0,
3121							"total syscalls of current thread is valid");
3122
3123					NSDictionary *cpu_times = thread[@"cpu_times"];
3124					T_EXPECT_GE([cpu_times[@"runnable_time"] intValue],
3125							[cpu_times[@"system_time"] intValue] +
3126							[cpu_times[@"user_time"] intValue],
3127							"runnable time of current thread is valid");
3128				}
3129				if (!found_null_kernel_frame) {
3130					for (NSNumber *frame in thread[@"kernel_frames"]) {
3131						if (frame.unsignedLongValue == 0) {
3132							found_null_kernel_frame = true;
3133							break;
3134						}
3135					}
3136				}
3137				if (expect_asyncstack && !found_asyncstack &&
3138				    asyncstack_threadid == [thread_snap[@"ths_thread_id"] unsignedLongLongValue]) {
3139					found_asyncstack = true;
3140					NSArray* async_stack = thread[@"user_async_stack_frames"];
3141					NSNumber* start_idx = thread[@"user_async_start_index"];
3142					NSArray* user_stack = thread[@"user_stack_frames"];
3143					T_QUIET; T_ASSERT_NOTNULL(async_stack, "async thread %#llx has user_async_stack_frames", asyncstack_threadid);
3144					T_QUIET; T_ASSERT_NOTNULL(start_idx, "async thread %#llx has user_async_start_index", asyncstack_threadid);
3145					T_QUIET; T_ASSERT_NOTNULL(user_stack, "async thread %#llx has user_stack_frames", asyncstack_threadid);
3146					T_QUIET; T_ASSERT_EQ(async_stack.count, asyncstack_stack.count,
3147						"actual async_stack count == expected async_stack count");
3148					for (size_t i = 0; i < async_stack.count; i++) {
3149						T_EXPECT_EQ([async_stack[i][@"lr"] unsignedLongLongValue],
3150							[asyncstack_stack[i] unsignedLongLongValue], "frame %zu matches", i);
3151					}
3152				}
3153			}
3154			T_EXPECT_TRUE(found_main_thread, "found main thread for current task in stackshot");
3155			T_EXPECT_FALSE(found_null_kernel_frame, "should not see any NULL kernel frames");
3156
3157			if (expect_turnstile_lock && !found_turnstile_lock) {
3158				NSArray *tsinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3159
3160				for (id i in tsinfos) {
3161					if ([i[@"turnstile_context"] unsignedLongLongValue] == main_thread_id) {
3162						found_turnstile_lock = true;
3163						break;
3164					}
3165				}
3166			}
3167			break;
3168		}
3169		case STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO: {
3170			// Legacy shared cache info
3171			struct dyld_shared_cache_loadinfo *payload = kcdata_iter_payload(iter);
3172			T_ASSERT_EQ((size_t)kcdata_iter_size(iter), sizeof(*payload), "valid dyld_shared_cache_loadinfo struct");
3173
3174			check_shared_cache_uuid(payload->sharedCacheUUID);
3175
3176			T_EXPECT_LE(payload->sharedCacheUnreliableSlidBaseAddress,
3177				payload->sharedCacheSlidFirstMapping,
3178				"SlidBaseAddress <= SlidFirstMapping");
3179			T_EXPECT_GE(payload->sharedCacheUnreliableSlidBaseAddress + (7ull << 32) + (1ull << 29),
3180				payload->sharedCacheSlidFirstMapping,
3181				"SlidFirstMapping should be within 28.5gigs of SlidBaseAddress");
3182
3183			size_t shared_cache_len;
3184			const void *addr = _dyld_get_shared_cache_range(&shared_cache_len);
3185			T_EXPECT_EQ((uint64_t)addr, payload->sharedCacheSlidFirstMapping,
3186			    "SlidFirstMapping should match shared_cache_range");
3187
3188			/*
3189			 * check_shared_cache_uuid() asserts on failure, so we must have
3190			 * found the shared cache UUID to be correct.
3191			 */
3192			found_shared_cache_uuid = true;
3193			break;
3194		}
3195		}
3196	}
3197
3198	if (expect_sharedcache_child) {
3199		T_QUIET; T_ASSERT_TRUE(found_sharedcache_child, "found sharedcache child in kcdata");
3200		T_QUIET; T_ASSERT_TRUE(found_sharedcache_self, "found self in kcdata");
3201		if (found_sharedcache_child && found_sharedcache_self) {
3202			T_QUIET; T_ASSERT_NE(sharedcache_child_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache child should have shared region");
3203			T_QUIET; T_ASSERT_NE(sharedcache_self_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache: self should have shared region");
3204			if (sharedcache_self_flags == kTaskSharedRegionSystem && !sharedcache_child_sameaddr) {
3205				/* If we're in the system shared region, and the child has a different address, child must have an Other shared region */
3206				T_ASSERT_EQ(sharedcache_child_flags, (uint64_t)kTaskSharedRegionOther,
3207				    "sharedcache child should have Other shared region");
3208			}
3209		}
3210	}
3211
3212	if (expect_transitioning_task) {
3213		T_QUIET; T_ASSERT_TRUE(found_transitioning_task, "found transitioning_task child in kcdata");
3214	}
3215
3216	if (expect_exec_inprogress) {
3217		T_QUIET; T_ASSERT_GT(exec_inprogress_found, 0, "found at least 1 task for execing process");
3218	}
3219
3220	if (expect_zombie_child) {
3221		T_QUIET; T_ASSERT_TRUE(found_zombie_child, "found zombie child in kcdata");
3222	}
3223
3224	if (expect_postexec_child) {
3225		T_QUIET; T_ASSERT_TRUE(found_postexec_child, "found post-exec child in kcdata");
3226	}
3227
3228	if (expect_translated_child) {
3229		T_QUIET; T_ASSERT_TRUE(found_translated_child, "found translated child in kcdata");
3230	}
3231
3232	if (expect_shared_cache_layout) {
3233		T_QUIET; T_ASSERT_TRUE(found_shared_cache_layout, "shared cache layout found in kcdata");
3234	}
3235
3236	if (expect_shared_cache_uuid) {
3237		T_QUIET; T_ASSERT_TRUE(found_shared_cache_uuid, "shared cache UUID found in kcdata");
3238	}
3239
3240	if (expect_dispatch_queue_label) {
3241		T_QUIET; T_ASSERT_TRUE(found_dispatch_queue_label, "dispatch queue label found in kcdata");
3242	}
3243
3244	if (expect_turnstile_lock) {
3245		T_QUIET; T_ASSERT_TRUE(found_turnstile_lock, "found expected deadlock");
3246	}
3247
3248	if (expect_cseg_waitinfo) {
3249		T_QUIET; T_ASSERT_TRUE(found_cseg_waitinfo, "found c_seg waitinfo");
3250	}
3251
3252	if (expect_srp_waitinfo) {
3253		T_QUIET; T_ASSERT_TRUE(found_srp_waitinfo, "found special reply port waitinfo");
3254	}
3255
3256	if (expect_sp_throttled) {
3257		T_QUIET; T_ASSERT_TRUE(found_throttled_service, "found the throttled service");
3258	}
3259
3260	if (expect_asyncstack) {
3261		T_QUIET; T_ASSERT_TRUE(found_asyncstack, "found async stack threadid");
3262	}
3263
3264	T_ASSERT_FALSE(KCDATA_ITER_FOREACH_FAILED(iter), "successfully iterated kcdata");
3265
3266	free(inflatedBufferBase);
3267}
3268
3269static const char *
3270current_process_name(void)
3271{
3272	static char name[64];
3273
3274	if (!name[0]) {
3275		int ret = proc_name(getpid(), name, sizeof(name));
3276		T_QUIET;
3277		T_ASSERT_POSIX_SUCCESS(ret, "proc_name failed for current process");
3278	}
3279
3280	return name;
3281}
3282
3283static void
3284initialize_thread(void)
3285{
3286	int ret = pthread_setname_np(TEST_THREAD_NAME);
3287	T_QUIET;
3288	T_ASSERT_POSIX_ZERO(ret, "set thread name to %s", TEST_THREAD_NAME);
3289}
3290