1#include <darwintest.h> 2#include <darwintest_utils.h> 3#include <darwintest_multiprocess.h> 4#include <kern/debug.h> 5#include <kern/kern_cdata.h> 6#include <kern/block_hint.h> 7#include <kdd.h> 8#include <libproc.h> 9#include <os/atomic_private.h> 10#include <mach-o/dyld.h> 11#include <mach-o/dyld_images.h> 12#include <mach-o/dyld_priv.h> 13#include <sys/syscall.h> 14#include <sys/stackshot.h> 15#include <uuid/uuid.h> 16#include <servers/bootstrap.h> 17#include <pthread/workqueue_private.h> 18#include <dispatch/private.h> 19#include <stdalign.h> 20 21#import <zlib.h> 22#import <IOKit/IOKitLib.h> 23#import <IOKit/IOKitLibPrivate.h> 24#import <IOKit/IOKitKeysPrivate.h> 25 26 27 28T_GLOBAL_META( 29 T_META_NAMESPACE("xnu.stackshot"), 30 T_META_RADAR_COMPONENT_NAME("xnu"), 31 T_META_RADAR_COMPONENT_VERSION("stackshot"), 32 T_META_OWNER("jonathan_w_adams"), 33 T_META_CHECK_LEAKS(false), 34 T_META_ASROOT(true) 35 ); 36 37static const char *current_process_name(void); 38static void verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count); 39static void parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra); 40static void parse_thread_group_stackshot(void **sbuf, size_t sslen); 41static uint64_t stackshot_timestamp(void *ssbuf, size_t sslen); 42static void initialize_thread(void); 43 44static uint64_t global_flags = 0; 45 46#define DEFAULT_STACKSHOT_BUFFER_SIZE (1024 * 1024) 47#define MAX_STACKSHOT_BUFFER_SIZE (6 * 1024 * 1024) 48 49#define SRP_SERVICE_NAME "com.apple.xnu.test.stackshot.special_reply_port" 50 51/* bit flags for parse_stackshot */ 52#define PARSE_STACKSHOT_DELTA 0x01 53#define PARSE_STACKSHOT_ZOMBIE 0x02 54#define PARSE_STACKSHOT_SHAREDCACHE_LAYOUT 0x04 55#define PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL 0x08 56#define PARSE_STACKSHOT_TURNSTILEINFO 0x10 57#define PARSE_STACKSHOT_POSTEXEC 0x20 58#define PARSE_STACKSHOT_WAITINFO_CSEG 0x40 59#define PARSE_STACKSHOT_WAITINFO_SRP 0x80 60#define PARSE_STACKSHOT_TRANSLATED 0x100 61#define PARSE_STACKSHOT_SHAREDCACHE_FLAGS 0x200 62#define PARSE_STACKSHOT_EXEC_INPROGRESS 0x400 63#define PARSE_STACKSHOT_TRANSITIONING 0x800 64#define PARSE_STACKSHOT_ASYNCSTACK 0x1000 65#define PARSE_STACKSHOT_COMPACTINFO 0x2000 /* TODO: rdar://88789261 */ 66#define PARSE_STACKSHOT_DRIVERKIT 0x4000 67#define PARSE_STACKSHOT_THROTTLED_SP 0x8000 68#define PARSE_STACKSHOT_SUSPENDINFO 0x10000 69 70/* keys for 'extra' dictionary for parse_stackshot */ 71static const NSString* zombie_child_pid_key = @"zombie_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_ZOMBIE 72static const NSString* postexec_child_unique_pid_key = @"postexec_child_unique_pid"; // -> @(unique_pid), required for PARSE_STACKSHOT_POSTEXEC 73static const NSString* cseg_expected_threadid_key = @"cseg_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_WAITINFO_CSEG 74static const NSString* srp_expected_threadid_key = @"srp_expected_threadid"; // -> @(tid), this or ..._pid required for PARSE_STACKSHOT_WAITINFO_SRP 75static const NSString* srp_expected_pid_key = @"srp_expected_pid"; // -> @(pid), this or ..._threadid required for PARSE_STACKSHOT_WAITINFO_SRP 76static const NSString* translated_child_pid_key = @"translated_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSLATED 77static const NSString* sharedcache_child_pid_key = @"sharedcache_child_pid"; // @(pid), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS 78static const NSString* sharedcache_child_sameaddr_key = @"sharedcache_child_sameaddr"; // @(0 or 1), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS 79static const NSString* exec_inprogress_pid_key = @"exec_inprogress_pid"; 80static const NSString* exec_inprogress_found_key = @"exec_inprogress_found"; // callback when inprogress is found 81static const NSString* transitioning_pid_key = @"transitioning_task_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSITIONING 82static const NSString* asyncstack_expected_threadid_key = @"asyncstack_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_ASYNCSTACK 83static const NSString* asyncstack_expected_stack_key = @"asyncstack_expected_stack"; // -> @[pc...]), expected PCs for asyncstack 84static const NSString* driverkit_found_key = @"driverkit_found_key"; // callback when driverkit process is found. argument is the process pid. 85static const NSString* sp_throttled_expected_ctxt_key = @"sp_throttled_expected_ctxt_key"; // -> @(ctxt), required for PARSE_STACKSHOT_THROTTLED_SP 86static const NSString* sp_throttled_expect_flag = @"sp_throttled_expect_flag"; // -> @(is_throttled), required for PARSE_STACKSHOT_THROTTLED_SP 87static const NSString* no_exclaves_key = @"no_exclaves"; 88 89#define TEST_STACKSHOT_QUEUE_LABEL "houston.we.had.a.problem" 90#define TEST_STACKSHOT_QUEUE_LABEL_LENGTH sizeof(TEST_STACKSHOT_QUEUE_LABEL) 91 92#define THROTTLED_SERVICE_NAME "com.apple.xnu.test.stackshot.throttled_service" 93 94T_DECL(microstackshots, "test the microstackshot syscall") 95{ 96 void *buf = NULL; 97 unsigned int size = DEFAULT_STACKSHOT_BUFFER_SIZE; 98 99 while (1) { 100 buf = malloc(size); 101 T_QUIET; T_ASSERT_NOTNULL(buf, "allocated stackshot buffer"); 102 103#pragma clang diagnostic push 104#pragma clang diagnostic ignored "-Wdeprecated-declarations" 105 int len = syscall(SYS_microstackshot, buf, size, 106 (uint32_t) STACKSHOT_GET_MICROSTACKSHOT); 107#pragma clang diagnostic pop 108 if (len == ENOSYS) { 109 T_SKIP("microstackshot syscall failed, likely not compiled with CONFIG_TELEMETRY"); 110 } 111 if (len == -1 && errno == ENOSPC) { 112 /* syscall failed because buffer wasn't large enough, try again */ 113 free(buf); 114 buf = NULL; 115 size *= 2; 116 T_ASSERT_LE(size, (unsigned int)MAX_STACKSHOT_BUFFER_SIZE, 117 "growing stackshot buffer to sane size"); 118 continue; 119 } 120 T_ASSERT_POSIX_SUCCESS(len, "called microstackshot syscall"); 121 break; 122 } 123 124 T_EXPECT_EQ(*(uint32_t *)buf, 125 (uint32_t)STACKSHOT_MICRO_SNAPSHOT_MAGIC, 126 "magic value for microstackshot matches"); 127 128 free(buf); 129} 130 131struct scenario { 132 const char *name; 133 uint64_t flags; 134 bool quiet; 135 bool should_fail; 136 bool maybe_unsupported; 137 bool maybe_enomem; 138 bool no_recordfile; 139 pid_t target_pid; 140 bool target_kernel; 141 uint64_t since_timestamp; 142 uint32_t size_hint; 143 dt_stat_time_t timer; 144}; 145 146static void 147quiet(struct scenario *scenario) 148{ 149 if (scenario->timer || scenario->quiet) { 150 T_QUIET; 151 } 152} 153 154static void 155take_stackshot(struct scenario *scenario, bool compress_ok, void (^cb)(void *buf, size_t size)) 156{ 157start: 158 initialize_thread(); 159 160 void *config = stackshot_config_create(); 161 quiet(scenario); 162 T_ASSERT_NOTNULL(config, "created stackshot config"); 163 164 int ret = stackshot_config_set_flags(config, scenario->flags | global_flags); 165 quiet(scenario); 166 T_ASSERT_POSIX_ZERO(ret, "set flags %#llx on stackshot config", scenario->flags); 167 168 if (scenario->size_hint > 0) { 169 ret = stackshot_config_set_size_hint(config, scenario->size_hint); 170 quiet(scenario); 171 T_ASSERT_POSIX_ZERO(ret, "set size hint %" PRIu32 " on stackshot config", 172 scenario->size_hint); 173 } 174 175 if (scenario->target_pid > 0) { 176 ret = stackshot_config_set_pid(config, scenario->target_pid); 177 quiet(scenario); 178 T_ASSERT_POSIX_ZERO(ret, "set target pid %d on stackshot config", 179 scenario->target_pid); 180 } else if (scenario->target_kernel) { 181 ret = stackshot_config_set_pid(config, 0); 182 quiet(scenario); 183 T_ASSERT_POSIX_ZERO(ret, "set kernel target on stackshot config"); 184 } 185 186 if (scenario->since_timestamp > 0) { 187 ret = stackshot_config_set_delta_timestamp(config, scenario->since_timestamp); 188 quiet(scenario); 189 T_ASSERT_POSIX_ZERO(ret, "set since timestamp %" PRIu64 " on stackshot config", 190 scenario->since_timestamp); 191 } 192 193 int retries_remaining = 5; 194 195retry: ; 196 uint64_t start_time = mach_absolute_time(); 197 ret = stackshot_capture_with_config(config); 198 uint64_t end_time = mach_absolute_time(); 199 200 if (scenario->should_fail) { 201 T_EXPECTFAIL; 202 T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config"); 203 return; 204 } 205 206 if (ret == EBUSY || ret == ETIMEDOUT) { 207 if (retries_remaining > 0) { 208 if (!scenario->timer) { 209 T_LOG("stackshot_capture_with_config failed with %s (%d), retrying", 210 strerror(ret), ret); 211 } 212 213 retries_remaining--; 214 goto retry; 215 } else { 216 T_ASSERT_POSIX_ZERO(ret, 217 "called stackshot_capture_with_config (no retries remaining)"); 218 } 219 } else if ((ret == ENOTSUP) && scenario->maybe_unsupported) { 220 T_SKIP("kernel indicated this stackshot configuration is not supported"); 221 } else if ((ret == ENOMEM) && scenario->maybe_enomem) { 222 T_SKIP("insufficient available memory to run test"); 223 } else { 224 quiet(scenario); 225 T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config"); 226 } 227 228 if (scenario->timer) { 229 dt_stat_mach_time_add(scenario->timer, end_time - start_time); 230 } 231 void *buf = stackshot_config_get_stackshot_buffer(config); 232 size_t size = stackshot_config_get_stackshot_size(config); 233 if (scenario->name && !scenario->no_recordfile) { 234 char sspath[MAXPATHLEN]; 235 strlcpy(sspath, scenario->name, sizeof(sspath)); 236 strlcat(sspath, ".kcdata", sizeof(sspath)); 237 T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(sspath, sizeof(sspath)), 238 "create result file path"); 239 240 if (!scenario->quiet) { 241 T_LOG("writing stackshot to %s", sspath); 242 } 243 244 FILE *f = fopen(sspath, "w"); 245 T_WITH_ERRNO; T_QUIET; T_ASSERT_NOTNULL(f, 246 "open stackshot output file"); 247 248 size_t written = fwrite(buf, size, 1, f); 249 T_QUIET; T_ASSERT_POSIX_SUCCESS(written, "wrote stackshot to file"); 250 251 fclose(f); 252 } 253 cb(buf, size); 254 if (compress_ok) { 255 if (global_flags == 0) { 256 T_LOG("Restarting test with compression"); 257 global_flags |= STACKSHOT_DO_COMPRESS; 258 goto start; 259 } else { 260 global_flags = 0; 261 } 262 } 263 264 ret = stackshot_config_dealloc(config); 265 T_QUIET; T_EXPECT_POSIX_ZERO(ret, "deallocated stackshot config"); 266} 267 268T_DECL(simple_compressed, "take a simple compressed stackshot") 269{ 270 struct scenario scenario = { 271 .name = "kcdata_compressed", 272 .flags = (STACKSHOT_DO_COMPRESS | STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS | 273 STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 274 }; 275 276 T_LOG("taking compressed kcdata stackshot"); 277 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 278 parse_stackshot(0, ssbuf, sslen, nil); 279 }); 280} 281 282T_DECL(panic_compressed, "take a compressed stackshot with the same flags as a panic stackshot") 283{ 284 uint64_t stackshot_flags = (STACKSHOT_SAVE_KEXT_LOADINFO | 285 STACKSHOT_SAVE_LOADINFO | 286 STACKSHOT_KCDATA_FORMAT | 287 STACKSHOT_ENABLE_BT_FAULTING | 288 STACKSHOT_ENABLE_UUID_FAULTING | 289 STACKSHOT_DO_COMPRESS | 290 STACKSHOT_NO_IO_STATS | 291 STACKSHOT_THREAD_WAITINFO | 292#if TARGET_OS_MAC 293 STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT | 294#endif 295 STACKSHOT_DISABLE_LATENCY_INFO); 296 297 struct scenario scenario = { 298 .name = "kcdata_panic_compressed", 299 .flags = stackshot_flags, 300 }; 301 302 T_LOG("taking compressed kcdata stackshot with panic flags"); 303 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 304 parse_stackshot(0, ssbuf, sslen, nil); 305 }); 306} 307 308T_DECL(kcdata, "test that kcdata stackshots can be taken and parsed") 309{ 310 struct scenario scenario = { 311 .name = "kcdata", 312 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS | 313 STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 314 }; 315 316 T_LOG("taking kcdata stackshot"); 317 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 318 parse_stackshot(0, ssbuf, sslen, nil); 319 }); 320} 321 322static void 323get_stats(stackshot_stats_t *_Nonnull out) 324{ 325 size_t oldlen = sizeof (*out); 326 bzero(out, oldlen); 327 int result = sysctlbyname("kern.stackshot_stats", out, &oldlen, NULL, 0); 328 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(result, "reading \"kern.stackshot_stats\" sysctl should succeed"); 329 T_EXPECT_EQ(oldlen, sizeof (*out), "kernel should update full stats structure"); 330} 331 332static void 333log_stats(mach_timebase_info_data_t timebase, uint64_t now, const char *name, stackshot_stats_t stat) 334{ 335 uint64_t last_ago = (now - stat.ss_last_start) * timebase.numer / timebase.denom; 336 uint64_t last_duration = (stat.ss_last_end - stat.ss_last_start) * timebase.numer / timebase.denom; 337 uint64_t total_duration = (stat.ss_duration) * timebase.numer / timebase.denom; 338 339 uint64_t nanosec = 1000000000llu; 340 T_LOG("%s: %8lld stackshots, %10lld.%09lld total nsecs, last %lld.%09lld secs ago, %lld.%09lld secs long", 341 name, stat.ss_count, 342 total_duration / nanosec, total_duration % nanosec, 343 last_ago / nanosec, last_ago % nanosec, 344 last_duration / nanosec, last_duration % nanosec); 345} 346 347T_DECL(stats, "test that stackshot stats can be read out and change when a stackshot occurs") 348{ 349 mach_timebase_info_data_t timebase = {0, 0}; 350 mach_timebase_info(&timebase); 351 352 struct scenario scenario = { 353 .name = "kcdata", 354 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 355 }; 356 357 stackshot_stats_t pre, post; 358 359 get_stats(&pre); 360 361 T_LOG("taking kcdata stackshot"); 362 take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) { 363 (void)0; 364 }); 365 366 get_stats(&post); 367 368 uint64_t now = mach_absolute_time(); 369 370 log_stats(timebase, now, " pre", pre); 371 log_stats(timebase, now, " post", post); 372 373 int64_t delta_stackshots = (int64_t)(post.ss_count - pre.ss_count); 374 int64_t delta_duration = (int64_t)(post.ss_duration - pre.ss_duration) * (int64_t)timebase.numer / (int64_t)timebase.denom; 375 int64_t delta_nsec = delta_duration % 1000000000ll; 376 if (delta_nsec < 0) { 377 delta_nsec += 1000000000ll; 378 } 379 T_LOG("delta: %+8lld stackshots, %+10lld.%09lld total nsecs", delta_stackshots, delta_duration / 1000000000ll, delta_nsec); 380 381 T_EXPECT_LT(pre.ss_last_start, pre.ss_last_end, "pre: stackshot should take time"); 382 T_EXPECT_LT(pre.ss_count, post.ss_count, "stackshot count should increase when a stackshot is taken"); 383 T_EXPECT_LT(pre.ss_duration, post.ss_duration, "stackshot duration should increase when a stackshot is taken"); 384 T_EXPECT_LT(pre.ss_last_end, post.ss_last_start, "previous end should be less than new start after a stackshot"); 385 T_EXPECT_LT(post.ss_last_start, post.ss_last_end, "post: stackshot should take time"); 386} 387 388T_DECL(kcdata_faulting, "test that kcdata stackshots while faulting can be taken and parsed") 389{ 390 struct scenario scenario = { 391 .name = "faulting", 392 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 393 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT 394 | STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING), 395 }; 396 397 T_LOG("taking faulting stackshot"); 398 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 399 parse_stackshot(0, ssbuf, sslen, nil); 400 }); 401} 402 403T_DECL(bad_flags, "test a poorly-formed stackshot syscall") 404{ 405 struct scenario scenario = { 406 .flags = STACKSHOT_SAVE_IN_KERNEL_BUFFER /* not allowed from user space */, 407 .should_fail = true, 408 }; 409 410 T_LOG("attempting to take stackshot with kernel-only flag"); 411 take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) { 412 T_ASSERT_FAIL("stackshot data callback called"); 413 }); 414} 415 416T_DECL(delta, "test delta stackshots") 417{ 418 struct scenario scenario = { 419 .name = "delta", 420 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 421 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 422 }; 423 424 T_LOG("taking full stackshot"); 425 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 426 uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen); 427 428 T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time); 429 430 parse_stackshot(0, ssbuf, sslen, nil); 431 432 struct scenario delta_scenario = { 433 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 434 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT 435 | STACKSHOT_COLLECT_DELTA_SNAPSHOT), 436 .since_timestamp = stackshot_time 437 }; 438 439 take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) { 440 parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil); 441 }); 442 }); 443} 444 445T_DECL(shared_cache_layout, "test stackshot inclusion of shared cache layout") 446{ 447 struct scenario scenario = { 448 .name = "shared_cache_layout", 449 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 450 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT | 451 STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT), 452 }; 453 454 size_t shared_cache_length; 455 const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length); 456 if (cache_header == NULL) { 457 T_SKIP("Device not running with shared cache, skipping test..."); 458 } 459 460 if (shared_cache_length == 0) { 461 T_SKIP("dyld reports that currently running shared cache has zero length"); 462 } 463 464 T_LOG("taking stackshot with STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT set"); 465 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 466 parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_LAYOUT, ssbuf, sslen, nil); 467 }); 468} 469 470T_DECL(stress, "test that taking stackshots for 60 seconds doesn't crash the system") 471{ 472 uint64_t max_diff_time = 60ULL /* seconds */ * 1000000000ULL; 473 uint64_t start_time; 474 475 struct scenario scenario = { 476 .name = "stress", 477 .quiet = true, 478 .flags = (STACKSHOT_KCDATA_FORMAT | 479 STACKSHOT_THREAD_WAITINFO | 480 STACKSHOT_SAVE_LOADINFO | 481 STACKSHOT_SAVE_KEXT_LOADINFO | 482 STACKSHOT_GET_GLOBAL_MEM_STATS | 483 STACKSHOT_SAVE_IMP_DONATION_PIDS | 484 STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT | 485 STACKSHOT_THREAD_GROUP | 486 STACKSHOT_SAVE_JETSAM_COALITIONS | 487 STACKSHOT_ASID | 488 STACKSHOT_EXCLAVES | 489 0), 490 }; 491 492 start_time = clock_gettime_nsec_np(CLOCK_MONOTONIC); 493 while (clock_gettime_nsec_np(CLOCK_MONOTONIC) - start_time < max_diff_time) { 494 take_stackshot(&scenario, false, ^(void * __unused ssbuf, 495 size_t __unused sslen) { 496 printf("."); 497 fflush(stdout); 498 }); 499 500 /* 501 * After the first stackshot, there's no point in continuing to 502 * write them to disk, and it wears down the SSDs. 503 */ 504 scenario.no_recordfile = true; 505 506 /* Leave some time for the testing infrastructure to catch up */ 507 usleep(10000); 508 509 } 510 printf("\n"); 511} 512 513T_DECL(dispatch_queue_label, "test that kcdata stackshots contain libdispatch queue labels") 514{ 515 struct scenario scenario = { 516 .name = "kcdata", 517 .flags = (STACKSHOT_GET_DQ | STACKSHOT_KCDATA_FORMAT), 518 }; 519 dispatch_semaphore_t child_ready_sem, parent_done_sem; 520 dispatch_queue_t dq; 521 522#if TARGET_OS_WATCH 523 T_SKIP("This test is flaky on watches: 51663346"); 524#endif 525 526 child_ready_sem = dispatch_semaphore_create(0); 527 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "dqlabel child semaphore"); 528 529 parent_done_sem = dispatch_semaphore_create(0); 530 T_QUIET; T_ASSERT_NOTNULL(parent_done_sem, "dqlabel parent semaphore"); 531 532 dq = dispatch_queue_create(TEST_STACKSHOT_QUEUE_LABEL, NULL); 533 T_QUIET; T_ASSERT_NOTNULL(dq, "dispatch queue"); 534 535 /* start the helper thread */ 536 dispatch_async(dq, ^{ 537 dispatch_semaphore_signal(child_ready_sem); 538 539 dispatch_semaphore_wait(parent_done_sem, DISPATCH_TIME_FOREVER); 540 }); 541 542 /* block behind the child starting up */ 543 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 544 545 T_LOG("taking kcdata stackshot with libdispatch queue labels"); 546 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 547 parse_stackshot(PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL, ssbuf, sslen, nil); 548 }); 549 550 dispatch_semaphore_signal(parent_done_sem); 551} 552 553#define CACHEADDR_ENV "STACKSHOT_TEST_DYLDADDR" 554T_HELPER_DECL(spawn_reslide_child, "child process to spawn with alternate slide") 555{ 556 size_t shared_cache_len; 557 const void *addr, *prevaddr; 558 uintmax_t v; 559 char *endptr; 560 561 const char *cacheaddr_env = getenv(CACHEADDR_ENV); 562 T_QUIET; T_ASSERT_NOTNULL(cacheaddr_env, "getenv("CACHEADDR_ENV")"); 563 errno = 0; 564 endptr = NULL; 565 v = strtoumax(cacheaddr_env, &endptr, 16); /* read hex value */ 566 T_WITH_ERRNO; T_QUIET; T_ASSERT_NE(v, 0l, "getenv(%s) = \"%s\" should be a non-zero hex number", CACHEADDR_ENV, cacheaddr_env); 567 T_QUIET; T_ASSERT_EQ(*endptr, 0, "getenv(%s) = \"%s\" endptr \"%s\" should be empty", CACHEADDR_ENV, cacheaddr_env, endptr); 568 569 prevaddr = (const void *)v; 570 addr = _dyld_get_shared_cache_range(&shared_cache_len); 571 T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address"); 572 573 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(getppid(), (addr == prevaddr) ? SIGUSR2 : SIGUSR1), "signaled parent to take stackshot"); 574 for (;;) { 575 (void) pause(); /* parent will kill -9 us */ 576 } 577} 578 579T_DECL(shared_cache_flags, "tests stackshot's task_ss_flags for the shared cache") 580{ 581 posix_spawnattr_t attr; 582 char *env_addr; 583 char path[PATH_MAX]; 584 __block bool child_same_addr = false; 585 586 uint32_t path_size = sizeof(path); 587 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 588 char *args[] = { path, "-n", "spawn_reslide_child", NULL }; 589 pid_t pid; 590 size_t shared_cache_len; 591 const void *addr; 592 593 dispatch_source_t child_diffsig_src, child_samesig_src; 594 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 595 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "shared_cache child semaphore"); 596 597 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 598 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 599 600 signal(SIGUSR1, SIG_IGN); 601 signal(SIGUSR2, SIG_IGN); 602 child_samesig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 603 T_QUIET; T_ASSERT_NOTNULL(child_samesig_src, "dispatch_source_create (child_samesig_src)"); 604 child_diffsig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR2, 0, signal_processing_q); 605 T_QUIET; T_ASSERT_NOTNULL(child_diffsig_src, "dispatch_source_create (child_diffsig_src)"); 606 607 /* child will signal us depending on if their addr is the same or different */ 608 dispatch_source_set_event_handler(child_samesig_src, ^{ child_same_addr = false; dispatch_semaphore_signal(child_ready_sem); }); 609 dispatch_source_set_event_handler(child_diffsig_src, ^{ child_same_addr = true; dispatch_semaphore_signal(child_ready_sem); }); 610 dispatch_activate(child_samesig_src); 611 dispatch_activate(child_diffsig_src); 612 613 addr = _dyld_get_shared_cache_range(&shared_cache_len); 614 T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address"); 615 616 T_QUIET; T_ASSERT_POSIX_SUCCESS(asprintf(&env_addr, "%p", addr), "asprintf of env_addr succeeded"); 617 T_QUIET; T_ASSERT_POSIX_SUCCESS(setenv(CACHEADDR_ENV, env_addr, true), "setting "CACHEADDR_ENV" to %s", env_addr); 618 619 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&attr), "posix_spawnattr_init"); 620 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_setflags(&attr, _POSIX_SPAWN_RESLIDE), "posix_spawnattr_setflags"); 621 int sp_ret = posix_spawn(&pid, path, NULL, &attr, args, environ); 622 T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 623 624 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 625 T_LOG("received signal from child (%s), capturing stackshot", child_same_addr ? "same shared cache addr" : "different shared cache addr"); 626 627 struct scenario scenario = { 628 .name = "shared_cache_flags", 629 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 630 | STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT 631 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 632 }; 633 634 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 635 int status; 636 /* First kill the child so we can reap it */ 637 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing spawned process"); 638 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on spawned child"); 639 T_QUIET; T_ASSERT_EQ(!!WIFSIGNALED(status), 1, "waitpid status should be signalled"); 640 T_QUIET; T_ASSERT_EQ(WTERMSIG(status), SIGKILL, "waitpid status should be SIGKILLed"); 641 642 parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_FLAGS, ssbuf, sslen, 643 @{sharedcache_child_pid_key: @(pid), sharedcache_child_sameaddr_key: @(child_same_addr ? 1 : 0)}); 644 }); 645} 646 647T_DECL(transitioning_tasks, "test that stackshot contains transitioning task info", T_META_BOOTARGS_SET("enable_proc_exit_lpexit_spin=1")) 648{ 649 int32_t sysctlValue = -1, numAttempts =0; 650 char path[PATH_MAX]; 651 uint32_t path_size = sizeof(path); 652 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 653 char *args[] = { path, "-n", "exec_child_preexec", NULL }; 654 655 dispatch_source_t child_sig_src; 656 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 657 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore"); 658 659 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 660 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 661 662 pid_t pid; 663 664 signal(SIGUSR1, SIG_IGN); 665 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 666 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 667 668 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 669 dispatch_activate(child_sig_src); 670 671 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), "set debug.proc_exit_lpexit_spin_pid=-1"); 672 673 int proc_exit_spin_pos = 0 ; 674 675 while (0 == sysctlbyname("debug.proc_exit_lpexit_spin_pos", NULL, NULL, &proc_exit_spin_pos, sizeof(proc_exit_spin_pos))) { 676 677 T_LOG(" ##### Testing while spinning in proc_exit at position %d ##### ", proc_exit_spin_pos); 678 679 int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL); 680 T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 681 682 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 683 684 struct proc_uniqidentifierinfo proc_info_data = { }; 685 int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data)); 686 T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO"); 687 T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data"); 688 689 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec"); 690 691 /* wait for a signal from post-exec child */ 692 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 693 694 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &pid, sizeof(pid)), "set debug.proc_exit_lpexit_spin_pid = %d, ", pid); 695 696 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid); 697 698 sysctlValue = 0; 699 size_t len = sizeof(sysctlValue); 700 while (numAttempts < 5) { 701 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValue, &len, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning"); 702 if (sysctlValue != 1) numAttempts++; 703 else break; 704 sleep(1); 705 } 706 707 T_ASSERT_EQ_UINT(sysctlValue, 1, "find spinning task in proc_exit()"); 708 709 struct scenario scenario = { 710 .name = "transitioning_tasks", 711 .flags = (STACKSHOT_KCDATA_FORMAT) 712 }; 713 714 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 715 parse_stackshot(PARSE_STACKSHOT_TRANSITIONING, ssbuf, sslen, @{transitioning_pid_key: @(pid)}); 716 717 // Kill the child 718 int sysctlValueB = -1; 719 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValueB, sizeof(sysctlValueB)), "set debug.proc_exit_lpexit_spin_pid=-1"); 720 sleep(1); 721 size_t blen = sizeof(sysctlValueB); 722 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValueB, &blen, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning"); 723 T_ASSERT_EQ_UINT(sysctlValueB, 0, "make sure nothing is spining in proc_exit()"); 724 int status; 725 T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child"); 726 }); 727 728 proc_exit_spin_pos++; 729 } 730 731} 732 733static void *stuck_sysctl_thread(void *arg) { 734 int val = 1; 735 dispatch_semaphore_t child_thread_started = *(dispatch_semaphore_t *)arg; 736 737 dispatch_semaphore_signal(child_thread_started); 738 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread"); 739 740 return NULL; 741} 742 743T_HELPER_DECL(zombie_child, "child process to sample as a zombie") 744{ 745 pthread_t pthread; 746 dispatch_semaphore_t child_thread_started = dispatch_semaphore_create(0); 747 T_QUIET; T_ASSERT_NOTNULL(child_thread_started, "zombie child thread semaphore"); 748 749 /* spawn another thread to get stuck in the kernel, then call exit() to become a zombie */ 750 T_QUIET; T_ASSERT_POSIX_SUCCESS(pthread_create(&pthread, NULL, stuck_sysctl_thread, &child_thread_started), "pthread_create"); 751 752 dispatch_semaphore_wait(child_thread_started, DISPATCH_TIME_FOREVER); 753 754 /* sleep for a bit in the hope of ensuring that the other thread has called the sysctl before we signal the parent */ 755 usleep(100); 756 T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot"); 757 758 exit(0); 759} 760 761T_DECL(zombie, "tests a stackshot of a zombie task with a thread stuck in the kernel") 762{ 763 char path[PATH_MAX]; 764 uint32_t path_size = sizeof(path); 765 T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 766 char *args[] = { path, "-n", "zombie_child", NULL }; 767 768 dispatch_source_t child_sig_src; 769 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 770 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "zombie child semaphore"); 771 772 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 773 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 774 775 pid_t pid; 776 777 T_LOG("spawning a child"); 778 779 signal(SIGUSR1, SIG_IGN); 780 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 781 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 782 783 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 784 dispatch_activate(child_sig_src); 785 786 int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL); 787 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 788 789 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 790 791 T_LOG("received signal from child, capturing stackshot"); 792 793 struct proc_bsdshortinfo bsdshortinfo; 794 int retval, iterations_to_wait = 10; 795 796 while (iterations_to_wait > 0) { 797 retval = proc_pidinfo(pid, PROC_PIDT_SHORTBSDINFO, 0, &bsdshortinfo, sizeof(bsdshortinfo)); 798 if ((retval == 0) && errno == ESRCH) { 799 T_LOG("unable to find child using proc_pidinfo, assuming zombie"); 800 break; 801 } 802 803 T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDT_SHORTBSDINFO) returned a value > 0"); 804 T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(bsdshortinfo), "proc_pidinfo call for PROC_PIDT_SHORTBSDINFO returned expected size"); 805 806 if (bsdshortinfo.pbsi_flags & PROC_FLAG_INEXIT) { 807 T_LOG("child proc info marked as in exit"); 808 break; 809 } 810 811 iterations_to_wait--; 812 if (iterations_to_wait == 0) { 813 /* 814 * This will mark the test as failed but let it continue so we 815 * don't leave a process stuck in the kernel. 816 */ 817 T_FAIL("unable to discover that child is marked as exiting"); 818 } 819 820 /* Give the child a few more seconds to make it to exit */ 821 sleep(5); 822 } 823 824 /* Give the child some more time to make it through exit */ 825 sleep(10); 826 827 struct scenario scenario = { 828 .name = "zombie", 829 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 830 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 831 }; 832 833 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 834 /* First unwedge the child so we can reap it */ 835 int val = 1, status; 836 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child"); 837 838 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on zombie child"); 839 840 parse_stackshot(PARSE_STACKSHOT_ZOMBIE, ssbuf, sslen, @{zombie_child_pid_key: @(pid)}); 841 }); 842} 843 844T_HELPER_DECL(exec_child_preexec, "child process pre-exec") 845{ 846 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 847 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 848 849 signal(SIGUSR1, SIG_IGN); 850 dispatch_source_t parent_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 851 T_QUIET; T_ASSERT_NOTNULL(parent_sig_src, "dispatch_source_create (child_sig_src)"); 852 dispatch_source_set_event_handler(parent_sig_src, ^{ 853 854 // Parent took a timestamp then signaled us: exec into the next process 855 856 char path[PATH_MAX]; 857 uint32_t path_size = sizeof(path); 858 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 859 char *args[] = { path, "-n", "exec_child_postexec", NULL }; 860 861 T_QUIET; T_ASSERT_POSIX_ZERO(execve(args[0], args, NULL), "execing into exec_child_postexec"); 862 }); 863 dispatch_activate(parent_sig_src); 864 865 T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take timestamp"); 866 867 sleep(100); 868 // Should never get here 869 T_FAIL("Received signal to exec from parent"); 870} 871 872T_HELPER_DECL(exec_child_postexec, "child process post-exec to sample") 873{ 874 T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot"); 875 sleep(100); 876 // Should never get here 877 T_FAIL("Killed by parent"); 878} 879 880T_DECL(exec, "test getting full task snapshots for a task that execs") 881{ 882 char path[PATH_MAX]; 883 uint32_t path_size = sizeof(path); 884 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 885 char *args[] = { path, "-n", "exec_child_preexec", NULL }; 886 887 dispatch_source_t child_sig_src; 888 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 889 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore"); 890 891 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 892 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 893 894 pid_t pid; 895 896 T_LOG("spawning a child"); 897 898 signal(SIGUSR1, SIG_IGN); 899 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 900 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 901 902 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 903 dispatch_activate(child_sig_src); 904 905 int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL); 906 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 907 908 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 909 uint64_t start_time = mach_absolute_time(); 910 911 struct proc_uniqidentifierinfo proc_info_data = { }; 912 int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data)); 913 T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO"); 914 T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data"); 915 uint64_t unique_pid = proc_info_data.p_uniqueid; 916 917 T_LOG("received signal from pre-exec child, unique_pid is %llu, timestamp is %llu", unique_pid, start_time); 918 919 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec"); 920 921 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 922 923 T_LOG("received signal from post-exec child, capturing stackshot"); 924 925 struct scenario scenario = { 926 .name = "exec", 927 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 928 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT 929 | STACKSHOT_COLLECT_DELTA_SNAPSHOT), 930 .since_timestamp = start_time 931 }; 932 933 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 934 // Kill the child 935 int status; 936 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid); 937 T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child"); 938 939 parse_stackshot(PARSE_STACKSHOT_POSTEXEC | PARSE_STACKSHOT_DELTA, ssbuf, sslen, @{postexec_child_unique_pid_key: @(unique_pid)}); 940 }); 941} 942 943T_DECL( 944 exec_inprogress, 945 "test stackshots of processes in the middle of exec", 946 T_META_ENABLED(false) /* rdar://111691318 */) 947{ 948 pid_t pid; 949 /* a BASH quine which execs itself as long as the parent doesn't exit */ 950 char *bash_prog = "[[ $PPID -ne 1 ]] && exec /bin/bash -c \"$0\" \"$0\""; 951 char *args[] = { "/bin/bash", "-c", bash_prog, bash_prog, NULL }; 952 953 posix_spawnattr_t sattr; 954 T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&sattr), "posix_spawnattr_init"); 955 T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, &sattr, args, NULL), "spawn exec_inprogress_child"); 956 957 struct scenario scenario = { 958 .name = "exec_inprogress", 959 .flags = (STACKSHOT_KCDATA_FORMAT), 960 .target_pid = pid, 961 }; 962 963 int tries = 0; 964 int tries_limit = 30; 965 __block bool found = false; 966 __block uint64_t cid1 = 0, cid2 = 0; 967 968 for (tries = 0; !found && tries < tries_limit; tries++) { 969 take_stackshot(&scenario, false, 970 ^( void *ssbuf, size_t sslen) { 971 parse_stackshot(PARSE_STACKSHOT_EXEC_INPROGRESS, 972 ssbuf, sslen, @{ 973 exec_inprogress_pid_key: @(pid), 974 exec_inprogress_found_key: ^(uint64_t id1, uint64_t id2) { found = true; cid1 = id1; cid2 = id2; }}); 975 }); 976 } 977 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing exec loop"); 978 T_ASSERT_TRUE(found, "able to find our execing process mid-exec in %d tries", tries); 979 T_ASSERT_NE(cid1, cid2, "container IDs for in-progress exec are unique"); 980 T_PASS("found mid-exec process in %d tries", tries); 981} 982 983#ifdef _LP64 984#if __has_feature(ptrauth_calls) 985#define __ptrauth_swift_async_context_parent \ 986 __ptrauth(ptrauth_key_process_independent_data, 1, 0xbda2) 987#define __ptrauth_swift_async_context_resume \ 988 __ptrauth(ptrauth_key_function_pointer, 1, 0xd707) 989#else 990#define __ptrauth_swift_async_context_parent 991#define __ptrauth_swift_async_context_resume 992#endif 993// Add 1 to match the symbolication aid added by the stackshot backtracer. 994#define asyncstack_frame(x) ((uintptr_t)(void *)ptrauth_strip((void *)(x), ptrauth_key_function_pointer) + 1) 995 996// This struct fakes the Swift AsyncContext struct which is used by 997// the Swift concurrency runtime. We only care about the first 2 fields. 998struct fake_async_context { 999 struct fake_async_context* __ptrauth_swift_async_context_parent next; 1000 void(*__ptrauth_swift_async_context_resume resume_pc)(void); 1001}; 1002 1003static void 1004level1_func() 1005{ 1006} 1007static void 1008level2_func() 1009{ 1010} 1011 1012// Create a chain of fake async contexts; sync with asyncstack_expected_stack below 1013static alignas(16) struct fake_async_context level1 = { 0, level1_func }; 1014static alignas(16) struct fake_async_context level2 = { &level1, level2_func }; 1015 1016struct async_test_semaphores { 1017 dispatch_semaphore_t child_ready_sem; /* signal parent we're ready */ 1018 dispatch_semaphore_t child_exit_sem; /* parent tells us to go away */ 1019}; 1020 1021#define ASYNCSTACK_THREAD_NAME "asyncstack_thread" 1022 1023static void __attribute__((noinline, not_tail_called)) 1024expect_asyncstack(void *arg) 1025{ 1026 struct async_test_semaphores *async_ts = arg; 1027 1028 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_setname_np(ASYNCSTACK_THREAD_NAME), 1029 "set thread name to %s", ASYNCSTACK_THREAD_NAME); 1030 1031 /* Tell the main thread we're all set up, then wait for permission to exit */ 1032 dispatch_semaphore_signal(async_ts->child_ready_sem); 1033 dispatch_semaphore_wait(async_ts->child_exit_sem, DISPATCH_TIME_FOREVER); 1034 usleep(1); /* make sure we don't tailcall semaphore_wait */ 1035} 1036 1037static void * 1038asyncstack_thread(void *arg) 1039{ 1040 uint64_t *fp = __builtin_frame_address(0); 1041 // We cannot use a variable of pointer type, because this ABI is valid 1042 // on arm64_32 where pointers are 32bits, but the context pointer will 1043 // still be stored in a 64bits slot on the stack. 1044#if __has_feature(ptrauth_calls) 1045#define __stack_context_auth __ptrauth(ptrauth_key_process_dependent_data, 1, \ 1046 0xc31a) 1047 struct fake_async_context * __stack_context_auth ctx = &level2; 1048#else // __has_feature(ptrauth_calls) 1049 /* struct fake_async_context * */uint64_t ctx = (uintptr_t)&level2; 1050#endif // !__has_feature(ptrauth_calls) 1051 1052 // The signature of an async frame on the OS stack is: 1053 // [ <AsyncContext address>, <Saved FP | (1<<60)>, <return address> ] 1054 // The Async context must be right before the saved FP on the stack. This 1055 // should happen naturally in an optimized build as it is the only 1056 // variable on the stack. 1057 // This function cannot use T_ASSERT_* becuse it changes the stack 1058 // layout. 1059 assert((uintptr_t)fp - (uintptr_t)&ctx == 8); 1060 1061 // Modify the saved FP on the stack to include the async frame marker 1062 *fp |= (0x1ULL << 60); 1063 expect_asyncstack(arg); 1064 return NULL; 1065} 1066 1067T_DECL(asyncstack, "test swift async stack entries") 1068{ 1069 struct scenario scenario = { 1070 .name = "asyncstack", 1071 .flags = STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO, 1072 }; 1073 struct async_test_semaphores async_ts = { 1074 .child_ready_sem = dispatch_semaphore_create(0), 1075 .child_exit_sem = dispatch_semaphore_create(0), 1076 }; 1077 T_QUIET; T_ASSERT_NOTNULL(async_ts.child_ready_sem, "child_ready_sem alloc"); 1078 T_QUIET; T_ASSERT_NOTNULL(async_ts.child_exit_sem, "child_exit_sem alloc"); 1079 1080 pthread_t pthread; 1081 __block uint64_t threadid = 0; 1082 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_create(&pthread, NULL, asyncstack_thread, &async_ts), "pthread_create"); 1083 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_threadid_np(pthread, &threadid), "pthread_threadid_np"); 1084 1085 dispatch_semaphore_wait(async_ts.child_ready_sem, DISPATCH_TIME_FOREVER); 1086 1087 take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) { 1088 parse_stackshot(PARSE_STACKSHOT_ASYNCSTACK, ssbuf, sslen, @{ 1089 asyncstack_expected_threadid_key: @(threadid), 1090 asyncstack_expected_stack_key: @[ @(asyncstack_frame(level2_func)), @(asyncstack_frame(level1_func)) ], 1091 }); 1092 }); 1093 1094 dispatch_semaphore_signal(async_ts.child_exit_sem); 1095 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_join(pthread, NULL), "wait for thread"); 1096 1097} 1098#endif /* #ifdef _LP64 */ 1099 1100static uint32_t 1101get_user_promotion_basepri(void) 1102{ 1103 mach_msg_type_number_t count = THREAD_POLICY_STATE_COUNT; 1104 struct thread_policy_state thread_policy; 1105 boolean_t get_default = FALSE; 1106 mach_port_t thread_port = pthread_mach_thread_np(pthread_self()); 1107 1108 kern_return_t kr = thread_policy_get(thread_port, THREAD_POLICY_STATE, 1109 (thread_policy_t)&thread_policy, &count, &get_default); 1110 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_policy_get"); 1111 return thread_policy.thps_user_promotion_basepri; 1112} 1113 1114static int 1115get_pri(thread_t thread_port) 1116{ 1117 kern_return_t kr; 1118 1119 thread_extended_info_data_t extended_info; 1120 mach_msg_type_number_t count = THREAD_EXTENDED_INFO_COUNT; 1121 kr = thread_info(thread_port, THREAD_EXTENDED_INFO, 1122 (thread_info_t)&extended_info, &count); 1123 1124 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_info"); 1125 1126 return extended_info.pth_curpri; 1127} 1128 1129 1130T_DECL(turnstile_singlehop, "turnstile single hop test") 1131{ 1132 dispatch_queue_t dq1, dq2; 1133 dispatch_semaphore_t sema_x; 1134 dispatch_queue_attr_t dq1_attr, dq2_attr; 1135 __block qos_class_t main_qos = 0; 1136 __block int main_relpri = 0, main_relpri2 = 0, main_afterpri = 0; 1137 struct scenario scenario = { 1138 .name = "turnstile_singlehop", 1139 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 1140 }; 1141 dq1_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_UTILITY, 0); 1142 dq2_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_USER_INITIATED, 0); 1143 pthread_mutex_t lock_a = PTHREAD_MUTEX_INITIALIZER; 1144 pthread_mutex_t lock_b = PTHREAD_MUTEX_INITIALIZER; 1145 1146 pthread_mutex_t *lockap = &lock_a, *lockbp = &lock_b; 1147 1148 dq1 = dispatch_queue_create("q1", dq1_attr); 1149 dq2 = dispatch_queue_create("q2", dq2_attr); 1150 sema_x = dispatch_semaphore_create(0); 1151 1152 pthread_mutex_lock(lockap); 1153 dispatch_async(dq1, ^{ 1154 pthread_mutex_lock(lockbp); 1155 T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class"); 1156 T_LOG("The priority of q1 is %d\n", get_pri(mach_thread_self())); 1157 dispatch_semaphore_signal(sema_x); 1158 pthread_mutex_lock(lockap); 1159 }); 1160 dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER); 1161 1162 T_LOG("Async1 completed"); 1163 1164 pthread_set_qos_class_self_np(QOS_CLASS_UTILITY, 0); 1165 T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class"); 1166 T_LOG("The priority of main is %d\n", get_pri(mach_thread_self())); 1167 main_relpri = get_pri(mach_thread_self()); 1168 1169 dispatch_async(dq2, ^{ 1170 T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri2), "get qos class"); 1171 T_LOG("The priority of q2 is %d\n", get_pri(mach_thread_self())); 1172 dispatch_semaphore_signal(sema_x); 1173 pthread_mutex_lock(lockbp); 1174 }); 1175 dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER); 1176 1177 T_LOG("Async2 completed"); 1178 1179 while (1) { 1180 main_afterpri = (int) get_user_promotion_basepri(); 1181 if (main_relpri != main_afterpri) { 1182 T_LOG("Success with promotion pri is %d", main_afterpri); 1183 break; 1184 } 1185 1186 usleep(100); 1187 } 1188 1189 take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) { 1190 parse_stackshot(PARSE_STACKSHOT_TURNSTILEINFO, ssbuf, sslen, nil); 1191 }); 1192} 1193 1194 1195static void 1196expect_instrs_cycles_in_stackshot(void *ssbuf, size_t sslen) 1197{ 1198 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 1199 1200 bool in_task = false; 1201 bool in_thread = false; 1202 bool saw_instrs_cycles = false; 1203 iter = kcdata_iter_next(iter); 1204 1205 KCDATA_ITER_FOREACH(iter) { 1206 switch (kcdata_iter_type(iter)) { 1207 case KCDATA_TYPE_CONTAINER_BEGIN: 1208 switch (kcdata_iter_container_type(iter)) { 1209 case STACKSHOT_KCCONTAINER_TASK: 1210 in_task = true; 1211 saw_instrs_cycles = false; 1212 break; 1213 1214 case STACKSHOT_KCCONTAINER_THREAD: 1215 in_thread = true; 1216 saw_instrs_cycles = false; 1217 break; 1218 1219 default: 1220 break; 1221 } 1222 break; 1223 1224 case STACKSHOT_KCTYPE_INSTRS_CYCLES: 1225 saw_instrs_cycles = true; 1226 break; 1227 1228 case KCDATA_TYPE_CONTAINER_END: 1229 if (in_thread) { 1230 T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles, 1231 "saw instructions and cycles in thread"); 1232 in_thread = false; 1233 } else if (in_task) { 1234 T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles, 1235 "saw instructions and cycles in task"); 1236 in_task = false; 1237 } 1238 1239 default: 1240 break; 1241 } 1242 } 1243} 1244 1245static void 1246skip_if_monotonic_unsupported(void) 1247{ 1248 int supported = 0; 1249 size_t supported_size = sizeof(supported); 1250 int ret = sysctlbyname("kern.monotonic.supported", &supported, 1251 &supported_size, 0, 0); 1252 if (ret < 0 || !supported) { 1253 T_SKIP("monotonic is unsupported"); 1254 } 1255} 1256 1257T_DECL(instrs_cycles, "test a getting instructions and cycles in stackshot") 1258{ 1259 skip_if_monotonic_unsupported(); 1260 1261 struct scenario scenario = { 1262 .name = "instrs-cycles", 1263 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES 1264 | STACKSHOT_KCDATA_FORMAT), 1265 }; 1266 1267 T_LOG("attempting to take stackshot with instructions and cycles"); 1268 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1269 parse_stackshot(0, ssbuf, sslen, nil); 1270 expect_instrs_cycles_in_stackshot(ssbuf, sslen); 1271 }); 1272} 1273 1274T_DECL(delta_instrs_cycles, 1275 "test delta stackshots with instructions and cycles") 1276{ 1277 skip_if_monotonic_unsupported(); 1278 1279 struct scenario scenario = { 1280 .name = "delta-instrs-cycles", 1281 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES 1282 | STACKSHOT_KCDATA_FORMAT), 1283 }; 1284 1285 T_LOG("taking full stackshot"); 1286 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1287 uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen); 1288 1289 T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time); 1290 1291 parse_stackshot(0, ssbuf, sslen, nil); 1292 expect_instrs_cycles_in_stackshot(ssbuf, sslen); 1293 1294 struct scenario delta_scenario = { 1295 .name = "delta-instrs-cycles-next", 1296 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES 1297 | STACKSHOT_KCDATA_FORMAT 1298 | STACKSHOT_COLLECT_DELTA_SNAPSHOT), 1299 .since_timestamp = stackshot_time, 1300 }; 1301 1302 take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) { 1303 parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil); 1304 expect_instrs_cycles_in_stackshot(dssbuf, dsslen); 1305 }); 1306 }); 1307} 1308 1309static void 1310check_thread_groups_supported() 1311{ 1312 int err; 1313 int supported = 0; 1314 size_t supported_size = sizeof(supported); 1315 err = sysctlbyname("kern.thread_groups_supported", &supported, &supported_size, NULL, 0); 1316 1317 if (err || !supported) 1318 T_SKIP("thread groups not supported on this system"); 1319} 1320 1321T_DECL(thread_groups, "test getting thread groups in stackshot") 1322{ 1323 check_thread_groups_supported(); 1324 1325 struct scenario scenario = { 1326 .name = "thread-groups", 1327 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_GROUP 1328 | STACKSHOT_KCDATA_FORMAT), 1329 }; 1330 1331 T_LOG("attempting to take stackshot with thread group flag"); 1332 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1333 parse_thread_group_stackshot(ssbuf, sslen); 1334 }); 1335} 1336 1337T_DECL(compactinfo, "test compactinfo inclusion") 1338{ 1339 struct scenario scenario = { 1340 .name = "compactinfo", 1341 .target_pid = getpid(), 1342 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_SAVE_DYLD_COMPACTINFO 1343 | STACKSHOT_KCDATA_FORMAT), 1344 }; 1345 1346 T_LOG("attempting to take stackshot with compactinfo flag"); 1347 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1348 parse_stackshot(PARSE_STACKSHOT_COMPACTINFO, ssbuf, sslen, nil); 1349 }); 1350} 1351 1352T_DECL(suspendinfo, "test task suspend info inclusion") 1353{ 1354 struct scenario scenario = { 1355 .name = "suspendinfo", 1356 .target_pid = getpid(), 1357 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 1358 }; 1359 1360 T_LOG("attempting to take stackshot with suspendinfo flag"); 1361 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1362 parse_stackshot(PARSE_STACKSHOT_SUSPENDINFO, ssbuf, sslen, nil); 1363 }); 1364} 1365 1366static NSMutableSet * find_driverkit_pids(io_registry_entry_t root) { 1367 NSMutableSet * driverkit_pids = [NSMutableSet setWithCapacity:3]; 1368 io_registry_entry_t current = IO_OBJECT_NULL; 1369 io_iterator_t iter = IO_OBJECT_NULL; 1370 1371 T_EXPECT_MACH_SUCCESS(IORegistryEntryGetChildIterator(root, kIOServicePlane, &iter), "get registry iterator"); 1372 1373 while ((current = IOIteratorNext(iter)) != IO_OBJECT_NULL) { 1374 if (_IOObjectConformsTo(current, "IOUserServer", kIOClassNameOverrideNone)) { 1375 CFMutableDictionaryRef cfProperties = NULL; 1376 NSMutableDictionary * properties; 1377 NSString * client_creator_info; 1378 NSArray<NSString *> *creator_info_array; 1379 pid_t pid; 1380 1381 T_QUIET; T_EXPECT_MACH_SUCCESS(IORegistryEntryCreateCFProperties(current, &cfProperties, kCFAllocatorDefault, kNilOptions), "get properties"); 1382 properties = CFBridgingRelease(cfProperties); 1383 T_QUIET; T_ASSERT_NOTNULL(properties, "properties is not null"); 1384 client_creator_info = properties[@kIOUserClientCreatorKey]; 1385 creator_info_array = [client_creator_info componentsSeparatedByString:@","]; 1386 if ([creator_info_array[0] hasPrefix:@"pid"]) { 1387 NSArray<NSString *> *pid_info = [creator_info_array[0] componentsSeparatedByString:@" "]; 1388 T_QUIET; T_ASSERT_EQ(pid_info.count, 2UL, "Get pid info components from %s", creator_info_array[0].UTF8String); 1389 pid = pid_info[1].intValue; 1390 } else { 1391 T_ASSERT_FAIL("No pid info in client creator info: %s", client_creator_info.UTF8String); 1392 } 1393 T_LOG("Found driver pid %d", pid); 1394 [driverkit_pids addObject:[NSNumber numberWithInt:pid]]; 1395 } else { 1396 [driverkit_pids unionSet:find_driverkit_pids(current)]; 1397 } 1398 IOObjectRelease(current); 1399 } 1400 1401 IOObjectRelease(iter); 1402 return driverkit_pids; 1403} 1404 1405T_DECL(driverkit, "test driverkit inclusion") 1406{ 1407 struct scenario scenario = { 1408 .name = "driverkit", 1409 .target_kernel = true, 1410 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT 1411 | STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL), 1412 }; 1413 1414 io_registry_entry_t root = IORegistryGetRootEntry(kIOMainPortDefault); 1415 NSMutableSet * driverkit_pids = find_driverkit_pids(root); 1416 IOObjectRelease(root); 1417 1418 T_LOG("expecting to find %lu driverkit processes", [driverkit_pids count]); 1419 T_LOG("attempting to take stackshot with STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL flag"); 1420 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1421 parse_stackshot(PARSE_STACKSHOT_DRIVERKIT, ssbuf, sslen, @{ 1422 driverkit_found_key: ^(pid_t pid) { 1423 [driverkit_pids removeObject:[NSNumber numberWithInt:pid]]; 1424 }}); 1425 }); 1426 1427 T_EXPECT_EQ([driverkit_pids count], (NSUInteger)0, "found expected number of driverkit processes"); 1428} 1429 1430static void 1431parse_page_table_asid_stackshot(void **ssbuf, size_t sslen) 1432{ 1433 bool seen_asid = false; 1434 bool seen_page_table_snapshot = false; 1435 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 1436 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, 1437 "buffer provided is a stackshot"); 1438 1439 iter = kcdata_iter_next(iter); 1440 KCDATA_ITER_FOREACH(iter) { 1441 switch (kcdata_iter_type(iter)) { 1442 case KCDATA_TYPE_ARRAY: { 1443 T_QUIET; 1444 T_ASSERT_TRUE(kcdata_iter_array_valid(iter), 1445 "checked that array is valid"); 1446 1447 if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_PAGE_TABLES) { 1448 continue; 1449 } 1450 1451 T_ASSERT_FALSE(seen_page_table_snapshot, "check that we haven't yet seen a page table snapshot"); 1452 seen_page_table_snapshot = true; 1453 1454 T_ASSERT_EQ((size_t) kcdata_iter_array_elem_size(iter), sizeof(uint64_t), 1455 "check that each element of the pagetable dump is the expected size"); 1456 1457 uint64_t *pt_array = kcdata_iter_payload(iter); 1458 uint32_t elem_count = kcdata_iter_array_elem_count(iter); 1459 uint32_t j; 1460 bool nonzero_tte = false; 1461 for (j = 0; j < elem_count;) { 1462 T_QUIET; T_ASSERT_LE(j + 4, elem_count, "check for valid page table segment header"); 1463 uint64_t pa = pt_array[j]; 1464 uint64_t num_entries = pt_array[j + 1]; 1465 uint64_t start_va = pt_array[j + 2]; 1466 uint64_t end_va = pt_array[j + 3]; 1467 1468 T_QUIET; T_ASSERT_NE(pa, (uint64_t) 0, "check that the pagetable physical address is non-zero"); 1469 T_QUIET; T_ASSERT_EQ(pa % (num_entries * sizeof(uint64_t)), (uint64_t) 0, "check that the pagetable physical address is correctly aligned"); 1470 T_QUIET; T_ASSERT_NE(num_entries, (uint64_t) 0, "check that a pagetable region has more than 0 entries"); 1471 T_QUIET; T_ASSERT_LE(j + 4 + num_entries, (uint64_t) elem_count, "check for sufficient space in page table array"); 1472 T_QUIET; T_ASSERT_GT(end_va, start_va, "check for valid VA bounds in page table segment header"); 1473 1474 for (uint32_t k = j + 4; k < (j + 4 + num_entries); ++k) { 1475 if (pt_array[k] != 0) { 1476 nonzero_tte = true; 1477 T_QUIET; T_ASSERT_EQ((pt_array[k] >> 48) & 0xf, (uint64_t) 0, "check that bits[48:51] of arm64 TTE are clear"); 1478 // L0-L2 table and non-compressed L3 block entries should always have bit 1 set; assumes L0-L2 blocks will not be used outside the kernel 1479 bool table = ((pt_array[k] & 0x2) != 0); 1480 if (table) { 1481 T_QUIET; T_ASSERT_NE(pt_array[k] & ((1ULL << 48) - 1) & ~((1ULL << 12) - 1), (uint64_t) 0, "check that arm64 TTE physical address is non-zero"); 1482 } else { // should be a compressed PTE 1483 T_QUIET; T_ASSERT_NE(pt_array[k] & 0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has at least one of bits [63:62] set"); 1484 T_QUIET; T_ASSERT_EQ(pt_array[k] & ~0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has no other bits besides [63:62] set"); 1485 } 1486 } 1487 } 1488 1489 j += (4 + num_entries); 1490 } 1491 T_ASSERT_TRUE(nonzero_tte, "check that we saw at least one non-empty TTE"); 1492 T_ASSERT_EQ(j, elem_count, "check that page table dump size matches extent of last header"); 1493 break; 1494 } 1495 case STACKSHOT_KCTYPE_ASID: { 1496 T_ASSERT_FALSE(seen_asid, "check that we haven't yet seen an ASID"); 1497 seen_asid = true; 1498 } 1499 } 1500 } 1501 T_ASSERT_TRUE(seen_page_table_snapshot, "check that we have seen a page table snapshot"); 1502 T_ASSERT_TRUE(seen_asid, "check that we have seen an ASID"); 1503} 1504 1505T_DECL(dump_page_tables, "test stackshot page table dumping support") 1506{ 1507 struct scenario scenario = { 1508 .name = "asid-page-tables", 1509 .flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_ASID | STACKSHOT_PAGE_TABLES), 1510 .size_hint = (9ull << 20), // 9 MB 1511 .target_pid = getpid(), 1512 .maybe_unsupported = true, 1513 .maybe_enomem = true, 1514 }; 1515 1516 T_LOG("attempting to take stackshot with ASID and page table flags"); 1517 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1518 parse_page_table_asid_stackshot(ssbuf, sslen); 1519 }); 1520} 1521 1522static void stackshot_verify_current_proc_uuid_info(void **ssbuf, size_t sslen, uint64_t expected_offset, const struct proc_uniqidentifierinfo *proc_info_data) 1523{ 1524 const uuid_t *current_uuid = (const uuid_t *)(&proc_info_data->p_uuid); 1525 1526 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 1527 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "buffer provided is a stackshot"); 1528 1529 iter = kcdata_iter_next(iter); 1530 1531 KCDATA_ITER_FOREACH(iter) { 1532 switch (kcdata_iter_type(iter)) { 1533 case KCDATA_TYPE_ARRAY: { 1534 T_QUIET; T_ASSERT_TRUE(kcdata_iter_array_valid(iter), "checked that array is valid"); 1535 if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO64) { 1536 struct user64_dyld_uuid_info *info = (struct user64_dyld_uuid_info *) kcdata_iter_payload(iter); 1537 if (uuid_compare(*current_uuid, info->imageUUID) == 0) { 1538 T_ASSERT_EQ(expected_offset, info->imageLoadAddress, "found matching UUID with matching binary offset"); 1539 return; 1540 } 1541 } else if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO) { 1542 struct user32_dyld_uuid_info *info = (struct user32_dyld_uuid_info *) kcdata_iter_payload(iter); 1543 if (uuid_compare(*current_uuid, info->imageUUID) == 0) { 1544 T_ASSERT_EQ(expected_offset, ((uint64_t) info->imageLoadAddress), "found matching UUID with matching binary offset"); 1545 return; 1546 } 1547 } 1548 break; 1549 } 1550 default: 1551 break; 1552 } 1553 } 1554 1555 T_FAIL("failed to find matching UUID in stackshot data"); 1556} 1557 1558T_DECL(translated, "tests translated bit is set correctly") 1559{ 1560#if !(TARGET_OS_OSX && TARGET_CPU_ARM64) 1561 T_SKIP("Only valid on Apple silicon Macs") 1562#endif 1563 // Get path of stackshot_translated_child helper binary 1564 char path[PATH_MAX]; 1565 uint32_t path_size = sizeof(path); 1566 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 1567 char* binary_name = strrchr(path, '/'); 1568 if (binary_name) binary_name++; 1569 T_QUIET; T_ASSERT_NOTNULL(binary_name, "Find basename in path '%s'", path); 1570 strlcpy(binary_name, "stackshot_translated_child", path_size - (binary_name - path)); 1571 char *args[] = { path, NULL }; 1572 1573 dispatch_source_t child_sig_src; 1574 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 1575 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore"); 1576 1577 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 1578 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 1579 1580 signal(SIGUSR1, SIG_IGN); 1581 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 1582 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 1583 1584 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 1585 dispatch_activate(child_sig_src); 1586 1587 // Spawn child 1588 pid_t pid; 1589 T_LOG("spawning translated child"); 1590 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, NULL, args, NULL), "spawned process '%s' with PID %d", args[0], pid); 1591 1592 // Wait for the the child to spawn up 1593 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 1594 1595 // Make sure the child is running and is translated 1596 int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, pid }; 1597 struct kinfo_proc process_info; 1598 size_t bufsize = sizeof(process_info); 1599 T_QUIET; T_ASSERT_POSIX_SUCCESS(sysctl(mib, (unsigned)(sizeof(mib)/sizeof(int)), &process_info, &bufsize, NULL, 0), "get translated child process info"); 1600 T_QUIET; T_ASSERT_GT(bufsize, (size_t)0, "process info is not empty"); 1601 T_QUIET; T_ASSERT_TRUE((process_info.kp_proc.p_flag & P_TRANSLATED), "KERN_PROC_PID reports child is translated"); 1602 1603 T_LOG("capturing stackshot"); 1604 1605 struct scenario scenario = { 1606 .name = "translated", 1607 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 1608 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 1609 }; 1610 1611 take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) { 1612 parse_stackshot(PARSE_STACKSHOT_TRANSLATED, ssbuf, sslen, @{translated_child_pid_key: @(pid)}); 1613 }); 1614 1615 // Kill the child 1616 int status; 1617 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGTERM), "kill translated child"); 1618 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on translated child"); 1619 1620} 1621 1622T_DECL(proc_uuid_info, "tests that the main binary UUID for a proc is always populated") 1623{ 1624 struct proc_uniqidentifierinfo proc_info_data = { }; 1625 mach_msg_type_number_t count; 1626 kern_return_t kernel_status; 1627 task_dyld_info_data_t task_dyld_info; 1628 struct dyld_all_image_infos *target_infos; 1629 int retval; 1630 bool found_image_in_image_infos = false; 1631 uint64_t expected_mach_header_offset = 0; 1632 1633 /* Find the UUID of our main binary */ 1634 retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data)); 1635 T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO"); 1636 T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data"); 1637 1638 uuid_string_t str = {}; 1639 uuid_unparse(*(uuid_t*)&proc_info_data.p_uuid, str); 1640 T_LOG("Found current UUID is %s", str); 1641 1642 /* Find the location of the dyld image info metadata */ 1643 count = TASK_DYLD_INFO_COUNT; 1644 kernel_status = task_info(mach_task_self(), TASK_DYLD_INFO, (task_info_t)&task_dyld_info, &count); 1645 T_QUIET; T_ASSERT_EQ(kernel_status, KERN_SUCCESS, "retrieve task_info for TASK_DYLD_INFO"); 1646 1647 target_infos = (struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr; 1648 1649 /* Find our binary in the dyld image info array */ 1650 for (int i = 0; i < (int) target_infos->uuidArrayCount; i++) { 1651 if (uuid_compare(target_infos->uuidArray[i].imageUUID, *(uuid_t*)&proc_info_data.p_uuid) == 0) { 1652 expected_mach_header_offset = (uint64_t) target_infos->uuidArray[i].imageLoadAddress; 1653 found_image_in_image_infos = true; 1654 } 1655 } 1656 1657 T_ASSERT_TRUE(found_image_in_image_infos, "found binary image in dyld image info list"); 1658 1659 /* Overwrite the dyld image info data so the kernel has to fallback to the UUID stored in the proc structure */ 1660 target_infos->uuidArrayCount = 0; 1661 1662 struct scenario scenario = { 1663 .name = "proc_uuid_info", 1664 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 1665 .target_pid = getpid(), 1666 }; 1667 1668 T_LOG("attempting to take stackshot for current PID"); 1669 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1670 stackshot_verify_current_proc_uuid_info(ssbuf, sslen, expected_mach_header_offset, &proc_info_data); 1671 }); 1672} 1673 1674T_DECL(cseg_waitinfo, "test that threads stuck in the compressor report correct waitinfo") 1675{ 1676 struct scenario scenario = { 1677 .name = "cseg_waitinfo", 1678 .quiet = false, 1679 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 1680 }; 1681 __block uint64_t thread_id = 0; 1682 1683 dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot.cseg_waitinfo", NULL); 1684 dispatch_semaphore_t child_ok = dispatch_semaphore_create(0); 1685 1686 dispatch_async(dq, ^{ 1687 pthread_threadid_np(NULL, &thread_id); 1688 dispatch_semaphore_signal(child_ok); 1689 int val = 1; 1690 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread"); 1691 }); 1692 1693 dispatch_semaphore_wait(child_ok, DISPATCH_TIME_FOREVER); 1694 sleep(1); 1695 1696 T_LOG("taking stackshot"); 1697 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1698 int val = 1; 1699 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child thread"); 1700 parse_stackshot(PARSE_STACKSHOT_WAITINFO_CSEG, ssbuf, sslen, @{cseg_expected_threadid_key: @(thread_id)}); 1701 }); 1702} 1703 1704static void 1705srp_send( 1706 mach_port_t send_port, 1707 mach_port_t reply_port, 1708 mach_port_t msg_port) 1709{ 1710 kern_return_t ret = 0; 1711 1712 struct test_msg { 1713 mach_msg_header_t header; 1714 mach_msg_body_t body; 1715 mach_msg_port_descriptor_t port_descriptor; 1716 }; 1717 struct test_msg send_msg = { 1718 .header = { 1719 .msgh_remote_port = send_port, 1720 .msgh_local_port = reply_port, 1721 .msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, 1722 reply_port ? MACH_MSG_TYPE_MAKE_SEND_ONCE : 0, 1723 MACH_MSG_TYPE_MOVE_SEND, 1724 MACH_MSGH_BITS_COMPLEX), 1725 .msgh_id = 0x100, 1726 .msgh_size = sizeof(send_msg), 1727 }, 1728 .body = { 1729 .msgh_descriptor_count = 1, 1730 }, 1731 .port_descriptor = { 1732 .name = msg_port, 1733 .disposition = MACH_MSG_TYPE_MOVE_RECEIVE, 1734 .type = MACH_MSG_PORT_DESCRIPTOR, 1735 }, 1736 }; 1737 1738 if (msg_port == MACH_PORT_NULL) { 1739 send_msg.body.msgh_descriptor_count = 0; 1740 } 1741 1742 ret = mach_msg(&(send_msg.header), 1743 MACH_SEND_MSG | 1744 MACH_SEND_TIMEOUT | 1745 MACH_SEND_OVERRIDE, 1746 send_msg.header.msgh_size, 1747 0, 1748 MACH_PORT_NULL, 1749 10000, 1750 0); 1751 1752 T_ASSERT_MACH_SUCCESS(ret, "client mach_msg"); 1753} 1754 1755T_HELPER_DECL(srp_client, 1756 "Client used for the special_reply_port test") 1757{ 1758 pid_t ppid = getppid(); 1759 dispatch_semaphore_t can_continue = dispatch_semaphore_create(0); 1760 dispatch_queue_t dq = dispatch_queue_create("client_signalqueue", NULL); 1761 dispatch_source_t sig_src; 1762 1763 mach_msg_return_t mr; 1764 mach_port_t service_port; 1765 mach_port_t conn_port; 1766 mach_port_t special_reply_port; 1767 mach_port_options_t opts = { 1768 .flags = MPO_INSERT_SEND_RIGHT, 1769 }; 1770 1771 signal(SIGUSR1, SIG_IGN); 1772 sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq); 1773 1774 dispatch_source_set_event_handler(sig_src, ^{ 1775 dispatch_semaphore_signal(can_continue); 1776 }); 1777 dispatch_activate(sig_src); 1778 1779 /* lookup the mach service port for the parent */ 1780 kern_return_t kr = bootstrap_look_up(bootstrap_port, 1781 SRP_SERVICE_NAME, &service_port); 1782 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "client bootstrap_look_up"); 1783 1784 /* create the send-once right (special reply port) and message to send to the server */ 1785 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port); 1786 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct"); 1787 1788 special_reply_port = thread_get_special_reply_port(); 1789 T_QUIET; T_ASSERT_TRUE(MACH_PORT_VALID(special_reply_port), "get_thread_special_reply_port"); 1790 1791 /* send the message with the special reply port */ 1792 srp_send(service_port, special_reply_port, conn_port); 1793 1794 /* signal the parent to continue */ 1795 kill(ppid, SIGUSR1); 1796 1797 struct { 1798 mach_msg_header_t header; 1799 mach_msg_body_t body; 1800 mach_msg_port_descriptor_t port_descriptor; 1801 } rcv_msg = { 1802 .header = 1803 { 1804 .msgh_remote_port = MACH_PORT_NULL, 1805 .msgh_local_port = special_reply_port, 1806 .msgh_size = sizeof(rcv_msg), 1807 }, 1808 }; 1809 1810 /* wait on the reply from the parent (that we will never receive) */ 1811 mr = mach_msg(&(rcv_msg.header), 1812 (MACH_RCV_MSG | MACH_RCV_SYNC_WAIT), 1813 0, 1814 rcv_msg.header.msgh_size, 1815 special_reply_port, 1816 MACH_MSG_TIMEOUT_NONE, 1817 service_port); 1818 1819 /* not expected to execute as parent will SIGKILL client... */ 1820 T_LOG("client process exiting after sending message to parent (server)"); 1821} 1822 1823enum srp_test_type { 1824 SRP_TEST_THREAD, /* expect waiter on current thread */ 1825 SRP_TEST_PID, /* expect waiter on current PID */ 1826 SRP_TEST_EITHER, /* waiter could be on either */ 1827}; 1828 1829static void 1830check_srp_test(const char *name, enum srp_test_type ty) 1831{ 1832 struct scenario scenario = { 1833 .name = name, 1834 .quiet = false, 1835 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 1836 }; 1837 uint64_t thread_id = 0; 1838 pthread_threadid_np(NULL, &thread_id); 1839 if (ty == SRP_TEST_THREAD) { 1840 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1841 parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen, 1842 @{srp_expected_threadid_key: @(thread_id)}); 1843 }); 1844 } else if (ty == SRP_TEST_PID) { 1845 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1846 parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen, 1847 @{srp_expected_pid_key: @(getpid())}); 1848 }); 1849 } else { 1850 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1851 parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen, 1852 @{srp_expected_pid_key: @(getpid()), srp_expected_threadid_key: @(thread_id)}); 1853 }); 1854 } 1855 1856} 1857 1858 1859/* 1860 * Tests the stackshot wait info plumbing for synchronous IPC that doesn't use kevent on the server. 1861 * 1862 * (part 1): tests the scenario where a client sends a request that includes a special reply port 1863 * to a server that doesn't receive the message and doesn't copy the send-once right 1864 * into its address space as a result. for this case the special reply port is enqueued 1865 * in a port and we check which task has that receive right and use that info. (rdar://60440338) 1866 * (part 2): tests the scenario where a client sends a request that includes a special reply port 1867 * to a server that receives the message and copies in the send-once right, but doesn't 1868 * reply to the client. for this case the special reply port is copied out and the kernel 1869 * stashes the info about which task copied out the send once right. (rdar://60440592) 1870 * (part 3): tests the same as part 2, but uses kevents, which allow for 1871 * priority inheritance 1872 */ 1873T_DECL(special_reply_port, "test that tasks using special reply ports have correct waitinfo") 1874{ 1875 dispatch_semaphore_t can_continue = dispatch_semaphore_create(0); 1876 dispatch_queue_t dq = dispatch_queue_create("signalqueue", NULL); 1877 dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL); 1878 dispatch_source_t sig_src; 1879 char path[PATH_MAX]; 1880 uint32_t path_size = sizeof(path); 1881 T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 1882 char *client_args[] = { path, "-n", "srp_client", NULL }; 1883 pid_t client_pid; 1884 int sp_ret; 1885 kern_return_t kr; 1886 mach_port_t port; 1887 1888 /* setup the signal handler in the parent (server) */ 1889 T_LOG("setup sig handlers"); 1890 signal(SIGUSR1, SIG_IGN); 1891 sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq); 1892 1893 dispatch_source_set_event_handler(sig_src, ^{ 1894 dispatch_semaphore_signal(can_continue); 1895 }); 1896 dispatch_activate(sig_src); 1897 1898 /* register with the mach service name so the client can lookup and send a message to the parent (server) */ 1899 T_LOG("Server about to check in"); 1900 kr = bootstrap_check_in(bootstrap_port, SRP_SERVICE_NAME, &port); 1901 T_ASSERT_MACH_SUCCESS(kr, "server bootstrap_check_in"); 1902 1903 T_LOG("Launching client"); 1904 sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL); 1905 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid); 1906 T_LOG("Spawned client as PID %d", client_pid); 1907 1908 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 1909 T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear"); 1910 1911 /* 1912 * can_continue indicates the client has signaled us, but we want to make 1913 * sure they've actually blocked sending their mach message. It's cheesy, but 1914 * sleep() works for this. 1915 */ 1916 sleep(1); 1917 1918 /* 1919 * take the stackshot without calling receive to verify that the stackshot wait 1920 * info shows our (the server) thread for the scenario where the server has yet to 1921 * receive the message. 1922 */ 1923 T_LOG("Taking stackshot for part 1 coverage"); 1924 check_srp_test("srp", SRP_TEST_THREAD); 1925 1926 /* 1927 * receive the message from the client (which should copy the send once right into 1928 * our address space). 1929 */ 1930 struct { 1931 mach_msg_header_t header; 1932 mach_msg_body_t body; 1933 mach_msg_port_descriptor_t port_descriptor; 1934 } rcv_msg = { 1935 .header = 1936 { 1937 .msgh_remote_port = MACH_PORT_NULL, 1938 .msgh_local_port = port, 1939 .msgh_size = sizeof(rcv_msg), 1940 }, 1941 }; 1942 1943 T_LOG("server: starting sync receive\n"); 1944 1945 mach_msg_return_t mr; 1946 mr = mach_msg(&(rcv_msg.header), 1947 (MACH_RCV_MSG | MACH_RCV_TIMEOUT), 1948 0, 1949 4096, 1950 port, 1951 10000, 1952 MACH_PORT_NULL); 1953 T_QUIET; T_ASSERT_MACH_SUCCESS(mr, "mach_msg() recieve of message from client"); 1954 1955 /* 1956 * take the stackshot to verify that the stackshot wait info shows our (the server) PID 1957 * for the scenario where the server has received the message and copied in the send-once right. 1958 */ 1959 T_LOG("Taking stackshot for part 2 coverage"); 1960 check_srp_test("srp", SRP_TEST_PID); 1961 1962 /* cleanup - kill the client */ 1963 T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client"); 1964 T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit"); 1965 1966 // do it again, but using kevents 1967 T_LOG("Launching client"); 1968 sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL); 1969 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid); 1970 T_LOG("Spawned client as PID %d", client_pid); 1971 1972 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 1973 T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear"); 1974 1975 /* 1976 * can_continue indicates the client has signaled us, but we want to make 1977 * sure they've actually blocked sending their mach message. It's cheesy, but 1978 * sleep() works for this. 1979 */ 1980 sleep(1); 1981 1982 dispatch_mach_t dispatch_mach = dispatch_mach_create(SRP_SERVICE_NAME, machdq, 1983 ^(dispatch_mach_reason_t reason, 1984 dispatch_mach_msg_t message, 1985 mach_error_t error __unused) { 1986 switch (reason) { 1987 case DISPATCH_MACH_MESSAGE_RECEIVED: { 1988 size_t size = 0; 1989 mach_msg_header_t *msg __unused = dispatch_mach_msg_get_msg(message, &size); 1990 T_LOG("server: recieved %ld byte message", size); 1991 check_srp_test("turnstile_port_thread", SRP_TEST_THREAD); 1992 T_LOG("server: letting client go"); 1993 // drop the message on the ground, we'll kill the client later 1994 dispatch_semaphore_signal(can_continue); 1995 break; 1996 } 1997 default: 1998 break; 1999 } 2000 }); 2001 2002 dispatch_mach_connect(dispatch_mach, port, MACH_PORT_NULL, NULL); 2003 2004 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 2005 2006 /* cleanup - kill the client */ 2007 T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client"); 2008 T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit"); 2009} 2010 2011T_HELPER_DECL(throtlled_sp_client, 2012 "client that uses a connection port to send a message to a server") 2013{ 2014 mach_port_t conn_port, service_port, reply_port, *stash; 2015 mach_msg_type_number_t stash_cnt = 0; 2016 2017 kern_return_t kr = mach_ports_lookup(mach_task_self(), &stash, &stash_cnt); 2018 T_ASSERT_MACH_SUCCESS(kr, "mach_ports_lookup"); 2019 2020 service_port = stash[0]; 2021 T_ASSERT_TRUE(MACH_PORT_VALID(service_port), "valid service port"); 2022 mig_deallocate((vm_address_t)stash, stash_cnt * sizeof(stash[0])); 2023 2024 mach_port_options_t opts = { 2025 .flags = MPO_INSERT_SEND_RIGHT 2026 | MPO_CONNECTION_PORT, 2027 .service_port_name = service_port, 2028 }; 2029 2030 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port); 2031 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct"); 2032 2033 mach_port_options_t opts2 = { 2034 .flags = MPO_REPLY_PORT 2035 }; 2036 kr = mach_port_construct(mach_task_self(), &opts2, 0ull, &reply_port); 2037 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct"); 2038 2039 /* XPC-like check-in message */ 2040 struct { 2041 mach_msg_header_t header; 2042 mach_msg_port_descriptor_t recvp; 2043 mach_msg_port_descriptor_t sendp; 2044 } checkin_message = { 2045 .header = 2046 { 2047 .msgh_remote_port = service_port, 2048 .msgh_local_port = MACH_PORT_NULL, 2049 .msgh_size = sizeof(checkin_message), 2050 .msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0), 2051 }, 2052 .recvp = 2053 { 2054 .type = MACH_MSG_PORT_DESCRIPTOR, 2055 .name = conn_port, 2056 .disposition = MACH_MSG_TYPE_MOVE_RECEIVE, 2057 }, 2058 .sendp = 2059 { 2060 .type = MACH_MSG_PORT_DESCRIPTOR, 2061 .name = reply_port, 2062 .disposition = MACH_MSG_TYPE_MAKE_SEND, 2063 } 2064 }; 2065 dispatch_mach_msg_t dmsg = dispatch_mach_msg_create((mach_msg_header_t *)&checkin_message, sizeof(checkin_message), 2066 DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL); 2067 2068 dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL); 2069 dispatch_mach_t dchannel = dispatch_mach_create(THROTTLED_SERVICE_NAME, machdq, 2070 ^(dispatch_mach_reason_t reason, 2071 dispatch_mach_msg_t message __unused, 2072 mach_error_t error __unused) { 2073 switch (reason) { 2074 case DISPATCH_MACH_CONNECTED: 2075 T_LOG("mach channel connected"); 2076 break; 2077 case DISPATCH_MACH_MESSAGE_SENT: 2078 T_LOG("sent mach message"); 2079 break; 2080 default: 2081 T_ASSERT_FAIL("Unexpected reply to channel reason %lu", reason); 2082 } 2083 }); 2084 dispatch_mach_connect(dchannel, reply_port, service_port, dmsg); 2085 dispatch_release(dmsg); 2086 2087 struct { 2088 mach_msg_header_t header; 2089 uint64_t request_id; 2090 } request = { 2091 .header = 2092 { 2093 .msgh_size = sizeof(request), 2094 .msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE), 2095 }, 2096 .request_id = 1, 2097 }; 2098 dispatch_mach_msg_t dmsg2 = dispatch_mach_msg_create((mach_msg_header_t *)&request, sizeof(request), 2099 DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL); 2100 2101 dispatch_mach_reason_t reason; 2102 mach_error_t error; 2103 2104 /* send the check-in message and the request message */ 2105 dispatch_mach_msg_t dreply = dispatch_mach_send_with_result_and_wait_for_reply(dchannel, 2106 dmsg2, 0, DISPATCH_MACH_SEND_DEFAULT, &reason, &error); 2107 dispatch_release(dmsg2); 2108 2109 /* not expected to execute as parent will SIGKILL client */ 2110 T_ASSERT_FAIL("client process exiting after receiving %s reply", dreply ? "non-null" : "null"); 2111} 2112 2113static void 2114check_throttled_sp(const char *test_name, uint64_t context, bool is_throttled) 2115{ 2116 struct scenario scenario = { 2117 .name = test_name, 2118 .quiet = false, 2119 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 2120 }; 2121 2122 T_LOG("taking stackshot %s", test_name); 2123 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2124 parse_stackshot(PARSE_STACKSHOT_THROTTLED_SP, ssbuf, sslen, 2125 @{sp_throttled_expected_ctxt_key: @(context), 2126 sp_throttled_expect_flag: @(is_throttled)}); 2127 }); 2128} 2129 2130/* Take stackshot when a client is blocked on the service port of a process, in the scenario when 2131 * the process with the receive right for the service port is: 2132 * (a) Monitoring the service port using kevents 2133 * (b) Not monitoring the service port 2134 */ 2135T_DECL(throttled_sp, 2136 "test that service port throttled flag is propagated to the stackshot correctly") 2137{ 2138 mach_port_t service_port; 2139 __block dispatch_semaphore_t can_continue = dispatch_semaphore_create(0); 2140 2141 char path[PATH_MAX]; 2142 uint32_t path_size = sizeof(path); 2143 T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 2144 char *client_args[] = { path, "-n", "throtlled_sp_client", NULL }; 2145 2146 __block uint64_t thread_id = 0; 2147 pid_t client_pid; 2148 int mark_throttled; 2149 2150 struct mach_service_port_info sp_info = {}; 2151 strcpy(sp_info.mspi_string_name, THROTTLED_SERVICE_NAME); 2152 sp_info.mspi_domain_type = (uint8_t)1; 2153 kern_return_t kr; 2154 2155 mach_port_options_t opts = { 2156 .flags = MPO_SERVICE_PORT | MPO_INSERT_SEND_RIGHT | MPO_CONTEXT_AS_GUARD | MPO_STRICT | MPO_TEMPOWNER, 2157 .service_port_info = &sp_info, 2158 }; 2159 2160 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &service_port); 2161 T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct %u", service_port); 2162 2163 /* Setup a dispatch source to monitor the service port similar to how launchd does. */ 2164 dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL); 2165 dispatch_source_t mach_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_MACH_RECV, service_port, 2166 DISPATCH_MACH_RECV_SYNC_PEEK, machdq); 2167 dispatch_source_set_event_handler(mach_src, ^{ 2168 pthread_threadid_np(NULL, &thread_id); 2169 dispatch_semaphore_signal(can_continue); 2170 }); 2171 dispatch_activate(mach_src); 2172 2173 /* Stash the port in task to make sure child also gets it */ 2174 kr = mach_ports_register(mach_task_self(), &service_port, 1); 2175 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_ports_register service port"); 2176 2177 mark_throttled = 1; 2178 kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled), 2179 MACH_PORT_SERVICE_THROTTLED_COUNT); 2180 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mark service port as throttled"); 2181 2182 int rc = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL); 2183 T_QUIET; T_ASSERT_POSIX_ZERO(rc, "spawned process '%s' with PID %d", client_args[0], client_pid); 2184 T_LOG("Spawned client as PID %d", client_pid); 2185 2186 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 2187 2188 /* The service port has received the check-in message. Take stackshot for scenario (a). */ 2189 check_throttled_sp("throttled_service_port_monitored", thread_id, true); 2190 2191 /* This simulates a throttled spawn when the service port is no longer monitored. */ 2192 dispatch_source_cancel(mach_src); 2193 2194 /* Take stackshot for scenario (b) */ 2195 check_throttled_sp("throttled_service_port_unmonitored", (uint64_t)getpid(), true); 2196 2197 mark_throttled = 0; 2198 kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled), 2199 MACH_PORT_SERVICE_THROTTLED_COUNT); 2200 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "unmark service port as throttled"); 2201 2202 /* Throttled flag should not be set when the port is not throttled. */ 2203 check_throttled_sp("unthrottled_service_port_unmonitored", (uint64_t)getpid(), false); 2204 2205 /* cleanup - kill the client */ 2206 T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client"); 2207 T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit"); 2208} 2209 2210 2211#pragma mark performance tests 2212 2213#define SHOULD_REUSE_SIZE_HINT 0x01 2214#define SHOULD_USE_DELTA 0x02 2215#define SHOULD_TARGET_SELF 0x04 2216 2217static void 2218stackshot_perf(unsigned int options) 2219{ 2220 struct scenario scenario = { 2221 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 2222 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 2223 }; 2224 2225 dt_stat_t size = dt_stat_create("bytes", "size"); 2226 dt_stat_time_t duration = dt_stat_time_create("duration"); 2227 scenario.timer = duration; 2228 2229 if (options & SHOULD_TARGET_SELF) { 2230 scenario.target_pid = getpid(); 2231 } 2232 2233 while (!dt_stat_stable(duration) || !dt_stat_stable(size)) { 2234 __block uint64_t last_time = 0; 2235 __block uint32_t size_hint = 0; 2236 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2237 dt_stat_add(size, (double)sslen); 2238 last_time = stackshot_timestamp(ssbuf, sslen); 2239 size_hint = (uint32_t)sslen; 2240 }); 2241 if (options & SHOULD_USE_DELTA) { 2242 scenario.since_timestamp = last_time; 2243 scenario.flags |= STACKSHOT_COLLECT_DELTA_SNAPSHOT; 2244 } 2245 if (options & SHOULD_REUSE_SIZE_HINT) { 2246 scenario.size_hint = size_hint; 2247 } 2248 } 2249 2250 dt_stat_finalize(duration); 2251 dt_stat_finalize(size); 2252} 2253 2254static void 2255stackshot_flag_perf_noclobber(uint64_t flag, char *flagname) 2256{ 2257 struct scenario scenario = { 2258 .quiet = true, 2259 .flags = (flag | STACKSHOT_KCDATA_FORMAT), 2260 }; 2261 2262 dt_stat_t duration = dt_stat_create("nanoseconds per thread", "%s_duration", flagname); 2263 dt_stat_t size = dt_stat_create("bytes per thread", "%s_size", flagname); 2264 T_LOG("Testing \"%s\" = 0x%" PRIx64, flagname, flag); 2265 2266 while (!dt_stat_stable(duration) || !dt_stat_stable(size)) { 2267 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2268 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2269 unsigned long no_threads = 0; 2270 mach_timebase_info_data_t timebase = {0, 0}; 2271 uint64_t stackshot_duration = 0; 2272 int found = 0; 2273 T_QUIET; T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "stackshot buffer"); 2274 2275 KCDATA_ITER_FOREACH(iter) { 2276 switch(kcdata_iter_type(iter)) { 2277 case STACKSHOT_KCTYPE_THREAD_SNAPSHOT: { 2278 found |= 1; 2279 no_threads ++; 2280 break; 2281 } 2282 case STACKSHOT_KCTYPE_STACKSHOT_DURATION: { 2283 struct stackshot_duration *ssd = kcdata_iter_payload(iter); 2284 stackshot_duration = ssd->stackshot_duration; 2285 found |= 2; 2286 break; 2287 } 2288 case KCDATA_TYPE_TIMEBASE: { 2289 found |= 4; 2290 mach_timebase_info_data_t *tb = kcdata_iter_payload(iter); 2291 memcpy(&timebase, tb, sizeof(timebase)); 2292 break; 2293 } 2294 } 2295 } 2296 2297 T_QUIET; T_ASSERT_EQ(found, 0x7, "found everything needed"); 2298 2299 uint64_t ns = (stackshot_duration * timebase.numer) / timebase.denom; 2300 uint64_t per_thread_ns = ns / no_threads; 2301 uint64_t per_thread_size = sslen / no_threads; 2302 2303 dt_stat_add(duration, per_thread_ns); 2304 dt_stat_add(size, per_thread_size); 2305 }); 2306 } 2307 2308 dt_stat_finalize(duration); 2309 dt_stat_finalize(size); 2310} 2311 2312static void 2313stackshot_flag_perf(uint64_t flag, char *flagname) 2314{ 2315 /* 2316 * STACKSHOT_NO_IO_STATS disables data collection, so set it for 2317 * more accurate perfdata collection. 2318 */ 2319 flag |= STACKSHOT_NO_IO_STATS; 2320 2321 stackshot_flag_perf_noclobber(flag, flagname); 2322} 2323 2324 2325T_DECL(flag_perf, "test stackshot performance with different flags set", T_META_TAG_PERF) 2326{ 2327 stackshot_flag_perf_noclobber(STACKSHOT_NO_IO_STATS, "baseline"); 2328 stackshot_flag_perf_noclobber(0, "io_stats"); 2329 2330 stackshot_flag_perf(STACKSHOT_THREAD_WAITINFO, "thread_waitinfo"); 2331 stackshot_flag_perf(STACKSHOT_GET_DQ, "get_dq"); 2332 stackshot_flag_perf(STACKSHOT_SAVE_LOADINFO, "save_loadinfo"); 2333 stackshot_flag_perf(STACKSHOT_GET_GLOBAL_MEM_STATS, "get_global_mem_stats"); 2334 stackshot_flag_perf(STACKSHOT_SAVE_KEXT_LOADINFO, "save_kext_loadinfo"); 2335 stackshot_flag_perf(STACKSHOT_SAVE_IMP_DONATION_PIDS, "save_imp_donation_pids"); 2336 stackshot_flag_perf(STACKSHOT_ENABLE_BT_FAULTING, "enable_bt_faulting"); 2337 stackshot_flag_perf(STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT, "collect_sharedcache_layout"); 2338 stackshot_flag_perf(STACKSHOT_ENABLE_UUID_FAULTING, "enable_uuid_faulting"); 2339 stackshot_flag_perf(STACKSHOT_THREAD_GROUP, "thread_group"); 2340 stackshot_flag_perf(STACKSHOT_SAVE_JETSAM_COALITIONS, "save_jetsam_coalitions"); 2341 stackshot_flag_perf(STACKSHOT_INSTRS_CYCLES, "instrs_cycles"); 2342 stackshot_flag_perf(STACKSHOT_ASID, "asid"); 2343 stackshot_flag_perf(STACKSHOT_EXCLAVES, "exclaves"); 2344 stackshot_flag_perf(STACKSHOT_EXCLAVES | STACKSHOT_ASID, "exclaves + asid"); 2345 stackshot_flag_perf(STACKSHOT_SKIP_EXCLAVES, "exclaves skipped"); 2346} 2347 2348T_DECL(perf_no_size_hint, "test stackshot performance with no size hint", 2349 T_META_TAG_PERF) 2350{ 2351 stackshot_perf(0); 2352} 2353 2354T_DECL(perf_size_hint, "test stackshot performance with size hint", 2355 T_META_TAG_PERF) 2356{ 2357 stackshot_perf(SHOULD_REUSE_SIZE_HINT); 2358} 2359 2360T_DECL(perf_process, "test stackshot performance targeted at process", 2361 T_META_TAG_PERF) 2362{ 2363 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_TARGET_SELF); 2364} 2365 2366T_DECL(perf_delta, "test delta stackshot performance", 2367 T_META_TAG_PERF) 2368{ 2369 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA); 2370} 2371 2372T_DECL(perf_delta_no_exclaves, "test delta stackshot performance without Exclaves", 2373 T_META_REQUIRES_SYSCTL_EQ("kern.exclaves_status", 1), 2374 T_META_TAG_PERF) 2375{ 2376 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | STACKSHOT_SKIP_EXCLAVES); 2377} 2378 2379T_DECL(perf_delta_process, "test delta stackshot performance targeted at a process", 2380 T_META_TAG_PERF) 2381{ 2382 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | SHOULD_TARGET_SELF); 2383} 2384 2385T_DECL(stackshot_entitlement_report_test, "test stackshot entitlement report") 2386{ 2387 int sysctlValue = 1; 2388 T_ASSERT_POSIX_SUCCESS( 2389 sysctlbyname("debug.stackshot_entitlement_send_batch", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), 2390 "set debug.stackshot_entitlement_send_batch=1"); 2391 // having a way to verify that the coreanalytics event was received would be even better 2392 // See rdar://74197197 2393 T_PASS("entitlement test ran"); 2394} 2395 2396static uint64_t 2397stackshot_timestamp(void *ssbuf, size_t sslen) 2398{ 2399 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2400 2401 uint32_t type = kcdata_iter_type(iter); 2402 if (type != KCDATA_BUFFER_BEGIN_STACKSHOT && type != KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT) { 2403 T_ASSERT_FAIL("invalid kcdata type %u", kcdata_iter_type(iter)); 2404 } 2405 2406 iter = kcdata_iter_find_type(iter, KCDATA_TYPE_MACH_ABSOLUTE_TIME); 2407 T_QUIET; 2408 T_ASSERT_TRUE(kcdata_iter_valid(iter), "timestamp found in stackshot"); 2409 2410 return *(uint64_t *)kcdata_iter_payload(iter); 2411} 2412 2413#define TEST_THREAD_NAME "stackshot_test_thread" 2414 2415static void 2416parse_thread_group_stackshot(void **ssbuf, size_t sslen) 2417{ 2418 bool seen_thread_group_snapshot = false; 2419 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2420 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, 2421 "buffer provided is a stackshot"); 2422 2423 NSMutableSet *thread_groups = [[NSMutableSet alloc] init]; 2424 2425 iter = kcdata_iter_next(iter); 2426 KCDATA_ITER_FOREACH(iter) { 2427 switch (kcdata_iter_type(iter)) { 2428 case KCDATA_TYPE_ARRAY: { 2429 T_QUIET; 2430 T_ASSERT_TRUE(kcdata_iter_array_valid(iter), 2431 "checked that array is valid"); 2432 2433 if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_THREAD_GROUP_SNAPSHOT) { 2434 continue; 2435 } 2436 2437 seen_thread_group_snapshot = true; 2438 2439 if (kcdata_iter_array_elem_size(iter) >= sizeof(struct thread_group_snapshot_v3)) { 2440 struct thread_group_snapshot_v3 *tgs_array = kcdata_iter_payload(iter); 2441 for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) { 2442 struct thread_group_snapshot_v3 *tgs = tgs_array + j; 2443 [thread_groups addObject:@(tgs->tgs_id)]; 2444 } 2445 } 2446 else { 2447 struct thread_group_snapshot *tgs_array = kcdata_iter_payload(iter); 2448 for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) { 2449 struct thread_group_snapshot *tgs = tgs_array + j; 2450 [thread_groups addObject:@(tgs->tgs_id)]; 2451 } 2452 } 2453 break; 2454 } 2455 } 2456 } 2457 KCDATA_ITER_FOREACH(iter) { 2458 NSError *error = nil; 2459 2460 switch (kcdata_iter_type(iter)) { 2461 2462 case KCDATA_TYPE_CONTAINER_BEGIN: { 2463 T_QUIET; 2464 T_ASSERT_TRUE(kcdata_iter_container_valid(iter), 2465 "checked that container is valid"); 2466 2467 if (kcdata_iter_container_type(iter) != STACKSHOT_KCCONTAINER_THREAD) { 2468 break; 2469 } 2470 2471 NSDictionary *container = parseKCDataContainer(&iter, &error); 2472 T_QUIET; T_ASSERT_NOTNULL(container, "parsed thread container from stackshot"); 2473 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container"); 2474 2475 int tg = [container[@"thread_snapshots"][@"thread_group"] intValue]; 2476 2477 T_ASSERT_TRUE([thread_groups containsObject:@(tg)], "check that the thread group the thread is in exists"); 2478 2479 break; 2480 }; 2481 2482 } 2483 } 2484 T_ASSERT_TRUE(seen_thread_group_snapshot, "check that we have seen a thread group snapshot"); 2485} 2486 2487static void 2488verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count) 2489{ 2490 uuid_t cur_shared_cache_uuid; 2491 __block uint32_t lib_index = 0, libs_found = 0; 2492 2493 _dyld_get_shared_cache_uuid(cur_shared_cache_uuid); 2494 int result = dyld_shared_cache_iterate_text(cur_shared_cache_uuid, ^(const dyld_shared_cache_dylib_text_info* info) { 2495 T_QUIET; T_ASSERT_LT(lib_index, uuid_count, "dyld_shared_cache_iterate_text exceeded number of libraries returned by kernel"); 2496 2497 libs_found++; 2498 struct dyld_uuid_info_64 *cur_stackshot_uuid_entry = &uuids[lib_index]; 2499 T_QUIET; T_ASSERT_EQ(memcmp(info->dylibUuid, cur_stackshot_uuid_entry->imageUUID, sizeof(info->dylibUuid)), 0, 2500 "dyld returned UUID doesn't match kernel returned UUID"); 2501 T_QUIET; T_ASSERT_EQ(info->loadAddressUnslid, cur_stackshot_uuid_entry->imageLoadAddress, 2502 "dyld returned load address doesn't match kernel returned load address"); 2503 lib_index++; 2504 }); 2505 2506 T_ASSERT_EQ(result, 0, "iterate shared cache layout"); 2507 T_ASSERT_EQ(libs_found, uuid_count, "dyld iterator returned same number of libraries as kernel"); 2508 2509 T_LOG("verified %d libraries from dyld shared cache", libs_found); 2510} 2511 2512static void 2513check_shared_cache_uuid(uuid_t imageUUID) 2514{ 2515 static uuid_t shared_cache_uuid; 2516 static dispatch_once_t read_shared_cache_uuid; 2517 2518 dispatch_once(&read_shared_cache_uuid, ^{ 2519 T_QUIET; 2520 T_ASSERT_TRUE(_dyld_get_shared_cache_uuid(shared_cache_uuid), "retrieve current shared cache UUID"); 2521 }); 2522 T_QUIET; T_ASSERT_EQ(uuid_compare(shared_cache_uuid, imageUUID), 0, 2523 "dyld returned UUID doesn't match kernel returned UUID for system shared cache"); 2524} 2525 2526/* 2527 * extra dictionary contains data relevant for the given flags: 2528 * PARSE_STACKSHOT_ZOMBIE: zombie_child_pid_key -> @(pid) 2529 * PARSE_STACKSHOT_POSTEXEC: postexec_child_unique_pid_key -> @(unique_pid) 2530 */ 2531static void 2532parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra) 2533{ 2534 bool delta = (stackshot_parsing_flags & PARSE_STACKSHOT_DELTA); 2535 bool expect_sharedcache_child = (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_FLAGS); 2536 bool expect_zombie_child = (stackshot_parsing_flags & PARSE_STACKSHOT_ZOMBIE); 2537 bool expect_postexec_child = (stackshot_parsing_flags & PARSE_STACKSHOT_POSTEXEC); 2538 bool expect_cseg_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_CSEG); 2539 bool expect_translated_child = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSLATED); 2540 bool expect_shared_cache_layout = false; 2541 bool expect_shared_cache_uuid = !delta; 2542 bool expect_dispatch_queue_label = (stackshot_parsing_flags & PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL); 2543 bool expect_turnstile_lock = (stackshot_parsing_flags & PARSE_STACKSHOT_TURNSTILEINFO); 2544 bool expect_srp_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_SRP); 2545 bool expect_sp_throttled = (stackshot_parsing_flags & PARSE_STACKSHOT_THROTTLED_SP); 2546 bool expect_exec_inprogress = (stackshot_parsing_flags & PARSE_STACKSHOT_EXEC_INPROGRESS); 2547 bool expect_transitioning_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSITIONING); 2548 bool expect_asyncstack = (stackshot_parsing_flags & PARSE_STACKSHOT_ASYNCSTACK); 2549 bool expect_driverkit = (stackshot_parsing_flags & PARSE_STACKSHOT_DRIVERKIT); 2550 bool expect_suspendinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_SUSPENDINFO); 2551 bool found_zombie_child = false, found_postexec_child = false, found_shared_cache_layout = false, found_shared_cache_uuid = false; 2552 bool found_translated_child = false, found_transitioning_task = false; 2553 bool found_dispatch_queue_label = false, found_turnstile_lock = false; 2554 bool found_cseg_waitinfo = false, found_srp_waitinfo = false; 2555 bool found_sharedcache_child = false, found_sharedcache_badflags = false, found_sharedcache_self = false; 2556 bool found_asyncstack = false; 2557 bool found_throttled_service = false; 2558 bool found_exclaves = false; 2559 uint64_t srp_expected_threadid = 0; 2560 pid_t zombie_child_pid = -1, srp_expected_pid = -1, sharedcache_child_pid = -1, throttled_service_ctx = -1; 2561 pid_t translated_child_pid = -1, transistioning_task_pid = -1; 2562 bool sharedcache_child_sameaddr = false, is_throttled = false; 2563 uint64_t postexec_child_unique_pid = 0, cseg_expected_threadid = 0; 2564 uint64_t sharedcache_child_flags = 0, sharedcache_self_flags = 0; 2565 uint64_t asyncstack_threadid = 0; 2566 NSArray *asyncstack_stack = nil; 2567 char *inflatedBufferBase = NULL; 2568 pid_t exec_inprogress_pid = -1; 2569 void (^exec_inprogress_cb)(uint64_t, uint64_t) = NULL; 2570 int exec_inprogress_found = 0; 2571 uint64_t exec_inprogress_containerid = 0; 2572 void (^driverkit_cb)(pid_t) = NULL; 2573 NSMutableDictionary *sharedCaches = [NSMutableDictionary new]; 2574 2575 if (expect_shared_cache_uuid) { 2576 uuid_t shared_cache_uuid; 2577 if (!_dyld_get_shared_cache_uuid(shared_cache_uuid)) { 2578 T_LOG("Skipping verifying shared cache UUID in stackshot data because not running with a shared cache"); 2579 expect_shared_cache_uuid = false; 2580 } 2581 } 2582 2583 if (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_LAYOUT) { 2584 size_t shared_cache_length = 0; 2585 const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length); 2586 T_QUIET; T_ASSERT_NOTNULL(cache_header, "current process running with shared cache"); 2587 T_QUIET; T_ASSERT_GT(shared_cache_length, sizeof(struct _dyld_cache_header), "valid shared cache length populated by _dyld_get_shared_cache_range"); 2588 2589 if (_dyld_shared_cache_is_locally_built()) { 2590 T_LOG("device running with locally built shared cache, expect shared cache layout"); 2591 expect_shared_cache_layout = true; 2592 } else { 2593 T_LOG("device running with B&I built shared-cache, no shared cache layout expected"); 2594 } 2595 } 2596 2597 if (expect_sharedcache_child) { 2598 NSNumber* pid_num = extra[sharedcache_child_pid_key]; 2599 NSNumber* sameaddr_num = extra[sharedcache_child_sameaddr_key]; 2600 T_QUIET; T_ASSERT_NOTNULL(pid_num, "sharedcache child pid provided"); 2601 T_QUIET; T_ASSERT_NOTNULL(sameaddr_num, "sharedcache child addrsame provided"); 2602 sharedcache_child_pid = [pid_num intValue]; 2603 T_QUIET; T_ASSERT_GT(sharedcache_child_pid, 0, "sharedcache child pid greater than zero"); 2604 sharedcache_child_sameaddr = [sameaddr_num intValue]; 2605 T_QUIET; T_ASSERT_GE([sameaddr_num intValue], 0, "sharedcache child sameaddr is boolean (0 or 1)"); 2606 T_QUIET; T_ASSERT_LE([sameaddr_num intValue], 1, "sharedcache child sameaddr is boolean (0 or 1)"); 2607 } 2608 2609 if (expect_transitioning_task) { 2610 NSNumber* pid_num = extra[transitioning_pid_key]; 2611 T_ASSERT_NOTNULL(pid_num, "transitioning task pid provided"); 2612 transistioning_task_pid = [pid_num intValue]; 2613 } 2614 2615 if (expect_zombie_child) { 2616 NSNumber* pid_num = extra[zombie_child_pid_key]; 2617 T_QUIET; T_ASSERT_NOTNULL(pid_num, "zombie child pid provided"); 2618 zombie_child_pid = [pid_num intValue]; 2619 T_QUIET; T_ASSERT_GT(zombie_child_pid, 0, "zombie child pid greater than zero"); 2620 } 2621 2622 if (expect_postexec_child) { 2623 NSNumber* unique_pid_num = extra[postexec_child_unique_pid_key]; 2624 T_QUIET; T_ASSERT_NOTNULL(unique_pid_num, "postexec child unique pid provided"); 2625 postexec_child_unique_pid = [unique_pid_num unsignedLongLongValue]; 2626 T_QUIET; T_ASSERT_GT(postexec_child_unique_pid, 0ull, "postexec child unique pid greater than zero"); 2627 } 2628 2629 if (expect_cseg_waitinfo) { 2630 NSNumber* tid_num = extra[cseg_expected_threadid_key]; 2631 T_QUIET; T_ASSERT_NOTNULL(tid_num, "cseg's expected thread id provided"); 2632 cseg_expected_threadid = tid_num.unsignedLongValue; 2633 T_QUIET; T_ASSERT_GT(cseg_expected_threadid, UINT64_C(0), "compressor segment thread is present"); 2634 } 2635 2636 if (expect_srp_waitinfo) { 2637 NSNumber* threadid_num = extra[srp_expected_threadid_key]; 2638 NSNumber* pid_num = extra[srp_expected_pid_key]; 2639 T_QUIET; T_ASSERT_TRUE(threadid_num != nil || pid_num != nil, "expected SRP threadid or pid"); 2640 if (threadid_num != nil) { 2641 srp_expected_threadid = [threadid_num unsignedLongLongValue]; 2642 T_QUIET; T_ASSERT_GT(srp_expected_threadid, 0ull, "srp_expected_threadid greater than zero"); 2643 } 2644 if (pid_num != nil) { 2645 srp_expected_pid = [pid_num intValue]; 2646 T_QUIET; T_ASSERT_GT(srp_expected_pid, 0, "srp_expected_pid greater than zero"); 2647 } 2648 T_LOG("looking for SRP pid: %d threadid: %llu", srp_expected_pid, srp_expected_threadid); 2649 } 2650 2651 if (expect_sp_throttled) { 2652 NSNumber* ctx = extra[sp_throttled_expected_ctxt_key]; 2653 T_QUIET; T_ASSERT_TRUE(ctx != nil, "expected pid"); 2654 throttled_service_ctx = [ctx intValue]; 2655 T_QUIET; T_ASSERT_GT(throttled_service_ctx, 0, "expected pid greater than zero"); 2656 2657 NSNumber *throttled = extra[sp_throttled_expect_flag]; 2658 T_QUIET; T_ASSERT_TRUE(throttled != nil, "expected flag value"); 2659 is_throttled = ([throttled intValue] != 0); 2660 2661 T_LOG("Looking for service with ctxt: %d, thottled:%d", throttled_service_ctx, is_throttled); 2662 } 2663 2664 if (expect_translated_child) { 2665 NSNumber* pid_num = extra[translated_child_pid_key]; 2666 T_QUIET; T_ASSERT_NOTNULL(pid_num, "translated child pid provided"); 2667 translated_child_pid = [pid_num intValue]; 2668 T_QUIET; T_ASSERT_GT(translated_child_pid, 0, "translated child pid greater than zero"); 2669 } 2670 if (expect_exec_inprogress) { 2671 NSNumber* pid_num = extra[exec_inprogress_pid_key]; 2672 T_QUIET; T_ASSERT_NOTNULL(pid_num, "exec inprogress pid provided"); 2673 exec_inprogress_pid = [pid_num intValue]; 2674 T_QUIET; T_ASSERT_GT(exec_inprogress_pid, 0, "exec inprogress pid greater than zero"); 2675 2676 exec_inprogress_cb = extra[exec_inprogress_found_key]; 2677 T_QUIET; T_ASSERT_NOTNULL(exec_inprogress_cb, "exec inprogress found callback provided"); 2678 } 2679 if (expect_driverkit) { 2680 driverkit_cb = extra[driverkit_found_key]; 2681 T_QUIET; T_ASSERT_NOTNULL(driverkit_cb, "driverkit found callback provided"); 2682 } 2683 2684 if (expect_asyncstack) { 2685 NSNumber* threadid_id = extra[asyncstack_expected_threadid_key]; 2686 T_QUIET; T_ASSERT_NOTNULL(threadid_id, "asyncstack threadid provided"); 2687 asyncstack_threadid = [threadid_id unsignedLongLongValue]; 2688 asyncstack_stack = extra[asyncstack_expected_stack_key]; 2689 T_QUIET; T_ASSERT_NOTNULL(asyncstack_stack, "asyncstack expected stack provided"); 2690 } 2691 2692 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2693 if (delta) { 2694 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT, 2695 "buffer provided is a delta stackshot"); 2696 2697 iter = kcdata_iter_next(iter); 2698 } else { 2699 if (kcdata_iter_type(iter) != KCDATA_BUFFER_BEGIN_COMPRESSED) { 2700 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, 2701 "buffer provided is a stackshot"); 2702 2703 iter = kcdata_iter_next(iter); 2704 } else { 2705 /* we are dealing with a compressed buffer */ 2706 iter = kcdata_iter_next(iter); 2707 uint64_t compression_type = 0, totalout = 0, totalin = 0; 2708 2709 uint64_t *data; 2710 char *desc; 2711 for (int i = 0; i < 3; i ++) { 2712 kcdata_iter_get_data_with_desc(iter, &desc, (void **)&data, NULL); 2713 if (strcmp(desc, "kcd_c_type") == 0) { 2714 compression_type = *data; 2715 } else if (strcmp(desc, "kcd_c_totalout") == 0){ 2716 totalout = *data; 2717 } else if (strcmp(desc, "kcd_c_totalin") == 0){ 2718 totalin = *data; 2719 } 2720 2721 iter = kcdata_iter_next(iter); 2722 } 2723 2724 T_ASSERT_EQ(compression_type, UINT64_C(1), "zlib compression is used"); 2725 T_ASSERT_GT(totalout, UINT64_C(0), "successfully gathered how long the compressed buffer is"); 2726 T_ASSERT_GT(totalin, UINT64_C(0), "successfully gathered how long the uncompressed buffer will be at least"); 2727 2728 /* progress to the next kcdata item */ 2729 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "compressed stackshot found"); 2730 2731 char *bufferBase = kcdata_iter_payload(iter); 2732 2733 /* 2734 * zlib is used, allocate a buffer based on the metadata, plus 2735 * extra scratch space (+12.5%) in case totalin was inconsistent 2736 */ 2737 size_t inflatedBufferSize = totalin + (totalin >> 3); 2738 inflatedBufferBase = malloc(inflatedBufferSize); 2739 T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(inflatedBufferBase, "allocated temporary output buffer"); 2740 2741 z_stream zs; 2742 memset(&zs, 0, sizeof(zs)); 2743 T_QUIET; T_ASSERT_EQ(inflateInit(&zs), Z_OK, "inflateInit OK"); 2744 zs.next_in = (unsigned char *)bufferBase; 2745 T_QUIET; T_ASSERT_LE(totalout, (uint64_t)UINT_MAX, "stackshot is not too large"); 2746 zs.avail_in = (uInt)totalout; 2747 zs.next_out = (unsigned char *)inflatedBufferBase; 2748 T_QUIET; T_ASSERT_LE(inflatedBufferSize, (size_t)UINT_MAX, "output region is not too large"); 2749 zs.avail_out = (uInt)inflatedBufferSize; 2750 T_ASSERT_EQ(inflate(&zs, Z_FINISH), Z_STREAM_END, "inflated buffer"); 2751 inflateEnd(&zs); 2752 2753 T_ASSERT_EQ((uint64_t)zs.total_out, totalin, "expected number of bytes inflated"); 2754 2755 /* copy the data after the compressed area */ 2756 T_QUIET; T_ASSERT_GE((void *)bufferBase, ssbuf, 2757 "base of compressed stackshot is after the returned stackshot buffer"); 2758 size_t header_size = (size_t)(bufferBase - (char *)ssbuf); 2759 size_t data_after_compressed_size = sslen - totalout - header_size; 2760 T_QUIET; T_ASSERT_LE(data_after_compressed_size, 2761 inflatedBufferSize - zs.total_out, 2762 "footer fits in the buffer"); 2763 memcpy(inflatedBufferBase + zs.total_out, 2764 bufferBase + totalout, 2765 data_after_compressed_size); 2766 2767 iter = kcdata_iter(inflatedBufferBase, inflatedBufferSize); 2768 } 2769 } 2770 2771 KCDATA_ITER_FOREACH(iter) { 2772 NSError *error = nil; 2773 2774 switch (kcdata_iter_type(iter)) { 2775 case KCDATA_TYPE_ARRAY: { 2776 T_QUIET; 2777 T_ASSERT_TRUE(kcdata_iter_array_valid(iter), 2778 "checked that array is valid"); 2779 2780 NSMutableDictionary *array = parseKCDataArray(iter, &error); 2781 T_QUIET; T_ASSERT_NOTNULL(array, "parsed array from stackshot"); 2782 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing array"); 2783 2784 if (kcdata_iter_array_elem_type(iter) == STACKSHOT_KCTYPE_SYS_SHAREDCACHE_LAYOUT) { 2785 struct dyld_uuid_info_64 *shared_cache_uuids = kcdata_iter_payload(iter); 2786 uint32_t uuid_count = kcdata_iter_array_elem_count(iter); 2787 T_ASSERT_NOTNULL(shared_cache_uuids, "parsed shared cache layout array"); 2788 T_ASSERT_GT(uuid_count, 0, "returned valid number of UUIDs from shared cache"); 2789 verify_stackshot_sharedcache_layout(shared_cache_uuids, uuid_count); 2790 found_shared_cache_layout = true; 2791 } 2792 2793 break; 2794 } 2795 2796 case KCDATA_TYPE_CONTAINER_BEGIN: { 2797 T_QUIET; 2798 T_ASSERT_TRUE(kcdata_iter_container_valid(iter), 2799 "checked that container is valid"); 2800 2801 uint64_t containerid = kcdata_iter_container_id(iter); 2802 uint32_t container_type = kcdata_iter_container_type(iter); 2803 2804 if (container_type == STACKSHOT_KCCONTAINER_SHAREDCACHE) { 2805 NSDictionary *container = parseKCDataContainer(&iter, &error); 2806 T_QUIET; T_ASSERT_NOTNULL(container, "parsed sharedcache container from stackshot"); 2807 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing sharedcache container"); 2808 T_QUIET; T_EXPECT_EQ(sharedCaches[@(containerid)], nil, "sharedcache containerid %lld should be unique", containerid); 2809 sharedCaches[@(containerid)] = container; 2810 break; 2811 } 2812 2813 if (container_type == STACKSHOT_KCCONTAINER_EXCLAVES) { 2814 found_exclaves = true; 2815 break; 2816 } 2817 2818 /* 2819 * treat containers other than tasks/transitioning_tasks 2820 * as expanded in-line. 2821 */ 2822 if (container_type != STACKSHOT_KCCONTAINER_TASK && 2823 container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK) { 2824 T_LOG("container skipped: %d", container_type); 2825 break; 2826 } 2827 NSDictionary *container = parseKCDataContainer(&iter, &error); 2828 T_QUIET; T_ASSERT_NOTNULL(container, "parsed task/transitioning_task container from stackshot"); 2829 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container"); 2830 2831 NSDictionary* task_snapshot = container[@"task_snapshots"][@"task_snapshot"]; 2832 NSDictionary* task_delta_snapshot = container[@"task_snapshots"][@"task_delta_snapshot"]; 2833 NSDictionary* transitioning_task_snapshot = container[@"transitioning_task_snapshots"][@"transitioning_task_snapshot"]; 2834 2835 /* 2836 * Having processed the container, we now only check it 2837 * if it's the correct type. 2838 */ 2839 if ((!expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TASK)) || 2840 (expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK))) { 2841 break; 2842 } 2843 if (!expect_transitioning_task) { 2844 T_QUIET; T_ASSERT_TRUE(!!task_snapshot != !!task_delta_snapshot, "Either task_snapshot xor task_delta_snapshot provided"); 2845 } 2846 2847 if (expect_dispatch_queue_label && !found_dispatch_queue_label) { 2848 for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) { 2849 NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key]; 2850 NSString *dql = thread[@"dispatch_queue_label"]; 2851 2852 if ([dql isEqualToString:@TEST_STACKSHOT_QUEUE_LABEL]) { 2853 found_dispatch_queue_label = true; 2854 break; 2855 } 2856 } 2857 } 2858 2859 if (expect_transitioning_task && !found_transitioning_task) { 2860 if (transitioning_task_snapshot) { 2861 uint64_t the_pid = [transitioning_task_snapshot[@"tts_pid"] unsignedLongLongValue]; 2862 if (the_pid == (uint64_t)transistioning_task_pid) { 2863 found_transitioning_task = true; 2864 T_PASS("FOUND Transitioning task %llu has a transitioning task snapshot", (uint64_t) transistioning_task_pid); 2865 break; 2866 } 2867 } 2868 } 2869 2870 if (expect_postexec_child && !found_postexec_child) { 2871 if (task_snapshot) { 2872 uint64_t unique_pid = [task_snapshot[@"ts_unique_pid"] unsignedLongLongValue]; 2873 if (unique_pid == postexec_child_unique_pid) { 2874 found_postexec_child = true; 2875 2876 T_PASS("post-exec child %llu has a task snapshot", postexec_child_unique_pid); 2877 2878 break; 2879 } 2880 } 2881 2882 if (task_delta_snapshot) { 2883 uint64_t unique_pid = [task_delta_snapshot[@"tds_unique_pid"] unsignedLongLongValue]; 2884 if (unique_pid == postexec_child_unique_pid) { 2885 found_postexec_child = true; 2886 2887 T_FAIL("post-exec child %llu shouldn't have a delta task snapshot", postexec_child_unique_pid); 2888 2889 break; 2890 } 2891 } 2892 } 2893 2894 if (!task_snapshot) { 2895 break; 2896 } 2897 2898 int pid = [task_snapshot[@"ts_pid"] intValue]; 2899 2900 if (pid && expect_shared_cache_uuid && !found_shared_cache_uuid) { 2901 id ptr = container[@"task_snapshots"][@"shared_cache_dyld_load_info"]; 2902 if (ptr) { 2903 id uuid = ptr[@"imageUUID"]; 2904 2905 uint8_t uuid_p[16]; 2906 for (unsigned int i = 0; i < 16; i ++) { 2907 NSNumber *uuidByte = uuid[i]; 2908 uuid_p[i] = (uint8_t)uuidByte.charValue; 2909 } 2910 2911 check_shared_cache_uuid(uuid_p); 2912 2913 uint64_t baseAddress = (uint64_t)((NSNumber *)ptr[@"imageSlidBaseAddress"]).longLongValue; 2914 uint64_t firstMapping = (uint64_t)((NSNumber *)ptr[@"sharedCacheSlidFirstMapping"]).longLongValue; 2915 2916 T_EXPECT_LE(baseAddress, firstMapping, 2917 "in per-task shared_cache_dyld_load_info, " 2918 "baseAddress <= firstMapping"); 2919 T_EXPECT_GE(baseAddress + (7ull << 32) + (1ull << 29), 2920 firstMapping, 2921 "in per-task shared_cache_dyld_load_info, " 2922 "baseAddress + 28.5gig >= firstMapping"); 2923 2924 size_t shared_cache_len; 2925 const void *addr = _dyld_get_shared_cache_range(&shared_cache_len); 2926 T_EXPECT_EQ((uint64_t)addr, firstMapping, 2927 "SlidFirstMapping should match shared_cache_range"); 2928 2929 /* 2930 * check_shared_cache_uuid() will assert on failure, so if 2931 * we get here, then we have found the shared cache UUID 2932 * and it's correct 2933 */ 2934 found_shared_cache_uuid = true; 2935 } 2936 } 2937 2938 if (expect_sharedcache_child) { 2939 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 2940 uint64_t sharedregion_flags = (task_flags & (kTaskSharedRegionNone | kTaskSharedRegionSystem | kTaskSharedRegionOther)); 2941 id sharedregion_info = container[@"task_snapshots"][@"shared_cache_dyld_load_info"]; 2942 id sharedcache_id = container[@"task_snapshots"][@"sharedCacheID"]; 2943 if (!found_sharedcache_badflags) { 2944 T_QUIET; T_EXPECT_NE(sharedregion_flags, 0ll, "one of the kTaskSharedRegion flags should be set on all tasks"); 2945 bool multiple = (sharedregion_flags & (sharedregion_flags - 1)) != 0; 2946 T_QUIET; T_EXPECT_FALSE(multiple, "only one kTaskSharedRegion flag should be set on each task"); 2947 found_sharedcache_badflags = (sharedregion_flags == 0 || multiple); 2948 } 2949 if (pid == 0) { 2950 T_ASSERT_EQ(sharedregion_flags, (uint64_t)kTaskSharedRegionNone, "Kernel proc (pid 0) should have no shared region"); 2951 } else if (pid == sharedcache_child_pid) { 2952 found_sharedcache_child = true; 2953 sharedcache_child_flags = sharedregion_flags; 2954 } else if (pid == getpid()) { 2955 found_sharedcache_self = true; 2956 sharedcache_self_flags = sharedregion_flags; 2957 } 2958 if (sharedregion_flags == kTaskSharedRegionOther && !(task_flags & kTaskSharedRegionInfoUnavailable)) { 2959 T_QUIET; T_EXPECT_NOTNULL(sharedregion_info, "kTaskSharedRegionOther should have a shared_cache_dyld_load_info struct"); 2960 T_QUIET; T_EXPECT_NOTNULL(sharedcache_id, "kTaskSharedRegionOther should have a sharedCacheID"); 2961 if (sharedcache_id != nil) { 2962 T_QUIET; T_EXPECT_NOTNULL(sharedCaches[sharedcache_id], "sharedCacheID %d should exist", [sharedcache_id intValue]); 2963 } 2964 } else { 2965 T_QUIET; T_EXPECT_NULL(sharedregion_info, "non-kTaskSharedRegionOther should have no shared_cache_dyld_load_info struct"); 2966 T_QUIET; T_EXPECT_NULL(sharedcache_id, "non-kTaskSharedRegionOther should have no sharedCacheID"); 2967 } 2968 } 2969 2970 if (expect_zombie_child && (pid == zombie_child_pid)) { 2971 found_zombie_child = true; 2972 2973 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 2974 T_ASSERT_TRUE((task_flags & kTerminatedSnapshot) == kTerminatedSnapshot, "child zombie marked as terminated"); 2975 2976 continue; 2977 } 2978 2979 if (expect_translated_child && (pid == translated_child_pid)) { 2980 found_translated_child = true; 2981 2982 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 2983 T_EXPECT_BITS_SET(task_flags, kTaskIsTranslated, "child marked as translated"); 2984 2985 continue; 2986 } 2987 if (expect_exec_inprogress && (pid == exec_inprogress_pid || pid == -exec_inprogress_pid)) { 2988 exec_inprogress_found++; 2989 T_LOG("found exec task with pid %d, instance %d", pid, exec_inprogress_found); 2990 T_QUIET; T_ASSERT_LE(exec_inprogress_found, 2, "no more than two with the expected pid"); 2991 if (exec_inprogress_found == 2) { 2992 T_LOG("found 2 tasks with pid %d", exec_inprogress_pid); 2993 exec_inprogress_cb(containerid, exec_inprogress_containerid); 2994 } else { 2995 exec_inprogress_containerid = containerid; 2996 } 2997 } 2998 if (expect_driverkit && driverkit_cb != NULL) { 2999 driverkit_cb(pid); 3000 } 3001 if (expect_cseg_waitinfo) { 3002 NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"]; 3003 3004 for (id i in winfos) { 3005 NSNumber *waitType = i[@"wait_type"]; 3006 NSNumber *owner = i[@"owner"]; 3007 if (waitType.intValue == kThreadWaitCompressor && 3008 owner.unsignedLongValue == cseg_expected_threadid) { 3009 found_cseg_waitinfo = true; 3010 break; 3011 } 3012 } 3013 } 3014 3015 if (expect_srp_waitinfo) { 3016 NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"]; 3017 NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"]; 3018 for (id i in tinfos) { 3019 if (!found_srp_waitinfo) { 3020 bool found_thread = false; 3021 bool found_pid = false; 3022 if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_THREAD) && 3023 [i[@"turnstile_context"] unsignedLongLongValue] == srp_expected_threadid && 3024 srp_expected_threadid != 0) { 3025 found_thread = true; 3026 } 3027 if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_BLOCKED_ON_TASK) && 3028 [i[@"turnstile_context"] intValue] == srp_expected_pid && 3029 srp_expected_pid != -1) { 3030 found_pid = true; 3031 } 3032 if (found_pid || found_thread) { 3033 T_LOG("found SRP %s %lld waiter: %d", (found_thread ? "thread" : "pid"), 3034 [i[@"turnstile_context"] unsignedLongLongValue], [i[@"waiter"] intValue]); 3035 /* we found something that is blocking the correct threadid */ 3036 for (id j in winfos) { 3037 if ([j[@"waiter"] intValue] == [i[@"waiter"] intValue] && 3038 [j[@"wait_type"] intValue] == kThreadWaitPortReceive) { 3039 found_srp_waitinfo = true; 3040 T_EXPECT_EQ([j[@"wait_flags"] intValue], STACKSHOT_WAITINFO_FLAGS_SPECIALREPLY, 3041 "SRP waitinfo should be marked as a special reply"); 3042 break; 3043 } 3044 } 3045 3046 if (found_srp_waitinfo) { 3047 break; 3048 } 3049 } 3050 } 3051 } 3052 } 3053 3054 if (expect_sp_throttled) { 3055 NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"]; 3056 for (id i in tinfos) { 3057 if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_PORTFLAGS) 3058 && [i[@"turnstile_context"] intValue] == throttled_service_ctx) { 3059 int portlabel_id = [i[@"portlabel_id"] intValue]; 3060 T_LOG("[pid:%d] Turnstile (flags = 0x%x, ctx = %d, portlabel_id = %d)", pid, 3061 [i[@"turnstile_flags"] intValue], [i[@"turnstile_context"] intValue], portlabel_id); 3062 for (id portid in container[@"task_snapshots"][@"portlabels"]) { 3063 if (portlabel_id != [portid intValue]) { 3064 continue; 3065 } 3066 3067 NSMutableDictionary *portlabel = container[@"task_snapshots"][@"portlabels"][portid]; 3068 T_ASSERT_TRUE(portlabel != nil, "Found portlabel id: %d", [portid intValue]); 3069 NSString *portlabel_name = portlabel[@"portlabel_name"]; 3070 T_EXPECT_TRUE(portlabel_name != nil, "Found portlabel %s", portlabel_name.UTF8String); 3071 T_EXPECT_EQ_STR(portlabel_name.UTF8String, THROTTLED_SERVICE_NAME, "throttled service port name matches"); 3072 T_EXPECT_EQ(([portlabel[@"portlabel_flags"] intValue] & STACKSHOT_PORTLABEL_THROTTLED) != 0, 3073 is_throttled, "Port %s throttled", is_throttled ? "is" : "isn't"); 3074 found_throttled_service = true; 3075 break; 3076 } 3077 } 3078 3079 if (found_throttled_service) { 3080 break; 3081 } 3082 } 3083 } 3084 3085 if (expect_suspendinfo) { 3086 // TODO: rdar://112563110 3087 } 3088 3089 if (pid != getpid()) { 3090 break; 3091 } 3092 3093 T_EXPECT_EQ_STR(current_process_name(), 3094 [task_snapshot[@"ts_p_comm"] UTF8String], 3095 "current process name matches in stackshot"); 3096 3097 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 3098 T_ASSERT_BITS_NOTSET(task_flags, kTerminatedSnapshot, "current process not marked as terminated"); 3099 T_ASSERT_BITS_NOTSET(task_flags, kTaskIsTranslated, "current process not marked as translated"); 3100 3101 T_QUIET; 3102 T_EXPECT_LE(pid, [task_snapshot[@"ts_unique_pid"] intValue], 3103 "unique pid is greater than pid"); 3104 3105 NSDictionary* task_cpu_architecture = container[@"task_snapshots"][@"task_cpu_architecture"]; 3106 T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cputype"], "have cputype"); 3107 T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cpusubtype"], "have cputype"); 3108 int cputype = [task_cpu_architecture[@"cputype"] intValue]; 3109 int cpusubtype = [task_cpu_architecture[@"cpusubtype"] intValue]; 3110 3111 struct proc_archinfo archinfo; 3112 int retval = proc_pidinfo(pid, PROC_PIDARCHINFO, 0, &archinfo, sizeof(archinfo)); 3113 T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDARCHINFO) returned a value > 0"); 3114 T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(struct proc_archinfo), "proc_pidinfo call for PROC_PIDARCHINFO returned expected size"); 3115 T_QUIET; T_EXPECT_EQ(cputype, archinfo.p_cputype, "cpu type is correct"); 3116 T_QUIET; T_EXPECT_EQ(cpusubtype, archinfo.p_cpusubtype, "cpu subtype is correct"); 3117 3118 NSDictionary * codesigning_info = container[@"task_snapshots"][@"stackshot_task_codesigning_info"]; 3119 T_QUIET; T_ASSERT_NOTNULL(codesigning_info[@"csflags"], "have csflags"); 3120 uint64_t flags = [codesigning_info[@"csflags"] unsignedLongLongValue]; 3121 T_QUIET; T_EXPECT_GT(flags, 0, "nonzero csflags"); 3122 3123 T_QUIET; T_ASSERT_NOTNULL(container[@"task_snapshots"][@"jetsam_coalition"], "have jetsam coalition"); 3124 uint64_t jetsam_coalition = [container[@"task_snapshots"][@"jetsam_coalition"] unsignedLongLongValue]; 3125 T_QUIET; T_EXPECT_GT(jetsam_coalition, 0, "nonzero jetsam coalition"); 3126 3127 bool found_main_thread = false; 3128 uint64_t main_thread_id = -1ULL; 3129 bool found_null_kernel_frame = false; 3130 for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) { 3131 NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key]; 3132 NSDictionary *thread_snap = thread[@"thread_snapshot"]; 3133 3134 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_thread_id"] intValue], 0, 3135 "thread ID of thread in current task is valid"); 3136 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_base_priority"] intValue], 0, 3137 "base priority of thread in current task is valid"); 3138 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_sched_priority"] intValue], 0, 3139 "scheduling priority of thread in current task is valid"); 3140 3141 NSString *pth_name = thread[@"pth_name"]; 3142 if (pth_name != nil && [pth_name isEqualToString:@TEST_THREAD_NAME]) { 3143 found_main_thread = true; 3144 main_thread_id = [thread_snap[@"ths_thread_id"] unsignedLongLongValue]; 3145 3146 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_total_syscalls"] intValue], 0, 3147 "total syscalls of current thread is valid"); 3148 3149 NSDictionary *cpu_times = thread[@"cpu_times"]; 3150 T_EXPECT_GE([cpu_times[@"runnable_time"] intValue], 3151 [cpu_times[@"system_time"] intValue] + 3152 [cpu_times[@"user_time"] intValue], 3153 "runnable time of current thread is valid"); 3154 } 3155 if (!found_null_kernel_frame) { 3156 for (NSNumber *frame in thread[@"kernel_frames"]) { 3157 if (frame.unsignedLongValue == 0) { 3158 found_null_kernel_frame = true; 3159 break; 3160 } 3161 } 3162 } 3163 if (expect_asyncstack && !found_asyncstack && 3164 asyncstack_threadid == [thread_snap[@"ths_thread_id"] unsignedLongLongValue]) { 3165 found_asyncstack = true; 3166 NSArray* async_stack = thread[@"user_async_stack_frames"]; 3167 NSNumber* start_idx = thread[@"user_async_start_index"]; 3168 NSArray* user_stack = thread[@"user_stack_frames"]; 3169 T_QUIET; T_ASSERT_NOTNULL(async_stack, "async thread %#llx has user_async_stack_frames", asyncstack_threadid); 3170 T_QUIET; T_ASSERT_NOTNULL(start_idx, "async thread %#llx has user_async_start_index", asyncstack_threadid); 3171 T_QUIET; T_ASSERT_NOTNULL(user_stack, "async thread %#llx has user_stack_frames", asyncstack_threadid); 3172 T_QUIET; T_ASSERT_EQ(async_stack.count, asyncstack_stack.count, 3173 "actual async_stack count == expected async_stack count"); 3174 for (size_t i = 0; i < async_stack.count; i++) { 3175 T_EXPECT_EQ([async_stack[i][@"lr"] unsignedLongLongValue], 3176 [asyncstack_stack[i] unsignedLongLongValue], "frame %zu matches", i); 3177 } 3178 } 3179 3180 } 3181 T_EXPECT_TRUE(found_main_thread, "found main thread for current task in stackshot"); 3182 T_EXPECT_FALSE(found_null_kernel_frame, "should not see any NULL kernel frames"); 3183 3184 if (expect_turnstile_lock && !found_turnstile_lock) { 3185 NSArray *tsinfos = container[@"task_snapshots"][@"thread_turnstileinfo"]; 3186 3187 for (id i in tsinfos) { 3188 if ([i[@"turnstile_context"] unsignedLongLongValue] == main_thread_id) { 3189 found_turnstile_lock = true; 3190 break; 3191 } 3192 } 3193 } 3194 break; 3195 } 3196 case STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO: { 3197 // Legacy shared cache info 3198 struct dyld_shared_cache_loadinfo *payload = kcdata_iter_payload(iter); 3199 T_ASSERT_EQ((size_t)kcdata_iter_size(iter), sizeof(*payload), "valid dyld_shared_cache_loadinfo struct"); 3200 3201 check_shared_cache_uuid(payload->sharedCacheUUID); 3202 3203 T_EXPECT_LE(payload->sharedCacheUnreliableSlidBaseAddress, 3204 payload->sharedCacheSlidFirstMapping, 3205 "SlidBaseAddress <= SlidFirstMapping"); 3206 T_EXPECT_GE(payload->sharedCacheUnreliableSlidBaseAddress + (7ull << 32) + (1ull << 29), 3207 payload->sharedCacheSlidFirstMapping, 3208 "SlidFirstMapping should be within 28.5gigs of SlidBaseAddress"); 3209 3210 size_t shared_cache_len; 3211 const void *addr = _dyld_get_shared_cache_range(&shared_cache_len); 3212 T_EXPECT_EQ((uint64_t)addr, payload->sharedCacheSlidFirstMapping, 3213 "SlidFirstMapping should match shared_cache_range"); 3214 3215 /* 3216 * check_shared_cache_uuid() asserts on failure, so we must have 3217 * found the shared cache UUID to be correct. 3218 */ 3219 found_shared_cache_uuid = true; 3220 break; 3221 } 3222 } 3223 } 3224 3225 if (expect_sharedcache_child) { 3226 T_QUIET; T_ASSERT_TRUE(found_sharedcache_child, "found sharedcache child in kcdata"); 3227 T_QUIET; T_ASSERT_TRUE(found_sharedcache_self, "found self in kcdata"); 3228 if (found_sharedcache_child && found_sharedcache_self) { 3229 T_QUIET; T_ASSERT_NE(sharedcache_child_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache child should have shared region"); 3230 T_QUIET; T_ASSERT_NE(sharedcache_self_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache: self should have shared region"); 3231 if (sharedcache_self_flags == kTaskSharedRegionSystem && !sharedcache_child_sameaddr) { 3232 /* If we're in the system shared region, and the child has a different address, child must have an Other shared region */ 3233 T_ASSERT_EQ(sharedcache_child_flags, (uint64_t)kTaskSharedRegionOther, 3234 "sharedcache child should have Other shared region"); 3235 } 3236 } 3237 } 3238 3239 if (expect_transitioning_task) { 3240 T_QUIET; T_ASSERT_TRUE(found_transitioning_task, "found transitioning_task child in kcdata"); 3241 } 3242 3243 if (expect_exec_inprogress) { 3244 T_QUIET; T_ASSERT_GT(exec_inprogress_found, 0, "found at least 1 task for execing process"); 3245 } 3246 3247 if (expect_zombie_child) { 3248 T_QUIET; T_ASSERT_TRUE(found_zombie_child, "found zombie child in kcdata"); 3249 } 3250 3251 if (expect_postexec_child) { 3252 T_QUIET; T_ASSERT_TRUE(found_postexec_child, "found post-exec child in kcdata"); 3253 } 3254 3255 if (expect_translated_child) { 3256 T_QUIET; T_ASSERT_TRUE(found_translated_child, "found translated child in kcdata"); 3257 } 3258 3259 if (expect_shared_cache_layout) { 3260 T_QUIET; T_ASSERT_TRUE(found_shared_cache_layout, "shared cache layout found in kcdata"); 3261 } 3262 3263 if (expect_shared_cache_uuid) { 3264 T_QUIET; T_ASSERT_TRUE(found_shared_cache_uuid, "shared cache UUID found in kcdata"); 3265 } 3266 3267 if (expect_dispatch_queue_label) { 3268 T_QUIET; T_ASSERT_TRUE(found_dispatch_queue_label, "dispatch queue label found in kcdata"); 3269 } 3270 3271 if (expect_turnstile_lock) { 3272 T_QUIET; T_ASSERT_TRUE(found_turnstile_lock, "found expected deadlock"); 3273 } 3274 3275 if (expect_cseg_waitinfo) { 3276 T_QUIET; T_ASSERT_TRUE(found_cseg_waitinfo, "found c_seg waitinfo"); 3277 } 3278 3279 if (expect_srp_waitinfo) { 3280 T_QUIET; T_ASSERT_TRUE(found_srp_waitinfo, "found special reply port waitinfo"); 3281 } 3282 3283 if (expect_sp_throttled) { 3284 T_QUIET; T_ASSERT_TRUE(found_throttled_service, "found the throttled service"); 3285 } 3286 3287 if (expect_asyncstack) { 3288 T_QUIET; T_ASSERT_TRUE(found_asyncstack, "found async stack threadid"); 3289 } 3290 3291 if ([extra objectForKey:no_exclaves_key] != nil) { 3292 T_QUIET; T_ASSERT_FALSE(found_exclaves, "did not find any Exclaves data"); 3293 } 3294 3295 3296 T_ASSERT_FALSE(KCDATA_ITER_FOREACH_FAILED(iter), "successfully iterated kcdata"); 3297 3298 free(inflatedBufferBase); 3299} 3300 3301static const char * 3302current_process_name(void) 3303{ 3304 static char name[64]; 3305 3306 if (!name[0]) { 3307 int ret = proc_name(getpid(), name, sizeof(name)); 3308 T_QUIET; 3309 T_ASSERT_POSIX_SUCCESS(ret, "proc_name failed for current process"); 3310 } 3311 3312 return name; 3313} 3314 3315static void 3316initialize_thread(void) 3317{ 3318 int ret = pthread_setname_np(TEST_THREAD_NAME); 3319 T_QUIET; 3320 T_ASSERT_POSIX_ZERO(ret, "set thread name to %s", TEST_THREAD_NAME); 3321} 3322