1*43a90889SApple OSS DistributionsTask References 2*43a90889SApple OSS Distributions=============== 3*43a90889SApple OSS Distributions 4*43a90889SApple OSS DistributionsFinding the source of task reference count leaks. 5*43a90889SApple OSS Distributions 6*43a90889SApple OSS DistributionsBackground 7*43a90889SApple OSS Distributions---------- 8*43a90889SApple OSS Distributions 9*43a90889SApple OSS DistributionsTasks in XNU are reference counted. When a task is created it starts with two 10*43a90889SApple OSS Distributionsreferences - one for the caller and one for the task itself. Over the lifetime 11*43a90889SApple OSS Distributionsof the task this reference count is modified, for example when a thread is 12*43a90889SApple OSS Distributionscreated it increments the reference count and when it exits that count drops. 13*43a90889SApple OSS DistributionsWhen a reference count reaches zero, the task is freed. 14*43a90889SApple OSS Distributions 15*43a90889SApple OSS DistributionsTo grab a reference: 16*43a90889SApple OSS Distributions```c 17*43a90889SApple OSS Distributionstask_reference() 18*43a90889SApple OSS Distributions``` 19*43a90889SApple OSS Distributions 20*43a90889SApple OSS DistributionsTo release a reference: 21*43a90889SApple OSS Distributions```c 22*43a90889SApple OSS Distributionstask_deallocate() 23*43a90889SApple OSS Distributions``` 24*43a90889SApple OSS Distributions 25*43a90889SApple OSS DistributionsOne of the big problems seen with task references is that difficult to debug 26*43a90889SApple OSS Distributions_leaks_ commonly occur. This happens when a reference is taken but never 27*43a90889SApple OSS Distributionsreleased. The task is kept around indefinitely and eventually the system runs 28*43a90889SApple OSS Distributionsout of a finite resource (for example ASIDs). At this point there is very little 29*43a90889SApple OSS Distributionsinformation to determine what code was responsible for the leak. 30*43a90889SApple OSS Distributions 31*43a90889SApple OSS Distributions 32*43a90889SApple OSS DistributionsTask Reference Groups 33*43a90889SApple OSS Distributions-------------------- 34*43a90889SApple OSS Distributions 35*43a90889SApple OSS DistributionsReference groups are a feature which keep track of statistics (and when 36*43a90889SApple OSS Distributionsconfigured backtrace information) for a set of references. Reference groups are 37*43a90889SApple OSS Distributionshierarchical. To help with debugging the following task reference group 38*43a90889SApple OSS Distributionshierarchy is used: 39*43a90889SApple OSS Distributions 40*43a90889SApple OSS Distributions``` 41*43a90889SApple OSS Distributionstask 42*43a90889SApple OSS Distributions -> task_internal 43*43a90889SApple OSS Distributions -> task_local_internal 44*43a90889SApple OSS Distributions -> task_kernel 45*43a90889SApple OSS Distributions -> task_local_internal 46*43a90889SApple OSS Distributions -> task_mig 47*43a90889SApple OSS Distributions -> task_local_internal 48*43a90889SApple OSS Distributions -> task_external 49*43a90889SApple OSS Distributions -> task_local_external 50*43a90889SApple OSS Distributions -> task_com.apple.security.sandbox 51*43a90889SApple OSS Distributions -> task_com.apple.security.sandbox 52*43a90889SApple OSS Distributions -> task_com.apple.driver.AppleHV 53*43a90889SApple OSS Distributions -> task_com.apple.driver.AppleHV 54*43a90889SApple OSS Distributions ... 55*43a90889SApple OSS Distributions``` 56*43a90889SApple OSS Distributions 57*43a90889SApple OSS DistributionsThe `task` group contains a count of all task references in the system. The 58*43a90889SApple OSS Distributionsfirst-level groups are static and sub-divide task references based on the 59*43a90889SApple OSS Distributionssub-system they come from. `task_external` is used for kext references and each 60*43a90889SApple OSS Distributionskext will be dynamically assigned a reference group as needed (if there's 61*43a90889SApple OSS Distributionsone available). At the bottom level, there's a per-task (local) ref group under 62*43a90889SApple OSS Distributionseach global group. 63*43a90889SApple OSS DistributionsThe exact hierarchy of task references (specifically what per-task reference 64*43a90889SApple OSS Distributionsgroups are created) changes depending on the 'task_refgrp' boot arg. 65*43a90889SApple OSS Distributions 66*43a90889SApple OSS DistributionsTask reference groups can be explored in `lldb` as follows: 67*43a90889SApple OSS Distributions 68*43a90889SApple OSS Distributions``` 69*43a90889SApple OSS Distributions(lldb) showglobaltaskrefgrps 70*43a90889SApple OSS Distributionsos_refgrp name count retain release log 71*43a90889SApple OSS Distributions0xffffff801ace9250 task_kernel 68 367663 367595 0x0 72*43a90889SApple OSS Distributions0xffffff801ace9288 task_internal 974 4953 3979 0x0 73*43a90889SApple OSS Distributions0xffffff801ace92c0 task_mig 0 3670 3670 0x0 74*43a90889SApple OSS Distributions0xffffff801ace9218 task_external 35 108 73 0x0 75*43a90889SApple OSS Distributions0xffffff9369dc7b20 task_com.apple.iokit.IOAcceleratorFamily2 29 77 48 0x0 76*43a90889SApple OSS Distributions0xffffff936a3f0a20 task_com.apple.iokit.CoreAnalyticsFamily 1 1 0 0x0 77*43a90889SApple OSS Distributions0xffffff936a22cb20 task_com.apple.iokit.EndpointSecurity 0 1 1 0x0 78*43a90889SApple OSS Distributions0xffffff936a283f60 task_com.apple.iokit.IOSurface 5 5 0 0x0 79*43a90889SApple OSS Distributions0xffffff936a3f08a0 task_com.apple.security.sandbox 0 24 24 0x0 80*43a90889SApple OSS Distributions 81*43a90889SApple OSS Distributions``` 82*43a90889SApple OSS Distributions 83*43a90889SApple OSS DistributionsDisplay a task's reference groups: 84*43a90889SApple OSS Distributions 85*43a90889SApple OSS Distributions``` 86*43a90889SApple OSS Distributions(lldb) showtaskrefgrps kernel_task 87*43a90889SApple OSS Distributionsos_refgrp name count retain release log 88*43a90889SApple OSS Distributions0xffffff936a4b9200 task_local_kernel 1 6 5 0x0 89*43a90889SApple OSS Distributions0xffffff936a4b9238 task_local_internal 132 619 487 0x0 90*43a90889SApple OSS Distributions``` 91*43a90889SApple OSS Distributions 92*43a90889SApple OSS DistributionsThe reference group hierarchy for a specific group can be displayed as follows: 93*43a90889SApple OSS Distributions 94*43a90889SApple OSS Distributions``` 95*43a90889SApple OSS Distributions(lldb) showosrefgrphierarchy 0xffffff936a3f08a0 96*43a90889SApple OSS Distributions0xffffff801ace9988 all 1121 377740 376619 0x0 97*43a90889SApple OSS Distributions0xffffff801ace91e0 task 1077 376394 375317 0x0 98*43a90889SApple OSS Distributions0xffffff801ace9218 task_external 35 108 73 0x0 99*43a90889SApple OSS Distributions0xffffff936a3f08a0 task_com.apple.security.sandbox 0 24 24 0x0 100*43a90889SApple OSS Distributions``` 101*43a90889SApple OSS Distributions 102*43a90889SApple OSS DistributionsReference groups are normally disabled, but task reference group statistics 103*43a90889SApple OSS Distributions*are* enabled by default (for `RELEASE` builds, reference groups are not available 104*43a90889SApple OSS Distributionsat all). Backtrace logging for all groups is disabled, including task reference 105*43a90889SApple OSS Distributionsgroups. To enable backtrace logging and reference group statistics, the `rlog` 106*43a90889SApple OSS Distributionsboot-arg must be used. Backtrace logging for task reference groups is only 107*43a90889SApple OSS Distributionsenabled when `rlog` has been set to a suitable value. 108*43a90889SApple OSS Distributions 109*43a90889SApple OSS DistributionsFor example 110*43a90889SApple OSS Distributions 111*43a90889SApple OSS DistributionsTo enable statistics for all reference groups and backtrace logging for the 112*43a90889SApple OSS Distributions*task_external* reference group in particular: 113*43a90889SApple OSS Distributions 114*43a90889SApple OSS Distributions``` 115*43a90889SApple OSS Distributionsnvram boot-args="rlog=task_external ..." 116*43a90889SApple OSS Distributions``` 117*43a90889SApple OSS Distributions 118*43a90889SApple OSS Distributions``` 119*43a90889SApple OSS Distributions(lldb) showglobaltaskrefgrps 120*43a90889SApple OSS Distributionsos_refgrp name count retain release log 121*43a90889SApple OSS Distributions0xffffff801e0e9250 task_kernel 1259 132739 131480 0x0 122*43a90889SApple OSS Distributions0xffffff801e0e9218 task_external 35 100 65 0xffffffa05b3fc000 123*43a90889SApple OSS Distributions0xffffff936d117be0 task_com.apple.iokit.IOAcceleratorFamily2 29 77 48 0x0 124*43a90889SApple OSS Distributions0xffffff936db9fa20 task_com.apple.iokit.CoreAnalyticsFamily 1 1 0 0x0 125*43a90889SApple OSS Distributions0xffffff936d9dbb20 task_com.apple.iokit.EndpointSecurity 0 1 1 0x0 126*43a90889SApple OSS Distributions0xffffff936da324e0 task_com.apple.iokit.IOSurface 5 5 0 0x0 127*43a90889SApple OSS Distributions0xffffff936db9f8a0 task_com.apple.security.sandbox 0 16 16 0x0 128*43a90889SApple OSS Distributions 129*43a90889SApple OSS Distributions 130*43a90889SApple OSS Distributions(lldb) showbtlogrecords 0xffffffa05b3fc000 131*43a90889SApple OSS Distributions-------- OP 1 Stack Index 0 with active refs 1 of 165 -------- 132*43a90889SApple OSS Distributions0xffffff801da7c1cb <kernel.development`ref_log_op at refcnt.c:107> 133*43a90889SApple OSS Distributions0xffffff801d27c35d <kernel.development`task_reference_grp at task_ref.c:274> 134*43a90889SApple OSS Distributions0xffffff801ecc014e <EndpointSecurity`VMMap::taskSelf()> 135*43a90889SApple OSS Distributions0xffffff801eccc845 <EndpointSecurity`EndpointSecurityClient::create(ScopedPointer<MachSendWrapper> const&, proc*, ScopedPointer<EndpointSecurityExternalClient> const&, es_client_config_t const&)> 136*43a90889SApple OSS Distributions... 137*43a90889SApple OSS Distributions``` 138