xref: /xnu-10063.121.3/tests/stackshot_tests.m (revision 2c2f96dc2b9a4408a43d3150ae9c105355ca3daa)
1#include <darwintest.h>
2#include <darwintest_utils.h>
3#include <darwintest_multiprocess.h>
4#include <kern/debug.h>
5#include <kern/kern_cdata.h>
6#include <kern/block_hint.h>
7#include <kdd.h>
8#include <libproc.h>
9#include <os/atomic_private.h>
10#include <mach-o/dyld.h>
11#include <mach-o/dyld_images.h>
12#include <mach-o/dyld_priv.h>
13#include <sys/syscall.h>
14#include <sys/stackshot.h>
15#include <uuid/uuid.h>
16#include <servers/bootstrap.h>
17#include <pthread/workqueue_private.h>
18#include <dispatch/private.h>
19#include <stdalign.h>
20
21#import <zlib.h>
22#import <IOKit/IOKitLib.h>
23#import <IOKit/IOKitLibPrivate.h>
24#import <IOKit/IOKitKeysPrivate.h>
25
26
27
28T_GLOBAL_META(
29		T_META_NAMESPACE("xnu.stackshot"),
30		T_META_RADAR_COMPONENT_NAME("xnu"),
31		T_META_RADAR_COMPONENT_VERSION("stackshot"),
32		T_META_OWNER("jonathan_w_adams"),
33		T_META_CHECK_LEAKS(false),
34		T_META_ASROOT(true)
35		);
36
37static const char *current_process_name(void);
38static void verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count);
39static void parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra);
40static void parse_thread_group_stackshot(void **sbuf, size_t sslen);
41static uint64_t stackshot_timestamp(void *ssbuf, size_t sslen);
42static void initialize_thread(void);
43
44static uint64_t global_flags = 0;
45
46#define DEFAULT_STACKSHOT_BUFFER_SIZE (1024 * 1024)
47#define MAX_STACKSHOT_BUFFER_SIZE     (6 * 1024 * 1024)
48
49#define SRP_SERVICE_NAME "com.apple.xnu.test.stackshot.special_reply_port"
50
51/* bit flags for parse_stackshot */
52#define PARSE_STACKSHOT_DELTA                0x01
53#define PARSE_STACKSHOT_ZOMBIE               0x02
54#define PARSE_STACKSHOT_SHAREDCACHE_LAYOUT   0x04
55#define PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL 0x08
56#define PARSE_STACKSHOT_TURNSTILEINFO        0x10
57#define PARSE_STACKSHOT_POSTEXEC             0x20
58#define PARSE_STACKSHOT_WAITINFO_CSEG        0x40
59#define PARSE_STACKSHOT_WAITINFO_SRP         0x80
60#define PARSE_STACKSHOT_TRANSLATED           0x100
61#define PARSE_STACKSHOT_SHAREDCACHE_FLAGS    0x200
62#define PARSE_STACKSHOT_EXEC_INPROGRESS      0x400
63#define PARSE_STACKSHOT_TRANSITIONING        0x800
64#define PARSE_STACKSHOT_ASYNCSTACK           0x1000
65#define PARSE_STACKSHOT_COMPACTINFO          0x2000 /* TODO: rdar://88789261 */
66#define PARSE_STACKSHOT_DRIVERKIT            0x4000
67#define PARSE_STACKSHOT_THROTTLED_SP         0x8000
68#define PARSE_STACKSHOT_SUSPENDINFO          0x10000
69
70/* keys for 'extra' dictionary for parse_stackshot */
71static const NSString* zombie_child_pid_key = @"zombie_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_ZOMBIE
72static const NSString* postexec_child_unique_pid_key = @"postexec_child_unique_pid";  // -> @(unique_pid), required for PARSE_STACKSHOT_POSTEXEC
73static const NSString* cseg_expected_threadid_key = @"cseg_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_WAITINFO_CSEG
74static const NSString* srp_expected_threadid_key = @"srp_expected_threadid"; // -> @(tid), this or ..._pid required for PARSE_STACKSHOT_WAITINFO_SRP
75static const NSString* srp_expected_pid_key = @"srp_expected_pid"; // -> @(pid), this or ..._threadid required for PARSE_STACKSHOT_WAITINFO_SRP
76static const NSString* translated_child_pid_key = @"translated_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSLATED
77static const NSString* sharedcache_child_pid_key = @"sharedcache_child_pid"; // @(pid), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS
78static const NSString* sharedcache_child_sameaddr_key = @"sharedcache_child_sameaddr"; // @(0 or 1), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS
79static const NSString* exec_inprogress_pid_key = @"exec_inprogress_pid";
80static const NSString* exec_inprogress_found_key = @"exec_inprogress_found";  // callback when inprogress is found
81static const NSString* transitioning_pid_key = @"transitioning_task_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSITIONING
82static const NSString* asyncstack_expected_threadid_key = @"asyncstack_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_ASYNCSTACK
83static const NSString* asyncstack_expected_stack_key = @"asyncstack_expected_stack"; // -> @[pc...]), expected PCs for asyncstack
84static const NSString* driverkit_found_key = @"driverkit_found_key"; // callback when driverkit process is found. argument is the process pid.
85static const NSString* sp_throttled_expected_ctxt_key = @"sp_throttled_expected_ctxt_key"; // -> @(ctxt), required for PARSE_STACKSHOT_THROTTLED_SP
86static const NSString* sp_throttled_expect_flag = @"sp_throttled_expect_flag"; // -> @(is_throttled), required for PARSE_STACKSHOT_THROTTLED_SP
87static const NSString* no_exclaves_key = @"no_exclaves";
88
89#define TEST_STACKSHOT_QUEUE_LABEL        "houston.we.had.a.problem"
90#define TEST_STACKSHOT_QUEUE_LABEL_LENGTH sizeof(TEST_STACKSHOT_QUEUE_LABEL)
91
92#define THROTTLED_SERVICE_NAME "com.apple.xnu.test.stackshot.throttled_service"
93
94T_DECL(microstackshots, "test the microstackshot syscall")
95{
96	void *buf = NULL;
97	unsigned int size = DEFAULT_STACKSHOT_BUFFER_SIZE;
98
99	while (1) {
100		buf = malloc(size);
101		T_QUIET; T_ASSERT_NOTNULL(buf, "allocated stackshot buffer");
102
103#pragma clang diagnostic push
104#pragma clang diagnostic ignored "-Wdeprecated-declarations"
105		int len = syscall(SYS_microstackshot, buf, size,
106				(uint32_t) STACKSHOT_GET_MICROSTACKSHOT);
107#pragma clang diagnostic pop
108		if (len == ENOSYS) {
109			T_SKIP("microstackshot syscall failed, likely not compiled with CONFIG_TELEMETRY");
110		}
111		if (len == -1 && errno == ENOSPC) {
112			/* syscall failed because buffer wasn't large enough, try again */
113			free(buf);
114			buf = NULL;
115			size *= 2;
116			T_ASSERT_LE(size, (unsigned int)MAX_STACKSHOT_BUFFER_SIZE,
117					"growing stackshot buffer to sane size");
118			continue;
119		}
120		T_ASSERT_POSIX_SUCCESS(len, "called microstackshot syscall");
121		break;
122    }
123
124	T_EXPECT_EQ(*(uint32_t *)buf,
125			(uint32_t)STACKSHOT_MICRO_SNAPSHOT_MAGIC,
126			"magic value for microstackshot matches");
127
128	free(buf);
129}
130
131struct scenario {
132	const char *name;
133	uint64_t flags;
134	bool quiet;
135	bool should_fail;
136	bool maybe_unsupported;
137	bool maybe_enomem;
138	bool no_recordfile;
139	pid_t target_pid;
140	bool target_kernel;
141	uint64_t since_timestamp;
142	uint32_t size_hint;
143	dt_stat_time_t timer;
144};
145
146static void
147quiet(struct scenario *scenario)
148{
149	if (scenario->timer || scenario->quiet) {
150		T_QUIET;
151	}
152}
153
154static void
155take_stackshot(struct scenario *scenario, bool compress_ok, void (^cb)(void *buf, size_t size))
156{
157start:
158	initialize_thread();
159
160	void *config = stackshot_config_create();
161	quiet(scenario);
162	T_ASSERT_NOTNULL(config, "created stackshot config");
163
164	int ret = stackshot_config_set_flags(config, scenario->flags | global_flags);
165	quiet(scenario);
166	T_ASSERT_POSIX_ZERO(ret, "set flags %#llx on stackshot config", scenario->flags);
167
168	if (scenario->size_hint > 0) {
169		ret = stackshot_config_set_size_hint(config, scenario->size_hint);
170		quiet(scenario);
171		T_ASSERT_POSIX_ZERO(ret, "set size hint %" PRIu32 " on stackshot config",
172				scenario->size_hint);
173	}
174
175	if (scenario->target_pid > 0) {
176		ret = stackshot_config_set_pid(config, scenario->target_pid);
177		quiet(scenario);
178		T_ASSERT_POSIX_ZERO(ret, "set target pid %d on stackshot config",
179				scenario->target_pid);
180	} else if (scenario->target_kernel) {
181		ret = stackshot_config_set_pid(config, 0);
182		quiet(scenario);
183		T_ASSERT_POSIX_ZERO(ret, "set kernel target on stackshot config");
184	}
185
186	if (scenario->since_timestamp > 0) {
187		ret = stackshot_config_set_delta_timestamp(config, scenario->since_timestamp);
188		quiet(scenario);
189		T_ASSERT_POSIX_ZERO(ret, "set since timestamp %" PRIu64 " on stackshot config",
190				scenario->since_timestamp);
191	}
192
193	int retries_remaining = 5;
194
195retry: ;
196	uint64_t start_time = mach_absolute_time();
197	ret = stackshot_capture_with_config(config);
198	uint64_t end_time = mach_absolute_time();
199
200	if (scenario->should_fail) {
201		T_EXPECTFAIL;
202		T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config");
203		return;
204	}
205
206	if (ret == EBUSY || ret == ETIMEDOUT) {
207		if (retries_remaining > 0) {
208			if (!scenario->timer) {
209				T_LOG("stackshot_capture_with_config failed with %s (%d), retrying",
210						strerror(ret), ret);
211			}
212
213			retries_remaining--;
214			goto retry;
215		} else {
216			T_ASSERT_POSIX_ZERO(ret,
217					"called stackshot_capture_with_config (no retries remaining)");
218		}
219	} else if ((ret == ENOTSUP) && scenario->maybe_unsupported) {
220		T_SKIP("kernel indicated this stackshot configuration is not supported");
221	} else if ((ret == ENOMEM) && scenario->maybe_enomem) {
222		T_SKIP("insufficient available memory to run test");
223	} else {
224		quiet(scenario);
225		T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config");
226	}
227
228	if (scenario->timer) {
229		dt_stat_mach_time_add(scenario->timer, end_time - start_time);
230	}
231	void *buf = stackshot_config_get_stackshot_buffer(config);
232	size_t size = stackshot_config_get_stackshot_size(config);
233	if (scenario->name && !scenario->no_recordfile) {
234		char sspath[MAXPATHLEN];
235		strlcpy(sspath, scenario->name, sizeof(sspath));
236		strlcat(sspath, ".kcdata", sizeof(sspath));
237		T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(sspath, sizeof(sspath)),
238				"create result file path");
239
240		if (!scenario->quiet) {
241			T_LOG("writing stackshot to %s", sspath);
242		}
243
244		FILE *f = fopen(sspath, "w");
245		T_WITH_ERRNO; T_QUIET; T_ASSERT_NOTNULL(f,
246				"open stackshot output file");
247
248		size_t written = fwrite(buf, size, 1, f);
249		T_QUIET; T_ASSERT_POSIX_SUCCESS(written, "wrote stackshot to file");
250
251		fclose(f);
252	}
253	cb(buf, size);
254	if (compress_ok) {
255		if (global_flags == 0) {
256			T_LOG("Restarting test with compression");
257			global_flags |= STACKSHOT_DO_COMPRESS;
258			goto start;
259		} else {
260			global_flags = 0;
261		}
262	}
263
264	ret = stackshot_config_dealloc(config);
265	T_QUIET; T_EXPECT_POSIX_ZERO(ret, "deallocated stackshot config");
266}
267
268T_DECL(simple_compressed, "take a simple compressed stackshot")
269{
270	struct scenario scenario = {
271		.name = "kcdata_compressed",
272		.flags = (STACKSHOT_DO_COMPRESS | STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS |
273				STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
274	};
275
276	T_LOG("taking compressed kcdata stackshot");
277	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
278		parse_stackshot(0, ssbuf, sslen, nil);
279	});
280}
281
282T_DECL(panic_compressed, "take a compressed stackshot with the same flags as a panic stackshot")
283{
284	uint64_t stackshot_flags = (STACKSHOT_SAVE_KEXT_LOADINFO |
285			STACKSHOT_SAVE_LOADINFO |
286			STACKSHOT_KCDATA_FORMAT |
287			STACKSHOT_ENABLE_BT_FAULTING |
288			STACKSHOT_ENABLE_UUID_FAULTING |
289			STACKSHOT_DO_COMPRESS |
290			STACKSHOT_NO_IO_STATS |
291			STACKSHOT_THREAD_WAITINFO |
292#if TARGET_OS_MAC
293			STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT |
294#endif
295			STACKSHOT_DISABLE_LATENCY_INFO);
296
297	struct scenario scenario = {
298		.name = "kcdata_panic_compressed",
299		.flags = stackshot_flags,
300	};
301
302	T_LOG("taking compressed kcdata stackshot with panic flags");
303	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
304		parse_stackshot(0, ssbuf, sslen, nil);
305	});
306}
307
308T_DECL(kcdata, "test that kcdata stackshots can be taken and parsed")
309{
310	struct scenario scenario = {
311		.name = "kcdata",
312		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS |
313				STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
314	};
315
316	T_LOG("taking kcdata stackshot");
317	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
318		parse_stackshot(0, ssbuf, sslen, nil);
319	});
320}
321
322static void
323get_stats(stackshot_stats_t *_Nonnull out)
324{
325	size_t oldlen = sizeof (*out);
326	bzero(out, oldlen);
327	int result = sysctlbyname("kern.stackshot_stats", out, &oldlen, NULL, 0);
328	T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(result, "reading \"kern.stackshot_stats\" sysctl should succeed");
329	T_EXPECT_EQ(oldlen, sizeof (*out), "kernel should update full stats structure");
330}
331
332static void
333log_stats(mach_timebase_info_data_t timebase, uint64_t now, const char *name, stackshot_stats_t stat)
334{
335	uint64_t last_ago = (now - stat.ss_last_start) * timebase.numer / timebase.denom;
336	uint64_t last_duration = (stat.ss_last_end - stat.ss_last_start) * timebase.numer / timebase.denom;
337	uint64_t total_duration = (stat.ss_duration) * timebase.numer / timebase.denom;
338
339	uint64_t nanosec = 1000000000llu;
340	T_LOG("%s: %8lld stackshots, %10lld.%09lld total nsecs, last %lld.%09lld secs ago, %lld.%09lld secs long",
341		name, stat.ss_count,
342		total_duration / nanosec, total_duration % nanosec,
343		last_ago / nanosec, last_ago % nanosec,
344		last_duration / nanosec, last_duration % nanosec);
345}
346
347T_DECL(stats, "test that stackshot stats can be read out and change when a stackshot occurs")
348{
349	mach_timebase_info_data_t timebase = {0, 0};
350	mach_timebase_info(&timebase);
351
352	struct scenario scenario = {
353		.name = "kcdata",
354		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
355	};
356
357	stackshot_stats_t pre, post;
358
359	get_stats(&pre);
360
361	T_LOG("taking kcdata stackshot");
362	take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) {
363		(void)0;
364	});
365
366	get_stats(&post);
367
368	uint64_t now = mach_absolute_time();
369
370	log_stats(timebase, now, "  pre", pre);
371	log_stats(timebase, now, " post", post);
372
373	int64_t delta_stackshots = (int64_t)(post.ss_count - pre.ss_count);
374	int64_t delta_duration = (int64_t)(post.ss_duration - pre.ss_duration) * (int64_t)timebase.numer / (int64_t)timebase.denom;
375	int64_t delta_nsec = delta_duration % 1000000000ll;
376	if (delta_nsec < 0) {
377	    delta_nsec += 1000000000ll;
378	}
379	T_LOG("delta: %+8lld stackshots, %+10lld.%09lld total nsecs", delta_stackshots, delta_duration / 1000000000ll, delta_nsec);
380
381	T_EXPECT_LT(pre.ss_last_start, pre.ss_last_end, "pre: stackshot should take time");
382	T_EXPECT_LT(pre.ss_count, post.ss_count, "stackshot count should increase when a stackshot is taken");
383	T_EXPECT_LT(pre.ss_duration, post.ss_duration, "stackshot duration should increase when a stackshot is taken");
384	T_EXPECT_LT(pre.ss_last_end, post.ss_last_start, "previous end should be less than new start after a stackshot");
385	T_EXPECT_LT(post.ss_last_start, post.ss_last_end, "post: stackshot should take time");
386}
387
388T_DECL(kcdata_faulting, "test that kcdata stackshots while faulting can be taken and parsed")
389{
390	struct scenario scenario = {
391		.name = "faulting",
392		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
393				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
394				| STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING),
395	};
396
397	T_LOG("taking faulting stackshot");
398	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
399		parse_stackshot(0, ssbuf, sslen, nil);
400	});
401}
402
403T_DECL(bad_flags, "test a poorly-formed stackshot syscall")
404{
405	struct scenario scenario = {
406		.flags = STACKSHOT_SAVE_IN_KERNEL_BUFFER /* not allowed from user space */,
407		.should_fail = true,
408	};
409
410	T_LOG("attempting to take stackshot with kernel-only flag");
411	take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) {
412		T_ASSERT_FAIL("stackshot data callback called");
413	});
414}
415
416T_DECL(delta, "test delta stackshots")
417{
418	struct scenario scenario = {
419		.name = "delta",
420		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
421				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
422	};
423
424	T_LOG("taking full stackshot");
425	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
426		uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen);
427
428		T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time);
429
430		parse_stackshot(0, ssbuf, sslen, nil);
431
432		struct scenario delta_scenario = {
433			.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
434					| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
435					| STACKSHOT_COLLECT_DELTA_SNAPSHOT),
436			.since_timestamp = stackshot_time
437		};
438
439		take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) {
440			parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil);
441		});
442	});
443}
444
445T_DECL(shared_cache_layout, "test stackshot inclusion of shared cache layout")
446{
447	struct scenario scenario = {
448		.name = "shared_cache_layout",
449		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
450				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT |
451				STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT),
452	};
453
454	size_t shared_cache_length;
455	const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length);
456	if (cache_header == NULL) {
457		T_SKIP("Device not running with shared cache, skipping test...");
458	}
459
460	if (shared_cache_length == 0) {
461		T_SKIP("dyld reports that currently running shared cache has zero length");
462	}
463
464	T_LOG("taking stackshot with STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT set");
465	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
466		parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_LAYOUT, ssbuf, sslen, nil);
467	});
468}
469
470T_DECL(stress, "test that taking stackshots for 60 seconds doesn't crash the system")
471{
472	uint64_t max_diff_time = 60ULL /* seconds */ * 1000000000ULL;
473	uint64_t start_time;
474
475	struct scenario scenario = {
476		.name = "stress",
477		.quiet = true,
478		.flags = (STACKSHOT_KCDATA_FORMAT |
479				STACKSHOT_THREAD_WAITINFO |
480				STACKSHOT_SAVE_LOADINFO |
481				STACKSHOT_SAVE_KEXT_LOADINFO |
482				STACKSHOT_GET_GLOBAL_MEM_STATS |
483				STACKSHOT_SAVE_IMP_DONATION_PIDS |
484				STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT |
485				STACKSHOT_THREAD_GROUP |
486				STACKSHOT_SAVE_JETSAM_COALITIONS |
487				STACKSHOT_ASID |
488				STACKSHOT_EXCLAVES |
489				0),
490	};
491
492	start_time = clock_gettime_nsec_np(CLOCK_MONOTONIC);
493	while (clock_gettime_nsec_np(CLOCK_MONOTONIC) - start_time < max_diff_time) {
494		take_stackshot(&scenario, false, ^(void * __unused ssbuf,
495				size_t __unused sslen) {
496			printf(".");
497			fflush(stdout);
498		});
499
500		/*
501		 * After the first stackshot, there's no point in continuing to
502		 * write them to disk, and it wears down the SSDs.
503		 */
504		scenario.no_recordfile = true;
505
506		/* Leave some time for the testing infrastructure to catch up */
507		usleep(10000);
508
509	}
510	printf("\n");
511}
512
513T_DECL(dispatch_queue_label, "test that kcdata stackshots contain libdispatch queue labels")
514{
515	struct scenario scenario = {
516		.name = "kcdata",
517		.flags = (STACKSHOT_GET_DQ | STACKSHOT_KCDATA_FORMAT),
518	};
519	dispatch_semaphore_t child_ready_sem, parent_done_sem;
520	dispatch_queue_t dq;
521
522#if TARGET_OS_WATCH
523	T_SKIP("This test is flaky on watches: 51663346");
524#endif
525
526	child_ready_sem = dispatch_semaphore_create(0);
527	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "dqlabel child semaphore");
528
529	parent_done_sem = dispatch_semaphore_create(0);
530	T_QUIET; T_ASSERT_NOTNULL(parent_done_sem, "dqlabel parent semaphore");
531
532	dq = dispatch_queue_create(TEST_STACKSHOT_QUEUE_LABEL, NULL);
533	T_QUIET; T_ASSERT_NOTNULL(dq, "dispatch queue");
534
535	/* start the helper thread */
536	dispatch_async(dq, ^{
537			dispatch_semaphore_signal(child_ready_sem);
538
539			dispatch_semaphore_wait(parent_done_sem, DISPATCH_TIME_FOREVER);
540	});
541
542	/* block behind the child starting up */
543	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
544
545	T_LOG("taking kcdata stackshot with libdispatch queue labels");
546	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
547		parse_stackshot(PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL, ssbuf, sslen, nil);
548	});
549
550	dispatch_semaphore_signal(parent_done_sem);
551}
552
553#define CACHEADDR_ENV "STACKSHOT_TEST_DYLDADDR"
554T_HELPER_DECL(spawn_reslide_child, "child process to spawn with alternate slide")
555{
556	size_t shared_cache_len;
557	const void *addr, *prevaddr;
558	uintmax_t v;
559	char *endptr;
560
561	const char *cacheaddr_env = getenv(CACHEADDR_ENV);
562	T_QUIET; T_ASSERT_NOTNULL(cacheaddr_env, "getenv("CACHEADDR_ENV")");
563	errno = 0;
564	endptr = NULL;
565	v = strtoumax(cacheaddr_env, &endptr, 16);	/* read hex value */
566	T_WITH_ERRNO; T_QUIET; T_ASSERT_NE(v, 0l, "getenv(%s) = \"%s\" should be a non-zero hex number", CACHEADDR_ENV, cacheaddr_env);
567	T_QUIET; T_ASSERT_EQ(*endptr, 0, "getenv(%s) = \"%s\" endptr \"%s\" should be empty", CACHEADDR_ENV, cacheaddr_env, endptr);
568
569	prevaddr = (const void *)v;
570	addr = _dyld_get_shared_cache_range(&shared_cache_len);
571	T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address");
572
573	T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(getppid(), (addr == prevaddr) ? SIGUSR2 : SIGUSR1), "signaled parent to take stackshot");
574	for (;;) {
575		(void) pause();		/* parent will kill -9 us */
576	}
577}
578
579T_DECL(shared_cache_flags, "tests stackshot's task_ss_flags for the shared cache")
580{
581	posix_spawnattr_t		attr;
582	char *env_addr;
583	char path[PATH_MAX];
584	__block bool child_same_addr = false;
585
586	uint32_t path_size = sizeof(path);
587	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
588	char *args[] = { path, "-n", "spawn_reslide_child", NULL };
589	pid_t pid;
590	size_t shared_cache_len;
591	const void *addr;
592
593	dispatch_source_t child_diffsig_src, child_samesig_src;
594	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
595	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "shared_cache child semaphore");
596
597	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
598	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
599
600	signal(SIGUSR1, SIG_IGN);
601	signal(SIGUSR2, SIG_IGN);
602	child_samesig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
603	T_QUIET; T_ASSERT_NOTNULL(child_samesig_src, "dispatch_source_create (child_samesig_src)");
604	child_diffsig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR2, 0, signal_processing_q);
605	T_QUIET; T_ASSERT_NOTNULL(child_diffsig_src, "dispatch_source_create (child_diffsig_src)");
606
607	/* child will signal us depending on if their addr is the same or different */
608	dispatch_source_set_event_handler(child_samesig_src, ^{ child_same_addr = false; dispatch_semaphore_signal(child_ready_sem); });
609	dispatch_source_set_event_handler(child_diffsig_src, ^{ child_same_addr = true; dispatch_semaphore_signal(child_ready_sem); });
610	dispatch_activate(child_samesig_src);
611	dispatch_activate(child_diffsig_src);
612
613	addr = _dyld_get_shared_cache_range(&shared_cache_len);
614	T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address");
615
616	T_QUIET; T_ASSERT_POSIX_SUCCESS(asprintf(&env_addr, "%p", addr), "asprintf of env_addr succeeded");
617	T_QUIET; T_ASSERT_POSIX_SUCCESS(setenv(CACHEADDR_ENV, env_addr, true), "setting "CACHEADDR_ENV" to %s", env_addr);
618
619	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&attr), "posix_spawnattr_init");
620	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_setflags(&attr, _POSIX_SPAWN_RESLIDE), "posix_spawnattr_setflags");
621	int sp_ret = posix_spawn(&pid, path, NULL, &attr, args, environ);
622	T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
623
624	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
625	T_LOG("received signal from child (%s), capturing stackshot", child_same_addr ? "same shared cache addr" : "different shared cache addr");
626
627	struct scenario scenario = {
628		.name = "shared_cache_flags",
629		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
630				| STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT
631				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
632	};
633
634	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
635		int status;
636		/* First kill the child so we can reap it */
637		T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing spawned process");
638		T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on spawned child");
639		T_QUIET; T_ASSERT_EQ(!!WIFSIGNALED(status), 1, "waitpid status should be signalled");
640		T_QUIET; T_ASSERT_EQ(WTERMSIG(status), SIGKILL, "waitpid status should be SIGKILLed");
641
642		parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_FLAGS, ssbuf, sslen,
643			@{sharedcache_child_pid_key: @(pid), sharedcache_child_sameaddr_key: @(child_same_addr ? 1 : 0)});
644	});
645}
646
647T_DECL(transitioning_tasks, "test that stackshot contains transitioning task info", T_META_BOOTARGS_SET("enable_proc_exit_lpexit_spin=1"))
648{
649    int32_t sysctlValue = -1, numAttempts =0;
650    char path[PATH_MAX];
651    uint32_t path_size = sizeof(path);
652    T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
653    char *args[] = { path, "-n", "exec_child_preexec", NULL };
654
655    dispatch_source_t child_sig_src;
656    dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
657    T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
658
659    dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
660    T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
661
662    pid_t pid;
663
664    signal(SIGUSR1, SIG_IGN);
665    child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
666    T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
667
668    dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
669    dispatch_activate(child_sig_src);
670
671    T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), "set debug.proc_exit_lpexit_spin_pid=-1");
672
673    int proc_exit_spin_pos = 0 ;
674
675    while (0 == sysctlbyname("debug.proc_exit_lpexit_spin_pos", NULL, NULL, &proc_exit_spin_pos, sizeof(proc_exit_spin_pos))) {
676
677        T_LOG(" ##### Testing while spinning in proc_exit at position %d ##### ", proc_exit_spin_pos);
678
679        int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
680        T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
681
682        dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
683
684        struct proc_uniqidentifierinfo proc_info_data = { };
685        int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
686        T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
687        T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
688
689        T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec");
690
691	/* wait for a signal from post-exec child */
692        dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
693
694        T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &pid, sizeof(pid)), "set debug.proc_exit_lpexit_spin_pid =  %d, ", pid);
695
696        T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid);
697
698        sysctlValue = 0;
699        size_t len = sizeof(sysctlValue);
700        while (numAttempts < 5) {
701            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValue, &len, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning");
702            if (sysctlValue != 1) numAttempts++;
703            else break;
704            sleep(1);
705        }
706
707        T_ASSERT_EQ_UINT(sysctlValue, 1, "find spinning task in proc_exit()");
708
709        struct scenario scenario = {
710            .name = "transitioning_tasks",
711            .flags = (STACKSHOT_KCDATA_FORMAT)
712        };
713
714        take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
715            parse_stackshot(PARSE_STACKSHOT_TRANSITIONING, ssbuf, sslen, @{transitioning_pid_key: @(pid)});
716
717            // Kill the child
718            int sysctlValueB = -1;
719            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValueB, sizeof(sysctlValueB)), "set debug.proc_exit_lpexit_spin_pid=-1");
720            sleep(1);
721            size_t blen = sizeof(sysctlValueB);
722            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValueB, &blen, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning");
723            T_ASSERT_EQ_UINT(sysctlValueB, 0, "make sure nothing is spining in proc_exit()");
724            int status;
725            T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child");
726        });
727
728        proc_exit_spin_pos++;
729    }
730
731}
732
733static void *stuck_sysctl_thread(void *arg) {
734	int val = 1;
735	dispatch_semaphore_t child_thread_started = *(dispatch_semaphore_t *)arg;
736
737	dispatch_semaphore_signal(child_thread_started);
738	T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread");
739
740	return NULL;
741}
742
743T_HELPER_DECL(zombie_child, "child process to sample as a zombie")
744{
745	pthread_t pthread;
746	dispatch_semaphore_t child_thread_started = dispatch_semaphore_create(0);
747	T_QUIET; T_ASSERT_NOTNULL(child_thread_started, "zombie child thread semaphore");
748
749	/* spawn another thread to get stuck in the kernel, then call exit() to become a zombie */
750	T_QUIET; T_ASSERT_POSIX_SUCCESS(pthread_create(&pthread, NULL, stuck_sysctl_thread, &child_thread_started), "pthread_create");
751
752	dispatch_semaphore_wait(child_thread_started, DISPATCH_TIME_FOREVER);
753
754	/* sleep for a bit in the hope of ensuring that the other thread has called the sysctl before we signal the parent */
755	usleep(100);
756	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot");
757
758	exit(0);
759}
760
761T_DECL(zombie, "tests a stackshot of a zombie task with a thread stuck in the kernel")
762{
763	char path[PATH_MAX];
764	uint32_t path_size = sizeof(path);
765	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
766	char *args[] = { path, "-n", "zombie_child", NULL };
767
768	dispatch_source_t child_sig_src;
769	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
770	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "zombie child semaphore");
771
772	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
773	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
774
775	pid_t pid;
776
777	T_LOG("spawning a child");
778
779	signal(SIGUSR1, SIG_IGN);
780	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
781	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
782
783	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
784	dispatch_activate(child_sig_src);
785
786	int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
787	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
788
789	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
790
791	T_LOG("received signal from child, capturing stackshot");
792
793	struct proc_bsdshortinfo bsdshortinfo;
794	int retval, iterations_to_wait = 10;
795
796	while (iterations_to_wait > 0) {
797		retval = proc_pidinfo(pid, PROC_PIDT_SHORTBSDINFO, 0, &bsdshortinfo, sizeof(bsdshortinfo));
798		if ((retval == 0) && errno == ESRCH) {
799			T_LOG("unable to find child using proc_pidinfo, assuming zombie");
800			break;
801		}
802
803		T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDT_SHORTBSDINFO) returned a value > 0");
804		T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(bsdshortinfo), "proc_pidinfo call for PROC_PIDT_SHORTBSDINFO returned expected size");
805
806		if (bsdshortinfo.pbsi_flags & PROC_FLAG_INEXIT) {
807			T_LOG("child proc info marked as in exit");
808			break;
809		}
810
811		iterations_to_wait--;
812		if (iterations_to_wait == 0) {
813			/*
814			 * This will mark the test as failed but let it continue so we
815			 * don't leave a process stuck in the kernel.
816			 */
817			T_FAIL("unable to discover that child is marked as exiting");
818		}
819
820		/* Give the child a few more seconds to make it to exit */
821		sleep(5);
822	}
823
824	/* Give the child some more time to make it through exit */
825	sleep(10);
826
827	struct scenario scenario = {
828		.name = "zombie",
829		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
830				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
831	};
832
833	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
834		/* First unwedge the child so we can reap it */
835		int val = 1, status;
836		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child");
837
838		T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on zombie child");
839
840		parse_stackshot(PARSE_STACKSHOT_ZOMBIE, ssbuf, sslen, @{zombie_child_pid_key: @(pid)});
841	});
842}
843
844T_HELPER_DECL(exec_child_preexec, "child process pre-exec")
845{
846	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
847	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
848
849	signal(SIGUSR1, SIG_IGN);
850	dispatch_source_t parent_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
851	T_QUIET; T_ASSERT_NOTNULL(parent_sig_src, "dispatch_source_create (child_sig_src)");
852	dispatch_source_set_event_handler(parent_sig_src, ^{
853
854		// Parent took a timestamp then signaled us: exec into the next process
855
856		char path[PATH_MAX];
857		uint32_t path_size = sizeof(path);
858		T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
859		char *args[] = { path, "-n", "exec_child_postexec", NULL };
860
861		T_QUIET; T_ASSERT_POSIX_ZERO(execve(args[0], args, NULL), "execing into exec_child_postexec");
862	});
863	dispatch_activate(parent_sig_src);
864
865	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take timestamp");
866
867	sleep(100);
868	// Should never get here
869	T_FAIL("Received signal to exec from parent");
870}
871
872T_HELPER_DECL(exec_child_postexec, "child process post-exec to sample")
873{
874	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot");
875	sleep(100);
876	// Should never get here
877	T_FAIL("Killed by parent");
878}
879
880T_DECL(exec, "test getting full task snapshots for a task that execs")
881{
882	char path[PATH_MAX];
883	uint32_t path_size = sizeof(path);
884	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
885	char *args[] = { path, "-n", "exec_child_preexec", NULL };
886
887	dispatch_source_t child_sig_src;
888	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
889	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
890
891	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
892	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
893
894	pid_t pid;
895
896	T_LOG("spawning a child");
897
898	signal(SIGUSR1, SIG_IGN);
899	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
900	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
901
902	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
903	dispatch_activate(child_sig_src);
904
905	int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
906	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
907
908	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
909	uint64_t start_time = mach_absolute_time();
910
911	struct proc_uniqidentifierinfo proc_info_data = { };
912	int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
913	T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
914	T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
915	uint64_t unique_pid = proc_info_data.p_uniqueid;
916
917	T_LOG("received signal from pre-exec child, unique_pid is %llu, timestamp is %llu", unique_pid, start_time);
918
919	T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec");
920
921	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
922
923	T_LOG("received signal from post-exec child, capturing stackshot");
924
925	struct scenario scenario = {
926		.name = "exec",
927		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
928				  | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
929				  | STACKSHOT_COLLECT_DELTA_SNAPSHOT),
930		.since_timestamp = start_time
931	};
932
933	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
934		// Kill the child
935		int status;
936		T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid);
937		T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child");
938
939		parse_stackshot(PARSE_STACKSHOT_POSTEXEC | PARSE_STACKSHOT_DELTA, ssbuf, sslen, @{postexec_child_unique_pid_key: @(unique_pid)});
940	});
941}
942
943T_DECL(
944	exec_inprogress,
945	"test stackshots of processes in the middle of exec",
946	T_META_ENABLED(false) /* rdar://111691318 */)
947{
948	pid_t pid;
949	/* a BASH quine which execs itself as long as the parent doesn't exit */
950        char *bash_prog = "[[ $PPID -ne 1 ]] && exec /bin/bash -c \"$0\" \"$0\"";
951	char *args[] = { "/bin/bash", "-c", bash_prog, bash_prog, NULL };
952
953	posix_spawnattr_t sattr;
954	T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&sattr), "posix_spawnattr_init");
955	T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, &sattr, args, NULL), "spawn exec_inprogress_child");
956
957	struct scenario scenario = {
958		.name = "exec_inprogress",
959		.flags = (STACKSHOT_KCDATA_FORMAT),
960		.target_pid = pid,
961	};
962
963	int tries = 0;
964	int tries_limit = 30;
965	__block bool found = false;
966	__block uint64_t cid1 = 0, cid2 = 0;
967
968	for (tries = 0; !found && tries < tries_limit; tries++) {
969		take_stackshot(&scenario, false,
970		    ^( void *ssbuf, size_t sslen) {
971			parse_stackshot(PARSE_STACKSHOT_EXEC_INPROGRESS,
972			    ssbuf, sslen, @{
973				exec_inprogress_pid_key: @(pid),
974				exec_inprogress_found_key: ^(uint64_t id1, uint64_t id2) { found = true; cid1 = id1; cid2 = id2; }});
975		});
976	}
977	T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing exec loop");
978	T_ASSERT_TRUE(found, "able to find our execing process mid-exec in %d tries", tries);
979	T_ASSERT_NE(cid1, cid2, "container IDs for in-progress exec are unique");
980	T_PASS("found mid-exec process in %d tries", tries);
981}
982
983#ifdef _LP64
984#if __has_feature(ptrauth_calls)
985#define __ptrauth_swift_async_context_parent \
986  __ptrauth(ptrauth_key_process_independent_data, 1, 0xbda2)
987#define __ptrauth_swift_async_context_resume \
988  __ptrauth(ptrauth_key_function_pointer, 1, 0xd707)
989#else
990#define __ptrauth_swift_async_context_parent
991#define __ptrauth_swift_async_context_resume
992#endif
993// Add 1 to match the symbolication aid added by the stackshot backtracer.
994#define asyncstack_frame(x) ((uintptr_t)(void *)ptrauth_strip((void *)(x), ptrauth_key_function_pointer) + 1)
995
996// This struct fakes the Swift AsyncContext struct which is used by
997// the Swift concurrency runtime. We only care about the first 2 fields.
998struct fake_async_context {
999	struct fake_async_context* __ptrauth_swift_async_context_parent next;
1000	void(*__ptrauth_swift_async_context_resume resume_pc)(void);
1001};
1002
1003static void
1004level1_func()
1005{
1006}
1007static void
1008level2_func()
1009{
1010}
1011
1012// Create a chain of fake async contexts; sync with asyncstack_expected_stack below
1013static alignas(16) struct fake_async_context level1 = { 0, level1_func };
1014static alignas(16) struct fake_async_context level2 = { &level1, level2_func };
1015
1016struct async_test_semaphores {
1017	dispatch_semaphore_t child_ready_sem;	/* signal parent we're ready */
1018	dispatch_semaphore_t child_exit_sem;	/* parent tells us to go away */
1019};
1020
1021#define	ASYNCSTACK_THREAD_NAME "asyncstack_thread"
1022
1023static void __attribute__((noinline, not_tail_called))
1024expect_asyncstack(void *arg)
1025{
1026	struct async_test_semaphores *async_ts = arg;
1027
1028	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_setname_np(ASYNCSTACK_THREAD_NAME),
1029	     "set thread name to %s", ASYNCSTACK_THREAD_NAME);
1030
1031	/* Tell the main thread we're all set up, then wait for permission to exit */
1032	dispatch_semaphore_signal(async_ts->child_ready_sem);
1033	dispatch_semaphore_wait(async_ts->child_exit_sem, DISPATCH_TIME_FOREVER);
1034	usleep(1);	/* make sure we don't tailcall semaphore_wait */
1035}
1036
1037static void *
1038asyncstack_thread(void *arg)
1039{
1040	uint64_t *fp = __builtin_frame_address(0);
1041	// We cannot use a variable of pointer type, because this ABI is valid
1042	// on arm64_32 where pointers are 32bits, but the context pointer will
1043	// still be stored in a 64bits slot on the stack.
1044#if __has_feature(ptrauth_calls)
1045#define __stack_context_auth __ptrauth(ptrauth_key_process_dependent_data, 1, \
1046	        0xc31a)
1047	struct fake_async_context * __stack_context_auth ctx = &level2;
1048#else // __has_feature(ptrauth_calls)
1049	/* struct fake_async_context * */uint64_t ctx  = (uintptr_t)&level2;
1050#endif // !__has_feature(ptrauth_calls)
1051
1052	// The signature of an async frame on the OS stack is:
1053	// [ <AsyncContext address>, <Saved FP | (1<<60)>, <return address> ]
1054	// The Async context must be right before the saved FP on the stack. This
1055	// should happen naturally in an optimized build as it is the only
1056	// variable on the stack.
1057	// This function cannot use T_ASSERT_* becuse it changes the stack
1058	// layout.
1059	assert((uintptr_t)fp - (uintptr_t)&ctx == 8);
1060
1061	// Modify the saved FP on the stack to include the async frame marker
1062	*fp |= (0x1ULL << 60);
1063	expect_asyncstack(arg);
1064	return NULL;
1065}
1066
1067T_DECL(asyncstack, "test swift async stack entries")
1068{
1069	struct scenario scenario = {
1070		.name = "asyncstack",
1071		.flags = STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO,
1072	};
1073	struct async_test_semaphores async_ts = {
1074	    .child_ready_sem = dispatch_semaphore_create(0),
1075	    .child_exit_sem = dispatch_semaphore_create(0),
1076	};
1077	T_QUIET; T_ASSERT_NOTNULL(async_ts.child_ready_sem, "child_ready_sem alloc");
1078	T_QUIET; T_ASSERT_NOTNULL(async_ts.child_exit_sem, "child_exit_sem alloc");
1079
1080	pthread_t pthread;
1081	__block uint64_t threadid = 0;
1082	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_create(&pthread, NULL, asyncstack_thread, &async_ts), "pthread_create");
1083	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_threadid_np(pthread, &threadid), "pthread_threadid_np");
1084
1085	dispatch_semaphore_wait(async_ts.child_ready_sem, DISPATCH_TIME_FOREVER);
1086
1087	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1088		parse_stackshot(PARSE_STACKSHOT_ASYNCSTACK, ssbuf, sslen, @{
1089		    asyncstack_expected_threadid_key: @(threadid),
1090		       asyncstack_expected_stack_key: @[ @(asyncstack_frame(level2_func)), @(asyncstack_frame(level1_func)) ],
1091		});
1092	});
1093
1094	dispatch_semaphore_signal(async_ts.child_exit_sem);
1095	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_join(pthread, NULL), "wait for thread");
1096
1097}
1098#endif /* #ifdef _LP64 */
1099
1100static uint32_t
1101get_user_promotion_basepri(void)
1102{
1103	mach_msg_type_number_t count = THREAD_POLICY_STATE_COUNT;
1104	struct thread_policy_state thread_policy;
1105	boolean_t get_default = FALSE;
1106	mach_port_t thread_port = pthread_mach_thread_np(pthread_self());
1107
1108	kern_return_t kr = thread_policy_get(thread_port, THREAD_POLICY_STATE,
1109	    (thread_policy_t)&thread_policy, &count, &get_default);
1110	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_policy_get");
1111	return thread_policy.thps_user_promotion_basepri;
1112}
1113
1114static int
1115get_pri(thread_t thread_port)
1116{
1117	kern_return_t kr;
1118
1119	thread_extended_info_data_t extended_info;
1120	mach_msg_type_number_t count = THREAD_EXTENDED_INFO_COUNT;
1121	kr = thread_info(thread_port, THREAD_EXTENDED_INFO,
1122	    (thread_info_t)&extended_info, &count);
1123
1124	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_info");
1125
1126	return extended_info.pth_curpri;
1127}
1128
1129
1130T_DECL(turnstile_singlehop, "turnstile single hop test")
1131{
1132	dispatch_queue_t dq1, dq2;
1133	dispatch_semaphore_t sema_x;
1134	dispatch_queue_attr_t dq1_attr, dq2_attr;
1135	__block qos_class_t main_qos = 0;
1136	__block int main_relpri = 0, main_relpri2 = 0, main_afterpri = 0;
1137	struct scenario scenario = {
1138		.name = "turnstile_singlehop",
1139		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1140	};
1141	dq1_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_UTILITY, 0);
1142	dq2_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_USER_INITIATED, 0);
1143	pthread_mutex_t lock_a = PTHREAD_MUTEX_INITIALIZER;
1144	pthread_mutex_t lock_b = PTHREAD_MUTEX_INITIALIZER;
1145
1146	pthread_mutex_t *lockap = &lock_a, *lockbp = &lock_b;
1147
1148	dq1 = dispatch_queue_create("q1", dq1_attr);
1149	dq2 = dispatch_queue_create("q2", dq2_attr);
1150	sema_x = dispatch_semaphore_create(0);
1151
1152	pthread_mutex_lock(lockap);
1153	dispatch_async(dq1, ^{
1154		pthread_mutex_lock(lockbp);
1155		T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class");
1156		T_LOG("The priority of q1 is %d\n", get_pri(mach_thread_self()));
1157		dispatch_semaphore_signal(sema_x);
1158		pthread_mutex_lock(lockap);
1159	});
1160	dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER);
1161
1162	T_LOG("Async1 completed");
1163
1164	pthread_set_qos_class_self_np(QOS_CLASS_UTILITY, 0);
1165	T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class");
1166	T_LOG("The priority of main is %d\n", get_pri(mach_thread_self()));
1167	main_relpri = get_pri(mach_thread_self());
1168
1169	dispatch_async(dq2, ^{
1170		T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri2), "get qos class");
1171		T_LOG("The priority of q2 is %d\n", get_pri(mach_thread_self()));
1172		dispatch_semaphore_signal(sema_x);
1173		pthread_mutex_lock(lockbp);
1174	});
1175	dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER);
1176
1177	T_LOG("Async2 completed");
1178
1179	while (1) {
1180		main_afterpri = (int) get_user_promotion_basepri();
1181		if (main_relpri != main_afterpri) {
1182			T_LOG("Success with promotion pri is %d", main_afterpri);
1183			break;
1184		}
1185
1186		usleep(100);
1187	}
1188
1189	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1190		parse_stackshot(PARSE_STACKSHOT_TURNSTILEINFO, ssbuf, sslen, nil);
1191	});
1192}
1193
1194
1195static void
1196expect_instrs_cycles_in_stackshot(void *ssbuf, size_t sslen)
1197{
1198	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1199
1200	bool in_task = false;
1201	bool in_thread = false;
1202	bool saw_instrs_cycles = false;
1203	iter = kcdata_iter_next(iter);
1204
1205	KCDATA_ITER_FOREACH(iter) {
1206		switch (kcdata_iter_type(iter)) {
1207		case KCDATA_TYPE_CONTAINER_BEGIN:
1208			switch (kcdata_iter_container_type(iter)) {
1209			case STACKSHOT_KCCONTAINER_TASK:
1210				in_task = true;
1211				saw_instrs_cycles = false;
1212				break;
1213
1214			case STACKSHOT_KCCONTAINER_THREAD:
1215				in_thread = true;
1216				saw_instrs_cycles = false;
1217				break;
1218
1219			default:
1220				break;
1221			}
1222			break;
1223
1224		case STACKSHOT_KCTYPE_INSTRS_CYCLES:
1225			saw_instrs_cycles = true;
1226			break;
1227
1228		case KCDATA_TYPE_CONTAINER_END:
1229			if (in_thread) {
1230				T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles,
1231						"saw instructions and cycles in thread");
1232				in_thread = false;
1233			} else if (in_task) {
1234				T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles,
1235						"saw instructions and cycles in task");
1236				in_task = false;
1237			}
1238
1239		default:
1240			break;
1241		}
1242	}
1243}
1244
1245static void
1246skip_if_monotonic_unsupported(void)
1247{
1248	int supported = 0;
1249	size_t supported_size = sizeof(supported);
1250	int ret = sysctlbyname("kern.monotonic.supported", &supported,
1251			&supported_size, 0, 0);
1252	if (ret < 0 || !supported) {
1253		T_SKIP("monotonic is unsupported");
1254	}
1255}
1256
1257T_DECL(instrs_cycles, "test a getting instructions and cycles in stackshot")
1258{
1259	skip_if_monotonic_unsupported();
1260
1261	struct scenario scenario = {
1262		.name = "instrs-cycles",
1263		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1264				| STACKSHOT_KCDATA_FORMAT),
1265	};
1266
1267	T_LOG("attempting to take stackshot with instructions and cycles");
1268	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1269		parse_stackshot(0, ssbuf, sslen, nil);
1270		expect_instrs_cycles_in_stackshot(ssbuf, sslen);
1271	});
1272}
1273
1274T_DECL(delta_instrs_cycles,
1275		"test delta stackshots with instructions and cycles")
1276{
1277	skip_if_monotonic_unsupported();
1278
1279	struct scenario scenario = {
1280		.name = "delta-instrs-cycles",
1281		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1282				| STACKSHOT_KCDATA_FORMAT),
1283	};
1284
1285	T_LOG("taking full stackshot");
1286	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1287		uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen);
1288
1289		T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time);
1290
1291		parse_stackshot(0, ssbuf, sslen, nil);
1292		expect_instrs_cycles_in_stackshot(ssbuf, sslen);
1293
1294		struct scenario delta_scenario = {
1295			.name = "delta-instrs-cycles-next",
1296			.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1297					| STACKSHOT_KCDATA_FORMAT
1298					| STACKSHOT_COLLECT_DELTA_SNAPSHOT),
1299			.since_timestamp = stackshot_time,
1300		};
1301
1302		take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) {
1303			parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil);
1304			expect_instrs_cycles_in_stackshot(dssbuf, dsslen);
1305		});
1306	});
1307}
1308
1309static void
1310check_thread_groups_supported()
1311{
1312	int err;
1313	int supported = 0;
1314	size_t supported_size = sizeof(supported);
1315	err = sysctlbyname("kern.thread_groups_supported", &supported, &supported_size, NULL, 0);
1316
1317	if (err || !supported)
1318		T_SKIP("thread groups not supported on this system");
1319}
1320
1321T_DECL(thread_groups, "test getting thread groups in stackshot")
1322{
1323	check_thread_groups_supported();
1324
1325	struct scenario scenario = {
1326		.name = "thread-groups",
1327		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_GROUP
1328				| STACKSHOT_KCDATA_FORMAT),
1329	};
1330
1331	T_LOG("attempting to take stackshot with thread group flag");
1332	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1333		parse_thread_group_stackshot(ssbuf, sslen);
1334	});
1335}
1336
1337T_DECL(compactinfo, "test compactinfo inclusion")
1338{
1339	struct scenario scenario = {
1340		.name = "compactinfo",
1341		.target_pid = getpid(),
1342		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_SAVE_DYLD_COMPACTINFO
1343				| STACKSHOT_KCDATA_FORMAT),
1344	};
1345
1346	T_LOG("attempting to take stackshot with compactinfo flag");
1347	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1348		parse_stackshot(PARSE_STACKSHOT_COMPACTINFO, ssbuf, sslen, nil);
1349	});
1350}
1351
1352T_DECL(suspendinfo, "test task suspend info inclusion")
1353{
1354	struct scenario scenario = {
1355		.name = "suspendinfo",
1356		.target_pid = getpid(),
1357		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
1358	};
1359
1360	T_LOG("attempting to take stackshot with suspendinfo flag");
1361	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1362		parse_stackshot(PARSE_STACKSHOT_SUSPENDINFO, ssbuf, sslen, nil);
1363	});
1364}
1365
1366static NSMutableSet * find_driverkit_pids(io_registry_entry_t root) {
1367	NSMutableSet * driverkit_pids = [NSMutableSet setWithCapacity:3];
1368	io_registry_entry_t current = IO_OBJECT_NULL;
1369	io_iterator_t iter = IO_OBJECT_NULL;
1370
1371	T_EXPECT_MACH_SUCCESS(IORegistryEntryGetChildIterator(root, kIOServicePlane, &iter), "get registry iterator");
1372
1373	while ((current = IOIteratorNext(iter)) != IO_OBJECT_NULL) {
1374		if (_IOObjectConformsTo(current, "IOUserServer", kIOClassNameOverrideNone)) {
1375			CFMutableDictionaryRef cfProperties = NULL;
1376			NSMutableDictionary * properties;
1377			NSString * client_creator_info;
1378			NSArray<NSString *> *creator_info_array;
1379			pid_t pid;
1380
1381			T_QUIET; T_EXPECT_MACH_SUCCESS(IORegistryEntryCreateCFProperties(current, &cfProperties, kCFAllocatorDefault, kNilOptions), "get properties");
1382			properties = CFBridgingRelease(cfProperties);
1383			T_QUIET; T_ASSERT_NOTNULL(properties, "properties is not null");
1384			client_creator_info = properties[@kIOUserClientCreatorKey];
1385			creator_info_array = [client_creator_info componentsSeparatedByString:@","];
1386			if ([creator_info_array[0] hasPrefix:@"pid"]) {
1387				NSArray<NSString *> *pid_info = [creator_info_array[0] componentsSeparatedByString:@" "];
1388				T_QUIET; T_ASSERT_EQ(pid_info.count, 2UL, "Get pid info components from %s", creator_info_array[0].UTF8String);
1389				pid = pid_info[1].intValue;
1390			} else {
1391				T_ASSERT_FAIL("No pid info in client creator info: %s", client_creator_info.UTF8String);
1392			}
1393			T_LOG("Found driver pid %d", pid);
1394			[driverkit_pids addObject:[NSNumber numberWithInt:pid]];
1395		} else {
1396			[driverkit_pids unionSet:find_driverkit_pids(current)];
1397		}
1398		IOObjectRelease(current);
1399	}
1400
1401	IOObjectRelease(iter);
1402	return driverkit_pids;
1403}
1404
1405T_DECL(driverkit, "test driverkit inclusion")
1406{
1407	struct scenario scenario = {
1408		.name = "driverkit",
1409		.target_kernel = true,
1410		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT
1411			    | STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL),
1412	};
1413
1414	io_registry_entry_t root = IORegistryGetRootEntry(kIOMainPortDefault);
1415	NSMutableSet * driverkit_pids = find_driverkit_pids(root);
1416	IOObjectRelease(root);
1417
1418	T_LOG("expecting to find %lu driverkit processes", [driverkit_pids count]);
1419	T_LOG("attempting to take stackshot with STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL flag");
1420	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1421		parse_stackshot(PARSE_STACKSHOT_DRIVERKIT, ssbuf, sslen, @{
1422			driverkit_found_key: ^(pid_t pid) {
1423				[driverkit_pids removeObject:[NSNumber numberWithInt:pid]];
1424		}});
1425	});
1426
1427	T_EXPECT_EQ([driverkit_pids count], (NSUInteger)0, "found expected number of driverkit processes");
1428}
1429
1430static void
1431parse_page_table_asid_stackshot(void **ssbuf, size_t sslen)
1432{
1433	bool seen_asid = false;
1434	bool seen_page_table_snapshot = false;
1435	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1436	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
1437			"buffer provided is a stackshot");
1438
1439	iter = kcdata_iter_next(iter);
1440	KCDATA_ITER_FOREACH(iter) {
1441		switch (kcdata_iter_type(iter)) {
1442		case KCDATA_TYPE_ARRAY: {
1443			T_QUIET;
1444			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
1445					"checked that array is valid");
1446
1447			if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_PAGE_TABLES) {
1448				continue;
1449			}
1450
1451			T_ASSERT_FALSE(seen_page_table_snapshot, "check that we haven't yet seen a page table snapshot");
1452			seen_page_table_snapshot = true;
1453
1454			T_ASSERT_EQ((size_t) kcdata_iter_array_elem_size(iter), sizeof(uint64_t),
1455				"check that each element of the pagetable dump is the expected size");
1456
1457			uint64_t *pt_array = kcdata_iter_payload(iter);
1458			uint32_t elem_count = kcdata_iter_array_elem_count(iter);
1459			uint32_t j;
1460			bool nonzero_tte = false;
1461			for (j = 0; j < elem_count;) {
1462				T_QUIET; T_ASSERT_LE(j + 4, elem_count, "check for valid page table segment header");
1463				uint64_t pa = pt_array[j];
1464				uint64_t num_entries = pt_array[j + 1];
1465				uint64_t start_va = pt_array[j + 2];
1466				uint64_t end_va = pt_array[j + 3];
1467
1468				T_QUIET; T_ASSERT_NE(pa, (uint64_t) 0, "check that the pagetable physical address is non-zero");
1469				T_QUIET; T_ASSERT_EQ(pa % (num_entries * sizeof(uint64_t)), (uint64_t) 0, "check that the pagetable physical address is correctly aligned");
1470				T_QUIET; T_ASSERT_NE(num_entries, (uint64_t) 0, "check that a pagetable region has more than 0 entries");
1471				T_QUIET; T_ASSERT_LE(j + 4 + num_entries, (uint64_t) elem_count, "check for sufficient space in page table array");
1472				T_QUIET; T_ASSERT_GT(end_va, start_va, "check for valid VA bounds in page table segment header");
1473
1474				for (uint32_t k = j + 4; k < (j + 4 + num_entries); ++k) {
1475					if (pt_array[k] != 0) {
1476						nonzero_tte = true;
1477						T_QUIET; T_ASSERT_EQ((pt_array[k] >> 48) & 0xf, (uint64_t) 0, "check that bits[48:51] of arm64 TTE are clear");
1478						// L0-L2 table and non-compressed L3 block entries should always have bit 1 set; assumes L0-L2 blocks will not be used outside the kernel
1479						bool table = ((pt_array[k] & 0x2) != 0);
1480						if (table) {
1481							T_QUIET; T_ASSERT_NE(pt_array[k] & ((1ULL << 48) - 1) & ~((1ULL << 12) - 1), (uint64_t) 0, "check that arm64 TTE physical address is non-zero");
1482						} else { // should be a compressed PTE
1483							T_QUIET; T_ASSERT_NE(pt_array[k] & 0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has at least one of bits [63:62] set");
1484							T_QUIET; T_ASSERT_EQ(pt_array[k] & ~0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has no other bits besides [63:62] set");
1485						}
1486					}
1487				}
1488
1489				j += (4 + num_entries);
1490			}
1491			T_ASSERT_TRUE(nonzero_tte, "check that we saw at least one non-empty TTE");
1492			T_ASSERT_EQ(j, elem_count, "check that page table dump size matches extent of last header");
1493			break;
1494		}
1495		case STACKSHOT_KCTYPE_ASID: {
1496			T_ASSERT_FALSE(seen_asid, "check that we haven't yet seen an ASID");
1497			seen_asid = true;
1498		}
1499		}
1500	}
1501	T_ASSERT_TRUE(seen_page_table_snapshot, "check that we have seen a page table snapshot");
1502	T_ASSERT_TRUE(seen_asid, "check that we have seen an ASID");
1503}
1504
1505T_DECL(dump_page_tables, "test stackshot page table dumping support")
1506{
1507	struct scenario scenario = {
1508		.name = "asid-page-tables",
1509		.flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_ASID | STACKSHOT_PAGE_TABLES),
1510		.size_hint = (9ull << 20), // 9 MB
1511		.target_pid = getpid(),
1512		.maybe_unsupported = true,
1513		.maybe_enomem = true,
1514	};
1515
1516	T_LOG("attempting to take stackshot with ASID and page table flags");
1517	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1518		parse_page_table_asid_stackshot(ssbuf, sslen);
1519	});
1520}
1521
1522static void stackshot_verify_current_proc_uuid_info(void **ssbuf, size_t sslen, uint64_t expected_offset, const struct proc_uniqidentifierinfo *proc_info_data)
1523{
1524	const uuid_t *current_uuid = (const uuid_t *)(&proc_info_data->p_uuid);
1525
1526	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1527	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "buffer provided is a stackshot");
1528
1529	iter = kcdata_iter_next(iter);
1530
1531	KCDATA_ITER_FOREACH(iter) {
1532		switch (kcdata_iter_type(iter)) {
1533			case KCDATA_TYPE_ARRAY: {
1534				T_QUIET; T_ASSERT_TRUE(kcdata_iter_array_valid(iter), "checked that array is valid");
1535				if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO64) {
1536					struct user64_dyld_uuid_info *info = (struct user64_dyld_uuid_info *) kcdata_iter_payload(iter);
1537					if (uuid_compare(*current_uuid, info->imageUUID) == 0) {
1538						T_ASSERT_EQ(expected_offset, info->imageLoadAddress, "found matching UUID with matching binary offset");
1539						return;
1540					}
1541				} else if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO) {
1542					struct user32_dyld_uuid_info *info = (struct user32_dyld_uuid_info *) kcdata_iter_payload(iter);
1543					if (uuid_compare(*current_uuid, info->imageUUID) == 0) {
1544						T_ASSERT_EQ(expected_offset, ((uint64_t) info->imageLoadAddress),  "found matching UUID with matching binary offset");
1545						return;
1546					}
1547				}
1548				break;
1549			}
1550			default:
1551				break;
1552		}
1553	}
1554
1555	T_FAIL("failed to find matching UUID in stackshot data");
1556}
1557
1558T_DECL(translated, "tests translated bit is set correctly")
1559{
1560#if !(TARGET_OS_OSX && TARGET_CPU_ARM64)
1561	T_SKIP("Only valid on Apple silicon Macs")
1562#endif
1563	// Get path of stackshot_translated_child helper binary
1564	char path[PATH_MAX];
1565	uint32_t path_size = sizeof(path);
1566	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
1567	char* binary_name = strrchr(path, '/');
1568	if (binary_name) binary_name++;
1569	T_QUIET; T_ASSERT_NOTNULL(binary_name, "Find basename in path '%s'", path);
1570	strlcpy(binary_name, "stackshot_translated_child", path_size - (binary_name - path));
1571	char *args[] = { path, NULL };
1572
1573	dispatch_source_t child_sig_src;
1574	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
1575	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
1576
1577	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
1578	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
1579
1580	signal(SIGUSR1, SIG_IGN);
1581	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
1582	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
1583
1584	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
1585	dispatch_activate(child_sig_src);
1586
1587	// Spawn child
1588	pid_t pid;
1589	T_LOG("spawning translated child");
1590	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, NULL, args, NULL), "spawned process '%s' with PID %d", args[0], pid);
1591
1592	// Wait for the the child to spawn up
1593	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
1594
1595	// Make sure the child is running and is translated
1596	int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, pid };
1597	struct kinfo_proc process_info;
1598	size_t bufsize = sizeof(process_info);
1599	T_QUIET; T_ASSERT_POSIX_SUCCESS(sysctl(mib, (unsigned)(sizeof(mib)/sizeof(int)), &process_info, &bufsize, NULL, 0), "get translated child process info");
1600	T_QUIET; T_ASSERT_GT(bufsize, (size_t)0, "process info is not empty");
1601	T_QUIET; T_ASSERT_TRUE((process_info.kp_proc.p_flag & P_TRANSLATED), "KERN_PROC_PID reports child is translated");
1602
1603	T_LOG("capturing stackshot");
1604
1605	struct scenario scenario = {
1606		.name = "translated",
1607		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
1608				  | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
1609	};
1610
1611	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1612		parse_stackshot(PARSE_STACKSHOT_TRANSLATED, ssbuf, sslen, @{translated_child_pid_key: @(pid)});
1613	});
1614
1615    // Kill the child
1616    int status;
1617    T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGTERM), "kill translated child");
1618    T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on translated child");
1619
1620}
1621
1622T_DECL(proc_uuid_info, "tests that the main binary UUID for a proc is always populated")
1623{
1624	struct proc_uniqidentifierinfo proc_info_data = { };
1625	mach_msg_type_number_t      count;
1626	kern_return_t               kernel_status;
1627	task_dyld_info_data_t       task_dyld_info;
1628	struct dyld_all_image_infos *target_infos;
1629	int retval;
1630	bool found_image_in_image_infos = false;
1631	uint64_t expected_mach_header_offset = 0;
1632
1633	/* Find the UUID of our main binary */
1634	retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
1635	T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
1636	T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
1637
1638	uuid_string_t str = {};
1639	uuid_unparse(*(uuid_t*)&proc_info_data.p_uuid, str);
1640	T_LOG("Found current UUID is %s", str);
1641
1642	/* Find the location of the dyld image info metadata */
1643	count = TASK_DYLD_INFO_COUNT;
1644	kernel_status = task_info(mach_task_self(), TASK_DYLD_INFO, (task_info_t)&task_dyld_info, &count);
1645	T_QUIET; T_ASSERT_EQ(kernel_status, KERN_SUCCESS, "retrieve task_info for TASK_DYLD_INFO");
1646
1647	target_infos = (struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr;
1648
1649	/* Find our binary in the dyld image info array */
1650	for (int i = 0; i < (int) target_infos->uuidArrayCount; i++) {
1651		if (uuid_compare(target_infos->uuidArray[i].imageUUID, *(uuid_t*)&proc_info_data.p_uuid) == 0) {
1652			expected_mach_header_offset = (uint64_t) target_infos->uuidArray[i].imageLoadAddress;
1653			found_image_in_image_infos = true;
1654		}
1655	}
1656
1657	T_ASSERT_TRUE(found_image_in_image_infos, "found binary image in dyld image info list");
1658
1659	/* Overwrite the dyld image info data so the kernel has to fallback to the UUID stored in the proc structure */
1660	target_infos->uuidArrayCount = 0;
1661
1662	struct scenario scenario = {
1663		.name = "proc_uuid_info",
1664		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
1665		.target_pid = getpid(),
1666	};
1667
1668	T_LOG("attempting to take stackshot for current PID");
1669	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1670		stackshot_verify_current_proc_uuid_info(ssbuf, sslen, expected_mach_header_offset, &proc_info_data);
1671	});
1672}
1673
1674T_DECL(cseg_waitinfo, "test that threads stuck in the compressor report correct waitinfo")
1675{
1676	struct scenario scenario = {
1677		.name = "cseg_waitinfo",
1678		.quiet = false,
1679		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1680	};
1681	__block uint64_t thread_id = 0;
1682
1683	dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot.cseg_waitinfo", NULL);
1684	dispatch_semaphore_t child_ok = dispatch_semaphore_create(0);
1685
1686	dispatch_async(dq, ^{
1687		pthread_threadid_np(NULL, &thread_id);
1688		dispatch_semaphore_signal(child_ok);
1689		int val = 1;
1690		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread");
1691	});
1692
1693	dispatch_semaphore_wait(child_ok, DISPATCH_TIME_FOREVER);
1694	sleep(1);
1695
1696	T_LOG("taking stackshot");
1697	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1698		int val = 1;
1699		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child thread");
1700		parse_stackshot(PARSE_STACKSHOT_WAITINFO_CSEG, ssbuf, sslen, @{cseg_expected_threadid_key: @(thread_id)});
1701	});
1702}
1703
1704static void
1705srp_send(
1706	mach_port_t send_port,
1707	mach_port_t reply_port,
1708	mach_port_t msg_port)
1709{
1710	kern_return_t ret = 0;
1711
1712	struct test_msg {
1713		mach_msg_header_t header;
1714		mach_msg_body_t body;
1715		mach_msg_port_descriptor_t port_descriptor;
1716	};
1717	struct test_msg send_msg = {
1718		.header = {
1719			.msgh_remote_port = send_port,
1720			.msgh_local_port  = reply_port,
1721			.msgh_bits        = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND,
1722	    reply_port ? MACH_MSG_TYPE_MAKE_SEND_ONCE : 0,
1723	    MACH_MSG_TYPE_MOVE_SEND,
1724	    MACH_MSGH_BITS_COMPLEX),
1725			.msgh_id          = 0x100,
1726			.msgh_size        = sizeof(send_msg),
1727		},
1728		.body = {
1729			.msgh_descriptor_count = 1,
1730		},
1731		.port_descriptor = {
1732			.name        = msg_port,
1733			.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
1734			.type        = MACH_MSG_PORT_DESCRIPTOR,
1735		},
1736	};
1737
1738	if (msg_port == MACH_PORT_NULL) {
1739		send_msg.body.msgh_descriptor_count = 0;
1740	}
1741
1742	ret = mach_msg(&(send_msg.header),
1743	    MACH_SEND_MSG |
1744	    MACH_SEND_TIMEOUT |
1745	    MACH_SEND_OVERRIDE,
1746	    send_msg.header.msgh_size,
1747	    0,
1748	    MACH_PORT_NULL,
1749	    10000,
1750	    0);
1751
1752	T_ASSERT_MACH_SUCCESS(ret, "client mach_msg");
1753}
1754
1755T_HELPER_DECL(srp_client,
1756    "Client used for the special_reply_port test")
1757{
1758	pid_t ppid = getppid();
1759	dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
1760	dispatch_queue_t dq = dispatch_queue_create("client_signalqueue", NULL);
1761	dispatch_source_t sig_src;
1762
1763	mach_msg_return_t mr;
1764	mach_port_t service_port;
1765	mach_port_t conn_port;
1766	mach_port_t special_reply_port;
1767	mach_port_options_t opts = {
1768		.flags = MPO_INSERT_SEND_RIGHT,
1769	};
1770
1771	signal(SIGUSR1, SIG_IGN);
1772	sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
1773
1774	dispatch_source_set_event_handler(sig_src, ^{
1775			dispatch_semaphore_signal(can_continue);
1776	});
1777	dispatch_activate(sig_src);
1778
1779	/* lookup the mach service port for the parent */
1780	kern_return_t kr = bootstrap_look_up(bootstrap_port,
1781	    SRP_SERVICE_NAME, &service_port);
1782	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "client bootstrap_look_up");
1783
1784	/* create the send-once right (special reply port) and message to send to the server */
1785	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port);
1786	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
1787
1788	special_reply_port = thread_get_special_reply_port();
1789	T_QUIET; T_ASSERT_TRUE(MACH_PORT_VALID(special_reply_port), "get_thread_special_reply_port");
1790
1791	/* send the message with the special reply port */
1792	srp_send(service_port, special_reply_port, conn_port);
1793
1794	/* signal the parent to continue */
1795	kill(ppid, SIGUSR1);
1796
1797	struct {
1798		mach_msg_header_t header;
1799		mach_msg_body_t body;
1800		mach_msg_port_descriptor_t port_descriptor;
1801	} rcv_msg = {
1802		.header =
1803		{
1804			.msgh_remote_port = MACH_PORT_NULL,
1805			.msgh_local_port  = special_reply_port,
1806			.msgh_size        = sizeof(rcv_msg),
1807		},
1808	};
1809
1810	/* wait on the reply from the parent (that we will never receive) */
1811	mr = mach_msg(&(rcv_msg.header),
1812			(MACH_RCV_MSG | MACH_RCV_SYNC_WAIT),
1813			0,
1814			rcv_msg.header.msgh_size,
1815			special_reply_port,
1816			MACH_MSG_TIMEOUT_NONE,
1817			service_port);
1818
1819	/* not expected to execute as parent will SIGKILL client... */
1820	T_LOG("client process exiting after sending message to parent (server)");
1821}
1822
1823enum srp_test_type {
1824	SRP_TEST_THREAD,	/* expect waiter on current thread */
1825	SRP_TEST_PID,		/* expect waiter on current PID */
1826	SRP_TEST_EITHER,	/* waiter could be on either */
1827};
1828
1829static void
1830check_srp_test(const char *name, enum srp_test_type ty)
1831{
1832	struct scenario scenario = {
1833		.name = name,
1834		.quiet = false,
1835		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1836	};
1837	uint64_t thread_id = 0;
1838	pthread_threadid_np(NULL, &thread_id);
1839	if (ty == SRP_TEST_THREAD) {
1840		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1841			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1842					@{srp_expected_threadid_key: @(thread_id)});
1843		});
1844	} else if (ty == SRP_TEST_PID) {
1845		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1846			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1847					@{srp_expected_pid_key: @(getpid())});
1848		});
1849	} else {
1850		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1851			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1852					@{srp_expected_pid_key: @(getpid()), srp_expected_threadid_key: @(thread_id)});
1853		});
1854	}
1855
1856}
1857
1858
1859/*
1860 * Tests the stackshot wait info plumbing for synchronous IPC that doesn't use kevent on the server.
1861 *
1862 * (part 1): tests the scenario where a client sends a request that includes a special reply port
1863 *           to a server that doesn't receive the message and doesn't copy the send-once right
1864 *           into its address space as a result. for this case the special reply port is enqueued
1865 *           in a port and we check which task has that receive right and use that info. (rdar://60440338)
1866 * (part 2): tests the scenario where a client sends a request that includes a special reply port
1867 *           to a server that receives the message and copies in the send-once right, but doesn't
1868 *           reply to the client. for this case the special reply port is copied out and the kernel
1869 *           stashes the info about which task copied out the send once right. (rdar://60440592)
1870 * (part 3): tests the same as part 2, but uses kevents, which allow for
1871 *           priority inheritance
1872 */
1873T_DECL(special_reply_port, "test that tasks using special reply ports have correct waitinfo")
1874{
1875	dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
1876	dispatch_queue_t dq = dispatch_queue_create("signalqueue", NULL);
1877	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
1878	dispatch_source_t sig_src;
1879	char path[PATH_MAX];
1880	uint32_t path_size = sizeof(path);
1881	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
1882	char *client_args[] = { path, "-n", "srp_client", NULL };
1883	pid_t client_pid;
1884	int sp_ret;
1885	kern_return_t kr;
1886	mach_port_t port;
1887
1888	/* setup the signal handler in the parent (server) */
1889	T_LOG("setup sig handlers");
1890	signal(SIGUSR1, SIG_IGN);
1891	sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
1892
1893	dispatch_source_set_event_handler(sig_src, ^{
1894			dispatch_semaphore_signal(can_continue);
1895	});
1896	dispatch_activate(sig_src);
1897
1898	/* register with the mach service name so the client can lookup and send a message to the parent (server) */
1899	T_LOG("Server about to check in");
1900	kr = bootstrap_check_in(bootstrap_port, SRP_SERVICE_NAME, &port);
1901	T_ASSERT_MACH_SUCCESS(kr, "server bootstrap_check_in");
1902
1903	T_LOG("Launching client");
1904	sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
1905	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid);
1906	T_LOG("Spawned client as PID %d", client_pid);
1907
1908	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
1909	T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear");
1910
1911	/*
1912	 * can_continue indicates the client has signaled us, but we want to make
1913	 * sure they've actually blocked sending their mach message.  It's cheesy, but
1914	 * sleep() works for this.
1915	 */
1916	sleep(1);
1917
1918	/*
1919	 * take the stackshot without calling receive to verify that the stackshot wait
1920	 * info shows our (the server) thread for the scenario where the server has yet to
1921	 * receive the message.
1922	 */
1923	T_LOG("Taking stackshot for part 1 coverage");
1924	check_srp_test("srp", SRP_TEST_THREAD);
1925
1926	/*
1927	 * receive the message from the client (which should copy the send once right into
1928	 * our address space).
1929	 */
1930	struct {
1931		mach_msg_header_t header;
1932		mach_msg_body_t body;
1933		mach_msg_port_descriptor_t port_descriptor;
1934	} rcv_msg = {
1935		.header =
1936		{
1937			.msgh_remote_port = MACH_PORT_NULL,
1938			.msgh_local_port  = port,
1939			.msgh_size        = sizeof(rcv_msg),
1940		},
1941	};
1942
1943	T_LOG("server: starting sync receive\n");
1944
1945	mach_msg_return_t mr;
1946	mr = mach_msg(&(rcv_msg.header),
1947			(MACH_RCV_MSG | MACH_RCV_TIMEOUT),
1948			0,
1949			4096,
1950			port,
1951			10000,
1952			MACH_PORT_NULL);
1953	T_QUIET; T_ASSERT_MACH_SUCCESS(mr, "mach_msg() recieve of message from client");
1954
1955	/*
1956	 * take the stackshot to verify that the stackshot wait info shows our (the server) PID
1957	 * for the scenario where the server has received the message and copied in the send-once right.
1958	 */
1959	T_LOG("Taking stackshot for part 2 coverage");
1960	check_srp_test("srp", SRP_TEST_PID);
1961
1962	/* cleanup - kill the client */
1963	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
1964	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
1965
1966	// do it again, but using kevents
1967	T_LOG("Launching client");
1968	sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
1969	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid);
1970	T_LOG("Spawned client as PID %d", client_pid);
1971
1972	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
1973	T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear");
1974
1975	/*
1976	 * can_continue indicates the client has signaled us, but we want to make
1977	 * sure they've actually blocked sending their mach message.  It's cheesy, but
1978	 * sleep() works for this.
1979	 */
1980	sleep(1);
1981
1982	dispatch_mach_t dispatch_mach = dispatch_mach_create(SRP_SERVICE_NAME, machdq,
1983	    ^(dispatch_mach_reason_t reason,
1984	      dispatch_mach_msg_t message,
1985	      mach_error_t error __unused) {
1986		switch (reason) {
1987		case DISPATCH_MACH_MESSAGE_RECEIVED: {
1988			size_t size = 0;
1989			mach_msg_header_t *msg __unused = dispatch_mach_msg_get_msg(message, &size);
1990			T_LOG("server: recieved %ld byte message", size);
1991			check_srp_test("turnstile_port_thread", SRP_TEST_THREAD);
1992			T_LOG("server: letting client go");
1993			// drop the message on the ground, we'll kill the client later
1994			dispatch_semaphore_signal(can_continue);
1995			break;
1996		}
1997		default:
1998			break;
1999		}
2000	});
2001
2002	dispatch_mach_connect(dispatch_mach, port, MACH_PORT_NULL, NULL);
2003
2004	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2005
2006	/* cleanup - kill the client */
2007	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
2008	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2009}
2010
2011T_HELPER_DECL(throtlled_sp_client,
2012	"client that uses a connection port to send a message to a server")
2013{
2014	mach_port_t conn_port, service_port, reply_port, *stash;
2015	mach_msg_type_number_t stash_cnt = 0;
2016
2017	kern_return_t kr = mach_ports_lookup(mach_task_self(), &stash, &stash_cnt);
2018	T_ASSERT_MACH_SUCCESS(kr, "mach_ports_lookup");
2019
2020	service_port = stash[0];
2021	T_ASSERT_TRUE(MACH_PORT_VALID(service_port), "valid service port");
2022	mig_deallocate((vm_address_t)stash, stash_cnt * sizeof(stash[0]));
2023
2024	mach_port_options_t opts = {
2025		.flags = MPO_INSERT_SEND_RIGHT
2026			| MPO_CONNECTION_PORT,
2027		.service_port_name = service_port,
2028	};
2029
2030	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port);
2031	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
2032
2033	mach_port_options_t opts2 = {
2034		.flags = MPO_REPLY_PORT
2035	};
2036	kr = mach_port_construct(mach_task_self(), &opts2, 0ull, &reply_port);
2037	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
2038
2039	/* XPC-like check-in message */
2040	struct {
2041		mach_msg_header_t header;
2042		mach_msg_port_descriptor_t recvp;
2043		mach_msg_port_descriptor_t sendp;
2044	} checkin_message = {
2045		.header =
2046		{
2047			.msgh_remote_port = service_port,
2048			.msgh_local_port = MACH_PORT_NULL,
2049			.msgh_size = sizeof(checkin_message),
2050			.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0),
2051		},
2052		.recvp =
2053		{
2054			.type = MACH_MSG_PORT_DESCRIPTOR,
2055			.name = conn_port,
2056			.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
2057		},
2058		.sendp =
2059		{
2060			.type = MACH_MSG_PORT_DESCRIPTOR,
2061			.name = reply_port,
2062			.disposition = MACH_MSG_TYPE_MAKE_SEND,
2063		}
2064	};
2065	dispatch_mach_msg_t dmsg = dispatch_mach_msg_create((mach_msg_header_t *)&checkin_message, sizeof(checkin_message),
2066		DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL);
2067
2068	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
2069	dispatch_mach_t dchannel = dispatch_mach_create(THROTTLED_SERVICE_NAME, machdq,
2070		^(dispatch_mach_reason_t reason,
2071	      dispatch_mach_msg_t message __unused,
2072	      mach_error_t error __unused) {
2073		switch (reason) {
2074			case DISPATCH_MACH_CONNECTED:
2075				T_LOG("mach channel connected");
2076				break;
2077			case DISPATCH_MACH_MESSAGE_SENT:
2078				T_LOG("sent mach message");
2079				break;
2080			default:
2081				T_ASSERT_FAIL("Unexpected reply to channel reason %lu", reason);
2082		}
2083	});
2084	dispatch_mach_connect(dchannel, reply_port, service_port, dmsg);
2085	dispatch_release(dmsg);
2086
2087	struct {
2088		mach_msg_header_t header;
2089		uint64_t request_id;
2090	} request = {
2091		.header =
2092		{
2093			.msgh_size = sizeof(request),
2094			.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE),
2095		},
2096		.request_id = 1,
2097	};
2098	dispatch_mach_msg_t dmsg2 = dispatch_mach_msg_create((mach_msg_header_t *)&request, sizeof(request),
2099		DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL);
2100
2101	dispatch_mach_reason_t reason;
2102	mach_error_t error;
2103
2104	/* send the check-in message and the request message */
2105	dispatch_mach_msg_t dreply = dispatch_mach_send_with_result_and_wait_for_reply(dchannel,
2106			dmsg2, 0, DISPATCH_MACH_SEND_DEFAULT, &reason, &error);
2107	dispatch_release(dmsg2);
2108
2109	/* not expected to execute as parent will SIGKILL client */
2110	T_ASSERT_FAIL("client process exiting after receiving %s reply", dreply ? "non-null" : "null");
2111}
2112
2113static void
2114check_throttled_sp(const char *test_name, uint64_t context, bool is_throttled)
2115{
2116	struct scenario scenario = {
2117		.name = test_name,
2118		.quiet = false,
2119		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
2120	};
2121
2122	T_LOG("taking stackshot %s", test_name);
2123	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2124		parse_stackshot(PARSE_STACKSHOT_THROTTLED_SP, ssbuf, sslen,
2125					@{sp_throttled_expected_ctxt_key: @(context),
2126					sp_throttled_expect_flag: @(is_throttled)});
2127	});
2128}
2129
2130/* Take stackshot when a client is blocked on the service port of a process, in the scenario when
2131 * the process with the receive right for the service port is:
2132 *     (a) Monitoring the service port using kevents
2133 *     (b) Not monitoring the service port
2134 */
2135T_DECL(throttled_sp,
2136	"test that service port throttled flag is propagated to the stackshot correctly")
2137{
2138	mach_port_t service_port;
2139	__block dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
2140
2141	char path[PATH_MAX];
2142	uint32_t path_size = sizeof(path);
2143	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
2144	char *client_args[] = { path, "-n", "throtlled_sp_client", NULL };
2145
2146	__block	uint64_t thread_id = 0;
2147	pid_t client_pid;
2148	int mark_throttled;
2149
2150	struct mach_service_port_info sp_info = {};
2151	strcpy(sp_info.mspi_string_name, THROTTLED_SERVICE_NAME);
2152	sp_info.mspi_domain_type = (uint8_t)1;
2153	kern_return_t kr;
2154
2155	mach_port_options_t opts = {
2156		.flags = MPO_SERVICE_PORT | MPO_INSERT_SEND_RIGHT | MPO_CONTEXT_AS_GUARD | MPO_STRICT | MPO_TEMPOWNER,
2157		.service_port_info = &sp_info,
2158	};
2159
2160	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &service_port);
2161	T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct %u", service_port);
2162
2163	/* Setup a dispatch source to monitor the service port similar to how launchd does. */
2164	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
2165	dispatch_source_t mach_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_MACH_RECV, service_port,
2166		DISPATCH_MACH_RECV_SYNC_PEEK, machdq);
2167	dispatch_source_set_event_handler(mach_src, ^{
2168		pthread_threadid_np(NULL, &thread_id);
2169		dispatch_semaphore_signal(can_continue);
2170	});
2171	dispatch_activate(mach_src);
2172
2173	/* Stash the port in task to make sure child also gets it */
2174	kr = mach_ports_register(mach_task_self(), &service_port, 1);
2175	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_ports_register service port");
2176
2177	mark_throttled = 1;
2178	kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled),
2179	           MACH_PORT_SERVICE_THROTTLED_COUNT);
2180	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mark service port as throttled");
2181
2182	int rc = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
2183	T_QUIET; T_ASSERT_POSIX_ZERO(rc, "spawned process '%s' with PID %d", client_args[0], client_pid);
2184	T_LOG("Spawned client as PID %d", client_pid);
2185
2186	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2187
2188	/* The service port has received the check-in message. Take stackshot for scenario (a). */
2189	check_throttled_sp("throttled_service_port_monitored", thread_id, true);
2190
2191	/* This simulates a throttled spawn when the service port is no longer monitored. */
2192	dispatch_source_cancel(mach_src);
2193
2194	/* Take stackshot for scenario (b) */
2195	check_throttled_sp("throttled_service_port_unmonitored", (uint64_t)getpid(), true);
2196
2197	mark_throttled = 0;
2198	kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled),
2199	           MACH_PORT_SERVICE_THROTTLED_COUNT);
2200	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "unmark service port as throttled");
2201
2202	/* Throttled flag should not be set when the port is not throttled. */
2203	check_throttled_sp("unthrottled_service_port_unmonitored", (uint64_t)getpid(), false);
2204
2205	/* cleanup - kill the client */
2206	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
2207	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2208}
2209
2210
2211#pragma mark performance tests
2212
2213#define SHOULD_REUSE_SIZE_HINT 0x01
2214#define SHOULD_USE_DELTA       0x02
2215#define SHOULD_TARGET_SELF     0x04
2216
2217static void
2218stackshot_perf(unsigned int options)
2219{
2220	struct scenario scenario = {
2221		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
2222			| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
2223	};
2224
2225	dt_stat_t size = dt_stat_create("bytes", "size");
2226	dt_stat_time_t duration = dt_stat_time_create("duration");
2227	scenario.timer = duration;
2228
2229	if (options & SHOULD_TARGET_SELF) {
2230		scenario.target_pid = getpid();
2231	}
2232
2233	while (!dt_stat_stable(duration) || !dt_stat_stable(size)) {
2234		__block uint64_t last_time = 0;
2235		__block uint32_t size_hint = 0;
2236		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2237			dt_stat_add(size, (double)sslen);
2238			last_time = stackshot_timestamp(ssbuf, sslen);
2239			size_hint = (uint32_t)sslen;
2240		});
2241		if (options & SHOULD_USE_DELTA) {
2242			scenario.since_timestamp = last_time;
2243			scenario.flags |= STACKSHOT_COLLECT_DELTA_SNAPSHOT;
2244		}
2245		if (options & SHOULD_REUSE_SIZE_HINT) {
2246			scenario.size_hint = size_hint;
2247		}
2248	}
2249
2250	dt_stat_finalize(duration);
2251	dt_stat_finalize(size);
2252}
2253
2254static void
2255stackshot_flag_perf_noclobber(uint64_t flag, char *flagname)
2256{
2257	struct scenario scenario = {
2258		.quiet = true,
2259		.flags = (flag | STACKSHOT_KCDATA_FORMAT),
2260	};
2261
2262	dt_stat_t duration = dt_stat_create("nanoseconds per thread", "%s_duration", flagname);
2263	dt_stat_t size = dt_stat_create("bytes per thread", "%s_size", flagname);
2264	T_LOG("Testing \"%s\" = 0x%" PRIx64, flagname, flag);
2265
2266	while (!dt_stat_stable(duration) || !dt_stat_stable(size)) {
2267		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2268			kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2269			unsigned long no_threads = 0;
2270			mach_timebase_info_data_t timebase = {0, 0};
2271			uint64_t stackshot_duration = 0;
2272			int found = 0;
2273			T_QUIET; T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "stackshot buffer");
2274
2275			KCDATA_ITER_FOREACH(iter) {
2276				switch(kcdata_iter_type(iter)) {
2277					case STACKSHOT_KCTYPE_THREAD_SNAPSHOT: {
2278						found |= 1;
2279						no_threads ++;
2280						break;
2281					}
2282					case STACKSHOT_KCTYPE_STACKSHOT_DURATION: {
2283						struct stackshot_duration *ssd = kcdata_iter_payload(iter);
2284						stackshot_duration = ssd->stackshot_duration;
2285						found |= 2;
2286						break;
2287					}
2288					case KCDATA_TYPE_TIMEBASE: {
2289						found |= 4;
2290						mach_timebase_info_data_t *tb = kcdata_iter_payload(iter);
2291						memcpy(&timebase, tb, sizeof(timebase));
2292						break;
2293					}
2294				}
2295			}
2296
2297			T_QUIET; T_ASSERT_EQ(found, 0x7, "found everything needed");
2298
2299			uint64_t ns = (stackshot_duration * timebase.numer) / timebase.denom;
2300			uint64_t per_thread_ns = ns / no_threads;
2301			uint64_t per_thread_size = sslen / no_threads;
2302
2303			dt_stat_add(duration, per_thread_ns);
2304			dt_stat_add(size, per_thread_size);
2305		});
2306	}
2307
2308	dt_stat_finalize(duration);
2309	dt_stat_finalize(size);
2310}
2311
2312static void
2313stackshot_flag_perf(uint64_t flag, char *flagname)
2314{
2315	/*
2316	 * STACKSHOT_NO_IO_STATS disables data collection, so set it for
2317	 * more accurate perfdata collection.
2318	 */
2319	flag |= STACKSHOT_NO_IO_STATS;
2320
2321	stackshot_flag_perf_noclobber(flag, flagname);
2322}
2323
2324
2325T_DECL(flag_perf, "test stackshot performance with different flags set", T_META_TAG_PERF)
2326{
2327	stackshot_flag_perf_noclobber(STACKSHOT_NO_IO_STATS, "baseline");
2328	stackshot_flag_perf_noclobber(0, "io_stats");
2329
2330	stackshot_flag_perf(STACKSHOT_THREAD_WAITINFO, "thread_waitinfo");
2331	stackshot_flag_perf(STACKSHOT_GET_DQ, "get_dq");
2332	stackshot_flag_perf(STACKSHOT_SAVE_LOADINFO, "save_loadinfo");
2333	stackshot_flag_perf(STACKSHOT_GET_GLOBAL_MEM_STATS, "get_global_mem_stats");
2334	stackshot_flag_perf(STACKSHOT_SAVE_KEXT_LOADINFO, "save_kext_loadinfo");
2335	stackshot_flag_perf(STACKSHOT_SAVE_IMP_DONATION_PIDS, "save_imp_donation_pids");
2336	stackshot_flag_perf(STACKSHOT_ENABLE_BT_FAULTING, "enable_bt_faulting");
2337	stackshot_flag_perf(STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT, "collect_sharedcache_layout");
2338	stackshot_flag_perf(STACKSHOT_ENABLE_UUID_FAULTING, "enable_uuid_faulting");
2339	stackshot_flag_perf(STACKSHOT_THREAD_GROUP, "thread_group");
2340	stackshot_flag_perf(STACKSHOT_SAVE_JETSAM_COALITIONS, "save_jetsam_coalitions");
2341	stackshot_flag_perf(STACKSHOT_INSTRS_CYCLES, "instrs_cycles");
2342	stackshot_flag_perf(STACKSHOT_ASID, "asid");
2343	stackshot_flag_perf(STACKSHOT_EXCLAVES, "exclaves");
2344	stackshot_flag_perf(STACKSHOT_EXCLAVES | STACKSHOT_ASID, "exclaves + asid");
2345	stackshot_flag_perf(STACKSHOT_SKIP_EXCLAVES, "exclaves skipped");
2346}
2347
2348T_DECL(perf_no_size_hint, "test stackshot performance with no size hint",
2349		T_META_TAG_PERF)
2350{
2351	stackshot_perf(0);
2352}
2353
2354T_DECL(perf_size_hint, "test stackshot performance with size hint",
2355		T_META_TAG_PERF)
2356{
2357	stackshot_perf(SHOULD_REUSE_SIZE_HINT);
2358}
2359
2360T_DECL(perf_process, "test stackshot performance targeted at process",
2361		T_META_TAG_PERF)
2362{
2363	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_TARGET_SELF);
2364}
2365
2366T_DECL(perf_delta, "test delta stackshot performance",
2367		T_META_TAG_PERF)
2368{
2369	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA);
2370}
2371
2372T_DECL(perf_delta_no_exclaves, "test delta stackshot performance without Exclaves",
2373	    T_META_REQUIRES_SYSCTL_EQ("kern.exclaves_status", 1),
2374		T_META_TAG_PERF)
2375{
2376	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | STACKSHOT_SKIP_EXCLAVES);
2377}
2378
2379T_DECL(perf_delta_process, "test delta stackshot performance targeted at a process",
2380		T_META_TAG_PERF)
2381{
2382	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | SHOULD_TARGET_SELF);
2383}
2384
2385T_DECL(stackshot_entitlement_report_test, "test stackshot entitlement report")
2386{
2387	int sysctlValue = 1;
2388	T_ASSERT_POSIX_SUCCESS(
2389	    sysctlbyname("debug.stackshot_entitlement_send_batch", NULL, NULL, &sysctlValue, sizeof(sysctlValue)),
2390	    "set debug.stackshot_entitlement_send_batch=1");
2391	// having a way to verify that the coreanalytics event was received would be even better
2392	// See rdar://74197197
2393	T_PASS("entitlement test ran");
2394}
2395
2396static uint64_t
2397stackshot_timestamp(void *ssbuf, size_t sslen)
2398{
2399	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2400
2401	uint32_t type = kcdata_iter_type(iter);
2402	if (type != KCDATA_BUFFER_BEGIN_STACKSHOT && type != KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT) {
2403		T_ASSERT_FAIL("invalid kcdata type %u", kcdata_iter_type(iter));
2404	}
2405
2406	iter = kcdata_iter_find_type(iter, KCDATA_TYPE_MACH_ABSOLUTE_TIME);
2407	T_QUIET;
2408	T_ASSERT_TRUE(kcdata_iter_valid(iter), "timestamp found in stackshot");
2409
2410	return *(uint64_t *)kcdata_iter_payload(iter);
2411}
2412
2413#define TEST_THREAD_NAME "stackshot_test_thread"
2414
2415static void
2416parse_thread_group_stackshot(void **ssbuf, size_t sslen)
2417{
2418	bool seen_thread_group_snapshot = false;
2419	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2420	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
2421			"buffer provided is a stackshot");
2422
2423	NSMutableSet *thread_groups = [[NSMutableSet alloc] init];
2424
2425	iter = kcdata_iter_next(iter);
2426	KCDATA_ITER_FOREACH(iter) {
2427		switch (kcdata_iter_type(iter)) {
2428		case KCDATA_TYPE_ARRAY: {
2429			T_QUIET;
2430			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
2431					"checked that array is valid");
2432
2433			if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_THREAD_GROUP_SNAPSHOT) {
2434				continue;
2435			}
2436
2437			seen_thread_group_snapshot = true;
2438
2439			if (kcdata_iter_array_elem_size(iter) >= sizeof(struct thread_group_snapshot_v3)) {
2440				struct thread_group_snapshot_v3 *tgs_array = kcdata_iter_payload(iter);
2441				for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) {
2442					struct thread_group_snapshot_v3 *tgs = tgs_array + j;
2443					[thread_groups addObject:@(tgs->tgs_id)];
2444				}
2445			}
2446			else {
2447				struct thread_group_snapshot *tgs_array = kcdata_iter_payload(iter);
2448				for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) {
2449					struct thread_group_snapshot *tgs = tgs_array + j;
2450					[thread_groups addObject:@(tgs->tgs_id)];
2451				}
2452			}
2453			break;
2454		}
2455		}
2456	}
2457	KCDATA_ITER_FOREACH(iter) {
2458		NSError *error = nil;
2459
2460		switch (kcdata_iter_type(iter)) {
2461
2462		case KCDATA_TYPE_CONTAINER_BEGIN: {
2463			T_QUIET;
2464			T_ASSERT_TRUE(kcdata_iter_container_valid(iter),
2465					"checked that container is valid");
2466
2467			if (kcdata_iter_container_type(iter) != STACKSHOT_KCCONTAINER_THREAD) {
2468				break;
2469			}
2470
2471			NSDictionary *container = parseKCDataContainer(&iter, &error);
2472			T_QUIET; T_ASSERT_NOTNULL(container, "parsed thread container from stackshot");
2473			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container");
2474
2475			int tg = [container[@"thread_snapshots"][@"thread_group"] intValue];
2476
2477			T_ASSERT_TRUE([thread_groups containsObject:@(tg)], "check that the thread group the thread is in exists");
2478
2479			break;
2480		};
2481
2482		}
2483	}
2484	T_ASSERT_TRUE(seen_thread_group_snapshot, "check that we have seen a thread group snapshot");
2485}
2486
2487static void
2488verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count)
2489{
2490	uuid_t cur_shared_cache_uuid;
2491	__block uint32_t lib_index = 0, libs_found = 0;
2492
2493	_dyld_get_shared_cache_uuid(cur_shared_cache_uuid);
2494	int result = dyld_shared_cache_iterate_text(cur_shared_cache_uuid, ^(const dyld_shared_cache_dylib_text_info* info) {
2495			T_QUIET; T_ASSERT_LT(lib_index, uuid_count, "dyld_shared_cache_iterate_text exceeded number of libraries returned by kernel");
2496
2497			libs_found++;
2498			struct dyld_uuid_info_64 *cur_stackshot_uuid_entry = &uuids[lib_index];
2499			T_QUIET; T_ASSERT_EQ(memcmp(info->dylibUuid, cur_stackshot_uuid_entry->imageUUID, sizeof(info->dylibUuid)), 0,
2500					"dyld returned UUID doesn't match kernel returned UUID");
2501			T_QUIET; T_ASSERT_EQ(info->loadAddressUnslid, cur_stackshot_uuid_entry->imageLoadAddress,
2502					"dyld returned load address doesn't match kernel returned load address");
2503			lib_index++;
2504		});
2505
2506	T_ASSERT_EQ(result, 0, "iterate shared cache layout");
2507	T_ASSERT_EQ(libs_found, uuid_count, "dyld iterator returned same number of libraries as kernel");
2508
2509	T_LOG("verified %d libraries from dyld shared cache", libs_found);
2510}
2511
2512static void
2513check_shared_cache_uuid(uuid_t imageUUID)
2514{
2515	static uuid_t shared_cache_uuid;
2516	static dispatch_once_t read_shared_cache_uuid;
2517
2518	dispatch_once(&read_shared_cache_uuid, ^{
2519		T_QUIET;
2520		T_ASSERT_TRUE(_dyld_get_shared_cache_uuid(shared_cache_uuid), "retrieve current shared cache UUID");
2521	});
2522	T_QUIET; T_ASSERT_EQ(uuid_compare(shared_cache_uuid, imageUUID), 0,
2523			"dyld returned UUID doesn't match kernel returned UUID for system shared cache");
2524}
2525
2526/*
2527 * extra dictionary contains data relevant for the given flags:
2528 * PARSE_STACKSHOT_ZOMBIE:   zombie_child_pid_key -> @(pid)
2529 * PARSE_STACKSHOT_POSTEXEC: postexec_child_unique_pid_key -> @(unique_pid)
2530 */
2531static void
2532parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra)
2533{
2534	bool delta = (stackshot_parsing_flags & PARSE_STACKSHOT_DELTA);
2535	bool expect_sharedcache_child = (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_FLAGS);
2536	bool expect_zombie_child = (stackshot_parsing_flags & PARSE_STACKSHOT_ZOMBIE);
2537	bool expect_postexec_child = (stackshot_parsing_flags & PARSE_STACKSHOT_POSTEXEC);
2538	bool expect_cseg_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_CSEG);
2539	bool expect_translated_child = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSLATED);
2540	bool expect_shared_cache_layout = false;
2541	bool expect_shared_cache_uuid = !delta;
2542	bool expect_dispatch_queue_label = (stackshot_parsing_flags & PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL);
2543	bool expect_turnstile_lock = (stackshot_parsing_flags & PARSE_STACKSHOT_TURNSTILEINFO);
2544	bool expect_srp_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_SRP);
2545	bool expect_sp_throttled = (stackshot_parsing_flags & PARSE_STACKSHOT_THROTTLED_SP);
2546	bool expect_exec_inprogress = (stackshot_parsing_flags & PARSE_STACKSHOT_EXEC_INPROGRESS);
2547	bool expect_transitioning_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSITIONING);
2548	bool expect_asyncstack = (stackshot_parsing_flags & PARSE_STACKSHOT_ASYNCSTACK);
2549	bool expect_driverkit = (stackshot_parsing_flags & PARSE_STACKSHOT_DRIVERKIT);
2550	bool expect_suspendinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_SUSPENDINFO);
2551	bool found_zombie_child = false, found_postexec_child = false, found_shared_cache_layout = false, found_shared_cache_uuid = false;
2552	bool found_translated_child = false, found_transitioning_task = false;
2553	bool found_dispatch_queue_label = false, found_turnstile_lock = false;
2554	bool found_cseg_waitinfo = false, found_srp_waitinfo = false;
2555	bool found_sharedcache_child = false, found_sharedcache_badflags = false, found_sharedcache_self = false;
2556	bool found_asyncstack = false;
2557	bool found_throttled_service = false;
2558	bool found_exclaves = false;
2559	uint64_t srp_expected_threadid = 0;
2560	pid_t zombie_child_pid = -1, srp_expected_pid = -1, sharedcache_child_pid = -1, throttled_service_ctx = -1;
2561	pid_t translated_child_pid = -1, transistioning_task_pid = -1;
2562	bool sharedcache_child_sameaddr = false, is_throttled = false;
2563	uint64_t postexec_child_unique_pid = 0, cseg_expected_threadid = 0;
2564	uint64_t sharedcache_child_flags = 0, sharedcache_self_flags = 0;
2565	uint64_t asyncstack_threadid = 0;
2566	NSArray *asyncstack_stack = nil;
2567	char *inflatedBufferBase = NULL;
2568	pid_t exec_inprogress_pid = -1;
2569	void (^exec_inprogress_cb)(uint64_t, uint64_t) = NULL;
2570	int exec_inprogress_found = 0;
2571	uint64_t exec_inprogress_containerid = 0;
2572	void (^driverkit_cb)(pid_t) = NULL;
2573	NSMutableDictionary *sharedCaches = [NSMutableDictionary new];
2574
2575	if (expect_shared_cache_uuid) {
2576		uuid_t shared_cache_uuid;
2577		if (!_dyld_get_shared_cache_uuid(shared_cache_uuid)) {
2578			T_LOG("Skipping verifying shared cache UUID in stackshot data because not running with a shared cache");
2579			expect_shared_cache_uuid = false;
2580		}
2581	}
2582
2583	if (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_LAYOUT) {
2584		size_t shared_cache_length = 0;
2585		const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length);
2586		T_QUIET; T_ASSERT_NOTNULL(cache_header, "current process running with shared cache");
2587		T_QUIET; T_ASSERT_GT(shared_cache_length, sizeof(struct _dyld_cache_header), "valid shared cache length populated by _dyld_get_shared_cache_range");
2588
2589		if (_dyld_shared_cache_is_locally_built()) {
2590			T_LOG("device running with locally built shared cache, expect shared cache layout");
2591			expect_shared_cache_layout = true;
2592		} else {
2593			T_LOG("device running with B&I built shared-cache, no shared cache layout expected");
2594		}
2595	}
2596
2597	if (expect_sharedcache_child) {
2598		NSNumber* pid_num = extra[sharedcache_child_pid_key];
2599		NSNumber* sameaddr_num = extra[sharedcache_child_sameaddr_key];
2600		T_QUIET; T_ASSERT_NOTNULL(pid_num, "sharedcache child pid provided");
2601		T_QUIET; T_ASSERT_NOTNULL(sameaddr_num, "sharedcache child addrsame provided");
2602		sharedcache_child_pid = [pid_num intValue];
2603		T_QUIET; T_ASSERT_GT(sharedcache_child_pid, 0, "sharedcache child pid greater than zero");
2604		sharedcache_child_sameaddr = [sameaddr_num intValue];
2605		T_QUIET; T_ASSERT_GE([sameaddr_num intValue], 0, "sharedcache child sameaddr is boolean (0 or 1)");
2606		T_QUIET; T_ASSERT_LE([sameaddr_num intValue], 1, "sharedcache child sameaddr is boolean (0 or 1)");
2607	}
2608
2609    if (expect_transitioning_task) {
2610        NSNumber* pid_num = extra[transitioning_pid_key];
2611        T_ASSERT_NOTNULL(pid_num, "transitioning task pid provided");
2612        transistioning_task_pid = [pid_num intValue];
2613    }
2614
2615	if (expect_zombie_child) {
2616		NSNumber* pid_num = extra[zombie_child_pid_key];
2617		T_QUIET; T_ASSERT_NOTNULL(pid_num, "zombie child pid provided");
2618		zombie_child_pid = [pid_num intValue];
2619		T_QUIET; T_ASSERT_GT(zombie_child_pid, 0, "zombie child pid greater than zero");
2620	}
2621
2622	if (expect_postexec_child) {
2623		NSNumber* unique_pid_num = extra[postexec_child_unique_pid_key];
2624		T_QUIET; T_ASSERT_NOTNULL(unique_pid_num, "postexec child unique pid provided");
2625		postexec_child_unique_pid = [unique_pid_num unsignedLongLongValue];
2626		T_QUIET; T_ASSERT_GT(postexec_child_unique_pid, 0ull, "postexec child unique pid greater than zero");
2627	}
2628
2629	if (expect_cseg_waitinfo) {
2630		NSNumber* tid_num = extra[cseg_expected_threadid_key];
2631		T_QUIET; T_ASSERT_NOTNULL(tid_num, "cseg's expected thread id provided");
2632		cseg_expected_threadid = tid_num.unsignedLongValue;
2633		T_QUIET; T_ASSERT_GT(cseg_expected_threadid, UINT64_C(0), "compressor segment thread is present");
2634	}
2635
2636	if (expect_srp_waitinfo) {
2637		NSNumber* threadid_num = extra[srp_expected_threadid_key];
2638		NSNumber* pid_num = extra[srp_expected_pid_key];
2639		T_QUIET; T_ASSERT_TRUE(threadid_num != nil || pid_num != nil, "expected SRP threadid or pid");
2640		if (threadid_num != nil) {
2641			srp_expected_threadid = [threadid_num unsignedLongLongValue];
2642			T_QUIET; T_ASSERT_GT(srp_expected_threadid, 0ull, "srp_expected_threadid greater than zero");
2643		}
2644		if (pid_num != nil) {
2645			srp_expected_pid = [pid_num intValue];
2646			T_QUIET; T_ASSERT_GT(srp_expected_pid, 0, "srp_expected_pid greater than zero");
2647		}
2648		T_LOG("looking for SRP pid: %d threadid: %llu", srp_expected_pid, srp_expected_threadid);
2649	}
2650
2651	if (expect_sp_throttled) {
2652		NSNumber* ctx = extra[sp_throttled_expected_ctxt_key];
2653		T_QUIET; T_ASSERT_TRUE(ctx != nil, "expected pid");
2654		throttled_service_ctx = [ctx intValue];
2655		T_QUIET; T_ASSERT_GT(throttled_service_ctx, 0, "expected pid greater than zero");
2656
2657		NSNumber *throttled = extra[sp_throttled_expect_flag];
2658		T_QUIET; T_ASSERT_TRUE(throttled != nil, "expected flag value");
2659		is_throttled = ([throttled intValue] != 0);
2660
2661		T_LOG("Looking for service with ctxt: %d, thottled:%d", throttled_service_ctx, is_throttled);
2662	}
2663
2664	if (expect_translated_child) {
2665		NSNumber* pid_num = extra[translated_child_pid_key];
2666		T_QUIET; T_ASSERT_NOTNULL(pid_num, "translated child pid provided");
2667		translated_child_pid = [pid_num intValue];
2668		T_QUIET; T_ASSERT_GT(translated_child_pid, 0, "translated child pid greater than zero");
2669	}
2670	if (expect_exec_inprogress) {
2671		NSNumber* pid_num = extra[exec_inprogress_pid_key];
2672		T_QUIET; T_ASSERT_NOTNULL(pid_num, "exec inprogress pid provided");
2673		exec_inprogress_pid = [pid_num intValue];
2674		T_QUIET; T_ASSERT_GT(exec_inprogress_pid, 0, "exec inprogress pid greater than zero");
2675
2676		exec_inprogress_cb = extra[exec_inprogress_found_key];
2677		T_QUIET; T_ASSERT_NOTNULL(exec_inprogress_cb, "exec inprogress found callback provided");
2678	}
2679	if (expect_driverkit) {
2680		driverkit_cb = extra[driverkit_found_key];
2681		T_QUIET; T_ASSERT_NOTNULL(driverkit_cb, "driverkit found callback provided");
2682	}
2683
2684	if (expect_asyncstack) {
2685		NSNumber* threadid_id = extra[asyncstack_expected_threadid_key];
2686		T_QUIET; T_ASSERT_NOTNULL(threadid_id, "asyncstack threadid provided");
2687		asyncstack_threadid = [threadid_id unsignedLongLongValue];
2688		asyncstack_stack = extra[asyncstack_expected_stack_key];
2689		T_QUIET; T_ASSERT_NOTNULL(asyncstack_stack, "asyncstack expected stack provided");
2690	}
2691
2692	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2693	if (delta) {
2694		T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT,
2695				"buffer provided is a delta stackshot");
2696
2697			iter = kcdata_iter_next(iter);
2698	} else {
2699		if (kcdata_iter_type(iter) != KCDATA_BUFFER_BEGIN_COMPRESSED) {
2700			T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
2701					"buffer provided is a stackshot");
2702
2703			iter = kcdata_iter_next(iter);
2704		} else {
2705			/* we are dealing with a compressed buffer */
2706			iter = kcdata_iter_next(iter);
2707			uint64_t compression_type = 0, totalout = 0, totalin = 0;
2708
2709			uint64_t *data;
2710			char *desc;
2711			for (int i = 0; i < 3; i ++) {
2712				kcdata_iter_get_data_with_desc(iter, &desc, (void **)&data, NULL);
2713				if (strcmp(desc, "kcd_c_type") == 0) {
2714					compression_type = *data;
2715				} else if (strcmp(desc, "kcd_c_totalout") == 0){
2716					totalout = *data;
2717				} else if (strcmp(desc, "kcd_c_totalin") == 0){
2718					totalin = *data;
2719				}
2720
2721				iter = kcdata_iter_next(iter);
2722			}
2723
2724			T_ASSERT_EQ(compression_type, UINT64_C(1), "zlib compression is used");
2725			T_ASSERT_GT(totalout, UINT64_C(0), "successfully gathered how long the compressed buffer is");
2726			T_ASSERT_GT(totalin, UINT64_C(0), "successfully gathered how long the uncompressed buffer will be at least");
2727
2728			/* progress to the next kcdata item */
2729			T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "compressed stackshot found");
2730
2731			char *bufferBase = kcdata_iter_payload(iter);
2732
2733			/*
2734			 * zlib is used, allocate a buffer based on the metadata, plus
2735			 * extra scratch space (+12.5%) in case totalin was inconsistent
2736			 */
2737			size_t inflatedBufferSize = totalin + (totalin >> 3);
2738			inflatedBufferBase = malloc(inflatedBufferSize);
2739			T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(inflatedBufferBase, "allocated temporary output buffer");
2740
2741			z_stream zs;
2742			memset(&zs, 0, sizeof(zs));
2743			T_QUIET; T_ASSERT_EQ(inflateInit(&zs), Z_OK, "inflateInit OK");
2744			zs.next_in = (unsigned char *)bufferBase;
2745			T_QUIET; T_ASSERT_LE(totalout, (uint64_t)UINT_MAX, "stackshot is not too large");
2746			zs.avail_in = (uInt)totalout;
2747			zs.next_out = (unsigned char *)inflatedBufferBase;
2748			T_QUIET; T_ASSERT_LE(inflatedBufferSize, (size_t)UINT_MAX, "output region is not too large");
2749			zs.avail_out = (uInt)inflatedBufferSize;
2750			T_ASSERT_EQ(inflate(&zs, Z_FINISH), Z_STREAM_END, "inflated buffer");
2751			inflateEnd(&zs);
2752
2753			T_ASSERT_EQ((uint64_t)zs.total_out, totalin, "expected number of bytes inflated");
2754
2755			/* copy the data after the compressed area */
2756			T_QUIET; T_ASSERT_GE((void *)bufferBase, ssbuf,
2757					"base of compressed stackshot is after the returned stackshot buffer");
2758			size_t header_size = (size_t)(bufferBase - (char *)ssbuf);
2759			size_t data_after_compressed_size = sslen - totalout - header_size;
2760			T_QUIET; T_ASSERT_LE(data_after_compressed_size,
2761					inflatedBufferSize - zs.total_out,
2762					"footer fits in the buffer");
2763			memcpy(inflatedBufferBase + zs.total_out,
2764					bufferBase + totalout,
2765					data_after_compressed_size);
2766
2767			iter = kcdata_iter(inflatedBufferBase, inflatedBufferSize);
2768		}
2769	}
2770
2771	KCDATA_ITER_FOREACH(iter) {
2772		NSError *error = nil;
2773
2774		switch (kcdata_iter_type(iter)) {
2775		case KCDATA_TYPE_ARRAY: {
2776			T_QUIET;
2777			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
2778					"checked that array is valid");
2779
2780			NSMutableDictionary *array = parseKCDataArray(iter, &error);
2781			T_QUIET; T_ASSERT_NOTNULL(array, "parsed array from stackshot");
2782			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing array");
2783
2784			if (kcdata_iter_array_elem_type(iter) == STACKSHOT_KCTYPE_SYS_SHAREDCACHE_LAYOUT) {
2785				struct dyld_uuid_info_64 *shared_cache_uuids = kcdata_iter_payload(iter);
2786				uint32_t uuid_count = kcdata_iter_array_elem_count(iter);
2787				T_ASSERT_NOTNULL(shared_cache_uuids, "parsed shared cache layout array");
2788				T_ASSERT_GT(uuid_count, 0, "returned valid number of UUIDs from shared cache");
2789				verify_stackshot_sharedcache_layout(shared_cache_uuids, uuid_count);
2790				found_shared_cache_layout = true;
2791			}
2792
2793			break;
2794		}
2795
2796		case KCDATA_TYPE_CONTAINER_BEGIN: {
2797			T_QUIET;
2798			T_ASSERT_TRUE(kcdata_iter_container_valid(iter),
2799					"checked that container is valid");
2800
2801			uint64_t containerid = kcdata_iter_container_id(iter);
2802			uint32_t container_type = kcdata_iter_container_type(iter);
2803
2804			if (container_type == STACKSHOT_KCCONTAINER_SHAREDCACHE) {
2805				NSDictionary *container = parseKCDataContainer(&iter, &error);
2806				T_QUIET; T_ASSERT_NOTNULL(container, "parsed sharedcache container from stackshot");
2807				T_QUIET; T_ASSERT_NULL(error, "error unset after parsing sharedcache container");
2808				T_QUIET; T_EXPECT_EQ(sharedCaches[@(containerid)], nil, "sharedcache containerid %lld should be unique", containerid);
2809				sharedCaches[@(containerid)] = container;
2810				break;
2811			}
2812
2813			if (container_type == STACKSHOT_KCCONTAINER_EXCLAVES) {
2814				found_exclaves = true;
2815				break;
2816			}
2817
2818			/*
2819			 * treat containers other than tasks/transitioning_tasks
2820			 * as expanded in-line.
2821			 */
2822			if (container_type != STACKSHOT_KCCONTAINER_TASK &&
2823			    container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK) {
2824				T_LOG("container skipped: %d", container_type);
2825				break;
2826			}
2827			NSDictionary *container = parseKCDataContainer(&iter, &error);
2828			T_QUIET; T_ASSERT_NOTNULL(container, "parsed task/transitioning_task container from stackshot");
2829			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container");
2830
2831			NSDictionary* task_snapshot = container[@"task_snapshots"][@"task_snapshot"];
2832			NSDictionary* task_delta_snapshot = container[@"task_snapshots"][@"task_delta_snapshot"];
2833			NSDictionary* transitioning_task_snapshot = container[@"transitioning_task_snapshots"][@"transitioning_task_snapshot"];
2834
2835			/*
2836			 * Having processed the container, we now only check it
2837			 * if it's the correct type.
2838			 */
2839			if ((!expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TASK)) ||
2840			    (expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK))) {
2841				break;
2842			}
2843			if (!expect_transitioning_task) {
2844			    	T_QUIET; T_ASSERT_TRUE(!!task_snapshot != !!task_delta_snapshot, "Either task_snapshot xor task_delta_snapshot provided");
2845			}
2846
2847			if (expect_dispatch_queue_label && !found_dispatch_queue_label) {
2848				for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) {
2849					NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key];
2850					NSString *dql = thread[@"dispatch_queue_label"];
2851
2852					if ([dql isEqualToString:@TEST_STACKSHOT_QUEUE_LABEL]) {
2853						found_dispatch_queue_label = true;
2854						break;
2855					}
2856				}
2857			}
2858
2859			if (expect_transitioning_task && !found_transitioning_task) {
2860				if (transitioning_task_snapshot) {
2861					uint64_t the_pid = [transitioning_task_snapshot[@"tts_pid"] unsignedLongLongValue];
2862					if (the_pid == (uint64_t)transistioning_task_pid) {
2863					    found_transitioning_task = true;
2864					    T_PASS("FOUND Transitioning task %llu has a transitioning task snapshot", (uint64_t) transistioning_task_pid);
2865					    break;
2866					}
2867				}
2868			}
2869
2870			if (expect_postexec_child && !found_postexec_child) {
2871				if (task_snapshot) {
2872					uint64_t unique_pid = [task_snapshot[@"ts_unique_pid"] unsignedLongLongValue];
2873					if (unique_pid == postexec_child_unique_pid) {
2874						found_postexec_child = true;
2875
2876						T_PASS("post-exec child %llu has a task snapshot", postexec_child_unique_pid);
2877
2878						break;
2879					}
2880				}
2881
2882				if (task_delta_snapshot) {
2883					uint64_t unique_pid = [task_delta_snapshot[@"tds_unique_pid"] unsignedLongLongValue];
2884					if (unique_pid == postexec_child_unique_pid) {
2885						found_postexec_child = true;
2886
2887						T_FAIL("post-exec child %llu shouldn't have a delta task snapshot", postexec_child_unique_pid);
2888
2889						break;
2890					}
2891				}
2892			}
2893
2894			if (!task_snapshot) {
2895				break;
2896			}
2897
2898			int pid = [task_snapshot[@"ts_pid"] intValue];
2899
2900			if (pid && expect_shared_cache_uuid && !found_shared_cache_uuid) {
2901				id ptr = container[@"task_snapshots"][@"shared_cache_dyld_load_info"];
2902				if (ptr) {
2903					id uuid = ptr[@"imageUUID"];
2904
2905					uint8_t uuid_p[16];
2906					for (unsigned int i = 0; i < 16; i ++) {
2907						NSNumber *uuidByte = uuid[i];
2908						uuid_p[i] = (uint8_t)uuidByte.charValue;
2909					}
2910
2911					check_shared_cache_uuid(uuid_p);
2912
2913					uint64_t baseAddress = (uint64_t)((NSNumber *)ptr[@"imageSlidBaseAddress"]).longLongValue;
2914					uint64_t firstMapping = (uint64_t)((NSNumber *)ptr[@"sharedCacheSlidFirstMapping"]).longLongValue;
2915
2916					T_EXPECT_LE(baseAddress, firstMapping,
2917						"in per-task shared_cache_dyld_load_info, "
2918						"baseAddress <= firstMapping");
2919					T_EXPECT_GE(baseAddress + (7ull << 32) + (1ull << 29),
2920						firstMapping,
2921						"in per-task shared_cache_dyld_load_info, "
2922						"baseAddress + 28.5gig >= firstMapping");
2923
2924					size_t shared_cache_len;
2925					const void *addr = _dyld_get_shared_cache_range(&shared_cache_len);
2926					T_EXPECT_EQ((uint64_t)addr, firstMapping,
2927							"SlidFirstMapping should match shared_cache_range");
2928
2929					/*
2930					 * check_shared_cache_uuid() will assert on failure, so if
2931					 * we get here, then we have found the shared cache UUID
2932					 * and it's correct
2933					 */
2934					found_shared_cache_uuid = true;
2935				}
2936			}
2937
2938			if (expect_sharedcache_child) {
2939				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
2940				uint64_t sharedregion_flags = (task_flags & (kTaskSharedRegionNone | kTaskSharedRegionSystem | kTaskSharedRegionOther));
2941				id sharedregion_info = container[@"task_snapshots"][@"shared_cache_dyld_load_info"];
2942				id sharedcache_id = container[@"task_snapshots"][@"sharedCacheID"];
2943				if (!found_sharedcache_badflags) {
2944					T_QUIET; T_EXPECT_NE(sharedregion_flags, 0ll, "one of the kTaskSharedRegion flags should be set on all tasks");
2945					bool multiple = (sharedregion_flags & (sharedregion_flags - 1)) != 0;
2946					T_QUIET; T_EXPECT_FALSE(multiple, "only one kTaskSharedRegion flag should be set on each task");
2947					found_sharedcache_badflags = (sharedregion_flags == 0 || multiple);
2948				}
2949				if (pid == 0) {
2950					T_ASSERT_EQ(sharedregion_flags, (uint64_t)kTaskSharedRegionNone, "Kernel proc (pid 0) should have no shared region");
2951				} else if (pid == sharedcache_child_pid) {
2952					found_sharedcache_child = true;
2953					sharedcache_child_flags = sharedregion_flags;
2954				} else if (pid == getpid()) {
2955					found_sharedcache_self = true;
2956					sharedcache_self_flags = sharedregion_flags;
2957				}
2958				if (sharedregion_flags == kTaskSharedRegionOther && !(task_flags & kTaskSharedRegionInfoUnavailable)) {
2959					T_QUIET; T_EXPECT_NOTNULL(sharedregion_info, "kTaskSharedRegionOther should have a shared_cache_dyld_load_info struct");
2960					T_QUIET; T_EXPECT_NOTNULL(sharedcache_id, "kTaskSharedRegionOther should have a sharedCacheID");
2961					if (sharedcache_id != nil) {
2962						T_QUIET; T_EXPECT_NOTNULL(sharedCaches[sharedcache_id], "sharedCacheID %d should exist", [sharedcache_id intValue]);
2963					}
2964				} else {
2965					T_QUIET; T_EXPECT_NULL(sharedregion_info, "non-kTaskSharedRegionOther should have no shared_cache_dyld_load_info struct");
2966					T_QUIET; T_EXPECT_NULL(sharedcache_id, "non-kTaskSharedRegionOther should have no sharedCacheID");
2967				}
2968			}
2969
2970			if (expect_zombie_child && (pid == zombie_child_pid)) {
2971				found_zombie_child = true;
2972
2973				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
2974				T_ASSERT_TRUE((task_flags & kTerminatedSnapshot) == kTerminatedSnapshot, "child zombie marked as terminated");
2975
2976				continue;
2977			}
2978
2979			if (expect_translated_child && (pid == translated_child_pid)) {
2980				found_translated_child = true;
2981
2982				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
2983				T_EXPECT_BITS_SET(task_flags, kTaskIsTranslated, "child marked as translated");
2984
2985				continue;
2986			}
2987			if (expect_exec_inprogress && (pid == exec_inprogress_pid || pid == -exec_inprogress_pid)) {
2988				exec_inprogress_found++;
2989				T_LOG("found exec task with pid %d, instance %d", pid, exec_inprogress_found);
2990				T_QUIET; T_ASSERT_LE(exec_inprogress_found, 2, "no more than two with the expected pid");
2991				if (exec_inprogress_found == 2) {
2992					T_LOG("found 2 tasks with pid %d", exec_inprogress_pid);
2993					exec_inprogress_cb(containerid, exec_inprogress_containerid);
2994				} else {
2995					exec_inprogress_containerid = containerid;
2996				}
2997			}
2998			if (expect_driverkit && driverkit_cb != NULL) {
2999				driverkit_cb(pid);
3000			}
3001			if (expect_cseg_waitinfo) {
3002				NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"];
3003
3004				for (id i in winfos) {
3005					NSNumber *waitType = i[@"wait_type"];
3006					NSNumber *owner = i[@"owner"];
3007					if (waitType.intValue == kThreadWaitCompressor &&
3008							owner.unsignedLongValue == cseg_expected_threadid) {
3009						found_cseg_waitinfo = true;
3010						break;
3011					}
3012				}
3013			}
3014
3015			if (expect_srp_waitinfo) {
3016				NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3017				NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"];
3018				for (id i in tinfos) {
3019					if (!found_srp_waitinfo) {
3020						bool found_thread = false;
3021						bool found_pid = false;
3022						if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_THREAD) &&
3023						    [i[@"turnstile_context"] unsignedLongLongValue] == srp_expected_threadid &&
3024						    srp_expected_threadid != 0) {
3025							found_thread = true;
3026						}
3027						if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_BLOCKED_ON_TASK) &&
3028						    [i[@"turnstile_context"] intValue] == srp_expected_pid &&
3029						    srp_expected_pid != -1) {
3030							found_pid = true;
3031						}
3032						if (found_pid || found_thread) {
3033							T_LOG("found SRP %s %lld waiter: %d", (found_thread ? "thread" : "pid"),
3034							    [i[@"turnstile_context"] unsignedLongLongValue], [i[@"waiter"] intValue]);
3035							/* we found something that is blocking the correct threadid */
3036							for (id j in winfos) {
3037								if ([j[@"waiter"] intValue] == [i[@"waiter"] intValue] &&
3038								    [j[@"wait_type"] intValue] == kThreadWaitPortReceive) {
3039									found_srp_waitinfo = true;
3040									T_EXPECT_EQ([j[@"wait_flags"] intValue], STACKSHOT_WAITINFO_FLAGS_SPECIALREPLY,
3041									    "SRP waitinfo should be marked as a special reply");
3042									break;
3043								}
3044							}
3045
3046							if (found_srp_waitinfo) {
3047								break;
3048							}
3049						}
3050					}
3051				}
3052			}
3053
3054			if (expect_sp_throttled) {
3055				NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3056				for (id i in tinfos) {
3057					if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_PORTFLAGS)
3058						&& [i[@"turnstile_context"] intValue] == throttled_service_ctx) {
3059						int portlabel_id = [i[@"portlabel_id"] intValue];
3060						T_LOG("[pid:%d] Turnstile (flags = 0x%x, ctx = %d, portlabel_id = %d)", pid,
3061							[i[@"turnstile_flags"] intValue], [i[@"turnstile_context"] intValue], portlabel_id);
3062						for (id portid in container[@"task_snapshots"][@"portlabels"]) {
3063							if (portlabel_id != [portid intValue]) {
3064								continue;
3065							}
3066
3067							NSMutableDictionary *portlabel = container[@"task_snapshots"][@"portlabels"][portid];
3068							T_ASSERT_TRUE(portlabel != nil, "Found portlabel id: %d", [portid intValue]);
3069							NSString *portlabel_name = portlabel[@"portlabel_name"];
3070							T_EXPECT_TRUE(portlabel_name != nil, "Found portlabel %s", portlabel_name.UTF8String);
3071							T_EXPECT_EQ_STR(portlabel_name.UTF8String, THROTTLED_SERVICE_NAME, "throttled service port name matches");
3072							T_EXPECT_EQ(([portlabel[@"portlabel_flags"] intValue] & STACKSHOT_PORTLABEL_THROTTLED) != 0,
3073								is_throttled, "Port %s throttled", is_throttled ? "is" : "isn't");
3074							found_throttled_service = true;
3075							break;
3076						}
3077					}
3078
3079					if (found_throttled_service) {
3080						break;
3081					}
3082				}
3083			}
3084
3085			if (expect_suspendinfo) {
3086				// TODO: rdar://112563110
3087			}
3088
3089			if (pid != getpid()) {
3090				break;
3091			}
3092
3093			T_EXPECT_EQ_STR(current_process_name(),
3094					[task_snapshot[@"ts_p_comm"] UTF8String],
3095					"current process name matches in stackshot");
3096
3097			uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3098			T_ASSERT_BITS_NOTSET(task_flags, kTerminatedSnapshot, "current process not marked as terminated");
3099			T_ASSERT_BITS_NOTSET(task_flags, kTaskIsTranslated, "current process not marked as translated");
3100
3101			T_QUIET;
3102			T_EXPECT_LE(pid, [task_snapshot[@"ts_unique_pid"] intValue],
3103					"unique pid is greater than pid");
3104
3105			NSDictionary* task_cpu_architecture = container[@"task_snapshots"][@"task_cpu_architecture"];
3106			T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cputype"], "have cputype");
3107			T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cpusubtype"], "have cputype");
3108			int cputype = [task_cpu_architecture[@"cputype"] intValue];
3109			int cpusubtype = [task_cpu_architecture[@"cpusubtype"] intValue];
3110
3111			struct proc_archinfo archinfo;
3112			int retval = proc_pidinfo(pid, PROC_PIDARCHINFO, 0, &archinfo, sizeof(archinfo));
3113			T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDARCHINFO) returned a value > 0");
3114			T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(struct proc_archinfo), "proc_pidinfo call for PROC_PIDARCHINFO returned expected size");
3115			T_QUIET; T_EXPECT_EQ(cputype, archinfo.p_cputype, "cpu type is correct");
3116			T_QUIET; T_EXPECT_EQ(cpusubtype, archinfo.p_cpusubtype, "cpu subtype is correct");
3117
3118			NSDictionary * codesigning_info = container[@"task_snapshots"][@"stackshot_task_codesigning_info"];
3119			T_QUIET; T_ASSERT_NOTNULL(codesigning_info[@"csflags"], "have csflags");
3120			uint64_t flags = [codesigning_info[@"csflags"] unsignedLongLongValue];
3121			T_QUIET; T_EXPECT_GT(flags, 0, "nonzero csflags");
3122
3123			T_QUIET; T_ASSERT_NOTNULL(container[@"task_snapshots"][@"jetsam_coalition"], "have jetsam coalition");
3124			uint64_t jetsam_coalition = [container[@"task_snapshots"][@"jetsam_coalition"] unsignedLongLongValue];
3125			T_QUIET; T_EXPECT_GT(jetsam_coalition, 0, "nonzero jetsam coalition");
3126
3127			bool found_main_thread = false;
3128			uint64_t main_thread_id = -1ULL;
3129			bool found_null_kernel_frame = false;
3130			for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) {
3131				NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key];
3132				NSDictionary *thread_snap = thread[@"thread_snapshot"];
3133
3134				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_thread_id"] intValue], 0,
3135						"thread ID of thread in current task is valid");
3136				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_base_priority"] intValue], 0,
3137						"base priority of thread in current task is valid");
3138				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_sched_priority"] intValue], 0,
3139						"scheduling priority of thread in current task is valid");
3140
3141				NSString *pth_name = thread[@"pth_name"];
3142				if (pth_name != nil && [pth_name isEqualToString:@TEST_THREAD_NAME]) {
3143					found_main_thread = true;
3144					main_thread_id = [thread_snap[@"ths_thread_id"] unsignedLongLongValue];
3145
3146					T_QUIET; T_EXPECT_GT([thread_snap[@"ths_total_syscalls"] intValue], 0,
3147							"total syscalls of current thread is valid");
3148
3149					NSDictionary *cpu_times = thread[@"cpu_times"];
3150					T_EXPECT_GE([cpu_times[@"runnable_time"] intValue],
3151							[cpu_times[@"system_time"] intValue] +
3152							[cpu_times[@"user_time"] intValue],
3153							"runnable time of current thread is valid");
3154				}
3155				if (!found_null_kernel_frame) {
3156					for (NSNumber *frame in thread[@"kernel_frames"]) {
3157						if (frame.unsignedLongValue == 0) {
3158							found_null_kernel_frame = true;
3159							break;
3160						}
3161					}
3162				}
3163				if (expect_asyncstack && !found_asyncstack &&
3164				    asyncstack_threadid == [thread_snap[@"ths_thread_id"] unsignedLongLongValue]) {
3165					found_asyncstack = true;
3166					NSArray* async_stack = thread[@"user_async_stack_frames"];
3167					NSNumber* start_idx = thread[@"user_async_start_index"];
3168					NSArray* user_stack = thread[@"user_stack_frames"];
3169					T_QUIET; T_ASSERT_NOTNULL(async_stack, "async thread %#llx has user_async_stack_frames", asyncstack_threadid);
3170					T_QUIET; T_ASSERT_NOTNULL(start_idx, "async thread %#llx has user_async_start_index", asyncstack_threadid);
3171					T_QUIET; T_ASSERT_NOTNULL(user_stack, "async thread %#llx has user_stack_frames", asyncstack_threadid);
3172					T_QUIET; T_ASSERT_EQ(async_stack.count, asyncstack_stack.count,
3173						"actual async_stack count == expected async_stack count");
3174					for (size_t i = 0; i < async_stack.count; i++) {
3175						T_EXPECT_EQ([async_stack[i][@"lr"] unsignedLongLongValue],
3176							[asyncstack_stack[i] unsignedLongLongValue], "frame %zu matches", i);
3177					}
3178				}
3179
3180			}
3181			T_EXPECT_TRUE(found_main_thread, "found main thread for current task in stackshot");
3182			T_EXPECT_FALSE(found_null_kernel_frame, "should not see any NULL kernel frames");
3183
3184			if (expect_turnstile_lock && !found_turnstile_lock) {
3185				NSArray *tsinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3186
3187				for (id i in tsinfos) {
3188					if ([i[@"turnstile_context"] unsignedLongLongValue] == main_thread_id) {
3189						found_turnstile_lock = true;
3190						break;
3191					}
3192				}
3193			}
3194			break;
3195		}
3196		case STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO: {
3197			// Legacy shared cache info
3198			struct dyld_shared_cache_loadinfo *payload = kcdata_iter_payload(iter);
3199			T_ASSERT_EQ((size_t)kcdata_iter_size(iter), sizeof(*payload), "valid dyld_shared_cache_loadinfo struct");
3200
3201			check_shared_cache_uuid(payload->sharedCacheUUID);
3202
3203			T_EXPECT_LE(payload->sharedCacheUnreliableSlidBaseAddress,
3204				payload->sharedCacheSlidFirstMapping,
3205				"SlidBaseAddress <= SlidFirstMapping");
3206			T_EXPECT_GE(payload->sharedCacheUnreliableSlidBaseAddress + (7ull << 32) + (1ull << 29),
3207				payload->sharedCacheSlidFirstMapping,
3208				"SlidFirstMapping should be within 28.5gigs of SlidBaseAddress");
3209
3210			size_t shared_cache_len;
3211			const void *addr = _dyld_get_shared_cache_range(&shared_cache_len);
3212			T_EXPECT_EQ((uint64_t)addr, payload->sharedCacheSlidFirstMapping,
3213			    "SlidFirstMapping should match shared_cache_range");
3214
3215			/*
3216			 * check_shared_cache_uuid() asserts on failure, so we must have
3217			 * found the shared cache UUID to be correct.
3218			 */
3219			found_shared_cache_uuid = true;
3220			break;
3221		}
3222		}
3223	}
3224
3225	if (expect_sharedcache_child) {
3226		T_QUIET; T_ASSERT_TRUE(found_sharedcache_child, "found sharedcache child in kcdata");
3227		T_QUIET; T_ASSERT_TRUE(found_sharedcache_self, "found self in kcdata");
3228		if (found_sharedcache_child && found_sharedcache_self) {
3229			T_QUIET; T_ASSERT_NE(sharedcache_child_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache child should have shared region");
3230			T_QUIET; T_ASSERT_NE(sharedcache_self_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache: self should have shared region");
3231			if (sharedcache_self_flags == kTaskSharedRegionSystem && !sharedcache_child_sameaddr) {
3232				/* If we're in the system shared region, and the child has a different address, child must have an Other shared region */
3233				T_ASSERT_EQ(sharedcache_child_flags, (uint64_t)kTaskSharedRegionOther,
3234				    "sharedcache child should have Other shared region");
3235			}
3236		}
3237	}
3238
3239	if (expect_transitioning_task) {
3240		T_QUIET; T_ASSERT_TRUE(found_transitioning_task, "found transitioning_task child in kcdata");
3241	}
3242
3243	if (expect_exec_inprogress) {
3244		T_QUIET; T_ASSERT_GT(exec_inprogress_found, 0, "found at least 1 task for execing process");
3245	}
3246
3247	if (expect_zombie_child) {
3248		T_QUIET; T_ASSERT_TRUE(found_zombie_child, "found zombie child in kcdata");
3249	}
3250
3251	if (expect_postexec_child) {
3252		T_QUIET; T_ASSERT_TRUE(found_postexec_child, "found post-exec child in kcdata");
3253	}
3254
3255	if (expect_translated_child) {
3256		T_QUIET; T_ASSERT_TRUE(found_translated_child, "found translated child in kcdata");
3257	}
3258
3259	if (expect_shared_cache_layout) {
3260		T_QUIET; T_ASSERT_TRUE(found_shared_cache_layout, "shared cache layout found in kcdata");
3261	}
3262
3263	if (expect_shared_cache_uuid) {
3264		T_QUIET; T_ASSERT_TRUE(found_shared_cache_uuid, "shared cache UUID found in kcdata");
3265	}
3266
3267	if (expect_dispatch_queue_label) {
3268		T_QUIET; T_ASSERT_TRUE(found_dispatch_queue_label, "dispatch queue label found in kcdata");
3269	}
3270
3271	if (expect_turnstile_lock) {
3272		T_QUIET; T_ASSERT_TRUE(found_turnstile_lock, "found expected deadlock");
3273	}
3274
3275	if (expect_cseg_waitinfo) {
3276		T_QUIET; T_ASSERT_TRUE(found_cseg_waitinfo, "found c_seg waitinfo");
3277	}
3278
3279	if (expect_srp_waitinfo) {
3280		T_QUIET; T_ASSERT_TRUE(found_srp_waitinfo, "found special reply port waitinfo");
3281	}
3282
3283	if (expect_sp_throttled) {
3284		T_QUIET; T_ASSERT_TRUE(found_throttled_service, "found the throttled service");
3285	}
3286
3287	if (expect_asyncstack) {
3288		T_QUIET; T_ASSERT_TRUE(found_asyncstack, "found async stack threadid");
3289	}
3290
3291	if ([extra objectForKey:no_exclaves_key] != nil) {
3292		T_QUIET; T_ASSERT_FALSE(found_exclaves, "did not find any Exclaves data");
3293	}
3294
3295
3296	T_ASSERT_FALSE(KCDATA_ITER_FOREACH_FAILED(iter), "successfully iterated kcdata");
3297
3298	free(inflatedBufferBase);
3299}
3300
3301static const char *
3302current_process_name(void)
3303{
3304	static char name[64];
3305
3306	if (!name[0]) {
3307		int ret = proc_name(getpid(), name, sizeof(name));
3308		T_QUIET;
3309		T_ASSERT_POSIX_SUCCESS(ret, "proc_name failed for current process");
3310	}
3311
3312	return name;
3313}
3314
3315static void
3316initialize_thread(void)
3317{
3318	int ret = pthread_setname_np(TEST_THREAD_NAME);
3319	T_QUIET;
3320	T_ASSERT_POSIX_ZERO(ret, "set thread name to %s", TEST_THREAD_NAME);
3321}
3322