xref: /xnu-11417.101.15/tests/stackshot_tests.m (revision e3723e1f17661b24996789d8afc084c0c3303b26)
1#include <darwintest.h>
2#include <darwintest_utils.h>
3#include <darwintest_multiprocess.h>
4#include <kern/debug.h>
5#include <kern/kern_cdata.h>
6#include <kern/block_hint.h>
7#include <kdd.h>
8#include <libproc.h>
9#include <os/atomic_private.h>
10#include <mach-o/dyld.h>
11#include <mach-o/dyld_images.h>
12#include <mach-o/dyld_priv.h>
13#include <sys/syscall.h>
14#include <sys/stackshot.h>
15#include <uuid/uuid.h>
16#include <servers/bootstrap.h>
17#include <pthread/workqueue_private.h>
18#include <dispatch/private.h>
19#include <stdalign.h>
20#include <TargetConditionals.h>
21
22#import <zlib.h>
23#import <IOKit/IOKitLib.h>
24#import <IOKit/IOKitLibPrivate.h>
25#import <IOKit/IOKitKeysPrivate.h>
26#import "test_utils.h"
27
28
29
30T_GLOBAL_META(
31		T_META_NAMESPACE("xnu.stackshot"),
32		T_META_RADAR_COMPONENT_NAME("xnu"),
33		T_META_RADAR_COMPONENT_VERSION("stackshot"),
34		T_META_OWNER("jonathan_w_adams"),
35		T_META_CHECK_LEAKS(false),
36		T_META_ASROOT(true),
37		XNU_T_META_SOC_SPECIFIC
38		);
39
40static const char *current_process_name(void);
41static void verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count);
42static void parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra);
43static void parse_thread_group_stackshot(void **sbuf, size_t sslen);
44static uint64_t stackshot_timestamp(void *ssbuf, size_t sslen);
45static void initialize_thread(void);
46
47static uint64_t global_flags = 0;
48
49#define DEFAULT_STACKSHOT_BUFFER_SIZE (1024 * 1024)
50#define MAX_STACKSHOT_BUFFER_SIZE     (6 * 1024 * 1024)
51
52#define SRP_SERVICE_NAME "com.apple.xnu.test.stackshot.special_reply_port"
53
54/* bit flags for parse_stackshot */
55#define PARSE_STACKSHOT_DELTA                0x01
56#define PARSE_STACKSHOT_ZOMBIE               0x02
57#define PARSE_STACKSHOT_SHAREDCACHE_LAYOUT   0x04
58#define PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL 0x08
59#define PARSE_STACKSHOT_TURNSTILEINFO        0x10
60#define PARSE_STACKSHOT_POSTEXEC             0x20
61#define PARSE_STACKSHOT_WAITINFO_CSEG        0x40
62#define PARSE_STACKSHOT_WAITINFO_SRP         0x80
63#define PARSE_STACKSHOT_TRANSLATED           0x100
64#define PARSE_STACKSHOT_SHAREDCACHE_FLAGS    0x200
65#define PARSE_STACKSHOT_EXEC_INPROGRESS      0x400
66#define PARSE_STACKSHOT_TRANSITIONING        0x800
67#define PARSE_STACKSHOT_ASYNCSTACK           0x1000
68#define PARSE_STACKSHOT_COMPACTINFO          0x2000 /* TODO: rdar://88789261 */
69#define PARSE_STACKSHOT_DRIVERKIT            0x4000
70#define PARSE_STACKSHOT_THROTTLED_SP         0x8000
71#define PARSE_STACKSHOT_SUSPENDINFO          0x10000
72#define PARSE_STACKSHOT_TARGETPID            0x20000
73
74/* keys for 'extra' dictionary for parse_stackshot */
75static const NSString* zombie_child_pid_key = @"zombie_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_ZOMBIE
76static const NSString* postexec_child_unique_pid_key = @"postexec_child_unique_pid";  // -> @(unique_pid), required for PARSE_STACKSHOT_POSTEXEC
77static const NSString* cseg_expected_threadid_key = @"cseg_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_WAITINFO_CSEG
78static const NSString* srp_expected_threadid_key = @"srp_expected_threadid"; // -> @(tid), this or ..._pid required for PARSE_STACKSHOT_WAITINFO_SRP
79static const NSString* srp_expected_pid_key = @"srp_expected_pid"; // -> @(pid), this or ..._threadid required for PARSE_STACKSHOT_WAITINFO_SRP
80static const NSString* translated_child_pid_key = @"translated_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSLATED
81static const NSString* sharedcache_child_pid_key = @"sharedcache_child_pid"; // @(pid), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS
82static const NSString* sharedcache_child_sameaddr_key = @"sharedcache_child_sameaddr"; // @(0 or 1), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS
83static const NSString* exec_inprogress_pid_key = @"exec_inprogress_pid";
84static const NSString* exec_inprogress_found_key = @"exec_inprogress_found";  // callback when inprogress is found
85static const NSString* transitioning_pid_key = @"transitioning_task_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSITIONING
86static const NSString* asyncstack_expected_threadid_key = @"asyncstack_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_ASYNCSTACK
87static const NSString* asyncstack_expected_stack_key = @"asyncstack_expected_stack"; // -> @[pc...]), expected PCs for asyncstack
88static const NSString* driverkit_found_key = @"driverkit_found_key"; // callback when driverkit process is found. argument is the process pid.
89static const NSString* sp_throttled_expected_ctxt_key = @"sp_throttled_expected_ctxt_key"; // -> @(ctxt), required for PARSE_STACKSHOT_THROTTLED_SP
90static const NSString* sp_throttled_expect_flag = @"sp_throttled_expect_flag"; // -> @(is_throttled), required for PARSE_STACKSHOT_THROTTLED_SP
91static const NSString* no_exclaves_key = @"no_exclaves";
92
93#define TEST_STACKSHOT_QUEUE_LABEL        "houston.we.had.a.problem"
94#define TEST_STACKSHOT_QUEUE_LABEL_LENGTH sizeof(TEST_STACKSHOT_QUEUE_LABEL)
95
96#define THROTTLED_SERVICE_NAME "com.apple.xnu.test.stackshot.throttled_service"
97
98static int64_t
99run_sysctl_test(const char *t, int64_t value)
100{
101	char name[1024];
102	int64_t result = 0;
103	size_t s = sizeof(value);
104	int rc;
105
106	snprintf(name, sizeof(name), "debug.test.%s", t);
107	rc = sysctlbyname(name, &result, &s, &value, s);
108	T_QUIET; T_ASSERT_POSIX_SUCCESS(rc, "sysctlbyname(%s)", name);
109	return result;
110}
111
112T_DECL(microstackshots, "test the microstackshot syscall", T_META_TAG_VM_PREFERRED)
113{
114	void *buf = NULL;
115	unsigned int size = DEFAULT_STACKSHOT_BUFFER_SIZE;
116
117	while (1) {
118		buf = malloc(size);
119		T_QUIET; T_ASSERT_NOTNULL(buf, "allocated stackshot buffer");
120
121#pragma clang diagnostic push
122#pragma clang diagnostic ignored "-Wdeprecated-declarations"
123		int len = syscall(SYS_microstackshot, buf, size,
124				(uint32_t) STACKSHOT_GET_MICROSTACKSHOT);
125#pragma clang diagnostic pop
126		if (len == ENOSYS) {
127			T_SKIP("microstackshot syscall failed, likely not compiled with CONFIG_TELEMETRY");
128		}
129		if (len == -1 && errno == ENOSPC) {
130			/* syscall failed because buffer wasn't large enough, try again */
131			free(buf);
132			buf = NULL;
133			size *= 2;
134			T_ASSERT_LE(size, (unsigned int)MAX_STACKSHOT_BUFFER_SIZE,
135					"growing stackshot buffer to sane size");
136			continue;
137		}
138		T_ASSERT_POSIX_SUCCESS(len, "called microstackshot syscall");
139		break;
140    }
141
142	T_EXPECT_EQ(*(uint32_t *)buf,
143			(uint32_t)STACKSHOT_MICRO_SNAPSHOT_MAGIC,
144			"magic value for microstackshot matches");
145
146	free(buf);
147}
148
149struct scenario {
150	const char *name;
151	uint64_t flags;
152	bool quiet;
153	bool should_fail;
154	bool maybe_unsupported;
155	bool maybe_enomem;
156	bool no_recordfile;
157	pid_t target_pid;
158	bool target_kernel;
159	uint64_t since_timestamp;
160	uint32_t size_hint;
161	dt_stat_time_t timer;
162};
163
164static void
165quiet(struct scenario *scenario)
166{
167	if (scenario->timer || scenario->quiet) {
168		T_QUIET;
169	}
170}
171
172static void
173take_stackshot(struct scenario *scenario, bool compress_ok, void (^cb)(void *buf, size_t size))
174{
175start:
176	initialize_thread();
177
178	void *config = stackshot_config_create();
179	quiet(scenario);
180	T_ASSERT_NOTNULL(config, "created stackshot config");
181
182	int ret = stackshot_config_set_flags(config, scenario->flags | global_flags);
183	quiet(scenario);
184	T_ASSERT_POSIX_ZERO(ret, "set flags %#llx on stackshot config", scenario->flags);
185
186	if (scenario->size_hint > 0) {
187		ret = stackshot_config_set_size_hint(config, scenario->size_hint);
188		quiet(scenario);
189		T_ASSERT_POSIX_ZERO(ret, "set size hint %" PRIu32 " on stackshot config",
190				scenario->size_hint);
191	}
192
193	if (scenario->target_pid > 0) {
194		ret = stackshot_config_set_pid(config, scenario->target_pid);
195		quiet(scenario);
196		T_ASSERT_POSIX_ZERO(ret, "set target pid %d on stackshot config",
197				scenario->target_pid);
198	} else if (scenario->target_kernel) {
199		ret = stackshot_config_set_pid(config, 0);
200		quiet(scenario);
201		T_ASSERT_POSIX_ZERO(ret, "set kernel target on stackshot config");
202	}
203
204	if (scenario->since_timestamp > 0) {
205		ret = stackshot_config_set_delta_timestamp(config, scenario->since_timestamp);
206		quiet(scenario);
207		T_ASSERT_POSIX_ZERO(ret, "set since timestamp %" PRIu64 " on stackshot config",
208				scenario->since_timestamp);
209	}
210
211	int retries_remaining = 5;
212
213retry: ;
214	uint64_t start_time = mach_absolute_time();
215	ret = stackshot_capture_with_config(config);
216	uint64_t end_time = mach_absolute_time();
217
218	if (scenario->should_fail) {
219		T_EXPECTFAIL;
220		T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config");
221		return;
222	}
223
224	if (ret == EBUSY || ret == ETIMEDOUT) {
225		if (retries_remaining > 0) {
226			if (!scenario->timer) {
227				T_LOG("stackshot_capture_with_config failed with %s (%d), retrying",
228						strerror(ret), ret);
229			}
230
231			retries_remaining--;
232			goto retry;
233		} else {
234			T_ASSERT_POSIX_ZERO(ret,
235					"called stackshot_capture_with_config (no retries remaining)");
236		}
237	} else if ((ret == ENOTSUP) && scenario->maybe_unsupported) {
238		T_SKIP("kernel indicated this stackshot configuration is not supported");
239	} else if ((ret == ENOMEM) && scenario->maybe_enomem) {
240		T_SKIP("insufficient available memory to run test");
241	} else {
242		quiet(scenario);
243		T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config");
244	}
245
246	if (scenario->timer) {
247		dt_stat_mach_time_add(scenario->timer, end_time - start_time);
248	}
249	void *buf = stackshot_config_get_stackshot_buffer(config);
250	size_t size = stackshot_config_get_stackshot_size(config);
251	if (scenario->name && !scenario->no_recordfile) {
252		char sspath[MAXPATHLEN];
253		strlcpy(sspath, scenario->name, sizeof(sspath));
254		strlcat(sspath, ".kcdata", sizeof(sspath));
255		T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(sspath, sizeof(sspath)),
256				"create result file path");
257
258		if (!scenario->quiet) {
259			T_LOG("writing stackshot to %s", sspath);
260		}
261
262		FILE *f = fopen(sspath, "w");
263		T_WITH_ERRNO; T_QUIET; T_ASSERT_NOTNULL(f,
264				"open stackshot output file");
265
266		size_t written = fwrite(buf, size, 1, f);
267		T_QUIET; T_ASSERT_POSIX_SUCCESS(written, "wrote stackshot to file");
268
269		fclose(f);
270	}
271	cb(buf, size);
272	if (compress_ok) {
273		if (global_flags == 0) {
274			T_LOG("Restarting test with compression");
275			global_flags |= STACKSHOT_DO_COMPRESS;
276			goto start;
277		} else {
278			global_flags = 0;
279		}
280	}
281
282	ret = stackshot_config_dealloc(config);
283	T_QUIET; T_EXPECT_POSIX_ZERO(ret, "deallocated stackshot config");
284}
285
286T_DECL(simple_compressed, "take a simple compressed stackshot", T_META_TAG_VM_PREFERRED)
287{
288	struct scenario scenario = {
289		.name = "kcdata_compressed",
290		.flags = (STACKSHOT_DO_COMPRESS | STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS |
291				STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
292	};
293
294	T_LOG("taking compressed kcdata stackshot");
295	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
296		parse_stackshot(0, ssbuf, sslen, nil);
297	});
298}
299
300T_DECL(panic_compressed, "take a compressed stackshot with the same flags as a panic stackshot", T_META_TAG_VM_PREFERRED)
301{
302	uint64_t stackshot_flags = (STACKSHOT_SAVE_KEXT_LOADINFO |
303			STACKSHOT_SAVE_LOADINFO |
304			STACKSHOT_KCDATA_FORMAT |
305			STACKSHOT_ENABLE_BT_FAULTING |
306			STACKSHOT_ENABLE_UUID_FAULTING |
307			STACKSHOT_DO_COMPRESS |
308			STACKSHOT_NO_IO_STATS |
309			STACKSHOT_THREAD_WAITINFO |
310#if TARGET_OS_MAC
311			STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT |
312#endif
313			STACKSHOT_DISABLE_LATENCY_INFO);
314
315	struct scenario scenario = {
316		.name = "kcdata_panic_compressed",
317		.flags = stackshot_flags,
318	};
319
320	T_LOG("taking compressed kcdata stackshot with panic flags");
321	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
322		parse_stackshot(0, ssbuf, sslen, nil);
323	});
324}
325
326T_DECL(kcdata, "test that kcdata stackshots can be taken and parsed", T_META_TAG_VM_PREFERRED)
327{
328	struct scenario scenario = {
329		.name = "kcdata",
330		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS |
331				STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
332	};
333
334	T_LOG("taking kcdata stackshot");
335	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
336		parse_stackshot(0, ssbuf, sslen, nil);
337	});
338}
339
340static void
341get_stats(stackshot_stats_t *_Nonnull out)
342{
343	size_t oldlen = sizeof (*out);
344	bzero(out, oldlen);
345	int result = sysctlbyname("kern.stackshot_stats", out, &oldlen, NULL, 0);
346	T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(result, "reading \"kern.stackshot_stats\" sysctl should succeed");
347	T_EXPECT_EQ(oldlen, sizeof (*out), "kernel should update full stats structure");
348}
349
350static void
351log_stats(mach_timebase_info_data_t timebase, uint64_t now, const char *name, stackshot_stats_t stat)
352{
353	uint64_t last_ago = (now - stat.ss_last_start) * timebase.numer / timebase.denom;
354	uint64_t last_duration = (stat.ss_last_end - stat.ss_last_start) * timebase.numer / timebase.denom;
355	uint64_t total_duration = (stat.ss_duration) * timebase.numer / timebase.denom;
356
357	uint64_t nanosec = 1000000000llu;
358	T_LOG("%s: %8lld stackshots, %10lld.%09lld total nsecs, last %lld.%09lld secs ago, %lld.%09lld secs long",
359		name, stat.ss_count,
360		total_duration / nanosec, total_duration % nanosec,
361		last_ago / nanosec, last_ago % nanosec,
362		last_duration / nanosec, last_duration % nanosec);
363}
364
365T_DECL(stats, "test that stackshot stats can be read out and change when a stackshot occurs", T_META_TAG_VM_PREFERRED)
366{
367	mach_timebase_info_data_t timebase = {0, 0};
368	mach_timebase_info(&timebase);
369
370	struct scenario scenario = {
371		.name = "kcdata",
372		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
373	};
374
375	stackshot_stats_t pre, post;
376
377	get_stats(&pre);
378
379	T_LOG("taking kcdata stackshot");
380	take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) {
381		(void)0;
382	});
383
384	get_stats(&post);
385
386	uint64_t now = mach_absolute_time();
387
388	log_stats(timebase, now, "  pre", pre);
389	log_stats(timebase, now, " post", post);
390
391	int64_t delta_stackshots = (int64_t)(post.ss_count - pre.ss_count);
392	int64_t delta_duration = (int64_t)(post.ss_duration - pre.ss_duration) * (int64_t)timebase.numer / (int64_t)timebase.denom;
393	int64_t delta_nsec = delta_duration % 1000000000ll;
394	if (delta_nsec < 0) {
395	    delta_nsec += 1000000000ll;
396	}
397	T_LOG("delta: %+8lld stackshots, %+10lld.%09lld total nsecs", delta_stackshots, delta_duration / 1000000000ll, delta_nsec);
398
399	T_EXPECT_LT(pre.ss_last_start, pre.ss_last_end, "pre: stackshot should take time");
400	T_EXPECT_LT(pre.ss_count, post.ss_count, "stackshot count should increase when a stackshot is taken");
401	T_EXPECT_LT(pre.ss_duration, post.ss_duration, "stackshot duration should increase when a stackshot is taken");
402	T_EXPECT_LT(pre.ss_last_end, post.ss_last_start, "previous end should be less than new start after a stackshot");
403	T_EXPECT_LT(post.ss_last_start, post.ss_last_end, "post: stackshot should take time");
404}
405
406T_DECL(kcdata_faulting, "test that kcdata stackshots while faulting can be taken and parsed", T_META_TAG_VM_PREFERRED)
407{
408	struct scenario scenario = {
409		.name = "faulting",
410		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
411				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
412				| STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING),
413	};
414
415	T_LOG("taking faulting stackshot");
416	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
417		parse_stackshot(0, ssbuf, sslen, nil);
418	});
419}
420
421T_DECL(bad_flags, "test a poorly-formed stackshot syscall", T_META_TAG_VM_PREFERRED)
422{
423	struct scenario scenario = {
424		.flags = STACKSHOT_SAVE_IN_KERNEL_BUFFER /* not allowed from user space */,
425		.should_fail = true,
426	};
427
428	T_LOG("attempting to take stackshot with kernel-only flag");
429	take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) {
430		T_ASSERT_FAIL("stackshot data callback called");
431	});
432}
433
434T_DECL(delta, "test delta stackshots", T_META_TAG_VM_PREFERRED)
435{
436	struct scenario scenario = {
437		.name = "delta",
438		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
439				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
440	};
441
442	T_LOG("taking full stackshot");
443	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
444		uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen);
445
446		T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time);
447
448		parse_stackshot(0, ssbuf, sslen, nil);
449
450		struct scenario delta_scenario = {
451			.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
452					| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
453					| STACKSHOT_COLLECT_DELTA_SNAPSHOT),
454			.since_timestamp = stackshot_time
455		};
456
457		take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) {
458			parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil);
459		});
460	});
461}
462
463T_DECL(shared_cache_layout, "test stackshot inclusion of shared cache layout", T_META_TAG_VM_PREFERRED)
464{
465	struct scenario scenario = {
466		.name = "shared_cache_layout",
467		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
468				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT |
469				STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT),
470	};
471
472	size_t shared_cache_length;
473	const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length);
474	if (cache_header == NULL) {
475		T_SKIP("Device not running with shared cache, skipping test...");
476	}
477
478	if (shared_cache_length == 0) {
479		T_SKIP("dyld reports that currently running shared cache has zero length");
480	}
481
482	T_LOG("taking stackshot with STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT set");
483	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
484		parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_LAYOUT, ssbuf, sslen, nil);
485	});
486}
487
488T_DECL(stress, "test that taking stackshots for 60 seconds doesn't crash the system", T_META_TAG_VM_PREFERRED)
489{
490	uint64_t max_diff_time = 60ULL /* seconds */ * 1000000000ULL;
491	uint64_t start_time;
492
493	struct scenario scenario = {
494		.name = "stress",
495		.quiet = true,
496		.flags = (STACKSHOT_KCDATA_FORMAT |
497				STACKSHOT_THREAD_WAITINFO |
498				STACKSHOT_SAVE_LOADINFO |
499				STACKSHOT_SAVE_KEXT_LOADINFO |
500				STACKSHOT_GET_GLOBAL_MEM_STATS |
501				STACKSHOT_SAVE_IMP_DONATION_PIDS |
502				STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT |
503				STACKSHOT_THREAD_GROUP |
504				STACKSHOT_SAVE_JETSAM_COALITIONS |
505				STACKSHOT_ASID |
506				STACKSHOT_EXCLAVES |
507				0),
508	};
509
510	start_time = clock_gettime_nsec_np(CLOCK_MONOTONIC);
511	while (clock_gettime_nsec_np(CLOCK_MONOTONIC) - start_time < max_diff_time) {
512		take_stackshot(&scenario, false, ^(void * __unused ssbuf,
513				size_t __unused sslen) {
514			printf(".");
515			fflush(stdout);
516		});
517
518		/*
519		 * After the first stackshot, there's no point in continuing to
520		 * write them to disk, and it wears down the SSDs.
521		 */
522		scenario.no_recordfile = true;
523
524		/* Leave some time for the testing infrastructure to catch up */
525		usleep(10000);
526
527	}
528	printf("\n");
529}
530
531T_DECL(dispatch_queue_label, "test that kcdata stackshots contain libdispatch queue labels", T_META_TAG_VM_PREFERRED)
532{
533	struct scenario scenario = {
534		.name = "kcdata",
535		.flags = (STACKSHOT_GET_DQ | STACKSHOT_KCDATA_FORMAT),
536	};
537	dispatch_semaphore_t child_ready_sem, parent_done_sem;
538	dispatch_queue_t dq;
539
540#if TARGET_OS_WATCH
541	T_SKIP("This test is flaky on watches: 51663346");
542#endif
543
544	child_ready_sem = dispatch_semaphore_create(0);
545	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "dqlabel child semaphore");
546
547	parent_done_sem = dispatch_semaphore_create(0);
548	T_QUIET; T_ASSERT_NOTNULL(parent_done_sem, "dqlabel parent semaphore");
549
550	dq = dispatch_queue_create(TEST_STACKSHOT_QUEUE_LABEL, NULL);
551	T_QUIET; T_ASSERT_NOTNULL(dq, "dispatch queue");
552
553	/* start the helper thread */
554	dispatch_async(dq, ^{
555			dispatch_semaphore_signal(child_ready_sem);
556
557			dispatch_semaphore_wait(parent_done_sem, DISPATCH_TIME_FOREVER);
558	});
559
560	/* block behind the child starting up */
561	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
562
563	T_LOG("taking kcdata stackshot with libdispatch queue labels");
564	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
565		parse_stackshot(PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL, ssbuf, sslen, nil);
566	});
567
568	dispatch_semaphore_signal(parent_done_sem);
569}
570
571#define CACHEADDR_ENV "STACKSHOT_TEST_DYLDADDR"
572T_HELPER_DECL(spawn_reslide_child, "child process to spawn with alternate slide")
573{
574	size_t shared_cache_len;
575	const void *addr, *prevaddr;
576	uintmax_t v;
577	char *endptr;
578
579	const char *cacheaddr_env = getenv(CACHEADDR_ENV);
580	T_QUIET; T_ASSERT_NOTNULL(cacheaddr_env, "getenv("CACHEADDR_ENV")");
581	errno = 0;
582	endptr = NULL;
583	v = strtoumax(cacheaddr_env, &endptr, 16);	/* read hex value */
584	T_WITH_ERRNO; T_QUIET; T_ASSERT_NE(v, 0l, "getenv(%s) = \"%s\" should be a non-zero hex number", CACHEADDR_ENV, cacheaddr_env);
585	T_QUIET; T_ASSERT_EQ(*endptr, 0, "getenv(%s) = \"%s\" endptr \"%s\" should be empty", CACHEADDR_ENV, cacheaddr_env, endptr);
586
587	prevaddr = (const void *)v;
588	addr = _dyld_get_shared_cache_range(&shared_cache_len);
589	T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address");
590
591	T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(getppid(), (addr == prevaddr) ? SIGUSR2 : SIGUSR1), "signaled parent to take stackshot");
592	for (;;) {
593		(void) pause();		/* parent will kill -9 us */
594	}
595}
596
597T_DECL(shared_cache_flags, "tests stackshot's task_ss_flags for the shared cache", T_META_TAG_VM_PREFERRED)
598{
599	posix_spawnattr_t		attr;
600	char *env_addr;
601	char path[PATH_MAX];
602	__block bool child_same_addr = false;
603
604	uint32_t path_size = sizeof(path);
605	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
606	char *args[] = { path, "-n", "spawn_reslide_child", NULL };
607	pid_t pid;
608	size_t shared_cache_len;
609	const void *addr;
610
611	dispatch_source_t child_diffsig_src, child_samesig_src;
612	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
613	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "shared_cache child semaphore");
614
615	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
616	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
617
618	signal(SIGUSR1, SIG_IGN);
619	signal(SIGUSR2, SIG_IGN);
620	child_samesig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
621	T_QUIET; T_ASSERT_NOTNULL(child_samesig_src, "dispatch_source_create (child_samesig_src)");
622	child_diffsig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR2, 0, signal_processing_q);
623	T_QUIET; T_ASSERT_NOTNULL(child_diffsig_src, "dispatch_source_create (child_diffsig_src)");
624
625	/* child will signal us depending on if their addr is the same or different */
626	dispatch_source_set_event_handler(child_samesig_src, ^{ child_same_addr = false; dispatch_semaphore_signal(child_ready_sem); });
627	dispatch_source_set_event_handler(child_diffsig_src, ^{ child_same_addr = true; dispatch_semaphore_signal(child_ready_sem); });
628	dispatch_activate(child_samesig_src);
629	dispatch_activate(child_diffsig_src);
630
631	addr = _dyld_get_shared_cache_range(&shared_cache_len);
632	T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address");
633
634	T_QUIET; T_ASSERT_POSIX_SUCCESS(asprintf(&env_addr, "%p", addr), "asprintf of env_addr succeeded");
635	T_QUIET; T_ASSERT_POSIX_SUCCESS(setenv(CACHEADDR_ENV, env_addr, true), "setting "CACHEADDR_ENV" to %s", env_addr);
636
637	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&attr), "posix_spawnattr_init");
638	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_setflags(&attr, _POSIX_SPAWN_RESLIDE), "posix_spawnattr_setflags");
639	int sp_ret = posix_spawn(&pid, path, NULL, &attr, args, environ);
640	T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
641
642	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
643	T_LOG("received signal from child (%s), capturing stackshot", child_same_addr ? "same shared cache addr" : "different shared cache addr");
644
645	struct scenario scenario = {
646		.name = "shared_cache_flags",
647		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
648				| STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT
649				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
650	};
651
652	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
653		int status;
654		/* First kill the child so we can reap it */
655		T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing spawned process");
656		T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on spawned child");
657		T_QUIET; T_ASSERT_EQ(!!WIFSIGNALED(status), 1, "waitpid status should be signalled");
658		T_QUIET; T_ASSERT_EQ(WTERMSIG(status), SIGKILL, "waitpid status should be SIGKILLed");
659
660		parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_FLAGS, ssbuf, sslen,
661			@{sharedcache_child_pid_key: @(pid), sharedcache_child_sameaddr_key: @(child_same_addr ? 1 : 0)});
662	});
663}
664
665T_DECL(transitioning_tasks, "test that stackshot contains transitioning task info", T_META_BOOTARGS_SET("enable_proc_exit_lpexit_spin=1"), T_META_TAG_VM_PREFERRED)
666{
667    int32_t sysctlValue = -1, numAttempts =0;
668    char path[PATH_MAX];
669    uint32_t path_size = sizeof(path);
670    T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
671    char *args[] = { path, "-n", "exec_child_preexec", NULL };
672
673    dispatch_source_t child_sig_src;
674    dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
675    T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
676
677    dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
678    T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
679
680    pid_t pid;
681
682    signal(SIGUSR1, SIG_IGN);
683    child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
684    T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
685
686    dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
687    dispatch_activate(child_sig_src);
688
689    T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), "set debug.proc_exit_lpexit_spin_pid=-1");
690
691    int proc_exit_spin_pos = 0 ;
692
693    while (0 == sysctlbyname("debug.proc_exit_lpexit_spin_pos", NULL, NULL, &proc_exit_spin_pos, sizeof(proc_exit_spin_pos))) {
694
695        T_LOG(" ##### Testing while spinning in proc_exit at position %d ##### ", proc_exit_spin_pos);
696
697        int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
698        T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
699
700        dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
701
702        struct proc_uniqidentifierinfo proc_info_data = { };
703        int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
704        T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
705        T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
706
707        T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec");
708
709	/* wait for a signal from post-exec child */
710        dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
711
712        T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &pid, sizeof(pid)), "set debug.proc_exit_lpexit_spin_pid =  %d, ", pid);
713
714        T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid);
715
716        sysctlValue = 0;
717        size_t len = sizeof(sysctlValue);
718        while (numAttempts < 5) {
719            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValue, &len, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning");
720            if (sysctlValue != 1) numAttempts++;
721            else break;
722            sleep(1);
723        }
724
725        T_ASSERT_EQ_UINT(sysctlValue, 1, "find spinning task in proc_exit()");
726
727        struct scenario scenario = {
728            .name = "transitioning_tasks",
729            .flags = (STACKSHOT_KCDATA_FORMAT)
730        };
731
732        take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
733            parse_stackshot(PARSE_STACKSHOT_TRANSITIONING, ssbuf, sslen, @{transitioning_pid_key: @(pid)});
734
735            // Kill the child
736            int sysctlValueB = -1;
737            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValueB, sizeof(sysctlValueB)), "set debug.proc_exit_lpexit_spin_pid=-1");
738            sleep(1);
739            size_t blen = sizeof(sysctlValueB);
740            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValueB, &blen, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning");
741            T_ASSERT_EQ_UINT(sysctlValueB, 0, "make sure nothing is spining in proc_exit()");
742            int status;
743            T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child");
744        });
745
746        proc_exit_spin_pos++;
747    }
748
749}
750
751static void *stuck_sysctl_thread(void *arg) {
752	int val = 1;
753	dispatch_semaphore_t child_thread_started = *(dispatch_semaphore_t *)arg;
754
755	dispatch_semaphore_signal(child_thread_started);
756	T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread");
757
758	return NULL;
759}
760
761T_HELPER_DECL(zombie_child, "child process to sample as a zombie")
762{
763	pthread_t pthread;
764	dispatch_semaphore_t child_thread_started = dispatch_semaphore_create(0);
765	T_QUIET; T_ASSERT_NOTNULL(child_thread_started, "zombie child thread semaphore");
766
767	/* spawn another thread to get stuck in the kernel, then call exit() to become a zombie */
768	T_QUIET; T_ASSERT_POSIX_SUCCESS(pthread_create(&pthread, NULL, stuck_sysctl_thread, &child_thread_started), "pthread_create");
769
770	dispatch_semaphore_wait(child_thread_started, DISPATCH_TIME_FOREVER);
771
772	/* sleep for a bit in the hope of ensuring that the other thread has called the sysctl before we signal the parent */
773	usleep(100);
774	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot");
775
776	exit(0);
777}
778
779T_DECL(zombie, "tests a stackshot of a zombie task with a thread stuck in the kernel",
780	T_META_ENABLED(false), /* test is too flaky to run by default, but transitioning_tasks covers this case as well */
781	T_META_TAG_VM_PREFERRED)
782{
783	char path[PATH_MAX];
784	uint32_t path_size = sizeof(path);
785	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
786	char *args[] = { path, "-n", "zombie_child", NULL };
787
788	dispatch_source_t child_sig_src;
789	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
790	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "zombie child semaphore");
791
792	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
793	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
794
795	pid_t pid;
796
797	T_LOG("spawning a child");
798
799	signal(SIGUSR1, SIG_IGN);
800	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
801	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
802
803	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
804	dispatch_activate(child_sig_src);
805
806	int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
807	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
808
809	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
810
811	T_LOG("received signal from child, capturing stackshot");
812
813	struct proc_bsdshortinfo bsdshortinfo;
814	int retval, iterations_to_wait = 10;
815
816	while (iterations_to_wait > 0) {
817		retval = proc_pidinfo(pid, PROC_PIDT_SHORTBSDINFO, 0, &bsdshortinfo, sizeof(bsdshortinfo));
818		if ((retval == 0) && errno == ESRCH) {
819			T_LOG("unable to find child using proc_pidinfo, assuming zombie");
820			break;
821		}
822
823		T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDT_SHORTBSDINFO) returned a value > 0");
824		T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(bsdshortinfo), "proc_pidinfo call for PROC_PIDT_SHORTBSDINFO returned expected size");
825
826		if (bsdshortinfo.pbsi_flags & PROC_FLAG_INEXIT) {
827			T_LOG("child proc info marked as in exit");
828			break;
829		}
830
831		iterations_to_wait--;
832		if (iterations_to_wait == 0) {
833			/*
834			 * This will mark the test as failed but let it continue so we
835			 * don't leave a process stuck in the kernel.
836			 */
837			T_FAIL("unable to discover that child is marked as exiting");
838		}
839
840		/* Give the child a few more seconds to make it to exit */
841		sleep(5);
842	}
843
844	/* Give the child some more time to make it through exit */
845	sleep(10);
846
847	struct scenario scenario = {
848		.name = "zombie",
849		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
850				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
851	};
852
853	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
854		/* First unwedge the child so we can reap it */
855		int val = 1, status;
856		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child");
857
858		T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on zombie child");
859
860		parse_stackshot(PARSE_STACKSHOT_ZOMBIE, ssbuf, sslen, @{zombie_child_pid_key: @(pid)});
861	});
862}
863
864T_HELPER_DECL(exec_child_preexec, "child process pre-exec")
865{
866	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
867	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
868
869	signal(SIGUSR1, SIG_IGN);
870	dispatch_source_t parent_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
871	T_QUIET; T_ASSERT_NOTNULL(parent_sig_src, "dispatch_source_create (child_sig_src)");
872	dispatch_source_set_event_handler(parent_sig_src, ^{
873
874		// Parent took a timestamp then signaled us: exec into the next process
875
876		char path[PATH_MAX];
877		uint32_t path_size = sizeof(path);
878		T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
879		char *args[] = { path, "-n", "exec_child_postexec", NULL };
880
881		T_QUIET; T_ASSERT_POSIX_ZERO(execve(args[0], args, NULL), "execing into exec_child_postexec");
882	});
883	dispatch_activate(parent_sig_src);
884
885	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take timestamp");
886
887	sleep(100);
888	// Should never get here
889	T_FAIL("Received signal to exec from parent");
890}
891
892T_HELPER_DECL(exec_child_postexec, "child process post-exec to sample")
893{
894	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot");
895	sleep(100);
896	// Should never get here
897	T_FAIL("Killed by parent");
898}
899
900T_DECL(exec, "test getting full task snapshots for a task that execs", T_META_TAG_VM_PREFERRED)
901{
902	char path[PATH_MAX];
903	uint32_t path_size = sizeof(path);
904	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
905	char *args[] = { path, "-n", "exec_child_preexec", NULL };
906
907	dispatch_source_t child_sig_src;
908	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
909	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
910
911	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
912	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
913
914	pid_t pid;
915
916	T_LOG("spawning a child");
917
918	signal(SIGUSR1, SIG_IGN);
919	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
920	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
921
922	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
923	dispatch_activate(child_sig_src);
924
925	int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
926	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
927
928	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
929	uint64_t start_time = mach_absolute_time();
930
931	struct proc_uniqidentifierinfo proc_info_data = { };
932	int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
933	T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
934	T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
935	uint64_t unique_pid = proc_info_data.p_uniqueid;
936
937	T_LOG("received signal from pre-exec child, unique_pid is %llu, timestamp is %llu", unique_pid, start_time);
938
939	T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec");
940
941	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
942
943	T_LOG("received signal from post-exec child, capturing stackshot");
944
945	struct scenario scenario = {
946		.name = "exec",
947		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
948				  | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
949				  | STACKSHOT_COLLECT_DELTA_SNAPSHOT),
950		.since_timestamp = start_time
951	};
952
953	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
954		// Kill the child
955		int status;
956		T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid);
957		T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child");
958
959		parse_stackshot(PARSE_STACKSHOT_POSTEXEC | PARSE_STACKSHOT_DELTA, ssbuf, sslen, @{postexec_child_unique_pid_key: @(unique_pid)});
960	});
961}
962
963T_DECL(
964	exec_inprogress,
965	"test stackshots of processes in the middle of exec",
966	T_META_ENABLED(false), /* rdar://111691318 */
967	T_META_TAG_VM_PREFERRED)
968{
969	pid_t pid;
970	/* a BASH quine which execs itself as long as the parent doesn't exit */
971        char *bash_prog = "[[ $PPID -ne 1 ]] && exec /bin/bash -c \"$0\" \"$0\"";
972	char *args[] = { "/bin/bash", "-c", bash_prog, bash_prog, NULL };
973
974	posix_spawnattr_t sattr;
975	T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&sattr), "posix_spawnattr_init");
976	T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, &sattr, args, NULL), "spawn exec_inprogress_child");
977
978	struct scenario scenario = {
979		.name = "exec_inprogress",
980		.flags = (STACKSHOT_KCDATA_FORMAT),
981		.target_pid = pid,
982	};
983
984	int tries = 0;
985	int tries_limit = 30;
986	__block bool found = false;
987	__block uint64_t cid1 = 0, cid2 = 0;
988
989	for (tries = 0; !found && tries < tries_limit; tries++) {
990		take_stackshot(&scenario, false,
991		    ^( void *ssbuf, size_t sslen) {
992			parse_stackshot(PARSE_STACKSHOT_EXEC_INPROGRESS | PARSE_STACKSHOT_TARGETPID,
993			    ssbuf, sslen, @{
994				exec_inprogress_pid_key: @(pid),
995				exec_inprogress_found_key: ^(uint64_t id1, uint64_t id2) { found = true; cid1 = id1; cid2 = id2; }});
996		});
997	}
998	T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing exec loop");
999	T_ASSERT_TRUE(found, "able to find our execing process mid-exec in %d tries", tries);
1000	T_ASSERT_NE(cid1, cid2, "container IDs for in-progress exec are unique");
1001	T_PASS("found mid-exec process in %d tries", tries);
1002}
1003
1004#ifdef _LP64
1005#if __has_feature(ptrauth_calls)
1006#define __ptrauth_swift_async_context_parent \
1007  __ptrauth(ptrauth_key_process_independent_data, 1, 0xbda2)
1008#define __ptrauth_swift_async_context_resume \
1009  __ptrauth(ptrauth_key_function_pointer, 1, 0xd707)
1010#else
1011#define __ptrauth_swift_async_context_parent
1012#define __ptrauth_swift_async_context_resume
1013#endif
1014// Add 1 to match the symbolication aid added by the stackshot backtracer.
1015#define asyncstack_frame(x) ((uintptr_t)(void *)ptrauth_strip((void *)(x), ptrauth_key_function_pointer) + 1)
1016
1017// This struct fakes the Swift AsyncContext struct which is used by
1018// the Swift concurrency runtime. We only care about the first 2 fields.
1019struct fake_async_context {
1020	struct fake_async_context* __ptrauth_swift_async_context_parent next;
1021	void(*__ptrauth_swift_async_context_resume resume_pc)(void);
1022};
1023
1024static void
1025level1_func()
1026{
1027}
1028static void
1029level2_func()
1030{
1031}
1032
1033// Create a chain of fake async contexts; sync with asyncstack_expected_stack below
1034static alignas(16) struct fake_async_context level1 = { 0, level1_func };
1035static alignas(16) struct fake_async_context level2 = { &level1, level2_func };
1036
1037struct async_test_semaphores {
1038	dispatch_semaphore_t child_ready_sem;	/* signal parent we're ready */
1039	dispatch_semaphore_t child_exit_sem;	/* parent tells us to go away */
1040};
1041
1042#define	ASYNCSTACK_THREAD_NAME "asyncstack_thread"
1043
1044static void __attribute__((noinline, not_tail_called))
1045expect_asyncstack(void *arg)
1046{
1047	struct async_test_semaphores *async_ts = arg;
1048
1049	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_setname_np(ASYNCSTACK_THREAD_NAME),
1050	     "set thread name to %s", ASYNCSTACK_THREAD_NAME);
1051
1052	/* Tell the main thread we're all set up, then wait for permission to exit */
1053	dispatch_semaphore_signal(async_ts->child_ready_sem);
1054	dispatch_semaphore_wait(async_ts->child_exit_sem, DISPATCH_TIME_FOREVER);
1055	usleep(1);	/* make sure we don't tailcall semaphore_wait */
1056}
1057
1058static void *
1059asyncstack_thread(void *arg)
1060{
1061	uint64_t *fp = __builtin_frame_address(0);
1062	// We cannot use a variable of pointer type, because this ABI is valid
1063	// on arm64_32 where pointers are 32bits, but the context pointer will
1064	// still be stored in a 64bits slot on the stack.
1065#if __has_feature(ptrauth_calls)
1066#define __stack_context_auth __ptrauth(ptrauth_key_process_dependent_data, 1, \
1067	        0xc31a)
1068	struct fake_async_context * __stack_context_auth ctx = &level2;
1069#else // __has_feature(ptrauth_calls)
1070	/* struct fake_async_context * */uint64_t ctx  = (uintptr_t)&level2;
1071#endif // !__has_feature(ptrauth_calls)
1072
1073	// The signature of an async frame on the OS stack is:
1074	// [ <AsyncContext address>, <Saved FP | (1<<60)>, <return address> ]
1075	// The Async context must be right before the saved FP on the stack. This
1076	// should happen naturally in an optimized build as it is the only
1077	// variable on the stack.
1078	// This function cannot use T_ASSERT_* becuse it changes the stack
1079	// layout.
1080	assert((uintptr_t)fp - (uintptr_t)&ctx == 8);
1081
1082	// Modify the saved FP on the stack to include the async frame marker
1083	*fp |= (0x1ULL << 60);
1084	expect_asyncstack(arg);
1085	return NULL;
1086}
1087
1088T_DECL(asyncstack, "test swift async stack entries", T_META_TAG_VM_PREFERRED)
1089{
1090	struct scenario scenario = {
1091		.name = "asyncstack",
1092		.flags = STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO,
1093	};
1094	struct async_test_semaphores async_ts = {
1095	    .child_ready_sem = dispatch_semaphore_create(0),
1096	    .child_exit_sem = dispatch_semaphore_create(0),
1097	};
1098	T_QUIET; T_ASSERT_NOTNULL(async_ts.child_ready_sem, "child_ready_sem alloc");
1099	T_QUIET; T_ASSERT_NOTNULL(async_ts.child_exit_sem, "child_exit_sem alloc");
1100
1101	pthread_t pthread;
1102	__block uint64_t threadid = 0;
1103	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_create(&pthread, NULL, asyncstack_thread, &async_ts), "pthread_create");
1104	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_threadid_np(pthread, &threadid), "pthread_threadid_np");
1105
1106	dispatch_semaphore_wait(async_ts.child_ready_sem, DISPATCH_TIME_FOREVER);
1107
1108	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1109		parse_stackshot(PARSE_STACKSHOT_ASYNCSTACK, ssbuf, sslen, @{
1110		    asyncstack_expected_threadid_key: @(threadid),
1111		       asyncstack_expected_stack_key: @[ @(asyncstack_frame(level2_func)), @(asyncstack_frame(level1_func)) ],
1112		});
1113	});
1114
1115	dispatch_semaphore_signal(async_ts.child_exit_sem);
1116	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_join(pthread, NULL), "wait for thread");
1117
1118}
1119#endif /* #ifdef _LP64 */
1120
1121static uint32_t
1122get_user_promotion_basepri(void)
1123{
1124	mach_msg_type_number_t count = THREAD_POLICY_STATE_COUNT;
1125	struct thread_policy_state thread_policy;
1126	boolean_t get_default = FALSE;
1127	mach_port_t thread_port = pthread_mach_thread_np(pthread_self());
1128
1129	kern_return_t kr = thread_policy_get(thread_port, THREAD_POLICY_STATE,
1130	    (thread_policy_t)&thread_policy, &count, &get_default);
1131	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_policy_get");
1132	return thread_policy.thps_user_promotion_basepri;
1133}
1134
1135static int
1136get_pri(thread_t thread_port)
1137{
1138	kern_return_t kr;
1139
1140	thread_extended_info_data_t extended_info;
1141	mach_msg_type_number_t count = THREAD_EXTENDED_INFO_COUNT;
1142	kr = thread_info(thread_port, THREAD_EXTENDED_INFO,
1143	    (thread_info_t)&extended_info, &count);
1144
1145	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_info");
1146
1147	return extended_info.pth_curpri;
1148}
1149
1150
1151T_DECL(turnstile_singlehop, "turnstile single hop test", T_META_TAG_VM_PREFERRED)
1152{
1153	dispatch_queue_t dq1, dq2;
1154	dispatch_semaphore_t sema_x;
1155	dispatch_queue_attr_t dq1_attr, dq2_attr;
1156	__block qos_class_t main_qos = 0;
1157	__block int main_relpri = 0, main_relpri2 = 0, main_afterpri = 0;
1158	struct scenario scenario = {
1159		.name = "turnstile_singlehop",
1160		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1161	};
1162	dq1_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_UTILITY, 0);
1163	dq2_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_USER_INITIATED, 0);
1164	pthread_mutex_t lock_a = PTHREAD_MUTEX_INITIALIZER;
1165	pthread_mutex_t lock_b = PTHREAD_MUTEX_INITIALIZER;
1166
1167	pthread_mutex_t *lockap = &lock_a, *lockbp = &lock_b;
1168
1169	dq1 = dispatch_queue_create("q1", dq1_attr);
1170	dq2 = dispatch_queue_create("q2", dq2_attr);
1171	sema_x = dispatch_semaphore_create(0);
1172
1173	pthread_mutex_lock(lockap);
1174	dispatch_async(dq1, ^{
1175		pthread_mutex_lock(lockbp);
1176		T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class");
1177		T_LOG("The priority of q1 is %d\n", get_pri(mach_thread_self()));
1178		dispatch_semaphore_signal(sema_x);
1179		pthread_mutex_lock(lockap);
1180	});
1181	dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER);
1182
1183	T_LOG("Async1 completed");
1184
1185	pthread_set_qos_class_self_np(QOS_CLASS_UTILITY, 0);
1186	T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class");
1187	T_LOG("The priority of main is %d\n", get_pri(mach_thread_self()));
1188	main_relpri = get_pri(mach_thread_self());
1189
1190	dispatch_async(dq2, ^{
1191		T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri2), "get qos class");
1192		T_LOG("The priority of q2 is %d\n", get_pri(mach_thread_self()));
1193		dispatch_semaphore_signal(sema_x);
1194		pthread_mutex_lock(lockbp);
1195	});
1196	dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER);
1197
1198	T_LOG("Async2 completed");
1199
1200	while (1) {
1201		main_afterpri = (int) get_user_promotion_basepri();
1202		if (main_relpri != main_afterpri) {
1203			T_LOG("Success with promotion pri is %d", main_afterpri);
1204			break;
1205		}
1206
1207		usleep(100);
1208	}
1209
1210	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1211		parse_stackshot(PARSE_STACKSHOT_TURNSTILEINFO, ssbuf, sslen, nil);
1212	});
1213}
1214
1215
1216static void
1217expect_instrs_cycles_in_stackshot(void *ssbuf, size_t sslen)
1218{
1219	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1220
1221	bool in_task = false;
1222	bool in_thread = false;
1223	bool saw_instrs_cycles = false;
1224	iter = kcdata_iter_next(iter);
1225
1226	KCDATA_ITER_FOREACH(iter) {
1227		switch (kcdata_iter_type(iter)) {
1228		case KCDATA_TYPE_CONTAINER_BEGIN:
1229			switch (kcdata_iter_container_type(iter)) {
1230			case STACKSHOT_KCCONTAINER_TASK:
1231				in_task = true;
1232				saw_instrs_cycles = false;
1233				break;
1234
1235			case STACKSHOT_KCCONTAINER_THREAD:
1236				in_thread = true;
1237				saw_instrs_cycles = false;
1238				break;
1239
1240			default:
1241				break;
1242			}
1243			break;
1244
1245		case STACKSHOT_KCTYPE_INSTRS_CYCLES:
1246			saw_instrs_cycles = true;
1247			break;
1248
1249		case KCDATA_TYPE_CONTAINER_END:
1250			if (in_thread) {
1251				T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles,
1252						"saw instructions and cycles in thread");
1253				in_thread = false;
1254			} else if (in_task) {
1255				T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles,
1256						"saw instructions and cycles in task");
1257				in_task = false;
1258			}
1259
1260		default:
1261			break;
1262		}
1263	}
1264}
1265
1266static void
1267skip_if_monotonic_unsupported(void)
1268{
1269	int supported = 0;
1270	size_t supported_size = sizeof(supported);
1271	int ret = sysctlbyname("kern.monotonic.supported", &supported,
1272			&supported_size, 0, 0);
1273	if (ret < 0 || !supported) {
1274		T_SKIP("monotonic is unsupported");
1275	}
1276}
1277
1278T_DECL(instrs_cycles, "test a getting instructions and cycles in stackshot", T_META_TAG_VM_PREFERRED)
1279{
1280	skip_if_monotonic_unsupported();
1281
1282	struct scenario scenario = {
1283		.name = "instrs-cycles",
1284		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1285				| STACKSHOT_KCDATA_FORMAT),
1286	};
1287
1288	T_LOG("attempting to take stackshot with instructions and cycles");
1289	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1290		parse_stackshot(0, ssbuf, sslen, nil);
1291		expect_instrs_cycles_in_stackshot(ssbuf, sslen);
1292	});
1293}
1294
1295T_DECL(delta_instrs_cycles,
1296		"test delta stackshots with instructions and cycles", T_META_TAG_VM_PREFERRED)
1297{
1298	skip_if_monotonic_unsupported();
1299
1300	struct scenario scenario = {
1301		.name = "delta-instrs-cycles",
1302		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1303				| STACKSHOT_KCDATA_FORMAT),
1304	};
1305
1306	T_LOG("taking full stackshot");
1307	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1308		uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen);
1309
1310		T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time);
1311
1312		parse_stackshot(0, ssbuf, sslen, nil);
1313		expect_instrs_cycles_in_stackshot(ssbuf, sslen);
1314
1315		struct scenario delta_scenario = {
1316			.name = "delta-instrs-cycles-next",
1317			.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1318					| STACKSHOT_KCDATA_FORMAT
1319					| STACKSHOT_COLLECT_DELTA_SNAPSHOT),
1320			.since_timestamp = stackshot_time,
1321		};
1322
1323		take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) {
1324			parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil);
1325			expect_instrs_cycles_in_stackshot(dssbuf, dsslen);
1326		});
1327	});
1328}
1329
1330static void
1331check_thread_groups_supported()
1332{
1333	int err;
1334	int supported = 0;
1335	size_t supported_size = sizeof(supported);
1336	err = sysctlbyname("kern.thread_groups_supported", &supported, &supported_size, NULL, 0);
1337
1338	if (err || !supported)
1339		T_SKIP("thread groups not supported on this system");
1340}
1341
1342T_DECL(thread_groups, "test getting thread groups in stackshot", T_META_TAG_VM_PREFERRED)
1343{
1344	check_thread_groups_supported();
1345
1346	struct scenario scenario = {
1347		.name = "thread-groups",
1348		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_GROUP
1349				| STACKSHOT_KCDATA_FORMAT),
1350	};
1351
1352	T_LOG("attempting to take stackshot with thread group flag");
1353	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1354		parse_thread_group_stackshot(ssbuf, sslen);
1355	});
1356}
1357
1358T_DECL(compactinfo, "test compactinfo inclusion", T_META_TAG_VM_PREFERRED)
1359{
1360	struct scenario scenario = {
1361		.name = "compactinfo",
1362		.target_pid = getpid(),
1363		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_SAVE_DYLD_COMPACTINFO
1364				| STACKSHOT_KCDATA_FORMAT),
1365	};
1366
1367	T_LOG("attempting to take stackshot with compactinfo flag");
1368	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1369		parse_stackshot(PARSE_STACKSHOT_COMPACTINFO | PARSE_STACKSHOT_TARGETPID, ssbuf, sslen, nil);
1370	});
1371}
1372
1373T_DECL(suspendinfo, "test task suspend info inclusion", T_META_TAG_VM_PREFERRED)
1374{
1375	struct scenario scenario = {
1376		.name = "suspendinfo",
1377		.target_pid = getpid(),
1378		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
1379	};
1380
1381	T_LOG("attempting to take stackshot with suspendinfo flag");
1382	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1383		parse_stackshot(PARSE_STACKSHOT_SUSPENDINFO | PARSE_STACKSHOT_TARGETPID, ssbuf, sslen, nil);
1384	});
1385}
1386
1387static NSMutableSet * find_driverkit_pids(io_registry_entry_t root) {
1388	NSMutableSet * driverkit_pids = [NSMutableSet setWithCapacity:3];
1389	io_registry_entry_t current = IO_OBJECT_NULL;
1390	io_iterator_t iter = IO_OBJECT_NULL;
1391
1392	T_EXPECT_MACH_SUCCESS(IORegistryEntryGetChildIterator(root, kIOServicePlane, &iter), "get registry iterator");
1393
1394	while ((current = IOIteratorNext(iter)) != IO_OBJECT_NULL) {
1395		if (_IOObjectConformsTo(current, "IOUserServer", kIOClassNameOverrideNone)) {
1396			CFMutableDictionaryRef cfProperties = NULL;
1397			NSMutableDictionary * properties;
1398			NSString * client_creator_info;
1399			NSArray<NSString *> *creator_info_array;
1400			pid_t pid;
1401
1402			T_QUIET; T_EXPECT_MACH_SUCCESS(IORegistryEntryCreateCFProperties(current, &cfProperties, kCFAllocatorDefault, kNilOptions), "get properties");
1403			properties = CFBridgingRelease(cfProperties);
1404			T_QUIET; T_ASSERT_NOTNULL(properties, "properties is not null");
1405			client_creator_info = properties[@kIOUserClientCreatorKey];
1406			creator_info_array = [client_creator_info componentsSeparatedByString:@","];
1407			if ([creator_info_array[0] hasPrefix:@"pid"]) {
1408				NSArray<NSString *> *pid_info = [creator_info_array[0] componentsSeparatedByString:@" "];
1409				T_QUIET; T_ASSERT_EQ(pid_info.count, 2UL, "Get pid info components from %s", creator_info_array[0].UTF8String);
1410				pid = pid_info[1].intValue;
1411			} else {
1412				T_ASSERT_FAIL("No pid info in client creator info: %s", client_creator_info.UTF8String);
1413			}
1414			T_LOG("Found driver pid %d", pid);
1415			[driverkit_pids addObject:[NSNumber numberWithInt:pid]];
1416		} else {
1417			[driverkit_pids unionSet:find_driverkit_pids(current)];
1418		}
1419		IOObjectRelease(current);
1420	}
1421
1422	IOObjectRelease(iter);
1423	return driverkit_pids;
1424}
1425
1426T_DECL(driverkit, "test driverkit inclusion", T_META_TAG_VM_PREFERRED)
1427{
1428	struct scenario scenario = {
1429		.name = "driverkit",
1430		.target_kernel = true,
1431		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT
1432			    | STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL),
1433	};
1434
1435	io_registry_entry_t root = IORegistryGetRootEntry(kIOMainPortDefault);
1436	NSMutableSet * driverkit_pids = find_driverkit_pids(root);
1437	IOObjectRelease(root);
1438
1439	T_LOG("expecting to find %lu driverkit processes", [driverkit_pids count]);
1440	T_LOG("attempting to take stackshot with STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL flag");
1441	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1442		parse_stackshot(PARSE_STACKSHOT_DRIVERKIT | PARSE_STACKSHOT_TARGETPID, ssbuf, sslen, @{
1443			driverkit_found_key: ^(pid_t pid) {
1444				[driverkit_pids removeObject:[NSNumber numberWithInt:pid]];
1445		}});
1446	});
1447
1448	T_EXPECT_EQ([driverkit_pids count], (NSUInteger)0, "found expected number of driverkit processes");
1449}
1450
1451static void
1452parse_page_table_asid_stackshot(void **ssbuf, size_t sslen)
1453{
1454	bool seen_asid = false;
1455	bool seen_page_table_snapshot = false;
1456	bool seen_task = false;
1457	int container = 0;
1458	int task_container = -1;
1459	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1460	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
1461			"buffer provided is a stackshot");
1462
1463	iter = kcdata_iter_next(iter);
1464	KCDATA_ITER_FOREACH(iter) {
1465		switch (kcdata_iter_type(iter)) {
1466		/* There's a slight chance that we see a transit version of this task
1467		 * in the stackshot, so we want to make sure to check both */
1468		case KCDATA_TYPE_CONTAINER_BEGIN: {
1469			container++;
1470			if (kcdata_iter_container_type(iter) == STACKSHOT_KCCONTAINER_TASK) {
1471				seen_asid = seen_page_table_snapshot = false;
1472				task_container = container;
1473			}
1474			break;
1475		}
1476		case KCDATA_TYPE_CONTAINER_END: {
1477			if (container == task_container) {
1478				task_container = -1;
1479				seen_task = true;
1480				T_ASSERT_TRUE(seen_page_table_snapshot, "check that we have seen a page table snapshot");
1481				T_ASSERT_TRUE(seen_asid, "check that we have seen an ASID");
1482			}
1483			container--;
1484			break;
1485		}
1486		case KCDATA_TYPE_ARRAY: {
1487			T_QUIET;
1488			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
1489					"checked that array is valid");
1490
1491			if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_PAGE_TABLES) {
1492				continue;
1493			}
1494
1495			T_ASSERT_FALSE(seen_page_table_snapshot, "check that we haven't yet seen a page table snapshot");
1496			seen_page_table_snapshot = true;
1497
1498			T_ASSERT_EQ((size_t) kcdata_iter_array_elem_size(iter), sizeof(uint64_t),
1499				"check that each element of the pagetable dump is the expected size");
1500
1501			uint64_t *pt_array = kcdata_iter_payload(iter);
1502			uint32_t elem_count = kcdata_iter_array_elem_count(iter);
1503			uint32_t j;
1504			bool nonzero_tte = false;
1505			for (j = 0; j < elem_count;) {
1506				T_QUIET; T_ASSERT_LE(j + 4, elem_count, "check for valid page table segment header");
1507				uint64_t pa = pt_array[j];
1508				uint64_t num_entries = pt_array[j + 1];
1509				uint64_t start_va = pt_array[j + 2];
1510				uint64_t end_va = pt_array[j + 3];
1511
1512				T_QUIET; T_ASSERT_NE(pa, (uint64_t) 0, "check that the pagetable physical address is non-zero");
1513				T_QUIET; T_ASSERT_EQ(pa % (num_entries * sizeof(uint64_t)), (uint64_t) 0, "check that the pagetable physical address is correctly aligned");
1514				T_QUIET; T_ASSERT_NE(num_entries, (uint64_t) 0, "check that a pagetable region has more than 0 entries");
1515				T_QUIET; T_ASSERT_LE(j + 4 + num_entries, (uint64_t) elem_count, "check for sufficient space in page table array");
1516				T_QUIET; T_ASSERT_GT(end_va, start_va, "check for valid VA bounds in page table segment header");
1517
1518				for (uint32_t k = j + 4; k < (j + 4 + num_entries); ++k) {
1519					if (pt_array[k] != 0) {
1520						nonzero_tte = true;
1521						T_QUIET; T_ASSERT_EQ((pt_array[k] >> 48) & 0xf, (uint64_t) 0, "check that bits[48:51] of arm64 TTE are clear");
1522						// L0-L2 table and non-compressed L3 block entries should always have bit 1 set; assumes L0-L2 blocks will not be used outside the kernel
1523						bool table = ((pt_array[k] & 0x2) != 0);
1524						if (table) {
1525							T_QUIET; T_ASSERT_NE(pt_array[k] & ((1ULL << 48) - 1) & ~((1ULL << 12) - 1), (uint64_t) 0, "check that arm64 TTE physical address is non-zero");
1526						} else { // should be a compressed PTE
1527							T_QUIET; T_ASSERT_NE(pt_array[k] & 0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has at least one of bits [63:62] set");
1528							T_QUIET; T_ASSERT_EQ(pt_array[k] & ~0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has no other bits besides [63:62] set");
1529						}
1530					}
1531				}
1532
1533				j += (4 + num_entries);
1534			}
1535			T_ASSERT_TRUE(nonzero_tte, "check that we saw at least one non-empty TTE");
1536			T_ASSERT_EQ(j, elem_count, "check that page table dump size matches extent of last header");
1537			break;
1538		}
1539		case STACKSHOT_KCTYPE_ASID: {
1540			T_ASSERT_FALSE(seen_asid, "check that we haven't yet seen an ASID");
1541			seen_asid = true;
1542		}
1543		}
1544	}
1545
1546	T_QUIET; T_ASSERT_TRUE(seen_task, "check that we have seen a complete task container");
1547}
1548
1549T_DECL(dump_page_tables, "test stackshot page table dumping support", T_META_TAG_VM_PREFERRED)
1550{
1551	struct scenario scenario = {
1552		.name = "asid-page-tables",
1553		.flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_ASID | STACKSHOT_PAGE_TABLES),
1554		.size_hint = (9ull << 20), // 9 MB
1555		.target_pid = getpid(),
1556		.maybe_unsupported = true,
1557		.maybe_enomem = true,
1558	};
1559
1560	T_LOG("attempting to take stackshot with ASID and page table flags");
1561	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1562		parse_page_table_asid_stackshot(ssbuf, sslen);
1563	});
1564}
1565
1566static void stackshot_verify_current_proc_uuid_info(void **ssbuf, size_t sslen, uint64_t expected_offset, const struct proc_uniqidentifierinfo *proc_info_data)
1567{
1568	const uuid_t *current_uuid = (const uuid_t *)(&proc_info_data->p_uuid);
1569
1570	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1571	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "buffer provided is a stackshot");
1572
1573	iter = kcdata_iter_next(iter);
1574
1575	KCDATA_ITER_FOREACH(iter) {
1576		switch (kcdata_iter_type(iter)) {
1577			case KCDATA_TYPE_ARRAY: {
1578				T_QUIET; T_ASSERT_TRUE(kcdata_iter_array_valid(iter), "checked that array is valid");
1579				if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO64) {
1580					struct user64_dyld_uuid_info *info = (struct user64_dyld_uuid_info *) kcdata_iter_payload(iter);
1581					if (uuid_compare(*current_uuid, info->imageUUID) == 0) {
1582						T_ASSERT_EQ(expected_offset, info->imageLoadAddress, "found matching UUID with matching binary offset");
1583						return;
1584					}
1585				} else if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO) {
1586					struct user32_dyld_uuid_info *info = (struct user32_dyld_uuid_info *) kcdata_iter_payload(iter);
1587					if (uuid_compare(*current_uuid, info->imageUUID) == 0) {
1588						T_ASSERT_EQ(expected_offset, ((uint64_t) info->imageLoadAddress),  "found matching UUID with matching binary offset");
1589						return;
1590					}
1591				}
1592				break;
1593			}
1594			default:
1595				break;
1596		}
1597	}
1598
1599	T_FAIL("failed to find matching UUID in stackshot data");
1600}
1601
1602T_DECL(translated,
1603    "tests translated bit is set correctly",
1604    T_META_TAG_VM_PREFERRED,
1605    T_META_ENABLED(false /* rdar://133956022 */))
1606{
1607#if !(TARGET_OS_OSX && TARGET_CPU_ARM64)
1608	T_SKIP("Only valid on Apple silicon Macs")
1609#endif
1610	// Get path of stackshot_translated_child helper binary
1611	char path[PATH_MAX];
1612	uint32_t path_size = sizeof(path);
1613	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
1614	char* binary_name = strrchr(path, '/');
1615	if (binary_name) binary_name++;
1616	T_QUIET; T_ASSERT_NOTNULL(binary_name, "Find basename in path '%s'", path);
1617	strlcpy(binary_name, "stackshot_translated_child", path_size - (binary_name - path));
1618	char *args[] = { path, NULL };
1619
1620	dispatch_source_t child_sig_src;
1621	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
1622	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
1623
1624	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
1625	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
1626
1627	signal(SIGUSR1, SIG_IGN);
1628	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
1629	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
1630
1631	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
1632	dispatch_activate(child_sig_src);
1633
1634	// Spawn child
1635	pid_t pid;
1636	T_LOG("spawning translated child");
1637	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, NULL, args, NULL), "spawned process '%s' with PID %d", args[0], pid);
1638
1639	// Wait for the the child to spawn up
1640	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
1641
1642	// Make sure the child is running and is translated
1643	int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, pid };
1644	struct kinfo_proc process_info;
1645	size_t bufsize = sizeof(process_info);
1646	T_QUIET; T_ASSERT_POSIX_SUCCESS(sysctl(mib, (unsigned)(sizeof(mib)/sizeof(int)), &process_info, &bufsize, NULL, 0), "get translated child process info");
1647	T_QUIET; T_ASSERT_GT(bufsize, (size_t)0, "process info is not empty");
1648	T_QUIET; T_ASSERT_TRUE((process_info.kp_proc.p_flag & P_TRANSLATED), "KERN_PROC_PID reports child is translated");
1649
1650	T_LOG("capturing stackshot");
1651
1652	struct scenario scenario = {
1653		.name = "translated",
1654		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
1655				  | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
1656	};
1657
1658	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1659		parse_stackshot(PARSE_STACKSHOT_TRANSLATED, ssbuf, sslen, @{translated_child_pid_key: @(pid)});
1660	});
1661
1662    // Kill the child
1663    int status;
1664    T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGTERM), "kill translated child");
1665    T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on translated child");
1666
1667}
1668
1669T_DECL(proc_uuid_info, "tests that the main binary UUID for a proc is always populated", T_META_TAG_VM_PREFERRED)
1670{
1671	struct proc_uniqidentifierinfo proc_info_data = { };
1672	mach_msg_type_number_t      count;
1673	kern_return_t               kernel_status;
1674	task_dyld_info_data_t       task_dyld_info;
1675	struct dyld_all_image_infos *target_infos;
1676	int retval;
1677	bool found_image_in_image_infos = false;
1678	uint64_t expected_mach_header_offset = 0;
1679
1680	/* Find the UUID of our main binary */
1681	retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
1682	T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
1683	T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
1684
1685	uuid_string_t str = {};
1686	uuid_unparse(*(uuid_t*)&proc_info_data.p_uuid, str);
1687	T_LOG("Found current UUID is %s", str);
1688
1689	/* Find the location of the dyld image info metadata */
1690	count = TASK_DYLD_INFO_COUNT;
1691	kernel_status = task_info(mach_task_self(), TASK_DYLD_INFO, (task_info_t)&task_dyld_info, &count);
1692	T_QUIET; T_ASSERT_EQ(kernel_status, KERN_SUCCESS, "retrieve task_info for TASK_DYLD_INFO");
1693
1694	target_infos = (struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr;
1695
1696	/* Find our binary in the dyld image info array */
1697	for (int i = 0; i < (int) target_infos->uuidArrayCount; i++) {
1698		if (uuid_compare(target_infos->uuidArray[i].imageUUID, *(uuid_t*)&proc_info_data.p_uuid) == 0) {
1699			expected_mach_header_offset = (uint64_t) target_infos->uuidArray[i].imageLoadAddress;
1700			found_image_in_image_infos = true;
1701		}
1702	}
1703
1704	T_ASSERT_TRUE(found_image_in_image_infos, "found binary image in dyld image info list");
1705
1706	/* Overwrite the dyld image info data so the kernel has to fallback to the UUID stored in the proc structure */
1707	target_infos->uuidArrayCount = 0;
1708
1709	struct scenario scenario = {
1710		.name = "proc_uuid_info",
1711		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
1712		.target_pid = getpid(),
1713	};
1714
1715	T_LOG("attempting to take stackshot for current PID");
1716	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1717		stackshot_verify_current_proc_uuid_info(ssbuf, sslen, expected_mach_header_offset, &proc_info_data);
1718	});
1719}
1720
1721T_DECL(cseg_waitinfo, "test that threads stuck in the compressor report correct waitinfo", T_META_TAG_VM_PREFERRED)
1722{
1723	struct scenario scenario = {
1724		.name = "cseg_waitinfo",
1725		.quiet = false,
1726		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1727	};
1728	__block uint64_t thread_id = 0;
1729
1730	dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot.cseg_waitinfo", NULL);
1731	dispatch_semaphore_t child_ok = dispatch_semaphore_create(0);
1732
1733	dispatch_async(dq, ^{
1734		pthread_threadid_np(NULL, &thread_id);
1735		dispatch_semaphore_signal(child_ok);
1736		int val = 1;
1737		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread");
1738	});
1739
1740	dispatch_semaphore_wait(child_ok, DISPATCH_TIME_FOREVER);
1741	sleep(1);
1742
1743	T_LOG("taking stackshot");
1744	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1745		int val = 1;
1746		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child thread");
1747		parse_stackshot(PARSE_STACKSHOT_WAITINFO_CSEG, ssbuf, sslen, @{cseg_expected_threadid_key: @(thread_id)});
1748	});
1749}
1750
1751static void
1752srp_send(
1753	mach_port_t send_port,
1754	mach_port_t reply_port,
1755	mach_port_t msg_port)
1756{
1757	kern_return_t ret = 0;
1758
1759	struct test_msg {
1760		mach_msg_header_t header;
1761		mach_msg_body_t body;
1762		mach_msg_port_descriptor_t port_descriptor;
1763	};
1764	struct test_msg send_msg = {
1765		.header = {
1766			.msgh_remote_port = send_port,
1767			.msgh_local_port  = reply_port,
1768			.msgh_bits        = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND,
1769	    reply_port ? MACH_MSG_TYPE_MAKE_SEND_ONCE : 0,
1770	    MACH_MSG_TYPE_MOVE_SEND,
1771	    MACH_MSGH_BITS_COMPLEX),
1772			.msgh_id          = 0x100,
1773			.msgh_size        = sizeof(send_msg),
1774		},
1775		.body = {
1776			.msgh_descriptor_count = 1,
1777		},
1778		.port_descriptor = {
1779			.name        = msg_port,
1780			.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
1781			.type        = MACH_MSG_PORT_DESCRIPTOR,
1782		},
1783	};
1784
1785	if (msg_port == MACH_PORT_NULL) {
1786		send_msg.body.msgh_descriptor_count = 0;
1787	}
1788
1789	ret = mach_msg(&(send_msg.header),
1790	    MACH_SEND_MSG |
1791	    MACH_SEND_TIMEOUT |
1792	    MACH_SEND_OVERRIDE,
1793	    send_msg.header.msgh_size,
1794	    0,
1795	    MACH_PORT_NULL,
1796	    10000,
1797	    0);
1798
1799	T_ASSERT_MACH_SUCCESS(ret, "client mach_msg");
1800}
1801
1802T_HELPER_DECL(srp_client,
1803    "Client used for the special_reply_port test")
1804{
1805	pid_t ppid = getppid();
1806	dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
1807	dispatch_queue_t dq = dispatch_queue_create("client_signalqueue", NULL);
1808	dispatch_source_t sig_src;
1809
1810	mach_msg_return_t mr;
1811	mach_port_t service_port;
1812	mach_port_t conn_port;
1813	mach_port_t special_reply_port;
1814	mach_port_options_t opts = {
1815		.flags = MPO_INSERT_SEND_RIGHT,
1816	};
1817
1818	signal(SIGUSR1, SIG_IGN);
1819	sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
1820
1821	dispatch_source_set_event_handler(sig_src, ^{
1822			dispatch_semaphore_signal(can_continue);
1823	});
1824	dispatch_activate(sig_src);
1825
1826	/* lookup the mach service port for the parent */
1827	kern_return_t kr = bootstrap_look_up(bootstrap_port,
1828	    SRP_SERVICE_NAME, &service_port);
1829	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "client bootstrap_look_up");
1830
1831	/* create the send-once right (special reply port) and message to send to the server */
1832	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port);
1833	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
1834
1835	special_reply_port = thread_get_special_reply_port();
1836	T_QUIET; T_ASSERT_TRUE(MACH_PORT_VALID(special_reply_port), "get_thread_special_reply_port");
1837
1838	/* send the message with the special reply port */
1839	srp_send(service_port, special_reply_port, conn_port);
1840
1841	/* signal the parent to continue */
1842	kill(ppid, SIGUSR1);
1843
1844	struct {
1845		mach_msg_header_t header;
1846		mach_msg_body_t body;
1847		mach_msg_port_descriptor_t port_descriptor;
1848	} rcv_msg = {
1849		.header =
1850		{
1851			.msgh_remote_port = MACH_PORT_NULL,
1852			.msgh_local_port  = special_reply_port,
1853			.msgh_size        = sizeof(rcv_msg),
1854		},
1855	};
1856
1857	/* wait on the reply from the parent (that we will never receive) */
1858	mr = mach_msg(&(rcv_msg.header),
1859			(MACH_RCV_MSG | MACH_RCV_SYNC_WAIT),
1860			0,
1861			rcv_msg.header.msgh_size,
1862			special_reply_port,
1863			MACH_MSG_TIMEOUT_NONE,
1864			service_port);
1865
1866	/* not expected to execute as parent will SIGKILL client... */
1867	T_LOG("client process exiting after sending message to parent (server)");
1868}
1869
1870enum srp_test_type {
1871	SRP_TEST_THREAD,	/* expect waiter on current thread */
1872	SRP_TEST_PID,		/* expect waiter on current PID */
1873	SRP_TEST_EITHER,	/* waiter could be on either */
1874};
1875
1876static void
1877check_srp_test(const char *name, enum srp_test_type ty)
1878{
1879	struct scenario scenario = {
1880		.name = name,
1881		.quiet = false,
1882		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1883	};
1884	uint64_t thread_id = 0;
1885	pthread_threadid_np(NULL, &thread_id);
1886	if (ty == SRP_TEST_THREAD) {
1887		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1888			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1889					@{srp_expected_threadid_key: @(thread_id)});
1890		});
1891	} else if (ty == SRP_TEST_PID) {
1892		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1893			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1894					@{srp_expected_pid_key: @(getpid())});
1895		});
1896	} else {
1897		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1898			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1899					@{srp_expected_pid_key: @(getpid()), srp_expected_threadid_key: @(thread_id)});
1900		});
1901	}
1902
1903}
1904
1905
1906/*
1907 * Tests the stackshot wait info plumbing for synchronous IPC that doesn't use kevent on the server.
1908 *
1909 * (part 1): tests the scenario where a client sends a request that includes a special reply port
1910 *           to a server that doesn't receive the message and doesn't copy the send-once right
1911 *           into its address space as a result. for this case the special reply port is enqueued
1912 *           in a port and we check which task has that receive right and use that info. (rdar://60440338)
1913 * (part 2): tests the scenario where a client sends a request that includes a special reply port
1914 *           to a server that receives the message and copies in the send-once right, but doesn't
1915 *           reply to the client. for this case the special reply port is copied out and the kernel
1916 *           stashes the info about which task copied out the send once right. (rdar://60440592)
1917 * (part 3): tests the same as part 2, but uses kevents, which allow for
1918 *           priority inheritance
1919 */
1920T_DECL(special_reply_port, "test that tasks using special reply ports have correct waitinfo", T_META_TAG_VM_PREFERRED)
1921{
1922	dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
1923	dispatch_queue_t dq = dispatch_queue_create("signalqueue", NULL);
1924	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
1925	dispatch_source_t sig_src;
1926	char path[PATH_MAX];
1927	uint32_t path_size = sizeof(path);
1928	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
1929	char *client_args[] = { path, "-n", "srp_client", NULL };
1930	pid_t client_pid;
1931	int sp_ret;
1932	kern_return_t kr;
1933	mach_port_t port;
1934
1935	/* setup the signal handler in the parent (server) */
1936	T_LOG("setup sig handlers");
1937	signal(SIGUSR1, SIG_IGN);
1938	sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
1939
1940	dispatch_source_set_event_handler(sig_src, ^{
1941			dispatch_semaphore_signal(can_continue);
1942	});
1943	dispatch_activate(sig_src);
1944
1945	/* register with the mach service name so the client can lookup and send a message to the parent (server) */
1946	T_LOG("Server about to check in");
1947	kr = bootstrap_check_in(bootstrap_port, SRP_SERVICE_NAME, &port);
1948	T_ASSERT_MACH_SUCCESS(kr, "server bootstrap_check_in");
1949
1950	T_LOG("Launching client");
1951	sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
1952	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid);
1953	T_LOG("Spawned client as PID %d", client_pid);
1954
1955	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
1956	T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear");
1957
1958	/*
1959	 * can_continue indicates the client has signaled us, but we want to make
1960	 * sure they've actually blocked sending their mach message.  It's cheesy, but
1961	 * sleep() works for this.
1962	 */
1963	sleep(1);
1964
1965	/*
1966	 * take the stackshot without calling receive to verify that the stackshot wait
1967	 * info shows our (the server) thread for the scenario where the server has yet to
1968	 * receive the message.
1969	 */
1970	T_LOG("Taking stackshot for part 1 coverage");
1971	check_srp_test("srp", SRP_TEST_THREAD);
1972
1973	/*
1974	 * receive the message from the client (which should copy the send once right into
1975	 * our address space).
1976	 */
1977	struct {
1978		mach_msg_header_t header;
1979		mach_msg_body_t body;
1980		mach_msg_port_descriptor_t port_descriptor;
1981	} rcv_msg = {
1982		.header =
1983		{
1984			.msgh_remote_port = MACH_PORT_NULL,
1985			.msgh_local_port  = port,
1986			.msgh_size        = sizeof(rcv_msg),
1987		},
1988	};
1989
1990	T_LOG("server: starting sync receive\n");
1991
1992	mach_msg_return_t mr;
1993	mr = mach_msg(&(rcv_msg.header),
1994			(MACH_RCV_MSG | MACH_RCV_TIMEOUT),
1995			0,
1996			4096,
1997			port,
1998			10000,
1999			MACH_PORT_NULL);
2000	T_QUIET; T_ASSERT_MACH_SUCCESS(mr, "mach_msg() recieve of message from client");
2001
2002	/*
2003	 * take the stackshot to verify that the stackshot wait info shows our (the server) PID
2004	 * for the scenario where the server has received the message and copied in the send-once right.
2005	 */
2006	T_LOG("Taking stackshot for part 2 coverage");
2007	check_srp_test("srp", SRP_TEST_PID);
2008
2009	/* cleanup - kill the client */
2010	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
2011	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2012
2013	// do it again, but using kevents
2014	T_LOG("Launching client");
2015	sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
2016	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid);
2017	T_LOG("Spawned client as PID %d", client_pid);
2018
2019	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2020	T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear");
2021
2022	/*
2023	 * can_continue indicates the client has signaled us, but we want to make
2024	 * sure they've actually blocked sending their mach message.  It's cheesy, but
2025	 * sleep() works for this.
2026	 */
2027	sleep(1);
2028
2029	dispatch_mach_t dispatch_mach = dispatch_mach_create(SRP_SERVICE_NAME, machdq,
2030	    ^(dispatch_mach_reason_t reason,
2031	      dispatch_mach_msg_t message,
2032	      mach_error_t error __unused) {
2033		switch (reason) {
2034		case DISPATCH_MACH_MESSAGE_RECEIVED: {
2035			size_t size = 0;
2036			mach_msg_header_t *msg __unused = dispatch_mach_msg_get_msg(message, &size);
2037			T_LOG("server: recieved %ld byte message", size);
2038			check_srp_test("turnstile_port_thread", SRP_TEST_THREAD);
2039			T_LOG("server: letting client go");
2040			// drop the message on the ground, we'll kill the client later
2041			dispatch_semaphore_signal(can_continue);
2042			break;
2043		}
2044		default:
2045			break;
2046		}
2047	});
2048
2049	dispatch_mach_connect(dispatch_mach, port, MACH_PORT_NULL, NULL);
2050
2051	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2052
2053	/* cleanup - kill the client */
2054	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
2055	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2056}
2057
2058T_HELPER_DECL(throtlled_sp_client,
2059	"client that uses a connection port to send a message to a server")
2060{
2061	mach_port_t conn_port, service_port, reply_port, *stash;
2062	mach_msg_type_number_t stash_cnt = 0;
2063
2064	kern_return_t kr = mach_ports_lookup(mach_task_self(), &stash, &stash_cnt);
2065	T_ASSERT_MACH_SUCCESS(kr, "mach_ports_lookup");
2066
2067	service_port = stash[0];
2068	T_ASSERT_TRUE(MACH_PORT_VALID(service_port), "valid service port");
2069	mig_deallocate((vm_address_t)stash, stash_cnt * sizeof(stash[0]));
2070
2071	mach_port_options_t opts = {
2072		.flags = MPO_INSERT_SEND_RIGHT
2073			| MPO_CONNECTION_PORT,
2074		.service_port_name = service_port,
2075	};
2076
2077	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port);
2078	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
2079
2080	mach_port_options_t opts2 = {
2081		.flags = MPO_REPLY_PORT
2082	};
2083	kr = mach_port_construct(mach_task_self(), &opts2, 0ull, &reply_port);
2084	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
2085
2086	/* XPC-like check-in message */
2087	struct {
2088		mach_msg_header_t header;
2089		mach_msg_port_descriptor_t recvp;
2090		mach_msg_port_descriptor_t sendp;
2091	} checkin_message = {
2092		.header =
2093		{
2094			.msgh_remote_port = service_port,
2095			.msgh_local_port = MACH_PORT_NULL,
2096			.msgh_size = sizeof(checkin_message),
2097			.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0),
2098		},
2099		.recvp =
2100		{
2101			.type = MACH_MSG_PORT_DESCRIPTOR,
2102			.name = conn_port,
2103			.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
2104		},
2105		.sendp =
2106		{
2107			.type = MACH_MSG_PORT_DESCRIPTOR,
2108			.name = reply_port,
2109			.disposition = MACH_MSG_TYPE_MAKE_SEND,
2110		}
2111	};
2112	dispatch_mach_msg_t dmsg = dispatch_mach_msg_create((mach_msg_header_t *)&checkin_message, sizeof(checkin_message),
2113		DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL);
2114
2115	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
2116	dispatch_mach_t dchannel = dispatch_mach_create(THROTTLED_SERVICE_NAME, machdq,
2117		^(dispatch_mach_reason_t reason,
2118	      dispatch_mach_msg_t message __unused,
2119	      mach_error_t error __unused) {
2120		switch (reason) {
2121			case DISPATCH_MACH_CONNECTED:
2122				T_LOG("mach channel connected");
2123				break;
2124			case DISPATCH_MACH_MESSAGE_SENT:
2125				T_LOG("sent mach message");
2126				break;
2127			default:
2128				T_ASSERT_FAIL("Unexpected reply to channel reason %lu", reason);
2129		}
2130	});
2131	dispatch_mach_connect(dchannel, reply_port, service_port, dmsg);
2132	dispatch_release(dmsg);
2133
2134	struct {
2135		mach_msg_header_t header;
2136		uint64_t request_id;
2137	} request = {
2138		.header =
2139		{
2140			.msgh_size = sizeof(request),
2141			.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE),
2142		},
2143		.request_id = 1,
2144	};
2145	dispatch_mach_msg_t dmsg2 = dispatch_mach_msg_create((mach_msg_header_t *)&request, sizeof(request),
2146		DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL);
2147
2148	dispatch_mach_reason_t reason;
2149	mach_error_t error;
2150
2151	/* send the check-in message and the request message */
2152	dispatch_mach_msg_t dreply = dispatch_mach_send_with_result_and_wait_for_reply(dchannel,
2153			dmsg2, 0, DISPATCH_MACH_SEND_DEFAULT, &reason, &error);
2154	dispatch_release(dmsg2);
2155
2156	/* not expected to execute as parent will SIGKILL client */
2157	T_ASSERT_FAIL("client process exiting after receiving %s reply", dreply ? "non-null" : "null");
2158}
2159
2160static void
2161check_throttled_sp(const char *test_name, uint64_t context, bool is_throttled)
2162{
2163	struct scenario scenario = {
2164		.name = test_name,
2165		.quiet = false,
2166		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
2167	};
2168
2169	T_LOG("taking stackshot %s", test_name);
2170	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2171		parse_stackshot(PARSE_STACKSHOT_THROTTLED_SP, ssbuf, sslen,
2172					@{sp_throttled_expected_ctxt_key: @(context),
2173					sp_throttled_expect_flag: @(is_throttled)});
2174	});
2175}
2176
2177/* Take stackshot when a client is blocked on the service port of a process, in the scenario when
2178 * the process with the receive right for the service port is:
2179 *     (a) Monitoring the service port using kevents
2180 *     (b) Not monitoring the service port
2181 */
2182T_DECL(throttled_sp,
2183	"test that service port throttled flag is propagated to the stackshot correctly", T_META_TAG_VM_PREFERRED)
2184{
2185	mach_port_t service_port;
2186	__block dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
2187
2188	char path[PATH_MAX];
2189	uint32_t path_size = sizeof(path);
2190	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
2191	char *client_args[] = { path, "-n", "throtlled_sp_client", NULL };
2192
2193	__block	uint64_t thread_id = 0;
2194	pid_t client_pid;
2195	int mark_throttled;
2196
2197	struct mach_service_port_info sp_info = {};
2198	strcpy(sp_info.mspi_string_name, THROTTLED_SERVICE_NAME);
2199	sp_info.mspi_domain_type = (uint8_t)1;
2200	kern_return_t kr;
2201
2202	mach_port_options_t opts = {
2203		.flags = MPO_SERVICE_PORT | MPO_INSERT_SEND_RIGHT | MPO_CONTEXT_AS_GUARD | MPO_STRICT | MPO_TEMPOWNER,
2204		.service_port_info = &sp_info,
2205	};
2206
2207	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &service_port);
2208	T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct %u", service_port);
2209
2210	/* Setup a dispatch source to monitor the service port similar to how launchd does. */
2211	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
2212	dispatch_source_t mach_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_MACH_RECV, service_port,
2213		DISPATCH_MACH_RECV_SYNC_PEEK, machdq);
2214	dispatch_source_set_event_handler(mach_src, ^{
2215		pthread_threadid_np(NULL, &thread_id);
2216		dispatch_semaphore_signal(can_continue);
2217	});
2218	dispatch_activate(mach_src);
2219
2220	/* Stash the port in task to make sure child also gets it */
2221	kr = mach_ports_register(mach_task_self(), &service_port, 1);
2222	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_ports_register service port");
2223
2224	mark_throttled = 1;
2225	kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled),
2226	           MACH_PORT_SERVICE_THROTTLED_COUNT);
2227	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mark service port as throttled");
2228
2229	int rc = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
2230	T_QUIET; T_ASSERT_POSIX_ZERO(rc, "spawned process '%s' with PID %d", client_args[0], client_pid);
2231	T_LOG("Spawned client as PID %d", client_pid);
2232
2233	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2234
2235	/* The service port has received the check-in message. Take stackshot for scenario (a). */
2236	check_throttled_sp("throttled_service_port_monitored", thread_id, true);
2237
2238	/* This simulates a throttled spawn when the service port is no longer monitored. */
2239	dispatch_source_cancel(mach_src);
2240
2241	/* Take stackshot for scenario (b) */
2242	check_throttled_sp("throttled_service_port_unmonitored", (uint64_t)getpid(), true);
2243
2244	mark_throttled = 0;
2245	kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled),
2246	           MACH_PORT_SERVICE_THROTTLED_COUNT);
2247	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "unmark service port as throttled");
2248
2249	/* Throttled flag should not be set when the port is not throttled. */
2250	check_throttled_sp("unthrottled_service_port_unmonitored", (uint64_t)getpid(), false);
2251
2252	/* cleanup - kill the client */
2253	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
2254	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2255}
2256
2257
2258char *const clpcctrl_path = "/usr/local/bin/clpcctrl";
2259
2260static void
2261run_clpcctrl(char *const argv[]) {
2262	posix_spawnattr_t sattr;
2263	pid_t pid;
2264	int wstatus;
2265
2266	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, argv[0], NULL, NULL, argv, NULL), "spawn clpcctrl");
2267	T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &wstatus, 0), "wait for clpcctrl");
2268	T_QUIET; T_ASSERT_TRUE(WIFEXITED(wstatus), "clpcctrl exited normally");
2269	T_QUIET; T_ASSERT_POSIX_ZERO(WEXITSTATUS(wstatus), "clpcctrl exited successfully");
2270
2271	uint64_t sched_recommended_cores = 1;
2272	size_t sched_recommended_cores_sz = sizeof(uint64_t);
2273	T_QUIET; T_ASSERT_POSIX_SUCCESS(
2274	    sysctlbyname("kern.sched_recommended_cores", &sched_recommended_cores, &sched_recommended_cores_sz, NULL, 0),
2275	    "get kern.sched_recommended_cores");
2276	T_LOG("Recommended cores: 0x%llx", sched_recommended_cores);
2277}
2278
2279static void
2280restore_clpcctrl() {
2281	run_clpcctrl((char *const []) { clpcctrl_path, "-d", NULL });
2282}
2283
2284#define CLUSTER_TYPE_SMP 0
2285#define CLUSTER_TYPE_E 1
2286#define CLUSTER_TYPE_P 2
2287
2288void test_stackshot_cpu_info(void *ssbuf, size_t sslen, int exp_cpus, NSArray *exp_cluster_types) {
2289	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2290	bool seen = false;
2291	int singlethread_override = 0;
2292	size_t singlethread_override_sz = sizeof(singlethread_override);
2293	T_QUIET; T_ASSERT_POSIX_SUCCESS(
2294		sysctlbyname("kern.stackshot_single_thread", &singlethread_override, &singlethread_override_sz, NULL, 0),
2295		"get kern.stackshot_single_thread");
2296	if (singlethread_override) {
2297		T_LOG("skipping cpu count/type check due to single-thread override (kern.stackshot_single_thread=1)");
2298		return;
2299	}
2300
2301	KCDATA_ITER_FOREACH(iter) {
2302		if ((kcdata_iter_type(iter) != KCDATA_TYPE_ARRAY) || (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_LATENCY_INFO_CPU)) {
2303			continue;
2304		}
2305
2306		seen = true;
2307
2308		/* Check ncpus */
2309		int ncpus = kcdata_iter_array_elem_count(iter);
2310		if (exp_cpus != -1) {
2311			T_QUIET; T_ASSERT_EQ(exp_cpus, ncpus, "Expected number of CPUs matches number of CPUs used for stackshot");
2312		}
2313
2314		if (exp_cluster_types == nil) {
2315			continue;
2316		}
2317
2318		/* Check cluster types */
2319		struct stackshot_latency_cpu *latencies = (struct stackshot_latency_cpu *) kcdata_iter_payload(iter);
2320		for (int i = 0; i < ncpus; i++) {
2321			NSNumber *cluster_type = [NSNumber numberWithInt:latencies[i].cluster_type];
2322			T_QUIET; T_ASSERT_TRUE([exp_cluster_types containsObject:cluster_type], "Type of CPU cluster in expected CPU cluster types");
2323		}
2324	}
2325
2326	T_QUIET; T_ASSERT_TRUE(seen || !is_development_kernel(), "Seen CPU latency info or is release kernel");
2327}
2328
2329void test_stackshot_with_clpcctrl(char *const name, char *const argv[], int exp_cpus, NSArray *exp_cluster_types) {
2330	T_LOG("Stackshot CLPC scenario %s", name);
2331	run_clpcctrl(argv);
2332	struct scenario scenario = {
2333		.name = name,
2334		.flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO |
2335			STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS)
2336	};
2337	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2338		parse_stackshot(0, ssbuf, sslen, nil);
2339		test_stackshot_cpu_info(ssbuf, sslen, exp_cpus, exp_cluster_types);
2340	});
2341}
2342
2343T_DECL(core_masks,
2344	"test that stackshot works under various core masks on ARM systems",
2345	T_META_REQUIRES_SYSCTL_EQ("hw.optional.arm64", 1),
2346	T_META_REQUIRES_SYSCTL_NE("kern.kasan.available", 1), /* rdar://115577993 */
2347	XNU_T_META_REQUIRES_DEVELOPMENT_KERNEL,
2348	T_META_REQUIRE_NOT_VIRTUALIZED,
2349	T_META_RUN_CONCURRENTLY(false),
2350	T_META_TAG_VM_NOT_ELIGIBLE,
2351	T_META_ENABLED(!TARGET_OS_VISION)) // disable for visionOS: device may not be stable with many cores masked off (127904530)
2352{
2353	/*
2354	 * Make sure we're not in a release kernel
2355	 * (cannot check with T_META; only one sysctl T_META at a time will work)
2356	 */
2357	if (!is_development_kernel()) {
2358		T_SKIP("test was not run because kernel is release; cannot set core masks");
2359		return;
2360	}
2361
2362	/*
2363	 * rdar://115577993 - CLPC compiles as release in KASAN-variant builds,
2364	 * preventing clpcctrl from working. For now, skip this. (Cannot check
2365	 * with T_META; only one sysctl T_META at a time will work)
2366	 */
2367	int kasan_avail = 0;
2368	size_t kasan_avail_sz = sizeof(kasan_avail);
2369	sysctlbyname("kern.kasan.available", &kasan_avail, &kasan_avail_sz, NULL, 0);
2370	if (kasan_avail) {
2371		T_SKIP("test was not run because kernel is KASAN; cannot set core masks (see rdar://115577993)");
2372		return;
2373	}
2374
2375
2376	T_ATEND(restore_clpcctrl);
2377
2378	/* Test with 1 and 2 CPUs for basic functionality */
2379	test_stackshot_with_clpcctrl(
2380		"core_masks_1cpu", (char *const[]) {clpcctrl_path, "-c", "1", NULL},
2381		1, nil);
2382
2383	test_stackshot_with_clpcctrl(
2384		"core_masks_2cpus", (char *const[]) {clpcctrl_path, "-c", "2", NULL},
2385		2, nil);
2386
2387	/* Check nperflevels to see if we're on an AMP system */
2388	int nperflevels = 1;
2389	size_t nperflevels_sz = sizeof(int);
2390	T_ASSERT_POSIX_SUCCESS(
2391	    sysctlbyname("hw.nperflevels", &nperflevels, &nperflevels_sz, NULL, 0),
2392	    "get hw.nperflevels");
2393	if (nperflevels == 1) {
2394		T_LOG("On SMP system, skipping stackshot core_masks AMP tests");
2395		return;
2396	}
2397
2398	T_QUIET; T_ASSERT_EQ(nperflevels, 2, "nperflevels is 1 or 2");
2399	T_LOG("On AMP system, performing stackshot core_masks AMP tests");
2400
2401	/* Perform AMP tests with different cluster types active */
2402	test_stackshot_with_clpcctrl(
2403		"core_masks_amp_allcpus",
2404		(char *const[]) {clpcctrl_path, "-C", "all", NULL},
2405		-1, @[@CLUSTER_TYPE_E, @CLUSTER_TYPE_P]);
2406
2407	test_stackshot_with_clpcctrl(
2408		"core_masks_amp_ecpus",
2409		(char *const[]) {clpcctrl_path, "-C", "e", NULL},
2410		-1, @[@CLUSTER_TYPE_E]);
2411
2412	test_stackshot_with_clpcctrl(
2413		"core_masks_amp_pcpus",
2414		(char *const[]) {clpcctrl_path, "-C", "p", NULL},
2415		-1, @[@CLUSTER_TYPE_P]);
2416}
2417
2418#pragma mark performance tests
2419
2420#define SHOULD_REUSE_SIZE_HINT 0x01
2421#define SHOULD_USE_DELTA       0x02
2422#define SHOULD_TARGET_SELF     0x04
2423
2424static void
2425stackshot_perf(unsigned int options)
2426{
2427	struct scenario scenario = {
2428		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
2429			| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
2430	};
2431
2432	dt_stat_t size = dt_stat_create("bytes", "size");
2433	dt_stat_time_t duration = dt_stat_time_create("duration");
2434	scenario.timer = duration;
2435
2436	if (options & SHOULD_TARGET_SELF) {
2437		scenario.target_pid = getpid();
2438	}
2439
2440	while (!dt_stat_stable(duration) || !dt_stat_stable(size)) {
2441		__block uint64_t last_time = 0;
2442		__block uint32_t size_hint = 0;
2443		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2444			dt_stat_add(size, (double)sslen);
2445			last_time = stackshot_timestamp(ssbuf, sslen);
2446			size_hint = (uint32_t)sslen;
2447		});
2448		if (options & SHOULD_USE_DELTA) {
2449			scenario.since_timestamp = last_time;
2450			scenario.flags |= STACKSHOT_COLLECT_DELTA_SNAPSHOT;
2451		}
2452		if (options & SHOULD_REUSE_SIZE_HINT) {
2453			scenario.size_hint = size_hint;
2454		}
2455	}
2456
2457	dt_stat_finalize(duration);
2458	dt_stat_finalize(size);
2459}
2460
2461static void
2462stackshot_flag_perf_noclobber(uint64_t flag, char *flagname)
2463{
2464	struct scenario scenario = {
2465		.quiet = true,
2466		.flags = (flag | STACKSHOT_KCDATA_FORMAT),
2467	};
2468
2469	dt_stat_t duration = dt_stat_create("nanoseconds per thread", "%s_duration", flagname);
2470	dt_stat_t size = dt_stat_create("bytes per thread", "%s_size", flagname);
2471	T_LOG("Testing \"%s\" = 0x%" PRIx64, flagname, flag);
2472
2473	while (!dt_stat_stable(duration) || !dt_stat_stable(size)) {
2474		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2475			kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2476			unsigned long no_threads = 0;
2477			mach_timebase_info_data_t timebase = {0, 0};
2478			uint64_t stackshot_duration = 0;
2479			int found = 0;
2480			T_QUIET; T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "stackshot buffer");
2481
2482			KCDATA_ITER_FOREACH(iter) {
2483				switch(kcdata_iter_type(iter)) {
2484					case STACKSHOT_KCTYPE_THREAD_SNAPSHOT: {
2485						found |= 1;
2486						no_threads ++;
2487						break;
2488					}
2489					case STACKSHOT_KCTYPE_STACKSHOT_DURATION: {
2490						struct stackshot_duration *ssd = kcdata_iter_payload(iter);
2491						stackshot_duration = ssd->stackshot_duration;
2492						found |= 2;
2493						break;
2494					}
2495					case KCDATA_TYPE_TIMEBASE: {
2496						found |= 4;
2497						mach_timebase_info_data_t *tb = kcdata_iter_payload(iter);
2498						memcpy(&timebase, tb, sizeof(timebase));
2499						break;
2500					}
2501				}
2502			}
2503
2504			T_QUIET; T_ASSERT_EQ(found, 0x7, "found everything needed");
2505
2506			uint64_t ns = (stackshot_duration * timebase.numer) / timebase.denom;
2507			uint64_t per_thread_ns = ns / no_threads;
2508			uint64_t per_thread_size = sslen / no_threads;
2509
2510			dt_stat_add(duration, per_thread_ns);
2511			dt_stat_add(size, per_thread_size);
2512		});
2513	}
2514
2515	dt_stat_finalize(duration);
2516	dt_stat_finalize(size);
2517}
2518
2519static void
2520stackshot_flag_perf(uint64_t flag, char *flagname)
2521{
2522	/*
2523	 * STACKSHOT_NO_IO_STATS disables data collection, so set it for
2524	 * more accurate perfdata collection.
2525	 */
2526	flag |= STACKSHOT_NO_IO_STATS;
2527
2528	stackshot_flag_perf_noclobber(flag, flagname);
2529}
2530
2531
2532T_DECL(flag_perf, "test stackshot performance with different flags set", T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2533{
2534	stackshot_flag_perf_noclobber(STACKSHOT_NO_IO_STATS, "baseline");
2535	stackshot_flag_perf_noclobber(0, "io_stats");
2536
2537	stackshot_flag_perf(STACKSHOT_THREAD_WAITINFO, "thread_waitinfo");
2538	stackshot_flag_perf(STACKSHOT_GET_DQ, "get_dq");
2539	stackshot_flag_perf(STACKSHOT_SAVE_LOADINFO, "save_loadinfo");
2540	stackshot_flag_perf(STACKSHOT_GET_GLOBAL_MEM_STATS, "get_global_mem_stats");
2541	stackshot_flag_perf(STACKSHOT_SAVE_KEXT_LOADINFO, "save_kext_loadinfo");
2542	stackshot_flag_perf(STACKSHOT_SAVE_IMP_DONATION_PIDS, "save_imp_donation_pids");
2543	stackshot_flag_perf(STACKSHOT_ENABLE_BT_FAULTING, "enable_bt_faulting");
2544	stackshot_flag_perf(STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT, "collect_sharedcache_layout");
2545	stackshot_flag_perf(STACKSHOT_ENABLE_UUID_FAULTING, "enable_uuid_faulting");
2546	stackshot_flag_perf(STACKSHOT_THREAD_GROUP, "thread_group");
2547	stackshot_flag_perf(STACKSHOT_SAVE_JETSAM_COALITIONS, "save_jetsam_coalitions");
2548	stackshot_flag_perf(STACKSHOT_INSTRS_CYCLES, "instrs_cycles");
2549	stackshot_flag_perf(STACKSHOT_ASID, "asid");
2550	stackshot_flag_perf(STACKSHOT_EXCLAVES, "all_exclaves");
2551	stackshot_flag_perf(STACKSHOT_EXCLAVES | STACKSHOT_ASID, "all_exclaves_and_asid");
2552	stackshot_flag_perf(STACKSHOT_SKIP_EXCLAVES, "skip_exclaves");
2553}
2554
2555T_DECL(perf_no_size_hint, "test stackshot performance with no size hint",
2556		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2557{
2558	stackshot_perf(0);
2559}
2560
2561T_DECL(perf_size_hint, "test stackshot performance with size hint",
2562		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2563{
2564	stackshot_perf(SHOULD_REUSE_SIZE_HINT);
2565}
2566
2567T_DECL(perf_process, "test stackshot performance targeted at process",
2568		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2569{
2570	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_TARGET_SELF);
2571}
2572
2573T_DECL(perf_delta, "test delta stackshot performance",
2574		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2575{
2576	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA);
2577}
2578
2579T_DECL(perf_delta_no_exclaves, "test delta stackshot performance without Exclaves",
2580	    T_META_REQUIRES_SYSCTL_EQ("kern.exclaves_status", 1),
2581		T_META_REQUIRES_SYSCTL_EQ("kern.exclaves_inspection_status", 1),
2582		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2583{
2584	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | STACKSHOT_SKIP_EXCLAVES);
2585}
2586
2587T_DECL(perf_delta_process, "test delta stackshot performance targeted at a process",
2588		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2589{
2590	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | SHOULD_TARGET_SELF);
2591}
2592
2593T_DECL(stackshot_entitlement_report_test, "test stackshot entitlement report", T_META_TAG_VM_PREFERRED)
2594{
2595	int sysctlValue = 1;
2596	T_ASSERT_POSIX_SUCCESS(
2597	    sysctlbyname("debug.stackshot_entitlement_send_batch", NULL, NULL, &sysctlValue, sizeof(sysctlValue)),
2598	    "set debug.stackshot_entitlement_send_batch=1");
2599	// having a way to verify that the coreanalytics event was received would be even better
2600	// See rdar://74197197
2601	T_PASS("entitlement test ran");
2602}
2603
2604static void
2605expect_os_build_version_in_stackshot(void *ssbuf, size_t sslen)
2606{
2607	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2608
2609	bool saw_os_build_version = false;
2610	iter = kcdata_iter_next(iter);
2611
2612	KCDATA_ITER_FOREACH(iter) {
2613		switch (kcdata_iter_type(iter)) {
2614		case STACKSHOT_KCTYPE_OS_BUILD_VERSION:
2615			saw_os_build_version = true;
2616			T_LOG("Found os build version in stackshot: %s", kcdata_iter_payload(iter));
2617			return;
2618
2619		default:
2620			break;
2621		}
2622	}
2623
2624	T_ASSERT_FAIL("didn't see os build version in stackshot");
2625}
2626
2627T_DECL(os_build_version, "test stackshot contains os build version", T_META_TAG_VM_PREFERRED)
2628{
2629
2630	struct scenario scenario = {
2631		.name = "os-build-version",
2632		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
2633	};
2634
2635	T_LOG("attempting to take stackshot with an os build version");
2636	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2637		expect_os_build_version_in_stackshot(ssbuf, sslen);
2638	});
2639}
2640
2641static uint64_t
2642stackshot_timestamp(void *ssbuf, size_t sslen)
2643{
2644	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2645
2646	uint32_t type = kcdata_iter_type(iter);
2647	if (type != KCDATA_BUFFER_BEGIN_STACKSHOT && type != KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT) {
2648		T_ASSERT_FAIL("invalid kcdata type %u", kcdata_iter_type(iter));
2649	}
2650
2651	iter = kcdata_iter_find_type(iter, KCDATA_TYPE_MACH_ABSOLUTE_TIME);
2652	T_QUIET;
2653	T_ASSERT_TRUE(kcdata_iter_valid(iter), "timestamp found in stackshot");
2654
2655	return *(uint64_t *)kcdata_iter_payload(iter);
2656}
2657
2658#define TEST_THREAD_NAME "stackshot_test_thread"
2659
2660static void
2661parse_thread_group_stackshot(void **ssbuf, size_t sslen)
2662{
2663	bool seen_thread_group_snapshot = false;
2664	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2665	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
2666			"buffer provided is a stackshot");
2667
2668	NSMutableSet *thread_groups = [[NSMutableSet alloc] init];
2669
2670	iter = kcdata_iter_next(iter);
2671	KCDATA_ITER_FOREACH(iter) {
2672		switch (kcdata_iter_type(iter)) {
2673		case KCDATA_TYPE_ARRAY: {
2674			T_QUIET;
2675			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
2676					"checked that array is valid");
2677
2678			if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_THREAD_GROUP_SNAPSHOT) {
2679				continue;
2680			}
2681
2682			seen_thread_group_snapshot = true;
2683
2684			if (kcdata_iter_array_elem_size(iter) >= sizeof(struct thread_group_snapshot_v3)) {
2685				struct thread_group_snapshot_v3 *tgs_array = kcdata_iter_payload(iter);
2686				for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) {
2687					struct thread_group_snapshot_v3 *tgs = tgs_array + j;
2688					[thread_groups addObject:@(tgs->tgs_id)];
2689				}
2690			}
2691			else {
2692				struct thread_group_snapshot *tgs_array = kcdata_iter_payload(iter);
2693				for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) {
2694					struct thread_group_snapshot *tgs = tgs_array + j;
2695					[thread_groups addObject:@(tgs->tgs_id)];
2696				}
2697			}
2698			break;
2699		}
2700		}
2701	}
2702	KCDATA_ITER_FOREACH(iter) {
2703		NSError *error = nil;
2704
2705		switch (kcdata_iter_type(iter)) {
2706
2707		case KCDATA_TYPE_CONTAINER_BEGIN: {
2708			T_QUIET;
2709			T_ASSERT_TRUE(kcdata_iter_container_valid(iter),
2710					"checked that container is valid");
2711
2712			if (kcdata_iter_container_type(iter) != STACKSHOT_KCCONTAINER_THREAD) {
2713				break;
2714			}
2715
2716			NSDictionary *container = parseKCDataContainer(&iter, &error);
2717			T_QUIET; T_ASSERT_NOTNULL(container, "parsed thread container from stackshot");
2718			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container");
2719
2720			int tg = [container[@"thread_snapshots"][@"thread_group"] intValue];
2721
2722			T_ASSERT_TRUE([thread_groups containsObject:@(tg)], "check that the thread group the thread is in exists");
2723
2724			break;
2725		};
2726
2727		}
2728	}
2729	T_ASSERT_TRUE(seen_thread_group_snapshot, "check that we have seen a thread group snapshot");
2730}
2731
2732static void
2733verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count)
2734{
2735	uuid_t cur_shared_cache_uuid;
2736	__block uint32_t lib_index = 0, libs_found = 0;
2737
2738	_dyld_get_shared_cache_uuid(cur_shared_cache_uuid);
2739	int result = dyld_shared_cache_iterate_text(cur_shared_cache_uuid, ^(const dyld_shared_cache_dylib_text_info* info) {
2740			T_QUIET; T_ASSERT_LT(lib_index, uuid_count, "dyld_shared_cache_iterate_text exceeded number of libraries returned by kernel");
2741
2742			libs_found++;
2743			struct dyld_uuid_info_64 *cur_stackshot_uuid_entry = &uuids[lib_index];
2744			T_QUIET; T_ASSERT_EQ(memcmp(info->dylibUuid, cur_stackshot_uuid_entry->imageUUID, sizeof(info->dylibUuid)), 0,
2745					"dyld returned UUID doesn't match kernel returned UUID");
2746			T_QUIET; T_ASSERT_EQ(info->loadAddressUnslid, cur_stackshot_uuid_entry->imageLoadAddress,
2747					"dyld returned load address doesn't match kernel returned load address");
2748			lib_index++;
2749		});
2750
2751	T_ASSERT_EQ(result, 0, "iterate shared cache layout");
2752	T_ASSERT_EQ(libs_found, uuid_count, "dyld iterator returned same number of libraries as kernel");
2753
2754	T_LOG("verified %d libraries from dyld shared cache", libs_found);
2755}
2756
2757static void
2758check_shared_cache_uuid(uuid_t imageUUID)
2759{
2760	static uuid_t shared_cache_uuid;
2761	static dispatch_once_t read_shared_cache_uuid;
2762
2763	dispatch_once(&read_shared_cache_uuid, ^{
2764		T_QUIET;
2765		T_ASSERT_TRUE(_dyld_get_shared_cache_uuid(shared_cache_uuid), "retrieve current shared cache UUID");
2766	});
2767	T_QUIET; T_ASSERT_EQ(uuid_compare(shared_cache_uuid, imageUUID), 0,
2768			"dyld returned UUID doesn't match kernel returned UUID for system shared cache");
2769}
2770
2771/*
2772 * extra dictionary contains data relevant for the given flags:
2773 * PARSE_STACKSHOT_ZOMBIE:   zombie_child_pid_key -> @(pid)
2774 * PARSE_STACKSHOT_POSTEXEC: postexec_child_unique_pid_key -> @(unique_pid)
2775 */
2776static void
2777parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra)
2778{
2779	bool delta = (stackshot_parsing_flags & PARSE_STACKSHOT_DELTA);
2780	bool expect_sharedcache_child = (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_FLAGS);
2781	bool expect_zombie_child = (stackshot_parsing_flags & PARSE_STACKSHOT_ZOMBIE);
2782	bool expect_postexec_child = (stackshot_parsing_flags & PARSE_STACKSHOT_POSTEXEC);
2783	bool expect_cseg_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_CSEG);
2784	bool expect_translated_child = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSLATED);
2785	bool expect_shared_cache_layout = false;
2786	bool expect_shared_cache_uuid = !delta;
2787	bool expect_dispatch_queue_label = (stackshot_parsing_flags & PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL);
2788	bool expect_turnstile_lock = (stackshot_parsing_flags & PARSE_STACKSHOT_TURNSTILEINFO);
2789	bool expect_srp_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_SRP);
2790	bool expect_sp_throttled = (stackshot_parsing_flags & PARSE_STACKSHOT_THROTTLED_SP);
2791	bool expect_exec_inprogress = (stackshot_parsing_flags & PARSE_STACKSHOT_EXEC_INPROGRESS);
2792	bool expect_transitioning_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSITIONING);
2793	bool expect_asyncstack = (stackshot_parsing_flags & PARSE_STACKSHOT_ASYNCSTACK);
2794	bool expect_driverkit = (stackshot_parsing_flags & PARSE_STACKSHOT_DRIVERKIT);
2795	bool expect_suspendinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_SUSPENDINFO);
2796	bool found_zombie_child = false, found_postexec_child = false, found_shared_cache_layout = false, found_shared_cache_uuid = false;
2797	bool found_translated_child = false, found_transitioning_task = false;
2798	bool found_dispatch_queue_label = false, found_turnstile_lock = false;
2799	bool found_cseg_waitinfo = false, found_srp_waitinfo = false;
2800	bool found_sharedcache_child = false, found_sharedcache_badflags = false, found_sharedcache_self = false;
2801	bool found_asyncstack = false;
2802	bool found_throttled_service = false;
2803	bool found_exclaves = false;
2804	bool expect_single_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TARGETPID);
2805	uint64_t srp_expected_threadid = 0;
2806	pid_t zombie_child_pid = -1, srp_expected_pid = -1, sharedcache_child_pid = -1, throttled_service_ctx = -1;
2807	pid_t translated_child_pid = -1, transistioning_task_pid = -1;
2808	bool sharedcache_child_sameaddr = false, is_throttled = false;
2809	uint64_t postexec_child_unique_pid = 0, cseg_expected_threadid = 0;
2810	uint64_t sharedcache_child_flags = 0, sharedcache_self_flags = 0;
2811	uint64_t asyncstack_threadid = 0;
2812	NSArray *asyncstack_stack = nil;
2813	char *inflatedBufferBase = NULL;
2814	pid_t exec_inprogress_pid = -1;
2815	void (^exec_inprogress_cb)(uint64_t, uint64_t) = NULL;
2816	int exec_inprogress_found = 0;
2817	uint64_t exec_inprogress_containerid = 0;
2818	void (^driverkit_cb)(pid_t) = NULL;
2819	NSMutableDictionary *sharedCaches = [NSMutableDictionary new];
2820	uint64_t expected_num_threads = 0, expected_num_tasks = 0, found_percpu_threads = 0, found_tasks = 0, found_percpu_tasks = 0;
2821	NSMutableSet *seen_tasks = [NSMutableSet new];
2822
2823	if (expect_shared_cache_uuid) {
2824		uuid_t shared_cache_uuid;
2825		if (!_dyld_get_shared_cache_uuid(shared_cache_uuid)) {
2826			T_LOG("Skipping verifying shared cache UUID in stackshot data because not running with a shared cache");
2827			expect_shared_cache_uuid = false;
2828		}
2829	}
2830
2831	if (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_LAYOUT) {
2832		size_t shared_cache_length = 0;
2833		const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length);
2834		T_QUIET; T_ASSERT_NOTNULL(cache_header, "current process running with shared cache");
2835		T_QUIET; T_ASSERT_GT(shared_cache_length, sizeof(struct _dyld_cache_header), "valid shared cache length populated by _dyld_get_shared_cache_range");
2836
2837		if (_dyld_shared_cache_is_locally_built()) {
2838			T_LOG("device running with locally built shared cache, expect shared cache layout");
2839			expect_shared_cache_layout = true;
2840		} else {
2841			T_LOG("device running with B&I built shared-cache, no shared cache layout expected");
2842		}
2843	}
2844
2845	if (expect_sharedcache_child) {
2846		NSNumber* pid_num = extra[sharedcache_child_pid_key];
2847		NSNumber* sameaddr_num = extra[sharedcache_child_sameaddr_key];
2848		T_QUIET; T_ASSERT_NOTNULL(pid_num, "sharedcache child pid provided");
2849		T_QUIET; T_ASSERT_NOTNULL(sameaddr_num, "sharedcache child addrsame provided");
2850		sharedcache_child_pid = [pid_num intValue];
2851		T_QUIET; T_ASSERT_GT(sharedcache_child_pid, 0, "sharedcache child pid greater than zero");
2852		sharedcache_child_sameaddr = [sameaddr_num intValue];
2853		T_QUIET; T_ASSERT_GE([sameaddr_num intValue], 0, "sharedcache child sameaddr is boolean (0 or 1)");
2854		T_QUIET; T_ASSERT_LE([sameaddr_num intValue], 1, "sharedcache child sameaddr is boolean (0 or 1)");
2855	}
2856
2857    if (expect_transitioning_task) {
2858        NSNumber* pid_num = extra[transitioning_pid_key];
2859        T_ASSERT_NOTNULL(pid_num, "transitioning task pid provided");
2860        transistioning_task_pid = [pid_num intValue];
2861    }
2862
2863	if (expect_zombie_child) {
2864		NSNumber* pid_num = extra[zombie_child_pid_key];
2865		T_QUIET; T_ASSERT_NOTNULL(pid_num, "zombie child pid provided");
2866		zombie_child_pid = [pid_num intValue];
2867		T_QUIET; T_ASSERT_GT(zombie_child_pid, 0, "zombie child pid greater than zero");
2868	}
2869
2870	if (expect_postexec_child) {
2871		NSNumber* unique_pid_num = extra[postexec_child_unique_pid_key];
2872		T_QUIET; T_ASSERT_NOTNULL(unique_pid_num, "postexec child unique pid provided");
2873		postexec_child_unique_pid = [unique_pid_num unsignedLongLongValue];
2874		T_QUIET; T_ASSERT_GT(postexec_child_unique_pid, 0ull, "postexec child unique pid greater than zero");
2875	}
2876
2877	if (expect_cseg_waitinfo) {
2878		NSNumber* tid_num = extra[cseg_expected_threadid_key];
2879		T_QUIET; T_ASSERT_NOTNULL(tid_num, "cseg's expected thread id provided");
2880		cseg_expected_threadid = tid_num.unsignedLongValue;
2881		T_QUIET; T_ASSERT_GT(cseg_expected_threadid, UINT64_C(0), "compressor segment thread is present");
2882	}
2883
2884	if (expect_srp_waitinfo) {
2885		NSNumber* threadid_num = extra[srp_expected_threadid_key];
2886		NSNumber* pid_num = extra[srp_expected_pid_key];
2887		T_QUIET; T_ASSERT_TRUE(threadid_num != nil || pid_num != nil, "expected SRP threadid or pid");
2888		if (threadid_num != nil) {
2889			srp_expected_threadid = [threadid_num unsignedLongLongValue];
2890			T_QUIET; T_ASSERT_GT(srp_expected_threadid, 0ull, "srp_expected_threadid greater than zero");
2891		}
2892		if (pid_num != nil) {
2893			srp_expected_pid = [pid_num intValue];
2894			T_QUIET; T_ASSERT_GT(srp_expected_pid, 0, "srp_expected_pid greater than zero");
2895		}
2896		T_LOG("looking for SRP pid: %d threadid: %llu", srp_expected_pid, srp_expected_threadid);
2897	}
2898
2899	if (expect_sp_throttled) {
2900		NSNumber* ctx = extra[sp_throttled_expected_ctxt_key];
2901		T_QUIET; T_ASSERT_TRUE(ctx != nil, "expected pid");
2902		throttled_service_ctx = [ctx intValue];
2903		T_QUIET; T_ASSERT_GT(throttled_service_ctx, 0, "expected pid greater than zero");
2904
2905		NSNumber *throttled = extra[sp_throttled_expect_flag];
2906		T_QUIET; T_ASSERT_TRUE(throttled != nil, "expected flag value");
2907		is_throttled = ([throttled intValue] != 0);
2908
2909		T_LOG("Looking for service with ctxt: %d, thottled:%d", throttled_service_ctx, is_throttled);
2910	}
2911
2912	if (expect_translated_child) {
2913		NSNumber* pid_num = extra[translated_child_pid_key];
2914		T_QUIET; T_ASSERT_NOTNULL(pid_num, "translated child pid provided");
2915		translated_child_pid = [pid_num intValue];
2916		T_QUIET; T_ASSERT_GT(translated_child_pid, 0, "translated child pid greater than zero");
2917	}
2918	if (expect_exec_inprogress) {
2919		NSNumber* pid_num = extra[exec_inprogress_pid_key];
2920		T_QUIET; T_ASSERT_NOTNULL(pid_num, "exec inprogress pid provided");
2921		exec_inprogress_pid = [pid_num intValue];
2922		T_QUIET; T_ASSERT_GT(exec_inprogress_pid, 0, "exec inprogress pid greater than zero");
2923
2924		exec_inprogress_cb = extra[exec_inprogress_found_key];
2925		T_QUIET; T_ASSERT_NOTNULL(exec_inprogress_cb, "exec inprogress found callback provided");
2926	}
2927	if (expect_driverkit) {
2928		driverkit_cb = extra[driverkit_found_key];
2929		T_QUIET; T_ASSERT_NOTNULL(driverkit_cb, "driverkit found callback provided");
2930	}
2931
2932	if (expect_asyncstack) {
2933		NSNumber* threadid_id = extra[asyncstack_expected_threadid_key];
2934		T_QUIET; T_ASSERT_NOTNULL(threadid_id, "asyncstack threadid provided");
2935		asyncstack_threadid = [threadid_id unsignedLongLongValue];
2936		asyncstack_stack = extra[asyncstack_expected_stack_key];
2937		T_QUIET; T_ASSERT_NOTNULL(asyncstack_stack, "asyncstack expected stack provided");
2938	}
2939
2940	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2941	if (delta) {
2942		T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT,
2943				"buffer provided is a delta stackshot");
2944
2945			iter = kcdata_iter_next(iter);
2946	} else {
2947		if (kcdata_iter_type(iter) != KCDATA_BUFFER_BEGIN_COMPRESSED) {
2948			T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
2949					"buffer provided is a stackshot");
2950
2951			iter = kcdata_iter_next(iter);
2952		} else {
2953			/* we are dealing with a compressed buffer */
2954			iter = kcdata_iter_next(iter);
2955			uint64_t compression_type = 0, totalout = 0, totalin = 0;
2956
2957			uint64_t *data;
2958			char *desc;
2959			for (int i = 0; i < 3; i ++) {
2960				kcdata_iter_get_data_with_desc(iter, &desc, (void **)&data, NULL);
2961				if (strcmp(desc, "kcd_c_type") == 0) {
2962					compression_type = *data;
2963				} else if (strcmp(desc, "kcd_c_totalout") == 0){
2964					totalout = *data;
2965				} else if (strcmp(desc, "kcd_c_totalin") == 0){
2966					totalin = *data;
2967				}
2968
2969				iter = kcdata_iter_next(iter);
2970			}
2971
2972			T_ASSERT_EQ(compression_type, UINT64_C(1), "zlib compression is used");
2973			T_ASSERT_GT(totalout, UINT64_C(0), "successfully gathered how long the compressed buffer is");
2974			T_ASSERT_GT(totalin, UINT64_C(0), "successfully gathered how long the uncompressed buffer will be at least");
2975
2976			/* progress to the next kcdata item */
2977			T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "compressed stackshot found");
2978
2979			char *bufferBase = kcdata_iter_payload(iter);
2980
2981			/*
2982			 * zlib is used, allocate a buffer based on the metadata, plus
2983			 * extra scratch space (+12.5%) in case totalin was inconsistent
2984			 */
2985			size_t inflatedBufferSize = totalin + (totalin >> 3);
2986			inflatedBufferBase = malloc(inflatedBufferSize);
2987			T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(inflatedBufferBase, "allocated temporary output buffer");
2988
2989			z_stream zs;
2990			memset(&zs, 0, sizeof(zs));
2991			T_QUIET; T_ASSERT_EQ(inflateInit(&zs), Z_OK, "inflateInit OK");
2992			zs.next_in = (unsigned char *)bufferBase;
2993			T_QUIET; T_ASSERT_LE(totalout, (uint64_t)UINT_MAX, "stackshot is not too large");
2994			zs.avail_in = (uInt)totalout;
2995			zs.next_out = (unsigned char *)inflatedBufferBase;
2996			T_QUIET; T_ASSERT_LE(inflatedBufferSize, (size_t)UINT_MAX, "output region is not too large");
2997			zs.avail_out = (uInt)inflatedBufferSize;
2998			T_ASSERT_EQ(inflate(&zs, Z_FINISH), Z_STREAM_END, "inflated buffer");
2999			inflateEnd(&zs);
3000
3001			T_ASSERT_EQ((uint64_t)zs.total_out, totalin, "expected number of bytes inflated");
3002
3003			/* copy the data after the compressed area */
3004			T_QUIET; T_ASSERT_GE((void *)bufferBase, ssbuf,
3005					"base of compressed stackshot is after the returned stackshot buffer");
3006			size_t header_size = (size_t)(bufferBase - (char *)ssbuf);
3007			size_t data_after_compressed_size = sslen - totalout - header_size;
3008			T_QUIET; T_ASSERT_LE(data_after_compressed_size,
3009					inflatedBufferSize - zs.total_out,
3010					"footer fits in the buffer");
3011			memcpy(inflatedBufferBase + zs.total_out,
3012					bufferBase + totalout,
3013					data_after_compressed_size);
3014
3015			iter = kcdata_iter(inflatedBufferBase, inflatedBufferSize);
3016		}
3017	}
3018
3019	KCDATA_ITER_FOREACH(iter) {
3020		NSError *error = nil;
3021
3022		switch (kcdata_iter_type(iter)) {
3023		case KCDATA_TYPE_ARRAY: {
3024			T_QUIET;
3025			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
3026					"checked that array is valid");
3027
3028			NSMutableDictionary *array = parseKCDataArray(iter, &error);
3029			T_QUIET; T_ASSERT_NOTNULL(array, "parsed array from stackshot");
3030			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing array");
3031
3032			if (kcdata_iter_array_elem_type(iter) == STACKSHOT_KCTYPE_SYS_SHAREDCACHE_LAYOUT) {
3033				struct dyld_uuid_info_64 *shared_cache_uuids = kcdata_iter_payload(iter);
3034				uint32_t uuid_count = kcdata_iter_array_elem_count(iter);
3035				T_ASSERT_NOTNULL(shared_cache_uuids, "parsed shared cache layout array");
3036				T_ASSERT_GT(uuid_count, 0, "returned valid number of UUIDs from shared cache");
3037				verify_stackshot_sharedcache_layout(shared_cache_uuids, uuid_count);
3038				found_shared_cache_layout = true;
3039			}
3040
3041			break;
3042		}
3043		case KCDATA_TYPE_CONTAINER_BEGIN: {
3044			T_QUIET;
3045			T_ASSERT_TRUE(kcdata_iter_container_valid(iter),
3046					"checked that container is valid");
3047
3048			uint64_t containerid = kcdata_iter_container_id(iter);
3049			uint32_t container_type = kcdata_iter_container_type(iter);
3050
3051			if (container_type == STACKSHOT_KCCONTAINER_SHAREDCACHE) {
3052				NSDictionary *container = parseKCDataContainer(&iter, &error);
3053				T_QUIET; T_ASSERT_NOTNULL(container, "parsed sharedcache container from stackshot");
3054				T_QUIET; T_ASSERT_NULL(error, "error unset after parsing sharedcache container");
3055				T_QUIET; T_EXPECT_EQ(sharedCaches[@(containerid)], nil, "sharedcache containerid %lld should be unique", containerid);
3056				sharedCaches[@(containerid)] = container;
3057				break;
3058			}
3059
3060			if (container_type == STACKSHOT_KCCONTAINER_EXCLAVES) {
3061				found_exclaves = true;
3062				break;
3063			}
3064
3065			/*
3066			 * treat containers other than tasks/transitioning_tasks
3067			 * as expanded in-line.
3068			 */
3069			if (container_type != STACKSHOT_KCCONTAINER_TASK &&
3070			    container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK) {
3071				T_LOG("container skipped: %d", container_type);
3072				break;
3073			}
3074			NSDictionary *container = parseKCDataContainer(&iter, &error);
3075			T_QUIET; T_ASSERT_NOTNULL(container, "parsed task/transitioning_task container from stackshot");
3076			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container");
3077
3078			found_tasks++;
3079
3080			NSDictionary* task_snapshot = container[@"task_snapshots"][@"task_snapshot"];
3081			NSDictionary* task_delta_snapshot = container[@"task_snapshots"][@"task_delta_snapshot"];
3082			NSDictionary* transitioning_task_snapshot = container[@"transitioning_task_snapshots"][@"transitioning_task_snapshot"];
3083
3084			NSNumber *task_pid = NULL;
3085			if (task_snapshot) {
3086				task_pid = task_snapshot[@"ts_unique_pid"];
3087			} else if(task_delta_snapshot) {
3088				task_pid = task_snapshot[@"tds_unique_pid"];
3089			} else if(transitioning_task_snapshot) {
3090				task_pid = transitioning_task_snapshot[@"tts_pid"];
3091			}
3092
3093			if (task_pid && [seen_tasks containsObject:task_pid]) {
3094				T_QUIET; T_ASSERT_FALSE([seen_tasks containsObject:task_pid], "No duplicate PIDs in stackshot");
3095				[seen_tasks addObject:task_pid];
3096			}
3097
3098			/*
3099			 * Having processed the container, we now only check it
3100			 * if it's the correct type.
3101			 */
3102			if ((!expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TASK)) ||
3103			    (expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK))) {
3104				break;
3105			}
3106			if (!expect_transitioning_task) {
3107			    	T_QUIET; T_ASSERT_TRUE(!!task_snapshot != !!task_delta_snapshot, "Either task_snapshot xor task_delta_snapshot provided");
3108			}
3109
3110			if (expect_dispatch_queue_label && !found_dispatch_queue_label) {
3111				for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) {
3112					NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key];
3113					NSString *dql = thread[@"dispatch_queue_label"];
3114
3115					if ([dql isEqualToString:@TEST_STACKSHOT_QUEUE_LABEL]) {
3116						found_dispatch_queue_label = true;
3117						break;
3118					}
3119				}
3120			}
3121
3122			if (expect_transitioning_task && !found_transitioning_task) {
3123				if (transitioning_task_snapshot) {
3124					uint64_t the_pid = [transitioning_task_snapshot[@"tts_pid"] unsignedLongLongValue];
3125					if (the_pid == (uint64_t)transistioning_task_pid) {
3126					    found_transitioning_task = true;
3127
3128					    T_PASS("FOUND Transitioning task %llu has a transitioning task snapshot", (uint64_t) transistioning_task_pid);
3129					    break;
3130					}
3131				}
3132			}
3133
3134			if (expect_postexec_child && !found_postexec_child) {
3135				if (task_snapshot) {
3136					uint64_t unique_pid = [task_snapshot[@"ts_unique_pid"] unsignedLongLongValue];
3137					if (unique_pid == postexec_child_unique_pid) {
3138						found_postexec_child = true;
3139
3140						T_PASS("post-exec child %llu has a task snapshot", postexec_child_unique_pid);
3141
3142						break;
3143					}
3144				}
3145
3146				if (task_delta_snapshot) {
3147					uint64_t unique_pid = [task_delta_snapshot[@"tds_unique_pid"] unsignedLongLongValue];
3148					if (unique_pid == postexec_child_unique_pid) {
3149						found_postexec_child = true;
3150
3151						T_FAIL("post-exec child %llu shouldn't have a delta task snapshot", postexec_child_unique_pid);
3152
3153						break;
3154					}
3155				}
3156			}
3157
3158			int pid = [task_snapshot[@"ts_pid"] intValue];
3159
3160			if (pid && expect_shared_cache_uuid && !found_shared_cache_uuid) {
3161				id ptr = container[@"task_snapshots"][@"shared_cache_dyld_load_info"];
3162				if (ptr) {
3163					id uuid = ptr[@"imageUUID"];
3164
3165					uint8_t uuid_p[16];
3166					for (unsigned int i = 0; i < 16; i ++) {
3167						NSNumber *uuidByte = uuid[i];
3168						uuid_p[i] = (uint8_t)uuidByte.charValue;
3169					}
3170
3171					check_shared_cache_uuid(uuid_p);
3172
3173					uint64_t baseAddress = (uint64_t)((NSNumber *)ptr[@"imageSlidBaseAddress"]).longLongValue;
3174					uint64_t firstMapping = (uint64_t)((NSNumber *)ptr[@"sharedCacheSlidFirstMapping"]).longLongValue;
3175
3176					T_EXPECT_LE(baseAddress, firstMapping,
3177						"in per-task shared_cache_dyld_load_info, "
3178						"baseAddress <= firstMapping");
3179					T_EXPECT_GE(baseAddress + (7ull << 32) + (1ull << 29),
3180						firstMapping,
3181						"in per-task shared_cache_dyld_load_info, "
3182						"baseAddress + 28.5gig >= firstMapping");
3183
3184					size_t shared_cache_len;
3185					const void *addr = _dyld_get_shared_cache_range(&shared_cache_len);
3186					T_EXPECT_EQ((uint64_t)addr, firstMapping,
3187							"SlidFirstMapping should match shared_cache_range");
3188
3189					/*
3190					 * check_shared_cache_uuid() will assert on failure, so if
3191					 * we get here, then we have found the shared cache UUID
3192					 * and it's correct
3193					 */
3194					found_shared_cache_uuid = true;
3195				}
3196			}
3197
3198			if (expect_sharedcache_child) {
3199				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3200				uint64_t sharedregion_flags = (task_flags & (kTaskSharedRegionNone | kTaskSharedRegionSystem | kTaskSharedRegionOther));
3201				id sharedregion_info = container[@"task_snapshots"][@"shared_cache_dyld_load_info"];
3202				id sharedcache_id = container[@"task_snapshots"][@"sharedCacheID"];
3203				if (!found_sharedcache_badflags) {
3204					T_QUIET; T_EXPECT_NE(sharedregion_flags, 0ll, "one of the kTaskSharedRegion flags should be set on all tasks");
3205					bool multiple = (sharedregion_flags & (sharedregion_flags - 1)) != 0;
3206					T_QUIET; T_EXPECT_FALSE(multiple, "only one kTaskSharedRegion flag should be set on each task");
3207					found_sharedcache_badflags = (sharedregion_flags == 0 || multiple);
3208				}
3209				if (pid == 0) {
3210					T_ASSERT_EQ(sharedregion_flags, (uint64_t)kTaskSharedRegionNone, "Kernel proc (pid 0) should have no shared region");
3211				} else if (pid == sharedcache_child_pid) {
3212					found_sharedcache_child = true;
3213					sharedcache_child_flags = sharedregion_flags;
3214				} else if (pid == getpid()) {
3215					found_sharedcache_self = true;
3216					sharedcache_self_flags = sharedregion_flags;
3217				}
3218				if (sharedregion_flags == kTaskSharedRegionOther && !(task_flags & kTaskSharedRegionInfoUnavailable)) {
3219					T_QUIET; T_EXPECT_NOTNULL(sharedregion_info, "kTaskSharedRegionOther should have a shared_cache_dyld_load_info struct");
3220					T_QUIET; T_EXPECT_NOTNULL(sharedcache_id, "kTaskSharedRegionOther should have a sharedCacheID");
3221					if (sharedcache_id != nil) {
3222						T_QUIET; T_EXPECT_NOTNULL(sharedCaches[sharedcache_id], "sharedCacheID %d should exist", [sharedcache_id intValue]);
3223					}
3224				} else {
3225					T_QUIET; T_EXPECT_NULL(sharedregion_info, "non-kTaskSharedRegionOther should have no shared_cache_dyld_load_info struct");
3226					T_QUIET; T_EXPECT_NULL(sharedcache_id, "non-kTaskSharedRegionOther should have no sharedCacheID");
3227				}
3228			}
3229
3230			if (expect_zombie_child && (pid == zombie_child_pid)) {
3231				found_zombie_child = true;
3232
3233				expected_num_tasks += 1;
3234
3235				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3236				T_ASSERT_TRUE((task_flags & kTerminatedSnapshot) == kTerminatedSnapshot, "child zombie marked as terminated");
3237
3238				continue;
3239			}
3240
3241			if (expect_translated_child && (pid == translated_child_pid)) {
3242				found_translated_child = true;
3243
3244				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3245				T_EXPECT_BITS_SET(task_flags, kTaskIsTranslated, "child marked as translated");
3246
3247				continue;
3248			}
3249			if (expect_exec_inprogress && (pid == exec_inprogress_pid || pid == -exec_inprogress_pid)) {
3250				exec_inprogress_found++;
3251				T_LOG("found exec task with pid %d, instance %d", pid, exec_inprogress_found);
3252				T_QUIET; T_ASSERT_LE(exec_inprogress_found, 2, "no more than two with the expected pid");
3253				if (exec_inprogress_found == 2) {
3254					T_LOG("found 2 tasks with pid %d", exec_inprogress_pid);
3255					exec_inprogress_cb(containerid, exec_inprogress_containerid);
3256				} else {
3257					exec_inprogress_containerid = containerid;
3258				}
3259			}
3260			if (expect_driverkit && driverkit_cb != NULL) {
3261				driverkit_cb(pid);
3262			}
3263			if (expect_cseg_waitinfo) {
3264				NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"];
3265
3266				for (id i in winfos) {
3267					NSNumber *waitType = i[@"wait_type"];
3268					NSNumber *owner = i[@"owner"];
3269					if (waitType.intValue == kThreadWaitCompressor &&
3270							owner.unsignedLongValue == cseg_expected_threadid) {
3271						found_cseg_waitinfo = true;
3272						break;
3273					}
3274				}
3275			}
3276
3277			if (expect_srp_waitinfo) {
3278				NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3279				NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"];
3280				for (id i in tinfos) {
3281					if (!found_srp_waitinfo) {
3282						bool found_thread = false;
3283						bool found_pid = false;
3284						if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_THREAD) &&
3285						    [i[@"turnstile_context"] unsignedLongLongValue] == srp_expected_threadid &&
3286						    srp_expected_threadid != 0) {
3287							found_thread = true;
3288						}
3289						if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_BLOCKED_ON_TASK) &&
3290						    [i[@"turnstile_context"] intValue] == srp_expected_pid &&
3291						    srp_expected_pid != -1) {
3292							found_pid = true;
3293						}
3294						if (found_pid || found_thread) {
3295							T_LOG("found SRP %s %lld waiter: %d", (found_thread ? "thread" : "pid"),
3296							    [i[@"turnstile_context"] unsignedLongLongValue], [i[@"waiter"] intValue]);
3297							/* we found something that is blocking the correct threadid */
3298							for (id j in winfos) {
3299								if ([j[@"waiter"] intValue] == [i[@"waiter"] intValue] &&
3300								    [j[@"wait_type"] intValue] == kThreadWaitPortReceive) {
3301									found_srp_waitinfo = true;
3302									T_EXPECT_EQ([j[@"wait_flags"] intValue], STACKSHOT_WAITINFO_FLAGS_SPECIALREPLY,
3303									    "SRP waitinfo should be marked as a special reply");
3304									break;
3305								}
3306							}
3307
3308							if (found_srp_waitinfo) {
3309								break;
3310							}
3311						}
3312					}
3313				}
3314			}
3315
3316			if (expect_sp_throttled) {
3317				NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3318				for (id i in tinfos) {
3319					if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_PORTFLAGS)
3320						&& [i[@"turnstile_context"] intValue] == throttled_service_ctx) {
3321						int portlabel_id = [i[@"portlabel_id"] intValue];
3322						T_LOG("[pid:%d] Turnstile (flags = 0x%x, ctx = %d, portlabel_id = %d)", pid,
3323							[i[@"turnstile_flags"] intValue], [i[@"turnstile_context"] intValue], portlabel_id);
3324						for (id portid in container[@"task_snapshots"][@"portlabels"]) {
3325							if (portlabel_id != [portid intValue]) {
3326								continue;
3327							}
3328
3329							NSMutableDictionary *portlabel = container[@"task_snapshots"][@"portlabels"][portid];
3330							T_ASSERT_TRUE(portlabel != nil, "Found portlabel id: %d", [portid intValue]);
3331							NSString *portlabel_name = portlabel[@"portlabel_name"];
3332							T_EXPECT_TRUE(portlabel_name != nil, "Found portlabel %s", portlabel_name.UTF8String);
3333							T_EXPECT_EQ_STR(portlabel_name.UTF8String, THROTTLED_SERVICE_NAME, "throttled service port name matches");
3334							T_EXPECT_EQ(([portlabel[@"portlabel_flags"] intValue] & STACKSHOT_PORTLABEL_THROTTLED) != 0,
3335								is_throttled, "Port %s throttled", is_throttled ? "is" : "isn't");
3336							found_throttled_service = true;
3337							break;
3338						}
3339					}
3340
3341					if (found_throttled_service) {
3342						break;
3343					}
3344				}
3345			}
3346
3347			if (expect_suspendinfo) {
3348				// TODO: rdar://112563110
3349			}
3350
3351
3352			if (pid != getpid()) {
3353				break;
3354			}
3355
3356			T_EXPECT_EQ_STR(current_process_name(),
3357					[task_snapshot[@"ts_p_comm"] UTF8String],
3358					"current process name matches in stackshot");
3359
3360			uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3361			T_ASSERT_BITS_NOTSET(task_flags, kTerminatedSnapshot, "current process not marked as terminated");
3362			T_ASSERT_BITS_NOTSET(task_flags, kTaskIsTranslated, "current process not marked as translated");
3363
3364			T_QUIET;
3365			T_EXPECT_LE(pid, [task_snapshot[@"ts_unique_pid"] intValue],
3366					"unique pid is greater than pid");
3367
3368			NSDictionary* task_cpu_architecture = container[@"task_snapshots"][@"task_cpu_architecture"];
3369			T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cputype"], "have cputype");
3370			T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cpusubtype"], "have cputype");
3371			int cputype = [task_cpu_architecture[@"cputype"] intValue];
3372			int cpusubtype = [task_cpu_architecture[@"cpusubtype"] intValue];
3373
3374			struct proc_archinfo archinfo;
3375			int retval = proc_pidinfo(pid, PROC_PIDARCHINFO, 0, &archinfo, sizeof(archinfo));
3376			T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDARCHINFO) returned a value > 0");
3377			T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(struct proc_archinfo), "proc_pidinfo call for PROC_PIDARCHINFO returned expected size");
3378			T_QUIET; T_EXPECT_EQ(cputype, archinfo.p_cputype, "cpu type is correct");
3379			T_QUIET; T_EXPECT_EQ(cpusubtype, archinfo.p_cpusubtype, "cpu subtype is correct");
3380
3381			NSDictionary * codesigning_info = container[@"task_snapshots"][@"stackshot_task_codesigning_info"];
3382			T_QUIET; T_ASSERT_NOTNULL(codesigning_info[@"csflags"], "have csflags");
3383			uint64_t flags = [codesigning_info[@"csflags"] unsignedLongLongValue];
3384			T_QUIET; T_EXPECT_GT(flags, 0, "nonzero csflags");
3385
3386			T_QUIET; T_ASSERT_NOTNULL(container[@"task_snapshots"][@"jetsam_coalition"], "have jetsam coalition");
3387			uint64_t jetsam_coalition = [container[@"task_snapshots"][@"jetsam_coalition"] unsignedLongLongValue];
3388			T_QUIET; T_EXPECT_GT(jetsam_coalition, 0, "nonzero jetsam coalition");
3389
3390			bool found_main_thread = false;
3391			uint64_t main_thread_id = -1ULL;
3392			bool found_null_kernel_frame = false;
3393			for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) {
3394				NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key];
3395				NSDictionary *thread_snap = thread[@"thread_snapshot"];
3396
3397				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_thread_id"] intValue], 0,
3398						"thread ID of thread in current task is valid");
3399				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_base_priority"] intValue], 0,
3400						"base priority of thread in current task is valid");
3401				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_sched_priority"] intValue], 0,
3402						"scheduling priority of thread in current task is valid");
3403
3404				NSString *pth_name = thread[@"pth_name"];
3405				if (pth_name != nil && [pth_name isEqualToString:@TEST_THREAD_NAME]) {
3406					found_main_thread = true;
3407					main_thread_id = [thread_snap[@"ths_thread_id"] unsignedLongLongValue];
3408
3409					T_QUIET; T_EXPECT_GT([thread_snap[@"ths_total_syscalls"] intValue], 0,
3410							"total syscalls of current thread is valid");
3411
3412					NSDictionary *cpu_times = thread[@"cpu_times"];
3413					T_EXPECT_GE([cpu_times[@"runnable_time"] intValue],
3414							[cpu_times[@"system_time"] intValue] +
3415							[cpu_times[@"user_time"] intValue],
3416							"runnable time of current thread is valid");
3417				}
3418				if (!found_null_kernel_frame) {
3419					for (NSNumber *frame in thread[@"kernel_frames"]) {
3420						if (frame.unsignedLongValue == 0) {
3421							found_null_kernel_frame = true;
3422							break;
3423						}
3424					}
3425				}
3426				if (expect_asyncstack && !found_asyncstack &&
3427				    asyncstack_threadid == [thread_snap[@"ths_thread_id"] unsignedLongLongValue]) {
3428					found_asyncstack = true;
3429					NSArray* async_stack = thread[@"user_async_stack_frames"];
3430					NSNumber* start_idx = thread[@"user_async_start_index"];
3431					NSArray* user_stack = thread[@"user_stack_frames"];
3432					T_QUIET; T_ASSERT_NOTNULL(async_stack, "async thread %#llx has user_async_stack_frames", asyncstack_threadid);
3433					T_QUIET; T_ASSERT_NOTNULL(start_idx, "async thread %#llx has user_async_start_index", asyncstack_threadid);
3434					T_QUIET; T_ASSERT_NOTNULL(user_stack, "async thread %#llx has user_stack_frames", asyncstack_threadid);
3435					T_QUIET; T_ASSERT_EQ(async_stack.count, asyncstack_stack.count,
3436						"actual async_stack count == expected async_stack count");
3437					for (size_t i = 0; i < async_stack.count; i++) {
3438						T_EXPECT_EQ([async_stack[i][@"lr"] unsignedLongLongValue],
3439							[asyncstack_stack[i] unsignedLongLongValue], "frame %zu matches", i);
3440					}
3441				}
3442			}
3443			T_EXPECT_TRUE(found_main_thread, "found main thread for current task in stackshot");
3444			T_EXPECT_FALSE(found_null_kernel_frame, "should not see any NULL kernel frames");
3445
3446			if (expect_turnstile_lock && !found_turnstile_lock) {
3447				NSArray *tsinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3448
3449				for (id i in tsinfos) {
3450					if ([i[@"turnstile_context"] unsignedLongLongValue] == main_thread_id) {
3451						found_turnstile_lock = true;
3452						break;
3453					}
3454				}
3455			}
3456			break;
3457		}
3458		case STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO: {
3459			// Legacy shared cache info
3460			struct dyld_shared_cache_loadinfo *payload = kcdata_iter_payload(iter);
3461			T_ASSERT_EQ((size_t)kcdata_iter_size(iter), sizeof(*payload), "valid dyld_shared_cache_loadinfo struct");
3462
3463			check_shared_cache_uuid(payload->sharedCacheUUID);
3464
3465			T_EXPECT_LE(payload->sharedCacheUnreliableSlidBaseAddress,
3466				payload->sharedCacheSlidFirstMapping,
3467				"SlidBaseAddress <= SlidFirstMapping");
3468			T_EXPECT_GE(payload->sharedCacheUnreliableSlidBaseAddress + (7ull << 32) + (1ull << 29),
3469				payload->sharedCacheSlidFirstMapping,
3470				"SlidFirstMapping should be within 28.5gigs of SlidBaseAddress");
3471
3472			size_t shared_cache_len;
3473			const void *addr = _dyld_get_shared_cache_range(&shared_cache_len);
3474			T_EXPECT_EQ((uint64_t)addr, payload->sharedCacheSlidFirstMapping,
3475			    "SlidFirstMapping should match shared_cache_range");
3476
3477			/*
3478			 * check_shared_cache_uuid() asserts on failure, so we must have
3479			 * found the shared cache UUID to be correct.
3480			 */
3481			found_shared_cache_uuid = true;
3482			break;
3483		}
3484		case KCDATA_TYPE_UINT64_DESC: {
3485			char     *desc;
3486			uint64_t *data;
3487			uint32_t  size;
3488			kcdata_iter_get_data_with_desc(iter, &desc, &data, &size);
3489
3490			if (strcmp(desc, "stackshot_tasks_count") == 0) {
3491				expected_num_tasks = *data;
3492			} else if (strcmp(desc, "stackshot_threads_count") == 0) {
3493				expected_num_threads = *data;
3494			}
3495
3496			break;
3497		}
3498		case STACKSHOT_KCTYPE_LATENCY_INFO_CPU: {
3499			struct stackshot_latency_cpu *cpu_latency = kcdata_iter_payload(iter);
3500			found_percpu_tasks += cpu_latency->tasks_processed;
3501			found_percpu_threads += cpu_latency->threads_processed;
3502			break;
3503		}
3504		}
3505	}
3506
3507	if (expect_sharedcache_child) {
3508		T_QUIET; T_ASSERT_TRUE(found_sharedcache_child, "found sharedcache child in kcdata");
3509		T_QUIET; T_ASSERT_TRUE(found_sharedcache_self, "found self in kcdata");
3510		if (found_sharedcache_child && found_sharedcache_self) {
3511			T_QUIET; T_ASSERT_NE(sharedcache_child_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache child should have shared region");
3512			T_QUIET; T_ASSERT_NE(sharedcache_self_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache: self should have shared region");
3513			if (sharedcache_self_flags == kTaskSharedRegionSystem && !sharedcache_child_sameaddr) {
3514				/* If we're in the system shared region, and the child has a different address, child must have an Other shared region */
3515				T_ASSERT_EQ(sharedcache_child_flags, (uint64_t)kTaskSharedRegionOther,
3516				    "sharedcache child should have Other shared region");
3517			}
3518		}
3519	}
3520
3521	if (expect_transitioning_task) {
3522		T_QUIET; T_ASSERT_TRUE(found_transitioning_task, "found transitioning_task child in kcdata");
3523	}
3524
3525	if (expect_exec_inprogress) {
3526		T_QUIET; T_ASSERT_GT(exec_inprogress_found, 0, "found at least 1 task for execing process");
3527	}
3528
3529	if (expect_zombie_child) {
3530		T_QUIET; T_ASSERT_TRUE(found_zombie_child, "found zombie child in kcdata");
3531	}
3532
3533	if (expect_postexec_child) {
3534		T_QUIET; T_ASSERT_TRUE(found_postexec_child, "found post-exec child in kcdata");
3535	}
3536
3537	if (expect_translated_child) {
3538		T_QUIET; T_ASSERT_TRUE(found_translated_child, "found translated child in kcdata");
3539	}
3540
3541	if (expect_shared_cache_layout) {
3542		T_QUIET; T_ASSERT_TRUE(found_shared_cache_layout, "shared cache layout found in kcdata");
3543	}
3544
3545	if (expect_shared_cache_uuid) {
3546		T_QUIET; T_ASSERT_TRUE(found_shared_cache_uuid, "shared cache UUID found in kcdata");
3547	}
3548
3549	if (expect_dispatch_queue_label) {
3550		T_QUIET; T_ASSERT_TRUE(found_dispatch_queue_label, "dispatch queue label found in kcdata");
3551	}
3552
3553	if (expect_turnstile_lock) {
3554		T_QUIET; T_ASSERT_TRUE(found_turnstile_lock, "found expected deadlock");
3555	}
3556
3557	if (expect_cseg_waitinfo) {
3558		T_QUIET; T_ASSERT_TRUE(found_cseg_waitinfo, "found c_seg waitinfo");
3559	}
3560
3561	if (expect_srp_waitinfo) {
3562		T_QUIET; T_ASSERT_TRUE(found_srp_waitinfo, "found special reply port waitinfo");
3563	}
3564
3565	if (expect_sp_throttled) {
3566		T_QUIET; T_ASSERT_TRUE(found_throttled_service, "found the throttled service");
3567	}
3568
3569	if (expect_asyncstack) {
3570		T_QUIET; T_ASSERT_TRUE(found_asyncstack, "found async stack threadid");
3571	}
3572
3573	if ([extra objectForKey:no_exclaves_key] != nil) {
3574		T_QUIET; T_ASSERT_FALSE(found_exclaves, "did not find any Exclaves data");
3575	}
3576
3577
3578	bool check_counts = !delta && !found_transitioning_task && !expect_single_task && !expect_driverkit;
3579
3580	if (check_counts && (expected_num_threads != 0) && (found_percpu_threads != 0)) {
3581		/* If the task counts below check out, we can be sure that the per-cpu reported thread counts are accurate. */
3582		T_QUIET; T_ASSERT_EQ_ULLONG(found_percpu_threads, expected_num_threads, "number of threads reported by CPUs matches expected count");
3583	}
3584
3585	if (check_counts && (expected_num_tasks != 0)) {
3586		T_QUIET; T_ASSERT_EQ_ULLONG(found_tasks, expected_num_tasks, "number of tasks in kcdata matches expected count");
3587		if (found_percpu_tasks != 0) {
3588			T_QUIET; T_ASSERT_EQ_ULLONG(found_percpu_tasks, expected_num_tasks, "number of tasks reported by CPUs matches expected count");
3589		}
3590	}
3591
3592	T_ASSERT_FALSE(KCDATA_ITER_FOREACH_FAILED(iter), "successfully iterated kcdata");
3593
3594	free(inflatedBufferBase);
3595}
3596
3597static const char *
3598current_process_name(void)
3599{
3600	static char name[64];
3601
3602	if (!name[0]) {
3603		int ret = proc_name(getpid(), name, sizeof(name));
3604		T_QUIET;
3605		T_ASSERT_POSIX_SUCCESS(ret, "proc_name failed for current process");
3606	}
3607
3608	return name;
3609}
3610
3611static void
3612initialize_thread(void)
3613{
3614	int ret = pthread_setname_np(TEST_THREAD_NAME);
3615	T_QUIET;
3616	T_ASSERT_POSIX_ZERO(ret, "set thread name to %s", TEST_THREAD_NAME);
3617}
3618
3619T_DECL(dirty_buffer, "test that stackshot works with a dirty input buffer from kernel", T_META_TAG_VM_PREFERRED)
3620{
3621	const char *test_sysctl = "stackshot_dirty_buffer";
3622	int64_t result;
3623
3624	T_LOG("running sysctl to trigger kernel-driven stackshot");
3625	result = run_sysctl_test(test_sysctl, 0);
3626	T_ASSERT_EQ_LLONG(result, 1, "sysctl result indicated success");
3627}
3628
3629T_DECL(kernel_initiated, "smoke test that stackshot works with kernel-initiated stackshots", T_META_TAG_VM_PREFERRED)
3630{
3631	const char *test_sysctl = "stackshot_kernel_initiator";
3632	int64_t result;
3633	__block bool did_get_stackshot = false;
3634
3635	initialize_thread(); // must run before the stackshots to keep parse_stackshot happy
3636
3637	T_LOG("running sysctl to trigger kernel-driven stackshot type 1");
3638	result = run_sysctl_test(test_sysctl, 1);
3639	T_ASSERT_EQ_LLONG(result, 1, "sysctl result indicated success");
3640
3641	T_LOG("running sysctl to trigger kernel-driven stackshot type 2");
3642	result = run_sysctl_test(test_sysctl, 2);
3643	T_ASSERT_EQ_LLONG(result, 1, "sysctl result indicated success");
3644
3645	struct scenario scenario = {
3646		.name = "from_kernel_initiated",
3647		.flags = STACKSHOT_RETRIEVE_EXISTING_BUFFER,
3648	};
3649
3650	T_LOG("attempting to fetch stored in-kernel stackshot");
3651	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
3652		T_ASSERT_NOTNULL(ssbuf, "non-null kernel stackshot");
3653		T_ASSERT_GT(sslen, 0, "non-zero stackshot size");
3654		parse_stackshot(0, ssbuf, sslen, nil);
3655		did_get_stackshot = true;
3656	});
3657
3658	T_ASSERT_TRUE(did_get_stackshot, "got stackshot from kernel type 2");
3659}
3660