xref: /xnu-11417.140.69/tests/stackshot_tests.m (revision 43a90889846e00bfb5cf1d255cdc0a701a1e05a4)
1#include <darwintest.h>
2#include <darwintest_utils.h>
3#include <darwintest_multiprocess.h>
4#include <kern/debug.h>
5#include <kern/kern_cdata.h>
6#include <kern/block_hint.h>
7#include <kdd.h>
8#include <libproc.h>
9#include <os/atomic_private.h>
10#include <mach-o/dyld.h>
11#include <mach-o/dyld_images.h>
12#include <mach-o/dyld_priv.h>
13#include <sys/syscall.h>
14#include <sys/stackshot.h>
15#include <uuid/uuid.h>
16#include <servers/bootstrap.h>
17#include <pthread/workqueue_private.h>
18#include <dispatch/private.h>
19#include <stdalign.h>
20#include <TargetConditionals.h>
21
22#import <zlib.h>
23#import <IOKit/IOKitLib.h>
24#import <IOKit/IOKitLibPrivate.h>
25#import <IOKit/IOKitKeysPrivate.h>
26#import "test_utils.h"
27
28
29
30T_GLOBAL_META(
31		T_META_NAMESPACE("xnu.stackshot"),
32		T_META_RADAR_COMPONENT_NAME("xnu"),
33		T_META_RADAR_COMPONENT_VERSION("stackshot"),
34		T_META_OWNER("jonathan_w_adams"),
35		T_META_CHECK_LEAKS(false),
36		T_META_ASROOT(true),
37		XNU_T_META_SOC_SPECIFIC
38		);
39
40static const char *current_process_name(void);
41static void verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count);
42static void parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra);
43static void parse_thread_group_stackshot(void **sbuf, size_t sslen);
44static uint64_t stackshot_timestamp(void *ssbuf, size_t sslen);
45static void initialize_thread(void);
46
47static uint64_t global_flags = 0;
48
49#define DEFAULT_STACKSHOT_BUFFER_SIZE (1024 * 1024)
50#define MAX_STACKSHOT_BUFFER_SIZE     (6 * 1024 * 1024)
51
52#define SRP_SERVICE_NAME "com.apple.xnu.test.stackshot.special_reply_port"
53
54/* bit flags for parse_stackshot */
55#define PARSE_STACKSHOT_DELTA                0x01
56#define PARSE_STACKSHOT_ZOMBIE               0x02
57#define PARSE_STACKSHOT_SHAREDCACHE_LAYOUT   0x04
58#define PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL 0x08
59#define PARSE_STACKSHOT_TURNSTILEINFO        0x10
60#define PARSE_STACKSHOT_POSTEXEC             0x20
61#define PARSE_STACKSHOT_WAITINFO_CSEG        0x40
62#define PARSE_STACKSHOT_WAITINFO_SRP         0x80
63#define PARSE_STACKSHOT_TRANSLATED           0x100
64#define PARSE_STACKSHOT_SHAREDCACHE_FLAGS    0x200
65#define PARSE_STACKSHOT_EXEC_INPROGRESS      0x400
66#define PARSE_STACKSHOT_TRANSITIONING        0x800
67#define PARSE_STACKSHOT_ASYNCSTACK           0x1000
68#define PARSE_STACKSHOT_COMPACTINFO          0x2000 /* TODO: rdar://88789261 */
69#define PARSE_STACKSHOT_DRIVERKIT            0x4000
70#define PARSE_STACKSHOT_THROTTLED_SP         0x8000
71#define PARSE_STACKSHOT_SUSPENDINFO          0x10000
72#define PARSE_STACKSHOT_TARGETPID            0x20000
73
74/* keys for 'extra' dictionary for parse_stackshot */
75static const NSString* zombie_child_pid_key = @"zombie_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_ZOMBIE
76static const NSString* postexec_child_unique_pid_key = @"postexec_child_unique_pid";  // -> @(unique_pid), required for PARSE_STACKSHOT_POSTEXEC
77static const NSString* cseg_expected_threadid_key = @"cseg_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_WAITINFO_CSEG
78static const NSString* srp_expected_threadid_key = @"srp_expected_threadid"; // -> @(tid), this or ..._pid required for PARSE_STACKSHOT_WAITINFO_SRP
79static const NSString* srp_expected_pid_key = @"srp_expected_pid"; // -> @(pid), this or ..._threadid required for PARSE_STACKSHOT_WAITINFO_SRP
80static const NSString* translated_child_pid_key = @"translated_child_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSLATED
81static const NSString* sharedcache_child_pid_key = @"sharedcache_child_pid"; // @(pid), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS
82static const NSString* sharedcache_child_sameaddr_key = @"sharedcache_child_sameaddr"; // @(0 or 1), required for PARSE_STACKSHOT_SHAREDCACHE_FLAGS
83static const NSString* exec_inprogress_pid_key = @"exec_inprogress_pid";
84static const NSString* exec_inprogress_found_key = @"exec_inprogress_found";  // callback when inprogress is found
85static const NSString* transitioning_pid_key = @"transitioning_task_pid"; // -> @(pid), required for PARSE_STACKSHOT_TRANSITIONING
86static const NSString* asyncstack_expected_threadid_key = @"asyncstack_expected_threadid"; // -> @(tid), required for PARSE_STACKSHOT_ASYNCSTACK
87static const NSString* asyncstack_expected_stack_key = @"asyncstack_expected_stack"; // -> @[pc...]), expected PCs for asyncstack
88static const NSString* driverkit_found_key = @"driverkit_found_key"; // callback when driverkit process is found. argument is the process pid.
89static const NSString* sp_throttled_expected_ctxt_key = @"sp_throttled_expected_ctxt_key"; // -> @(ctxt), required for PARSE_STACKSHOT_THROTTLED_SP
90static const NSString* sp_throttled_expect_flag = @"sp_throttled_expect_flag"; // -> @(is_throttled), required for PARSE_STACKSHOT_THROTTLED_SP
91static const NSString* no_exclaves_key = @"no_exclaves";
92
93#define TEST_STACKSHOT_QUEUE_LABEL        "houston.we.had.a.problem"
94#define TEST_STACKSHOT_QUEUE_LABEL_LENGTH sizeof(TEST_STACKSHOT_QUEUE_LABEL)
95
96#define THROTTLED_SERVICE_NAME "com.apple.xnu.test.stackshot.throttled_service"
97
98static int64_t
99run_sysctl_test(const char *t, int64_t value)
100{
101	char name[1024];
102	int64_t result = 0;
103	size_t s = sizeof(value);
104	int rc;
105
106	snprintf(name, sizeof(name), "debug.test.%s", t);
107	rc = sysctlbyname(name, &result, &s, &value, s);
108	T_QUIET; T_ASSERT_POSIX_SUCCESS(rc, "sysctlbyname(%s)", name);
109	return result;
110}
111
112T_DECL(microstackshots, "test the microstackshot syscall", T_META_TAG_VM_PREFERRED)
113{
114	void *buf = NULL;
115	unsigned int size = DEFAULT_STACKSHOT_BUFFER_SIZE;
116
117	while (1) {
118		buf = malloc(size);
119		T_QUIET; T_ASSERT_NOTNULL(buf, "allocated stackshot buffer");
120
121#pragma clang diagnostic push
122#pragma clang diagnostic ignored "-Wdeprecated-declarations"
123		int len = syscall(SYS_microstackshot, buf, size,
124				(uint32_t) STACKSHOT_GET_MICROSTACKSHOT);
125#pragma clang diagnostic pop
126		if (len == ENOSYS) {
127			T_SKIP("microstackshot syscall failed, likely not compiled with CONFIG_TELEMETRY");
128		}
129		if (len == -1 && errno == ENOSPC) {
130			/* syscall failed because buffer wasn't large enough, try again */
131			free(buf);
132			buf = NULL;
133			size *= 2;
134			T_ASSERT_LE(size, (unsigned int)MAX_STACKSHOT_BUFFER_SIZE,
135					"growing stackshot buffer to sane size");
136			continue;
137		}
138		T_ASSERT_POSIX_SUCCESS(len, "called microstackshot syscall");
139		break;
140    }
141
142	T_EXPECT_EQ(*(uint32_t *)buf,
143			(uint32_t)STACKSHOT_MICRO_SNAPSHOT_MAGIC,
144			"magic value for microstackshot matches");
145
146	free(buf);
147}
148
149struct scenario {
150	const char *name;
151	uint64_t flags;
152	bool quiet;
153	bool should_fail;
154	bool maybe_unsupported;
155	bool maybe_enomem;
156	bool no_recordfile;
157	pid_t target_pid;
158	bool target_kernel;
159	bool nocheck_recordfile;
160	uint64_t since_timestamp;
161	uint32_t size_hint;
162	dt_stat_time_t timer;
163};
164
165static void
166quiet(struct scenario *scenario)
167{
168	if (scenario->timer || scenario->quiet) {
169		T_QUIET;
170	}
171}
172
173static void
174take_stackshot(struct scenario *scenario, bool compress_ok, void (^cb)(void *buf, size_t size))
175{
176start:
177	initialize_thread();
178
179	void *config = stackshot_config_create();
180	quiet(scenario);
181	T_ASSERT_NOTNULL(config, "created stackshot config");
182
183	int ret = stackshot_config_set_flags(config, scenario->flags | global_flags);
184	quiet(scenario);
185	T_ASSERT_POSIX_ZERO(ret, "set flags %#llx on stackshot config", scenario->flags);
186
187	if (scenario->size_hint > 0) {
188		ret = stackshot_config_set_size_hint(config, scenario->size_hint);
189		quiet(scenario);
190		T_ASSERT_POSIX_ZERO(ret, "set size hint %" PRIu32 " on stackshot config",
191				scenario->size_hint);
192	}
193
194	if (scenario->target_pid > 0) {
195		ret = stackshot_config_set_pid(config, scenario->target_pid);
196		quiet(scenario);
197		T_ASSERT_POSIX_ZERO(ret, "set target pid %d on stackshot config",
198				scenario->target_pid);
199	} else if (scenario->target_kernel) {
200		ret = stackshot_config_set_pid(config, 0);
201		quiet(scenario);
202		T_ASSERT_POSIX_ZERO(ret, "set kernel target on stackshot config");
203	}
204
205	if (scenario->since_timestamp > 0) {
206		ret = stackshot_config_set_delta_timestamp(config, scenario->since_timestamp);
207		quiet(scenario);
208		T_ASSERT_POSIX_ZERO(ret, "set since timestamp %" PRIu64 " on stackshot config",
209				scenario->since_timestamp);
210	}
211
212	int retries_remaining = 5;
213
214retry: ;
215	uint64_t start_time = mach_absolute_time();
216	ret = stackshot_capture_with_config(config);
217	uint64_t end_time = mach_absolute_time();
218
219	if (scenario->should_fail) {
220		T_EXPECTFAIL;
221		T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config");
222		return;
223	}
224
225	if (ret == EBUSY || ret == ETIMEDOUT) {
226		if (retries_remaining > 0) {
227			if (!scenario->timer) {
228				T_LOG("stackshot_capture_with_config failed with %s (%d), retrying",
229						strerror(ret), ret);
230			}
231
232			retries_remaining--;
233			goto retry;
234		} else {
235			T_ASSERT_POSIX_ZERO(ret,
236					"called stackshot_capture_with_config (no retries remaining)");
237		}
238	} else if ((ret == ENOTSUP) && scenario->maybe_unsupported) {
239		T_SKIP("kernel indicated this stackshot configuration is not supported");
240	} else if ((ret == ENOMEM) && scenario->maybe_enomem) {
241		T_SKIP("insufficient available memory to run test");
242	} else {
243		quiet(scenario);
244		T_ASSERT_POSIX_ZERO(ret, "called stackshot_capture_with_config");
245	}
246
247	if (scenario->timer) {
248		dt_stat_mach_time_add(scenario->timer, end_time - start_time);
249	}
250	void *buf = stackshot_config_get_stackshot_buffer(config);
251	size_t size = stackshot_config_get_stackshot_size(config);
252	if (scenario->name && !scenario->no_recordfile) {
253		char sspath[MAXPATHLEN];
254		strlcpy(sspath, scenario->name, sizeof(sspath));
255		strlcat(sspath, ".kcdata", sizeof(sspath));
256		T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(sspath, sizeof(sspath)),
257				"create result file path");
258
259		if (!scenario->quiet) {
260			T_LOG("writing stackshot to %s", sspath);
261		}
262
263		FILE *f = fopen(sspath, "w");
264		T_WITH_ERRNO; T_QUIET; T_ASSERT_NOTNULL(f,
265				"open stackshot output file");
266
267		size_t written = fwrite(buf, size, 1, f);
268		T_QUIET; T_ASSERT_POSIX_SUCCESS(written, "wrote stackshot to file");
269
270		fclose(f);
271
272		// the xnu lldbmacros include a kcdata dumper which is used by
273		// panic triage and other things to process the recorded data
274		// from panics.  With `-s foo.ips`, this generates a panic
275		// report similar.  It's really important that this continues to
276		// work.
277		//
278		// We also ship the same code as /usr/local/bin/kcdata.  To make
279		// sure the *.ips continues to work without aborting or otherwise
280		// tripping over the current data being output by xnu, we do a
281		// `kcdata.py -s /dev/null` run on the *first* kcdata we get for
282		// a given test, and save the stdout/err to files that get
283		// reported in the test report.  Typically it will tell you the
284		// shared cache UUID and maybe complain about missing exclaves
285		// data.
286		//
287		// This only works on full stackshots, so we skip it for DELTAs,
288		// and BridgeOS is missing python, so we make sure everything we
289		// need is executable before trying
290#define PYTHON3_PATH "/usr/local/bin/python3"
291#define KCDATA_PATH "/usr/local/bin/kcdata"
292		if (!(scenario->flags & STACKSHOT_COLLECT_DELTA_SNAPSHOT) &&
293		    !scenario->nocheck_recordfile &&
294		    access(PYTHON3_PATH, X_OK) == 0 && access(KCDATA_PATH, X_OK) == 0) {
295
296			scenario->nocheck_recordfile = true; // don't do this more than once per scenario
297			char outpath[MAXPATHLEN];
298			strlcpy(outpath, scenario->name, sizeof(outpath));
299			strlcat(outpath, ".kcdpy-out", sizeof(outpath));
300			char errpath[MAXPATHLEN];
301			strlcpy(errpath, scenario->name, sizeof(errpath));
302			strlcat(errpath, ".kcdpy-err", sizeof(errpath));
303			T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(outpath, sizeof(outpath)), "create py-out path");
304			T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(errpath, sizeof(errpath)), "create py-err path");
305
306			char *launch_tool_args[] = {
307				KCDATA_PATH,
308				"-s",
309				"/dev/null",
310				sspath,
311				NULL
312			};
313			pid_t child_pid = -1;
314			int ret = dt_launch_tool(&child_pid, launch_tool_args, false, outpath, errpath);
315			T_WITH_ERRNO; T_EXPECT_EQ(ret, 0, "dt_launch_tool(\"" KCDATA_PATH " -s /dev/null kcdata\") should succeed");
316			if (ret == 0) {
317				int exit_status = 0, signum = 0;
318				ret = dt_waitpid(child_pid, &exit_status, &signum, 60);
319				T_QUIET; T_EXPECT_EQ(ret, 1, "dt_waitpid() on "KCDATA_PATH);
320				if (ret == 1) {
321					T_EXPECT_EQ(exit_status, 0, "kcdata.py should successfully run against our output");
322					T_QUIET; T_EXPECT_EQ(signum, 0, "kcdata.py shouldn't get a signal");
323				}
324			}
325		}
326	}
327	cb(buf, size);
328	if (compress_ok) {
329		if (global_flags == 0) {
330			T_LOG("Restarting test with compression");
331			global_flags |= STACKSHOT_DO_COMPRESS;
332			goto start;
333		} else {
334			global_flags = 0;
335		}
336	}
337
338	ret = stackshot_config_dealloc(config);
339	T_QUIET; T_EXPECT_POSIX_ZERO(ret, "deallocated stackshot config");
340}
341
342T_DECL(simple_compressed, "take a simple compressed stackshot", T_META_TAG_VM_PREFERRED)
343{
344	struct scenario scenario = {
345		.name = "kcdata_compressed",
346		.flags = (STACKSHOT_DO_COMPRESS | STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS |
347				STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
348	};
349
350	T_LOG("taking compressed kcdata stackshot");
351	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
352		parse_stackshot(0, ssbuf, sslen, nil);
353	});
354}
355
356T_DECL(panic_compressed, "take a compressed stackshot with the same flags as a panic stackshot", T_META_TAG_VM_PREFERRED)
357{
358	uint64_t stackshot_flags = (STACKSHOT_SAVE_KEXT_LOADINFO |
359			STACKSHOT_SAVE_LOADINFO |
360			STACKSHOT_KCDATA_FORMAT |
361			STACKSHOT_ENABLE_BT_FAULTING |
362			STACKSHOT_ENABLE_UUID_FAULTING |
363			STACKSHOT_DO_COMPRESS |
364			STACKSHOT_NO_IO_STATS |
365			STACKSHOT_THREAD_WAITINFO |
366#if TARGET_OS_MAC
367			STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT |
368#endif
369			STACKSHOT_DISABLE_LATENCY_INFO);
370
371	struct scenario scenario = {
372		.name = "kcdata_panic_compressed",
373		.flags = stackshot_flags,
374	};
375
376	T_LOG("taking compressed kcdata stackshot with panic flags");
377	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
378		parse_stackshot(0, ssbuf, sslen, nil);
379	});
380}
381
382T_DECL(kcdata, "test that kcdata stackshots can be taken and parsed", T_META_TAG_VM_PREFERRED)
383{
384	struct scenario scenario = {
385		.name = "kcdata",
386		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS |
387				STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
388	};
389
390	T_LOG("taking kcdata stackshot");
391	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
392		parse_stackshot(0, ssbuf, sslen, nil);
393	});
394}
395
396static void
397get_stats(stackshot_stats_t *_Nonnull out)
398{
399	size_t oldlen = sizeof (*out);
400	bzero(out, oldlen);
401	int result = sysctlbyname("kern.stackshot_stats", out, &oldlen, NULL, 0);
402	T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(result, "reading \"kern.stackshot_stats\" sysctl should succeed");
403	T_EXPECT_EQ(oldlen, sizeof (*out), "kernel should update full stats structure");
404}
405
406static void
407log_stats(mach_timebase_info_data_t timebase, uint64_t now, const char *name, stackshot_stats_t stat)
408{
409	uint64_t last_ago = (now - stat.ss_last_start) * timebase.numer / timebase.denom;
410	uint64_t last_duration = (stat.ss_last_end - stat.ss_last_start) * timebase.numer / timebase.denom;
411	uint64_t total_duration = (stat.ss_duration) * timebase.numer / timebase.denom;
412
413	uint64_t nanosec = 1000000000llu;
414	T_LOG("%s: %8lld stackshots, %10lld.%09lld total nsecs, last %lld.%09lld secs ago, %lld.%09lld secs long",
415		name, stat.ss_count,
416		total_duration / nanosec, total_duration % nanosec,
417		last_ago / nanosec, last_ago % nanosec,
418		last_duration / nanosec, last_duration % nanosec);
419}
420
421T_DECL(stats, "test that stackshot stats can be read out and change when a stackshot occurs", T_META_TAG_VM_PREFERRED)
422{
423	mach_timebase_info_data_t timebase = {0, 0};
424	mach_timebase_info(&timebase);
425
426	struct scenario scenario = {
427		.name = "kcdata",
428		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
429	};
430
431	stackshot_stats_t pre, post;
432
433	get_stats(&pre);
434
435	T_LOG("taking kcdata stackshot");
436	take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) {
437		(void)0;
438	});
439
440	get_stats(&post);
441
442	uint64_t now = mach_absolute_time();
443
444	log_stats(timebase, now, "  pre", pre);
445	log_stats(timebase, now, " post", post);
446
447	int64_t delta_stackshots = (int64_t)(post.ss_count - pre.ss_count);
448	int64_t delta_duration = (int64_t)(post.ss_duration - pre.ss_duration) * (int64_t)timebase.numer / (int64_t)timebase.denom;
449	int64_t delta_nsec = delta_duration % 1000000000ll;
450	if (delta_nsec < 0) {
451	    delta_nsec += 1000000000ll;
452	}
453	T_LOG("delta: %+8lld stackshots, %+10lld.%09lld total nsecs", delta_stackshots, delta_duration / 1000000000ll, delta_nsec);
454
455	T_EXPECT_LT(pre.ss_last_start, pre.ss_last_end, "pre: stackshot should take time");
456	T_EXPECT_LT(pre.ss_count, post.ss_count, "stackshot count should increase when a stackshot is taken");
457	T_EXPECT_LT(pre.ss_duration, post.ss_duration, "stackshot duration should increase when a stackshot is taken");
458	T_EXPECT_LT(pre.ss_last_end, post.ss_last_start, "previous end should be less than new start after a stackshot");
459	T_EXPECT_LT(post.ss_last_start, post.ss_last_end, "post: stackshot should take time");
460}
461
462T_DECL(kcdata_faulting, "test that kcdata stackshots while faulting can be taken and parsed", T_META_TAG_VM_PREFERRED)
463{
464	struct scenario scenario = {
465		.name = "faulting",
466		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
467				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
468				| STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING),
469	};
470
471	T_LOG("taking faulting stackshot");
472	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
473		parse_stackshot(0, ssbuf, sslen, nil);
474	});
475}
476
477T_DECL(bad_flags, "test a poorly-formed stackshot syscall", T_META_TAG_VM_PREFERRED)
478{
479	struct scenario scenario = {
480		.flags = STACKSHOT_SAVE_IN_KERNEL_BUFFER /* not allowed from user space */,
481		.should_fail = true,
482	};
483
484	T_LOG("attempting to take stackshot with kernel-only flag");
485	take_stackshot(&scenario, true, ^(__unused void *ssbuf, __unused size_t sslen) {
486		T_ASSERT_FAIL("stackshot data callback called");
487	});
488}
489
490T_DECL(delta, "test delta stackshots", T_META_TAG_VM_PREFERRED)
491{
492	struct scenario scenario = {
493		.name = "delta",
494		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
495				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
496	};
497
498	T_LOG("taking full stackshot");
499	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
500		uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen);
501
502		T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time);
503
504		parse_stackshot(0, ssbuf, sslen, nil);
505
506		struct scenario delta_scenario = {
507			.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
508					| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
509					| STACKSHOT_COLLECT_DELTA_SNAPSHOT),
510			.since_timestamp = stackshot_time
511		};
512
513		take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) {
514			parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil);
515		});
516	});
517}
518
519T_DECL(shared_cache_layout, "test stackshot inclusion of shared cache layout", T_META_TAG_VM_PREFERRED)
520{
521	struct scenario scenario = {
522		.name = "shared_cache_layout",
523		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
524				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT |
525				STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT),
526	};
527
528	size_t shared_cache_length;
529	const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length);
530	if (cache_header == NULL) {
531		T_SKIP("Device not running with shared cache, skipping test...");
532	}
533
534	if (shared_cache_length == 0) {
535		T_SKIP("dyld reports that currently running shared cache has zero length");
536	}
537
538	T_LOG("taking stackshot with STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT set");
539	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
540		parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_LAYOUT, ssbuf, sslen, nil);
541	});
542}
543
544T_DECL(stress, "test that taking stackshots for 60 seconds doesn't crash the system", T_META_TAG_VM_PREFERRED)
545{
546	uint64_t max_diff_time = 60ULL /* seconds */ * 1000000000ULL;
547	uint64_t start_time;
548
549	struct scenario scenario = {
550		.name = "stress",
551		.quiet = true,
552		.flags = (STACKSHOT_KCDATA_FORMAT |
553				STACKSHOT_THREAD_WAITINFO |
554				STACKSHOT_SAVE_LOADINFO |
555				STACKSHOT_SAVE_KEXT_LOADINFO |
556				STACKSHOT_GET_GLOBAL_MEM_STATS |
557				STACKSHOT_SAVE_IMP_DONATION_PIDS |
558				STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT |
559				STACKSHOT_THREAD_GROUP |
560				STACKSHOT_SAVE_JETSAM_COALITIONS |
561				STACKSHOT_ASID |
562				STACKSHOT_EXCLAVES |
563				0),
564	};
565
566	start_time = clock_gettime_nsec_np(CLOCK_MONOTONIC);
567	while (clock_gettime_nsec_np(CLOCK_MONOTONIC) - start_time < max_diff_time) {
568		take_stackshot(&scenario, false, ^(void * __unused ssbuf,
569				size_t __unused sslen) {
570			printf(".");
571			fflush(stdout);
572		});
573
574		/*
575		 * After the first stackshot, there's no point in continuing to
576		 * write them to disk, and it wears down the SSDs.
577		 */
578		scenario.no_recordfile = true;
579
580		/* Leave some time for the testing infrastructure to catch up */
581		usleep(10000);
582
583	}
584	printf("\n");
585}
586
587T_DECL(dispatch_queue_label, "test that kcdata stackshots contain libdispatch queue labels", T_META_TAG_VM_PREFERRED)
588{
589	struct scenario scenario = {
590		.name = "kcdata",
591		.flags = (STACKSHOT_GET_DQ | STACKSHOT_KCDATA_FORMAT),
592	};
593	dispatch_semaphore_t child_ready_sem, parent_done_sem;
594	dispatch_queue_t dq;
595
596#if TARGET_OS_WATCH
597	T_SKIP("This test is flaky on watches: 51663346");
598#endif
599
600	child_ready_sem = dispatch_semaphore_create(0);
601	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "dqlabel child semaphore");
602
603	parent_done_sem = dispatch_semaphore_create(0);
604	T_QUIET; T_ASSERT_NOTNULL(parent_done_sem, "dqlabel parent semaphore");
605
606	dq = dispatch_queue_create(TEST_STACKSHOT_QUEUE_LABEL, NULL);
607	T_QUIET; T_ASSERT_NOTNULL(dq, "dispatch queue");
608
609	/* start the helper thread */
610	dispatch_async(dq, ^{
611			dispatch_semaphore_signal(child_ready_sem);
612
613			dispatch_semaphore_wait(parent_done_sem, DISPATCH_TIME_FOREVER);
614	});
615
616	/* block behind the child starting up */
617	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
618
619	T_LOG("taking kcdata stackshot with libdispatch queue labels");
620	take_stackshot(&scenario, true, ^(void *ssbuf, size_t sslen) {
621		parse_stackshot(PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL, ssbuf, sslen, nil);
622	});
623
624	dispatch_semaphore_signal(parent_done_sem);
625}
626
627#define CACHEADDR_ENV "STACKSHOT_TEST_DYLDADDR"
628T_HELPER_DECL(spawn_reslide_child, "child process to spawn with alternate slide")
629{
630	size_t shared_cache_len;
631	const void *addr, *prevaddr;
632	uintmax_t v;
633	char *endptr;
634
635	const char *cacheaddr_env = getenv(CACHEADDR_ENV);
636	T_QUIET; T_ASSERT_NOTNULL(cacheaddr_env, "getenv("CACHEADDR_ENV")");
637	errno = 0;
638	endptr = NULL;
639	v = strtoumax(cacheaddr_env, &endptr, 16);	/* read hex value */
640	T_WITH_ERRNO; T_QUIET; T_ASSERT_NE(v, 0l, "getenv(%s) = \"%s\" should be a non-zero hex number", CACHEADDR_ENV, cacheaddr_env);
641	T_QUIET; T_ASSERT_EQ(*endptr, 0, "getenv(%s) = \"%s\" endptr \"%s\" should be empty", CACHEADDR_ENV, cacheaddr_env, endptr);
642
643	prevaddr = (const void *)v;
644	addr = _dyld_get_shared_cache_range(&shared_cache_len);
645	T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address");
646
647	T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(getppid(), (addr == prevaddr) ? SIGUSR2 : SIGUSR1), "signaled parent to take stackshot");
648	for (;;) {
649		(void) pause();		/* parent will kill -9 us */
650	}
651}
652
653T_DECL(shared_cache_flags, "tests stackshot's task_ss_flags for the shared cache", T_META_TAG_VM_PREFERRED)
654{
655	posix_spawnattr_t		attr;
656	char *env_addr;
657	char path[PATH_MAX];
658	__block bool child_same_addr = false;
659
660	uint32_t path_size = sizeof(path);
661	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
662	char *args[] = { path, "-n", "spawn_reslide_child", NULL };
663	pid_t pid;
664	size_t shared_cache_len;
665	const void *addr;
666
667	dispatch_source_t child_diffsig_src, child_samesig_src;
668	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
669	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "shared_cache child semaphore");
670
671	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
672	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
673
674	signal(SIGUSR1, SIG_IGN);
675	signal(SIGUSR2, SIG_IGN);
676	child_samesig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
677	T_QUIET; T_ASSERT_NOTNULL(child_samesig_src, "dispatch_source_create (child_samesig_src)");
678	child_diffsig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR2, 0, signal_processing_q);
679	T_QUIET; T_ASSERT_NOTNULL(child_diffsig_src, "dispatch_source_create (child_diffsig_src)");
680
681	/* child will signal us depending on if their addr is the same or different */
682	dispatch_source_set_event_handler(child_samesig_src, ^{ child_same_addr = false; dispatch_semaphore_signal(child_ready_sem); });
683	dispatch_source_set_event_handler(child_diffsig_src, ^{ child_same_addr = true; dispatch_semaphore_signal(child_ready_sem); });
684	dispatch_activate(child_samesig_src);
685	dispatch_activate(child_diffsig_src);
686
687	addr = _dyld_get_shared_cache_range(&shared_cache_len);
688	T_QUIET; T_ASSERT_NOTNULL(addr, "shared cache address");
689
690	T_QUIET; T_ASSERT_POSIX_SUCCESS(asprintf(&env_addr, "%p", addr), "asprintf of env_addr succeeded");
691	T_QUIET; T_ASSERT_POSIX_SUCCESS(setenv(CACHEADDR_ENV, env_addr, true), "setting "CACHEADDR_ENV" to %s", env_addr);
692
693	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&attr), "posix_spawnattr_init");
694	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawnattr_setflags(&attr, _POSIX_SPAWN_RESLIDE), "posix_spawnattr_setflags");
695	int sp_ret = posix_spawn(&pid, path, NULL, &attr, args, environ);
696	T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
697
698	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
699	T_LOG("received signal from child (%s), capturing stackshot", child_same_addr ? "same shared cache addr" : "different shared cache addr");
700
701	struct scenario scenario = {
702		.name = "shared_cache_flags",
703		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
704				| STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT
705				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
706	};
707
708	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
709		int status;
710		/* First kill the child so we can reap it */
711		T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing spawned process");
712		T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on spawned child");
713		T_QUIET; T_ASSERT_EQ(!!WIFSIGNALED(status), 1, "waitpid status should be signalled");
714		T_QUIET; T_ASSERT_EQ(WTERMSIG(status), SIGKILL, "waitpid status should be SIGKILLed");
715
716		parse_stackshot(PARSE_STACKSHOT_SHAREDCACHE_FLAGS, ssbuf, sslen,
717			@{sharedcache_child_pid_key: @(pid), sharedcache_child_sameaddr_key: @(child_same_addr ? 1 : 0)});
718	});
719}
720
721T_DECL(transitioning_tasks, "test that stackshot contains transitioning task info", T_META_BOOTARGS_SET("enable_proc_exit_lpexit_spin=1"), T_META_TAG_VM_PREFERRED)
722{
723    int32_t sysctlValue = -1, numAttempts =0;
724    char path[PATH_MAX];
725    uint32_t path_size = sizeof(path);
726    T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
727    char *args[] = { path, "-n", "exec_child_preexec", NULL };
728
729    dispatch_source_t child_sig_src;
730    dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
731    T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
732
733    dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
734    T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
735
736    pid_t pid;
737
738    signal(SIGUSR1, SIG_IGN);
739    child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
740    T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
741
742    dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
743    dispatch_activate(child_sig_src);
744
745    T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValue, sizeof(sysctlValue)), "set debug.proc_exit_lpexit_spin_pid=-1");
746
747    int proc_exit_spin_pos = 0 ;
748
749    while (0 == sysctlbyname("debug.proc_exit_lpexit_spin_pos", NULL, NULL, &proc_exit_spin_pos, sizeof(proc_exit_spin_pos))) {
750
751        T_LOG(" ##### Testing while spinning in proc_exit at position %d ##### ", proc_exit_spin_pos);
752
753        int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
754        T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
755
756        dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
757
758        struct proc_uniqidentifierinfo proc_info_data = { };
759        int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
760        T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
761        T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
762
763        T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec");
764
765	/* wait for a signal from post-exec child */
766        dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
767
768        T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &pid, sizeof(pid)), "set debug.proc_exit_lpexit_spin_pid =  %d, ", pid);
769
770        T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid);
771
772        sysctlValue = 0;
773        size_t len = sizeof(sysctlValue);
774        while (numAttempts < 5) {
775            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValue, &len, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning");
776            if (sysctlValue != 1) numAttempts++;
777            else break;
778            sleep(1);
779        }
780
781        T_ASSERT_EQ_UINT(sysctlValue, 1, "find spinning task in proc_exit()");
782
783        struct scenario scenario = {
784            .name = "transitioning_tasks",
785            .flags = (STACKSHOT_KCDATA_FORMAT)
786        };
787
788        take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
789            parse_stackshot(PARSE_STACKSHOT_TRANSITIONING, ssbuf, sslen, @{transitioning_pid_key: @(pid)});
790
791            // Kill the child
792            int sysctlValueB = -1;
793            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spin_pid", NULL, NULL, &sysctlValueB, sizeof(sysctlValueB)), "set debug.proc_exit_lpexit_spin_pid=-1");
794            sleep(1);
795            size_t blen = sizeof(sysctlValueB);
796            T_ASSERT_POSIX_SUCCESS(sysctlbyname("debug.proc_exit_lpexit_spinning", &sysctlValueB, &blen, NULL, 0), "retrieve debug.proc_exit_lpexit_spinning");
797            T_ASSERT_EQ_UINT(sysctlValueB, 0, "make sure nothing is spining in proc_exit()");
798            int status;
799            T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child");
800        });
801
802        proc_exit_spin_pos++;
803    }
804
805}
806
807static void *stuck_sysctl_thread(void *arg) {
808	int val = 1;
809	dispatch_semaphore_t child_thread_started = *(dispatch_semaphore_t *)arg;
810
811	dispatch_semaphore_signal(child_thread_started);
812	T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread");
813
814	return NULL;
815}
816
817T_HELPER_DECL(zombie_child, "child process to sample as a zombie")
818{
819	pthread_t pthread;
820	dispatch_semaphore_t child_thread_started = dispatch_semaphore_create(0);
821	T_QUIET; T_ASSERT_NOTNULL(child_thread_started, "zombie child thread semaphore");
822
823	/* spawn another thread to get stuck in the kernel, then call exit() to become a zombie */
824	T_QUIET; T_ASSERT_POSIX_SUCCESS(pthread_create(&pthread, NULL, stuck_sysctl_thread, &child_thread_started), "pthread_create");
825
826	dispatch_semaphore_wait(child_thread_started, DISPATCH_TIME_FOREVER);
827
828	/* sleep for a bit in the hope of ensuring that the other thread has called the sysctl before we signal the parent */
829	usleep(100);
830	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot");
831
832	exit(0);
833}
834
835T_DECL(zombie, "tests a stackshot of a zombie task with a thread stuck in the kernel",
836	T_META_ENABLED(false), /* test is too flaky to run by default, but transitioning_tasks covers this case as well */
837	T_META_TAG_VM_PREFERRED)
838{
839	char path[PATH_MAX];
840	uint32_t path_size = sizeof(path);
841	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
842	char *args[] = { path, "-n", "zombie_child", NULL };
843
844	dispatch_source_t child_sig_src;
845	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
846	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "zombie child semaphore");
847
848	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
849	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
850
851	pid_t pid;
852
853	T_LOG("spawning a child");
854
855	signal(SIGUSR1, SIG_IGN);
856	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
857	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
858
859	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
860	dispatch_activate(child_sig_src);
861
862	int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
863	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
864
865	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
866
867	T_LOG("received signal from child, capturing stackshot");
868
869	struct proc_bsdshortinfo bsdshortinfo;
870	int retval, iterations_to_wait = 10;
871
872	while (iterations_to_wait > 0) {
873		retval = proc_pidinfo(pid, PROC_PIDT_SHORTBSDINFO, 0, &bsdshortinfo, sizeof(bsdshortinfo));
874		if ((retval == 0) && errno == ESRCH) {
875			T_LOG("unable to find child using proc_pidinfo, assuming zombie");
876			break;
877		}
878
879		T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDT_SHORTBSDINFO) returned a value > 0");
880		T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(bsdshortinfo), "proc_pidinfo call for PROC_PIDT_SHORTBSDINFO returned expected size");
881
882		if (bsdshortinfo.pbsi_flags & PROC_FLAG_INEXIT) {
883			T_LOG("child proc info marked as in exit");
884			break;
885		}
886
887		iterations_to_wait--;
888		if (iterations_to_wait == 0) {
889			/*
890			 * This will mark the test as failed but let it continue so we
891			 * don't leave a process stuck in the kernel.
892			 */
893			T_FAIL("unable to discover that child is marked as exiting");
894		}
895
896		/* Give the child a few more seconds to make it to exit */
897		sleep(5);
898	}
899
900	/* Give the child some more time to make it through exit */
901	sleep(10);
902
903	struct scenario scenario = {
904		.name = "zombie",
905		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
906				| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
907	};
908
909	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
910		/* First unwedge the child so we can reap it */
911		int val = 1, status;
912		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child");
913
914		T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on zombie child");
915
916		parse_stackshot(PARSE_STACKSHOT_ZOMBIE, ssbuf, sslen, @{zombie_child_pid_key: @(pid)});
917	});
918}
919
920T_HELPER_DECL(exec_child_preexec, "child process pre-exec")
921{
922	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
923	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
924
925	signal(SIGUSR1, SIG_IGN);
926	dispatch_source_t parent_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
927	T_QUIET; T_ASSERT_NOTNULL(parent_sig_src, "dispatch_source_create (child_sig_src)");
928	dispatch_source_set_event_handler(parent_sig_src, ^{
929
930		// Parent took a timestamp then signaled us: exec into the next process
931
932		char path[PATH_MAX];
933		uint32_t path_size = sizeof(path);
934		T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
935		char *args[] = { path, "-n", "exec_child_postexec", NULL };
936
937		T_QUIET; T_ASSERT_POSIX_ZERO(execve(args[0], args, NULL), "execing into exec_child_postexec");
938	});
939	dispatch_activate(parent_sig_src);
940
941	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take timestamp");
942
943	sleep(100);
944	// Should never get here
945	T_FAIL("Received signal to exec from parent");
946}
947
948T_HELPER_DECL(exec_child_postexec, "child process post-exec to sample")
949{
950	T_ASSERT_POSIX_SUCCESS(kill(getppid(), SIGUSR1), "signaled parent to take stackshot");
951	sleep(100);
952	// Should never get here
953	T_FAIL("Killed by parent");
954}
955
956T_DECL(exec, "test getting full task snapshots for a task that execs", T_META_TAG_VM_PREFERRED)
957{
958	char path[PATH_MAX];
959	uint32_t path_size = sizeof(path);
960	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
961	char *args[] = { path, "-n", "exec_child_preexec", NULL };
962
963	dispatch_source_t child_sig_src;
964	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
965	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
966
967	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
968	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
969
970	pid_t pid;
971
972	T_LOG("spawning a child");
973
974	signal(SIGUSR1, SIG_IGN);
975	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
976	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
977
978	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
979	dispatch_activate(child_sig_src);
980
981	int sp_ret = posix_spawn(&pid, args[0], NULL, NULL, args, NULL);
982	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", args[0], pid);
983
984	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
985	uint64_t start_time = mach_absolute_time();
986
987	struct proc_uniqidentifierinfo proc_info_data = { };
988	int retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
989	T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
990	T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
991	uint64_t unique_pid = proc_info_data.p_uniqueid;
992
993	T_LOG("received signal from pre-exec child, unique_pid is %llu, timestamp is %llu", unique_pid, start_time);
994
995	T_ASSERT_POSIX_SUCCESS(kill(pid, SIGUSR1), "signaled pre-exec child to exec");
996
997	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
998
999	T_LOG("received signal from post-exec child, capturing stackshot");
1000
1001	struct scenario scenario = {
1002		.name = "exec",
1003		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
1004				  | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT
1005				  | STACKSHOT_COLLECT_DELTA_SNAPSHOT),
1006		.since_timestamp = start_time
1007	};
1008
1009	take_stackshot(&scenario, false, ^( void *ssbuf, size_t sslen) {
1010		// Kill the child
1011		int status;
1012		T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "kill post-exec child %d", pid);
1013		T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on post-exec child");
1014
1015		parse_stackshot(PARSE_STACKSHOT_POSTEXEC | PARSE_STACKSHOT_DELTA, ssbuf, sslen, @{postexec_child_unique_pid_key: @(unique_pid)});
1016	});
1017}
1018
1019T_DECL(
1020	exec_inprogress,
1021	"test stackshots of processes in the middle of exec",
1022	T_META_ENABLED(false), /* rdar://111691318 */
1023	T_META_TAG_VM_PREFERRED)
1024{
1025	pid_t pid;
1026	/* a BASH quine which execs itself as long as the parent doesn't exit */
1027        char *bash_prog = "[[ $PPID -ne 1 ]] && exec /bin/bash -c \"$0\" \"$0\"";
1028	char *args[] = { "/bin/bash", "-c", bash_prog, bash_prog, NULL };
1029
1030	posix_spawnattr_t sattr;
1031	T_ASSERT_POSIX_ZERO(posix_spawnattr_init(&sattr), "posix_spawnattr_init");
1032	T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, &sattr, args, NULL), "spawn exec_inprogress_child");
1033
1034	struct scenario scenario = {
1035		.name = "exec_inprogress",
1036		.flags = (STACKSHOT_KCDATA_FORMAT),
1037		.target_pid = pid,
1038	};
1039
1040	int tries = 0;
1041	int tries_limit = 30;
1042	__block bool found = false;
1043	__block uint64_t cid1 = 0, cid2 = 0;
1044
1045	for (tries = 0; !found && tries < tries_limit; tries++) {
1046		take_stackshot(&scenario, false,
1047		    ^( void *ssbuf, size_t sslen) {
1048			parse_stackshot(PARSE_STACKSHOT_EXEC_INPROGRESS | PARSE_STACKSHOT_TARGETPID,
1049			    ssbuf, sslen, @{
1050				exec_inprogress_pid_key: @(pid),
1051				exec_inprogress_found_key: ^(uint64_t id1, uint64_t id2) { found = true; cid1 = id1; cid2 = id2; }});
1052		});
1053	}
1054	T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGKILL), "killing exec loop");
1055	T_ASSERT_TRUE(found, "able to find our execing process mid-exec in %d tries", tries);
1056	T_ASSERT_NE(cid1, cid2, "container IDs for in-progress exec are unique");
1057	T_PASS("found mid-exec process in %d tries", tries);
1058}
1059
1060#ifdef _LP64
1061#if __has_feature(ptrauth_calls)
1062#define __ptrauth_swift_async_context_parent \
1063  __ptrauth(ptrauth_key_process_independent_data, 1, 0xbda2)
1064#define __ptrauth_swift_async_context_resume \
1065  __ptrauth(ptrauth_key_function_pointer, 1, 0xd707)
1066#else
1067#define __ptrauth_swift_async_context_parent
1068#define __ptrauth_swift_async_context_resume
1069#endif
1070// Add 1 to match the symbolication aid added by the stackshot backtracer.
1071#define asyncstack_frame(x) ((uintptr_t)(void *)ptrauth_strip((void *)(x), ptrauth_key_function_pointer) + 1)
1072
1073// This struct fakes the Swift AsyncContext struct which is used by
1074// the Swift concurrency runtime. We only care about the first 2 fields.
1075struct fake_async_context {
1076	struct fake_async_context* __ptrauth_swift_async_context_parent next;
1077	void(*__ptrauth_swift_async_context_resume resume_pc)(void);
1078};
1079
1080static void
1081level1_func()
1082{
1083}
1084static void
1085level2_func()
1086{
1087}
1088
1089// Create a chain of fake async contexts; sync with asyncstack_expected_stack below
1090static alignas(16) struct fake_async_context level1 = { 0, level1_func };
1091static alignas(16) struct fake_async_context level2 = { &level1, level2_func };
1092
1093struct async_test_semaphores {
1094	dispatch_semaphore_t child_ready_sem;	/* signal parent we're ready */
1095	dispatch_semaphore_t child_exit_sem;	/* parent tells us to go away */
1096};
1097
1098#define	ASYNCSTACK_THREAD_NAME "asyncstack_thread"
1099
1100static void __attribute__((noinline, not_tail_called))
1101expect_asyncstack(void *arg)
1102{
1103	struct async_test_semaphores *async_ts = arg;
1104
1105	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_setname_np(ASYNCSTACK_THREAD_NAME),
1106	     "set thread name to %s", ASYNCSTACK_THREAD_NAME);
1107
1108	/* Tell the main thread we're all set up, then wait for permission to exit */
1109	dispatch_semaphore_signal(async_ts->child_ready_sem);
1110	dispatch_semaphore_wait(async_ts->child_exit_sem, DISPATCH_TIME_FOREVER);
1111	usleep(1);	/* make sure we don't tailcall semaphore_wait */
1112}
1113
1114static void *
1115asyncstack_thread(void *arg)
1116{
1117	uint64_t *fp = __builtin_frame_address(0);
1118	// We cannot use a variable of pointer type, because this ABI is valid
1119	// on arm64_32 where pointers are 32bits, but the context pointer will
1120	// still be stored in a 64bits slot on the stack.
1121#if __has_feature(ptrauth_calls)
1122#define __stack_context_auth __ptrauth(ptrauth_key_process_dependent_data, 1, \
1123	        0xc31a)
1124	struct fake_async_context * __stack_context_auth ctx = &level2;
1125#else // __has_feature(ptrauth_calls)
1126	/* struct fake_async_context * */uint64_t ctx  = (uintptr_t)&level2;
1127#endif // !__has_feature(ptrauth_calls)
1128
1129	// The signature of an async frame on the OS stack is:
1130	// [ <AsyncContext address>, <Saved FP | (1<<60)>, <return address> ]
1131	// The Async context must be right before the saved FP on the stack. This
1132	// should happen naturally in an optimized build as it is the only
1133	// variable on the stack.
1134	// This function cannot use T_ASSERT_* becuse it changes the stack
1135	// layout.
1136	assert((uintptr_t)fp - (uintptr_t)&ctx == 8);
1137
1138	// Modify the saved FP on the stack to include the async frame marker
1139	*fp |= (0x1ULL << 60);
1140	expect_asyncstack(arg);
1141	return NULL;
1142}
1143
1144T_DECL(asyncstack, "test swift async stack entries", T_META_TAG_VM_PREFERRED)
1145{
1146	struct scenario scenario = {
1147		.name = "asyncstack",
1148		.flags = STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO,
1149	};
1150	struct async_test_semaphores async_ts = {
1151	    .child_ready_sem = dispatch_semaphore_create(0),
1152	    .child_exit_sem = dispatch_semaphore_create(0),
1153	};
1154	T_QUIET; T_ASSERT_NOTNULL(async_ts.child_ready_sem, "child_ready_sem alloc");
1155	T_QUIET; T_ASSERT_NOTNULL(async_ts.child_exit_sem, "child_exit_sem alloc");
1156
1157	pthread_t pthread;
1158	__block uint64_t threadid = 0;
1159	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_create(&pthread, NULL, asyncstack_thread, &async_ts), "pthread_create");
1160	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_threadid_np(pthread, &threadid), "pthread_threadid_np");
1161
1162	dispatch_semaphore_wait(async_ts.child_ready_sem, DISPATCH_TIME_FOREVER);
1163
1164	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1165		parse_stackshot(PARSE_STACKSHOT_ASYNCSTACK, ssbuf, sslen, @{
1166		    asyncstack_expected_threadid_key: @(threadid),
1167		       asyncstack_expected_stack_key: @[ @(asyncstack_frame(level2_func)), @(asyncstack_frame(level1_func)) ],
1168		});
1169	});
1170
1171	dispatch_semaphore_signal(async_ts.child_exit_sem);
1172	T_QUIET; T_ASSERT_POSIX_ZERO(pthread_join(pthread, NULL), "wait for thread");
1173
1174}
1175#endif /* #ifdef _LP64 */
1176
1177static uint32_t
1178get_user_promotion_basepri(void)
1179{
1180	mach_msg_type_number_t count = THREAD_POLICY_STATE_COUNT;
1181	struct thread_policy_state thread_policy;
1182	boolean_t get_default = FALSE;
1183	mach_port_t thread_port = pthread_mach_thread_np(pthread_self());
1184
1185	kern_return_t kr = thread_policy_get(thread_port, THREAD_POLICY_STATE,
1186	    (thread_policy_t)&thread_policy, &count, &get_default);
1187	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_policy_get");
1188	return thread_policy.thps_user_promotion_basepri;
1189}
1190
1191static int
1192get_pri(thread_t thread_port)
1193{
1194	kern_return_t kr;
1195
1196	thread_extended_info_data_t extended_info;
1197	mach_msg_type_number_t count = THREAD_EXTENDED_INFO_COUNT;
1198	kr = thread_info(thread_port, THREAD_EXTENDED_INFO,
1199	    (thread_info_t)&extended_info, &count);
1200
1201	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_info");
1202
1203	return extended_info.pth_curpri;
1204}
1205
1206
1207T_DECL(turnstile_singlehop, "turnstile single hop test", T_META_TAG_VM_PREFERRED)
1208{
1209	dispatch_queue_t dq1, dq2;
1210	dispatch_semaphore_t sema_x;
1211	dispatch_queue_attr_t dq1_attr, dq2_attr;
1212	__block qos_class_t main_qos = 0;
1213	__block int main_relpri = 0, main_relpri2 = 0, main_afterpri = 0;
1214	struct scenario scenario = {
1215		.name = "turnstile_singlehop",
1216		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1217	};
1218	dq1_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_UTILITY, 0);
1219	dq2_attr = dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL, QOS_CLASS_USER_INITIATED, 0);
1220	pthread_mutex_t lock_a = PTHREAD_MUTEX_INITIALIZER;
1221	pthread_mutex_t lock_b = PTHREAD_MUTEX_INITIALIZER;
1222
1223	pthread_mutex_t *lockap = &lock_a, *lockbp = &lock_b;
1224
1225	dq1 = dispatch_queue_create("q1", dq1_attr);
1226	dq2 = dispatch_queue_create("q2", dq2_attr);
1227	sema_x = dispatch_semaphore_create(0);
1228
1229	pthread_mutex_lock(lockap);
1230	dispatch_async(dq1, ^{
1231		pthread_mutex_lock(lockbp);
1232		T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class");
1233		T_LOG("The priority of q1 is %d\n", get_pri(mach_thread_self()));
1234		dispatch_semaphore_signal(sema_x);
1235		pthread_mutex_lock(lockap);
1236	});
1237	dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER);
1238
1239	T_LOG("Async1 completed");
1240
1241	pthread_set_qos_class_self_np(QOS_CLASS_UTILITY, 0);
1242	T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri), "get qos class");
1243	T_LOG("The priority of main is %d\n", get_pri(mach_thread_self()));
1244	main_relpri = get_pri(mach_thread_self());
1245
1246	dispatch_async(dq2, ^{
1247		T_ASSERT_POSIX_SUCCESS(pthread_get_qos_class_np(pthread_self(), &main_qos, &main_relpri2), "get qos class");
1248		T_LOG("The priority of q2 is %d\n", get_pri(mach_thread_self()));
1249		dispatch_semaphore_signal(sema_x);
1250		pthread_mutex_lock(lockbp);
1251	});
1252	dispatch_semaphore_wait(sema_x, DISPATCH_TIME_FOREVER);
1253
1254	T_LOG("Async2 completed");
1255
1256	while (1) {
1257		main_afterpri = (int) get_user_promotion_basepri();
1258		if (main_relpri != main_afterpri) {
1259			T_LOG("Success with promotion pri is %d", main_afterpri);
1260			break;
1261		}
1262
1263		usleep(100);
1264	}
1265
1266	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1267		parse_stackshot(PARSE_STACKSHOT_TURNSTILEINFO, ssbuf, sslen, nil);
1268	});
1269}
1270
1271
1272static void
1273expect_instrs_cycles_in_stackshot(void *ssbuf, size_t sslen)
1274{
1275	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1276
1277	bool in_task = false;
1278	bool in_thread = false;
1279	bool saw_instrs_cycles = false;
1280	iter = kcdata_iter_next(iter);
1281
1282	KCDATA_ITER_FOREACH(iter) {
1283		switch (kcdata_iter_type(iter)) {
1284		case KCDATA_TYPE_CONTAINER_BEGIN:
1285			switch (kcdata_iter_container_type(iter)) {
1286			case STACKSHOT_KCCONTAINER_TASK:
1287				in_task = true;
1288				saw_instrs_cycles = false;
1289				break;
1290
1291			case STACKSHOT_KCCONTAINER_THREAD:
1292				in_thread = true;
1293				saw_instrs_cycles = false;
1294				break;
1295
1296			default:
1297				break;
1298			}
1299			break;
1300
1301		case STACKSHOT_KCTYPE_INSTRS_CYCLES:
1302			saw_instrs_cycles = true;
1303			break;
1304
1305		case KCDATA_TYPE_CONTAINER_END:
1306			if (in_thread) {
1307				T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles,
1308						"saw instructions and cycles in thread");
1309				in_thread = false;
1310			} else if (in_task) {
1311				T_QUIET; T_EXPECT_TRUE(saw_instrs_cycles,
1312						"saw instructions and cycles in task");
1313				in_task = false;
1314			}
1315
1316		default:
1317			break;
1318		}
1319	}
1320}
1321
1322static void
1323skip_if_monotonic_unsupported(void)
1324{
1325	int supported = 0;
1326	size_t supported_size = sizeof(supported);
1327	int ret = sysctlbyname("kern.monotonic.supported", &supported,
1328			&supported_size, 0, 0);
1329	if (ret < 0 || !supported) {
1330		T_SKIP("monotonic is unsupported");
1331	}
1332}
1333
1334T_DECL(instrs_cycles, "test a getting instructions and cycles in stackshot", T_META_TAG_VM_PREFERRED)
1335{
1336	skip_if_monotonic_unsupported();
1337
1338	struct scenario scenario = {
1339		.name = "instrs-cycles",
1340		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1341				| STACKSHOT_KCDATA_FORMAT),
1342	};
1343
1344	T_LOG("attempting to take stackshot with instructions and cycles");
1345	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1346		parse_stackshot(0, ssbuf, sslen, nil);
1347		expect_instrs_cycles_in_stackshot(ssbuf, sslen);
1348	});
1349}
1350
1351T_DECL(delta_instrs_cycles,
1352		"test delta stackshots with instructions and cycles", T_META_TAG_VM_PREFERRED)
1353{
1354	skip_if_monotonic_unsupported();
1355
1356	struct scenario scenario = {
1357		.name = "delta-instrs-cycles",
1358		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1359				| STACKSHOT_KCDATA_FORMAT),
1360	};
1361
1362	T_LOG("taking full stackshot");
1363	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1364		uint64_t stackshot_time = stackshot_timestamp(ssbuf, sslen);
1365
1366		T_LOG("taking delta stackshot since time %" PRIu64, stackshot_time);
1367
1368		parse_stackshot(0, ssbuf, sslen, nil);
1369		expect_instrs_cycles_in_stackshot(ssbuf, sslen);
1370
1371		struct scenario delta_scenario = {
1372			.name = "delta-instrs-cycles-next",
1373			.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_INSTRS_CYCLES
1374					| STACKSHOT_KCDATA_FORMAT
1375					| STACKSHOT_COLLECT_DELTA_SNAPSHOT),
1376			.since_timestamp = stackshot_time,
1377		};
1378
1379		take_stackshot(&delta_scenario, false, ^(void *dssbuf, size_t dsslen) {
1380			parse_stackshot(PARSE_STACKSHOT_DELTA, dssbuf, dsslen, nil);
1381			expect_instrs_cycles_in_stackshot(dssbuf, dsslen);
1382		});
1383	});
1384}
1385
1386static void
1387check_thread_groups_supported()
1388{
1389	int err;
1390	int supported = 0;
1391	size_t supported_size = sizeof(supported);
1392	err = sysctlbyname("kern.thread_groups_supported", &supported, &supported_size, NULL, 0);
1393
1394	if (err || !supported)
1395		T_SKIP("thread groups not supported on this system");
1396}
1397
1398T_DECL(thread_groups, "test getting thread groups in stackshot", T_META_TAG_VM_PREFERRED)
1399{
1400	check_thread_groups_supported();
1401
1402	struct scenario scenario = {
1403		.name = "thread-groups",
1404		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_THREAD_GROUP
1405				| STACKSHOT_KCDATA_FORMAT),
1406	};
1407
1408	T_LOG("attempting to take stackshot with thread group flag");
1409	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1410		parse_thread_group_stackshot(ssbuf, sslen);
1411	});
1412}
1413
1414T_DECL(compactinfo, "test compactinfo inclusion", T_META_TAG_VM_PREFERRED)
1415{
1416	struct scenario scenario = {
1417		.name = "compactinfo",
1418		.target_pid = getpid(),
1419		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_SAVE_DYLD_COMPACTINFO
1420				| STACKSHOT_KCDATA_FORMAT),
1421	};
1422
1423	T_LOG("attempting to take stackshot with compactinfo flag");
1424	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1425		parse_stackshot(PARSE_STACKSHOT_COMPACTINFO | PARSE_STACKSHOT_TARGETPID, ssbuf, sslen, nil);
1426	});
1427}
1428
1429T_DECL(suspendinfo, "test task suspend info inclusion", T_META_TAG_VM_PREFERRED)
1430{
1431	struct scenario scenario = {
1432		.name = "suspendinfo",
1433		.target_pid = getpid(),
1434		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
1435	};
1436
1437	T_LOG("attempting to take stackshot with suspendinfo flag");
1438	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1439		parse_stackshot(PARSE_STACKSHOT_SUSPENDINFO | PARSE_STACKSHOT_TARGETPID, ssbuf, sslen, nil);
1440	});
1441}
1442
1443static NSMutableSet * find_driverkit_pids(io_registry_entry_t root) {
1444	NSMutableSet * driverkit_pids = [NSMutableSet setWithCapacity:3];
1445	io_registry_entry_t current = IO_OBJECT_NULL;
1446	io_iterator_t iter = IO_OBJECT_NULL;
1447
1448	T_EXPECT_MACH_SUCCESS(IORegistryEntryGetChildIterator(root, kIOServicePlane, &iter), "get registry iterator");
1449
1450	while ((current = IOIteratorNext(iter)) != IO_OBJECT_NULL) {
1451		if (_IOObjectConformsTo(current, "IOUserServer", kIOClassNameOverrideNone)) {
1452			CFMutableDictionaryRef cfProperties = NULL;
1453			NSMutableDictionary * properties;
1454			NSString * client_creator_info;
1455			NSArray<NSString *> *creator_info_array;
1456			pid_t pid;
1457
1458			T_QUIET; T_EXPECT_MACH_SUCCESS(IORegistryEntryCreateCFProperties(current, &cfProperties, kCFAllocatorDefault, kNilOptions), "get properties");
1459			properties = CFBridgingRelease(cfProperties);
1460			T_QUIET; T_ASSERT_NOTNULL(properties, "properties is not null");
1461			client_creator_info = properties[@kIOUserClientCreatorKey];
1462			creator_info_array = [client_creator_info componentsSeparatedByString:@","];
1463			if ([creator_info_array[0] hasPrefix:@"pid"]) {
1464				NSArray<NSString *> *pid_info = [creator_info_array[0] componentsSeparatedByString:@" "];
1465				T_QUIET; T_ASSERT_EQ(pid_info.count, 2UL, "Get pid info components from %s", creator_info_array[0].UTF8String);
1466				pid = pid_info[1].intValue;
1467			} else {
1468				T_ASSERT_FAIL("No pid info in client creator info: %s", client_creator_info.UTF8String);
1469			}
1470			T_LOG("Found driver pid %d", pid);
1471			[driverkit_pids addObject:[NSNumber numberWithInt:pid]];
1472		} else {
1473			[driverkit_pids unionSet:find_driverkit_pids(current)];
1474		}
1475		IOObjectRelease(current);
1476	}
1477
1478	IOObjectRelease(iter);
1479	return driverkit_pids;
1480}
1481
1482T_DECL(driverkit, "test driverkit inclusion", T_META_TAG_VM_PREFERRED)
1483{
1484	struct scenario scenario = {
1485		.name = "driverkit",
1486		.target_kernel = true,
1487		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT
1488			    | STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL),
1489	};
1490
1491	io_registry_entry_t root = IORegistryGetRootEntry(kIOMainPortDefault);
1492	NSMutableSet * driverkit_pids = find_driverkit_pids(root);
1493	IOObjectRelease(root);
1494
1495	T_LOG("expecting to find %lu driverkit processes", [driverkit_pids count]);
1496	T_LOG("attempting to take stackshot with STACKSHOT_INCLUDE_DRIVER_THREADS_IN_KERNEL flag");
1497	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1498		parse_stackshot(PARSE_STACKSHOT_DRIVERKIT | PARSE_STACKSHOT_TARGETPID, ssbuf, sslen, @{
1499			driverkit_found_key: ^(pid_t pid) {
1500				[driverkit_pids removeObject:[NSNumber numberWithInt:pid]];
1501		}});
1502	});
1503
1504	T_EXPECT_EQ([driverkit_pids count], (NSUInteger)0, "found expected number of driverkit processes");
1505}
1506
1507static void
1508parse_page_table_asid_stackshot(void **ssbuf, size_t sslen)
1509{
1510	bool seen_asid = false;
1511	bool seen_page_table_snapshot = false;
1512	bool seen_task = false;
1513	int container = 0;
1514	int task_container = -1;
1515	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1516	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
1517			"buffer provided is a stackshot");
1518
1519	iter = kcdata_iter_next(iter);
1520	KCDATA_ITER_FOREACH(iter) {
1521		switch (kcdata_iter_type(iter)) {
1522		/* There's a slight chance that we see a transit version of this task
1523		 * in the stackshot, so we want to make sure to check both */
1524		case KCDATA_TYPE_CONTAINER_BEGIN: {
1525			container++;
1526			if (kcdata_iter_container_type(iter) == STACKSHOT_KCCONTAINER_TASK) {
1527				seen_asid = seen_page_table_snapshot = false;
1528				task_container = container;
1529			}
1530			break;
1531		}
1532		case KCDATA_TYPE_CONTAINER_END: {
1533			if (container == task_container) {
1534				task_container = -1;
1535				seen_task = true;
1536				T_ASSERT_TRUE(seen_page_table_snapshot, "check that we have seen a page table snapshot");
1537				T_ASSERT_TRUE(seen_asid, "check that we have seen an ASID");
1538			}
1539			container--;
1540			break;
1541		}
1542		case KCDATA_TYPE_ARRAY: {
1543			T_QUIET;
1544			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
1545					"checked that array is valid");
1546
1547			if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_PAGE_TABLES) {
1548				continue;
1549			}
1550
1551			T_ASSERT_FALSE(seen_page_table_snapshot, "check that we haven't yet seen a page table snapshot");
1552			seen_page_table_snapshot = true;
1553
1554			T_ASSERT_EQ((size_t) kcdata_iter_array_elem_size(iter), sizeof(uint64_t),
1555				"check that each element of the pagetable dump is the expected size");
1556
1557			uint64_t *pt_array = kcdata_iter_payload(iter);
1558			uint32_t elem_count = kcdata_iter_array_elem_count(iter);
1559			uint32_t j;
1560			bool nonzero_tte = false;
1561			for (j = 0; j < elem_count;) {
1562				T_QUIET; T_ASSERT_LE(j + 4, elem_count, "check for valid page table segment header");
1563				uint64_t pa = pt_array[j];
1564				uint64_t num_entries = pt_array[j + 1];
1565				uint64_t start_va = pt_array[j + 2];
1566				uint64_t end_va = pt_array[j + 3];
1567
1568				T_QUIET; T_ASSERT_NE(pa, (uint64_t) 0, "check that the pagetable physical address is non-zero");
1569				T_QUIET; T_ASSERT_EQ(pa % (num_entries * sizeof(uint64_t)), (uint64_t) 0, "check that the pagetable physical address is correctly aligned");
1570				T_QUIET; T_ASSERT_NE(num_entries, (uint64_t) 0, "check that a pagetable region has more than 0 entries");
1571				T_QUIET; T_ASSERT_LE(j + 4 + num_entries, (uint64_t) elem_count, "check for sufficient space in page table array");
1572				T_QUIET; T_ASSERT_GT(end_va, start_va, "check for valid VA bounds in page table segment header");
1573
1574				for (uint32_t k = j + 4; k < (j + 4 + num_entries); ++k) {
1575					if (pt_array[k] != 0) {
1576						nonzero_tte = true;
1577						T_QUIET; T_ASSERT_EQ((pt_array[k] >> 48) & 0xf, (uint64_t) 0, "check that bits[48:51] of arm64 TTE are clear");
1578						// L0-L2 table and non-compressed L3 block entries should always have bit 1 set; assumes L0-L2 blocks will not be used outside the kernel
1579						bool table = ((pt_array[k] & 0x2) != 0);
1580						if (table) {
1581							T_QUIET; T_ASSERT_NE(pt_array[k] & ((1ULL << 48) - 1) & ~((1ULL << 12) - 1), (uint64_t) 0, "check that arm64 TTE physical address is non-zero");
1582						} else { // should be a compressed PTE
1583							T_QUIET; T_ASSERT_NE(pt_array[k] & 0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has at least one of bits [63:62] set");
1584							T_QUIET; T_ASSERT_EQ(pt_array[k] & ~0xC000000000000000ULL, (uint64_t) 0, "check that compressed PTE has no other bits besides [63:62] set");
1585						}
1586					}
1587				}
1588
1589				j += (4 + num_entries);
1590			}
1591			T_ASSERT_TRUE(nonzero_tte, "check that we saw at least one non-empty TTE");
1592			T_ASSERT_EQ(j, elem_count, "check that page table dump size matches extent of last header");
1593			break;
1594		}
1595		case STACKSHOT_KCTYPE_ASID: {
1596			T_ASSERT_FALSE(seen_asid, "check that we haven't yet seen an ASID");
1597			seen_asid = true;
1598		}
1599		}
1600	}
1601
1602	T_QUIET; T_ASSERT_TRUE(seen_task, "check that we have seen a complete task container");
1603}
1604
1605T_DECL(dump_page_tables, "test stackshot page table dumping support", T_META_TAG_VM_PREFERRED)
1606{
1607	struct scenario scenario = {
1608		.name = "asid-page-tables",
1609		.flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_ASID | STACKSHOT_PAGE_TABLES),
1610		.size_hint = (9ull << 20), // 9 MB
1611		.target_pid = getpid(),
1612		.maybe_unsupported = true,
1613		.maybe_enomem = true,
1614	};
1615
1616	T_LOG("attempting to take stackshot with ASID and page table flags");
1617	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1618		parse_page_table_asid_stackshot(ssbuf, sslen);
1619	});
1620}
1621
1622
1623
1624static void stackshot_verify_current_proc_uuid_info(void **ssbuf, size_t sslen, uint64_t expected_offset, const struct proc_uniqidentifierinfo *proc_info_data)
1625{
1626	const uuid_t *current_uuid = (const uuid_t *)(&proc_info_data->p_uuid);
1627
1628	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
1629	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "buffer provided is a stackshot");
1630
1631	iter = kcdata_iter_next(iter);
1632
1633	KCDATA_ITER_FOREACH(iter) {
1634		switch (kcdata_iter_type(iter)) {
1635			case KCDATA_TYPE_ARRAY: {
1636				T_QUIET; T_ASSERT_TRUE(kcdata_iter_array_valid(iter), "checked that array is valid");
1637				if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO64) {
1638					struct user64_dyld_uuid_info *info = (struct user64_dyld_uuid_info *) kcdata_iter_payload(iter);
1639					if (uuid_compare(*current_uuid, info->imageUUID) == 0) {
1640						T_ASSERT_EQ(expected_offset, info->imageLoadAddress, "found matching UUID with matching binary offset");
1641						return;
1642					}
1643				} else if (kcdata_iter_array_elem_type(iter) == KCDATA_TYPE_LIBRARY_LOADINFO) {
1644					struct user32_dyld_uuid_info *info = (struct user32_dyld_uuid_info *) kcdata_iter_payload(iter);
1645					if (uuid_compare(*current_uuid, info->imageUUID) == 0) {
1646						T_ASSERT_EQ(expected_offset, ((uint64_t) info->imageLoadAddress),  "found matching UUID with matching binary offset");
1647						return;
1648					}
1649				}
1650				break;
1651			}
1652			default:
1653				break;
1654		}
1655	}
1656
1657	T_FAIL("failed to find matching UUID in stackshot data");
1658}
1659
1660T_DECL(translated,
1661    "tests translated bit is set correctly",
1662    T_META_TAG_VM_PREFERRED,
1663    T_META_ENABLED(false /* rdar://133956022 */))
1664{
1665#if !(TARGET_OS_OSX && TARGET_CPU_ARM64)
1666	T_SKIP("Only valid on Apple silicon Macs")
1667#endif
1668	// Get path of stackshot_translated_child helper binary
1669	char path[PATH_MAX];
1670	uint32_t path_size = sizeof(path);
1671	T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
1672	char* binary_name = strrchr(path, '/');
1673	if (binary_name) binary_name++;
1674	T_QUIET; T_ASSERT_NOTNULL(binary_name, "Find basename in path '%s'", path);
1675	strlcpy(binary_name, "stackshot_translated_child", path_size - (binary_name - path));
1676	char *args[] = { path, NULL };
1677
1678	dispatch_source_t child_sig_src;
1679	dispatch_semaphore_t child_ready_sem = dispatch_semaphore_create(0);
1680	T_QUIET; T_ASSERT_NOTNULL(child_ready_sem, "exec child semaphore");
1681
1682	dispatch_queue_t signal_processing_q = dispatch_queue_create("signal processing queue", NULL);
1683	T_QUIET; T_ASSERT_NOTNULL(signal_processing_q, "signal processing queue");
1684
1685	signal(SIGUSR1, SIG_IGN);
1686	child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, signal_processing_q);
1687	T_QUIET; T_ASSERT_NOTNULL(child_sig_src, "dispatch_source_create (child_sig_src)");
1688
1689	dispatch_source_set_event_handler(child_sig_src, ^{ dispatch_semaphore_signal(child_ready_sem); });
1690	dispatch_activate(child_sig_src);
1691
1692	// Spawn child
1693	pid_t pid;
1694	T_LOG("spawning translated child");
1695	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, args[0], NULL, NULL, args, NULL), "spawned process '%s' with PID %d", args[0], pid);
1696
1697	// Wait for the the child to spawn up
1698	dispatch_semaphore_wait(child_ready_sem, DISPATCH_TIME_FOREVER);
1699
1700	// Make sure the child is running and is translated
1701	int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, pid };
1702	struct kinfo_proc process_info;
1703	size_t bufsize = sizeof(process_info);
1704	T_QUIET; T_ASSERT_POSIX_SUCCESS(sysctl(mib, (unsigned)(sizeof(mib)/sizeof(int)), &process_info, &bufsize, NULL, 0), "get translated child process info");
1705	T_QUIET; T_ASSERT_GT(bufsize, (size_t)0, "process info is not empty");
1706	T_QUIET; T_ASSERT_TRUE((process_info.kp_proc.p_flag & P_TRANSLATED), "KERN_PROC_PID reports child is translated");
1707
1708	T_LOG("capturing stackshot");
1709
1710	struct scenario scenario = {
1711		.name = "translated",
1712		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
1713				  | STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
1714	};
1715
1716	take_stackshot(&scenario, true, ^( void *ssbuf, size_t sslen) {
1717		parse_stackshot(PARSE_STACKSHOT_TRANSLATED, ssbuf, sslen, @{translated_child_pid_key: @(pid)});
1718	});
1719
1720    // Kill the child
1721    int status;
1722    T_QUIET; T_ASSERT_POSIX_SUCCESS(kill(pid, SIGTERM), "kill translated child");
1723    T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &status, 0), "waitpid on translated child");
1724
1725}
1726
1727T_DECL(proc_uuid_info, "tests that the main binary UUID for a proc is always populated", T_META_TAG_VM_PREFERRED)
1728{
1729	struct proc_uniqidentifierinfo proc_info_data = { };
1730	mach_msg_type_number_t      count;
1731	kern_return_t               kernel_status;
1732	task_dyld_info_data_t       task_dyld_info;
1733	struct dyld_all_image_infos *target_infos;
1734	int retval;
1735	bool found_image_in_image_infos = false;
1736	uint64_t expected_mach_header_offset = 0;
1737
1738	/* Find the UUID of our main binary */
1739	retval = proc_pidinfo(getpid(), PROC_PIDUNIQIDENTIFIERINFO, 0, &proc_info_data, sizeof(proc_info_data));
1740	T_QUIET; T_EXPECT_POSIX_SUCCESS(retval, "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO");
1741	T_QUIET; T_ASSERT_EQ_INT(retval, (int) sizeof(proc_info_data), "proc_pidinfo PROC_PIDUNIQIDENTIFIERINFO returned data");
1742
1743	uuid_string_t str = {};
1744	uuid_unparse(*(uuid_t*)&proc_info_data.p_uuid, str);
1745	T_LOG("Found current UUID is %s", str);
1746
1747	/* Find the location of the dyld image info metadata */
1748	count = TASK_DYLD_INFO_COUNT;
1749	kernel_status = task_info(mach_task_self(), TASK_DYLD_INFO, (task_info_t)&task_dyld_info, &count);
1750	T_QUIET; T_ASSERT_EQ(kernel_status, KERN_SUCCESS, "retrieve task_info for TASK_DYLD_INFO");
1751
1752	target_infos = (struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr;
1753
1754	/* Find our binary in the dyld image info array */
1755	for (int i = 0; i < (int) target_infos->uuidArrayCount; i++) {
1756		if (uuid_compare(target_infos->uuidArray[i].imageUUID, *(uuid_t*)&proc_info_data.p_uuid) == 0) {
1757			expected_mach_header_offset = (uint64_t) target_infos->uuidArray[i].imageLoadAddress;
1758			found_image_in_image_infos = true;
1759		}
1760	}
1761
1762	T_ASSERT_TRUE(found_image_in_image_infos, "found binary image in dyld image info list");
1763
1764	/* Overwrite the dyld image info data so the kernel has to fallback to the UUID stored in the proc structure */
1765	target_infos->uuidArrayCount = 0;
1766
1767	struct scenario scenario = {
1768		.name = "proc_uuid_info",
1769		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
1770		.target_pid = getpid(),
1771	};
1772
1773	T_LOG("attempting to take stackshot for current PID");
1774	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1775		stackshot_verify_current_proc_uuid_info(ssbuf, sslen, expected_mach_header_offset, &proc_info_data);
1776	});
1777}
1778
1779T_DECL(cseg_waitinfo, "test that threads stuck in the compressor report correct waitinfo", T_META_TAG_VM_PREFERRED)
1780{
1781	struct scenario scenario = {
1782		.name = "cseg_waitinfo",
1783		.quiet = false,
1784		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1785	};
1786	__block uint64_t thread_id = 0;
1787
1788	dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot.cseg_waitinfo", NULL);
1789	dispatch_semaphore_t child_ok = dispatch_semaphore_create(0);
1790
1791	dispatch_async(dq, ^{
1792		pthread_threadid_np(NULL, &thread_id);
1793		dispatch_semaphore_signal(child_ok);
1794		int val = 1;
1795		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_wedge_thread", NULL, NULL, &val, sizeof(val)), "wedge child thread");
1796	});
1797
1798	dispatch_semaphore_wait(child_ok, DISPATCH_TIME_FOREVER);
1799	sleep(1);
1800
1801	T_LOG("taking stackshot");
1802	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1803		int val = 1;
1804		T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.cseg_unwedge_thread", NULL, NULL, &val, sizeof(val)), "unwedge child thread");
1805		parse_stackshot(PARSE_STACKSHOT_WAITINFO_CSEG, ssbuf, sslen, @{cseg_expected_threadid_key: @(thread_id)});
1806	});
1807}
1808
1809static void
1810srp_send(
1811	mach_port_t send_port,
1812	mach_port_t reply_port,
1813	mach_port_t msg_port)
1814{
1815	kern_return_t ret = 0;
1816
1817	struct test_msg {
1818		mach_msg_header_t header;
1819		mach_msg_body_t body;
1820		mach_msg_port_descriptor_t port_descriptor;
1821	};
1822	struct test_msg send_msg = {
1823		.header = {
1824			.msgh_remote_port = send_port,
1825			.msgh_local_port  = reply_port,
1826			.msgh_bits        = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND,
1827	    reply_port ? MACH_MSG_TYPE_MAKE_SEND_ONCE : 0,
1828	    MACH_MSG_TYPE_MOVE_SEND,
1829	    MACH_MSGH_BITS_COMPLEX),
1830			.msgh_id          = 0x100,
1831			.msgh_size        = sizeof(send_msg),
1832		},
1833		.body = {
1834			.msgh_descriptor_count = 1,
1835		},
1836		.port_descriptor = {
1837			.name        = msg_port,
1838			.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
1839			.type        = MACH_MSG_PORT_DESCRIPTOR,
1840		},
1841	};
1842
1843	if (msg_port == MACH_PORT_NULL) {
1844		send_msg.body.msgh_descriptor_count = 0;
1845	}
1846
1847	ret = mach_msg(&(send_msg.header),
1848	    MACH_SEND_MSG |
1849	    MACH_SEND_TIMEOUT |
1850	    MACH_SEND_OVERRIDE,
1851	    send_msg.header.msgh_size,
1852	    0,
1853	    MACH_PORT_NULL,
1854	    10000,
1855	    0);
1856
1857	T_ASSERT_MACH_SUCCESS(ret, "client mach_msg");
1858}
1859
1860T_HELPER_DECL(srp_client,
1861    "Client used for the special_reply_port test")
1862{
1863	pid_t ppid = getppid();
1864	dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
1865	dispatch_queue_t dq = dispatch_queue_create("client_signalqueue", NULL);
1866	dispatch_source_t sig_src;
1867
1868	mach_msg_return_t mr;
1869	mach_port_t service_port;
1870	mach_port_t conn_port;
1871	mach_port_t special_reply_port;
1872	mach_port_options_t opts = {
1873		.flags = MPO_INSERT_SEND_RIGHT,
1874	};
1875
1876	signal(SIGUSR1, SIG_IGN);
1877	sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
1878
1879	dispatch_source_set_event_handler(sig_src, ^{
1880			dispatch_semaphore_signal(can_continue);
1881	});
1882	dispatch_activate(sig_src);
1883
1884	/* lookup the mach service port for the parent */
1885	kern_return_t kr = bootstrap_look_up(bootstrap_port,
1886	    SRP_SERVICE_NAME, &service_port);
1887	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "client bootstrap_look_up");
1888
1889	/* create the send-once right (special reply port) and message to send to the server */
1890	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port);
1891	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
1892
1893	special_reply_port = thread_get_special_reply_port();
1894	T_QUIET; T_ASSERT_TRUE(MACH_PORT_VALID(special_reply_port), "get_thread_special_reply_port");
1895
1896	/* send the message with the special reply port */
1897	srp_send(service_port, special_reply_port, conn_port);
1898
1899	/* signal the parent to continue */
1900	kill(ppid, SIGUSR1);
1901
1902	struct {
1903		mach_msg_header_t header;
1904		mach_msg_body_t body;
1905		mach_msg_port_descriptor_t port_descriptor;
1906	} rcv_msg = {
1907		.header =
1908		{
1909			.msgh_remote_port = MACH_PORT_NULL,
1910			.msgh_local_port  = special_reply_port,
1911			.msgh_size        = sizeof(rcv_msg),
1912		},
1913	};
1914
1915	/* wait on the reply from the parent (that we will never receive) */
1916	mr = mach_msg(&(rcv_msg.header),
1917			(MACH_RCV_MSG | MACH_RCV_SYNC_WAIT),
1918			0,
1919			rcv_msg.header.msgh_size,
1920			special_reply_port,
1921			MACH_MSG_TIMEOUT_NONE,
1922			service_port);
1923
1924	/* not expected to execute as parent will SIGKILL client... */
1925	T_LOG("client process exiting after sending message to parent (server)");
1926}
1927
1928enum srp_test_type {
1929	SRP_TEST_THREAD,	/* expect waiter on current thread */
1930	SRP_TEST_PID,		/* expect waiter on current PID */
1931	SRP_TEST_EITHER,	/* waiter could be on either */
1932};
1933
1934static void
1935check_srp_test(const char *name, enum srp_test_type ty)
1936{
1937	struct scenario scenario = {
1938		.name = name,
1939		.quiet = false,
1940		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
1941	};
1942	uint64_t thread_id = 0;
1943	pthread_threadid_np(NULL, &thread_id);
1944	if (ty == SRP_TEST_THREAD) {
1945		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1946			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1947					@{srp_expected_threadid_key: @(thread_id)});
1948		});
1949	} else if (ty == SRP_TEST_PID) {
1950		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1951			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1952					@{srp_expected_pid_key: @(getpid())});
1953		});
1954	} else {
1955		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
1956			parse_stackshot(PARSE_STACKSHOT_WAITINFO_SRP, ssbuf, sslen,
1957					@{srp_expected_pid_key: @(getpid()), srp_expected_threadid_key: @(thread_id)});
1958		});
1959	}
1960
1961}
1962
1963
1964/*
1965 * Tests the stackshot wait info plumbing for synchronous IPC that doesn't use kevent on the server.
1966 *
1967 * (part 1): tests the scenario where a client sends a request that includes a special reply port
1968 *           to a server that doesn't receive the message and doesn't copy the send-once right
1969 *           into its address space as a result. for this case the special reply port is enqueued
1970 *           in a port and we check which task has that receive right and use that info. (rdar://60440338)
1971 * (part 2): tests the scenario where a client sends a request that includes a special reply port
1972 *           to a server that receives the message and copies in the send-once right, but doesn't
1973 *           reply to the client. for this case the special reply port is copied out and the kernel
1974 *           stashes the info about which task copied out the send once right. (rdar://60440592)
1975 * (part 3): tests the same as part 2, but uses kevents, which allow for
1976 *           priority inheritance
1977 */
1978T_DECL(special_reply_port, "test that tasks using special reply ports have correct waitinfo", T_META_TAG_VM_PREFERRED)
1979{
1980	dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
1981	dispatch_queue_t dq = dispatch_queue_create("signalqueue", NULL);
1982	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
1983	dispatch_source_t sig_src;
1984	char path[PATH_MAX];
1985	uint32_t path_size = sizeof(path);
1986	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
1987	char *client_args[] = { path, "-n", "srp_client", NULL };
1988	pid_t client_pid;
1989	int sp_ret;
1990	kern_return_t kr;
1991	mach_port_t port;
1992
1993	/* setup the signal handler in the parent (server) */
1994	T_LOG("setup sig handlers");
1995	signal(SIGUSR1, SIG_IGN);
1996	sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
1997
1998	dispatch_source_set_event_handler(sig_src, ^{
1999			dispatch_semaphore_signal(can_continue);
2000	});
2001	dispatch_activate(sig_src);
2002
2003	/* register with the mach service name so the client can lookup and send a message to the parent (server) */
2004	T_LOG("Server about to check in");
2005	kr = bootstrap_check_in(bootstrap_port, SRP_SERVICE_NAME, &port);
2006	T_ASSERT_MACH_SUCCESS(kr, "server bootstrap_check_in");
2007
2008	T_LOG("Launching client");
2009	sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
2010	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid);
2011	T_LOG("Spawned client as PID %d", client_pid);
2012
2013	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2014	T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear");
2015
2016	/*
2017	 * can_continue indicates the client has signaled us, but we want to make
2018	 * sure they've actually blocked sending their mach message.  It's cheesy, but
2019	 * sleep() works for this.
2020	 */
2021	sleep(1);
2022
2023	/*
2024	 * take the stackshot without calling receive to verify that the stackshot wait
2025	 * info shows our (the server) thread for the scenario where the server has yet to
2026	 * receive the message.
2027	 */
2028	T_LOG("Taking stackshot for part 1 coverage");
2029	check_srp_test("srp", SRP_TEST_THREAD);
2030
2031	/*
2032	 * receive the message from the client (which should copy the send once right into
2033	 * our address space).
2034	 */
2035	struct {
2036		mach_msg_header_t header;
2037		mach_msg_body_t body;
2038		mach_msg_port_descriptor_t port_descriptor;
2039	} rcv_msg = {
2040		.header =
2041		{
2042			.msgh_remote_port = MACH_PORT_NULL,
2043			.msgh_local_port  = port,
2044			.msgh_size        = sizeof(rcv_msg),
2045		},
2046	};
2047
2048	T_LOG("server: starting sync receive\n");
2049
2050	mach_msg_return_t mr;
2051	mr = mach_msg(&(rcv_msg.header),
2052			(MACH_RCV_MSG | MACH_RCV_TIMEOUT),
2053			0,
2054			4096,
2055			port,
2056			10000,
2057			MACH_PORT_NULL);
2058	T_QUIET; T_ASSERT_MACH_SUCCESS(mr, "mach_msg() recieve of message from client");
2059
2060	/*
2061	 * take the stackshot to verify that the stackshot wait info shows our (the server) PID
2062	 * for the scenario where the server has received the message and copied in the send-once right.
2063	 */
2064	T_LOG("Taking stackshot for part 2 coverage");
2065	check_srp_test("srp", SRP_TEST_PID);
2066
2067	/* cleanup - kill the client */
2068	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
2069	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2070
2071	// do it again, but using kevents
2072	T_LOG("Launching client");
2073	sp_ret = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
2074	T_QUIET; T_ASSERT_POSIX_ZERO(sp_ret, "spawned process '%s' with PID %d", client_args[0], client_pid);
2075	T_LOG("Spawned client as PID %d", client_pid);
2076
2077	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2078	T_LOG("Ready to take stackshot, but waiting 1s for the coast to clear");
2079
2080	/*
2081	 * can_continue indicates the client has signaled us, but we want to make
2082	 * sure they've actually blocked sending their mach message.  It's cheesy, but
2083	 * sleep() works for this.
2084	 */
2085	sleep(1);
2086
2087	dispatch_mach_t dispatch_mach = dispatch_mach_create(SRP_SERVICE_NAME, machdq,
2088	    ^(dispatch_mach_reason_t reason,
2089	      dispatch_mach_msg_t message,
2090	      mach_error_t error __unused) {
2091		switch (reason) {
2092		case DISPATCH_MACH_MESSAGE_RECEIVED: {
2093			size_t size = 0;
2094			mach_msg_header_t *msg __unused = dispatch_mach_msg_get_msg(message, &size);
2095			T_LOG("server: recieved %ld byte message", size);
2096			check_srp_test("turnstile_port_thread", SRP_TEST_THREAD);
2097			T_LOG("server: letting client go");
2098			// drop the message on the ground, we'll kill the client later
2099			dispatch_semaphore_signal(can_continue);
2100			break;
2101		}
2102		default:
2103			break;
2104		}
2105	});
2106
2107	dispatch_mach_connect(dispatch_mach, port, MACH_PORT_NULL, NULL);
2108
2109	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2110
2111	/* cleanup - kill the client */
2112	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
2113	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2114}
2115
2116T_HELPER_DECL(throtlled_sp_client,
2117	"client that uses a connection port to send a message to a server")
2118{
2119	mach_port_t conn_port, service_port, reply_port, *stash;
2120	mach_msg_type_number_t stash_cnt = 0;
2121
2122	kern_return_t kr = mach_ports_lookup(mach_task_self(), &stash, &stash_cnt);
2123	T_ASSERT_MACH_SUCCESS(kr, "mach_ports_lookup");
2124
2125	service_port = stash[0];
2126	T_ASSERT_TRUE(MACH_PORT_VALID(service_port), "valid service port");
2127	mig_deallocate((vm_address_t)stash, stash_cnt * sizeof(stash[0]));
2128
2129	mach_port_options_t opts = {
2130		.flags = MPO_INSERT_SEND_RIGHT
2131			| MPO_CONNECTION_PORT,
2132		.service_port_name = service_port,
2133	};
2134
2135	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &conn_port);
2136	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
2137
2138	mach_port_options_t opts2 = {
2139		.flags = MPO_REPLY_PORT
2140	};
2141	kr = mach_port_construct(mach_task_self(), &opts2, 0ull, &reply_port);
2142	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct");
2143
2144	/* XPC-like check-in message */
2145	struct {
2146		mach_msg_header_t header;
2147		mach_msg_port_descriptor_t recvp;
2148		mach_msg_port_descriptor_t sendp;
2149	} checkin_message = {
2150		.header =
2151		{
2152			.msgh_remote_port = service_port,
2153			.msgh_local_port = MACH_PORT_NULL,
2154			.msgh_size = sizeof(checkin_message),
2155			.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0),
2156		},
2157		.recvp =
2158		{
2159			.type = MACH_MSG_PORT_DESCRIPTOR,
2160			.name = conn_port,
2161			.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
2162		},
2163		.sendp =
2164		{
2165			.type = MACH_MSG_PORT_DESCRIPTOR,
2166			.name = reply_port,
2167			.disposition = MACH_MSG_TYPE_MAKE_SEND,
2168		}
2169	};
2170	dispatch_mach_msg_t dmsg = dispatch_mach_msg_create((mach_msg_header_t *)&checkin_message, sizeof(checkin_message),
2171		DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL);
2172
2173	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
2174	dispatch_mach_t dchannel = dispatch_mach_create(THROTTLED_SERVICE_NAME, machdq,
2175		^(dispatch_mach_reason_t reason,
2176	      dispatch_mach_msg_t message __unused,
2177	      mach_error_t error __unused) {
2178		switch (reason) {
2179			case DISPATCH_MACH_CONNECTED:
2180				T_LOG("mach channel connected");
2181				break;
2182			case DISPATCH_MACH_MESSAGE_SENT:
2183				T_LOG("sent mach message");
2184				break;
2185			default:
2186				T_ASSERT_FAIL("Unexpected reply to channel reason %lu", reason);
2187		}
2188	});
2189	dispatch_mach_connect(dchannel, reply_port, service_port, dmsg);
2190	dispatch_release(dmsg);
2191
2192	struct {
2193		mach_msg_header_t header;
2194		uint64_t request_id;
2195	} request = {
2196		.header =
2197		{
2198			.msgh_size = sizeof(request),
2199			.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE),
2200		},
2201		.request_id = 1,
2202	};
2203	dispatch_mach_msg_t dmsg2 = dispatch_mach_msg_create((mach_msg_header_t *)&request, sizeof(request),
2204		DISPATCH_MACH_MSG_DESTRUCTOR_DEFAULT, NULL);
2205
2206	dispatch_mach_reason_t reason;
2207	mach_error_t error;
2208
2209	/* send the check-in message and the request message */
2210	dispatch_mach_msg_t dreply = dispatch_mach_send_with_result_and_wait_for_reply(dchannel,
2211			dmsg2, 0, DISPATCH_MACH_SEND_DEFAULT, &reason, &error);
2212	dispatch_release(dmsg2);
2213
2214	/* not expected to execute as parent will SIGKILL client */
2215	T_ASSERT_FAIL("client process exiting after receiving %s reply", dreply ? "non-null" : "null");
2216}
2217
2218static void
2219check_throttled_sp(const char *test_name, uint64_t context, bool is_throttled)
2220{
2221	struct scenario scenario = {
2222		.name = test_name,
2223		.quiet = false,
2224		.flags = (STACKSHOT_THREAD_WAITINFO | STACKSHOT_KCDATA_FORMAT),
2225	};
2226
2227	T_LOG("taking stackshot %s", test_name);
2228	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2229		parse_stackshot(PARSE_STACKSHOT_THROTTLED_SP, ssbuf, sslen,
2230					@{sp_throttled_expected_ctxt_key: @(context),
2231					sp_throttled_expect_flag: @(is_throttled)});
2232	});
2233}
2234
2235/* Take stackshot when a client is blocked on the service port of a process, in the scenario when
2236 * the process with the receive right for the service port is:
2237 *     (a) Monitoring the service port using kevents
2238 *     (b) Not monitoring the service port
2239 */
2240T_DECL(throttled_sp,
2241	"test that service port throttled flag is propagated to the stackshot correctly", T_META_TAG_VM_PREFERRED)
2242{
2243	mach_port_t service_port;
2244	__block dispatch_semaphore_t can_continue  = dispatch_semaphore_create(0);
2245
2246	char path[PATH_MAX];
2247	uint32_t path_size = sizeof(path);
2248	T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
2249	char *client_args[] = { path, "-n", "throtlled_sp_client", NULL };
2250
2251	__block	uint64_t thread_id = 0;
2252	pid_t client_pid;
2253	int mark_throttled;
2254
2255	struct mach_service_port_info sp_info = {};
2256	strcpy(sp_info.mspi_string_name, THROTTLED_SERVICE_NAME);
2257	sp_info.mspi_domain_type = (uint8_t)1;
2258	kern_return_t kr;
2259
2260	mach_port_options_t opts = {
2261		.flags = MPO_SERVICE_PORT | MPO_INSERT_SEND_RIGHT | MPO_CONTEXT_AS_GUARD | MPO_STRICT | MPO_TEMPOWNER,
2262		.service_port_info = &sp_info,
2263	};
2264
2265	kr = mach_port_construct(mach_task_self(), &opts, 0ull, &service_port);
2266	T_ASSERT_MACH_SUCCESS(kr, "mach_port_construct %u", service_port);
2267
2268	/* Setup a dispatch source to monitor the service port similar to how launchd does. */
2269	dispatch_queue_t machdq = dispatch_queue_create("machqueue", NULL);
2270	dispatch_source_t mach_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_MACH_RECV, service_port,
2271		DISPATCH_MACH_RECV_SYNC_PEEK, machdq);
2272	dispatch_source_set_event_handler(mach_src, ^{
2273		pthread_threadid_np(NULL, &thread_id);
2274		dispatch_semaphore_signal(can_continue);
2275	});
2276	dispatch_activate(mach_src);
2277
2278	/* Stash the port in task to make sure child also gets it */
2279	kr = mach_ports_register(mach_task_self(), &service_port, 1);
2280	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mach_ports_register service port");
2281
2282	mark_throttled = 1;
2283	kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled),
2284	           MACH_PORT_SERVICE_THROTTLED_COUNT);
2285	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "mark service port as throttled");
2286
2287	int rc = posix_spawn(&client_pid, client_args[0], NULL, NULL, client_args, NULL);
2288	T_QUIET; T_ASSERT_POSIX_ZERO(rc, "spawned process '%s' with PID %d", client_args[0], client_pid);
2289	T_LOG("Spawned client as PID %d", client_pid);
2290
2291	dispatch_semaphore_wait(can_continue, DISPATCH_TIME_FOREVER);
2292
2293	/* The service port has received the check-in message. Take stackshot for scenario (a). */
2294	check_throttled_sp("throttled_service_port_monitored", thread_id, true);
2295
2296	/* This simulates a throttled spawn when the service port is no longer monitored. */
2297	dispatch_source_cancel(mach_src);
2298
2299	/* Take stackshot for scenario (b) */
2300	check_throttled_sp("throttled_service_port_unmonitored", (uint64_t)getpid(), true);
2301
2302	mark_throttled = 0;
2303	kr = mach_port_set_attributes(mach_task_self(), service_port, MACH_PORT_SERVICE_THROTTLED, (mach_port_info_t)(&mark_throttled),
2304	           MACH_PORT_SERVICE_THROTTLED_COUNT);
2305	T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "unmark service port as throttled");
2306
2307	/* Throttled flag should not be set when the port is not throttled. */
2308	check_throttled_sp("unthrottled_service_port_unmonitored", (uint64_t)getpid(), false);
2309
2310	/* cleanup - kill the client */
2311	T_ASSERT_POSIX_SUCCESS(kill(client_pid, SIGKILL), "killing client");
2312	T_ASSERT_POSIX_SUCCESS(waitpid(client_pid, NULL, 0), "waiting for the client to exit");
2313}
2314
2315
2316char *const clpcctrl_path = "/usr/local/bin/clpcctrl";
2317
2318static void
2319run_clpcctrl(char *const argv[]) {
2320	posix_spawnattr_t sattr;
2321	pid_t pid;
2322	int wstatus;
2323
2324	T_QUIET; T_ASSERT_POSIX_ZERO(posix_spawn(&pid, argv[0], NULL, NULL, argv, NULL), "spawn clpcctrl");
2325	T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(pid, &wstatus, 0), "wait for clpcctrl");
2326	T_QUIET; T_ASSERT_TRUE(WIFEXITED(wstatus), "clpcctrl exited normally");
2327	T_QUIET; T_ASSERT_POSIX_ZERO(WEXITSTATUS(wstatus), "clpcctrl exited successfully");
2328
2329	uint64_t sched_recommended_cores = 1;
2330	size_t sched_recommended_cores_sz = sizeof(uint64_t);
2331	T_QUIET; T_ASSERT_POSIX_SUCCESS(
2332	    sysctlbyname("kern.sched_recommended_cores", &sched_recommended_cores, &sched_recommended_cores_sz, NULL, 0),
2333	    "get kern.sched_recommended_cores");
2334	T_LOG("Recommended cores: 0x%llx", sched_recommended_cores);
2335}
2336
2337static void
2338restore_clpcctrl() {
2339	run_clpcctrl((char *const []) { clpcctrl_path, "-d", NULL });
2340}
2341
2342#define CLUSTER_TYPE_SMP 0
2343#define CLUSTER_TYPE_E 1
2344#define CLUSTER_TYPE_P 2
2345
2346void test_stackshot_cpu_info(void *ssbuf, size_t sslen, int exp_cpus, NSArray *exp_cluster_types) {
2347	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2348	bool seen = false;
2349	int singlethread_override = 0;
2350	size_t singlethread_override_sz = sizeof(singlethread_override);
2351	T_QUIET; T_ASSERT_POSIX_SUCCESS(
2352		sysctlbyname("kern.stackshot_single_thread", &singlethread_override, &singlethread_override_sz, NULL, 0),
2353		"get kern.stackshot_single_thread");
2354	if (singlethread_override) {
2355		T_LOG("skipping cpu count/type check due to single-thread override (kern.stackshot_single_thread=1)");
2356		return;
2357	}
2358
2359	KCDATA_ITER_FOREACH(iter) {
2360		if ((kcdata_iter_type(iter) != KCDATA_TYPE_ARRAY) || (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_LATENCY_INFO_CPU)) {
2361			continue;
2362		}
2363
2364		seen = true;
2365
2366		/* Check ncpus */
2367		int ncpus = kcdata_iter_array_elem_count(iter);
2368		if (exp_cpus != -1) {
2369			T_QUIET; T_ASSERT_EQ(exp_cpus, ncpus, "Expected number of CPUs matches number of CPUs used for stackshot");
2370		}
2371
2372		if (exp_cluster_types == nil) {
2373			continue;
2374		}
2375
2376		/* Check cluster types */
2377		struct stackshot_latency_cpu *latencies = (struct stackshot_latency_cpu *) kcdata_iter_payload(iter);
2378		for (int i = 0; i < ncpus; i++) {
2379			NSNumber *cluster_type = [NSNumber numberWithInt:latencies[i].cluster_type];
2380			T_QUIET; T_ASSERT_TRUE([exp_cluster_types containsObject:cluster_type], "Type of CPU cluster in expected CPU cluster types");
2381		}
2382	}
2383
2384	T_QUIET; T_ASSERT_TRUE(seen || !is_development_kernel(), "Seen CPU latency info or is release kernel");
2385}
2386
2387void test_stackshot_with_clpcctrl(char *const name, char *const argv[], int exp_cpus, NSArray *exp_cluster_types) {
2388	T_LOG("Stackshot CLPC scenario %s", name);
2389	run_clpcctrl(argv);
2390	struct scenario scenario = {
2391		.name = name,
2392		.flags = (STACKSHOT_KCDATA_FORMAT | STACKSHOT_SAVE_LOADINFO |
2393			STACKSHOT_THREAD_WAITINFO | STACKSHOT_GET_GLOBAL_MEM_STATS)
2394	};
2395	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2396		parse_stackshot(0, ssbuf, sslen, nil);
2397		test_stackshot_cpu_info(ssbuf, sslen, exp_cpus, exp_cluster_types);
2398	});
2399}
2400
2401T_DECL(core_masks,
2402	"test that stackshot works under various core masks on ARM systems",
2403	T_META_REQUIRES_SYSCTL_EQ("hw.optional.arm64", 1),
2404	T_META_REQUIRES_SYSCTL_NE("kern.kasan.available", 1), /* rdar://115577993 */
2405	XNU_T_META_REQUIRES_DEVELOPMENT_KERNEL,
2406	T_META_REQUIRE_NOT_VIRTUALIZED,
2407	T_META_RUN_CONCURRENTLY(false),
2408	T_META_TAG_VM_NOT_ELIGIBLE,
2409	T_META_ENABLED(!TARGET_OS_VISION)) // disable for visionOS: device may not be stable with many cores masked off (127904530)
2410{
2411	/*
2412	 * Make sure we're not in a release kernel
2413	 * (cannot check with T_META; only one sysctl T_META at a time will work)
2414	 */
2415	if (!is_development_kernel()) {
2416		T_SKIP("test was not run because kernel is release; cannot set core masks");
2417		return;
2418	}
2419
2420	/*
2421	 * rdar://115577993 - CLPC compiles as release in KASAN-variant builds,
2422	 * preventing clpcctrl from working. For now, skip this. (Cannot check
2423	 * with T_META; only one sysctl T_META at a time will work)
2424	 */
2425	int kasan_avail = 0;
2426	size_t kasan_avail_sz = sizeof(kasan_avail);
2427	sysctlbyname("kern.kasan.available", &kasan_avail, &kasan_avail_sz, NULL, 0);
2428	if (kasan_avail) {
2429		T_SKIP("test was not run because kernel is KASAN; cannot set core masks (see rdar://115577993)");
2430		return;
2431	}
2432
2433
2434	T_ATEND(restore_clpcctrl);
2435
2436	/* Test with 1 and 2 CPUs for basic functionality */
2437	test_stackshot_with_clpcctrl(
2438		"core_masks_1cpu", (char *const[]) {clpcctrl_path, "-c", "1", NULL},
2439		1, nil);
2440
2441	test_stackshot_with_clpcctrl(
2442		"core_masks_2cpus", (char *const[]) {clpcctrl_path, "-c", "2", NULL},
2443		2, nil);
2444
2445	/* Check nperflevels to see if we're on an AMP system */
2446	int nperflevels = 1;
2447	size_t nperflevels_sz = sizeof(int);
2448	T_ASSERT_POSIX_SUCCESS(
2449	    sysctlbyname("hw.nperflevels", &nperflevels, &nperflevels_sz, NULL, 0),
2450	    "get hw.nperflevels");
2451	if (nperflevels == 1) {
2452		T_LOG("On SMP system, skipping stackshot core_masks AMP tests");
2453		return;
2454	}
2455
2456	T_QUIET; T_ASSERT_EQ(nperflevels, 2, "nperflevels is 1 or 2");
2457	T_LOG("On AMP system, performing stackshot core_masks AMP tests");
2458
2459	/* Perform AMP tests with different cluster types active */
2460	test_stackshot_with_clpcctrl(
2461		"core_masks_amp_allcpus",
2462		(char *const[]) {clpcctrl_path, "-C", "all", NULL},
2463		-1, @[@CLUSTER_TYPE_E, @CLUSTER_TYPE_P]);
2464
2465	test_stackshot_with_clpcctrl(
2466		"core_masks_amp_ecpus",
2467		(char *const[]) {clpcctrl_path, "-C", "e", NULL},
2468		-1, @[@CLUSTER_TYPE_E]);
2469
2470	test_stackshot_with_clpcctrl(
2471		"core_masks_amp_pcpus",
2472		(char *const[]) {clpcctrl_path, "-C", "p", NULL},
2473		-1, @[@CLUSTER_TYPE_P]);
2474}
2475
2476#pragma mark performance tests
2477
2478#define SHOULD_REUSE_SIZE_HINT 0x01
2479#define SHOULD_USE_DELTA       0x02
2480#define SHOULD_TARGET_SELF     0x04
2481
2482static void
2483stackshot_perf(unsigned int options)
2484{
2485	struct scenario scenario = {
2486		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_GET_GLOBAL_MEM_STATS
2487			| STACKSHOT_SAVE_IMP_DONATION_PIDS | STACKSHOT_KCDATA_FORMAT),
2488	};
2489
2490	dt_stat_t size = dt_stat_create("bytes", "size");
2491	dt_stat_time_t duration = dt_stat_time_create("duration");
2492	scenario.timer = duration;
2493
2494	if (options & SHOULD_TARGET_SELF) {
2495		scenario.target_pid = getpid();
2496	}
2497
2498	while (!dt_stat_stable(duration) || !dt_stat_stable(size)) {
2499		__block uint64_t last_time = 0;
2500		__block uint32_t size_hint = 0;
2501		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2502			dt_stat_add(size, (double)sslen);
2503			last_time = stackshot_timestamp(ssbuf, sslen);
2504			size_hint = (uint32_t)sslen;
2505		});
2506		if (options & SHOULD_USE_DELTA) {
2507			scenario.since_timestamp = last_time;
2508			scenario.flags |= STACKSHOT_COLLECT_DELTA_SNAPSHOT;
2509		}
2510		if (options & SHOULD_REUSE_SIZE_HINT) {
2511			scenario.size_hint = size_hint;
2512		}
2513	}
2514
2515	dt_stat_finalize(duration);
2516	dt_stat_finalize(size);
2517}
2518
2519static void
2520stackshot_flag_perf_noclobber(uint64_t flag, char *flagname)
2521{
2522	struct scenario scenario = {
2523		.quiet = true,
2524		.flags = (flag | STACKSHOT_KCDATA_FORMAT),
2525	};
2526
2527	dt_stat_t duration = dt_stat_create("nanoseconds per thread", "%s_duration", flagname);
2528	dt_stat_t size = dt_stat_create("bytes per thread", "%s_size", flagname);
2529	T_LOG("Testing \"%s\" = 0x%" PRIx64, flagname, flag);
2530
2531	while (!dt_stat_stable(duration) || !dt_stat_stable(size)) {
2532		take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2533			kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2534			unsigned long no_threads = 0;
2535			mach_timebase_info_data_t timebase = {0, 0};
2536			uint64_t stackshot_duration = 0;
2537			int found = 0;
2538			T_QUIET; T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "stackshot buffer");
2539
2540			KCDATA_ITER_FOREACH(iter) {
2541				switch(kcdata_iter_type(iter)) {
2542					case STACKSHOT_KCTYPE_THREAD_SNAPSHOT: {
2543						found |= 1;
2544						no_threads ++;
2545						break;
2546					}
2547					case STACKSHOT_KCTYPE_STACKSHOT_DURATION: {
2548						struct stackshot_duration *ssd = kcdata_iter_payload(iter);
2549						stackshot_duration = ssd->stackshot_duration;
2550						found |= 2;
2551						break;
2552					}
2553					case KCDATA_TYPE_TIMEBASE: {
2554						found |= 4;
2555						mach_timebase_info_data_t *tb = kcdata_iter_payload(iter);
2556						memcpy(&timebase, tb, sizeof(timebase));
2557						break;
2558					}
2559				}
2560			}
2561
2562			T_QUIET; T_ASSERT_EQ(found, 0x7, "found everything needed");
2563
2564			uint64_t ns = (stackshot_duration * timebase.numer) / timebase.denom;
2565			uint64_t per_thread_ns = ns / no_threads;
2566			uint64_t per_thread_size = sslen / no_threads;
2567
2568			dt_stat_add(duration, per_thread_ns);
2569			dt_stat_add(size, per_thread_size);
2570		});
2571	}
2572
2573	dt_stat_finalize(duration);
2574	dt_stat_finalize(size);
2575}
2576
2577static void
2578stackshot_flag_perf(uint64_t flag, char *flagname)
2579{
2580	/*
2581	 * STACKSHOT_NO_IO_STATS disables data collection, so set it for
2582	 * more accurate perfdata collection.
2583	 */
2584	flag |= STACKSHOT_NO_IO_STATS;
2585
2586	stackshot_flag_perf_noclobber(flag, flagname);
2587}
2588
2589
2590T_DECL(flag_perf, "test stackshot performance with different flags set", T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2591{
2592	stackshot_flag_perf_noclobber(STACKSHOT_NO_IO_STATS, "baseline");
2593	stackshot_flag_perf_noclobber(0, "io_stats");
2594
2595	stackshot_flag_perf(STACKSHOT_THREAD_WAITINFO, "thread_waitinfo");
2596	stackshot_flag_perf(STACKSHOT_GET_DQ, "get_dq");
2597	stackshot_flag_perf(STACKSHOT_SAVE_LOADINFO, "save_loadinfo");
2598	stackshot_flag_perf(STACKSHOT_GET_GLOBAL_MEM_STATS, "get_global_mem_stats");
2599	stackshot_flag_perf(STACKSHOT_SAVE_KEXT_LOADINFO, "save_kext_loadinfo");
2600	stackshot_flag_perf(STACKSHOT_SAVE_IMP_DONATION_PIDS, "save_imp_donation_pids");
2601	stackshot_flag_perf(STACKSHOT_ENABLE_BT_FAULTING, "enable_bt_faulting");
2602	stackshot_flag_perf(STACKSHOT_COLLECT_SHAREDCACHE_LAYOUT, "collect_sharedcache_layout");
2603	stackshot_flag_perf(STACKSHOT_ENABLE_UUID_FAULTING, "enable_uuid_faulting");
2604	stackshot_flag_perf(STACKSHOT_THREAD_GROUP, "thread_group");
2605	stackshot_flag_perf(STACKSHOT_SAVE_JETSAM_COALITIONS, "save_jetsam_coalitions");
2606	stackshot_flag_perf(STACKSHOT_INSTRS_CYCLES, "instrs_cycles");
2607	stackshot_flag_perf(STACKSHOT_ASID, "asid");
2608	stackshot_flag_perf(STACKSHOT_EXCLAVES, "all_exclaves");
2609	stackshot_flag_perf(STACKSHOT_EXCLAVES | STACKSHOT_ASID, "all_exclaves_and_asid");
2610	stackshot_flag_perf(STACKSHOT_SKIP_EXCLAVES, "skip_exclaves");
2611}
2612
2613T_DECL(perf_no_size_hint, "test stackshot performance with no size hint",
2614		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2615{
2616	stackshot_perf(0);
2617}
2618
2619T_DECL(perf_size_hint, "test stackshot performance with size hint",
2620		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2621{
2622	stackshot_perf(SHOULD_REUSE_SIZE_HINT);
2623}
2624
2625T_DECL(perf_process, "test stackshot performance targeted at process",
2626		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2627{
2628	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_TARGET_SELF);
2629}
2630
2631T_DECL(perf_delta, "test delta stackshot performance",
2632		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2633{
2634	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA);
2635}
2636
2637T_DECL(perf_delta_no_exclaves, "test delta stackshot performance without Exclaves",
2638	    T_META_REQUIRES_SYSCTL_EQ("kern.exclaves_status", 1),
2639		T_META_REQUIRES_SYSCTL_EQ("kern.exclaves_inspection_status", 1),
2640		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2641{
2642	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | STACKSHOT_SKIP_EXCLAVES);
2643}
2644
2645T_DECL(perf_delta_process, "test delta stackshot performance targeted at a process",
2646		T_META_TAG_PERF, T_META_TAG_VM_NOT_ELIGIBLE)
2647{
2648	stackshot_perf(SHOULD_REUSE_SIZE_HINT | SHOULD_USE_DELTA | SHOULD_TARGET_SELF);
2649}
2650
2651T_DECL(stackshot_entitlement_report_test, "test stackshot entitlement report", T_META_TAG_VM_PREFERRED)
2652{
2653	int sysctlValue = 1;
2654	T_ASSERT_POSIX_SUCCESS(
2655	    sysctlbyname("debug.stackshot_entitlement_send_batch", NULL, NULL, &sysctlValue, sizeof(sysctlValue)),
2656	    "set debug.stackshot_entitlement_send_batch=1");
2657	// having a way to verify that the coreanalytics event was received would be even better
2658	// See rdar://74197197
2659	T_PASS("entitlement test ran");
2660}
2661
2662static void
2663expect_os_build_version_in_stackshot(void *ssbuf, size_t sslen)
2664{
2665	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2666
2667	bool saw_os_build_version = false;
2668	iter = kcdata_iter_next(iter);
2669
2670	KCDATA_ITER_FOREACH(iter) {
2671		switch (kcdata_iter_type(iter)) {
2672		case STACKSHOT_KCTYPE_OS_BUILD_VERSION:
2673			saw_os_build_version = true;
2674			T_LOG("Found os build version in stackshot: %s", kcdata_iter_payload(iter));
2675			return;
2676
2677		default:
2678			break;
2679		}
2680	}
2681
2682	T_ASSERT_FAIL("didn't see os build version in stackshot");
2683}
2684
2685T_DECL(os_build_version, "test stackshot contains os build version", T_META_TAG_VM_PREFERRED)
2686{
2687
2688	struct scenario scenario = {
2689		.name = "os-build-version",
2690		.flags = (STACKSHOT_SAVE_LOADINFO | STACKSHOT_KCDATA_FORMAT),
2691	};
2692
2693	T_LOG("attempting to take stackshot with an os build version");
2694	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
2695		expect_os_build_version_in_stackshot(ssbuf, sslen);
2696	});
2697}
2698
2699static uint64_t
2700stackshot_timestamp(void *ssbuf, size_t sslen)
2701{
2702	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2703
2704	uint32_t type = kcdata_iter_type(iter);
2705	if (type != KCDATA_BUFFER_BEGIN_STACKSHOT && type != KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT) {
2706		T_ASSERT_FAIL("invalid kcdata type %u", kcdata_iter_type(iter));
2707	}
2708
2709	iter = kcdata_iter_find_type(iter, KCDATA_TYPE_MACH_ABSOLUTE_TIME);
2710	T_QUIET;
2711	T_ASSERT_TRUE(kcdata_iter_valid(iter), "timestamp found in stackshot");
2712
2713	return *(uint64_t *)kcdata_iter_payload(iter);
2714}
2715
2716#define TEST_THREAD_NAME "stackshot_test_thread"
2717
2718static void
2719parse_thread_group_stackshot(void **ssbuf, size_t sslen)
2720{
2721	bool seen_thread_group_snapshot = false;
2722	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2723	T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
2724			"buffer provided is a stackshot");
2725
2726	NSMutableSet *thread_groups = [[NSMutableSet alloc] init];
2727
2728	iter = kcdata_iter_next(iter);
2729	KCDATA_ITER_FOREACH(iter) {
2730		switch (kcdata_iter_type(iter)) {
2731		case KCDATA_TYPE_ARRAY: {
2732			T_QUIET;
2733			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
2734					"checked that array is valid");
2735
2736			if (kcdata_iter_array_elem_type(iter) != STACKSHOT_KCTYPE_THREAD_GROUP_SNAPSHOT) {
2737				continue;
2738			}
2739
2740			seen_thread_group_snapshot = true;
2741
2742			if (kcdata_iter_array_elem_size(iter) >= sizeof(struct thread_group_snapshot_v3)) {
2743				struct thread_group_snapshot_v3 *tgs_array = kcdata_iter_payload(iter);
2744				for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) {
2745					struct thread_group_snapshot_v3 *tgs = tgs_array + j;
2746					[thread_groups addObject:@(tgs->tgs_id)];
2747				}
2748			}
2749			else {
2750				struct thread_group_snapshot *tgs_array = kcdata_iter_payload(iter);
2751				for (uint32_t j = 0; j < kcdata_iter_array_elem_count(iter); j++) {
2752					struct thread_group_snapshot *tgs = tgs_array + j;
2753					[thread_groups addObject:@(tgs->tgs_id)];
2754				}
2755			}
2756			break;
2757		}
2758		}
2759	}
2760	KCDATA_ITER_FOREACH(iter) {
2761		NSError *error = nil;
2762
2763		switch (kcdata_iter_type(iter)) {
2764
2765		case KCDATA_TYPE_CONTAINER_BEGIN: {
2766			T_QUIET;
2767			T_ASSERT_TRUE(kcdata_iter_container_valid(iter),
2768					"checked that container is valid");
2769
2770			if (kcdata_iter_container_type(iter) != STACKSHOT_KCCONTAINER_THREAD) {
2771				break;
2772			}
2773
2774			NSDictionary *container = parseKCDataContainer(&iter, &error);
2775			T_QUIET; T_ASSERT_NOTNULL(container, "parsed thread container from stackshot");
2776			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container");
2777
2778			int tg = [container[@"thread_snapshots"][@"thread_group"] intValue];
2779
2780			T_ASSERT_TRUE([thread_groups containsObject:@(tg)], "check that the thread group the thread is in exists");
2781
2782			break;
2783		};
2784
2785		}
2786	}
2787	T_ASSERT_TRUE(seen_thread_group_snapshot, "check that we have seen a thread group snapshot");
2788}
2789
2790static void
2791verify_stackshot_sharedcache_layout(struct dyld_uuid_info_64 *uuids, uint32_t uuid_count)
2792{
2793	uuid_t cur_shared_cache_uuid;
2794	__block uint32_t lib_index = 0, libs_found = 0;
2795
2796	_dyld_get_shared_cache_uuid(cur_shared_cache_uuid);
2797	int result = dyld_shared_cache_iterate_text(cur_shared_cache_uuid, ^(const dyld_shared_cache_dylib_text_info* info) {
2798			T_QUIET; T_ASSERT_LT(lib_index, uuid_count, "dyld_shared_cache_iterate_text exceeded number of libraries returned by kernel");
2799
2800			libs_found++;
2801			struct dyld_uuid_info_64 *cur_stackshot_uuid_entry = &uuids[lib_index];
2802			T_QUIET; T_ASSERT_EQ(memcmp(info->dylibUuid, cur_stackshot_uuid_entry->imageUUID, sizeof(info->dylibUuid)), 0,
2803					"dyld returned UUID doesn't match kernel returned UUID");
2804			T_QUIET; T_ASSERT_EQ(info->loadAddressUnslid, cur_stackshot_uuid_entry->imageLoadAddress,
2805					"dyld returned load address doesn't match kernel returned load address");
2806			lib_index++;
2807		});
2808
2809	T_ASSERT_EQ(result, 0, "iterate shared cache layout");
2810	T_ASSERT_EQ(libs_found, uuid_count, "dyld iterator returned same number of libraries as kernel");
2811
2812	T_LOG("verified %d libraries from dyld shared cache", libs_found);
2813}
2814
2815static void
2816check_shared_cache_uuid(uuid_t imageUUID)
2817{
2818	static uuid_t shared_cache_uuid;
2819	static dispatch_once_t read_shared_cache_uuid;
2820
2821	dispatch_once(&read_shared_cache_uuid, ^{
2822		T_QUIET;
2823		T_ASSERT_TRUE(_dyld_get_shared_cache_uuid(shared_cache_uuid), "retrieve current shared cache UUID");
2824	});
2825	T_QUIET; T_ASSERT_EQ(uuid_compare(shared_cache_uuid, imageUUID), 0,
2826			"dyld returned UUID doesn't match kernel returned UUID for system shared cache");
2827}
2828
2829/*
2830 * extra dictionary contains data relevant for the given flags:
2831 * PARSE_STACKSHOT_ZOMBIE:   zombie_child_pid_key -> @(pid)
2832 * PARSE_STACKSHOT_POSTEXEC: postexec_child_unique_pid_key -> @(unique_pid)
2833 */
2834static void
2835parse_stackshot(uint64_t stackshot_parsing_flags, void *ssbuf, size_t sslen, NSDictionary *extra)
2836{
2837	bool delta = (stackshot_parsing_flags & PARSE_STACKSHOT_DELTA);
2838	bool expect_sharedcache_child = (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_FLAGS);
2839	bool expect_zombie_child = (stackshot_parsing_flags & PARSE_STACKSHOT_ZOMBIE);
2840	bool expect_postexec_child = (stackshot_parsing_flags & PARSE_STACKSHOT_POSTEXEC);
2841	bool expect_cseg_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_CSEG);
2842	bool expect_translated_child = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSLATED);
2843	bool expect_shared_cache_layout = false;
2844	bool expect_shared_cache_uuid = !delta;
2845	bool expect_dispatch_queue_label = (stackshot_parsing_flags & PARSE_STACKSHOT_DISPATCH_QUEUE_LABEL);
2846	bool expect_turnstile_lock = (stackshot_parsing_flags & PARSE_STACKSHOT_TURNSTILEINFO);
2847	bool expect_srp_waitinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_WAITINFO_SRP);
2848	bool expect_sp_throttled = (stackshot_parsing_flags & PARSE_STACKSHOT_THROTTLED_SP);
2849	bool expect_exec_inprogress = (stackshot_parsing_flags & PARSE_STACKSHOT_EXEC_INPROGRESS);
2850	bool expect_transitioning_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TRANSITIONING);
2851	bool expect_asyncstack = (stackshot_parsing_flags & PARSE_STACKSHOT_ASYNCSTACK);
2852	bool expect_driverkit = (stackshot_parsing_flags & PARSE_STACKSHOT_DRIVERKIT);
2853	bool expect_suspendinfo = (stackshot_parsing_flags & PARSE_STACKSHOT_SUSPENDINFO);
2854	bool found_zombie_child = false, found_postexec_child = false, found_shared_cache_layout = false, found_shared_cache_uuid = false;
2855	bool found_translated_child = false, found_transitioning_task = false;
2856	bool found_dispatch_queue_label = false, found_turnstile_lock = false;
2857	bool found_cseg_waitinfo = false, found_srp_waitinfo = false;
2858	bool found_sharedcache_child = false, found_sharedcache_badflags = false, found_sharedcache_self = false;
2859	bool found_asyncstack = false;
2860	bool found_throttled_service = false;
2861	bool found_exclaves = false;
2862	bool expect_single_task = (stackshot_parsing_flags & PARSE_STACKSHOT_TARGETPID);
2863	uint64_t srp_expected_threadid = 0;
2864	pid_t zombie_child_pid = -1, srp_expected_pid = -1, sharedcache_child_pid = -1, throttled_service_ctx = -1;
2865	pid_t translated_child_pid = -1, transistioning_task_pid = -1;
2866	bool sharedcache_child_sameaddr = false, is_throttled = false;
2867	uint64_t postexec_child_unique_pid = 0, cseg_expected_threadid = 0;
2868	uint64_t sharedcache_child_flags = 0, sharedcache_self_flags = 0;
2869	uint64_t asyncstack_threadid = 0;
2870	NSArray *asyncstack_stack = nil;
2871	char *inflatedBufferBase = NULL;
2872	pid_t exec_inprogress_pid = -1;
2873	void (^exec_inprogress_cb)(uint64_t, uint64_t) = NULL;
2874	int exec_inprogress_found = 0;
2875	uint64_t exec_inprogress_containerid = 0;
2876	void (^driverkit_cb)(pid_t) = NULL;
2877	NSMutableDictionary *sharedCaches = [NSMutableDictionary new];
2878	uint64_t expected_num_threads = 0, expected_num_tasks = 0, found_percpu_threads = 0, found_tasks = 0, found_percpu_tasks = 0;
2879	NSMutableSet *seen_tasks = [NSMutableSet new];
2880
2881	if (expect_shared_cache_uuid) {
2882		uuid_t shared_cache_uuid;
2883		if (!_dyld_get_shared_cache_uuid(shared_cache_uuid)) {
2884			T_LOG("Skipping verifying shared cache UUID in stackshot data because not running with a shared cache");
2885			expect_shared_cache_uuid = false;
2886		}
2887	}
2888
2889	if (stackshot_parsing_flags & PARSE_STACKSHOT_SHAREDCACHE_LAYOUT) {
2890		size_t shared_cache_length = 0;
2891		const void *cache_header = _dyld_get_shared_cache_range(&shared_cache_length);
2892		T_QUIET; T_ASSERT_NOTNULL(cache_header, "current process running with shared cache");
2893		T_QUIET; T_ASSERT_GT(shared_cache_length, sizeof(struct _dyld_cache_header), "valid shared cache length populated by _dyld_get_shared_cache_range");
2894
2895		if (_dyld_shared_cache_is_locally_built()) {
2896			T_LOG("device running with locally built shared cache, expect shared cache layout");
2897			expect_shared_cache_layout = true;
2898		} else {
2899			T_LOG("device running with B&I built shared-cache, no shared cache layout expected");
2900		}
2901	}
2902
2903	if (expect_sharedcache_child) {
2904		NSNumber* pid_num = extra[sharedcache_child_pid_key];
2905		NSNumber* sameaddr_num = extra[sharedcache_child_sameaddr_key];
2906		T_QUIET; T_ASSERT_NOTNULL(pid_num, "sharedcache child pid provided");
2907		T_QUIET; T_ASSERT_NOTNULL(sameaddr_num, "sharedcache child addrsame provided");
2908		sharedcache_child_pid = [pid_num intValue];
2909		T_QUIET; T_ASSERT_GT(sharedcache_child_pid, 0, "sharedcache child pid greater than zero");
2910		sharedcache_child_sameaddr = [sameaddr_num intValue];
2911		T_QUIET; T_ASSERT_GE([sameaddr_num intValue], 0, "sharedcache child sameaddr is boolean (0 or 1)");
2912		T_QUIET; T_ASSERT_LE([sameaddr_num intValue], 1, "sharedcache child sameaddr is boolean (0 or 1)");
2913	}
2914
2915    if (expect_transitioning_task) {
2916        NSNumber* pid_num = extra[transitioning_pid_key];
2917        T_ASSERT_NOTNULL(pid_num, "transitioning task pid provided");
2918        transistioning_task_pid = [pid_num intValue];
2919    }
2920
2921	if (expect_zombie_child) {
2922		NSNumber* pid_num = extra[zombie_child_pid_key];
2923		T_QUIET; T_ASSERT_NOTNULL(pid_num, "zombie child pid provided");
2924		zombie_child_pid = [pid_num intValue];
2925		T_QUIET; T_ASSERT_GT(zombie_child_pid, 0, "zombie child pid greater than zero");
2926	}
2927
2928	if (expect_postexec_child) {
2929		NSNumber* unique_pid_num = extra[postexec_child_unique_pid_key];
2930		T_QUIET; T_ASSERT_NOTNULL(unique_pid_num, "postexec child unique pid provided");
2931		postexec_child_unique_pid = [unique_pid_num unsignedLongLongValue];
2932		T_QUIET; T_ASSERT_GT(postexec_child_unique_pid, 0ull, "postexec child unique pid greater than zero");
2933	}
2934
2935	if (expect_cseg_waitinfo) {
2936		NSNumber* tid_num = extra[cseg_expected_threadid_key];
2937		T_QUIET; T_ASSERT_NOTNULL(tid_num, "cseg's expected thread id provided");
2938		cseg_expected_threadid = tid_num.unsignedLongValue;
2939		T_QUIET; T_ASSERT_GT(cseg_expected_threadid, UINT64_C(0), "compressor segment thread is present");
2940	}
2941
2942	if (expect_srp_waitinfo) {
2943		NSNumber* threadid_num = extra[srp_expected_threadid_key];
2944		NSNumber* pid_num = extra[srp_expected_pid_key];
2945		T_QUIET; T_ASSERT_TRUE(threadid_num != nil || pid_num != nil, "expected SRP threadid or pid");
2946		if (threadid_num != nil) {
2947			srp_expected_threadid = [threadid_num unsignedLongLongValue];
2948			T_QUIET; T_ASSERT_GT(srp_expected_threadid, 0ull, "srp_expected_threadid greater than zero");
2949		}
2950		if (pid_num != nil) {
2951			srp_expected_pid = [pid_num intValue];
2952			T_QUIET; T_ASSERT_GT(srp_expected_pid, 0, "srp_expected_pid greater than zero");
2953		}
2954		T_LOG("looking for SRP pid: %d threadid: %llu", srp_expected_pid, srp_expected_threadid);
2955	}
2956
2957	if (expect_sp_throttled) {
2958		NSNumber* ctx = extra[sp_throttled_expected_ctxt_key];
2959		T_QUIET; T_ASSERT_TRUE(ctx != nil, "expected pid");
2960		throttled_service_ctx = [ctx intValue];
2961		T_QUIET; T_ASSERT_GT(throttled_service_ctx, 0, "expected pid greater than zero");
2962
2963		NSNumber *throttled = extra[sp_throttled_expect_flag];
2964		T_QUIET; T_ASSERT_TRUE(throttled != nil, "expected flag value");
2965		is_throttled = ([throttled intValue] != 0);
2966
2967		T_LOG("Looking for service with ctxt: %d, thottled:%d", throttled_service_ctx, is_throttled);
2968	}
2969
2970	if (expect_translated_child) {
2971		NSNumber* pid_num = extra[translated_child_pid_key];
2972		T_QUIET; T_ASSERT_NOTNULL(pid_num, "translated child pid provided");
2973		translated_child_pid = [pid_num intValue];
2974		T_QUIET; T_ASSERT_GT(translated_child_pid, 0, "translated child pid greater than zero");
2975	}
2976	if (expect_exec_inprogress) {
2977		NSNumber* pid_num = extra[exec_inprogress_pid_key];
2978		T_QUIET; T_ASSERT_NOTNULL(pid_num, "exec inprogress pid provided");
2979		exec_inprogress_pid = [pid_num intValue];
2980		T_QUIET; T_ASSERT_GT(exec_inprogress_pid, 0, "exec inprogress pid greater than zero");
2981
2982		exec_inprogress_cb = extra[exec_inprogress_found_key];
2983		T_QUIET; T_ASSERT_NOTNULL(exec_inprogress_cb, "exec inprogress found callback provided");
2984	}
2985	if (expect_driverkit) {
2986		driverkit_cb = extra[driverkit_found_key];
2987		T_QUIET; T_ASSERT_NOTNULL(driverkit_cb, "driverkit found callback provided");
2988	}
2989
2990	if (expect_asyncstack) {
2991		NSNumber* threadid_id = extra[asyncstack_expected_threadid_key];
2992		T_QUIET; T_ASSERT_NOTNULL(threadid_id, "asyncstack threadid provided");
2993		asyncstack_threadid = [threadid_id unsignedLongLongValue];
2994		asyncstack_stack = extra[asyncstack_expected_stack_key];
2995		T_QUIET; T_ASSERT_NOTNULL(asyncstack_stack, "asyncstack expected stack provided");
2996	}
2997
2998	kcdata_iter_t iter = kcdata_iter(ssbuf, sslen);
2999	if (delta) {
3000		T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_DELTA_STACKSHOT,
3001				"buffer provided is a delta stackshot");
3002
3003			iter = kcdata_iter_next(iter);
3004	} else {
3005		if (kcdata_iter_type(iter) != KCDATA_BUFFER_BEGIN_COMPRESSED) {
3006			T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT,
3007					"buffer provided is a stackshot");
3008
3009			iter = kcdata_iter_next(iter);
3010		} else {
3011			/* we are dealing with a compressed buffer */
3012			iter = kcdata_iter_next(iter);
3013			uint64_t compression_type = 0, totalout = 0, totalin = 0;
3014
3015			uint64_t *data;
3016			char *desc;
3017			for (int i = 0; i < 3; i ++) {
3018				kcdata_iter_get_data_with_desc(iter, &desc, (void **)&data, NULL);
3019				if (strcmp(desc, "kcd_c_type") == 0) {
3020					compression_type = *data;
3021				} else if (strcmp(desc, "kcd_c_totalout") == 0){
3022					totalout = *data;
3023				} else if (strcmp(desc, "kcd_c_totalin") == 0){
3024					totalin = *data;
3025				}
3026
3027				iter = kcdata_iter_next(iter);
3028			}
3029
3030			T_ASSERT_EQ(compression_type, UINT64_C(1), "zlib compression is used");
3031			T_ASSERT_GT(totalout, UINT64_C(0), "successfully gathered how long the compressed buffer is");
3032			T_ASSERT_GT(totalin, UINT64_C(0), "successfully gathered how long the uncompressed buffer will be at least");
3033
3034			/* progress to the next kcdata item */
3035			T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "compressed stackshot found");
3036
3037			char *bufferBase = kcdata_iter_payload(iter);
3038
3039			/*
3040			 * zlib is used, allocate a buffer based on the metadata, plus
3041			 * extra scratch space (+12.5%) in case totalin was inconsistent
3042			 */
3043			size_t inflatedBufferSize = totalin + (totalin >> 3);
3044			inflatedBufferBase = malloc(inflatedBufferSize);
3045			T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(inflatedBufferBase, "allocated temporary output buffer");
3046
3047			z_stream zs;
3048			memset(&zs, 0, sizeof(zs));
3049			T_QUIET; T_ASSERT_EQ(inflateInit(&zs), Z_OK, "inflateInit OK");
3050			zs.next_in = (unsigned char *)bufferBase;
3051			T_QUIET; T_ASSERT_LE(totalout, (uint64_t)UINT_MAX, "stackshot is not too large");
3052			zs.avail_in = (uInt)totalout;
3053			zs.next_out = (unsigned char *)inflatedBufferBase;
3054			T_QUIET; T_ASSERT_LE(inflatedBufferSize, (size_t)UINT_MAX, "output region is not too large");
3055			zs.avail_out = (uInt)inflatedBufferSize;
3056			T_ASSERT_EQ(inflate(&zs, Z_FINISH), Z_STREAM_END, "inflated buffer");
3057			inflateEnd(&zs);
3058
3059			T_ASSERT_EQ((uint64_t)zs.total_out, totalin, "expected number of bytes inflated");
3060
3061			/* copy the data after the compressed area */
3062			T_QUIET; T_ASSERT_GE((void *)bufferBase, ssbuf,
3063					"base of compressed stackshot is after the returned stackshot buffer");
3064			size_t header_size = (size_t)(bufferBase - (char *)ssbuf);
3065			size_t data_after_compressed_size = sslen - totalout - header_size;
3066			T_QUIET; T_ASSERT_LE(data_after_compressed_size,
3067					inflatedBufferSize - zs.total_out,
3068					"footer fits in the buffer");
3069			memcpy(inflatedBufferBase + zs.total_out,
3070					bufferBase + totalout,
3071					data_after_compressed_size);
3072
3073			iter = kcdata_iter(inflatedBufferBase, inflatedBufferSize);
3074		}
3075	}
3076
3077	KCDATA_ITER_FOREACH(iter) {
3078		NSError *error = nil;
3079
3080		switch (kcdata_iter_type(iter)) {
3081		case KCDATA_TYPE_ARRAY: {
3082			T_QUIET;
3083			T_ASSERT_TRUE(kcdata_iter_array_valid(iter),
3084					"checked that array is valid");
3085
3086			NSMutableDictionary *array = parseKCDataArray(iter, &error);
3087			T_QUIET; T_ASSERT_NOTNULL(array, "parsed array from stackshot");
3088			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing array");
3089
3090			if (kcdata_iter_array_elem_type(iter) == STACKSHOT_KCTYPE_SYS_SHAREDCACHE_LAYOUT) {
3091				struct dyld_uuid_info_64 *shared_cache_uuids = kcdata_iter_payload(iter);
3092				uint32_t uuid_count = kcdata_iter_array_elem_count(iter);
3093				T_ASSERT_NOTNULL(shared_cache_uuids, "parsed shared cache layout array");
3094				T_ASSERT_GT(uuid_count, 0, "returned valid number of UUIDs from shared cache");
3095				verify_stackshot_sharedcache_layout(shared_cache_uuids, uuid_count);
3096				found_shared_cache_layout = true;
3097			}
3098
3099			break;
3100		}
3101		case KCDATA_TYPE_CONTAINER_BEGIN: {
3102			T_QUIET;
3103			T_ASSERT_TRUE(kcdata_iter_container_valid(iter),
3104					"checked that container is valid");
3105
3106			uint64_t containerid = kcdata_iter_container_id(iter);
3107			uint32_t container_type = kcdata_iter_container_type(iter);
3108
3109			if (container_type == STACKSHOT_KCCONTAINER_SHAREDCACHE) {
3110				NSDictionary *container = parseKCDataContainer(&iter, &error);
3111				T_QUIET; T_ASSERT_NOTNULL(container, "parsed sharedcache container from stackshot");
3112				T_QUIET; T_ASSERT_NULL(error, "error unset after parsing sharedcache container");
3113				T_QUIET; T_EXPECT_EQ(sharedCaches[@(containerid)], nil, "sharedcache containerid %lld should be unique", containerid);
3114				sharedCaches[@(containerid)] = container;
3115				break;
3116			}
3117
3118			if (container_type == STACKSHOT_KCCONTAINER_EXCLAVES) {
3119				found_exclaves = true;
3120				break;
3121			}
3122
3123			/*
3124			 * treat containers other than tasks/transitioning_tasks
3125			 * as expanded in-line.
3126			 */
3127			if (container_type != STACKSHOT_KCCONTAINER_TASK &&
3128			    container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK) {
3129				T_LOG("container skipped: %d", container_type);
3130				break;
3131			}
3132			NSDictionary *container = parseKCDataContainer(&iter, &error);
3133			T_QUIET; T_ASSERT_NOTNULL(container, "parsed task/transitioning_task container from stackshot");
3134			T_QUIET; T_ASSERT_NULL(error, "error unset after parsing container");
3135
3136			found_tasks++;
3137
3138			NSDictionary* task_snapshot = container[@"task_snapshots"][@"task_snapshot"];
3139			NSDictionary* task_delta_snapshot = container[@"task_snapshots"][@"task_delta_snapshot"];
3140			NSDictionary* transitioning_task_snapshot = container[@"transitioning_task_snapshots"][@"transitioning_task_snapshot"];
3141
3142			NSNumber *task_pid = NULL;
3143			if (task_snapshot) {
3144				task_pid = task_snapshot[@"ts_unique_pid"];
3145			} else if(task_delta_snapshot) {
3146				task_pid = task_snapshot[@"tds_unique_pid"];
3147			} else if(transitioning_task_snapshot) {
3148				task_pid = transitioning_task_snapshot[@"tts_pid"];
3149			}
3150
3151			if (task_pid && [seen_tasks containsObject:task_pid]) {
3152				T_QUIET; T_ASSERT_FALSE([seen_tasks containsObject:task_pid], "No duplicate PIDs in stackshot");
3153				[seen_tasks addObject:task_pid];
3154			}
3155
3156			/*
3157			 * Having processed the container, we now only check it
3158			 * if it's the correct type.
3159			 */
3160			if ((!expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TASK)) ||
3161			    (expect_transitioning_task && (container_type != STACKSHOT_KCCONTAINER_TRANSITIONING_TASK))) {
3162				break;
3163			}
3164			if (!expect_transitioning_task) {
3165			    	T_QUIET; T_ASSERT_TRUE(!!task_snapshot != !!task_delta_snapshot, "Either task_snapshot xor task_delta_snapshot provided");
3166			}
3167
3168			if (expect_dispatch_queue_label && !found_dispatch_queue_label) {
3169				for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) {
3170					NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key];
3171					NSString *dql = thread[@"dispatch_queue_label"];
3172
3173					if ([dql isEqualToString:@TEST_STACKSHOT_QUEUE_LABEL]) {
3174						found_dispatch_queue_label = true;
3175						break;
3176					}
3177				}
3178			}
3179
3180			if (expect_transitioning_task && !found_transitioning_task) {
3181				if (transitioning_task_snapshot) {
3182					uint64_t the_pid = [transitioning_task_snapshot[@"tts_pid"] unsignedLongLongValue];
3183					if (the_pid == (uint64_t)transistioning_task_pid) {
3184					    found_transitioning_task = true;
3185
3186					    T_PASS("FOUND Transitioning task %llu has a transitioning task snapshot", (uint64_t) transistioning_task_pid);
3187					    break;
3188					}
3189				}
3190			}
3191
3192			if (expect_postexec_child && !found_postexec_child) {
3193				if (task_snapshot) {
3194					uint64_t unique_pid = [task_snapshot[@"ts_unique_pid"] unsignedLongLongValue];
3195					if (unique_pid == postexec_child_unique_pid) {
3196						found_postexec_child = true;
3197
3198						T_PASS("post-exec child %llu has a task snapshot", postexec_child_unique_pid);
3199
3200						break;
3201					}
3202				}
3203
3204				if (task_delta_snapshot) {
3205					uint64_t unique_pid = [task_delta_snapshot[@"tds_unique_pid"] unsignedLongLongValue];
3206					if (unique_pid == postexec_child_unique_pid) {
3207						found_postexec_child = true;
3208
3209						T_FAIL("post-exec child %llu shouldn't have a delta task snapshot", postexec_child_unique_pid);
3210
3211						break;
3212					}
3213				}
3214			}
3215
3216			int pid = [task_snapshot[@"ts_pid"] intValue];
3217
3218			if (pid && expect_shared_cache_uuid && !found_shared_cache_uuid) {
3219				id ptr = container[@"task_snapshots"][@"shared_cache_dyld_load_info"];
3220				if (ptr) {
3221					id uuid = ptr[@"imageUUID"];
3222
3223					uint8_t uuid_p[16];
3224					for (unsigned int i = 0; i < 16; i ++) {
3225						NSNumber *uuidByte = uuid[i];
3226						uuid_p[i] = (uint8_t)uuidByte.charValue;
3227					}
3228
3229					check_shared_cache_uuid(uuid_p);
3230
3231					uint64_t baseAddress = (uint64_t)((NSNumber *)ptr[@"imageSlidBaseAddress"]).longLongValue;
3232					uint64_t firstMapping = (uint64_t)((NSNumber *)ptr[@"sharedCacheSlidFirstMapping"]).longLongValue;
3233
3234					T_EXPECT_LE(baseAddress, firstMapping,
3235						"in per-task shared_cache_dyld_load_info, "
3236						"baseAddress <= firstMapping");
3237					T_EXPECT_GE(baseAddress + (7ull << 32) + (1ull << 29),
3238						firstMapping,
3239						"in per-task shared_cache_dyld_load_info, "
3240						"baseAddress + 28.5gig >= firstMapping");
3241
3242					size_t shared_cache_len;
3243					const void *addr = _dyld_get_shared_cache_range(&shared_cache_len);
3244					T_EXPECT_EQ((uint64_t)addr, firstMapping,
3245							"SlidFirstMapping should match shared_cache_range");
3246
3247					/*
3248					 * check_shared_cache_uuid() will assert on failure, so if
3249					 * we get here, then we have found the shared cache UUID
3250					 * and it's correct
3251					 */
3252					found_shared_cache_uuid = true;
3253				}
3254			}
3255
3256			if (expect_sharedcache_child) {
3257				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3258				uint64_t sharedregion_flags = (task_flags & (kTaskSharedRegionNone | kTaskSharedRegionSystem | kTaskSharedRegionOther));
3259				id sharedregion_info = container[@"task_snapshots"][@"shared_cache_dyld_load_info"];
3260				id sharedcache_id = container[@"task_snapshots"][@"sharedCacheID"];
3261				if (!found_sharedcache_badflags) {
3262					T_QUIET; T_EXPECT_NE(sharedregion_flags, 0ll, "one of the kTaskSharedRegion flags should be set on all tasks");
3263					bool multiple = (sharedregion_flags & (sharedregion_flags - 1)) != 0;
3264					T_QUIET; T_EXPECT_FALSE(multiple, "only one kTaskSharedRegion flag should be set on each task");
3265					found_sharedcache_badflags = (sharedregion_flags == 0 || multiple);
3266				}
3267				if (pid == 0) {
3268					T_ASSERT_EQ(sharedregion_flags, (uint64_t)kTaskSharedRegionNone, "Kernel proc (pid 0) should have no shared region");
3269				} else if (pid == sharedcache_child_pid) {
3270					found_sharedcache_child = true;
3271					sharedcache_child_flags = sharedregion_flags;
3272				} else if (pid == getpid()) {
3273					found_sharedcache_self = true;
3274					sharedcache_self_flags = sharedregion_flags;
3275				}
3276				if (sharedregion_flags == kTaskSharedRegionOther && !(task_flags & kTaskSharedRegionInfoUnavailable)) {
3277					T_QUIET; T_EXPECT_NOTNULL(sharedregion_info, "kTaskSharedRegionOther should have a shared_cache_dyld_load_info struct");
3278					T_QUIET; T_EXPECT_NOTNULL(sharedcache_id, "kTaskSharedRegionOther should have a sharedCacheID");
3279					if (sharedcache_id != nil) {
3280						T_QUIET; T_EXPECT_NOTNULL(sharedCaches[sharedcache_id], "sharedCacheID %d should exist", [sharedcache_id intValue]);
3281					}
3282				} else {
3283					T_QUIET; T_EXPECT_NULL(sharedregion_info, "non-kTaskSharedRegionOther should have no shared_cache_dyld_load_info struct");
3284					T_QUIET; T_EXPECT_NULL(sharedcache_id, "non-kTaskSharedRegionOther should have no sharedCacheID");
3285				}
3286			}
3287
3288			if (expect_zombie_child && (pid == zombie_child_pid)) {
3289				found_zombie_child = true;
3290
3291				expected_num_tasks += 1;
3292
3293				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3294				T_ASSERT_TRUE((task_flags & kTerminatedSnapshot) == kTerminatedSnapshot, "child zombie marked as terminated");
3295
3296				continue;
3297			}
3298
3299			if (expect_translated_child && (pid == translated_child_pid)) {
3300				found_translated_child = true;
3301
3302				uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3303				T_EXPECT_BITS_SET(task_flags, kTaskIsTranslated, "child marked as translated");
3304
3305				continue;
3306			}
3307			if (expect_exec_inprogress && (pid == exec_inprogress_pid || pid == -exec_inprogress_pid)) {
3308				exec_inprogress_found++;
3309				T_LOG("found exec task with pid %d, instance %d", pid, exec_inprogress_found);
3310				T_QUIET; T_ASSERT_LE(exec_inprogress_found, 2, "no more than two with the expected pid");
3311				if (exec_inprogress_found == 2) {
3312					T_LOG("found 2 tasks with pid %d", exec_inprogress_pid);
3313					exec_inprogress_cb(containerid, exec_inprogress_containerid);
3314				} else {
3315					exec_inprogress_containerid = containerid;
3316				}
3317			}
3318			if (expect_driverkit && driverkit_cb != NULL) {
3319				driverkit_cb(pid);
3320			}
3321			if (expect_cseg_waitinfo) {
3322				NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"];
3323
3324				for (id i in winfos) {
3325					NSNumber *waitType = i[@"wait_type"];
3326					NSNumber *owner = i[@"owner"];
3327					if (waitType.intValue == kThreadWaitCompressor &&
3328							owner.unsignedLongValue == cseg_expected_threadid) {
3329						found_cseg_waitinfo = true;
3330						break;
3331					}
3332				}
3333			}
3334
3335			if (expect_srp_waitinfo) {
3336				NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3337				NSArray *winfos = container[@"task_snapshots"][@"thread_waitinfo"];
3338				for (id i in tinfos) {
3339					if (!found_srp_waitinfo) {
3340						bool found_thread = false;
3341						bool found_pid = false;
3342						if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_THREAD) &&
3343						    [i[@"turnstile_context"] unsignedLongLongValue] == srp_expected_threadid &&
3344						    srp_expected_threadid != 0) {
3345							found_thread = true;
3346						}
3347						if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_BLOCKED_ON_TASK) &&
3348						    [i[@"turnstile_context"] intValue] == srp_expected_pid &&
3349						    srp_expected_pid != -1) {
3350							found_pid = true;
3351						}
3352						if (found_pid || found_thread) {
3353							T_LOG("found SRP %s %lld waiter: %d", (found_thread ? "thread" : "pid"),
3354							    [i[@"turnstile_context"] unsignedLongLongValue], [i[@"waiter"] intValue]);
3355							/* we found something that is blocking the correct threadid */
3356							for (id j in winfos) {
3357								if ([j[@"waiter"] intValue] == [i[@"waiter"] intValue] &&
3358								    [j[@"wait_type"] intValue] == kThreadWaitPortReceive) {
3359									found_srp_waitinfo = true;
3360									T_EXPECT_EQ([j[@"wait_flags"] intValue], STACKSHOT_WAITINFO_FLAGS_SPECIALREPLY,
3361									    "SRP waitinfo should be marked as a special reply");
3362									break;
3363								}
3364							}
3365
3366							if (found_srp_waitinfo) {
3367								break;
3368							}
3369						}
3370					}
3371				}
3372			}
3373
3374			if (expect_sp_throttled) {
3375				NSArray *tinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3376				for (id i in tinfos) {
3377					if (([i[@"turnstile_flags"] intValue] & STACKSHOT_TURNSTILE_STATUS_PORTFLAGS)
3378						&& [i[@"turnstile_context"] intValue] == throttled_service_ctx) {
3379						int portlabel_id = [i[@"portlabel_id"] intValue];
3380						T_LOG("[pid:%d] Turnstile (flags = 0x%x, ctx = %d, portlabel_id = %d)", pid,
3381							[i[@"turnstile_flags"] intValue], [i[@"turnstile_context"] intValue], portlabel_id);
3382						for (id portid in container[@"task_snapshots"][@"portlabels"]) {
3383							if (portlabel_id != [portid intValue]) {
3384								continue;
3385							}
3386
3387							NSMutableDictionary *portlabel = container[@"task_snapshots"][@"portlabels"][portid];
3388							T_ASSERT_TRUE(portlabel != nil, "Found portlabel id: %d", [portid intValue]);
3389							NSString *portlabel_name = portlabel[@"portlabel_name"];
3390							T_EXPECT_TRUE(portlabel_name != nil, "Found portlabel %s", portlabel_name.UTF8String);
3391							T_EXPECT_EQ_STR(portlabel_name.UTF8String, THROTTLED_SERVICE_NAME, "throttled service port name matches");
3392							T_EXPECT_EQ(([portlabel[@"portlabel_flags"] intValue] & STACKSHOT_PORTLABEL_THROTTLED) != 0,
3393								is_throttled, "Port %s throttled", is_throttled ? "is" : "isn't");
3394							found_throttled_service = true;
3395							break;
3396						}
3397					}
3398
3399					if (found_throttled_service) {
3400						break;
3401					}
3402				}
3403			}
3404
3405			if (expect_suspendinfo) {
3406				// TODO: rdar://112563110
3407			}
3408
3409
3410			if (pid != getpid()) {
3411				break;
3412			}
3413
3414			T_EXPECT_EQ_STR(current_process_name(),
3415					[task_snapshot[@"ts_p_comm"] UTF8String],
3416					"current process name matches in stackshot");
3417
3418			uint64_t task_flags = [task_snapshot[@"ts_ss_flags"] unsignedLongLongValue];
3419			T_ASSERT_BITS_NOTSET(task_flags, kTerminatedSnapshot, "current process not marked as terminated");
3420			T_ASSERT_BITS_NOTSET(task_flags, kTaskIsTranslated, "current process not marked as translated");
3421
3422			T_QUIET;
3423			T_EXPECT_LE(pid, [task_snapshot[@"ts_unique_pid"] intValue],
3424					"unique pid is greater than pid");
3425
3426			NSDictionary* task_cpu_architecture = container[@"task_snapshots"][@"task_cpu_architecture"];
3427			T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cputype"], "have cputype");
3428			T_QUIET; T_ASSERT_NOTNULL(task_cpu_architecture[@"cpusubtype"], "have cputype");
3429			int cputype = [task_cpu_architecture[@"cputype"] intValue];
3430			int cpusubtype = [task_cpu_architecture[@"cpusubtype"] intValue];
3431
3432			struct proc_archinfo archinfo;
3433			int retval = proc_pidinfo(pid, PROC_PIDARCHINFO, 0, &archinfo, sizeof(archinfo));
3434			T_QUIET; T_WITH_ERRNO; T_ASSERT_GT(retval, 0, "proc_pidinfo(PROC_PIDARCHINFO) returned a value > 0");
3435			T_QUIET; T_ASSERT_EQ(retval, (int)sizeof(struct proc_archinfo), "proc_pidinfo call for PROC_PIDARCHINFO returned expected size");
3436			T_QUIET; T_EXPECT_EQ(cputype, archinfo.p_cputype, "cpu type is correct");
3437			T_QUIET; T_EXPECT_EQ(cpusubtype, archinfo.p_cpusubtype, "cpu subtype is correct");
3438
3439			NSDictionary * codesigning_info = container[@"task_snapshots"][@"stackshot_task_codesigning_info"];
3440			T_QUIET; T_ASSERT_NOTNULL(codesigning_info[@"csflags"], "have csflags");
3441			uint64_t flags = [codesigning_info[@"csflags"] unsignedLongLongValue];
3442			T_QUIET; T_EXPECT_GT(flags, 0, "nonzero csflags");
3443
3444			T_QUIET; T_ASSERT_NOTNULL(container[@"task_snapshots"][@"jetsam_coalition"], "have jetsam coalition");
3445			uint64_t jetsam_coalition = [container[@"task_snapshots"][@"jetsam_coalition"] unsignedLongLongValue];
3446			T_QUIET; T_EXPECT_GT(jetsam_coalition, 0, "nonzero jetsam coalition");
3447
3448			bool found_main_thread = false;
3449			uint64_t main_thread_id = -1ULL;
3450			bool found_null_kernel_frame = false;
3451			for (id thread_key in container[@"task_snapshots"][@"thread_snapshots"]) {
3452				NSMutableDictionary *thread = container[@"task_snapshots"][@"thread_snapshots"][thread_key];
3453				NSDictionary *thread_snap = thread[@"thread_snapshot"];
3454
3455				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_thread_id"] intValue], 0,
3456						"thread ID of thread in current task is valid");
3457				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_base_priority"] intValue], 0,
3458						"base priority of thread in current task is valid");
3459				T_QUIET; T_EXPECT_GT([thread_snap[@"ths_sched_priority"] intValue], 0,
3460						"scheduling priority of thread in current task is valid");
3461
3462				NSString *pth_name = thread[@"pth_name"];
3463				if (pth_name != nil && [pth_name isEqualToString:@TEST_THREAD_NAME]) {
3464					found_main_thread = true;
3465					main_thread_id = [thread_snap[@"ths_thread_id"] unsignedLongLongValue];
3466
3467					T_QUIET; T_EXPECT_GT([thread_snap[@"ths_total_syscalls"] intValue], 0,
3468							"total syscalls of current thread is valid");
3469
3470					NSDictionary *cpu_times = thread[@"cpu_times"];
3471					T_EXPECT_GE([cpu_times[@"runnable_time"] intValue],
3472							[cpu_times[@"system_time"] intValue] +
3473							[cpu_times[@"user_time"] intValue],
3474							"runnable time of current thread is valid");
3475				}
3476				if (!found_null_kernel_frame) {
3477					for (NSNumber *frame in thread[@"kernel_frames"]) {
3478						if (frame.unsignedLongValue == 0) {
3479							found_null_kernel_frame = true;
3480							break;
3481						}
3482					}
3483				}
3484				if (expect_asyncstack && !found_asyncstack &&
3485				    asyncstack_threadid == [thread_snap[@"ths_thread_id"] unsignedLongLongValue]) {
3486					found_asyncstack = true;
3487					NSArray* async_stack = thread[@"user_async_stack_frames"];
3488					NSNumber* start_idx = thread[@"user_async_start_index"];
3489					NSArray* user_stack = thread[@"user_stack_frames"];
3490					T_QUIET; T_ASSERT_NOTNULL(async_stack, "async thread %#llx has user_async_stack_frames", asyncstack_threadid);
3491					T_QUIET; T_ASSERT_NOTNULL(start_idx, "async thread %#llx has user_async_start_index", asyncstack_threadid);
3492					T_QUIET; T_ASSERT_NOTNULL(user_stack, "async thread %#llx has user_stack_frames", asyncstack_threadid);
3493					T_QUIET; T_ASSERT_EQ(async_stack.count, asyncstack_stack.count,
3494						"actual async_stack count == expected async_stack count");
3495					for (size_t i = 0; i < async_stack.count; i++) {
3496						T_EXPECT_EQ([async_stack[i][@"lr"] unsignedLongLongValue],
3497							[asyncstack_stack[i] unsignedLongLongValue], "frame %zu matches", i);
3498					}
3499				}
3500			}
3501			T_EXPECT_TRUE(found_main_thread, "found main thread for current task in stackshot");
3502			T_EXPECT_FALSE(found_null_kernel_frame, "should not see any NULL kernel frames");
3503
3504			if (expect_turnstile_lock && !found_turnstile_lock) {
3505				NSArray *tsinfos = container[@"task_snapshots"][@"thread_turnstileinfo"];
3506
3507				for (id i in tsinfos) {
3508					if ([i[@"turnstile_context"] unsignedLongLongValue] == main_thread_id) {
3509						found_turnstile_lock = true;
3510						break;
3511					}
3512				}
3513			}
3514			break;
3515		}
3516		case STACKSHOT_KCTYPE_SHAREDCACHE_LOADINFO: {
3517			// Legacy shared cache info
3518			struct dyld_shared_cache_loadinfo *payload = kcdata_iter_payload(iter);
3519			T_ASSERT_EQ((size_t)kcdata_iter_size(iter), sizeof(*payload), "valid dyld_shared_cache_loadinfo struct");
3520
3521			check_shared_cache_uuid(payload->sharedCacheUUID);
3522
3523			T_EXPECT_LE(payload->sharedCacheUnreliableSlidBaseAddress,
3524				payload->sharedCacheSlidFirstMapping,
3525				"SlidBaseAddress <= SlidFirstMapping");
3526			T_EXPECT_GE(payload->sharedCacheUnreliableSlidBaseAddress + (7ull << 32) + (1ull << 29),
3527				payload->sharedCacheSlidFirstMapping,
3528				"SlidFirstMapping should be within 28.5gigs of SlidBaseAddress");
3529
3530			size_t shared_cache_len;
3531			const void *addr = _dyld_get_shared_cache_range(&shared_cache_len);
3532			T_EXPECT_EQ((uint64_t)addr, payload->sharedCacheSlidFirstMapping,
3533			    "SlidFirstMapping should match shared_cache_range");
3534
3535			/*
3536			 * check_shared_cache_uuid() asserts on failure, so we must have
3537			 * found the shared cache UUID to be correct.
3538			 */
3539			found_shared_cache_uuid = true;
3540			break;
3541		}
3542		case KCDATA_TYPE_UINT64_DESC: {
3543			char     *desc;
3544			uint64_t *data;
3545			uint32_t  size;
3546			kcdata_iter_get_data_with_desc(iter, &desc, &data, &size);
3547
3548			if (strcmp(desc, "stackshot_tasks_count") == 0) {
3549				expected_num_tasks = *data;
3550			} else if (strcmp(desc, "stackshot_threads_count") == 0) {
3551				expected_num_threads = *data;
3552			}
3553
3554			break;
3555		}
3556		case STACKSHOT_KCTYPE_LATENCY_INFO_CPU: {
3557			struct stackshot_latency_cpu *cpu_latency = kcdata_iter_payload(iter);
3558			found_percpu_tasks += cpu_latency->tasks_processed;
3559			found_percpu_threads += cpu_latency->threads_processed;
3560			break;
3561		}
3562		}
3563	}
3564
3565	if (expect_sharedcache_child) {
3566		T_QUIET; T_ASSERT_TRUE(found_sharedcache_child, "found sharedcache child in kcdata");
3567		T_QUIET; T_ASSERT_TRUE(found_sharedcache_self, "found self in kcdata");
3568		if (found_sharedcache_child && found_sharedcache_self) {
3569			T_QUIET; T_ASSERT_NE(sharedcache_child_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache child should have shared region");
3570			T_QUIET; T_ASSERT_NE(sharedcache_self_flags, (uint64_t)kTaskSharedRegionNone, "sharedcache: self should have shared region");
3571			if (sharedcache_self_flags == kTaskSharedRegionSystem && !sharedcache_child_sameaddr) {
3572				/* If we're in the system shared region, and the child has a different address, child must have an Other shared region */
3573				T_ASSERT_EQ(sharedcache_child_flags, (uint64_t)kTaskSharedRegionOther,
3574				    "sharedcache child should have Other shared region");
3575			}
3576		}
3577	}
3578
3579	if (expect_transitioning_task) {
3580		T_QUIET; T_ASSERT_TRUE(found_transitioning_task, "found transitioning_task child in kcdata");
3581	}
3582
3583	if (expect_exec_inprogress) {
3584		T_QUIET; T_ASSERT_GT(exec_inprogress_found, 0, "found at least 1 task for execing process");
3585	}
3586
3587	if (expect_zombie_child) {
3588		T_QUIET; T_ASSERT_TRUE(found_zombie_child, "found zombie child in kcdata");
3589	}
3590
3591	if (expect_postexec_child) {
3592		T_QUIET; T_ASSERT_TRUE(found_postexec_child, "found post-exec child in kcdata");
3593	}
3594
3595	if (expect_translated_child) {
3596		T_QUIET; T_ASSERT_TRUE(found_translated_child, "found translated child in kcdata");
3597	}
3598
3599	if (expect_shared_cache_layout) {
3600		T_QUIET; T_ASSERT_TRUE(found_shared_cache_layout, "shared cache layout found in kcdata");
3601	}
3602
3603	if (expect_shared_cache_uuid) {
3604		T_QUIET; T_ASSERT_TRUE(found_shared_cache_uuid, "shared cache UUID found in kcdata");
3605	}
3606
3607	if (expect_dispatch_queue_label) {
3608		T_QUIET; T_ASSERT_TRUE(found_dispatch_queue_label, "dispatch queue label found in kcdata");
3609	}
3610
3611	if (expect_turnstile_lock) {
3612		T_QUIET; T_ASSERT_TRUE(found_turnstile_lock, "found expected deadlock");
3613	}
3614
3615	if (expect_cseg_waitinfo) {
3616		T_QUIET; T_ASSERT_TRUE(found_cseg_waitinfo, "found c_seg waitinfo");
3617	}
3618
3619	if (expect_srp_waitinfo) {
3620		T_QUIET; T_ASSERT_TRUE(found_srp_waitinfo, "found special reply port waitinfo");
3621	}
3622
3623	if (expect_sp_throttled) {
3624		T_QUIET; T_ASSERT_TRUE(found_throttled_service, "found the throttled service");
3625	}
3626
3627	if (expect_asyncstack) {
3628		T_QUIET; T_ASSERT_TRUE(found_asyncstack, "found async stack threadid");
3629	}
3630
3631	if ([extra objectForKey:no_exclaves_key] != nil) {
3632		T_QUIET; T_ASSERT_FALSE(found_exclaves, "did not find any Exclaves data");
3633	}
3634
3635
3636	bool check_counts = !delta && !found_transitioning_task && !expect_single_task && !expect_driverkit;
3637
3638	if (check_counts && (expected_num_threads != 0) && (found_percpu_threads != 0)) {
3639		/* If the task counts below check out, we can be sure that the per-cpu reported thread counts are accurate. */
3640		T_QUIET; T_ASSERT_EQ_ULLONG(found_percpu_threads, expected_num_threads, "number of threads reported by CPUs matches expected count");
3641	}
3642
3643	if (check_counts && (expected_num_tasks != 0)) {
3644		T_QUIET; T_ASSERT_EQ_ULLONG(found_tasks, expected_num_tasks, "number of tasks in kcdata matches expected count");
3645		if (found_percpu_tasks != 0) {
3646			T_QUIET; T_ASSERT_EQ_ULLONG(found_percpu_tasks, expected_num_tasks, "number of tasks reported by CPUs matches expected count");
3647		}
3648	}
3649
3650	T_ASSERT_FALSE(KCDATA_ITER_FOREACH_FAILED(iter), "successfully iterated kcdata");
3651
3652	free(inflatedBufferBase);
3653}
3654
3655static const char *
3656current_process_name(void)
3657{
3658	static char name[64];
3659
3660	if (!name[0]) {
3661		int ret = proc_name(getpid(), name, sizeof(name));
3662		T_QUIET;
3663		T_ASSERT_POSIX_SUCCESS(ret, "proc_name failed for current process");
3664	}
3665
3666	return name;
3667}
3668
3669static void
3670initialize_thread(void)
3671{
3672	int ret = pthread_setname_np(TEST_THREAD_NAME);
3673	T_QUIET;
3674	T_ASSERT_POSIX_ZERO(ret, "set thread name to %s", TEST_THREAD_NAME);
3675}
3676
3677T_DECL(dirty_buffer, "test that stackshot works with a dirty input buffer from kernel", T_META_TAG_VM_PREFERRED)
3678{
3679	const char *test_sysctl = "stackshot_dirty_buffer";
3680	int64_t result;
3681
3682	T_LOG("running sysctl to trigger kernel-driven stackshot");
3683	result = run_sysctl_test(test_sysctl, 0);
3684	T_ASSERT_EQ_LLONG(result, 1, "sysctl result indicated success");
3685}
3686
3687T_DECL(kernel_initiated, "smoke test that stackshot works with kernel-initiated stackshots", T_META_TAG_VM_PREFERRED)
3688{
3689	const char *test_sysctl = "stackshot_kernel_initiator";
3690	int64_t result;
3691	__block bool did_get_stackshot = false;
3692
3693	initialize_thread(); // must run before the stackshots to keep parse_stackshot happy
3694
3695	T_LOG("running sysctl to trigger kernel-driven stackshot type 1");
3696	result = run_sysctl_test(test_sysctl, 1);
3697	T_ASSERT_EQ_LLONG(result, 1, "sysctl result indicated success");
3698
3699	T_LOG("running sysctl to trigger kernel-driven stackshot type 2");
3700	result = run_sysctl_test(test_sysctl, 2);
3701	T_ASSERT_EQ_LLONG(result, 1, "sysctl result indicated success");
3702
3703	struct scenario scenario = {
3704		.name = "from_kernel_initiated",
3705		.flags = STACKSHOT_RETRIEVE_EXISTING_BUFFER,
3706	};
3707
3708	T_LOG("attempting to fetch stored in-kernel stackshot");
3709	take_stackshot(&scenario, false, ^(void *ssbuf, size_t sslen) {
3710		T_ASSERT_NOTNULL(ssbuf, "non-null kernel stackshot");
3711		T_ASSERT_GT(sslen, 0, "non-zero stackshot size");
3712		parse_stackshot(0, ssbuf, sslen, nil);
3713		did_get_stackshot = true;
3714	});
3715
3716	T_ASSERT_TRUE(did_get_stackshot, "got stackshot from kernel type 2");
3717}
3718