1#include <darwintest.h> 2#include <darwintest_utils.h> 3#include <darwintest_multiprocess.h> 4#include <kern/debug.h> 5#include <kern/kern_cdata.h> 6#include <kern/block_hint.h> 7#include <kdd.h> 8#include <libproc.h> 9#include <os/atomic_private.h> 10#include <mach-o/dyld.h> 11#include <mach-o/dyld_images.h> 12#include <mach-o/dyld_priv.h> 13#include <sys/syscall.h> 14#include <sys/stackshot.h> 15#include <uuid/uuid.h> 16#include <servers/bootstrap.h> 17#include <pthread/workqueue_private.h> 18#include <dispatch/private.h> 19#include <stdalign.h> 20#include <TargetConditionals.h> 21 22#import <zlib.h> 23#import <IOKit/IOKitLib.h> 24#import <IOKit/IOKitLibPrivate.h> 25#import <IOKit/IOKitKeysPrivate.h> 26#import "test_utils.h" 27 28 29 30T_GLOBAL_META( 31 T_META_NAMESPACE("xnu.stackshot"), 32 T_META_RADAR_COMPONENT_NAME("xnu"), 33 T_META_RADAR_COMPONENT_VERSION("stackshot"), 34 T_META_OWNER("jonathan_w_adams"), 35 T_META_CHECK_LEAKS(false), 36 T_META_ASROOT(true), 37 XNU_T_META_SOC_SPECIFIC 38 ); 39 40static const char *current_process_name(void); 41static void verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count); 42static void parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra); 43static void parse_thread_group_stackshot(void **sbuf, size_t sslen); 44static uint64_t stackshot_timestamp(void *ssbuf, size_t sslen); 45static void initialize_thread(void); 46 47static uint64_t global_flags = 0; 48 49#define DEFAULT_STACKSHOT_BUFFER_SIZE (1024 * 1024) 50#define MAX_STACKSHOT_BUFFER_SIZE (6 * 1024 * 1024) 51 52#define SRP_SERVICE_NAME "com.apple.xnu.test.stackshot.special_reply_port" 53 54/* bit flags for parse_stackshot */ 55#define PARSE_STACKSHOT_DELTA 0x01 56#define PARSE_STACKSHOT_ZOMBIE 0x02 57#define PARSE_STACKSHOT_SHAREDCACHE_LAYOUT 0x04 58#define PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL 0x08 59#define PARSE_STACKSHOT_TURNSTILEINFO 0x10 60#define PARSE_STACKSHOT_POSTEXEC 0x20 61#define PARSE_STACKSHOT_WAITINFO_CSEG 0x40 62#define PARSE_STACKSHOT_WAITINFO_SRP 0x80 63#define PARSE_STACKSHOT_TRANSLATED 0x100 64#define PARSE_STACKSHOT_SHAREDCACHE_FLAGS 0x200 65#define PARSE_STACKSHOT_EXEC_INPROGRESS 0x400 66#define PARSE_STACKSHOT_TRANSITIONING 0x800 67#define PARSE_STACKSHOT_ASYNCSTACK 0x1000 68#define PARSE_STACKSHOT_COMPACTINFO 0x2000 /* TODO: rdar://88789261 */ 69#define PARSE_STACKSHOT_DRIVERKIT 0x4000 70#define PARSE_STACKSHOT_THROTTLED_SP 0x8000 71#define PARSE_STACKSHOT_SUSPENDINFO 0x10000 72#define PARSE_STACKSHOT_TARGETPID 0x20000 73 74/* keys for 'extra' dictionary for parse_stackshot */ 75static const NSString* zombie_child_pid_key = @"zombie_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_ZOMBIE 76static const NSString* postexec_child_unique_pid_key = @"postexec_child_unique_pid"; // -> @(unique_pid), required for PARSE_STACKSHOT_POSTEXEC 77static const NSString* cseg_expected_threadid_key = @"cseg_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_WAITINFO_CSEG 78static const NSString* srp_expected_threadid_key = @"srp_expected_threadid"; // -> @(tid), this or ..._pid required for PARSE_STACKSHOT_WAITINFO_SRP 79static const NSString* srp_expected_pid_key = @"srp_expected_pid"; // -> @(pid), this or ..._threadid required for PARSE_STACKSHOT_WAITINFO_SRP 80static const NSString* translated_child_pid_key = @"translated_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSLATED 81static const NSString* sharedcache_child_pid_key = @"sharedcache_child_pid"; // @(pid), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS 82static const NSString* sharedcache_child_sameaddr_key = @"sharedcache_child_sameaddr"; // @(0 or 1), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS 83static const NSString* exec_inprogress_pid_key = @"exec_inprogress_pid"; 84static const NSString* exec_inprogress_found_key = @"exec_inprogress_found"; // callback when inprogress is found 85static const NSString* transitioning_pid_key = @"transitioning_task_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSITIONING 86static const NSString* asyncstack_expected_threadid_key = @"asyncstack_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_ASYNCSTACK 87static const NSString* asyncstack_expected_stack_key = @"asyncstack_expected_stack"; // -> @[pc...]), expected PCs for asyncstack 88static const NSString* driverkit_found_key = @"driverkit_found_key"; // callback when driverkit process is found. argument is the process pid. 89static const NSString* sp_throttled_expected_ctxt_key = @"sp_throttled_expected_ctxt_key"; // -> @(ctxt), required for PARSE_STACKSHOT_THROTTLED_SP 90static const NSString* sp_throttled_expect_flag = @"sp_throttled_expect_flag"; // -> @(is_throttled), required for PARSE_STACKSHOT_THROTTLED_SP 91static const NSString* no_exclaves_key = @"no_exclaves"; 92 93#define TEST_STACKSHOT_QUEUE_LABEL "houston.we.had.a.problem" 94#define TEST_STACKSHOT_QUEUE_LABEL_LENGTH sizeof(TEST_STACKSHOT_QUEUE_LABEL) 95 96#define THROTTLED_SERVICE_NAME "com.apple.xnu.test.stackshot.throttled_service" 97 98static int64_t 99run_sysctl_test(const char *t, int64_t value) 100{ 101 char name[1024]; 102 int64_t result = 0; 103 size_t s = sizeof(value); 104 int rc; 105 106 snprintf(name, sizeof(name), "debug.test.%s", t); 107 rc = sysctlbyname(name, &result, &s, &value, s); 108 T_QUIET; T_ASSERT_POSIX_SUCCESS(rc, "sysctlbyname(%s)", name); 109 return result; 110} 111 112T_DECL(microstackshots, "test the microstackshot syscall", T_META_TAG_VM_PREFERRED) 113{ 114 void *buf = NULL; 115 unsigned int size = DEFAULT_STACKSHOT_BUFFER_SIZE; 116 117 while (1) { 118 buf = malloc(size); 119 T_QUIET; T_ASSERT_NOTNULL(buf, "allocated stackshot buffer"); 120 121#pragma clang diagnostic push 122#pragma clang diagnostic ignored "-Wdeprecated-declarations" 123 int len = syscall(SYS_microstackshot, buf, size, 124 (uint32_t) STACKSHOT_GET_MICROSTACKSHOT); 125#pragma clang diagnostic pop 126 if (len == ENOSYS) { 127 T_SKIP("microstackshot syscall failed, likely not compiled with CONFIG_TELEMETRY"); 128 } 129 if (len == -1 && errno == ENOSPC) { 130 /* syscall failed because buffer wasn't large enough, try again */ 131 free(buf); 132 buf = NULL; 133 size *= 2; 134 T_ASSERT_LE(size, (unsigned int)MAX_STACKSHOT_BUFFER_SIZE, 135 "growing stackshot buffer to sane size"); 136 continue; 137 } 138 T_ASSERT_POSIX_SUCCESS(len, "called microstackshot syscall"); 139 break; 140 } 141 142 T_EXPECT_EQ(*(uint32_t *)buf, 143 (uint32_t)STACKSHOT_MICRO_SNAPSHOT_MAGIC, 144 "magic value for microstackshot matches"); 145 146 free(buf); 147} 148 149struct scenario { 150 const char *name; 151 uint64_t flags; 152 bool quiet; 153 bool should_fail; 154 bool maybe_unsupported; 155 bool maybe_enomem; 156 bool no_recordfile; 157 pid_t target_pid; 158 bool target_kernel; 159 uint64_t since_timestamp; 160 uint32_t size_hint; 161 dt_stat_time_t timer; 162}; 163 164static void 165quiet(struct scenario *scenario) 166{ 167 if (scenario->timer || scenario->quiet) { 168 T_QUIET; 169 } 170} 171 172static void 173take_stackshot(struct scenario *scenario, bool compress_ok, void (^cb)(void *buf, size_t size)) 174{ 175start: 176 initialize_thread(); 177 178 void *config = stackshot_config_create(); 179 quiet(scenario); 180 T_ASSERT_NOTNULL(config, "created stackshot config"); 181 182 int ret = stackshot_config_set_flags(config, scenario->flags | global_flags); 183 quiet(scenario); 184 T_ASSERT_POSIX_ZERO(ret, "set flags %#llx on stackshot config", scenario->flags); 185 186 if (scenario->size_hint > 0) { 187 ret = stackshot_config_set_size_hint(config, scenario->size_hint); 188 quiet(scenario); 189 T_ASSERT_POSIX_ZERO(ret, "set size hint %" PRIu32 " on stackshot config", 190 scenario->size_hint); 191 } 192 193 if (scenario->target_pid > 0) { 194 ret = stackshot_config_set_pid(config, scenario->target_pid); 195 quiet(scenario); 196 T_ASSERT_POSIX_ZERO(ret, "set target pid %d on stackshot config", 197 scenario->target_pid); 198 } else if (scenario->target_kernel) { 199 ret = stackshot_config_set_pid(config, 0); 200 quiet(scenario); 201 T_ASSERT_POSIX_ZERO(ret, "set kernel target on stackshot config"); 202 } 203 204 if (scenario->since_timestamp > 0) { 205 ret = stackshot_config_set_delta_timestamp(config, scenario->since_timestamp); 206 quiet(scenario); 207 T_ASSERT_POSIX_ZERO(ret, "set since timestamp %" PRIu64 " on stackshot config", 208 scenario->since_timestamp); 209 } 210 211 int retries_remaining = 5; 212 213retry: ; 214 uint64_t start_time = mach_absolute_time(); 215 ret = stackshot_capture_with_config(config); 216 uint64_t end_time = mach_absolute_time(); 217 218 if (scenario->should_fail) { 219 T_EXPECTFAIL; 220 T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config"); 221 return; 222 } 223 224 if (ret == EBUSY || ret == ETIMEDOUT) { 225 if (retries_remaining > 0) { 226 if (!scenario->timer) { 227 T_LOG("stackshot_capture_with_config failed with %s (%d), retrying", 228 strerror(ret), ret); 229 } 230 231 retries_remaining--; 232 goto retry; 233 } else { 234 T_ASSERT_POSIX_ZERO(ret, 235 "called stackshot_capture_with_config (no retries remaining)"); 236 } 237 } else if ((ret == ENOTSUP) && scenario->maybe_unsupported) { 238 T_SKIP("kernel indicated this stackshot configuration is not supported"); 239 } else if ((ret == ENOMEM) && scenario->maybe_enomem) { 240 T_SKIP("insufficient available memory to run test"); 241 } else { 242 quiet(scenario); 243 T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config"); 244 } 245 246 if (scenario->timer) { 247 dt_stat_mach_time_add(scenario->timer, end_time - start_time); 248 } 249 void *buf = stackshot_config_get_stackshot_buffer(config); 250 size_t size = stackshot_config_get_stackshot_size(config); 251 if (scenario->name && !scenario->no_recordfile) { 252 char sspath[MAXPATHLEN]; 253 strlcpy(sspath, scenario->name, sizeof(sspath)); 254 strlcat(sspath, ".kcdata", sizeof(sspath)); 255 T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(sspath, sizeof(sspath)), 256 "create result file path"); 257 258 if (!scenario->quiet) { 259 T_LOG("writing stackshot to %s", sspath); 260 } 261 262 FILE *f = fopen(sspath, "w"); 263 T_WITH_ERRNO; T_QUIET; T_ASSERT_NOTNULL(f, 264 "open stackshot output file"); 265 266 size_t written = fwrite(buf, size, 1, f); 267 T_QUIET; T_ASSERT_POSIX_SUCCESS(written, "wrote stackshot to file"); 268 269 fclose(f); 270 } 271 cb(buf, size); 272 if (compress_ok) { 273 if (global_flags == 0) { 274 T_LOG("Restarting test with compression"); 275 global_flags |= STACKSHOT_DO_COMPRESS; 276 goto start; 277 } else { 278 global_flags = 0; 279 } 280 } 281 282 ret = stackshot_config_dealloc(config); 283 T_QUIET; T_EXPECT_POSIX_ZERO(ret, "deallocated stackshot config"); 284} 285 286T_DECL(simple_compressed, "take a simple compressed stackshot", T_META_TAG_VM_PREFERRED) 287{ 288 struct scenario scenario = { 289 .name = "kcdata_compressed", 290 .flags = (STACKSHOT_DO_COMPRESS | STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS | 291 STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 292 }; 293 294 T_LOG("taking compressed kcdata stackshot"); 295 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 296 parse_stackshot(0, ssbuf, sslen, nil); 297 }); 298} 299 300T_DECL(panic_compressed, "take a compressed stackshot with the same flags as a panic stackshot", T_META_TAG_VM_PREFERRED) 301{ 302 uint64_t stackshot_flags = (STACKSHOT_SAVE_KEXT_LOADINFO | 303 STACKSHOT_SAVE_LOADINFO | 304 STACKSHOT_KCDATA_FORMAT | 305 STACKSHOT_ENABLE_BT_FAULTING | 306 STACKSHOT_ENABLE_UUID_FAULTING | 307 STACKSHOT_DO_COMPRESS | 308 STACKSHOT_NO_IO_STATS | 309 STACKSHOT_THREAD_WAITINFO | 310#if TARGET_OS_MAC 311 STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT | 312#endif 313 STACKSHOT_DISABLE_LATENCY_INFO); 314 315 struct scenario scenario = { 316 .name = "kcdata_panic_compressed", 317 .flags = stackshot_flags, 318 }; 319 320 T_LOG("taking compressed kcdata stackshot with panic flags"); 321 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 322 parse_stackshot(0, ssbuf, sslen, nil); 323 }); 324} 325 326T_DECL(kcdata, "test that kcdata stackshots can be taken and parsed", T_META_TAG_VM_PREFERRED) 327{ 328 struct scenario scenario = { 329 .name = "kcdata", 330 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS | 331 STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 332 }; 333 334 T_LOG("taking kcdata stackshot"); 335 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 336 parse_stackshot(0, ssbuf, sslen, nil); 337 }); 338} 339 340static void 341get_stats(stackshot_stats_t *_Nonnull out) 342{ 343 size_t oldlen = sizeof (*out); 344 bzero(out, oldlen); 345 int result = sysctlbyname("kern.stackshot_stats", out, &oldlen, NULL, 0); 346 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(result, "reading \"kern.stackshot_stats\" sysctl should succeed"); 347 T_EXPECT_EQ(oldlen, sizeof (*out), "kernel should update full stats structure"); 348} 349 350static void 351log_stats(mach_timebase_info_data_t timebase, uint64_t now, const char *name, stackshot_stats_t stat) 352{ 353 uint64_t last_ago = (now - stat.ss_last_start) * timebase.numer / timebase.denom; 354 uint64_t last_duration = (stat.ss_last_end - stat.ss_last_start) * timebase.numer / timebase.denom; 355 uint64_t total_duration = (stat.ss_duration) * timebase.numer / timebase.denom; 356 357 uint64_t nanosec = 1000000000llu; 358 T_LOG("%s: %8lld stackshots, %10lld.%09lld total nsecs, last %lld.%09lld secs ago, %lld.%09lld secs long", 359 name, stat.ss_count, 360 total_duration / nanosec, total_duration % nanosec, 361 last_ago / nanosec, last_ago % nanosec, 362 last_duration / nanosec, last_duration % nanosec); 363} 364 365T_DECL(stats, "test that stackshot stats can be read out and change when a stackshot occurs", T_META_TAG_VM_PREFERRED) 366{ 367 mach_timebase_info_data_t timebase = {0, 0}; 368 mach_timebase_info(&timebase); 369 370 struct scenario scenario = { 371 .name = "kcdata", 372 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 373 }; 374 375 stackshot_stats_t pre, post; 376 377 get_stats(&pre); 378 379 T_LOG("taking kcdata stackshot"); 380 take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) { 381 (void)0; 382 }); 383 384 get_stats(&post); 385 386 uint64_t now = mach_absolute_time(); 387 388 log_stats(timebase, now, " pre", pre); 389 log_stats(timebase, now, " post", post); 390 391 int64_t delta_stackshots = (int64_t)(post.ss_count - pre.ss_count); 392 int64_t delta_duration = (int64_t)(post.ss_duration - pre.ss_duration) * (int64_t)timebase.numer / (int64_t)timebase.denom; 393 int64_t delta_nsec = delta_duration % 1000000000ll; 394 if (delta_nsec < 0) { 395 delta_nsec += 1000000000ll; 396 } 397 T_LOG("delta: %+8lld stackshots, %+10lld.%09lld total nsecs", delta_stackshots, delta_duration / 1000000000ll, delta_nsec); 398 399 T_EXPECT_LT(pre.ss_last_start, pre.ss_last_end, "pre: stackshot should take time"); 400 T_EXPECT_LT(pre.ss_count, post.ss_count, "stackshot count should increase when a stackshot is taken"); 401 T_EXPECT_LT(pre.ss_duration, post.ss_duration, "stackshot duration should increase when a stackshot is taken"); 402 T_EXPECT_LT(pre.ss_last_end, post.ss_last_start, "previous end should be less than new start after a stackshot"); 403 T_EXPECT_LT(post.ss_last_start, post.ss_last_end, "post: stackshot should take time"); 404} 405 406T_DECL(kcdata_faulting, "test that kcdata stackshots while faulting can be taken and parsed", T_META_TAG_VM_PREFERRED) 407{ 408 struct scenario scenario = { 409 .name = "faulting", 410 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 411 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT 412 | STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING), 413 }; 414 415 T_LOG("taking faulting stackshot"); 416 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 417 parse_stackshot(0, ssbuf, sslen, nil); 418 }); 419} 420 421T_DECL(bad_flags, "test a poorly-formed stackshot syscall", T_META_TAG_VM_PREFERRED) 422{ 423 struct scenario scenario = { 424 .flags = STACKSHOT_SAVE_IN_KERNEL_BUFFER /* not allowed from user space */, 425 .should_fail = true, 426 }; 427 428 T_LOG("attempting to take stackshot with kernel-only flag"); 429 take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) { 430 T_ASSERT_FAIL("stackshot data callback called"); 431 }); 432} 433 434T_DECL(delta, "test delta stackshots", T_META_TAG_VM_PREFERRED) 435{ 436 struct scenario scenario = { 437 .name = "delta", 438 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 439 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 440 }; 441 442 T_LOG("taking full stackshot"); 443 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 444 uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen); 445 446 T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time); 447 448 parse_stackshot(0, ssbuf, sslen, nil); 449 450 struct scenario delta_scenario = { 451 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 452 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT 453 | STACKSHOT_COLLECT_DELTA_SNAPSHOT), 454 .since_timestamp = stackshot_time 455 }; 456 457 take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) { 458 parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil); 459 }); 460 }); 461} 462 463T_DECL(shared_cache_layout, "test stackshot inclusion of shared cache layout", T_META_TAG_VM_PREFERRED) 464{ 465 struct scenario scenario = { 466 .name = "shared_cache_layout", 467 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 468 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT | 469 STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT), 470 }; 471 472 size_t shared_cache_length; 473 const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length); 474 if (cache_header == NULL) { 475 T_SKIP("Device not running with shared cache, skipping test..."); 476 } 477 478 if (shared_cache_length == 0) { 479 T_SKIP("dyld reports that currently running shared cache has zero length"); 480 } 481 482 T_LOG("taking stackshot with STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT set"); 483 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 484 parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_LAYOUT, ssbuf, sslen, nil); 485 }); 486} 487 488T_DECL(stress, "test that taking stackshots for 60 seconds doesn't crash the system", T_META_TAG_VM_PREFERRED) 489{ 490 uint64_t max_diff_time = 60ULL /* seconds */ * 1000000000ULL; 491 uint64_t start_time; 492 493 struct scenario scenario = { 494 .name = "stress", 495 .quiet = true, 496 .flags = (STACKSHOT_KCDATA_FORMAT | 497 STACKSHOT_THREAD_WAITINFO | 498 STACKSHOT_SAVE_LOADINFO | 499 STACKSHOT_SAVE_KEXT_LOADINFO | 500 STACKSHOT_GET_GLOBAL_MEM_STATS | 501 STACKSHOT_SAVE_IMP_DONATION_PIDS | 502 STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT | 503 STACKSHOT_THREAD_GROUP | 504 STACKSHOT_SAVE_JETSAM_COALITIONS | 505 STACKSHOT_ASID | 506 STACKSHOT_EXCLAVES | 507 0), 508 }; 509 510 start_time = clock_gettime_nsec_np(CLOCK_MONOTONIC); 511 while (clock_gettime_nsec_np(CLOCK_MONOTONIC) - start_time < max_diff_time) { 512 take_stackshot(&scenario, false, ^(void * __unused ssbuf, 513 size_t __unused sslen) { 514 printf("."); 515 fflush(stdout); 516 }); 517 518 /* 519 * After the first stackshot, there's no point in continuing to 520 * write them to disk, and it wears down the SSDs. 521 */ 522 scenario.no_recordfile = true; 523 524 /* Leave some time for the testing infrastructure to catch up */ 525 usleep(10000); 526 527 } 528 printf("\n"); 529} 530 531T_DECL(dispatch_queue_label, "test that kcdata stackshots contain libdispatch queue labels", T_META_TAG_VM_PREFERRED) 532{ 533 struct scenario scenario = { 534 .name = "kcdata", 535 .flags = (STACKSHOT_GET_DQ | STACKSHOT_KCDATA_FORMAT), 536 }; 537 dispatch_semaphore_t child_ready_sem, parent_done_sem; 538 dispatch_queue_t dq; 539 540#if TARGET_OS_WATCH 541 T_SKIP("This test is flaky on watches: 51663346"); 542#endif 543 544 child_ready_sem = dispatch_semaphore_create(0); 545 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "dqlabel child semaphore"); 546 547 parent_done_sem = dispatch_semaphore_create(0); 548 T_QUIET; T_ASSERT_NOTNULL(parent_done_sem, "dqlabel parent semaphore"); 549 550 dq = dispatch_queue_create(TEST_STACKSHOT_QUEUE_LABEL, NULL); 551 T_QUIET; T_ASSERT_NOTNULL(dq, "dispatch queue"); 552 553 /* start the helper thread */ 554 dispatch_async(dq, ^{ 555 dispatch_semaphore_signal(child_ready_sem); 556 557 dispatch_semaphore_wait(parent_done_sem, DISPATCH_TIME_FOREVER); 558 }); 559 560 /* block behind the child starting up */ 561 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 562 563 T_LOG("taking kcdata stackshot with libdispatch queue labels"); 564 take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) { 565 parse_stackshot(PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL, ssbuf, sslen, nil); 566 }); 567 568 dispatch_semaphore_signal(parent_done_sem); 569} 570 571#define CACHEADDR_ENV "STACKSHOT_TEST_DYLDADDR" 572T_HELPER_DECL(spawn_reslide_child, "child process to spawn with alternate slide") 573{ 574 size_t shared_cache_len; 575 const void *addr, *prevaddr; 576 uintmax_t v; 577 char *endptr; 578 579 const char *cacheaddr_env = getenv(CACHEADDR_ENV); 580 T_QUIET; T_ASSERT_NOTNULL(cacheaddr_env, "getenv("CACHEADDR_ENV")"); 581 errno = 0; 582 endptr = NULL; 583 v = strtoumax(cacheaddr_env, &endptr, 16); /* read hex value */ 584 T_WITH_ERRNO; T_QUIET; T_ASSERT_NE(v, 0l, "getenv(%s) = \"%s\" should be a non-zero hex number", CACHEADDR_ENV, cacheaddr_env); 585 T_QUIET; T_ASSERT_EQ(*endptr, 0, "getenv(%s) = \"%s\" endptr \"%s\" should be empty", CACHEADDR_ENV, cacheaddr_env, endptr); 586 587 prevaddr = (const void *)v; 588 addr = _dyld_get_shared_cache_range(&shared_cache_len); 589 T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address"); 590 591 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(getppid(), (addr == prevaddr) ? SIGUSR2 : SIGUSR1), "signaled parent to take stackshot"); 592 for (;;) { 593 (void) pause(); /* parent will kill -9 us */ 594 } 595} 596 597T_DECL(shared_cache_flags, "tests stackshot's task_ss_flags for the shared cache", T_META_TAG_VM_PREFERRED) 598{ 599 posix_spawnattr_t attr; 600 char *env_addr; 601 char path[PATH_MAX]; 602 __block bool child_same_addr = false; 603 604 uint32_t path_size = sizeof(path); 605 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 606 char *args[] = { path, "-n", "spawn_reslide_child", NULL }; 607 pid_t pid; 608 size_t shared_cache_len; 609 const void *addr; 610 611 dispatch_source_t child_diffsig_src, child_samesig_src; 612 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 613 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "shared_cache child semaphore"); 614 615 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 616 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 617 618 signal(SIGUSR1, SIG_IGN); 619 signal(SIGUSR2, SIG_IGN); 620 child_samesig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 621 T_QUIET; T_ASSERT_NOTNULL(child_samesig_src, "dispatch_source_create (child_samesig_src)"); 622 child_diffsig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR2, 0, signal_processing_q); 623 T_QUIET; T_ASSERT_NOTNULL(child_diffsig_src, "dispatch_source_create (child_diffsig_src)"); 624 625 /* child will signal us depending on if their addr is the same or different */ 626 dispatch_source_set_event_handler(child_samesig_src, ^{ child_same_addr = false; dispatch_semaphore_signal(child_ready_sem); }); 627 dispatch_source_set_event_handler(child_diffsig_src, ^{ child_same_addr = true; dispatch_semaphore_signal(child_ready_sem); }); 628 dispatch_activate(child_samesig_src); 629 dispatch_activate(child_diffsig_src); 630 631 addr = _dyld_get_shared_cache_range(&shared_cache_len); 632 T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address"); 633 634 T_QUIET; T_ASSERT_POSIX_SUCCESS(asprintf(&env_addr, "%p", addr), "asprintf of env_addr succeeded"); 635 T_QUIET; T_ASSERT_POSIX_SUCCESS(setenv(CACHEADDR_ENV, env_addr, true), "setting "CACHEADDR_ENV" to %s", env_addr); 636 637 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&attr), "posix_spawnattr_init"); 638 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_setflags(&attr, _POSIX_SPAWN_RESLIDE), "posix_spawnattr_setflags"); 639 int sp_ret = posix_spawn(&pid, path, NULL, &attr, args, environ); 640 T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 641 642 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 643 T_LOG("received signal from child (%s), capturing stackshot", child_same_addr ? "same shared cache addr" : "different shared cache addr"); 644 645 struct scenario scenario = { 646 .name = "shared_cache_flags", 647 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 648 | STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT 649 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 650 }; 651 652 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 653 int status; 654 /* First kill the child so we can reap it */ 655 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing spawned process"); 656 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on spawned child"); 657 T_QUIET; T_ASSERT_EQ(!!WIFSIGNALED(status), 1, "waitpid status should be signalled"); 658 T_QUIET; T_ASSERT_EQ(WTERMSIG(status), SIGKILL, "waitpid status should be SIGKILLed"); 659 660 parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_FLAGS, ssbuf, sslen, 661 @{sharedcache_child_pid_key: @(pid), sharedcache_child_sameaddr_key: @(child_same_addr ? 1 : 0)}); 662 }); 663} 664 665T_DECL(transitioning_tasks, "test that stackshot contains transitioning task info", T_META_BOOTARGS_SET("enable_proc_exit_lpexit_spin=1"), T_META_TAG_VM_PREFERRED) 666{ 667 int32_t sysctlValue = -1, numAttempts =0; 668 char path[PATH_MAX]; 669 uint32_t path_size = sizeof(path); 670 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 671 char *args[] = { path, "-n", "exec_child_preexec", NULL }; 672 673 dispatch_source_t child_sig_src; 674 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 675 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore"); 676 677 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 678 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 679 680 pid_t pid; 681 682 signal(SIGUSR1, SIG_IGN); 683 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 684 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 685 686 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 687 dispatch_activate(child_sig_src); 688 689 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), "set debug.proc_exit_lpexit_spin_pid=-1"); 690 691 int proc_exit_spin_pos = 0 ; 692 693 while (0 == sysctlbyname("debug.proc_exit_lpexit_spin_pos", NULL, NULL, &proc_exit_spin_pos, sizeof(proc_exit_spin_pos))) { 694 695 T_LOG(" ##### Testing while spinning in proc_exit at position %d ##### ", proc_exit_spin_pos); 696 697 int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL); 698 T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 699 700 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 701 702 struct proc_uniqidentifierinfo proc_info_data = { }; 703 int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data)); 704 T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO"); 705 T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data"); 706 707 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec"); 708 709 /* wait for a signal from post-exec child */ 710 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 711 712 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &pid, sizeof(pid)), "set debug.proc_exit_lpexit_spin_pid = %d, ", pid); 713 714 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid); 715 716 sysctlValue = 0; 717 size_t len = sizeof(sysctlValue); 718 while (numAttempts < 5) { 719 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValue, &len, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning"); 720 if (sysctlValue != 1) numAttempts++; 721 else break; 722 sleep(1); 723 } 724 725 T_ASSERT_EQ_UINT(sysctlValue, 1, "find spinning task in proc_exit()"); 726 727 struct scenario scenario = { 728 .name = "transitioning_tasks", 729 .flags = (STACKSHOT_KCDATA_FORMAT) 730 }; 731 732 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 733 parse_stackshot(PARSE_STACKSHOT_TRANSITIONING, ssbuf, sslen, @{transitioning_pid_key: @(pid)}); 734 735 // Kill the child 736 int sysctlValueB = -1; 737 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValueB, sizeof(sysctlValueB)), "set debug.proc_exit_lpexit_spin_pid=-1"); 738 sleep(1); 739 size_t blen = sizeof(sysctlValueB); 740 T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValueB, &blen, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning"); 741 T_ASSERT_EQ_UINT(sysctlValueB, 0, "make sure nothing is spining in proc_exit()"); 742 int status; 743 T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child"); 744 }); 745 746 proc_exit_spin_pos++; 747 } 748 749} 750 751static void *stuck_sysctl_thread(void *arg) { 752 int val = 1; 753 dispatch_semaphore_t child_thread_started = *(dispatch_semaphore_t *)arg; 754 755 dispatch_semaphore_signal(child_thread_started); 756 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread"); 757 758 return NULL; 759} 760 761T_HELPER_DECL(zombie_child, "child process to sample as a zombie") 762{ 763 pthread_t pthread; 764 dispatch_semaphore_t child_thread_started = dispatch_semaphore_create(0); 765 T_QUIET; T_ASSERT_NOTNULL(child_thread_started, "zombie child thread semaphore"); 766 767 /* spawn another thread to get stuck in the kernel, then call exit() to become a zombie */ 768 T_QUIET; T_ASSERT_POSIX_SUCCESS(pthread_create(&pthread, NULL, stuck_sysctl_thread, &child_thread_started), "pthread_create"); 769 770 dispatch_semaphore_wait(child_thread_started, DISPATCH_TIME_FOREVER); 771 772 /* sleep for a bit in the hope of ensuring that the other thread has called the sysctl before we signal the parent */ 773 usleep(100); 774 T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot"); 775 776 exit(0); 777} 778 779T_DECL(zombie, "tests a stackshot of a zombie task with a thread stuck in the kernel", 780 T_META_ENABLED(false), /* test is too flaky to run by default, but transitioning_tasks covers this case as well */ 781 T_META_TAG_VM_PREFERRED) 782{ 783 char path[PATH_MAX]; 784 uint32_t path_size = sizeof(path); 785 T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 786 char *args[] = { path, "-n", "zombie_child", NULL }; 787 788 dispatch_source_t child_sig_src; 789 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 790 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "zombie child semaphore"); 791 792 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 793 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 794 795 pid_t pid; 796 797 T_LOG("spawning a child"); 798 799 signal(SIGUSR1, SIG_IGN); 800 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 801 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 802 803 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 804 dispatch_activate(child_sig_src); 805 806 int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL); 807 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 808 809 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 810 811 T_LOG("received signal from child, capturing stackshot"); 812 813 struct proc_bsdshortinfo bsdshortinfo; 814 int retval, iterations_to_wait = 10; 815 816 while (iterations_to_wait > 0) { 817 retval = proc_pidinfo(pid, PROC_PIDT_SHORTBSDINFO, 0, &bsdshortinfo, sizeof(bsdshortinfo)); 818 if ((retval == 0) && errno == ESRCH) { 819 T_LOG("unable to find child using proc_pidinfo, assuming zombie"); 820 break; 821 } 822 823 T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDT_SHORTBSDINFO) returned a value > 0"); 824 T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(bsdshortinfo), "proc_pidinfo call for PROC_PIDT_SHORTBSDINFO returned expected size"); 825 826 if (bsdshortinfo.pbsi_flags & PROC_FLAG_INEXIT) { 827 T_LOG("child proc info marked as in exit"); 828 break; 829 } 830 831 iterations_to_wait--; 832 if (iterations_to_wait == 0) { 833 /* 834 * This will mark the test as failed but let it continue so we 835 * don't leave a process stuck in the kernel. 836 */ 837 T_FAIL("unable to discover that child is marked as exiting"); 838 } 839 840 /* Give the child a few more seconds to make it to exit */ 841 sleep(5); 842 } 843 844 /* Give the child some more time to make it through exit */ 845 sleep(10); 846 847 struct scenario scenario = { 848 .name = "zombie", 849 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 850 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 851 }; 852 853 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 854 /* First unwedge the child so we can reap it */ 855 int val = 1, status; 856 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child"); 857 858 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on zombie child"); 859 860 parse_stackshot(PARSE_STACKSHOT_ZOMBIE, ssbuf, sslen, @{zombie_child_pid_key: @(pid)}); 861 }); 862} 863 864T_HELPER_DECL(exec_child_preexec, "child process pre-exec") 865{ 866 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 867 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 868 869 signal(SIGUSR1, SIG_IGN); 870 dispatch_source_t parent_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 871 T_QUIET; T_ASSERT_NOTNULL(parent_sig_src, "dispatch_source_create (child_sig_src)"); 872 dispatch_source_set_event_handler(parent_sig_src, ^{ 873 874 // Parent took a timestamp then signaled us: exec into the next process 875 876 char path[PATH_MAX]; 877 uint32_t path_size = sizeof(path); 878 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 879 char *args[] = { path, "-n", "exec_child_postexec", NULL }; 880 881 T_QUIET; T_ASSERT_POSIX_ZERO(execve(args[0], args, NULL), "execing into exec_child_postexec"); 882 }); 883 dispatch_activate(parent_sig_src); 884 885 T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take timestamp"); 886 887 sleep(100); 888 // Should never get here 889 T_FAIL("Received signal to exec from parent"); 890} 891 892T_HELPER_DECL(exec_child_postexec, "child process post-exec to sample") 893{ 894 T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot"); 895 sleep(100); 896 // Should never get here 897 T_FAIL("Killed by parent"); 898} 899 900T_DECL(exec, "test getting full task snapshots for a task that execs", T_META_TAG_VM_PREFERRED) 901{ 902 char path[PATH_MAX]; 903 uint32_t path_size = sizeof(path); 904 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 905 char *args[] = { path, "-n", "exec_child_preexec", NULL }; 906 907 dispatch_source_t child_sig_src; 908 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 909 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore"); 910 911 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 912 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 913 914 pid_t pid; 915 916 T_LOG("spawning a child"); 917 918 signal(SIGUSR1, SIG_IGN); 919 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 920 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 921 922 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 923 dispatch_activate(child_sig_src); 924 925 int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL); 926 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid); 927 928 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 929 uint64_t start_time = mach_absolute_time(); 930 931 struct proc_uniqidentifierinfo proc_info_data = { }; 932 int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data)); 933 T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO"); 934 T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data"); 935 uint64_t unique_pid = proc_info_data.p_uniqueid; 936 937 T_LOG("received signal from pre-exec child, unique_pid is %llu, timestamp is %llu", unique_pid, start_time); 938 939 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec"); 940 941 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 942 943 T_LOG("received signal from post-exec child, capturing stackshot"); 944 945 struct scenario scenario = { 946 .name = "exec", 947 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 948 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT 949 | STACKSHOT_COLLECT_DELTA_SNAPSHOT), 950 .since_timestamp = start_time 951 }; 952 953 take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) { 954 // Kill the child 955 int status; 956 T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid); 957 T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child"); 958 959 parse_stackshot(PARSE_STACKSHOT_POSTEXEC | PARSE_STACKSHOT_DELTA, ssbuf, sslen, @{postexec_child_unique_pid_key: @(unique_pid)}); 960 }); 961} 962 963T_DECL( 964 exec_inprogress, 965 "test stackshots of processes in the middle of exec", 966 T_META_ENABLED(false), /* rdar://111691318 */ 967 T_META_TAG_VM_PREFERRED) 968{ 969 pid_t pid; 970 /* a BASH quine which execs itself as long as the parent doesn't exit */ 971 char *bash_prog = "[[ $PPID -ne 1 ]] && exec /bin/bash -c \"$0\" \"$0\""; 972 char *args[] = { "/bin/bash", "-c", bash_prog, bash_prog, NULL }; 973 974 posix_spawnattr_t sattr; 975 T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&sattr), "posix_spawnattr_init"); 976 T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, &sattr, args, NULL), "spawn exec_inprogress_child"); 977 978 struct scenario scenario = { 979 .name = "exec_inprogress", 980 .flags = (STACKSHOT_KCDATA_FORMAT), 981 .target_pid = pid, 982 }; 983 984 int tries = 0; 985 int tries_limit = 30; 986 __block bool found = false; 987 __block uint64_t cid1 = 0, cid2 = 0; 988 989 for (tries = 0; !found && tries < tries_limit; tries++) { 990 take_stackshot(&scenario, false, 991 ^( void *ssbuf, size_t sslen) { 992 parse_stackshot(PARSE_STACKSHOT_EXEC_INPROGRESS | PARSE_STACKSHOT_TARGETPID, 993 ssbuf, sslen, @{ 994 exec_inprogress_pid_key: @(pid), 995 exec_inprogress_found_key: ^(uint64_t id1, uint64_t id2) { found = true; cid1 = id1; cid2 = id2; }}); 996 }); 997 } 998 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing exec loop"); 999 T_ASSERT_TRUE(found, "able to find our execing process mid-exec in %d tries", tries); 1000 T_ASSERT_NE(cid1, cid2, "container IDs for in-progress exec are unique"); 1001 T_PASS("found mid-exec process in %d tries", tries); 1002} 1003 1004#ifdef _LP64 1005#if __has_feature(ptrauth_calls) 1006#define __ptrauth_swift_async_context_parent \ 1007 __ptrauth(ptrauth_key_process_independent_data, 1, 0xbda2) 1008#define __ptrauth_swift_async_context_resume \ 1009 __ptrauth(ptrauth_key_function_pointer, 1, 0xd707) 1010#else 1011#define __ptrauth_swift_async_context_parent 1012#define __ptrauth_swift_async_context_resume 1013#endif 1014// Add 1 to match the symbolication aid added by the stackshot backtracer. 1015#define asyncstack_frame(x) ((uintptr_t)(void *)ptrauth_strip((void *)(x), ptrauth_key_function_pointer) + 1) 1016 1017// This struct fakes the Swift AsyncContext struct which is used by 1018// the Swift concurrency runtime. We only care about the first 2 fields. 1019struct fake_async_context { 1020 struct fake_async_context* __ptrauth_swift_async_context_parent next; 1021 void(*__ptrauth_swift_async_context_resume resume_pc)(void); 1022}; 1023 1024static void 1025level1_func() 1026{ 1027} 1028static void 1029level2_func() 1030{ 1031} 1032 1033// Create a chain of fake async contexts; sync with asyncstack_expected_stack below 1034static alignas(16) struct fake_async_context level1 = { 0, level1_func }; 1035static alignas(16) struct fake_async_context level2 = { &level1, level2_func }; 1036 1037struct async_test_semaphores { 1038 dispatch_semaphore_t child_ready_sem; /* signal parent we're ready */ 1039 dispatch_semaphore_t child_exit_sem; /* parent tells us to go away */ 1040}; 1041 1042#define ASYNCSTACK_THREAD_NAME "asyncstack_thread" 1043 1044static void __attribute__((noinline, not_tail_called)) 1045expect_asyncstack(void *arg) 1046{ 1047 struct async_test_semaphores *async_ts = arg; 1048 1049 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_setname_np(ASYNCSTACK_THREAD_NAME), 1050 "set thread name to %s", ASYNCSTACK_THREAD_NAME); 1051 1052 /* Tell the main thread we're all set up, then wait for permission to exit */ 1053 dispatch_semaphore_signal(async_ts->child_ready_sem); 1054 dispatch_semaphore_wait(async_ts->child_exit_sem, DISPATCH_TIME_FOREVER); 1055 usleep(1); /* make sure we don't tailcall semaphore_wait */ 1056} 1057 1058static void * 1059asyncstack_thread(void *arg) 1060{ 1061 uint64_t *fp = __builtin_frame_address(0); 1062 // We cannot use a variable of pointer type, because this ABI is valid 1063 // on arm64_32 where pointers are 32bits, but the context pointer will 1064 // still be stored in a 64bits slot on the stack. 1065#if __has_feature(ptrauth_calls) 1066#define __stack_context_auth __ptrauth(ptrauth_key_process_dependent_data, 1, \ 1067 0xc31a) 1068 struct fake_async_context * __stack_context_auth ctx = &level2; 1069#else // __has_feature(ptrauth_calls) 1070 /* struct fake_async_context * */uint64_t ctx = (uintptr_t)&level2; 1071#endif // !__has_feature(ptrauth_calls) 1072 1073 // The signature of an async frame on the OS stack is: 1074 // [ <AsyncContext address>, <Saved FP | (1<<60)>, <return address> ] 1075 // The Async context must be right before the saved FP on the stack. This 1076 // should happen naturally in an optimized build as it is the only 1077 // variable on the stack. 1078 // This function cannot use T_ASSERT_* becuse it changes the stack 1079 // layout. 1080 assert((uintptr_t)fp - (uintptr_t)&ctx == 8); 1081 1082 // Modify the saved FP on the stack to include the async frame marker 1083 *fp |= (0x1ULL << 60); 1084 expect_asyncstack(arg); 1085 return NULL; 1086} 1087 1088T_DECL(asyncstack, "test swift async stack entries", T_META_TAG_VM_PREFERRED) 1089{ 1090 struct scenario scenario = { 1091 .name = "asyncstack", 1092 .flags = STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO, 1093 }; 1094 struct async_test_semaphores async_ts = { 1095 .child_ready_sem = dispatch_semaphore_create(0), 1096 .child_exit_sem = dispatch_semaphore_create(0), 1097 }; 1098 T_QUIET; T_ASSERT_NOTNULL(async_ts.child_ready_sem, "child_ready_sem alloc"); 1099 T_QUIET; T_ASSERT_NOTNULL(async_ts.child_exit_sem, "child_exit_sem alloc"); 1100 1101 pthread_t pthread; 1102 __block uint64_t threadid = 0; 1103 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_create(&pthread, NULL, asyncstack_thread, &async_ts), "pthread_create"); 1104 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_threadid_np(pthread, &threadid), "pthread_threadid_np"); 1105 1106 dispatch_semaphore_wait(async_ts.child_ready_sem, DISPATCH_TIME_FOREVER); 1107 1108 take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) { 1109 parse_stackshot(PARSE_STACKSHOT_ASYNCSTACK, ssbuf, sslen, @{ 1110 asyncstack_expected_threadid_key: @(threadid), 1111 asyncstack_expected_stack_key: @[ @(asyncstack_frame(level2_func)), @(asyncstack_frame(level1_func)) ], 1112 }); 1113 }); 1114 1115 dispatch_semaphore_signal(async_ts.child_exit_sem); 1116 T_QUIET; T_ASSERT_POSIX_ZERO(pthread_join(pthread, NULL), "wait for thread"); 1117 1118} 1119#endif /* #ifdef _LP64 */ 1120 1121static uint32_t 1122get_user_promotion_basepri(void) 1123{ 1124 mach_msg_type_number_t count = THREAD_POLICY_STATE_COUNT; 1125 struct thread_policy_state thread_policy; 1126 boolean_t get_default = FALSE; 1127 mach_port_t thread_port = pthread_mach_thread_np(pthread_self()); 1128 1129 kern_return_t kr = thread_policy_get(thread_port, THREAD_POLICY_STATE, 1130 (thread_policy_t)&thread_policy, &count, &get_default); 1131 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_policy_get"); 1132 return thread_policy.thps_user_promotion_basepri; 1133} 1134 1135static int 1136get_pri(thread_t thread_port) 1137{ 1138 kern_return_t kr; 1139 1140 thread_extended_info_data_t extended_info; 1141 mach_msg_type_number_t count = THREAD_EXTENDED_INFO_COUNT; 1142 kr = thread_info(thread_port, THREAD_EXTENDED_INFO, 1143 (thread_info_t)&extended_info, &count); 1144 1145 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_info"); 1146 1147 return extended_info.pth_curpri; 1148} 1149 1150 1151T_DECL(turnstile_singlehop, "turnstile single hop test", T_META_TAG_VM_PREFERRED) 1152{ 1153 dispatch_queue_t dq1, dq2; 1154 dispatch_semaphore_t sema_x; 1155 dispatch_queue_attr_t dq1_attr, dq2_attr; 1156 __block qos_class_t main_qos = 0; 1157 __block int main_relpri = 0, main_relpri2 = 0, main_afterpri = 0; 1158 struct scenario scenario = { 1159 .name = "turnstile_singlehop", 1160 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 1161 }; 1162 dq1_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_UTILITY, 0); 1163 dq2_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_USER_INITIATED, 0); 1164 pthread_mutex_t lock_a = PTHREAD_MUTEX_INITIALIZER; 1165 pthread_mutex_t lock_b = PTHREAD_MUTEX_INITIALIZER; 1166 1167 pthread_mutex_t *lockap = &lock_a, *lockbp = &lock_b; 1168 1169 dq1 = dispatch_queue_create("q1", dq1_attr); 1170 dq2 = dispatch_queue_create("q2", dq2_attr); 1171 sema_x = dispatch_semaphore_create(0); 1172 1173 pthread_mutex_lock(lockap); 1174 dispatch_async(dq1, ^{ 1175 pthread_mutex_lock(lockbp); 1176 T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class"); 1177 T_LOG("The priority of q1 is %d\n", get_pri(mach_thread_self())); 1178 dispatch_semaphore_signal(sema_x); 1179 pthread_mutex_lock(lockap); 1180 }); 1181 dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER); 1182 1183 T_LOG("Async1 completed"); 1184 1185 pthread_set_qos_class_self_np(QOS_CLASS_UTILITY, 0); 1186 T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class"); 1187 T_LOG("The priority of main is %d\n", get_pri(mach_thread_self())); 1188 main_relpri = get_pri(mach_thread_self()); 1189 1190 dispatch_async(dq2, ^{ 1191 T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri2), "get qos class"); 1192 T_LOG("The priority of q2 is %d\n", get_pri(mach_thread_self())); 1193 dispatch_semaphore_signal(sema_x); 1194 pthread_mutex_lock(lockbp); 1195 }); 1196 dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER); 1197 1198 T_LOG("Async2 completed"); 1199 1200 while (1) { 1201 main_afterpri = (int) get_user_promotion_basepri(); 1202 if (main_relpri != main_afterpri) { 1203 T_LOG("Success with promotion pri is %d", main_afterpri); 1204 break; 1205 } 1206 1207 usleep(100); 1208 } 1209 1210 take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) { 1211 parse_stackshot(PARSE_STACKSHOT_TURNSTILEINFO, ssbuf, sslen, nil); 1212 }); 1213} 1214 1215 1216static void 1217expect_instrs_cycles_in_stackshot(void *ssbuf, size_t sslen) 1218{ 1219 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 1220 1221 bool in_task = false; 1222 bool in_thread = false; 1223 bool saw_instrs_cycles = false; 1224 iter = kcdata_iter_next(iter); 1225 1226 KCDATA_ITER_FOREACH(iter) { 1227 switch (kcdata_iter_type(iter)) { 1228 case KCDATA_TYPE_CONTAINER_BEGIN: 1229 switch (kcdata_iter_container_type(iter)) { 1230 case STACKSHOT_KCCONTAINER_TASK: 1231 in_task = true; 1232 saw_instrs_cycles = false; 1233 break; 1234 1235 case STACKSHOT_KCCONTAINER_THREAD: 1236 in_thread = true; 1237 saw_instrs_cycles = false; 1238 break; 1239 1240 default: 1241 break; 1242 } 1243 break; 1244 1245 case STACKSHOT_KCTYPE_INSTRS_CYCLES: 1246 saw_instrs_cycles = true; 1247 break; 1248 1249 case KCDATA_TYPE_CONTAINER_END: 1250 if (in_thread) { 1251 T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles, 1252 "saw instructions and cycles in thread"); 1253 in_thread = false; 1254 } else if (in_task) { 1255 T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles, 1256 "saw instructions and cycles in task"); 1257 in_task = false; 1258 } 1259 1260 default: 1261 break; 1262 } 1263 } 1264} 1265 1266static void 1267skip_if_monotonic_unsupported(void) 1268{ 1269 int supported = 0; 1270 size_t supported_size = sizeof(supported); 1271 int ret = sysctlbyname("kern.monotonic.supported", &supported, 1272 &supported_size, 0, 0); 1273 if (ret < 0 || !supported) { 1274 T_SKIP("monotonic is unsupported"); 1275 } 1276} 1277 1278T_DECL(instrs_cycles, "test a getting instructions and cycles in stackshot", T_META_TAG_VM_PREFERRED) 1279{ 1280 skip_if_monotonic_unsupported(); 1281 1282 struct scenario scenario = { 1283 .name = "instrs-cycles", 1284 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES 1285 | STACKSHOT_KCDATA_FORMAT), 1286 }; 1287 1288 T_LOG("attempting to take stackshot with instructions and cycles"); 1289 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1290 parse_stackshot(0, ssbuf, sslen, nil); 1291 expect_instrs_cycles_in_stackshot(ssbuf, sslen); 1292 }); 1293} 1294 1295T_DECL(delta_instrs_cycles, 1296 "test delta stackshots with instructions and cycles", T_META_TAG_VM_PREFERRED) 1297{ 1298 skip_if_monotonic_unsupported(); 1299 1300 struct scenario scenario = { 1301 .name = "delta-instrs-cycles", 1302 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES 1303 | STACKSHOT_KCDATA_FORMAT), 1304 }; 1305 1306 T_LOG("taking full stackshot"); 1307 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1308 uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen); 1309 1310 T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time); 1311 1312 parse_stackshot(0, ssbuf, sslen, nil); 1313 expect_instrs_cycles_in_stackshot(ssbuf, sslen); 1314 1315 struct scenario delta_scenario = { 1316 .name = "delta-instrs-cycles-next", 1317 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES 1318 | STACKSHOT_KCDATA_FORMAT 1319 | STACKSHOT_COLLECT_DELTA_SNAPSHOT), 1320 .since_timestamp = stackshot_time, 1321 }; 1322 1323 take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) { 1324 parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil); 1325 expect_instrs_cycles_in_stackshot(dssbuf, dsslen); 1326 }); 1327 }); 1328} 1329 1330static void 1331check_thread_groups_supported() 1332{ 1333 int err; 1334 int supported = 0; 1335 size_t supported_size = sizeof(supported); 1336 err = sysctlbyname("kern.thread_groups_supported", &supported, &supported_size, NULL, 0); 1337 1338 if (err || !supported) 1339 T_SKIP("thread groups not supported on this system"); 1340} 1341 1342T_DECL(thread_groups, "test getting thread groups in stackshot", T_META_TAG_VM_PREFERRED) 1343{ 1344 check_thread_groups_supported(); 1345 1346 struct scenario scenario = { 1347 .name = "thread-groups", 1348 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_GROUP 1349 | STACKSHOT_KCDATA_FORMAT), 1350 }; 1351 1352 T_LOG("attempting to take stackshot with thread group flag"); 1353 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1354 parse_thread_group_stackshot(ssbuf, sslen); 1355 }); 1356} 1357 1358T_DECL(compactinfo, "test compactinfo inclusion", T_META_TAG_VM_PREFERRED) 1359{ 1360 struct scenario scenario = { 1361 .name = "compactinfo", 1362 .target_pid = getpid(), 1363 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_SAVE_DYLD_COMPACTINFO 1364 | STACKSHOT_KCDATA_FORMAT), 1365 }; 1366 1367 T_LOG("attempting to take stackshot with compactinfo flag"); 1368 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1369 parse_stackshot(PARSE_STACKSHOT_COMPACTINFO | PARSE_STACKSHOT_TARGETPID, ssbuf, sslen, nil); 1370 }); 1371} 1372 1373T_DECL(suspendinfo, "test task suspend info inclusion", T_META_TAG_VM_PREFERRED) 1374{ 1375 struct scenario scenario = { 1376 .name = "suspendinfo", 1377 .target_pid = getpid(), 1378 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 1379 }; 1380 1381 T_LOG("attempting to take stackshot with suspendinfo flag"); 1382 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1383 parse_stackshot(PARSE_STACKSHOT_SUSPENDINFO | PARSE_STACKSHOT_TARGETPID, ssbuf, sslen, nil); 1384 }); 1385} 1386 1387static NSMutableSet * find_driverkit_pids(io_registry_entry_t root) { 1388 NSMutableSet * driverkit_pids = [NSMutableSet setWithCapacity:3]; 1389 io_registry_entry_t current = IO_OBJECT_NULL; 1390 io_iterator_t iter = IO_OBJECT_NULL; 1391 1392 T_EXPECT_MACH_SUCCESS(IORegistryEntryGetChildIterator(root, kIOServicePlane, &iter), "get registry iterator"); 1393 1394 while ((current = IOIteratorNext(iter)) != IO_OBJECT_NULL) { 1395 if (_IOObjectConformsTo(current, "IOUserServer", kIOClassNameOverrideNone)) { 1396 CFMutableDictionaryRef cfProperties = NULL; 1397 NSMutableDictionary * properties; 1398 NSString * client_creator_info; 1399 NSArray<NSString *> *creator_info_array; 1400 pid_t pid; 1401 1402 T_QUIET; T_EXPECT_MACH_SUCCESS(IORegistryEntryCreateCFProperties(current, &cfProperties, kCFAllocatorDefault, kNilOptions), "get properties"); 1403 properties = CFBridgingRelease(cfProperties); 1404 T_QUIET; T_ASSERT_NOTNULL(properties, "properties is not null"); 1405 client_creator_info = properties[@kIOUserClientCreatorKey]; 1406 creator_info_array = [client_creator_info componentsSeparatedByString:@","]; 1407 if ([creator_info_array[0] hasPrefix:@"pid"]) { 1408 NSArray<NSString *> *pid_info = [creator_info_array[0] componentsSeparatedByString:@" "]; 1409 T_QUIET; T_ASSERT_EQ(pid_info.count, 2UL, "Get pid info components from %s", creator_info_array[0].UTF8String); 1410 pid = pid_info[1].intValue; 1411 } else { 1412 T_ASSERT_FAIL("No pid info in client creator info: %s", client_creator_info.UTF8String); 1413 } 1414 T_LOG("Found driver pid %d", pid); 1415 [driverkit_pids addObject:[NSNumber numberWithInt:pid]]; 1416 } else { 1417 [driverkit_pids unionSet:find_driverkit_pids(current)]; 1418 } 1419 IOObjectRelease(current); 1420 } 1421 1422 IOObjectRelease(iter); 1423 return driverkit_pids; 1424} 1425 1426T_DECL(driverkit, "test driverkit inclusion", T_META_TAG_VM_PREFERRED) 1427{ 1428 struct scenario scenario = { 1429 .name = "driverkit", 1430 .target_kernel = true, 1431 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT 1432 | STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL), 1433 }; 1434 1435 io_registry_entry_t root = IORegistryGetRootEntry(kIOMainPortDefault); 1436 NSMutableSet * driverkit_pids = find_driverkit_pids(root); 1437 IOObjectRelease(root); 1438 1439 T_LOG("expecting to find %lu driverkit processes", [driverkit_pids count]); 1440 T_LOG("attempting to take stackshot with STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL flag"); 1441 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1442 parse_stackshot(PARSE_STACKSHOT_DRIVERKIT | PARSE_STACKSHOT_TARGETPID, ssbuf, sslen, @{ 1443 driverkit_found_key: ^(pid_t pid) { 1444 [driverkit_pids removeObject:[NSNumber numberWithInt:pid]]; 1445 }}); 1446 }); 1447 1448 T_EXPECT_EQ([driverkit_pids count], (NSUInteger)0, "found expected number of driverkit processes"); 1449} 1450 1451static void 1452parse_page_table_asid_stackshot(void **ssbuf, size_t sslen) 1453{ 1454 bool seen_asid = false; 1455 bool seen_page_table_snapshot = false; 1456 bool seen_task = false; 1457 int container = 0; 1458 int task_container = -1; 1459 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 1460 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, 1461 "buffer provided is a stackshot"); 1462 1463 iter = kcdata_iter_next(iter); 1464 KCDATA_ITER_FOREACH(iter) { 1465 switch (kcdata_iter_type(iter)) { 1466 /* There's a slight chance that we see a transit version of this task 1467 * in the stackshot, so we want to make sure to check both */ 1468 case KCDATA_TYPE_CONTAINER_BEGIN: { 1469 container++; 1470 if (kcdata_iter_container_type(iter) == STACKSHOT_KCCONTAINER_TASK) { 1471 seen_asid = seen_page_table_snapshot = false; 1472 task_container = container; 1473 } 1474 break; 1475 } 1476 case KCDATA_TYPE_CONTAINER_END: { 1477 if (container == task_container) { 1478 task_container = -1; 1479 seen_task = true; 1480 T_ASSERT_TRUE(seen_page_table_snapshot, "check that we have seen a page table snapshot"); 1481 T_ASSERT_TRUE(seen_asid, "check that we have seen an ASID"); 1482 } 1483 container--; 1484 break; 1485 } 1486 case KCDATA_TYPE_ARRAY: { 1487 T_QUIET; 1488 T_ASSERT_TRUE(kcdata_iter_array_valid(iter), 1489 "checked that array is valid"); 1490 1491 if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_PAGE_TABLES) { 1492 continue; 1493 } 1494 1495 T_ASSERT_FALSE(seen_page_table_snapshot, "check that we haven't yet seen a page table snapshot"); 1496 seen_page_table_snapshot = true; 1497 1498 T_ASSERT_EQ((size_t) kcdata_iter_array_elem_size(iter), sizeof(uint64_t), 1499 "check that each element of the pagetable dump is the expected size"); 1500 1501 uint64_t *pt_array = kcdata_iter_payload(iter); 1502 uint32_t elem_count = kcdata_iter_array_elem_count(iter); 1503 uint32_t j; 1504 bool nonzero_tte = false; 1505 for (j = 0; j < elem_count;) { 1506 T_QUIET; T_ASSERT_LE(j + 4, elem_count, "check for valid page table segment header"); 1507 uint64_t pa = pt_array[j]; 1508 uint64_t num_entries = pt_array[j + 1]; 1509 uint64_t start_va = pt_array[j + 2]; 1510 uint64_t end_va = pt_array[j + 3]; 1511 1512 T_QUIET; T_ASSERT_NE(pa, (uint64_t) 0, "check that the pagetable physical address is non-zero"); 1513 T_QUIET; T_ASSERT_EQ(pa % (num_entries * sizeof(uint64_t)), (uint64_t) 0, "check that the pagetable physical address is correctly aligned"); 1514 T_QUIET; T_ASSERT_NE(num_entries, (uint64_t) 0, "check that a pagetable region has more than 0 entries"); 1515 T_QUIET; T_ASSERT_LE(j + 4 + num_entries, (uint64_t) elem_count, "check for sufficient space in page table array"); 1516 T_QUIET; T_ASSERT_GT(end_va, start_va, "check for valid VA bounds in page table segment header"); 1517 1518 for (uint32_t k = j + 4; k < (j + 4 + num_entries); ++k) { 1519 if (pt_array[k] != 0) { 1520 nonzero_tte = true; 1521 T_QUIET; T_ASSERT_EQ((pt_array[k] >> 48) & 0xf, (uint64_t) 0, "check that bits[48:51] of arm64 TTE are clear"); 1522 // L0-L2 table and non-compressed L3 block entries should always have bit 1 set; assumes L0-L2 blocks will not be used outside the kernel 1523 bool table = ((pt_array[k] & 0x2) != 0); 1524 if (table) { 1525 T_QUIET; T_ASSERT_NE(pt_array[k] & ((1ULL << 48) - 1) & ~((1ULL << 12) - 1), (uint64_t) 0, "check that arm64 TTE physical address is non-zero"); 1526 } else { // should be a compressed PTE 1527 T_QUIET; T_ASSERT_NE(pt_array[k] & 0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has at least one of bits [63:62] set"); 1528 T_QUIET; T_ASSERT_EQ(pt_array[k] & ~0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has no other bits besides [63:62] set"); 1529 } 1530 } 1531 } 1532 1533 j += (4 + num_entries); 1534 } 1535 T_ASSERT_TRUE(nonzero_tte, "check that we saw at least one non-empty TTE"); 1536 T_ASSERT_EQ(j, elem_count, "check that page table dump size matches extent of last header"); 1537 break; 1538 } 1539 case STACKSHOT_KCTYPE_ASID: { 1540 T_ASSERT_FALSE(seen_asid, "check that we haven't yet seen an ASID"); 1541 seen_asid = true; 1542 } 1543 } 1544 } 1545 1546 T_QUIET; T_ASSERT_TRUE(seen_task, "check that we have seen a complete task container"); 1547} 1548 1549T_DECL(dump_page_tables, "test stackshot page table dumping support", T_META_TAG_VM_PREFERRED) 1550{ 1551 struct scenario scenario = { 1552 .name = "asid-page-tables", 1553 .flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_ASID | STACKSHOT_PAGE_TABLES), 1554 .size_hint = (9ull << 20), // 9 MB 1555 .target_pid = getpid(), 1556 .maybe_unsupported = true, 1557 .maybe_enomem = true, 1558 }; 1559 1560 T_LOG("attempting to take stackshot with ASID and page table flags"); 1561 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1562 parse_page_table_asid_stackshot(ssbuf, sslen); 1563 }); 1564} 1565 1566static void stackshot_verify_current_proc_uuid_info(void **ssbuf, size_t sslen, uint64_t expected_offset, const struct proc_uniqidentifierinfo *proc_info_data) 1567{ 1568 const uuid_t *current_uuid = (const uuid_t *)(&proc_info_data->p_uuid); 1569 1570 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 1571 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "buffer provided is a stackshot"); 1572 1573 iter = kcdata_iter_next(iter); 1574 1575 KCDATA_ITER_FOREACH(iter) { 1576 switch (kcdata_iter_type(iter)) { 1577 case KCDATA_TYPE_ARRAY: { 1578 T_QUIET; T_ASSERT_TRUE(kcdata_iter_array_valid(iter), "checked that array is valid"); 1579 if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO64) { 1580 struct user64_dyld_uuid_info *info = (struct user64_dyld_uuid_info *) kcdata_iter_payload(iter); 1581 if (uuid_compare(*current_uuid, info->imageUUID) == 0) { 1582 T_ASSERT_EQ(expected_offset, info->imageLoadAddress, "found matching UUID with matching binary offset"); 1583 return; 1584 } 1585 } else if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO) { 1586 struct user32_dyld_uuid_info *info = (struct user32_dyld_uuid_info *) kcdata_iter_payload(iter); 1587 if (uuid_compare(*current_uuid, info->imageUUID) == 0) { 1588 T_ASSERT_EQ(expected_offset, ((uint64_t) info->imageLoadAddress), "found matching UUID with matching binary offset"); 1589 return; 1590 } 1591 } 1592 break; 1593 } 1594 default: 1595 break; 1596 } 1597 } 1598 1599 T_FAIL("failed to find matching UUID in stackshot data"); 1600} 1601 1602T_DECL(translated, 1603 "tests translated bit is set correctly", 1604 T_META_TAG_VM_PREFERRED, 1605 T_META_ENABLED(false /* rdar://133956022 */)) 1606{ 1607#if !(TARGET_OS_OSX && TARGET_CPU_ARM64) 1608 T_SKIP("Only valid on Apple silicon Macs") 1609#endif 1610 // Get path of stackshot_translated_child helper binary 1611 char path[PATH_MAX]; 1612 uint32_t path_size = sizeof(path); 1613 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 1614 char* binary_name = strrchr(path, '/'); 1615 if (binary_name) binary_name++; 1616 T_QUIET; T_ASSERT_NOTNULL(binary_name, "Find basename in path '%s'", path); 1617 strlcpy(binary_name, "stackshot_translated_child", path_size - (binary_name - path)); 1618 char *args[] = { path, NULL }; 1619 1620 dispatch_source_t child_sig_src; 1621 dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0); 1622 T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore"); 1623 1624 dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL); 1625 T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue"); 1626 1627 signal(SIGUSR1, SIG_IGN); 1628 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q); 1629 T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)"); 1630 1631 dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); }); 1632 dispatch_activate(child_sig_src); 1633 1634 // Spawn child 1635 pid_t pid; 1636 T_LOG("spawning translated child"); 1637 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, NULL, args, NULL), "spawned process '%s' with PID %d", args[0], pid); 1638 1639 // Wait for the the child to spawn up 1640 dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER); 1641 1642 // Make sure the child is running and is translated 1643 int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, pid }; 1644 struct kinfo_proc process_info; 1645 size_t bufsize = sizeof(process_info); 1646 T_QUIET; T_ASSERT_POSIX_SUCCESS(sysctl(mib, (unsigned)(sizeof(mib)/sizeof(int)), &process_info, &bufsize, NULL, 0), "get translated child process info"); 1647 T_QUIET; T_ASSERT_GT(bufsize, (size_t)0, "process info is not empty"); 1648 T_QUIET; T_ASSERT_TRUE((process_info.kp_proc.p_flag & P_TRANSLATED), "KERN_PROC_PID reports child is translated"); 1649 1650 T_LOG("capturing stackshot"); 1651 1652 struct scenario scenario = { 1653 .name = "translated", 1654 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 1655 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 1656 }; 1657 1658 take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) { 1659 parse_stackshot(PARSE_STACKSHOT_TRANSLATED, ssbuf, sslen, @{translated_child_pid_key: @(pid)}); 1660 }); 1661 1662 // Kill the child 1663 int status; 1664 T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGTERM), "kill translated child"); 1665 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on translated child"); 1666 1667} 1668 1669T_DECL(proc_uuid_info, "tests that the main binary UUID for a proc is always populated", T_META_TAG_VM_PREFERRED) 1670{ 1671 struct proc_uniqidentifierinfo proc_info_data = { }; 1672 mach_msg_type_number_t count; 1673 kern_return_t kernel_status; 1674 task_dyld_info_data_t task_dyld_info; 1675 struct dyld_all_image_infos *target_infos; 1676 int retval; 1677 bool found_image_in_image_infos = false; 1678 uint64_t expected_mach_header_offset = 0; 1679 1680 /* Find the UUID of our main binary */ 1681 retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data)); 1682 T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO"); 1683 T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data"); 1684 1685 uuid_string_t str = {}; 1686 uuid_unparse(*(uuid_t*)&proc_info_data.p_uuid, str); 1687 T_LOG("Found current UUID is %s", str); 1688 1689 /* Find the location of the dyld image info metadata */ 1690 count = TASK_DYLD_INFO_COUNT; 1691 kernel_status = task_info(mach_task_self(), TASK_DYLD_INFO, (task_info_t)&task_dyld_info, &count); 1692 T_QUIET; T_ASSERT_EQ(kernel_status, KERN_SUCCESS, "retrieve task_info for TASK_DYLD_INFO"); 1693 1694 target_infos = (struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr; 1695 1696 /* Find our binary in the dyld image info array */ 1697 for (int i = 0; i < (int) target_infos->uuidArrayCount; i++) { 1698 if (uuid_compare(target_infos->uuidArray[i].imageUUID, *(uuid_t*)&proc_info_data.p_uuid) == 0) { 1699 expected_mach_header_offset = (uint64_t) target_infos->uuidArray[i].imageLoadAddress; 1700 found_image_in_image_infos = true; 1701 } 1702 } 1703 1704 T_ASSERT_TRUE(found_image_in_image_infos, "found binary image in dyld image info list"); 1705 1706 /* Overwrite the dyld image info data so the kernel has to fallback to the UUID stored in the proc structure */ 1707 target_infos->uuidArrayCount = 0; 1708 1709 struct scenario scenario = { 1710 .name = "proc_uuid_info", 1711 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 1712 .target_pid = getpid(), 1713 }; 1714 1715 T_LOG("attempting to take stackshot for current PID"); 1716 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1717 stackshot_verify_current_proc_uuid_info(ssbuf, sslen, expected_mach_header_offset, &proc_info_data); 1718 }); 1719} 1720 1721T_DECL(cseg_waitinfo, "test that threads stuck in the compressor report correct waitinfo", T_META_TAG_VM_PREFERRED) 1722{ 1723 struct scenario scenario = { 1724 .name = "cseg_waitinfo", 1725 .quiet = false, 1726 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 1727 }; 1728 __block uint64_t thread_id = 0; 1729 1730 dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot.cseg_waitinfo", NULL); 1731 dispatch_semaphore_t child_ok = dispatch_semaphore_create(0); 1732 1733 dispatch_async(dq, ^{ 1734 pthread_threadid_np(NULL, &thread_id); 1735 dispatch_semaphore_signal(child_ok); 1736 int val = 1; 1737 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread"); 1738 }); 1739 1740 dispatch_semaphore_wait(child_ok, DISPATCH_TIME_FOREVER); 1741 sleep(1); 1742 1743 T_LOG("taking stackshot"); 1744 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1745 int val = 1; 1746 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child thread"); 1747 parse_stackshot(PARSE_STACKSHOT_WAITINFO_CSEG, ssbuf, sslen, @{cseg_expected_threadid_key: @(thread_id)}); 1748 }); 1749} 1750 1751static void 1752srp_send( 1753 mach_port_t send_port, 1754 mach_port_t reply_port, 1755 mach_port_t msg_port) 1756{ 1757 kern_return_t ret = 0; 1758 1759 struct test_msg { 1760 mach_msg_header_t header; 1761 mach_msg_body_t body; 1762 mach_msg_port_descriptor_t port_descriptor; 1763 }; 1764 struct test_msg send_msg = { 1765 .header = { 1766 .msgh_remote_port = send_port, 1767 .msgh_local_port = reply_port, 1768 .msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, 1769 reply_port ? MACH_MSG_TYPE_MAKE_SEND_ONCE : 0, 1770 MACH_MSG_TYPE_MOVE_SEND, 1771 MACH_MSGH_BITS_COMPLEX), 1772 .msgh_id = 0x100, 1773 .msgh_size = sizeof(send_msg), 1774 }, 1775 .body = { 1776 .msgh_descriptor_count = 1, 1777 }, 1778 .port_descriptor = { 1779 .name = msg_port, 1780 .disposition = MACH_MSG_TYPE_MOVE_RECEIVE, 1781 .type = MACH_MSG_PORT_DESCRIPTOR, 1782 }, 1783 }; 1784 1785 if (msg_port == MACH_PORT_NULL) { 1786 send_msg.body.msgh_descriptor_count = 0; 1787 } 1788 1789 ret = mach_msg(&(send_msg.header), 1790 MACH_SEND_MSG | 1791 MACH_SEND_TIMEOUT | 1792 MACH_SEND_OVERRIDE, 1793 send_msg.header.msgh_size, 1794 0, 1795 MACH_PORT_NULL, 1796 10000, 1797 0); 1798 1799 T_ASSERT_MACH_SUCCESS(ret, "client mach_msg"); 1800} 1801 1802T_HELPER_DECL(srp_client, 1803 "Client used for the special_reply_port test") 1804{ 1805 pid_t ppid = getppid(); 1806 dispatch_semaphore_t can_continue = dispatch_semaphore_create(0); 1807 dispatch_queue_t dq = dispatch_queue_create("client_signalqueue", NULL); 1808 dispatch_source_t sig_src; 1809 1810 mach_msg_return_t mr; 1811 mach_port_t service_port; 1812 mach_port_t conn_port; 1813 mach_port_t special_reply_port; 1814 mach_port_options_t opts = { 1815 .flags = MPO_INSERT_SEND_RIGHT, 1816 }; 1817 1818 signal(SIGUSR1, SIG_IGN); 1819 sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq); 1820 1821 dispatch_source_set_event_handler(sig_src, ^{ 1822 dispatch_semaphore_signal(can_continue); 1823 }); 1824 dispatch_activate(sig_src); 1825 1826 /* lookup the mach service port for the parent */ 1827 kern_return_t kr = bootstrap_look_up(bootstrap_port, 1828 SRP_SERVICE_NAME, &service_port); 1829 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "client bootstrap_look_up"); 1830 1831 /* create the send-once right (special reply port) and message to send to the server */ 1832 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port); 1833 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct"); 1834 1835 special_reply_port = thread_get_special_reply_port(); 1836 T_QUIET; T_ASSERT_TRUE(MACH_PORT_VALID(special_reply_port), "get_thread_special_reply_port"); 1837 1838 /* send the message with the special reply port */ 1839 srp_send(service_port, special_reply_port, conn_port); 1840 1841 /* signal the parent to continue */ 1842 kill(ppid, SIGUSR1); 1843 1844 struct { 1845 mach_msg_header_t header; 1846 mach_msg_body_t body; 1847 mach_msg_port_descriptor_t port_descriptor; 1848 } rcv_msg = { 1849 .header = 1850 { 1851 .msgh_remote_port = MACH_PORT_NULL, 1852 .msgh_local_port = special_reply_port, 1853 .msgh_size = sizeof(rcv_msg), 1854 }, 1855 }; 1856 1857 /* wait on the reply from the parent (that we will never receive) */ 1858 mr = mach_msg(&(rcv_msg.header), 1859 (MACH_RCV_MSG | MACH_RCV_SYNC_WAIT), 1860 0, 1861 rcv_msg.header.msgh_size, 1862 special_reply_port, 1863 MACH_MSG_TIMEOUT_NONE, 1864 service_port); 1865 1866 /* not expected to execute as parent will SIGKILL client... */ 1867 T_LOG("client process exiting after sending message to parent (server)"); 1868} 1869 1870enum srp_test_type { 1871 SRP_TEST_THREAD, /* expect waiter on current thread */ 1872 SRP_TEST_PID, /* expect waiter on current PID */ 1873 SRP_TEST_EITHER, /* waiter could be on either */ 1874}; 1875 1876static void 1877check_srp_test(const char *name, enum srp_test_type ty) 1878{ 1879 struct scenario scenario = { 1880 .name = name, 1881 .quiet = false, 1882 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 1883 }; 1884 uint64_t thread_id = 0; 1885 pthread_threadid_np(NULL, &thread_id); 1886 if (ty == SRP_TEST_THREAD) { 1887 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1888 parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen, 1889 @{srp_expected_threadid_key: @(thread_id)}); 1890 }); 1891 } else if (ty == SRP_TEST_PID) { 1892 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1893 parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen, 1894 @{srp_expected_pid_key: @(getpid())}); 1895 }); 1896 } else { 1897 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 1898 parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen, 1899 @{srp_expected_pid_key: @(getpid()), srp_expected_threadid_key: @(thread_id)}); 1900 }); 1901 } 1902 1903} 1904 1905 1906/* 1907 * Tests the stackshot wait info plumbing for synchronous IPC that doesn't use kevent on the server. 1908 * 1909 * (part 1): tests the scenario where a client sends a request that includes a special reply port 1910 * to a server that doesn't receive the message and doesn't copy the send-once right 1911 * into its address space as a result. for this case the special reply port is enqueued 1912 * in a port and we check which task has that receive right and use that info. (rdar://60440338) 1913 * (part 2): tests the scenario where a client sends a request that includes a special reply port 1914 * to a server that receives the message and copies in the send-once right, but doesn't 1915 * reply to the client. for this case the special reply port is copied out and the kernel 1916 * stashes the info about which task copied out the send once right. (rdar://60440592) 1917 * (part 3): tests the same as part 2, but uses kevents, which allow for 1918 * priority inheritance 1919 */ 1920T_DECL(special_reply_port, "test that tasks using special reply ports have correct waitinfo", T_META_TAG_VM_PREFERRED) 1921{ 1922 dispatch_semaphore_t can_continue = dispatch_semaphore_create(0); 1923 dispatch_queue_t dq = dispatch_queue_create("signalqueue", NULL); 1924 dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL); 1925 dispatch_source_t sig_src; 1926 char path[PATH_MAX]; 1927 uint32_t path_size = sizeof(path); 1928 T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 1929 char *client_args[] = { path, "-n", "srp_client", NULL }; 1930 pid_t client_pid; 1931 int sp_ret; 1932 kern_return_t kr; 1933 mach_port_t port; 1934 1935 /* setup the signal handler in the parent (server) */ 1936 T_LOG("setup sig handlers"); 1937 signal(SIGUSR1, SIG_IGN); 1938 sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq); 1939 1940 dispatch_source_set_event_handler(sig_src, ^{ 1941 dispatch_semaphore_signal(can_continue); 1942 }); 1943 dispatch_activate(sig_src); 1944 1945 /* register with the mach service name so the client can lookup and send a message to the parent (server) */ 1946 T_LOG("Server about to check in"); 1947 kr = bootstrap_check_in(bootstrap_port, SRP_SERVICE_NAME, &port); 1948 T_ASSERT_MACH_SUCCESS(kr, "server bootstrap_check_in"); 1949 1950 T_LOG("Launching client"); 1951 sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL); 1952 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid); 1953 T_LOG("Spawned client as PID %d", client_pid); 1954 1955 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 1956 T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear"); 1957 1958 /* 1959 * can_continue indicates the client has signaled us, but we want to make 1960 * sure they've actually blocked sending their mach message. It's cheesy, but 1961 * sleep() works for this. 1962 */ 1963 sleep(1); 1964 1965 /* 1966 * take the stackshot without calling receive to verify that the stackshot wait 1967 * info shows our (the server) thread for the scenario where the server has yet to 1968 * receive the message. 1969 */ 1970 T_LOG("Taking stackshot for part 1 coverage"); 1971 check_srp_test("srp", SRP_TEST_THREAD); 1972 1973 /* 1974 * receive the message from the client (which should copy the send once right into 1975 * our address space). 1976 */ 1977 struct { 1978 mach_msg_header_t header; 1979 mach_msg_body_t body; 1980 mach_msg_port_descriptor_t port_descriptor; 1981 } rcv_msg = { 1982 .header = 1983 { 1984 .msgh_remote_port = MACH_PORT_NULL, 1985 .msgh_local_port = port, 1986 .msgh_size = sizeof(rcv_msg), 1987 }, 1988 }; 1989 1990 T_LOG("server: starting sync receive\n"); 1991 1992 mach_msg_return_t mr; 1993 mr = mach_msg(&(rcv_msg.header), 1994 (MACH_RCV_MSG | MACH_RCV_TIMEOUT), 1995 0, 1996 4096, 1997 port, 1998 10000, 1999 MACH_PORT_NULL); 2000 T_QUIET; T_ASSERT_MACH_SUCCESS(mr, "mach_msg() recieve of message from client"); 2001 2002 /* 2003 * take the stackshot to verify that the stackshot wait info shows our (the server) PID 2004 * for the scenario where the server has received the message and copied in the send-once right. 2005 */ 2006 T_LOG("Taking stackshot for part 2 coverage"); 2007 check_srp_test("srp", SRP_TEST_PID); 2008 2009 /* cleanup - kill the client */ 2010 T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client"); 2011 T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit"); 2012 2013 // do it again, but using kevents 2014 T_LOG("Launching client"); 2015 sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL); 2016 T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid); 2017 T_LOG("Spawned client as PID %d", client_pid); 2018 2019 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 2020 T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear"); 2021 2022 /* 2023 * can_continue indicates the client has signaled us, but we want to make 2024 * sure they've actually blocked sending their mach message. It's cheesy, but 2025 * sleep() works for this. 2026 */ 2027 sleep(1); 2028 2029 dispatch_mach_t dispatch_mach = dispatch_mach_create(SRP_SERVICE_NAME, machdq, 2030 ^(dispatch_mach_reason_t reason, 2031 dispatch_mach_msg_t message, 2032 mach_error_t error __unused) { 2033 switch (reason) { 2034 case DISPATCH_MACH_MESSAGE_RECEIVED: { 2035 size_t size = 0; 2036 mach_msg_header_t *msg __unused = dispatch_mach_msg_get_msg(message, &size); 2037 T_LOG("server: recieved %ld byte message", size); 2038 check_srp_test("turnstile_port_thread", SRP_TEST_THREAD); 2039 T_LOG("server: letting client go"); 2040 // drop the message on the ground, we'll kill the client later 2041 dispatch_semaphore_signal(can_continue); 2042 break; 2043 } 2044 default: 2045 break; 2046 } 2047 }); 2048 2049 dispatch_mach_connect(dispatch_mach, port, MACH_PORT_NULL, NULL); 2050 2051 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 2052 2053 /* cleanup - kill the client */ 2054 T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client"); 2055 T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit"); 2056} 2057 2058T_HELPER_DECL(throtlled_sp_client, 2059 "client that uses a connection port to send a message to a server") 2060{ 2061 mach_port_t conn_port, service_port, reply_port, *stash; 2062 mach_msg_type_number_t stash_cnt = 0; 2063 2064 kern_return_t kr = mach_ports_lookup(mach_task_self(), &stash, &stash_cnt); 2065 T_ASSERT_MACH_SUCCESS(kr, "mach_ports_lookup"); 2066 2067 service_port = stash[0]; 2068 T_ASSERT_TRUE(MACH_PORT_VALID(service_port), "valid service port"); 2069 mig_deallocate((vm_address_t)stash, stash_cnt * sizeof(stash[0])); 2070 2071 mach_port_options_t opts = { 2072 .flags = MPO_INSERT_SEND_RIGHT 2073 | MPO_CONNECTION_PORT, 2074 .service_port_name = service_port, 2075 }; 2076 2077 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port); 2078 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct"); 2079 2080 mach_port_options_t opts2 = { 2081 .flags = MPO_REPLY_PORT 2082 }; 2083 kr = mach_port_construct(mach_task_self(), &opts2, 0ull, &reply_port); 2084 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct"); 2085 2086 /* XPC-like check-in message */ 2087 struct { 2088 mach_msg_header_t header; 2089 mach_msg_port_descriptor_t recvp; 2090 mach_msg_port_descriptor_t sendp; 2091 } checkin_message = { 2092 .header = 2093 { 2094 .msgh_remote_port = service_port, 2095 .msgh_local_port = MACH_PORT_NULL, 2096 .msgh_size = sizeof(checkin_message), 2097 .msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0), 2098 }, 2099 .recvp = 2100 { 2101 .type = MACH_MSG_PORT_DESCRIPTOR, 2102 .name = conn_port, 2103 .disposition = MACH_MSG_TYPE_MOVE_RECEIVE, 2104 }, 2105 .sendp = 2106 { 2107 .type = MACH_MSG_PORT_DESCRIPTOR, 2108 .name = reply_port, 2109 .disposition = MACH_MSG_TYPE_MAKE_SEND, 2110 } 2111 }; 2112 dispatch_mach_msg_t dmsg = dispatch_mach_msg_create((mach_msg_header_t *)&checkin_message, sizeof(checkin_message), 2113 DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL); 2114 2115 dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL); 2116 dispatch_mach_t dchannel = dispatch_mach_create(THROTTLED_SERVICE_NAME, machdq, 2117 ^(dispatch_mach_reason_t reason, 2118 dispatch_mach_msg_t message __unused, 2119 mach_error_t error __unused) { 2120 switch (reason) { 2121 case DISPATCH_MACH_CONNECTED: 2122 T_LOG("mach channel connected"); 2123 break; 2124 case DISPATCH_MACH_MESSAGE_SENT: 2125 T_LOG("sent mach message"); 2126 break; 2127 default: 2128 T_ASSERT_FAIL("Unexpected reply to channel reason %lu", reason); 2129 } 2130 }); 2131 dispatch_mach_connect(dchannel, reply_port, service_port, dmsg); 2132 dispatch_release(dmsg); 2133 2134 struct { 2135 mach_msg_header_t header; 2136 uint64_t request_id; 2137 } request = { 2138 .header = 2139 { 2140 .msgh_size = sizeof(request), 2141 .msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE), 2142 }, 2143 .request_id = 1, 2144 }; 2145 dispatch_mach_msg_t dmsg2 = dispatch_mach_msg_create((mach_msg_header_t *)&request, sizeof(request), 2146 DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL); 2147 2148 dispatch_mach_reason_t reason; 2149 mach_error_t error; 2150 2151 /* send the check-in message and the request message */ 2152 dispatch_mach_msg_t dreply = dispatch_mach_send_with_result_and_wait_for_reply(dchannel, 2153 dmsg2, 0, DISPATCH_MACH_SEND_DEFAULT, &reason, &error); 2154 dispatch_release(dmsg2); 2155 2156 /* not expected to execute as parent will SIGKILL client */ 2157 T_ASSERT_FAIL("client process exiting after receiving %s reply", dreply ? "non-null" : "null"); 2158} 2159 2160static void 2161check_throttled_sp(const char *test_name, uint64_t context, bool is_throttled) 2162{ 2163 struct scenario scenario = { 2164 .name = test_name, 2165 .quiet = false, 2166 .flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT), 2167 }; 2168 2169 T_LOG("taking stackshot %s", test_name); 2170 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2171 parse_stackshot(PARSE_STACKSHOT_THROTTLED_SP, ssbuf, sslen, 2172 @{sp_throttled_expected_ctxt_key: @(context), 2173 sp_throttled_expect_flag: @(is_throttled)}); 2174 }); 2175} 2176 2177/* Take stackshot when a client is blocked on the service port of a process, in the scenario when 2178 * the process with the receive right for the service port is: 2179 * (a) Monitoring the service port using kevents 2180 * (b) Not monitoring the service port 2181 */ 2182T_DECL(throttled_sp, 2183 "test that service port throttled flag is propagated to the stackshot correctly", T_META_TAG_VM_PREFERRED) 2184{ 2185 mach_port_t service_port; 2186 __block dispatch_semaphore_t can_continue = dispatch_semaphore_create(0); 2187 2188 char path[PATH_MAX]; 2189 uint32_t path_size = sizeof(path); 2190 T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath"); 2191 char *client_args[] = { path, "-n", "throtlled_sp_client", NULL }; 2192 2193 __block uint64_t thread_id = 0; 2194 pid_t client_pid; 2195 int mark_throttled; 2196 2197 struct mach_service_port_info sp_info = {}; 2198 strcpy(sp_info.mspi_string_name, THROTTLED_SERVICE_NAME); 2199 sp_info.mspi_domain_type = (uint8_t)1; 2200 kern_return_t kr; 2201 2202 mach_port_options_t opts = { 2203 .flags = MPO_SERVICE_PORT | MPO_INSERT_SEND_RIGHT | MPO_CONTEXT_AS_GUARD | MPO_STRICT | MPO_TEMPOWNER, 2204 .service_port_info = &sp_info, 2205 }; 2206 2207 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &service_port); 2208 T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct %u", service_port); 2209 2210 /* Setup a dispatch source to monitor the service port similar to how launchd does. */ 2211 dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL); 2212 dispatch_source_t mach_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_MACH_RECV, service_port, 2213 DISPATCH_MACH_RECV_SYNC_PEEK, machdq); 2214 dispatch_source_set_event_handler(mach_src, ^{ 2215 pthread_threadid_np(NULL, &thread_id); 2216 dispatch_semaphore_signal(can_continue); 2217 }); 2218 dispatch_activate(mach_src); 2219 2220 /* Stash the port in task to make sure child also gets it */ 2221 kr = mach_ports_register(mach_task_self(), &service_port, 1); 2222 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_ports_register service port"); 2223 2224 mark_throttled = 1; 2225 kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled), 2226 MACH_PORT_SERVICE_THROTTLED_COUNT); 2227 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mark service port as throttled"); 2228 2229 int rc = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL); 2230 T_QUIET; T_ASSERT_POSIX_ZERO(rc, "spawned process '%s' with PID %d", client_args[0], client_pid); 2231 T_LOG("Spawned client as PID %d", client_pid); 2232 2233 dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER); 2234 2235 /* The service port has received the check-in message. Take stackshot for scenario (a). */ 2236 check_throttled_sp("throttled_service_port_monitored", thread_id, true); 2237 2238 /* This simulates a throttled spawn when the service port is no longer monitored. */ 2239 dispatch_source_cancel(mach_src); 2240 2241 /* Take stackshot for scenario (b) */ 2242 check_throttled_sp("throttled_service_port_unmonitored", (uint64_t)getpid(), true); 2243 2244 mark_throttled = 0; 2245 kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled), 2246 MACH_PORT_SERVICE_THROTTLED_COUNT); 2247 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "unmark service port as throttled"); 2248 2249 /* Throttled flag should not be set when the port is not throttled. */ 2250 check_throttled_sp("unthrottled_service_port_unmonitored", (uint64_t)getpid(), false); 2251 2252 /* cleanup - kill the client */ 2253 T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client"); 2254 T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit"); 2255} 2256 2257 2258char *const clpcctrl_path = "/usr/local/bin/clpcctrl"; 2259 2260static void 2261run_clpcctrl(char *const argv[]) { 2262 posix_spawnattr_t sattr; 2263 pid_t pid; 2264 int wstatus; 2265 2266 T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, argv[0], NULL, NULL, argv, NULL), "spawn clpcctrl"); 2267 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &wstatus, 0), "wait for clpcctrl"); 2268 T_QUIET; T_ASSERT_TRUE(WIFEXITED(wstatus), "clpcctrl exited normally"); 2269 T_QUIET; T_ASSERT_POSIX_ZERO(WEXITSTATUS(wstatus), "clpcctrl exited successfully"); 2270 2271 uint64_t sched_recommended_cores = 1; 2272 size_t sched_recommended_cores_sz = sizeof(uint64_t); 2273 T_QUIET; T_ASSERT_POSIX_SUCCESS( 2274 sysctlbyname("kern.sched_recommended_cores", &sched_recommended_cores, &sched_recommended_cores_sz, NULL, 0), 2275 "get kern.sched_recommended_cores"); 2276 T_LOG("Recommended cores: 0x%llx", sched_recommended_cores); 2277} 2278 2279static void 2280restore_clpcctrl() { 2281 run_clpcctrl((char *const []) { clpcctrl_path, "-d", NULL }); 2282} 2283 2284#define CLUSTER_TYPE_SMP 0 2285#define CLUSTER_TYPE_E 1 2286#define CLUSTER_TYPE_P 2 2287 2288void test_stackshot_cpu_info(void *ssbuf, size_t sslen, int exp_cpus, NSArray *exp_cluster_types) { 2289 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2290 bool seen = false; 2291 int singlethread_override = 0; 2292 size_t singlethread_override_sz = sizeof(singlethread_override); 2293 T_QUIET; T_ASSERT_POSIX_SUCCESS( 2294 sysctlbyname("kern.stackshot_single_thread", &singlethread_override, &singlethread_override_sz, NULL, 0), 2295 "get kern.stackshot_single_thread"); 2296 if (singlethread_override) { 2297 T_LOG("skipping cpu count/type check due to single-thread override (kern.stackshot_single_thread=1)"); 2298 return; 2299 } 2300 2301 KCDATA_ITER_FOREACH(iter) { 2302 if ((kcdata_iter_type(iter) != KCDATA_TYPE_ARRAY) || (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_LATENCY_INFO_CPU)) { 2303 continue; 2304 } 2305 2306 seen = true; 2307 2308 /* Check ncpus */ 2309 int ncpus = kcdata_iter_array_elem_count(iter); 2310 if (exp_cpus != -1) { 2311 T_QUIET; T_ASSERT_EQ(exp_cpus, ncpus, "Expected number of CPUs matches number of CPUs used for stackshot"); 2312 } 2313 2314 if (exp_cluster_types == nil) { 2315 continue; 2316 } 2317 2318 /* Check cluster types */ 2319 struct stackshot_latency_cpu *latencies = (struct stackshot_latency_cpu *) kcdata_iter_payload(iter); 2320 for (int i = 0; i < ncpus; i++) { 2321 NSNumber *cluster_type = [NSNumber numberWithInt:latencies[i].cluster_type]; 2322 T_QUIET; T_ASSERT_TRUE([exp_cluster_types containsObject:cluster_type], "Type of CPU cluster in expected CPU cluster types"); 2323 } 2324 } 2325 2326 T_QUIET; T_ASSERT_TRUE(seen || !is_development_kernel(), "Seen CPU latency info or is release kernel"); 2327} 2328 2329void test_stackshot_with_clpcctrl(char *const name, char *const argv[], int exp_cpus, NSArray *exp_cluster_types) { 2330 T_LOG("Stackshot CLPC scenario %s", name); 2331 run_clpcctrl(argv); 2332 struct scenario scenario = { 2333 .name = name, 2334 .flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO | 2335 STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS) 2336 }; 2337 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2338 parse_stackshot(0, ssbuf, sslen, nil); 2339 test_stackshot_cpu_info(ssbuf, sslen, exp_cpus, exp_cluster_types); 2340 }); 2341} 2342 2343T_DECL(core_masks, 2344 "test that stackshot works under various core masks on ARM systems", 2345 T_META_REQUIRES_SYSCTL_EQ("hw.optional.arm64", 1), 2346 T_META_REQUIRES_SYSCTL_NE("kern.kasan.available", 1), /* rdar://115577993 */ 2347 XNU_T_META_REQUIRES_DEVELOPMENT_KERNEL, 2348 T_META_REQUIRE_NOT_VIRTUALIZED, 2349 T_META_RUN_CONCURRENTLY(false), 2350 T_META_TAG_VM_NOT_ELIGIBLE, 2351 T_META_ENABLED(!TARGET_OS_VISION)) // disable for visionOS: device may not be stable with many cores masked off (127904530) 2352{ 2353 /* 2354 * Make sure we're not in a release kernel 2355 * (cannot check with T_META; only one sysctl T_META at a time will work) 2356 */ 2357 if (!is_development_kernel()) { 2358 T_SKIP("test was not run because kernel is release; cannot set core masks"); 2359 return; 2360 } 2361 2362 /* 2363 * rdar://115577993 - CLPC compiles as release in KASAN-variant builds, 2364 * preventing clpcctrl from working. For now, skip this. (Cannot check 2365 * with T_META; only one sysctl T_META at a time will work) 2366 */ 2367 int kasan_avail = 0; 2368 size_t kasan_avail_sz = sizeof(kasan_avail); 2369 sysctlbyname("kern.kasan.available", &kasan_avail, &kasan_avail_sz, NULL, 0); 2370 if (kasan_avail) { 2371 T_SKIP("test was not run because kernel is KASAN; cannot set core masks (see rdar://115577993)"); 2372 return; 2373 } 2374 2375 2376 T_ATEND(restore_clpcctrl); 2377 2378 /* Test with 1 and 2 CPUs for basic functionality */ 2379 test_stackshot_with_clpcctrl( 2380 "core_masks_1cpu", (char *const[]) {clpcctrl_path, "-c", "1", NULL}, 2381 1, nil); 2382 2383 test_stackshot_with_clpcctrl( 2384 "core_masks_2cpus", (char *const[]) {clpcctrl_path, "-c", "2", NULL}, 2385 2, nil); 2386 2387 /* Check nperflevels to see if we're on an AMP system */ 2388 int nperflevels = 1; 2389 size_t nperflevels_sz = sizeof(int); 2390 T_ASSERT_POSIX_SUCCESS( 2391 sysctlbyname("hw.nperflevels", &nperflevels, &nperflevels_sz, NULL, 0), 2392 "get hw.nperflevels"); 2393 if (nperflevels == 1) { 2394 T_LOG("On SMP system, skipping stackshot core_masks AMP tests"); 2395 return; 2396 } 2397 2398 T_QUIET; T_ASSERT_EQ(nperflevels, 2, "nperflevels is 1 or 2"); 2399 T_LOG("On AMP system, performing stackshot core_masks AMP tests"); 2400 2401 /* Perform AMP tests with different cluster types active */ 2402 test_stackshot_with_clpcctrl( 2403 "core_masks_amp_allcpus", 2404 (char *const[]) {clpcctrl_path, "-C", "all", NULL}, 2405 -1, @[@CLUSTER_TYPE_E, @CLUSTER_TYPE_P]); 2406 2407 test_stackshot_with_clpcctrl( 2408 "core_masks_amp_ecpus", 2409 (char *const[]) {clpcctrl_path, "-C", "e", NULL}, 2410 -1, @[@CLUSTER_TYPE_E]); 2411 2412 test_stackshot_with_clpcctrl( 2413 "core_masks_amp_pcpus", 2414 (char *const[]) {clpcctrl_path, "-C", "p", NULL}, 2415 -1, @[@CLUSTER_TYPE_P]); 2416} 2417 2418#pragma mark performance tests 2419 2420#define SHOULD_REUSE_SIZE_HINT 0x01 2421#define SHOULD_USE_DELTA 0x02 2422#define SHOULD_TARGET_SELF 0x04 2423 2424static void 2425stackshot_perf(unsigned int options) 2426{ 2427 struct scenario scenario = { 2428 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS 2429 | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT), 2430 }; 2431 2432 dt_stat_t size = dt_stat_create("bytes", "size"); 2433 dt_stat_time_t duration = dt_stat_time_create("duration"); 2434 scenario.timer = duration; 2435 2436 if (options & SHOULD_TARGET_SELF) { 2437 scenario.target_pid = getpid(); 2438 } 2439 2440 while (!dt_stat_stable(duration) || !dt_stat_stable(size)) { 2441 __block uint64_t last_time = 0; 2442 __block uint32_t size_hint = 0; 2443 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2444 dt_stat_add(size, (double)sslen); 2445 last_time = stackshot_timestamp(ssbuf, sslen); 2446 size_hint = (uint32_t)sslen; 2447 }); 2448 if (options & SHOULD_USE_DELTA) { 2449 scenario.since_timestamp = last_time; 2450 scenario.flags |= STACKSHOT_COLLECT_DELTA_SNAPSHOT; 2451 } 2452 if (options & SHOULD_REUSE_SIZE_HINT) { 2453 scenario.size_hint = size_hint; 2454 } 2455 } 2456 2457 dt_stat_finalize(duration); 2458 dt_stat_finalize(size); 2459} 2460 2461static void 2462stackshot_flag_perf_noclobber(uint64_t flag, char *flagname) 2463{ 2464 struct scenario scenario = { 2465 .quiet = true, 2466 .flags = (flag | STACKSHOT_KCDATA_FORMAT), 2467 }; 2468 2469 dt_stat_t duration = dt_stat_create("nanoseconds per thread", "%s_duration", flagname); 2470 dt_stat_t size = dt_stat_create("bytes per thread", "%s_size", flagname); 2471 T_LOG("Testing \"%s\" = 0x%" PRIx64, flagname, flag); 2472 2473 while (!dt_stat_stable(duration) || !dt_stat_stable(size)) { 2474 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2475 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2476 unsigned long no_threads = 0; 2477 mach_timebase_info_data_t timebase = {0, 0}; 2478 uint64_t stackshot_duration = 0; 2479 int found = 0; 2480 T_QUIET; T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "stackshot buffer"); 2481 2482 KCDATA_ITER_FOREACH(iter) { 2483 switch(kcdata_iter_type(iter)) { 2484 case STACKSHOT_KCTYPE_THREAD_SNAPSHOT: { 2485 found |= 1; 2486 no_threads ++; 2487 break; 2488 } 2489 case STACKSHOT_KCTYPE_STACKSHOT_DURATION: { 2490 struct stackshot_duration *ssd = kcdata_iter_payload(iter); 2491 stackshot_duration = ssd->stackshot_duration; 2492 found |= 2; 2493 break; 2494 } 2495 case KCDATA_TYPE_TIMEBASE: { 2496 found |= 4; 2497 mach_timebase_info_data_t *tb = kcdata_iter_payload(iter); 2498 memcpy(&timebase, tb, sizeof(timebase)); 2499 break; 2500 } 2501 } 2502 } 2503 2504 T_QUIET; T_ASSERT_EQ(found, 0x7, "found everything needed"); 2505 2506 uint64_t ns = (stackshot_duration * timebase.numer) / timebase.denom; 2507 uint64_t per_thread_ns = ns / no_threads; 2508 uint64_t per_thread_size = sslen / no_threads; 2509 2510 dt_stat_add(duration, per_thread_ns); 2511 dt_stat_add(size, per_thread_size); 2512 }); 2513 } 2514 2515 dt_stat_finalize(duration); 2516 dt_stat_finalize(size); 2517} 2518 2519static void 2520stackshot_flag_perf(uint64_t flag, char *flagname) 2521{ 2522 /* 2523 * STACKSHOT_NO_IO_STATS disables data collection, so set it for 2524 * more accurate perfdata collection. 2525 */ 2526 flag |= STACKSHOT_NO_IO_STATS; 2527 2528 stackshot_flag_perf_noclobber(flag, flagname); 2529} 2530 2531 2532T_DECL(flag_perf, "test stackshot performance with different flags set", T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE) 2533{ 2534 stackshot_flag_perf_noclobber(STACKSHOT_NO_IO_STATS, "baseline"); 2535 stackshot_flag_perf_noclobber(0, "io_stats"); 2536 2537 stackshot_flag_perf(STACKSHOT_THREAD_WAITINFO, "thread_waitinfo"); 2538 stackshot_flag_perf(STACKSHOT_GET_DQ, "get_dq"); 2539 stackshot_flag_perf(STACKSHOT_SAVE_LOADINFO, "save_loadinfo"); 2540 stackshot_flag_perf(STACKSHOT_GET_GLOBAL_MEM_STATS, "get_global_mem_stats"); 2541 stackshot_flag_perf(STACKSHOT_SAVE_KEXT_LOADINFO, "save_kext_loadinfo"); 2542 stackshot_flag_perf(STACKSHOT_SAVE_IMP_DONATION_PIDS, "save_imp_donation_pids"); 2543 stackshot_flag_perf(STACKSHOT_ENABLE_BT_FAULTING, "enable_bt_faulting"); 2544 stackshot_flag_perf(STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT, "collect_sharedcache_layout"); 2545 stackshot_flag_perf(STACKSHOT_ENABLE_UUID_FAULTING, "enable_uuid_faulting"); 2546 stackshot_flag_perf(STACKSHOT_THREAD_GROUP, "thread_group"); 2547 stackshot_flag_perf(STACKSHOT_SAVE_JETSAM_COALITIONS, "save_jetsam_coalitions"); 2548 stackshot_flag_perf(STACKSHOT_INSTRS_CYCLES, "instrs_cycles"); 2549 stackshot_flag_perf(STACKSHOT_ASID, "asid"); 2550 stackshot_flag_perf(STACKSHOT_EXCLAVES, "all_exclaves"); 2551 stackshot_flag_perf(STACKSHOT_EXCLAVES | STACKSHOT_ASID, "all_exclaves_and_asid"); 2552 stackshot_flag_perf(STACKSHOT_SKIP_EXCLAVES, "skip_exclaves"); 2553} 2554 2555T_DECL(perf_no_size_hint, "test stackshot performance with no size hint", 2556 T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE) 2557{ 2558 stackshot_perf(0); 2559} 2560 2561T_DECL(perf_size_hint, "test stackshot performance with size hint", 2562 T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE) 2563{ 2564 stackshot_perf(SHOULD_REUSE_SIZE_HINT); 2565} 2566 2567T_DECL(perf_process, "test stackshot performance targeted at process", 2568 T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE) 2569{ 2570 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_TARGET_SELF); 2571} 2572 2573T_DECL(perf_delta, "test delta stackshot performance", 2574 T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE) 2575{ 2576 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA); 2577} 2578 2579T_DECL(perf_delta_no_exclaves, "test delta stackshot performance without Exclaves", 2580 T_META_REQUIRES_SYSCTL_EQ("kern.exclaves_status", 1), 2581 T_META_REQUIRES_SYSCTL_EQ("kern.exclaves_inspection_status", 1), 2582 T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE) 2583{ 2584 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | STACKSHOT_SKIP_EXCLAVES); 2585} 2586 2587T_DECL(perf_delta_process, "test delta stackshot performance targeted at a process", 2588 T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE) 2589{ 2590 stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | SHOULD_TARGET_SELF); 2591} 2592 2593T_DECL(stackshot_entitlement_report_test, "test stackshot entitlement report", T_META_TAG_VM_PREFERRED) 2594{ 2595 int sysctlValue = 1; 2596 T_ASSERT_POSIX_SUCCESS( 2597 sysctlbyname("debug.stackshot_entitlement_send_batch", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), 2598 "set debug.stackshot_entitlement_send_batch=1"); 2599 // having a way to verify that the coreanalytics event was received would be even better 2600 // See rdar://74197197 2601 T_PASS("entitlement test ran"); 2602} 2603 2604static void 2605expect_os_build_version_in_stackshot(void *ssbuf, size_t sslen) 2606{ 2607 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2608 2609 bool saw_os_build_version = false; 2610 iter = kcdata_iter_next(iter); 2611 2612 KCDATA_ITER_FOREACH(iter) { 2613 switch (kcdata_iter_type(iter)) { 2614 case STACKSHOT_KCTYPE_OS_BUILD_VERSION: 2615 saw_os_build_version = true; 2616 T_LOG("Found os build version in stackshot: %s", kcdata_iter_payload(iter)); 2617 return; 2618 2619 default: 2620 break; 2621 } 2622 } 2623 2624 T_ASSERT_FAIL("didn't see os build version in stackshot"); 2625} 2626 2627T_DECL(os_build_version, "test stackshot contains os build version", T_META_TAG_VM_PREFERRED) 2628{ 2629 2630 struct scenario scenario = { 2631 .name = "os-build-version", 2632 .flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT), 2633 }; 2634 2635 T_LOG("attempting to take stackshot with an os build version"); 2636 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 2637 expect_os_build_version_in_stackshot(ssbuf, sslen); 2638 }); 2639} 2640 2641static uint64_t 2642stackshot_timestamp(void *ssbuf, size_t sslen) 2643{ 2644 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2645 2646 uint32_t type = kcdata_iter_type(iter); 2647 if (type != KCDATA_BUFFER_BEGIN_STACKSHOT && type != KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT) { 2648 T_ASSERT_FAIL("invalid kcdata type %u", kcdata_iter_type(iter)); 2649 } 2650 2651 iter = kcdata_iter_find_type(iter, KCDATA_TYPE_MACH_ABSOLUTE_TIME); 2652 T_QUIET; 2653 T_ASSERT_TRUE(kcdata_iter_valid(iter), "timestamp found in stackshot"); 2654 2655 return *(uint64_t *)kcdata_iter_payload(iter); 2656} 2657 2658#define TEST_THREAD_NAME "stackshot_test_thread" 2659 2660static void 2661parse_thread_group_stackshot(void **ssbuf, size_t sslen) 2662{ 2663 bool seen_thread_group_snapshot = false; 2664 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2665 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, 2666 "buffer provided is a stackshot"); 2667 2668 NSMutableSet *thread_groups = [[NSMutableSet alloc] init]; 2669 2670 iter = kcdata_iter_next(iter); 2671 KCDATA_ITER_FOREACH(iter) { 2672 switch (kcdata_iter_type(iter)) { 2673 case KCDATA_TYPE_ARRAY: { 2674 T_QUIET; 2675 T_ASSERT_TRUE(kcdata_iter_array_valid(iter), 2676 "checked that array is valid"); 2677 2678 if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_THREAD_GROUP_SNAPSHOT) { 2679 continue; 2680 } 2681 2682 seen_thread_group_snapshot = true; 2683 2684 if (kcdata_iter_array_elem_size(iter) >= sizeof(struct thread_group_snapshot_v3)) { 2685 struct thread_group_snapshot_v3 *tgs_array = kcdata_iter_payload(iter); 2686 for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) { 2687 struct thread_group_snapshot_v3 *tgs = tgs_array + j; 2688 [thread_groups addObject:@(tgs->tgs_id)]; 2689 } 2690 } 2691 else { 2692 struct thread_group_snapshot *tgs_array = kcdata_iter_payload(iter); 2693 for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) { 2694 struct thread_group_snapshot *tgs = tgs_array + j; 2695 [thread_groups addObject:@(tgs->tgs_id)]; 2696 } 2697 } 2698 break; 2699 } 2700 } 2701 } 2702 KCDATA_ITER_FOREACH(iter) { 2703 NSError *error = nil; 2704 2705 switch (kcdata_iter_type(iter)) { 2706 2707 case KCDATA_TYPE_CONTAINER_BEGIN: { 2708 T_QUIET; 2709 T_ASSERT_TRUE(kcdata_iter_container_valid(iter), 2710 "checked that container is valid"); 2711 2712 if (kcdata_iter_container_type(iter) != STACKSHOT_KCCONTAINER_THREAD) { 2713 break; 2714 } 2715 2716 NSDictionary *container = parseKCDataContainer(&iter, &error); 2717 T_QUIET; T_ASSERT_NOTNULL(container, "parsed thread container from stackshot"); 2718 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container"); 2719 2720 int tg = [container[@"thread_snapshots"][@"thread_group"] intValue]; 2721 2722 T_ASSERT_TRUE([thread_groups containsObject:@(tg)], "check that the thread group the thread is in exists"); 2723 2724 break; 2725 }; 2726 2727 } 2728 } 2729 T_ASSERT_TRUE(seen_thread_group_snapshot, "check that we have seen a thread group snapshot"); 2730} 2731 2732static void 2733verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count) 2734{ 2735 uuid_t cur_shared_cache_uuid; 2736 __block uint32_t lib_index = 0, libs_found = 0; 2737 2738 _dyld_get_shared_cache_uuid(cur_shared_cache_uuid); 2739 int result = dyld_shared_cache_iterate_text(cur_shared_cache_uuid, ^(const dyld_shared_cache_dylib_text_info* info) { 2740 T_QUIET; T_ASSERT_LT(lib_index, uuid_count, "dyld_shared_cache_iterate_text exceeded number of libraries returned by kernel"); 2741 2742 libs_found++; 2743 struct dyld_uuid_info_64 *cur_stackshot_uuid_entry = &uuids[lib_index]; 2744 T_QUIET; T_ASSERT_EQ(memcmp(info->dylibUuid, cur_stackshot_uuid_entry->imageUUID, sizeof(info->dylibUuid)), 0, 2745 "dyld returned UUID doesn't match kernel returned UUID"); 2746 T_QUIET; T_ASSERT_EQ(info->loadAddressUnslid, cur_stackshot_uuid_entry->imageLoadAddress, 2747 "dyld returned load address doesn't match kernel returned load address"); 2748 lib_index++; 2749 }); 2750 2751 T_ASSERT_EQ(result, 0, "iterate shared cache layout"); 2752 T_ASSERT_EQ(libs_found, uuid_count, "dyld iterator returned same number of libraries as kernel"); 2753 2754 T_LOG("verified %d libraries from dyld shared cache", libs_found); 2755} 2756 2757static void 2758check_shared_cache_uuid(uuid_t imageUUID) 2759{ 2760 static uuid_t shared_cache_uuid; 2761 static dispatch_once_t read_shared_cache_uuid; 2762 2763 dispatch_once(&read_shared_cache_uuid, ^{ 2764 T_QUIET; 2765 T_ASSERT_TRUE(_dyld_get_shared_cache_uuid(shared_cache_uuid), "retrieve current shared cache UUID"); 2766 }); 2767 T_QUIET; T_ASSERT_EQ(uuid_compare(shared_cache_uuid, imageUUID), 0, 2768 "dyld returned UUID doesn't match kernel returned UUID for system shared cache"); 2769} 2770 2771/* 2772 * extra dictionary contains data relevant for the given flags: 2773 * PARSE_STACKSHOT_ZOMBIE: zombie_child_pid_key -> @(pid) 2774 * PARSE_STACKSHOT_POSTEXEC: postexec_child_unique_pid_key -> @(unique_pid) 2775 */ 2776static void 2777parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra) 2778{ 2779 bool delta = (stackshot_parsing_flags & PARSE_STACKSHOT_DELTA); 2780 bool expect_sharedcache_child = (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_FLAGS); 2781 bool expect_zombie_child = (stackshot_parsing_flags & PARSE_STACKSHOT_ZOMBIE); 2782 bool expect_postexec_child = (stackshot_parsing_flags & PARSE_STACKSHOT_POSTEXEC); 2783 bool expect_cseg_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_CSEG); 2784 bool expect_translated_child = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSLATED); 2785 bool expect_shared_cache_layout = false; 2786 bool expect_shared_cache_uuid = !delta; 2787 bool expect_dispatch_queue_label = (stackshot_parsing_flags & PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL); 2788 bool expect_turnstile_lock = (stackshot_parsing_flags & PARSE_STACKSHOT_TURNSTILEINFO); 2789 bool expect_srp_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_SRP); 2790 bool expect_sp_throttled = (stackshot_parsing_flags & PARSE_STACKSHOT_THROTTLED_SP); 2791 bool expect_exec_inprogress = (stackshot_parsing_flags & PARSE_STACKSHOT_EXEC_INPROGRESS); 2792 bool expect_transitioning_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSITIONING); 2793 bool expect_asyncstack = (stackshot_parsing_flags & PARSE_STACKSHOT_ASYNCSTACK); 2794 bool expect_driverkit = (stackshot_parsing_flags & PARSE_STACKSHOT_DRIVERKIT); 2795 bool expect_suspendinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_SUSPENDINFO); 2796 bool found_zombie_child = false, found_postexec_child = false, found_shared_cache_layout = false, found_shared_cache_uuid = false; 2797 bool found_translated_child = false, found_transitioning_task = false; 2798 bool found_dispatch_queue_label = false, found_turnstile_lock = false; 2799 bool found_cseg_waitinfo = false, found_srp_waitinfo = false; 2800 bool found_sharedcache_child = false, found_sharedcache_badflags = false, found_sharedcache_self = false; 2801 bool found_asyncstack = false; 2802 bool found_throttled_service = false; 2803 bool found_exclaves = false; 2804 bool expect_single_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TARGETPID); 2805 uint64_t srp_expected_threadid = 0; 2806 pid_t zombie_child_pid = -1, srp_expected_pid = -1, sharedcache_child_pid = -1, throttled_service_ctx = -1; 2807 pid_t translated_child_pid = -1, transistioning_task_pid = -1; 2808 bool sharedcache_child_sameaddr = false, is_throttled = false; 2809 uint64_t postexec_child_unique_pid = 0, cseg_expected_threadid = 0; 2810 uint64_t sharedcache_child_flags = 0, sharedcache_self_flags = 0; 2811 uint64_t asyncstack_threadid = 0; 2812 NSArray *asyncstack_stack = nil; 2813 char *inflatedBufferBase = NULL; 2814 pid_t exec_inprogress_pid = -1; 2815 void (^exec_inprogress_cb)(uint64_t, uint64_t) = NULL; 2816 int exec_inprogress_found = 0; 2817 uint64_t exec_inprogress_containerid = 0; 2818 void (^driverkit_cb)(pid_t) = NULL; 2819 NSMutableDictionary *sharedCaches = [NSMutableDictionary new]; 2820 uint64_t expected_num_threads = 0, expected_num_tasks = 0, found_percpu_threads = 0, found_tasks = 0, found_percpu_tasks = 0; 2821 NSMutableSet *seen_tasks = [NSMutableSet new]; 2822 2823 if (expect_shared_cache_uuid) { 2824 uuid_t shared_cache_uuid; 2825 if (!_dyld_get_shared_cache_uuid(shared_cache_uuid)) { 2826 T_LOG("Skipping verifying shared cache UUID in stackshot data because not running with a shared cache"); 2827 expect_shared_cache_uuid = false; 2828 } 2829 } 2830 2831 if (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_LAYOUT) { 2832 size_t shared_cache_length = 0; 2833 const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length); 2834 T_QUIET; T_ASSERT_NOTNULL(cache_header, "current process running with shared cache"); 2835 T_QUIET; T_ASSERT_GT(shared_cache_length, sizeof(struct _dyld_cache_header), "valid shared cache length populated by _dyld_get_shared_cache_range"); 2836 2837 if (_dyld_shared_cache_is_locally_built()) { 2838 T_LOG("device running with locally built shared cache, expect shared cache layout"); 2839 expect_shared_cache_layout = true; 2840 } else { 2841 T_LOG("device running with B&I built shared-cache, no shared cache layout expected"); 2842 } 2843 } 2844 2845 if (expect_sharedcache_child) { 2846 NSNumber* pid_num = extra[sharedcache_child_pid_key]; 2847 NSNumber* sameaddr_num = extra[sharedcache_child_sameaddr_key]; 2848 T_QUIET; T_ASSERT_NOTNULL(pid_num, "sharedcache child pid provided"); 2849 T_QUIET; T_ASSERT_NOTNULL(sameaddr_num, "sharedcache child addrsame provided"); 2850 sharedcache_child_pid = [pid_num intValue]; 2851 T_QUIET; T_ASSERT_GT(sharedcache_child_pid, 0, "sharedcache child pid greater than zero"); 2852 sharedcache_child_sameaddr = [sameaddr_num intValue]; 2853 T_QUIET; T_ASSERT_GE([sameaddr_num intValue], 0, "sharedcache child sameaddr is boolean (0 or 1)"); 2854 T_QUIET; T_ASSERT_LE([sameaddr_num intValue], 1, "sharedcache child sameaddr is boolean (0 or 1)"); 2855 } 2856 2857 if (expect_transitioning_task) { 2858 NSNumber* pid_num = extra[transitioning_pid_key]; 2859 T_ASSERT_NOTNULL(pid_num, "transitioning task pid provided"); 2860 transistioning_task_pid = [pid_num intValue]; 2861 } 2862 2863 if (expect_zombie_child) { 2864 NSNumber* pid_num = extra[zombie_child_pid_key]; 2865 T_QUIET; T_ASSERT_NOTNULL(pid_num, "zombie child pid provided"); 2866 zombie_child_pid = [pid_num intValue]; 2867 T_QUIET; T_ASSERT_GT(zombie_child_pid, 0, "zombie child pid greater than zero"); 2868 } 2869 2870 if (expect_postexec_child) { 2871 NSNumber* unique_pid_num = extra[postexec_child_unique_pid_key]; 2872 T_QUIET; T_ASSERT_NOTNULL(unique_pid_num, "postexec child unique pid provided"); 2873 postexec_child_unique_pid = [unique_pid_num unsignedLongLongValue]; 2874 T_QUIET; T_ASSERT_GT(postexec_child_unique_pid, 0ull, "postexec child unique pid greater than zero"); 2875 } 2876 2877 if (expect_cseg_waitinfo) { 2878 NSNumber* tid_num = extra[cseg_expected_threadid_key]; 2879 T_QUIET; T_ASSERT_NOTNULL(tid_num, "cseg's expected thread id provided"); 2880 cseg_expected_threadid = tid_num.unsignedLongValue; 2881 T_QUIET; T_ASSERT_GT(cseg_expected_threadid, UINT64_C(0), "compressor segment thread is present"); 2882 } 2883 2884 if (expect_srp_waitinfo) { 2885 NSNumber* threadid_num = extra[srp_expected_threadid_key]; 2886 NSNumber* pid_num = extra[srp_expected_pid_key]; 2887 T_QUIET; T_ASSERT_TRUE(threadid_num != nil || pid_num != nil, "expected SRP threadid or pid"); 2888 if (threadid_num != nil) { 2889 srp_expected_threadid = [threadid_num unsignedLongLongValue]; 2890 T_QUIET; T_ASSERT_GT(srp_expected_threadid, 0ull, "srp_expected_threadid greater than zero"); 2891 } 2892 if (pid_num != nil) { 2893 srp_expected_pid = [pid_num intValue]; 2894 T_QUIET; T_ASSERT_GT(srp_expected_pid, 0, "srp_expected_pid greater than zero"); 2895 } 2896 T_LOG("looking for SRP pid: %d threadid: %llu", srp_expected_pid, srp_expected_threadid); 2897 } 2898 2899 if (expect_sp_throttled) { 2900 NSNumber* ctx = extra[sp_throttled_expected_ctxt_key]; 2901 T_QUIET; T_ASSERT_TRUE(ctx != nil, "expected pid"); 2902 throttled_service_ctx = [ctx intValue]; 2903 T_QUIET; T_ASSERT_GT(throttled_service_ctx, 0, "expected pid greater than zero"); 2904 2905 NSNumber *throttled = extra[sp_throttled_expect_flag]; 2906 T_QUIET; T_ASSERT_TRUE(throttled != nil, "expected flag value"); 2907 is_throttled = ([throttled intValue] != 0); 2908 2909 T_LOG("Looking for service with ctxt: %d, thottled:%d", throttled_service_ctx, is_throttled); 2910 } 2911 2912 if (expect_translated_child) { 2913 NSNumber* pid_num = extra[translated_child_pid_key]; 2914 T_QUIET; T_ASSERT_NOTNULL(pid_num, "translated child pid provided"); 2915 translated_child_pid = [pid_num intValue]; 2916 T_QUIET; T_ASSERT_GT(translated_child_pid, 0, "translated child pid greater than zero"); 2917 } 2918 if (expect_exec_inprogress) { 2919 NSNumber* pid_num = extra[exec_inprogress_pid_key]; 2920 T_QUIET; T_ASSERT_NOTNULL(pid_num, "exec inprogress pid provided"); 2921 exec_inprogress_pid = [pid_num intValue]; 2922 T_QUIET; T_ASSERT_GT(exec_inprogress_pid, 0, "exec inprogress pid greater than zero"); 2923 2924 exec_inprogress_cb = extra[exec_inprogress_found_key]; 2925 T_QUIET; T_ASSERT_NOTNULL(exec_inprogress_cb, "exec inprogress found callback provided"); 2926 } 2927 if (expect_driverkit) { 2928 driverkit_cb = extra[driverkit_found_key]; 2929 T_QUIET; T_ASSERT_NOTNULL(driverkit_cb, "driverkit found callback provided"); 2930 } 2931 2932 if (expect_asyncstack) { 2933 NSNumber* threadid_id = extra[asyncstack_expected_threadid_key]; 2934 T_QUIET; T_ASSERT_NOTNULL(threadid_id, "asyncstack threadid provided"); 2935 asyncstack_threadid = [threadid_id unsignedLongLongValue]; 2936 asyncstack_stack = extra[asyncstack_expected_stack_key]; 2937 T_QUIET; T_ASSERT_NOTNULL(asyncstack_stack, "asyncstack expected stack provided"); 2938 } 2939 2940 kcdata_iter_t iter = kcdata_iter(ssbuf, sslen); 2941 if (delta) { 2942 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT, 2943 "buffer provided is a delta stackshot"); 2944 2945 iter = kcdata_iter_next(iter); 2946 } else { 2947 if (kcdata_iter_type(iter) != KCDATA_BUFFER_BEGIN_COMPRESSED) { 2948 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, 2949 "buffer provided is a stackshot"); 2950 2951 iter = kcdata_iter_next(iter); 2952 } else { 2953 /* we are dealing with a compressed buffer */ 2954 iter = kcdata_iter_next(iter); 2955 uint64_t compression_type = 0, totalout = 0, totalin = 0; 2956 2957 uint64_t *data; 2958 char *desc; 2959 for (int i = 0; i < 3; i ++) { 2960 kcdata_iter_get_data_with_desc(iter, &desc, (void **)&data, NULL); 2961 if (strcmp(desc, "kcd_c_type") == 0) { 2962 compression_type = *data; 2963 } else if (strcmp(desc, "kcd_c_totalout") == 0){ 2964 totalout = *data; 2965 } else if (strcmp(desc, "kcd_c_totalin") == 0){ 2966 totalin = *data; 2967 } 2968 2969 iter = kcdata_iter_next(iter); 2970 } 2971 2972 T_ASSERT_EQ(compression_type, UINT64_C(1), "zlib compression is used"); 2973 T_ASSERT_GT(totalout, UINT64_C(0), "successfully gathered how long the compressed buffer is"); 2974 T_ASSERT_GT(totalin, UINT64_C(0), "successfully gathered how long the uncompressed buffer will be at least"); 2975 2976 /* progress to the next kcdata item */ 2977 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "compressed stackshot found"); 2978 2979 char *bufferBase = kcdata_iter_payload(iter); 2980 2981 /* 2982 * zlib is used, allocate a buffer based on the metadata, plus 2983 * extra scratch space (+12.5%) in case totalin was inconsistent 2984 */ 2985 size_t inflatedBufferSize = totalin + (totalin >> 3); 2986 inflatedBufferBase = malloc(inflatedBufferSize); 2987 T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(inflatedBufferBase, "allocated temporary output buffer"); 2988 2989 z_stream zs; 2990 memset(&zs, 0, sizeof(zs)); 2991 T_QUIET; T_ASSERT_EQ(inflateInit(&zs), Z_OK, "inflateInit OK"); 2992 zs.next_in = (unsigned char *)bufferBase; 2993 T_QUIET; T_ASSERT_LE(totalout, (uint64_t)UINT_MAX, "stackshot is not too large"); 2994 zs.avail_in = (uInt)totalout; 2995 zs.next_out = (unsigned char *)inflatedBufferBase; 2996 T_QUIET; T_ASSERT_LE(inflatedBufferSize, (size_t)UINT_MAX, "output region is not too large"); 2997 zs.avail_out = (uInt)inflatedBufferSize; 2998 T_ASSERT_EQ(inflate(&zs, Z_FINISH), Z_STREAM_END, "inflated buffer"); 2999 inflateEnd(&zs); 3000 3001 T_ASSERT_EQ((uint64_t)zs.total_out, totalin, "expected number of bytes inflated"); 3002 3003 /* copy the data after the compressed area */ 3004 T_QUIET; T_ASSERT_GE((void *)bufferBase, ssbuf, 3005 "base of compressed stackshot is after the returned stackshot buffer"); 3006 size_t header_size = (size_t)(bufferBase - (char *)ssbuf); 3007 size_t data_after_compressed_size = sslen - totalout - header_size; 3008 T_QUIET; T_ASSERT_LE(data_after_compressed_size, 3009 inflatedBufferSize - zs.total_out, 3010 "footer fits in the buffer"); 3011 memcpy(inflatedBufferBase + zs.total_out, 3012 bufferBase + totalout, 3013 data_after_compressed_size); 3014 3015 iter = kcdata_iter(inflatedBufferBase, inflatedBufferSize); 3016 } 3017 } 3018 3019 KCDATA_ITER_FOREACH(iter) { 3020 NSError *error = nil; 3021 3022 switch (kcdata_iter_type(iter)) { 3023 case KCDATA_TYPE_ARRAY: { 3024 T_QUIET; 3025 T_ASSERT_TRUE(kcdata_iter_array_valid(iter), 3026 "checked that array is valid"); 3027 3028 NSMutableDictionary *array = parseKCDataArray(iter, &error); 3029 T_QUIET; T_ASSERT_NOTNULL(array, "parsed array from stackshot"); 3030 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing array"); 3031 3032 if (kcdata_iter_array_elem_type(iter) == STACKSHOT_KCTYPE_SYS_SHAREDCACHE_LAYOUT) { 3033 struct dyld_uuid_info_64 *shared_cache_uuids = kcdata_iter_payload(iter); 3034 uint32_t uuid_count = kcdata_iter_array_elem_count(iter); 3035 T_ASSERT_NOTNULL(shared_cache_uuids, "parsed shared cache layout array"); 3036 T_ASSERT_GT(uuid_count, 0, "returned valid number of UUIDs from shared cache"); 3037 verify_stackshot_sharedcache_layout(shared_cache_uuids, uuid_count); 3038 found_shared_cache_layout = true; 3039 } 3040 3041 break; 3042 } 3043 case KCDATA_TYPE_CONTAINER_BEGIN: { 3044 T_QUIET; 3045 T_ASSERT_TRUE(kcdata_iter_container_valid(iter), 3046 "checked that container is valid"); 3047 3048 uint64_t containerid = kcdata_iter_container_id(iter); 3049 uint32_t container_type = kcdata_iter_container_type(iter); 3050 3051 if (container_type == STACKSHOT_KCCONTAINER_SHAREDCACHE) { 3052 NSDictionary *container = parseKCDataContainer(&iter, &error); 3053 T_QUIET; T_ASSERT_NOTNULL(container, "parsed sharedcache container from stackshot"); 3054 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing sharedcache container"); 3055 T_QUIET; T_EXPECT_EQ(sharedCaches[@(containerid)], nil, "sharedcache containerid %lld should be unique", containerid); 3056 sharedCaches[@(containerid)] = container; 3057 break; 3058 } 3059 3060 if (container_type == STACKSHOT_KCCONTAINER_EXCLAVES) { 3061 found_exclaves = true; 3062 break; 3063 } 3064 3065 /* 3066 * treat containers other than tasks/transitioning_tasks 3067 * as expanded in-line. 3068 */ 3069 if (container_type != STACKSHOT_KCCONTAINER_TASK && 3070 container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK) { 3071 T_LOG("container skipped: %d", container_type); 3072 break; 3073 } 3074 NSDictionary *container = parseKCDataContainer(&iter, &error); 3075 T_QUIET; T_ASSERT_NOTNULL(container, "parsed task/transitioning_task container from stackshot"); 3076 T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container"); 3077 3078 found_tasks++; 3079 3080 NSDictionary* task_snapshot = container[@"task_snapshots"][@"task_snapshot"]; 3081 NSDictionary* task_delta_snapshot = container[@"task_snapshots"][@"task_delta_snapshot"]; 3082 NSDictionary* transitioning_task_snapshot = container[@"transitioning_task_snapshots"][@"transitioning_task_snapshot"]; 3083 3084 NSNumber *task_pid = NULL; 3085 if (task_snapshot) { 3086 task_pid = task_snapshot[@"ts_unique_pid"]; 3087 } else if(task_delta_snapshot) { 3088 task_pid = task_snapshot[@"tds_unique_pid"]; 3089 } else if(transitioning_task_snapshot) { 3090 task_pid = transitioning_task_snapshot[@"tts_pid"]; 3091 } 3092 3093 if (task_pid && [seen_tasks containsObject:task_pid]) { 3094 T_QUIET; T_ASSERT_FALSE([seen_tasks containsObject:task_pid], "No duplicate PIDs in stackshot"); 3095 [seen_tasks addObject:task_pid]; 3096 } 3097 3098 /* 3099 * Having processed the container, we now only check it 3100 * if it's the correct type. 3101 */ 3102 if ((!expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TASK)) || 3103 (expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK))) { 3104 break; 3105 } 3106 if (!expect_transitioning_task) { 3107 T_QUIET; T_ASSERT_TRUE(!!task_snapshot != !!task_delta_snapshot, "Either task_snapshot xor task_delta_snapshot provided"); 3108 } 3109 3110 if (expect_dispatch_queue_label && !found_dispatch_queue_label) { 3111 for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) { 3112 NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key]; 3113 NSString *dql = thread[@"dispatch_queue_label"]; 3114 3115 if ([dql isEqualToString:@TEST_STACKSHOT_QUEUE_LABEL]) { 3116 found_dispatch_queue_label = true; 3117 break; 3118 } 3119 } 3120 } 3121 3122 if (expect_transitioning_task && !found_transitioning_task) { 3123 if (transitioning_task_snapshot) { 3124 uint64_t the_pid = [transitioning_task_snapshot[@"tts_pid"] unsignedLongLongValue]; 3125 if (the_pid == (uint64_t)transistioning_task_pid) { 3126 found_transitioning_task = true; 3127 3128 T_PASS("FOUND Transitioning task %llu has a transitioning task snapshot", (uint64_t) transistioning_task_pid); 3129 break; 3130 } 3131 } 3132 } 3133 3134 if (expect_postexec_child && !found_postexec_child) { 3135 if (task_snapshot) { 3136 uint64_t unique_pid = [task_snapshot[@"ts_unique_pid"] unsignedLongLongValue]; 3137 if (unique_pid == postexec_child_unique_pid) { 3138 found_postexec_child = true; 3139 3140 T_PASS("post-exec child %llu has a task snapshot", postexec_child_unique_pid); 3141 3142 break; 3143 } 3144 } 3145 3146 if (task_delta_snapshot) { 3147 uint64_t unique_pid = [task_delta_snapshot[@"tds_unique_pid"] unsignedLongLongValue]; 3148 if (unique_pid == postexec_child_unique_pid) { 3149 found_postexec_child = true; 3150 3151 T_FAIL("post-exec child %llu shouldn't have a delta task snapshot", postexec_child_unique_pid); 3152 3153 break; 3154 } 3155 } 3156 } 3157 3158 int pid = [task_snapshot[@"ts_pid"] intValue]; 3159 3160 if (pid && expect_shared_cache_uuid && !found_shared_cache_uuid) { 3161 id ptr = container[@"task_snapshots"][@"shared_cache_dyld_load_info"]; 3162 if (ptr) { 3163 id uuid = ptr[@"imageUUID"]; 3164 3165 uint8_t uuid_p[16]; 3166 for (unsigned int i = 0; i < 16; i ++) { 3167 NSNumber *uuidByte = uuid[i]; 3168 uuid_p[i] = (uint8_t)uuidByte.charValue; 3169 } 3170 3171 check_shared_cache_uuid(uuid_p); 3172 3173 uint64_t baseAddress = (uint64_t)((NSNumber *)ptr[@"imageSlidBaseAddress"]).longLongValue; 3174 uint64_t firstMapping = (uint64_t)((NSNumber *)ptr[@"sharedCacheSlidFirstMapping"]).longLongValue; 3175 3176 T_EXPECT_LE(baseAddress, firstMapping, 3177 "in per-task shared_cache_dyld_load_info, " 3178 "baseAddress <= firstMapping"); 3179 T_EXPECT_GE(baseAddress + (7ull << 32) + (1ull << 29), 3180 firstMapping, 3181 "in per-task shared_cache_dyld_load_info, " 3182 "baseAddress + 28.5gig >= firstMapping"); 3183 3184 size_t shared_cache_len; 3185 const void *addr = _dyld_get_shared_cache_range(&shared_cache_len); 3186 T_EXPECT_EQ((uint64_t)addr, firstMapping, 3187 "SlidFirstMapping should match shared_cache_range"); 3188 3189 /* 3190 * check_shared_cache_uuid() will assert on failure, so if 3191 * we get here, then we have found the shared cache UUID 3192 * and it's correct 3193 */ 3194 found_shared_cache_uuid = true; 3195 } 3196 } 3197 3198 if (expect_sharedcache_child) { 3199 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 3200 uint64_t sharedregion_flags = (task_flags & (kTaskSharedRegionNone | kTaskSharedRegionSystem | kTaskSharedRegionOther)); 3201 id sharedregion_info = container[@"task_snapshots"][@"shared_cache_dyld_load_info"]; 3202 id sharedcache_id = container[@"task_snapshots"][@"sharedCacheID"]; 3203 if (!found_sharedcache_badflags) { 3204 T_QUIET; T_EXPECT_NE(sharedregion_flags, 0ll, "one of the kTaskSharedRegion flags should be set on all tasks"); 3205 bool multiple = (sharedregion_flags & (sharedregion_flags - 1)) != 0; 3206 T_QUIET; T_EXPECT_FALSE(multiple, "only one kTaskSharedRegion flag should be set on each task"); 3207 found_sharedcache_badflags = (sharedregion_flags == 0 || multiple); 3208 } 3209 if (pid == 0) { 3210 T_ASSERT_EQ(sharedregion_flags, (uint64_t)kTaskSharedRegionNone, "Kernel proc (pid 0) should have no shared region"); 3211 } else if (pid == sharedcache_child_pid) { 3212 found_sharedcache_child = true; 3213 sharedcache_child_flags = sharedregion_flags; 3214 } else if (pid == getpid()) { 3215 found_sharedcache_self = true; 3216 sharedcache_self_flags = sharedregion_flags; 3217 } 3218 if (sharedregion_flags == kTaskSharedRegionOther && !(task_flags & kTaskSharedRegionInfoUnavailable)) { 3219 T_QUIET; T_EXPECT_NOTNULL(sharedregion_info, "kTaskSharedRegionOther should have a shared_cache_dyld_load_info struct"); 3220 T_QUIET; T_EXPECT_NOTNULL(sharedcache_id, "kTaskSharedRegionOther should have a sharedCacheID"); 3221 if (sharedcache_id != nil) { 3222 T_QUIET; T_EXPECT_NOTNULL(sharedCaches[sharedcache_id], "sharedCacheID %d should exist", [sharedcache_id intValue]); 3223 } 3224 } else { 3225 T_QUIET; T_EXPECT_NULL(sharedregion_info, "non-kTaskSharedRegionOther should have no shared_cache_dyld_load_info struct"); 3226 T_QUIET; T_EXPECT_NULL(sharedcache_id, "non-kTaskSharedRegionOther should have no sharedCacheID"); 3227 } 3228 } 3229 3230 if (expect_zombie_child && (pid == zombie_child_pid)) { 3231 found_zombie_child = true; 3232 3233 expected_num_tasks += 1; 3234 3235 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 3236 T_ASSERT_TRUE((task_flags & kTerminatedSnapshot) == kTerminatedSnapshot, "child zombie marked as terminated"); 3237 3238 continue; 3239 } 3240 3241 if (expect_translated_child && (pid == translated_child_pid)) { 3242 found_translated_child = true; 3243 3244 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 3245 T_EXPECT_BITS_SET(task_flags, kTaskIsTranslated, "child marked as translated"); 3246 3247 continue; 3248 } 3249 if (expect_exec_inprogress && (pid == exec_inprogress_pid || pid == -exec_inprogress_pid)) { 3250 exec_inprogress_found++; 3251 T_LOG("found exec task with pid %d, instance %d", pid, exec_inprogress_found); 3252 T_QUIET; T_ASSERT_LE(exec_inprogress_found, 2, "no more than two with the expected pid"); 3253 if (exec_inprogress_found == 2) { 3254 T_LOG("found 2 tasks with pid %d", exec_inprogress_pid); 3255 exec_inprogress_cb(containerid, exec_inprogress_containerid); 3256 } else { 3257 exec_inprogress_containerid = containerid; 3258 } 3259 } 3260 if (expect_driverkit && driverkit_cb != NULL) { 3261 driverkit_cb(pid); 3262 } 3263 if (expect_cseg_waitinfo) { 3264 NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"]; 3265 3266 for (id i in winfos) { 3267 NSNumber *waitType = i[@"wait_type"]; 3268 NSNumber *owner = i[@"owner"]; 3269 if (waitType.intValue == kThreadWaitCompressor && 3270 owner.unsignedLongValue == cseg_expected_threadid) { 3271 found_cseg_waitinfo = true; 3272 break; 3273 } 3274 } 3275 } 3276 3277 if (expect_srp_waitinfo) { 3278 NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"]; 3279 NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"]; 3280 for (id i in tinfos) { 3281 if (!found_srp_waitinfo) { 3282 bool found_thread = false; 3283 bool found_pid = false; 3284 if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_THREAD) && 3285 [i[@"turnstile_context"] unsignedLongLongValue] == srp_expected_threadid && 3286 srp_expected_threadid != 0) { 3287 found_thread = true; 3288 } 3289 if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_BLOCKED_ON_TASK) && 3290 [i[@"turnstile_context"] intValue] == srp_expected_pid && 3291 srp_expected_pid != -1) { 3292 found_pid = true; 3293 } 3294 if (found_pid || found_thread) { 3295 T_LOG("found SRP %s %lld waiter: %d", (found_thread ? "thread" : "pid"), 3296 [i[@"turnstile_context"] unsignedLongLongValue], [i[@"waiter"] intValue]); 3297 /* we found something that is blocking the correct threadid */ 3298 for (id j in winfos) { 3299 if ([j[@"waiter"] intValue] == [i[@"waiter"] intValue] && 3300 [j[@"wait_type"] intValue] == kThreadWaitPortReceive) { 3301 found_srp_waitinfo = true; 3302 T_EXPECT_EQ([j[@"wait_flags"] intValue], STACKSHOT_WAITINFO_FLAGS_SPECIALREPLY, 3303 "SRP waitinfo should be marked as a special reply"); 3304 break; 3305 } 3306 } 3307 3308 if (found_srp_waitinfo) { 3309 break; 3310 } 3311 } 3312 } 3313 } 3314 } 3315 3316 if (expect_sp_throttled) { 3317 NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"]; 3318 for (id i in tinfos) { 3319 if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_PORTFLAGS) 3320 && [i[@"turnstile_context"] intValue] == throttled_service_ctx) { 3321 int portlabel_id = [i[@"portlabel_id"] intValue]; 3322 T_LOG("[pid:%d] Turnstile (flags = 0x%x, ctx = %d, portlabel_id = %d)", pid, 3323 [i[@"turnstile_flags"] intValue], [i[@"turnstile_context"] intValue], portlabel_id); 3324 for (id portid in container[@"task_snapshots"][@"portlabels"]) { 3325 if (portlabel_id != [portid intValue]) { 3326 continue; 3327 } 3328 3329 NSMutableDictionary *portlabel = container[@"task_snapshots"][@"portlabels"][portid]; 3330 T_ASSERT_TRUE(portlabel != nil, "Found portlabel id: %d", [portid intValue]); 3331 NSString *portlabel_name = portlabel[@"portlabel_name"]; 3332 T_EXPECT_TRUE(portlabel_name != nil, "Found portlabel %s", portlabel_name.UTF8String); 3333 T_EXPECT_EQ_STR(portlabel_name.UTF8String, THROTTLED_SERVICE_NAME, "throttled service port name matches"); 3334 T_EXPECT_EQ(([portlabel[@"portlabel_flags"] intValue] & STACKSHOT_PORTLABEL_THROTTLED) != 0, 3335 is_throttled, "Port %s throttled", is_throttled ? "is" : "isn't"); 3336 found_throttled_service = true; 3337 break; 3338 } 3339 } 3340 3341 if (found_throttled_service) { 3342 break; 3343 } 3344 } 3345 } 3346 3347 if (expect_suspendinfo) { 3348 // TODO: rdar://112563110 3349 } 3350 3351 3352 if (pid != getpid()) { 3353 break; 3354 } 3355 3356 T_EXPECT_EQ_STR(current_process_name(), 3357 [task_snapshot[@"ts_p_comm"] UTF8String], 3358 "current process name matches in stackshot"); 3359 3360 uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue]; 3361 T_ASSERT_BITS_NOTSET(task_flags, kTerminatedSnapshot, "current process not marked as terminated"); 3362 T_ASSERT_BITS_NOTSET(task_flags, kTaskIsTranslated, "current process not marked as translated"); 3363 3364 T_QUIET; 3365 T_EXPECT_LE(pid, [task_snapshot[@"ts_unique_pid"] intValue], 3366 "unique pid is greater than pid"); 3367 3368 NSDictionary* task_cpu_architecture = container[@"task_snapshots"][@"task_cpu_architecture"]; 3369 T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cputype"], "have cputype"); 3370 T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cpusubtype"], "have cputype"); 3371 int cputype = [task_cpu_architecture[@"cputype"] intValue]; 3372 int cpusubtype = [task_cpu_architecture[@"cpusubtype"] intValue]; 3373 3374 struct proc_archinfo archinfo; 3375 int retval = proc_pidinfo(pid, PROC_PIDARCHINFO, 0, &archinfo, sizeof(archinfo)); 3376 T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDARCHINFO) returned a value > 0"); 3377 T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(struct proc_archinfo), "proc_pidinfo call for PROC_PIDARCHINFO returned expected size"); 3378 T_QUIET; T_EXPECT_EQ(cputype, archinfo.p_cputype, "cpu type is correct"); 3379 T_QUIET; T_EXPECT_EQ(cpusubtype, archinfo.p_cpusubtype, "cpu subtype is correct"); 3380 3381 NSDictionary * codesigning_info = container[@"task_snapshots"][@"stackshot_task_codesigning_info"]; 3382 T_QUIET; T_ASSERT_NOTNULL(codesigning_info[@"csflags"], "have csflags"); 3383 uint64_t flags = [codesigning_info[@"csflags"] unsignedLongLongValue]; 3384 T_QUIET; T_EXPECT_GT(flags, 0, "nonzero csflags"); 3385 3386 T_QUIET; T_ASSERT_NOTNULL(container[@"task_snapshots"][@"jetsam_coalition"], "have jetsam coalition"); 3387 uint64_t jetsam_coalition = [container[@"task_snapshots"][@"jetsam_coalition"] unsignedLongLongValue]; 3388 T_QUIET; T_EXPECT_GT(jetsam_coalition, 0, "nonzero jetsam coalition"); 3389 3390 bool found_main_thread = false; 3391 uint64_t main_thread_id = -1ULL; 3392 bool found_null_kernel_frame = false; 3393 for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) { 3394 NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key]; 3395 NSDictionary *thread_snap = thread[@"thread_snapshot"]; 3396 3397 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_thread_id"] intValue], 0, 3398 "thread ID of thread in current task is valid"); 3399 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_base_priority"] intValue], 0, 3400 "base priority of thread in current task is valid"); 3401 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_sched_priority"] intValue], 0, 3402 "scheduling priority of thread in current task is valid"); 3403 3404 NSString *pth_name = thread[@"pth_name"]; 3405 if (pth_name != nil && [pth_name isEqualToString:@TEST_THREAD_NAME]) { 3406 found_main_thread = true; 3407 main_thread_id = [thread_snap[@"ths_thread_id"] unsignedLongLongValue]; 3408 3409 T_QUIET; T_EXPECT_GT([thread_snap[@"ths_total_syscalls"] intValue], 0, 3410 "total syscalls of current thread is valid"); 3411 3412 NSDictionary *cpu_times = thread[@"cpu_times"]; 3413 T_EXPECT_GE([cpu_times[@"runnable_time"] intValue], 3414 [cpu_times[@"system_time"] intValue] + 3415 [cpu_times[@"user_time"] intValue], 3416 "runnable time of current thread is valid"); 3417 } 3418 if (!found_null_kernel_frame) { 3419 for (NSNumber *frame in thread[@"kernel_frames"]) { 3420 if (frame.unsignedLongValue == 0) { 3421 found_null_kernel_frame = true; 3422 break; 3423 } 3424 } 3425 } 3426 if (expect_asyncstack && !found_asyncstack && 3427 asyncstack_threadid == [thread_snap[@"ths_thread_id"] unsignedLongLongValue]) { 3428 found_asyncstack = true; 3429 NSArray* async_stack = thread[@"user_async_stack_frames"]; 3430 NSNumber* start_idx = thread[@"user_async_start_index"]; 3431 NSArray* user_stack = thread[@"user_stack_frames"]; 3432 T_QUIET; T_ASSERT_NOTNULL(async_stack, "async thread %#llx has user_async_stack_frames", asyncstack_threadid); 3433 T_QUIET; T_ASSERT_NOTNULL(start_idx, "async thread %#llx has user_async_start_index", asyncstack_threadid); 3434 T_QUIET; T_ASSERT_NOTNULL(user_stack, "async thread %#llx has user_stack_frames", asyncstack_threadid); 3435 T_QUIET; T_ASSERT_EQ(async_stack.count, asyncstack_stack.count, 3436 "actual async_stack count == expected async_stack count"); 3437 for (size_t i = 0; i < async_stack.count; i++) { 3438 T_EXPECT_EQ([async_stack[i][@"lr"] unsignedLongLongValue], 3439 [asyncstack_stack[i] unsignedLongLongValue], "frame %zu matches", i); 3440 } 3441 } 3442 } 3443 T_EXPECT_TRUE(found_main_thread, "found main thread for current task in stackshot"); 3444 T_EXPECT_FALSE(found_null_kernel_frame, "should not see any NULL kernel frames"); 3445 3446 if (expect_turnstile_lock && !found_turnstile_lock) { 3447 NSArray *tsinfos = container[@"task_snapshots"][@"thread_turnstileinfo"]; 3448 3449 for (id i in tsinfos) { 3450 if ([i[@"turnstile_context"] unsignedLongLongValue] == main_thread_id) { 3451 found_turnstile_lock = true; 3452 break; 3453 } 3454 } 3455 } 3456 break; 3457 } 3458 case STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO: { 3459 // Legacy shared cache info 3460 struct dyld_shared_cache_loadinfo *payload = kcdata_iter_payload(iter); 3461 T_ASSERT_EQ((size_t)kcdata_iter_size(iter), sizeof(*payload), "valid dyld_shared_cache_loadinfo struct"); 3462 3463 check_shared_cache_uuid(payload->sharedCacheUUID); 3464 3465 T_EXPECT_LE(payload->sharedCacheUnreliableSlidBaseAddress, 3466 payload->sharedCacheSlidFirstMapping, 3467 "SlidBaseAddress <= SlidFirstMapping"); 3468 T_EXPECT_GE(payload->sharedCacheUnreliableSlidBaseAddress + (7ull << 32) + (1ull << 29), 3469 payload->sharedCacheSlidFirstMapping, 3470 "SlidFirstMapping should be within 28.5gigs of SlidBaseAddress"); 3471 3472 size_t shared_cache_len; 3473 const void *addr = _dyld_get_shared_cache_range(&shared_cache_len); 3474 T_EXPECT_EQ((uint64_t)addr, payload->sharedCacheSlidFirstMapping, 3475 "SlidFirstMapping should match shared_cache_range"); 3476 3477 /* 3478 * check_shared_cache_uuid() asserts on failure, so we must have 3479 * found the shared cache UUID to be correct. 3480 */ 3481 found_shared_cache_uuid = true; 3482 break; 3483 } 3484 case KCDATA_TYPE_UINT64_DESC: { 3485 char *desc; 3486 uint64_t *data; 3487 uint32_t size; 3488 kcdata_iter_get_data_with_desc(iter, &desc, &data, &size); 3489 3490 if (strcmp(desc, "stackshot_tasks_count") == 0) { 3491 expected_num_tasks = *data; 3492 } else if (strcmp(desc, "stackshot_threads_count") == 0) { 3493 expected_num_threads = *data; 3494 } 3495 3496 break; 3497 } 3498 case STACKSHOT_KCTYPE_LATENCY_INFO_CPU: { 3499 struct stackshot_latency_cpu *cpu_latency = kcdata_iter_payload(iter); 3500 found_percpu_tasks += cpu_latency->tasks_processed; 3501 found_percpu_threads += cpu_latency->threads_processed; 3502 break; 3503 } 3504 } 3505 } 3506 3507 if (expect_sharedcache_child) { 3508 T_QUIET; T_ASSERT_TRUE(found_sharedcache_child, "found sharedcache child in kcdata"); 3509 T_QUIET; T_ASSERT_TRUE(found_sharedcache_self, "found self in kcdata"); 3510 if (found_sharedcache_child && found_sharedcache_self) { 3511 T_QUIET; T_ASSERT_NE(sharedcache_child_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache child should have shared region"); 3512 T_QUIET; T_ASSERT_NE(sharedcache_self_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache: self should have shared region"); 3513 if (sharedcache_self_flags == kTaskSharedRegionSystem && !sharedcache_child_sameaddr) { 3514 /* If we're in the system shared region, and the child has a different address, child must have an Other shared region */ 3515 T_ASSERT_EQ(sharedcache_child_flags, (uint64_t)kTaskSharedRegionOther, 3516 "sharedcache child should have Other shared region"); 3517 } 3518 } 3519 } 3520 3521 if (expect_transitioning_task) { 3522 T_QUIET; T_ASSERT_TRUE(found_transitioning_task, "found transitioning_task child in kcdata"); 3523 } 3524 3525 if (expect_exec_inprogress) { 3526 T_QUIET; T_ASSERT_GT(exec_inprogress_found, 0, "found at least 1 task for execing process"); 3527 } 3528 3529 if (expect_zombie_child) { 3530 T_QUIET; T_ASSERT_TRUE(found_zombie_child, "found zombie child in kcdata"); 3531 } 3532 3533 if (expect_postexec_child) { 3534 T_QUIET; T_ASSERT_TRUE(found_postexec_child, "found post-exec child in kcdata"); 3535 } 3536 3537 if (expect_translated_child) { 3538 T_QUIET; T_ASSERT_TRUE(found_translated_child, "found translated child in kcdata"); 3539 } 3540 3541 if (expect_shared_cache_layout) { 3542 T_QUIET; T_ASSERT_TRUE(found_shared_cache_layout, "shared cache layout found in kcdata"); 3543 } 3544 3545 if (expect_shared_cache_uuid) { 3546 T_QUIET; T_ASSERT_TRUE(found_shared_cache_uuid, "shared cache UUID found in kcdata"); 3547 } 3548 3549 if (expect_dispatch_queue_label) { 3550 T_QUIET; T_ASSERT_TRUE(found_dispatch_queue_label, "dispatch queue label found in kcdata"); 3551 } 3552 3553 if (expect_turnstile_lock) { 3554 T_QUIET; T_ASSERT_TRUE(found_turnstile_lock, "found expected deadlock"); 3555 } 3556 3557 if (expect_cseg_waitinfo) { 3558 T_QUIET; T_ASSERT_TRUE(found_cseg_waitinfo, "found c_seg waitinfo"); 3559 } 3560 3561 if (expect_srp_waitinfo) { 3562 T_QUIET; T_ASSERT_TRUE(found_srp_waitinfo, "found special reply port waitinfo"); 3563 } 3564 3565 if (expect_sp_throttled) { 3566 T_QUIET; T_ASSERT_TRUE(found_throttled_service, "found the throttled service"); 3567 } 3568 3569 if (expect_asyncstack) { 3570 T_QUIET; T_ASSERT_TRUE(found_asyncstack, "found async stack threadid"); 3571 } 3572 3573 if ([extra objectForKey:no_exclaves_key] != nil) { 3574 T_QUIET; T_ASSERT_FALSE(found_exclaves, "did not find any Exclaves data"); 3575 } 3576 3577 3578 bool check_counts = !delta && !found_transitioning_task && !expect_single_task && !expect_driverkit; 3579 3580 if (check_counts && (expected_num_threads != 0) && (found_percpu_threads != 0)) { 3581 /* If the task counts below check out, we can be sure that the per-cpu reported thread counts are accurate. */ 3582 T_QUIET; T_ASSERT_EQ_ULLONG(found_percpu_threads, expected_num_threads, "number of threads reported by CPUs matches expected count"); 3583 } 3584 3585 if (check_counts && (expected_num_tasks != 0)) { 3586 T_QUIET; T_ASSERT_EQ_ULLONG(found_tasks, expected_num_tasks, "number of tasks in kcdata matches expected count"); 3587 if (found_percpu_tasks != 0) { 3588 T_QUIET; T_ASSERT_EQ_ULLONG(found_percpu_tasks, expected_num_tasks, "number of tasks reported by CPUs matches expected count"); 3589 } 3590 } 3591 3592 T_ASSERT_FALSE(KCDATA_ITER_FOREACH_FAILED(iter), "successfully iterated kcdata"); 3593 3594 free(inflatedBufferBase); 3595} 3596 3597static const char * 3598current_process_name(void) 3599{ 3600 static char name[64]; 3601 3602 if (!name[0]) { 3603 int ret = proc_name(getpid(), name, sizeof(name)); 3604 T_QUIET; 3605 T_ASSERT_POSIX_SUCCESS(ret, "proc_name failed for current process"); 3606 } 3607 3608 return name; 3609} 3610 3611static void 3612initialize_thread(void) 3613{ 3614 int ret = pthread_setname_np(TEST_THREAD_NAME); 3615 T_QUIET; 3616 T_ASSERT_POSIX_ZERO(ret, "set thread name to %s", TEST_THREAD_NAME); 3617} 3618 3619T_DECL(dirty_buffer, "test that stackshot works with a dirty input buffer from kernel", T_META_TAG_VM_PREFERRED) 3620{ 3621 const char *test_sysctl = "stackshot_dirty_buffer"; 3622 int64_t result; 3623 3624 T_LOG("running sysctl to trigger kernel-driven stackshot"); 3625 result = run_sysctl_test(test_sysctl, 0); 3626 T_ASSERT_EQ_LLONG(result, 1, "sysctl result indicated success"); 3627} 3628 3629T_DECL(kernel_initiated, "smoke test that stackshot works with kernel-initiated stackshots", T_META_TAG_VM_PREFERRED) 3630{ 3631 const char *test_sysctl = "stackshot_kernel_initiator"; 3632 int64_t result; 3633 __block bool did_get_stackshot = false; 3634 3635 initialize_thread(); // must run before the stackshots to keep parse_stackshot happy 3636 3637 T_LOG("running sysctl to trigger kernel-driven stackshot type 1"); 3638 result = run_sysctl_test(test_sysctl, 1); 3639 T_ASSERT_EQ_LLONG(result, 1, "sysctl result indicated success"); 3640 3641 T_LOG("running sysctl to trigger kernel-driven stackshot type 2"); 3642 result = run_sysctl_test(test_sysctl, 2); 3643 T_ASSERT_EQ_LLONG(result, 1, "sysctl result indicated success"); 3644 3645 struct scenario scenario = { 3646 .name = "from_kernel_initiated", 3647 .flags = STACKSHOT_RETRIEVE_EXISTING_BUFFER, 3648 }; 3649 3650 T_LOG("attempting to fetch stored in-kernel stackshot"); 3651 take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) { 3652 T_ASSERT_NOTNULL(ssbuf, "non-null kernel stackshot"); 3653 T_ASSERT_GT(sslen, 0, "non-zero stackshot size"); 3654 parse_stackshot(0, ssbuf, sslen, nil); 3655 did_get_stackshot = true; 3656 }); 3657 3658 T_ASSERT_TRUE(did_get_stackshot, "got stackshot from kernel type 2"); 3659} 3660